29a-7.026

从29A上收集的病毒源码

                                        mov     h1, eax
                                      }

                           virstr_hash32_v_new()

                                      DWORD h1;
                                      asm
                                      {
                                        mov     esi, s
                                        xor     eax, eax
  char* s = "sample text";            __calc_hash:
  virstr_hash32_v_new(h1, s);           rol     eax, 7
                                        xor     al, [esi]
                                        inc     esi
                                        cmp     byte ptr [esi], 0
                                        jne     __calc_hash
                                        mov     h1, eax
                                      }

                             virstr_callpop()

                                      asm
  char* s1;                           {
  virstr_callpop(s1, "sample            call    $+sizeof("sample_text")
  text");                               db      "sample text",0
                                        pop     s1
                                      }

                           virstr_callpop_new()

                                      char* s1;
                                      asm
  virstr_callpop_new(s1, "sample      {
  text");                               call $+sizeof("sample_text")
                                        db "sample text",0
                                        pop s1
                                      }

                              virstr_stosb()

                                      asm
                                      {
                                        lea     edi, s1
                                        cld
                                        mov     al, 's'
  char s1[260];                         stosb
  virstr_stosb(s1, "sample text");      ...
                                        mov     al, 't'
                                        stosb
                                        xor     al, al
                                        stosb
                                      }

                            virstr_stosb_new()

                                      char s1[12];
                                      asm
                                      {
                                        lea     edi, s1
                                        cld
  virstr_stosb_new(s1, "sample          mov     al, 's'
  text");                               stosb
                                        ...
                                        mov     al, 't'
                                        stosb
                                        xor     al, al
                                        stosb
                                      }

                            virstr_stosb_xor()

                                      asm
                                      {
                                        lea     edi, s1
                                        cld
                                        xor     al, al
  char s1[260];                         sub     al, ...
  virstr_stosb_xor(s1, "sample          stosb
  text");                               xor     al, ...
                                        stosb
                                        add     al, ...
                                        ...
                                        xor     al, al
                                        stosb
                                      }

                          virstr_stosb_xor_new()

                                      char s1[12];
                                      asm
                                      {
                                        lea     edi, s1
                                        cld
                                        xor     al, al
  virstr_stosb_xor_new(s1, "sample      sub     al, ...
  text");                               stosb
                                        xor     al, ...
                                        stosb
                                        add     al, ...
                                        ...
                                        xor     al, al
                                        stosb
                                      }

                              virstr_stosd()

                                      asm
                                      {
                                        lea     edi, s1
                                        cld
  char s1[260];                         mov     eax, 'samp'
  virstr_stosd(s1, "sample text");      stosd
                                        mov     eax, '...'
                                        stosd
                                        mov     eax, 'ext'
                                        stosd
                                      }

                            virstr_stosd_new()

                                      char s1[12];
                                      asm
                                      {
                                        lea    edi, s1
                                        cld
  virstr_stosd_new(s1, "sample          mov    eax, 'samp'
  text");                               stosd
                                        mov    eax, '...'
                                        stosd
                                        mov    eax, 'ext'
                                        stosd
                                      }

                            virstr_stosd_xor()

                                      asm
                                      {
                                        lea     edi, s1
                                        cld
  char s1[260];                         xor     eax, eax
  virstr_stosd_xor(s1, "sample          sub     eax, ...
  text");                               stosd
                                        xor     eax, ...
                                        stosd
                                        add     eax, ...
                                        stosd
                                      }

                          virstr_stosd_xor_new()

                                      char s1[12];
                                      asm
                                      {
                                        lea    edi, s1
                                        cld
  virstr_stosd_xor_new(s1, "sample      xor     eax, eax
  text");                               sub     eax, ...
                                        stosd
                                        xor     eax, ...
                                        stosd
                                        add     eax, ...
                                        stosd
                                      }

                           virstr_stosb_xored()

                                      asm
                                      {
                                        lea edi, s
                                        cld
  char s[260];                          xor al, al
  virstr_stosb_xored(s, "abc",          sub al, -('a' xor 'x')
  "xxxx");                              stosb
                                        xor al, ...
                                        stosb
                                        ...
                                      }

                         virstr_stosb_xored_new()

                                      char s[4];
                                      asm
                                      {
                                        lea edi, s
                                        cld
  virstr_stosb_xored_new(s, "abc",      xor al, al
  "xxxx");                              sub al, -('a' xor 'x')
                                        stosb
                                        xor al, ...
                                        stosb
                                        ...
                                      }

                           virstr_stosd_xored()

                                      asm
                                      {
                                        lea edi, s
  char s[8];                            cld
  virstr_stosd_xored(s, "abcdefg",      xor al, al
  "xxxxxxxxxx");                        sub eax, ...
                                        stosd
                                        xor eax, ...
                                        stosd
                                      }

                         virstr_stosd_xored_new()

                                      asm
                                      {
                                        lea edi, s
  char s[260];                          cld
  virstr_stosd_xored_new(s,             xor al, al
  "abcdefg", "xxxxxxxxxx");             sub eax, ...
                                        stosd
                                        xor eax, ...
                                        stosd
                                      }

                          virstr_stosd_xor_key()

                                      asm
                                      {
                                        lea     edi, s
                                        mov     eax, k
  char s[260];                          cld
  virstr_stosd_xor_key(s, "sample       sub     eax, 0x12345678 - 'samp'
  text", 0x12345678, k);                stosd
                                        xor     eax, ...
                                        stosd
                                        add     eax, ...
                                        stosd
                                      }

                        virstr_stosd_xor_key_new()

                                      char s[12];
                                      asm
                                      {
                                        lea     edi, s
                                        mov     eax, k
                                        cld
  virstr_stosd_xor_key_new(s,           sub     eax, 0x12345678 - 'samp'
  "sample text", 0x12345678, k);        stosd
                                        xor     eax, ...
                                        stosd
                                        add     eax, ...
                                        stosd
                                        ...
                                      }

  ------------------------------------------------------------------------

download VIRSTR library here.
  ------------------------------------------------------------------------

                                                            (x) 2002 Z0MBiE
                                                    http://z0mbie.host.sk/