![]() |
China DOS Union-- Unite DOS · Advance DOS · Grow DOS --Union site: www.cn-dos.net Forum site: www.cn-dos.net/forum |
| Guest | Log in | Register | Members | Search | China DOS Union |
|
中国DOS联盟论坛 The time now is 2026-09-14 23:26 |
47,812 topics / 349,917 posts / today 0 new / 48,268 members |
| DOS开发编程 & 发展交流 (开发室) » Analysis of the Caterpillar Virus |
| Printable Version 3,424 / 1 |
| Floor1 ko20010214 | Posted 2002-10-21 00:00 |
| 版主 Posts 1,628 Credits 7,296 | |
|
Boot portion of the Caterpillar virus:
Checks whether the last two bytes of c:command.com are 0C0AH; if not, it infects it. Then it loads the virus into the highest end of memory, occupying 2KB of space. Modifies interrupt 21H, intercepting DOS function calls 1AH, 11H, and 12H. Infection portion of the Caterpillar virus: Occupies the first 0CH bytes of the original com file, modifies the CS and IP values so that the program jumps to the virus program. The original 0CH bytes are moved to the virus program at the end of the file, at offset 0BH. When an infected com file runs, it first makes the virus resident in memory, then moves the 0CH bytes back and executes the original com file. Modifies the int21H entry, changing it to XXXX:04A8H. Display portion of the Caterpillar virus: Modifies the int 1CH entry, changing it to XXXX:06B0H. Graphical code of the Caterpillar virus: At XXXX:069AH there is 20 07 0F 0A 0F 0A 0F 0A 0F 0A 0F 0A 0F 0A 0F 0A 0F 0A F7 0E EE 0C The worm body is made of 8 connected 0FH symbols, with attribute 0AH, which is green The worm neck is made of 1 F7H symbol, with attribute 0EH, which is yellow The worm mouth is made of 1 EEH symbol, with attribute 0CH, which is red Set ES to B800H, continuously change the DI value, and call int1CH. Activating the Caterpillar virus under Debug: mov ax,yyyy mov ds,ax mov dx,6b0 mov ax,251c int 21h |
|
| Floor2 kickout | Posted 2002-10-28 00:00 |
| 高级用户 Posts 135 Credits 667 | |
|
Below is a small program I wrote in 1998, imitating the behavior of the Caterpillar virus. If you're interested, you can paste it and edit it with masm or tasm into an EXE file to run.
============================== dseg segment data1 db " The MaoMaoChong is Coming Back ! !! !!!",0ah,0dh db " ------Writen By Y.L.N 04/18/98 ",0ah,0dh db " GOOD LUCK For YOU ! !! !!!",0AH,0DH,"$" data2 db 0Fh, 0Ah, 0Fh, 0Ah,0Fh, 0Ah, 0Fh, 0Ah, 0Fh, 0Ah, 0Fh, 0Ah, 0Fh, 0Ah, 0Fh, 0Ah, F7h, 0Eh, EEh, 0Ch,0ah,0dh,'$' cury db 00 ;row curx db 00 ;column dseg ends stack segment stack sta dw 100 dup(?) stack ends code segment assume cs:code,ds:dseg,es:dseg main proc start: push ds xor ax,ax push ax mov ax,dseg mov ds,ax mov es,ax mov ah,02h ;set cursor mov dh,cury mov dl,curx int 10h mov dx,offset data1 ;print string mov ah,09h int 21h mov dh,03h ;reset cursor mov dl,00h mov cury,dh mov curx,dl loop1: inc dl mov curx,dl cmp dl,69 jng old cmp dl,79 jng repeat mov dl,00 mov curx,dl inc dh mov cury,dh cmp dh,23 jng old mov dh,03h mov cury,dh jmp eed old: xor ax,ax ;draw MaoMAoChong mov ax,offset data2 mov bp,ax mov ah,13h mov al,10b mov bh,0 mov cx,0ah int 10h mov cx,077fh ;delay delay1: push cx mov cx,0bfh delay11: loop delay11 pop cx loop delay1 repeat: mov dl,curx add dl,+11 mov ah,02h ;set cursor mov dh,cury int 10h xor ax,ax mov ah,08h ;push a character mov bh,00h int 10h mov dl,curx mov ah,02h ;set cursor mov dh,cury int 10h mov ah,0eh ;clear MaoMaoChong's tail mov bl,00000101b mov cx,1 int 10h mov cx ,077fh ;delay delay2: push cx mov cx,0bfh delay21: loop delay21 pop cx loop delay2 jmp loop1 ;loop until the world is coming to end eed: mov ah,00 ;show a page and exit int 21h main endp code ends end start =========================== Maybe the delay part needs to be changed, because I originally edited it on a 486, at most a 586 machine. Now the CPU is fast, and you need to increase the loop counts in the delay so that the caterpillar doesn't run too fast, heh heh... The 8 0Fh, 0Ah after data2 could have been simply written as db 08h DUP(' ' , but the ' ' here looks like a blank, actually it's the characters typed by pressing ALT + 015 (numeric keypad) and ALT + 010 (numeric keypad) under DOS. Since it looks like a blank, I still use the more crude way to input, not using this abbreviated way.One of the reasons I like DOS a lot is that you can program under DOS to precisely control the screen, which is very fun. Heh heh... Hope such interesting small programs can arouse everyone's little interest in DOS. |
|
|
[ Contact the Union admin team -
中国DOS联盟 -
Standard version ] Sponsored by ifanr Inc | © 2001–2023 |