Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- ;This is an Assembly File to generate the EICAR AntiVirus Test File
- org 0100h ;Make this a DOS .com Executable
- pop ax ;AX=0 SS:[SP]=0
- xor ax,214Fh ;AX=0x214F
- push ax ;SP=0xFFFE SS:[SP]=0x214F
- and ax,4140h ;AX=0x0140 ->0x0140=instruction Location after the EICAR String
- push ax ;SP=0xFFFC SS:[SP]=0x0140
- pop bx ;BX=0x0140 SP=0xFFFE
- xor al,5Ch ;AX=0x011C ->0x011C=EICAR String Memory Location
- push ax ;SP=0xFFFC SS:[SP]=0x011C
- pop dx ;DX=0x011C SP=0xFFFE
- pop ax ;AX=0x214F SP=0x0
- xor ax,2834h ;AX=0x097B
- push ax ;SP=0xFFFE SS:[SP]=0x097B
- pop si ;SI=0x097B SP=0x0
- sub [bx],si ;[0x0140]=0x2B48-0x097B=0x21CD ->Self modify Code: change Instruction at 0x0140 to "int 0x21" (DOS print string call)
- inc bx ;BX=0x0141
- inc bx ;BX=0x0142
- sub [bx],si ;[0x0142]=0x2A48-0x097B=0x20CD ->Change Instruction at 0x0142 to "int 0x20" (DOS exit call)
- jge 0140h ;Jump to the (meanwhile) changed Instruction at 0x0140
- ;Above is the "Jump if greater or equal" Instruction, but because of the Subtraction
- ;this Jump is always performed. (ZS Flag is unset after Subtraction)
- DB "EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$"
- dec ax ;These two Instructions are just here to
- sub cx,[bx+si+2Ah] ;occupy space and are rewritten at Runtime
- ;Conclusion
- ;==========
- ;
- ;We did the folowing:
- ;
- ;1. use only ASCII printable chars to output Text
- ;2. modify the Code at runtme with the non ASCII-printable interrupt calls
- ;
- ;We could do instead (if non ASCII-printables is allowed):
- ;----------------------
- ;org 0100h ;Declare this as a DOS .com File -> Statement depends on Assembler used.
- ;mov dx,msg ;Depending on the Assembler, the Modifier "OFFSET" is required before msg
- ;mov ax,097Bh ;Put the Print String Function (0x09) in AH Register (AL is 0x7B but we don't care)
- ;int 21h ;Call the Print Function
- ;int 20h ;Exit the Application
- ;msg DB "EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$"
- ;----------------------
- ;This will generate a smaller .com File that contains non-ASCII-printable chars in it.
- ;Above Code does not generates the EICAR File
- ;
- ;Do we have another Method for generating a valid EICAR File?
- ;
- ;Yes:
- ;Create a new File with only the Folowing line and assemble it.
- ;----------------------
- ;DB "X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*"
- ;----------------------
- ;Come on, that's silly!
- ;- But it works!
- ; You may also wish to add "org 0100h" as the first line for it to generate valid .com Files
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement