avatar

VeXation

Switching to QEMU

Setting up a Win95 dev VM in QEMU.

Don't be suspicious

Redirecting control-flow back to an infected program’s original entry-point.

Using kernel32.dll exports like a virus

Dynamically finding the Win95 kernel32.dll base address and exported APIs.

Delta Offsets

Using the “delta offset” approach to make the PE infector virus position independent.

PE File Infector Basics

Starting on an x86 virus that can inject new sections into PE executables.

Getting set up

Setting up Win95, file sharing, and Borland Turbo Assembler 5.0

Let's write a virus

A trip back to the 1990s and a journey into Win95 virus development.