旼컴컴컴컴컴컴컴컴컴컴컴컴컴� � �袴� �袴� �袴� �藁敲 � Utilities for � � 藁 � � �袴� � � antivirus � 훤暠 훤暠 훤苦� 菰� � researchers. 旼좔컴컴컴컴컴컴컴컴컴컴컴컴컴좔컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� � � � GOAT File Creator Package, Version 3.0 � � (c) MIG, Igor G. Muttik, 1994 � � � 읕컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 旼컴컴컴� 쿛URPOSE� 컴좔컴컴컴좔컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 Programs of the GOAT package (GOAT.COM, GOATS.COM, FLOCK.COM, GOATSET.BAT, and RUN-ALL.BAT) are made for the antivirus researchers. The files of this package produce executable victim file(s) (COM, EXE or SYS), typically called "sacrificial goat file(s)". These output files are used as a baits for the viruses. The purpose of the programs can be explained using the following diagram: �袴袴袴袴袴� 旼컴컴컴컴컴컴컴컴컴컴커 � Goats 픔컴컫캑 You need a goat file � 旼컴컴컴컴컴컴커 � creation � � � with some special 쳐컴컴컴� use GOAT.COM � � task � � � internal structure. � 읕컴컴컴컴컴컴켸 훤袴袴袴袴暠 � 읕컴컴컴컴컴컴컴컴컴컴켸 � 旼컴컴컴컴컴컴컴컴컴컴컴컴� � � You need a series of � 旼컴컴컴컴컴컴컴� 쳐� goat files of different 쳐컴� use GOATS.COM � � � sizes. � 읕컴컴컴컴컴컴컴� � 읕컴컴컴컴컴컴컴컴컴컴컴컴� � 旼컴컴컴컴컴컴컴컴컴커 � � You need a set of � 旼컴컴컴컴컴컴컴컴� 쳐� files of the same 쳐컴컴캑 use GOATSET.BAT � � � size, but with the � 읕컴컴컴컴컴컴컴컴� � � different contents.� � 읕컴컴컴컴컴컴컴컴컴켸 � 旼컴컴컴컴컴컴컴컴컴컴컴컴컴� � � You need many identical � 旼컴컴컴컴컴컴컴� 읕� samples to infect them 쳐� use FLOCK.COM � � with the polymorphic � 읕컴컴컴컴컴컴컴� � virus. � 읕컴컴컴컴컴컴컴컴컴컴컴컴컴� Using GOAT.COM you can manually select the size, the name of a sacrificial goat file and vary its internals to meet the criteria, which the virus uses when deciding "to infect or not to infect" the victim file. You can enter the size of a sacrificial goat file in any of given formats: decimal, hexadecimal or in kilobytes. Size of the victim files can be as small as 2 bytes and as much as many gigabytes (it is stored in 32-bit variable). GOAT.COM is very flexible - it can create COM, EXE, SYS(COM) and SYS(EXE) files, with code at the beginning, in the middle, or at the very end of the goat file. Files can be filled with zeroes, NOPs, two types of pattern and even filled with random garbage. You can add stack segment for the EXE files, vary header size, and ... many other options are available. GOATS.COM file is intended to create a series of bait files with linearly increasing length. Length increase step is changeable. GOATS.COM has the same flexibility as GOAT.COM. FLOCK.COM is a creator of up to 1000000 identical files. You can infect them with a polymorphic virus to test its behavior and properties. FLOCK.COM uses the same engine as GOAT.COM and GOATS.COM. Thus, all flexibility of GOAT.COM is available too. GOATSET.BAT produces some sort of "a standard set" of files of the same size. These files are different (internal contents or attribute are variable). GOATSET needs GOAT.COM for the execution. GOAT.COM should be located in the current directory, or it should be accessible via PATH environment variable. The "standard set" of goat files may help you to find out which files are preferred by the virus (ex.: virus may infect only COM files starting with JMP). Checking "a standard set" after virus attack, you can easily understand which files are infectable. A small batch file RUN-ALL.BAT will help you to run (or infect, if you have a resident virus active) all generated bait files. Text of RUN-ALL.BAT is self-explanatory. 旼컴컴컴커 쿐XAMPLES� 컴좔컴컴컴컨컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 GOAT 2 c:\bait.com /* create 2-byte file C:\BAIT.COM */ GOAT 100k /* create 100k file GOAT000.EXE */ GOAT 10 /b/j /* make short COM file with code at the bottom, without JMP instruction */ GOAT 34 /s /* create short EXE file */ GOAT 100 /s/9 /* create EXE file with a short header and fill it with NOPs */ GOAT 570 /e/b/j /* make EXE with a standard 512-byte header, place code at bottom and avoid JMP */ GOAT 4000 /iE5h /* make 4000 bytes COM file, fill with E5h */ GOAT 8k/r/t62 /* make 8k COM file with readonly attribute and seconds field in timestamp = 62 sec */ GOAT 30000 t.exe /* create 30000 bytes file T.EXE, but with internal COM structure, i.e., without EXE header */ GOAT 30000 t.exe /e /* create 30000 bytes file T.EXE, with standard 512 bytes 'MZ'-header */ GOAT 2000h /e /* create 8192 bytes file GOAT000.EXE */ GOAT 2048k /* create 2MB file GOAT000.EXE */ GOAT 300k /s/o/j/9 /* make 300k EXE file, not overlaid, without JMP, fill with NOPs, use 32-byte header */ GOAT 300k /s/o/j/9/b /* same, but code at bottom of file */ GOAT 300k /s/o/j/9/b/z /* same, but with ZM-header */ GOAT 300k /s/o/j/9/b/z/r /* same, but readonly file */ GOAT 300k /p/t18h /* make 300k EXE file and fill it with 00, 01, 02, ... pattern, set seconds in the file timestamp = 18h = 24 */ GOAT 1k /n /* make 1k COM file, filled with random bytes */ GOAT 1k /y /* make 1k SYS device driver */ GOAT 1k /y/e /* make 1k SYS device driver, being an EXE file */ GOAT 1k /k1k /* make 2k EXE file with 1k STACK segment */ GOAT 1k /k810h /* make 3088 bytes EXE file, code segment will take 1024 bytes, stack - 2064, and SP=810h, CS:IP=FFF0:100 */ GOAT 1k /k810h /M512 /* make 3088 bytes EXE file, code segment will take 1024 bytes, stack - 2064, and SP=810h, CS:IP=0:0 */ 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� GOATS 1000-65000 1000 /* create 65 COM files */ GOATS 1000-65000 1000 /E /* create 65 EXE files */ GOATS 1k-66k 32k /b/9 /* create 3 files. First two will be COM files with 1k and 33k size, last will be EXE file. Names assigned: GOAT000.COM, GOAT001.COM and GOAT002.EXE. Code located at bottom, filled with NOPs */ GOATS 1000h 2000h 200h /* create 9 files: GOAT000.COM (size= 4096) .. GOAT008.COM (size=8192) */ GOATS 50k 60k 10h /s/b/v /* create many EXE files with 32 byte EXE- header, code at bottom. All will have SS=CS, SP=IP */ GOATS 1024k 16384k 1024k /* create 16 files, all EXE. Will probably result in "Not enough disk space" error, because files will take >100MB in total */ GOATS 100 1000 100/m50/w /* make 10 COM files with JMP to the code located at byte 50, word-pattern filled */ GOATS 1k 10k 1k /y/e /* make 10 SYS device drivers, organized as EXE files with 512-bytes header */ 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� FLOCK /h /* give the help screen */ FLOCK 1000 /F400/D5 /* create 2000 COM files of size 1000 in five directories - DIR000...DIR004 Names are GOAT000.COM .. GOAT399.COM */ FLOCK 12345h /S/B/9/D1 /* create 500 files. Files will be EXE, 74165 bytes in size, with short EXE header, NOPs filled, code will be placed at the end of the files. Names assigned: GOAT000.COM .. GOAT999.COM All in one subdirectory - DIR000 */ 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� GOATSET 1024 /* create 52 different files. Twelve COM files, 34 EXE files and 6 SYS files (2 nornal SYS and 4 SYS-EXE). See GOATSET.LOG for the report. */ GOATSET 30k /* create 52 files. See GOATSET.LOG for the report. */ 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� RUN-ALL /* run all generated GOAT???.COM and GOAT???.EXE files */ 旼컴컴컴컴컴컴컴컴� 쿢SAGE OF PROGRAMS� 컴좔컴컴컴컴컴컴컴컴좔컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 You can see the correct usage of all programs, specifying the "help" command line switch "/h": GOAT /h GOATS /h FLOCK /h GOATSET /h Printout of the usage of the main program - GOAT.COM, is given below: 旼컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 쿢sage: GOAT Size [Filename] [/switch] [/switch] ... � 쿞ize - dec, hex or kbytes (Ex.: 1000, 65530, FE00h, 31k, 512K, 2048k) 쿑ilename - file to create. If no - creates GOAT000, GOAT001, etc. � 쿞witches: � /Annnn - set device Attribute /O - no internal Overlays � /B - code at Bottom /P - use byte Pattern � /Cn - set selfCheck level /R - make file Readonly � /E - create EXE file /S - Short EXE header � /H, /? - Help screen /Tnn - seT seconds = nn (<63, even) � /Inn - use fIll byte nn /V - set SS:SP = CS:IP � /J - no JMP at start /W - use Word pattern � /Knnnn - add STACK seg of nnnn size /Y - create device driver (SYS) � /Mnnnn - put code at nnnn position /Z - put 'ZM' EXE header � /N[nnnn] - RND filled (nnnn=seed) /9 - NOPs filled (90h). � The square brackets denote optional parameters. 旼컴컴컴컴컴컴컴커 쿞IZE LIMITATIONS� 컴좔컴컴컴컴컴컴컴컨컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 By default GOAT.COM, GOATS.COM and FLOCK.COM creators produce sacrificial file of COM type. This applies to any given size, which meet the following criterion: 2 < Size_of_COM < 65280 The magic number 65280 is a maximum size of COM file, which should fit in a segment size (64k) without PSP size (256): 65536 - 256 = 65280. When placing the code at the bottom of the COM file, which size is around 64K, code may lay too close to SS:SP (SS=CS for COMs, SP=FFFE) and the program may hang your system when run, because stack will likely overwrite the code. Therefore, if the spacing between IP and SP is less than 64 bytes, the goat generation is aborted and the goat file is not created (You will see a warning - "Goat IP will be too close to SP. Abort!"). If you absolutely need such a file - use switch /Mnnnn to place code at the very bottom of your file. With /M switch the test is not performed, because if you specify some value in /M switch you probably understand what are you doing! When the size specified in the command line is greater than 65280 (or equal to), EXE file is generated automatically (you do not need to write /E or /S switch explicitly). Such a file will have an EXE header in the beginning. Because of the presence of EXE header, the size limitations are the following: 513 < Size_of_EXE < free_disk_space (with /E switch) 33 < Size_of_EXE < free_disk_space (with /S switch) When you need to create EXE file shorter than 65280 bytes, use /E (or /S, /Z or /Knnnn) command line switch. When creating a series of bait files in a loop using GOATS.COM, the size can exceed 65280 bytes limit. If this is the case, all files longer than 65280 will be automatically turned to a default EXE files (i.e., with a standard 512 bytes 'MZ' header) and .EXE file extension will appear. 旼컴컴컴커 쿞WITCHES� 컴좔컴컴컴컨컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 Short reference of all available switches is given below in the alphabetical order: /Annnn - set device Attribute (default=0C853h) /B - place code at bottom of file (default - at start) /C[n] - set selfcheck level (by default equal to 2, the highest) (/C means /C0, i.e., no selfchecking at all) /Dnnn - create maximum nnn subdirectories (default=10) (recognized only by FLOCK.COM, ignored by GOAT and GOATS) /E - create EXE file (if size > 65280 - done automatically) /Fnnn - create maximum nnn files in a subdirectory (default=500) (recognized only by FLOCK.COM, ignored by GOAT and GOATS) /H, /? - Help screen /Inn - use fill byte 'nn' instead of standard zero-fill (you can use decimal /i100 or hexadecimal notation /iE5h) /J - remove JMP at code start (default - JMP present) /Knnnn - add nnnn bytes of STACK segment to the bottom of executable file (stack segment is filled with 'STACK' string by default) /Mnnnn - place code in the middle of the file exactly at nnnn position (nnnn is 32-bit value, but see limitations below) /N[nnnn]- fill goat file with pseudorandom bytes. The parameter (if given) is a random number generator seed. RNG uses multiplicative congruental method with 2**32 period. /O - do not make long EXE (>256K) with internal overlay structure /P - fill free file space with pattern 00, 01, .. FE, FF, 00, .. /R - make file readonly (default - normal) /S - make short (32 bytes) EXE header (default - 512 bytes) /Tnn - set timestamp seconds field = nn (<63, even: 0, 1Eh, 62, ..) /V - set SS:SP equal to CS:IP /W - make word pattern (0000, 0001, ...FFFF, 0000; pattern value is "anchored" to the location). /X - supress signature defined in the INI file using "Motto=" /Y - create device driver (SYS file) /Z - make 'ZM' EXE header instead of 'MZ' /9 - fill free file space with NOPs (default - with zeroes) The switches in the command line (like /E) give you the control over the victim creation. You can place the code at the beginning of the goat file or at the bottom. You can select the filling byte (00, 090h or even pattern), the presence of JMP at the code start. You can force creation of EXE file. You can even change size of EXE header and control values loaded in SS and SP. You can prohibit the creation of overlaid EXE files, etc. Most of the command line switches can be applied simultaneously. GOAT.COM, GOATS.COM and FLOCK.COM programs use the same set of command line switches. When filling the goat file with pattern (byte /P or word /W), the pattern values always correspond to the current offsets in the file (i.e., it is "anchored" to the location in the file). Value, specified in the switch /Mnnnn (nnnn is 32-bit value and you may use "k" and "h" modifiers), has the following limitations: for EXE: (header size) < nnnn < size-70 for COM 3 < nnnn < size-2 If some switches are conflicting (say, "GOAT 1000 /P/W", where /P - byte pattern and /W - word pattern), - the last is selected (same applies to the switches in the INI file). In this example it will be word type of pattern. Some combinations of switches are not allowed. For example, you cannot set /J, /B and /P for any COM file simultaneously (if code is at bottom and no JMP is present - pattern will appear as a code at CS:100). Switch /Knnnn adds stack segment at the bottom of the file (always EXE). Size of the stack segment is limited: 16 < nnnn < 65536 Please avoid small and odd values in /K, because they can hang computer or cause "Exception #13" (QEMM frequent warning), when SP goes through the stack segment boundary (i.e., half of word is written at SS:0000 and other half - at SS:FFFF). Note, that the size specified in /Knnnn is added to the main size of the file (i.e., GOAT 1k /k1k will produce 2048 bytes EXE file). If the main size of the file does not end on the paragraph boundary (i.e., main size is not divisible with 16) - stack segment will start on the first paragraph after the end of the main file size. Switches /Fnnn and /Dnnn are recognized only by FLOCK.COM (GOAT.COM and GOATS.COM simply ignore them). You can specify the desired number of files and subdirectories to create. By default, 10 subdirectories with 500 files in each are created. Note, that if any directory already exists (say, DIR004), it will be simply skipped and no new files will be created inside (the number of dirs and files to be created will not change; i.e., in mentioned case, last dir name will become DIR010, not DIR009). 旼컴컴컴커 쿔NI FILE� 컴좔컴컴컴컨컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 You may like to put your preferences (signature, switches, filename templates, etc.) into a separate file - GOAT.INI (common for GOAT.COM, GOATS.COM and FLOCK.COM). Use any text editor to create or modify INI file. The sample INI file is given below: 旼컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 �; �; sample INI file �; 쿘otto="Antivirus test file." ;all output bait files will carry � ;this string. 쿒OATfiles=FPROT ;files will be FPROT000.COM, FPROT001.COM, ... 쿒OATSfiles=TBAV ;files will be TBAV000.COM, TBAV001.COM, ... 쿑LOCKfiles=S&S ;files will be S&S000.COM, S&S001.COM, ... 쿑LOCKdirs=HEAP ;directories created - DIR000, DIR001, DIR002 쿞TACKfill="*MYSTACK" ;fill stack with '*MYSTACK*MYSTACK*MYSTACK' 쿞YSnames="DRIVERXX" ;this string is inserted into SYS header. 쿞witches=/F200/D50 ;make 50 dirs, 200 files in each. 10000 in total. 쿞witches=/C1 ;to turn off registers check and avoid � ;warning "Your PC might be infected..." 쿞witches=/iF6h ;always fill free file space with 0F6h byte 쿞witches=/O ;never make overlaid EXE files GOAT.INI may be located in the current directory or in the path of started program. The first location has priority over the second. GOAT.INI may not exist. In that case programs use built-in defaults. The following statements are allowed: Motto= ;defines signature for all created goat files ;(not present on default) GOATfiles= ;filename template for GOAT.COM (default=GOAT) GOATSfiles= ;filename template for GOATS.COM (default=GOAT) FLOCKfiles= ;filename template for FLOCK.COM (default=GOAT) FLOCKdirs= ;directories template for FLOCK.COM (default=DIR) STACKfill= ;stack fill string (default=STACK) SYSname= ;driver name (default=GOATXXXX) Switches= ;any switches you like (multiple lines allowed) Any comments may be added after a semicolon. Motto string, defined in the INI file appears in the created goat COM file immediately after JMP (if any) or after the goat code (if no JMP present). In the EXE file it appears after the goat code, if code is at the start. If space at the beginning is free (ex., /B or /Mnnnn switch moved goat code away from the beginning) - motto will appear at the EXE file start (obviously, after the EXE header). Motto string is limited to 64 symbols. To include spaces in the motto string use quotes. Note, that /J/B and /J/Mnnnn switch combinations supress motto in the goat file. Filename and subdirectory templates are limited to 5 symbols, because programs always add '000' and then start incrementing this number until it becomes '999'. Dot is not allowed in the template. Any string exceeding the limit of 5 symbols will give the following message: "Error in the INI file line #xxx" The processing will be aborted. The same error will appear if you give any wrong switch (say, /@) or parameter value (say, /F10000 or /i500). Stack fill string is limited to 32 symbols (you can use even unprintable characters, like ASCII 01, etc.). The strings may be quoted. To enter a quote itself - duplicate it inside the quoted string - ex. "File is ""readonly""" will be converted to string: 'File is "readonly"'. Driver name, defined using "SYSname=", is limited to 8 symbols. This name is right-padded with 'X' symbols, if name has less than eight symbols. Note that any INI file switch settings is overridden by command line switches. For example, /X switch in the command line supress Motto definition from the INI file. 旼컴컴컴컴컴컴컴컴컴커 쿍AIT FILES INTERNALS� 컴좔컴컴컴컴컴컴컴컴컴컨컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 The sacrificial goat file itself contains a small program, which displays its type (COM, EXE or SYS), size in hexadecimal and in decimal (only when goat file is of enough size, i.e., space for code itself is at least 70 bytes). The bait files created with GOAT.COM, GOATS.COM and FLOCK.COM (if they have the same size) are absolutely identical in their internal structure and properties. Sacrificial goat file consists of the two parts: the small portion of code (of fixed size, always being 2 bytes or 70 bytes) and a block of zeroes, NOPs or pattern of variable size (00..FF, 0000...FFFE or random pattern). Zeroes (NOPs or pattern) take all space of the file, free from the code. EXE files have additionally an EXE-header. Non-used part of the EXE header is always filled with zeroes. SYS files have SYS header, strategy and interrupt routines in addition to the code given below. Two types of code can be placed into the victim file (COM/EXE). They are given in the table: 旼컴쩡컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컫컴컴컴컴컴컫컴컴컴컴컴커 � # � Code � Size, dec � Size, hex � 쳐컴탠컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컵컴컴컴컴컴컵컴컴컴컴컴캑 � 1 � int 20h � 2 � 2 � 쳐컴탠컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컵컴컴컴컴컴컵컴컴컴컴컴캑 � 2 � jmp $+3 (or nop, nop, nop) � 70 � 46h � � � call code � � � � � db 'Goat file (COM). Size=...$'� � � � � code: pop dx � � � � � push cs � � � � � pop ds � � � � � mov ah,9 � � � � � int 21h � � � � � mov ah,4ch � � � � � int 21h � � � 읕컴좔컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컨컴컴컴컴컴컨컴컴컴컴컴켸 Notes: 3 NOPs instead of JMP $+3 (E9, 00, 00) are used if the switch /J was specified. 'COM' type designator may be substituted with EXE or SYS and reflects file contents. 旼컴컴컴컴컴컴� 쿍AIT PRINTOUT� 컴좔컴컴컴컴컴컴좔컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 The output of a sample goat file (the size of the sample was 100 bytes) is the following: "Goat file (COM). Size=00000064h/0000000100d bytes." File type (COM/EXE/SYS) and real numbers are inserted into the goat file message at the moment of creation. 旼컴컴컴컴컴� 쿍AIT NAMING� 컴좔컴컴컴컴컴좔컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 Usually GOAT.COM, GOATS.COM and FLOCK.COM programs create output sacrificial files in the following order: GOAT000.COM, GOAT001.COM, GOAT002.COM, etc. The same applies to EXE files, and the order is ascending: GOAT000.EXE, GOAT001.EXE, GOAT002.EXE, etc. If some file in a row (say GOAT050.COM or GOAT050.EXE) already exist - the next file number is selected automatically (it will be GOAT051.COM or GOAT051.EXE). This does not apply for SYS files (i.e., GOAT000.COM and GOAT000.SYS are allowed). This naming strategy is used to give some freedom for companion viruses. GOATSET.BAT produces 52 files of the same size. There will be 12 COM, 34 EXE, 2 SYS and 4 SYS-EXE files. GOATSET.LOG is created after each start of GOATSET.BAT. Inspect this log file (GOATSET.LOG) file in order to get the report about the internal structure of generated files, the error messages, etc. Note, that definitions, given in the INI file may change default file (and sudbirectories) naming. 旼컴컴컴컴커 쿐XE HEADER� 컴좔컴컴컴컴컨컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 By default, EXE header is 512 bytes in size. You can force usage of a 32-byte EXE header - use /S command line switch. By default, EXE header starts with 'MZ' signature. Use /Z switch to make 'ZM'. Only six fields (words) in the EXE header are variable: the number of 512-bytes pages in file (word ptr [header+4]), the number of bytes on the last page (word ptr [header+2]), CS, IP, SS and SP. When the sacrificial file is less than 256K bytes, the first two fields (pages and remainder in the last page) are assigned according to the real file size. But when code is placed at the beginning of bait file and when the limit of 256K is exceeded, the number of pages is set to 2 (EXE header size plus code size) and code on the last page is set to 64 bytes. This technique makes an "overlaid" EXE file. It is absolutely needed to enable execution of files bigger than the amount of free conventional memory (say, for execution of a 700K file or a 10MB file). Switch /O does not affect the internals of EXE files smaller than 256K. If you specify /B switch (or /Mnnnn or /Knnnn switches), the overlay creation mode is automatically turned off (same as if you write /O in the command line). Otherwise, the code (or stack) may be unaccessible and such a file would not run (DOS will give error message, when attempting to start such a file). If you need a goat file with, say SS:SP equal to 400:1234, use one of the following calls: GOAT 4200h /K1234h GOAT 4020h /K1234h /S Value of SP=1234h is obvious. To calculate file size take needed SS, multiply it on 10h (to convert paragraphs into bytes) and add 200h (bytes in standard header) or 20h (for short EXE header). 旼컴컴컴컴컴컴커 쿏EVICE DRIVERS� 컴좔컴컴컴컴컴컴컨컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 To create device driver (SYS) file use switch /Y. Device driver file can be in two formats - simple driver (a'la COM file) and EXE-file driver (with EXE header, a'la SMARTDRV.EXE or SETVER.EXE). Files of the first format can only be invoked from CONFIG.SYS and they will print message "Goat file (SYS). Size=..." when DOS requests an initialization of the driver. Second format (SYS&EXE) can be placed in the CONFIG.SYS and can also be invoked from the DOS command line as a normal EXE file. In both cases this driver file prints the same message. Minimal size of the device driver is around 150 bytes (including SYS header). For EXE drivers this limit increases (it should include additionally the size of the EXE header - 32 bytes for /S; 512 bytes for /E). Note that device drivers, being simultaneously an EXE files, has a "(SYS)" type designator inside, but are always named as .EXE files (to enable execution from the command line as a normal executable file). Such a files can exceed 64K only if device driver routine is placed in the first segment of the goat file (because pointers to Strategy and Interrupt routines in the driver header are limited to 16-bits). Thus, a command "GOAT 70k /y/b" is illegal, but "GOAT 70k /y/m63k" is OK. Default device driver attribute is set to 0C853h (most usable bits are set), because I decided that most SYS-infecting viruses will likely test set attribute bits, rather than reset ones. You can vary attribyte with /Annnn switch (or even place this switch setting into the INI file to override default setting). 旼컴컴컴컴커 쿐RRORLEVEL� 컴좔컴컴컴컴컨컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 GOAT.COM, GOATS.COM and FLOCK.COM return ERRORLEVEL=0 after the successful operation. GOAT.COM returns ERRORLEVEL=1, when output victim file was not created. The error explanation text will appear on the screen. GOATS.COM and FLOCK.COM will return ERRORLEVEL=1 if current operation failed (creation of the current file in a loop exhausted the disk space, etc.). Note, that all files created before the appearance of the error condition were generated successfully. GOAT.COM, GOATS.COM and FLOCK.COM return ERRORLEVEL=2 when user pressed Ctrl-Break (this feature is used in batch file GOATSET.BAT). GOAT.COM, GOATS.COM and FLOCK.COM return ERRORLEVEL=3 when selfchecking has failed (/C switch forces ERRORLEVEL<3). 旼컴컴컴컴컴커 쿞ELFCHECKING� 컴좔컴컴컴컴컴컨컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 GOAT.COM, GOATS.COM and FLOCK.COM check their own health. The selfchecking is very sensitive to any modification of the environment or the file internals. Selfchecking has three levels (selectable with /Cn switch): 0 - no checks made 1 - checksum of the file on disk made (including timestamp and file extension) 2 - checksum of the file on disk and registers upon startup made (default level) If processor registers upon startup looks suspicious - the following message appears: "Your PC might be infected (use /C1 to turn off this warning)." This may be caused by some resident virus, sitting on DOS EXEC function, or any unusual resident software. Any virus, which infected GOAT program and do not restore all registers in the same way as DOS does will turn on this warning too. DR-DOS and Nowell Netware are known to set some strange (i.e. not MS-DOS compatible) values into processor registers after EXEC function. If you need to turn off registers checking - use switch /C1. It may be useful if DR-DOS or Netware NETX is loaded. You may like to add "Switches=/C1" line to the INI file to supress the warning. If the checksum of the file on disk is invalid you will hear a beep and see a warning after program termination: "XXXXX.COM probably infected!" XXXXX stands for GOAT, GOATS or FLOCK. If you need to turn off file contents checking - use switch /C0 (or simply /C). Therefore, do not try to pack GOAT.COM, GOATS.COM or FLOCK.COM with PKLITE or similar compressors. That will result in the "... probably infected!" report. The same report will be given, if you start the programs under DEBUG, because it assigns processor registers in its own way. If program file extension is not COM you will see (if switch /C is not specified): "XXXXX.COM probably infected by companion virus!" All selfchecking is automatically turned off (same as /C0) for DOS versions prior to 3.00 (because the location of the original file on disk cannot be retrieved from after the environment). Note - this selfcheck may miss the changes if very smart full-stealth virus infect your system! In any case (check enabled, or not), when virus is active - output goat file(s) may be infected immediately after creation. No checks of the generated files integrity are made! 旼컴컴컴컴컴컴컴컴컴컴커 쿓ISTORY AND KNOWN BUGS� 컴좔컴컴컴컴컴컴컴컴컴컴컨컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 Version 3.0 - Goat file contents changed - the string, indicating type of goat file, added to the printed message (COM/EXE/SYS). Device driver creation mode added: switches /Y (make SYS file) and /Annnn (set device attribute) appeared. "SYSname=" definition added to the INI file processor (this name appears in the SYS file header). Help screen redesigned - now switches are listed in the alphabetical order. FLOCK.COM, when operating on a drive, having zero free bytes, entered very long loop - corrected. GOATSET.BAT creates now 6 device driver files. Version 2.1 - Motto string added to the INI file. INI file processor allows quoted strings now in the "Motto=" and "STACKfill=" definitions. New switches /N[nnnn] (random fill with possible seed definition) and /X (supress Motto string defined in the INI file) added. GOAT.INI was not found by FLOCK and GOATS thru path, fixed. Version 2.01 - Some portion of code (common to GOAT, GOATS and FLOCK, version >1.5) alerted F-Prot (it reported "Probably new variant of BootEXE"). I rewrote it in order to avoid this false positive. Version 2.0 - INI file processing added. FLOCK.COM appeared instead of FLOCK.BAT. FLOCK.COM switches /F (# of files in dir) and /D (max # of subdirectories) appeared. Selfchecking level added (switch /Cn). Switches /O and /V do not force EXE now (to allow including /O, /V into INI file). Word pattern (/W) fixup corrected. GOATSET operation (when GOAT.COM selfcheck fails) is corrected. Version 1.6 - Switches /K, /M, /W, /C, /I added. Many enhancements in the code made. Selfchecking is double now (in-memory copy and file on disk), check for companion virus infection added. Rare conflict of /R and /T switches fixed. Removing of non-fully created readonly files fixed. Version 1.5 - Switch /P (pattern fill) added. Selfchecking of timestamp added. /J/B/E or /J/B/S forced NOP-filling for EXE files, corrected. When making a series of files with GOATS.COM on 5 (and 67) byte boundary, additional JMP appeared even with /J switch, corrected. GOATSET have not been changed. Version 1.4 - File numeration changed, it is common for EXE and COM files now. Ex., if GOAT000.COM exist, created EXE file will be GOAT001.EXE (to help handling of companion viruses). FLOCK and GOATSET have not been changed. Version 1.3 - Added switch /Tnn. Bug with attribute in GOATS fixed (always set 0000, even with /R switch). When modified, GOATS.COM reported "GOAT.COM probably infected!", corrected. Minalloc field in EXE header changed to zero (ver. <1.3 always set 20h). Version 1.2 - DOC file written. BAT files FLOCK and GOATSET added. Decimal printout of goat file size added. Added rotating "|" (when creating goat files longer than 64k). Selfchecking added. Version 1.1 - Many switches added (/S,/O,/B,/J,/Z, /V,/9,/R). Version 1.0 - First version, without documentation, supported only switch /E. No decimal size in the printout of goat files. All EXE files >=1024k, created with an /O and /S switches (short header, not overlaid) hang DOS upon execution. For a very similar file with normal 512-bytes header, DOS behaves normally. It reports "Program too big to fit in memory". I guess the hang of the file with short header is really a DOS problem, which is confused with such a strange goat file (the file without overlaid structure and greater than 640K cannot fit into DOS memory and have no real sense). DOS should report a load error, because a load size is definitely >640K. Unfortunately it hangs instead. 旼컴컴컴컴컴컴컴� 쿌CNOWLEDGEMENTS� 컴좔컴컴컴컴컴컴컴좔컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 I am greatly acknowledged to the CARO member Frans Veldman (Esass, the Netherlands). Discussions of some aspects of a goat file generation were very fruitful. I am benefited from the usage of HIEW.EXE (Hacker's View) program by SEN. HIEW.EXE, being the viewer of an executable files, is very useful for the examination of the contents of a goat files. I can recommend HIEW for all users of GOAT package (current HIEW.EXE version is 4.41). 旼컴컴커 쿑LAMES� 컴좔컴컴컨컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 Send flames, questions, etc. directly to the author (preferably via Email). All ideas, comments and corrections will be appreciated. Sorry for a possible errors in this manual - English is not my native language. 旼컴컴컴컴컴커 쿝EGISTRATION� 컴좔컴컴컴컴컴컨컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 I ask that you consider donating $10US to the GOAT package programs to support virus research and challenge computer viruses. If you find the program useful and easy to use, please use the following data to send a donation: Of the Moscow Savings Bank's corresponding account in Barclays Bank, London N 68866399 USD Corresponding account Cheryomushkinskoe branch 7980 in VU MB SB RF N 073000034 account N 0010501799 Igor G. Muttik If you inform me about the payment - I will immediately send you fresh version of GOAT package. 旼컴컴컴컴컴컴컴컴컴커 쿎OMPANY REGISTRATION� 컴좔컴컴컴컴컴컴컴컴컴컨컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 If you are registering this package for a company, I will be asking for more than $10US, because you are probably going to use this program to help your company make money. I feel that it is great that my program will help your business, and also feel that if it does make you money, GOAT package should get some support. I guess, all company registrations should be negotiated (Email preferred). 旼컴컴커 쿌UTHOR� 컴좔컴컴컨컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 Igor G. Muttik Low Temperature Lab, Physics Department Moscow State University, Moscow 117234, Russia Internet address : MIG@lt.phys.msu.su Phones: +7 (095) 9391147 (office) +7 (095) 3396238 (home)