mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2026-06-16 15:59:24 +00:00
Add files via upload
This commit is contained in:
vxunderground
GitHub
@@ -0,0 +1,247 @@
|
||||
; KEY-FAKE.ASM -- Fakes keystrokes from internal keyboard buffer.
|
||||
; ============
|
||||
|
||||
CSEG Segment
|
||||
Assume CS:CSEG
|
||||
Org 0100h
|
||||
Entry: Jmp Initialize
|
||||
|
||||
; Most Resident Data
|
||||
; ------------------
|
||||
|
||||
db 'KEY-FAKE (C) Copyright Charles Petzold, 1985'
|
||||
SearchLabelEnd Label Byte
|
||||
|
||||
OldInterrupt16 dd 0
|
||||
Pointer dw Offset KeyStrokeBuffer
|
||||
Counter db 0
|
||||
|
||||
; New Interrupt 16 (Keyboard)
|
||||
; ---------------------------
|
||||
|
||||
NewInterrupt16 Proc Far
|
||||
|
||||
Sti ; Allow futher interrupts
|
||||
Cmp CS:[Counter],0 ; See if characters in buffer
|
||||
Jz DoOldInterrupt ; If not, just do regular interrupt
|
||||
|
||||
Or AH,AH ; Check if AH is zero
|
||||
Jz GetCharacter ; If so, call is to get character
|
||||
|
||||
Cmp AH,1 ; Check if AH is one
|
||||
Jz GetStatus ; If so, call is for status
|
||||
|
||||
DoOldInterrupt: Jmp CS:[OldInterrupt16] ; Otherwise, go away
|
||||
|
||||
GetCharacter: Push BX
|
||||
Mov BX,CS:[Pointer] ; BX points to current buffer position
|
||||
Mov AX,CS:[BX] ; Get ASCII code and scan code
|
||||
Inc BX ; Move buffer pointer ahead
|
||||
Inc BX
|
||||
Mov CS:[Pointer],BX ; Save new pointer
|
||||
Dec CS:[Counter] ; One less character in counter
|
||||
Pop BX
|
||||
|
||||
Or AX,AX ; See if 0 returned
|
||||
Jz NewInterrupt16 ; If so, take it from the top again
|
||||
|
||||
IRet ; Return to calling program
|
||||
|
||||
GetStatus: Push BX
|
||||
Mov BX,CS:[Pointer] ; BX points to current buffer position
|
||||
Mov AX,CS:[BX] ; Get ASCII code and scan code
|
||||
Pop BX
|
||||
|
||||
Or AX,AX ; See if special 0 keystroke
|
||||
Jnz StatusReturn ; If not, return non-zero flag
|
||||
|
||||
Add CS:[Pointer],2 ; If so, skip over it
|
||||
Dec CS:[Counter] ; One less character
|
||||
Or AX,AX ; Will set zero flag
|
||||
|
||||
StatusReturn: Ret 2 ; Do not pop flags
|
||||
|
||||
NewInterrupt16 EndP
|
||||
|
||||
; Beginning of Key Stroke Buffer
|
||||
; ------------------------------
|
||||
|
||||
KeyStrokeBuffer Label Byte ; 256 Byte Buffer for keystrokes
|
||||
|
||||
; Initialization -- Search through Memory and see if label matches
|
||||
; ----------------------------------------------------------------
|
||||
;
|
||||
; If so, use the loaded program; if not, create a new interrupt
|
||||
|
||||
Assume DS:CSEG, ES:CSEG, SS:CSEG
|
||||
|
||||
Initialize: Mov Word Ptr [Entry],0 ; Slightly modify search label
|
||||
Mov Byte Ptr [Entry + 2],0 ; so no false matches
|
||||
|
||||
Cld
|
||||
Mov DX,CS ; This segment
|
||||
Sub AX,AX ; Beginning of search
|
||||
Mov ES,AX ; Search segment
|
||||
|
||||
SearchLoop: Mov SI,100h ; Address to search
|
||||
Mov DI,SI ; Set pointers to same address
|
||||
Mov CX,Offset SearchLabelEnd - Offset Entry
|
||||
Repz Cmpsb ; Check for match
|
||||
Jz ReadyForDecode ; If label matches
|
||||
|
||||
Inc AX ; Still the search segment
|
||||
Mov ES,AX ; ES to next segment
|
||||
|
||||
Cmp AX,DX ; Check if it's this segment
|
||||
Jnz SearchLoop ; Try another compare
|
||||
|
||||
Mov Byte Ptr DS:[1],27h ; Since no match found,
|
||||
; set up PSP for Terminate &
|
||||
; remain resident.
|
||||
|
||||
; Save and Set Interupt 16 if Staying Resident
|
||||
; --------------------------------------------
|
||||
|
||||
Sub AX,AX ; Set AX to zero
|
||||
Mov DS,AX ; To access vector segment
|
||||
Assume DS:Nothing ; Tell the assembler
|
||||
|
||||
Mov AX,Word Ptr DS:[16h * 4] ; Get vector offset
|
||||
Mov Word Ptr CS:[OldInterrupt16],AX ; Save it
|
||||
Mov AX,Word Ptr DS:[16h * 4 + 2] ; Get vector segment
|
||||
Mov Word Ptr CS:[OldInterrupt16 + 2],AX ; and save it
|
||||
|
||||
Cli ; Don't interrupt me
|
||||
Mov DS:[16h * 4],Offset NewInterrupt16 ; Store new
|
||||
Mov DS:[16h * 4 + 2],CS ; address
|
||||
Sti ; Now you can talk
|
||||
|
||||
Push CS
|
||||
Pop DS ; Restore DS
|
||||
Assume DS:CSEG
|
||||
|
||||
; Parameter decoding when program segment has been found
|
||||
; ------------------------------------------------------
|
||||
;
|
||||
; ES = segment of loaded program (could be CS)
|
||||
|
||||
ReadyForDecode: Mov SI,80h ; SI points to parameter area
|
||||
Mov DI,Offset KeyStrokeBuffer
|
||||
Mov ES:[Pointer],DI ; ES:DI points to buffer area
|
||||
Mov ES:[Counter],0 ; Set keystroke counter to zero
|
||||
|
||||
Lodsb ; Get parameter count
|
||||
Cbw ; Convert to word
|
||||
Mov CX,AX ; CX = parameter count
|
||||
Inc CX ; So catch last delimiter (0D)
|
||||
Or AX,AX ; Check if parameter present
|
||||
Jnz GoDecodeLoop ; If so, continue
|
||||
Jmp EndDecode ; If not, cut out
|
||||
|
||||
GoDecodeLoop: Jmp DecodeLoop
|
||||
|
||||
; End of Residence is end of Key Stroke Buffer
|
||||
; --------------------------------------------
|
||||
|
||||
Org 256 + Offset KeyStrokeBuffer
|
||||
|
||||
EndResidence Label Byte
|
||||
|
||||
; Data for Parameter Decoding
|
||||
; ---------------------------
|
||||
|
||||
QuoteSign db 0 ; Flag for quoted strings
|
||||
DoingNumber db 0 ; Flag for doing a number
|
||||
DoingExtended db 0 ; Flag for doing extended ASCII
|
||||
CalcNumber db 0 ; A calculated number
|
||||
Ten db 10 ; For MUL convenience
|
||||
|
||||
; Routine for doing quoted text
|
||||
; -----------------------------
|
||||
|
||||
DecodeLoop: Lodsb ; Get character
|
||||
Cmp [QuoteSign],0 ; Check if doing quoted text
|
||||
Jz NotDoingQuote ; If not, continue checks
|
||||
|
||||
Cmp AL,[QuoteSign] ; Check first if character is quote
|
||||
Jz EndQuote ; If so, finish quoted text
|
||||
|
||||
Sub AH,AH ; Set scan code to zero
|
||||
Stosw ; Save it in buffer
|
||||
Inc ES:[Counter] ; One more character
|
||||
Jmp DoNextCharacter ; Go to bottom of routine
|
||||
|
||||
EndQuote: Mov [QuoteSign],0 ; End of quoted text
|
||||
Jmp DoNextCharacter ; Get the next character
|
||||
|
||||
; Routine for Extended Ascii Character (@)
|
||||
; ----------------------------------------
|
||||
|
||||
NotDoingQuote: Cmp AL,'@' ; See if character is for extended
|
||||
Jnz NotExtended ; If not, hop over a little code
|
||||
|
||||
Mov [DoingExtended],1 ; Flag for extended ASCII
|
||||
Jmp Delimiter ; To possibly dump number
|
||||
|
||||
; Routine for Quote Sign ' or "
|
||||
; -----------------------------
|
||||
|
||||
NotExtended: Cmp AL,'"' ; Check for a double quote sign
|
||||
Jz Quote
|
||||
Cmp AL,"'" ; Check for a single quote sign
|
||||
Jnz NotAQuote
|
||||
|
||||
Quote: Mov [QuoteSign],AL ; Save the quote sign
|
||||
Jmp Delimiter ; To possibly dump number
|
||||
|
||||
; Routine for decimal number
|
||||
; --------------------------
|
||||
|
||||
NotAQuote: Cmp AL,'0' ; See if character >= 0
|
||||
Jb Delimiter
|
||||
Cmp AL,'9' ; See if character <= 9
|
||||
Ja Delimiter
|
||||
|
||||
Mov [DoingNumber],1 ; If so, doing number
|
||||
|
||||
Sub AL,'0' ; Convert to binary
|
||||
Xchg AL,[CalcNumber] ; Get previously calculated
|
||||
Mul [Ten] ; Multiply by 10
|
||||
Add [CalcNumber],AL ; Add it to new digit
|
||||
|
||||
Jmp DoNextCharacter ; And continue
|
||||
|
||||
; Anything else is considered a delimiter
|
||||
; ---------------------------------------
|
||||
|
||||
Delimiter: Cmp [DoingNumber],1 ; Check if doing a number
|
||||
Jnz DoNextCharacter ; If not, do not dump
|
||||
|
||||
Mov AL,[CalcNumber] ; Set AX to ASCII number
|
||||
Sub AH,AH ; Zero out scan code part
|
||||
Cmp [DoingExtended],1 ; Check if doing scan code
|
||||
Jnz NumberOK
|
||||
|
||||
Xchg AL,AH ; Switch ASCII and scan code
|
||||
|
||||
NumberOK: Stosw ; Store the two codes
|
||||
Inc ES:[Counter] ; One more character in buffer
|
||||
|
||||
Mov [DoingNumber],0 ; Clear out all flags
|
||||
Mov [DoingExtended],0
|
||||
Mov [CalcNumber],0
|
||||
|
||||
DoNextCharacter:Dec CX ; One less character to do
|
||||
Jz EndDecode ; If no more, we're done
|
||||
Jmp DecodeLoop ; Otherwise, get next one
|
||||
|
||||
; End Decode -- Ready to terminate (and possibly stay resident)
|
||||
; -------------------------------------------------------------
|
||||
|
||||
EndDecode: Mov DX,Offset EndResidence ; End of resident part
|
||||
Ret ; Int 20h or 27h
|
||||
|
||||
CSEG EndS
|
||||
|
||||
End Entry
|
||||
|
||||
Reference in New Issue
Block a user