China DOS Union

-- Unite DOS · Advance DOS · Grow DOS --

Union site: www.cn-dos.net Forum site: www.cn-dos.net/forum
DOS stands for freedom, openness and progress. Let us work hard, learn from the openness and GNU spirit of FreeDOS and Linux, and together build and grow a free GNU GPL world!

中国DOS联盟论坛
The time now is 2026-06-27 11:21
中国DOS联盟论坛 » DOS开发编程 & 发展交流 (开发室) » Analysis of the Caterpillar Virus View 2,957 Replies 1
Original Poster Posted 2002-10-21 00:00 ·  中国 江西 吉安 电信
版主
★★★★
Credits 7,296
Posts 1,628
Joined 2002-10-16 12:00
23-year member
UID 10
Gender Male
Status Offline
Boot portion of the Caterpillar virus:
Checks whether the last two bytes of c:command.com are 0C0AH; if not, it infects it.
Then it loads the virus into the highest end of memory, occupying 2KB of space.
Modifies interrupt 21H, intercepting DOS function calls 1AH, 11H, and 12H.
Infection portion of the Caterpillar virus:
Occupies the first 0CH bytes of the original com file, modifies the CS and IP values so that the program jumps to the virus program. The original 0CH bytes are moved to the virus program at the end of the file, at offset 0BH. When an infected com file runs, it first makes the virus resident in memory, then moves the 0CH bytes back and executes the original com file. Modifies the int21H entry, changing it to XXXX:04A8H.
Display portion of the Caterpillar virus:
Modifies the int 1CH entry, changing it to XXXX:06B0H.
Graphical code of the Caterpillar virus:
At XXXX:069AH there is
20 07 0F 0A 0F 0A 0F 0A 0F 0A 0F 0A 0F 0A 0F 0A 0F 0A F7 0E EE 0C
The worm body is made of 8 connected 0FH symbols, with attribute 0AH, which is green
The worm neck is made of 1 F7H symbol, with attribute 0EH, which is yellow
The worm mouth is made of 1 EEH symbol, with attribute 0CH, which is red
Set ES to B800H, continuously change the DI value, and call int1CH.
Activating the Caterpillar virus under Debug:
mov ax,yyyy
mov ds,ax
mov dx,6b0
mov ax,251c
int 21h
ko20010214
=================================
大功告成,打个Kiss!
ko20010214@MSN.com
神州优雅Q300C
Intel CeleronM 370处理器 | 256MbDDR内存
40G硬盘 | USB2.0 | IEEE 1394
13.3 ' WXGA 宽屏(16:10) | COMBO光驱
10/100M网卡 | 四合一读卡器
Floor 2 Posted 2002-10-28 00:00 ·  中国 江西 吉安 电信
高级用户
★★
Credits 667
Posts 135
Joined 2002-10-25 00:00
23-year member
UID 62
Gender Male
Status Offline
Below is a small program I wrote in 1998, imitating the behavior of the Caterpillar virus. If you're interested, you can paste it and edit it with masm or tasm into an EXE file to run.
==============================
dseg segment
data1 db " The MaoMaoChong is Coming Back ! !! !!!",0ah,0dh
db " ------Writen By Y.L.N 04/18/98 ",0ah,0dh
db " GOOD LUCK For YOU ! !! !!!",0AH,0DH,"$"
data2 db 0Fh, 0Ah, 0Fh, 0Ah,0Fh, 0Ah, 0Fh, 0Ah, 0Fh, 0Ah, 0Fh, 0Ah, 0Fh, 0Ah, 0Fh, 0Ah, F7h, 0Eh, EEh, 0Ch,0ah,0dh,'$'

cury db 00 ;row
curx db 00 ;column
dseg ends
stack segment stack
sta dw 100 dup(?)
stack ends
code segment
assume cs:code,ds:dseg,es:dseg
main proc
start:
push ds
xor ax,ax
push ax
mov ax,dseg
mov ds,ax
mov es,ax

mov ah,02h ;set cursor
mov dh,cury
mov dl,curx
int 10h

mov dx,offset data1 ;print string
mov ah,09h
int 21h

mov dh,03h ;reset cursor
mov dl,00h
mov cury,dh
mov curx,dl

loop1:
inc dl
mov curx,dl
cmp dl,69
jng old
cmp dl,79
jng repeat
mov dl,00
mov curx,dl
inc dh
mov cury,dh
cmp dh,23
jng old
mov dh,03h
mov cury,dh
jmp eed
old: xor ax,ax ;draw MaoMAoChong
mov ax,offset data2
mov bp,ax
mov ah,13h
mov al,10b
mov bh,0
mov cx,0ah
int 10h
mov cx,077fh ;delay
delay1:
push cx
mov cx,0bfh
delay11:
loop delay11
pop cx
loop delay1
repeat:
mov dl,curx
add dl,+11
mov ah,02h ;set cursor
mov dh,cury
int 10h
xor ax,ax
mov ah,08h ;push a character
mov bh,00h
int 10h
mov dl,curx
mov ah,02h ;set cursor
mov dh,cury
int 10h

mov ah,0eh ;clear MaoMaoChong's tail
mov bl,00000101b
mov cx,1
int 10h
mov cx ,077fh ;delay
delay2:
push cx
mov cx,0bfh
delay21:
loop delay21
pop cx
loop delay2
jmp loop1 ;loop until the world is coming to end
eed:
mov ah,00 ;show a page and exit
int 21h

main endp
code ends
end start
===========================
Maybe the delay part needs to be changed, because I originally edited it on a 486, at most a 586 machine. Now the CPU is fast, and you need to increase the loop counts in the delay so that the caterpillar doesn't run too fast, heh heh...

The 8 0Fh, 0Ah after data2 could have been simply written as db 08h DUP(' ', but the ' ' here looks like a blank, actually it's the characters typed by pressing ALT + 015 (numeric keypad) and ALT + 010 (numeric keypad) under DOS. Since it looks like a blank, I still use the more crude way to input, not using this abbreviated way.

One of the reasons I like DOS a lot is that you can program under DOS to precisely control the screen, which is very fun. Heh heh...
Hope such interesting small programs can arouse everyone's little interest in DOS.
================================= kickout
大功告成,打个Kiss!
Forum Jump: