Boot portion of the Caterpillar virus:
Checks whether the last two bytes of c:command.com are 0C0AH; if not, it infects it.
Then it loads the virus into the highest end of memory, occupying 2KB of space.
Modifies interrupt 21H, intercepting DOS function calls 1AH, 11H, and 12H.
Infection portion of the Caterpillar virus:
Occupies the first 0CH bytes of the original com file, modifies the CS and IP values so that the program jumps to the virus program. The original 0CH bytes are moved to the virus program at the end of the file, at offset 0BH. When an infected com file runs, it first makes the virus resident in memory, then moves the 0CH bytes back and executes the original com file. Modifies the int21H entry, changing it to XXXX:04A8H.
Display portion of the Caterpillar virus:
Modifies the int 1CH entry, changing it to XXXX:06B0H.
Graphical code of the Caterpillar virus:
At XXXX:069AH there is
20 07 0F 0A 0F 0A 0F 0A 0F 0A 0F 0A 0F 0A 0F 0A 0F 0A F7 0E EE 0C
The worm body is made of 8 connected 0FH symbols, with attribute 0AH, which is green
The worm neck is made of 1 F7H symbol, with attribute 0EH, which is yellow
The worm mouth is made of 1 EEH symbol, with attribute 0CH, which is red
Set ES to B800H, continuously change the DI value, and call int1CH.
Activating the Caterpillar virus under Debug:
mov ax,yyyy
mov ds,ax
mov dx,6b0
mov ax,251c
int 21h
Checks whether the last two bytes of c:command.com are 0C0AH; if not, it infects it.
Then it loads the virus into the highest end of memory, occupying 2KB of space.
Modifies interrupt 21H, intercepting DOS function calls 1AH, 11H, and 12H.
Infection portion of the Caterpillar virus:
Occupies the first 0CH bytes of the original com file, modifies the CS and IP values so that the program jumps to the virus program. The original 0CH bytes are moved to the virus program at the end of the file, at offset 0BH. When an infected com file runs, it first makes the virus resident in memory, then moves the 0CH bytes back and executes the original com file. Modifies the int21H entry, changing it to XXXX:04A8H.
Display portion of the Caterpillar virus:
Modifies the int 1CH entry, changing it to XXXX:06B0H.
Graphical code of the Caterpillar virus:
At XXXX:069AH there is
20 07 0F 0A 0F 0A 0F 0A 0F 0A 0F 0A 0F 0A 0F 0A 0F 0A F7 0E EE 0C
The worm body is made of 8 connected 0FH symbols, with attribute 0AH, which is green
The worm neck is made of 1 F7H symbol, with attribute 0EH, which is yellow
The worm mouth is made of 1 EEH symbol, with attribute 0CH, which is red
Set ES to B800H, continuously change the DI value, and call int1CH.
Activating the Caterpillar virus under Debug:
mov ax,yyyy
mov ds,ax
mov dx,6b0
mov ax,251c
int 21h
ko20010214
=================================
大功告成,打个Kiss!
ko20010214@MSN.com
神州优雅Q300C
Intel CeleronM 370处理器 | 256MbDDR内存
40G硬盘 | USB2.0 | IEEE 1394
13.3 ' WXGA 宽屏(16:10) | COMBO光驱
10/100M网卡 | 四合一读卡器
=================================
大功告成,打个Kiss!
ko20010214@MSN.com
神州优雅Q300C
Intel CeleronM 370处理器 | 256MbDDR内存
40G硬盘 | USB2.0 | IEEE 1394
13.3 ' WXGA 宽屏(16:10) | COMBO光驱
10/100M网卡 | 四合一读卡器

, but the ' ' here looks like a blank, actually it's the characters typed by pressing ALT + 015 (numeric keypad) and ALT + 010 (numeric keypad) under DOS. Since it looks like a blank, I still use the more crude way to input, not using this abbreviated way.