; GhostFix by Paul Ingemi

	.Model	small		; 64k max size
	.Stack	100h		; Reserve 256 bytes for the stack
	
	.Data				; because star trek is cool

verstr		db	"GFix v1.0n by Paul Ingemi (pingemi at wpi.edu)... ","$"
foundstr	db	"Found packet driver.",13,10,"$"
failedstr	db	"No packet driver found.",13,10,"$"
	
	.CODE
	.8086
	
;-----
;macros
;-----

savereg	MACRO
	push	ax
	push	bx
	push	cx
	push	dx
	ENDM
	
restreg	MACRO
	pop	dx
	pop	cx
	pop	bx
	pop	ax
	ENDM

patchint	MACRO	intnum, isr, iss
	savereg					; save working registers
	push	es
	cli						; turn off interrupts
	mov	ah, 035h
	mov	al, intnum
	int	21h
	mov	word ptr iss[2], es	; save old int segment
	mov	word ptr iss[0], bx	; save old int offset
	push	ds				; save current data segment
	mov	ax, seg isr			; Load new routine's code segment
	mov	ds, ax				; Point ds to segment of handler
	mov	dx, offset isr		; Load offset of handler
	mov ah, 25h				; save new handler address
	mov	al, intnum
	int 21h
	sti
	pop	ds
	pop	es
	restreg
	ENDM

;-----
;procedures
;-----

gtap:	jmp	gtapstart
pktline	db	'PKT DRVR'			; Identifies our head patch as a packet driver
myline	db	'PACKET DRIVER patched by Paul!'	; facilitates debugging
realpktdrvr	dd	00h			; real packet driver address

filehandle	dw	00h			; file handle for logging

oldds		dw	00h			; the old ds, needed for some operations
oldcx		dw	00h			; the old cs
oldax		dw	00h			; the old ax
oldsi		dw	00h			; the old si

filename	db	"gfixlog.txt",0

counter		db	00h			; counter
bufsize	dw	00h
	db	'START>'
pktbuffer	db	256 dup(00h)		; buffer stores 256 bytes
	db	'<END'
gtapstart:	

	jmp	startgtap
olddrvrvec	dd	00h
startgtap:
	cli
	savereg
	push	ds
	push	es
	push	di
	push	si

	push	ds			; gotta keep ds intact
	push	cs
	pop	ds
	add	counter, 1d
	pop	bx
	mov	oldds, bx		; save the old registers
	mov	oldax, ax
	mov	oldcx, cx
	push	si
	pop	oldsi

	cmp	ah, 4h			; patch on send
	je	do_send
	cmp	ah, 11h
	je	do_send
gtaptailisland:
	jmp	gtaptail
do_send:

; file logging... not fully working yet. Try to get file creation in init part of TSR
	;mov ah,51h  ; get PSP of current process.
	;int 21h
	;push bx
	;mov ah,50h  ; set our process as current
	;mov bx,cs
	;int 21h

	;mov	ah, 3Ch				; create file/empty file
	;mov	cx, 00h				; no file attribs
	;mov	dx, offset filename		; the filename
	;int	21h
	;mov	filehandle, ax

	;savereg
	;mov	ah, 40h
	;mov	bx, filehandle
	;mov	dx, si
	;mov	cx, oldcx			; use passed cx
	;push	ds
	;push	oldds
	;pop	ds				; use passed ds
	;int	21h
	;pop	ds
	;restreg

	;mov	ah, 3Eh
	;mov	bx, filehandle
	;int	21h

	;mov ah,50h  ; restore the original current proccess
	;pop bx
	;int 21h

; detect UDP WINS packets...
	mov	bx, 00h		; flag if found
	push	oldds
	pop	ds
	cmp	byte ptr [si+23], 11h	; udp proto number
	jne	passPacket
	cmp	byte ptr [si+36], 00h	; check for port 137
	jne	udppassPacket
	cmp	byte ptr [si+37], 137d	; check for port 137
	jne	udppassPacket
; ... perform dest IP substitution on them ...
; !! This code works, but is hardcoded for us. Commented out for general case !!
;	mov	byte ptr [si+30], 141d	; 141.
;	mov	byte ptr [si+31], 133d	; 133.
;	mov	byte ptr [si+32], 176d	; 113.
;	mov	byte ptr [si+33], 97d	; 196
; ... and rewrite IP header checksum  (fscking annoying to get this right)
	mov	byte ptr [si+24], 00h	; zero out the
	mov	byte ptr [si+25], 00h	; checksum
	xor	dx, dx			; might as well use dx for running total
	mov	cx, 10d			; might as well use cx for loop counter
	add	si, 14d			; move up to ip layer
	mov	bx, 18d			; starting offset
csloop:
	mov	ah, byte ptr [si+bx]	; get high byte
	mov	al, byte ptr [si+bx+1]	; get low byte
	add	dx, ax			; increment checksum
	adc	dx, 0d			; (add the carry... 1's complement sum)
	sub	bx, 2d			; decrement offset
	loop	csloop			; loop around!
	not	dx			; take one's complement (??why is this required??)
	sub	si, 14d			; reset si
	mov	byte ptr [si+24], dh	; set checksum
	mov	byte ptr [si+25], dl

	mov	byte ptr [si+40], 00h	; grr... ghost fscks up checksumming... zero it.
	mov	byte ptr [si+41], 00h

	mov	bx, 01h		; set flag
udppassPacket:
passPacket:
	push	cs		; reset ds
	pop	ds
	cmp	bx, 01h		; check flag
	jne	gtaptail

; some logging stuff... logs in memory
	mov	di, offset pktbuffer
	;add	di, bufsize
	mov	cx, oldcx		; use cx passed to us
	mov	bufsize, cx
	push	cs
	pop	es
	push	ds			; use passed ds
	push	oldds
	pop	ds
	push	oldsi			; use passed si
	pop	si
	mov	ch, 00h			; can't/won't copy more than 256
	rep movsb
	pop	ds
gtaptail:
	pop	si
	pop	di
	pop	es
	pop	ds
	restreg
	sti
	jmp	dword ptr cs:realpktdrvr

;-----
;main loop
;-----

startup:	nop				; show version info
	mov	ax, @data
	mov	ds, ax
	mov	dx, offset verstr
	mov	ah, 09h
	int	21h
main:						; search for packet driver
	mov	cx, 5Fh				; start searching for driver at int 60h, get vector
srchloop:
	inc cl
	cmp cl, 81h
	je	faileddrv
	mov	ax, cx				; int. ctr
	mov	ah, 35h
	int 21h					; get vector
	push	es				; go to interrupt segment
	pop	ds
	add	bx, 3d				; offset into interrupt by 3 (where identifier is)
	cmp	byte ptr [bx], 'P'			; check first part
	jne	srchloop
	cmp byte ptr [bx+1], 'K'
	jne	srchloop
	cmp	byte ptr [bx+2], 'T'
	jne	srchloop
	cmp	byte ptr [bx+3], ' '
	jne	srchloop
	cmp	byte ptr [bx+4], 'D'
	jne	srchloop
	cmp	byte ptr [bx+5], 'R'
	jne	srchloop
	cmp	byte ptr [bx+6], 'V'
	jne	srchloop
	cmp	byte ptr [bx+7], 'R'
	jne	srchloop
founddrv:
	mov	ax, @data
	mov	ds, ax
	mov	dx, offset foundstr
	mov	ah, 09h
	int	21h
	jmp	patch
faileddrv:
	mov	ax, @data
	mov	ds, ax
	mov	dx, offset failedstr
	mov	ah, 09h
	int	21h
	mov	ax, 4C00h
	int	21h
patch:
	cli						; turn off interrupts
	mov	ax, cx
	mov	ah, 035h
	int	21h
	mov	word ptr realpktdrvr[2], es	; save old int segment
	mov	word ptr realpktdrvr[0], bx	; save old int offset
	mov	ax, seg gtap		; load ghost tap's code segment
	mov	ds, ax				; point ds to segment of handler
	mov	dx, offset gtap		; load offset of handler
	mov	ax, cx
	mov	ah, 25h				; save new handler address
	int	21h
	sti
openlog:

done:	mov	ax, @data
	mov	ds, ax
	mov	dx, 500h
	mov	ax, 3100h
	int 21h					; Terminate and stay resident
	end startup