rmbr.asm

一个汇编病毒源代码

	Format	Binary
	include	'int13e.inc'	
	
	org	100H
	
	;Backup the hardisk Partition Table
	mov	ax,3C00H
	mov	dx,FileNameBak
	mov	cx,0
	int	21H
	mov	[HandleBak],ax

	;Get the Partition Table Data
	mov	si,Int13EDPA
	mov	[si+DevAddrPacketStr.TransBlockNum],1
	mov	ax,ds
	shl	eax,16
	mov	ax,TransBuf
	mov	[si+DevAddrPacketStr.TransBufAddr],eax
	xor	eax,eax
	mov	dword [si+DevAddrPacketStr.TransLBAAddr],eax		;LBA=0
	mov	dword [si+DevAddrPacketStr.TransLBAAddr+4],eax
	mov	ah,42H
	mov	dl,80H
	int	13H
	
	;Write the Partion Table Data File
	mov	bx,[HandleBak]
	mov	dx,TransBuf
	mov	cx,512
	mov	ah,40H
	int	21H
	
	;close the Partitio Table Data File hadler
	mov	bx,[HandleBak]
	mov	ah,3EH
	int	21H


	;Restore the hardisk Partition Table
	;Open the backup File 
	mov	ax,3D00H
	mov	dx,FileNameRes
	int	21H
	jnc	near	@f
	mov	dx,OpenError
	mov	ah,9
	int	21H
	mov	ah,4CH
	int	21H
	@@:
	mov	[HandleRes],ax
	;Reading the data to file buffer
	mov	bx,[HandleRes]
	mov	dx,TransBuf
	mov	cx,512
	mov	ah,3FH
	int	21H
	
	;Write the Partition Table Data
	mov	si,Int13EDPA
	mov	[si+DevAddrPacketStr.TransBlockNum],1
	mov	ax,ds
	shl	eax,16
	mov	ax,TransBuf
	mov	[si+DevAddrPacketStr.TransBufAddr],eax
	mov	dword [si+DevAddrPacketStr.TransLBAAddr],0		;LBA=0
	mov	dword [si+DevAddrPacketStr.TransLBAAddr+4],0
	mov	ax,4300H
	mov	dl,80H
	int	13H
	
	;close the Partitio Table Data File hadler
	mov	bx,[HandleRes]
	mov	ah,3EH
	int	21H
	
	mov	ah,09H
	mov	dx,ResultStr
	int	21H
	mov	ax,4C00H
	int	21H
	
	TransBuf	rb	512
	Int13EDPA	DevAddrPacketStr
	struct		DevAddrPacketStr
		
	HandleRes	dw	0
	HandleBak	dw	0
	ResultStr	db	'Successful restore Hardisk partition table!',0DH,0AH
			db	'You must be reset your machine after quiting program.',0DH,0AH
			db	'Designer:Zheng Hongwen Date:2003-07-31',0DH,0AH,'$'
	OpenError	db	"The file boot.bin not found!",07H,0DH,0AH,'$'
	FileNameRes	db	'boot.bin',0
	FileNameBak	db	'boot.bak',0