8.13 Demos.
; AX = 214Fh, SP = FFFEh and SS:[FFFE] = 214Fh
0105 25 40 41 and ax, 4140h
; AX = 140h, SP = FFFEh and SS:[FFFE] = 214Fh
0108 50 push ax
; AX = 140h, SP = FFFCh, SS:[FFFC] = 140h and SS:[FFFE] = 214Fh
0109 5B pop bx
; AX = 140h, BX = 140h, SP = FFFEh and SS:[FFFE] = 214Fh
010A 34 5C xor al, 5Ch
; AX = 11Ch, BX = 140h, SP = FFFEh and SS:[FFFE] = 214Fh
010C 50 push ax
010D 5A pop dx
; AX = 11Ch, BX = 140h, DX = 11Ch, SP = FFFEh and SS:[FFFE] = 214Fh
010E 58 pop ax
; AX = 214Fh, BX = 140h, DX = 11Ch and SP = 0
010F 35 34 28 xor ax, 2834h
; AX = 97Bh, BX = 140h, DX = 11Ch and SP = 0
0112 50 push ax
0113 5E pop si
; AX = 97Bh, BX = 140h, DX = 11Ch, SI = 97Bh and SP = 0
0114 29 37 sub [bx], si
0116 43 inc bx
0117 43 inc bx
0118 29 37 sub [bx], si
011A 7D 24 jge short near ptr word_10140
011C 45 49 43 ... db 'EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$'
0140 48 2B word_10140 dw 2B48h ; CD 21 (INT 21) will be here
0142 48 2A dw 2A48h ; CD 20 (INT 20) will be here
0144 0D db 0Dh
0145 0A db 0Ah
We will add comments about the registers and stack after each instruction.
Essentially, all these instructions are here only to execute this code:
B4 09 MOV AH, 9
BA 1C 01 MOV DX, 11Ch
CD 21 INT 21h
CD 20 INT 20h
INT 21hwith 9th function (passed inAH) just prints a string, the address of which is passed inDS:DX. By
the way, the string has to be terminated with the ’$’ sign. Apparently, it’s inherited fromCP/Mand this
function was left in DOS for compatibility.INT 20hexits to DOS.
But as we can see, these instruction’s opcodes are not strictly printable. So the main part of EICAR file is:
- preparing the register (AH and DX) values that we need;
- preparing INT 21 and INT 20 opcodes in memory;
- executing INT 21 and INT 20.
By the way, this technique is widely used in shellcode construction, when one have to pass x86 code in
string form.
Here is also a list of all x86 instructions which have printable opcodes:.1.6 on page 1037.
8.13 Demos
Demos (or demomaking) were an excellent exercise in mathematics, computer graphics programming
and very tight x86 hand coding.
8.13.1 10 PRINT CHR$(205.5+RND(1)); : GOTO 10
All examples here are MS-DOS .COM files.
In [Nick Montfort et al,10 PRINT CHR$(205.5+RND(1)); : GOTO 10, (The MIT Press:2012)]^46
(^46) Also available ashttp://go.yurichev.com/17286