seh.asm

Win32病毒入门源码

format  PE GUI 4.0
entry   __start


;
; code section...
;

section '.text' code    readable writeable executable

    _decript:
            mov     ecx,encripted_size              ; decript
            mov     esi,encripted
            mov     edi,esi
        decript:
            lodsb
            xor     al,15h
            stosb
            loop    decript

            mov     eax,[esp+0ch]                   ; context
            mov     dword [eax+0b8h],encripted

            xor     eax,eax                         ; ExceptionContinueExecution
            ret


    __start:
            lea     eax,[esp-8]                     ; setup seh frame
            xchg    eax,[fs:0]
            push    _decript
            push    eax

            mov     ecx,encripted_size              ; encript
            mov     esi,encripted
            mov     edi,esi
        encript:
            lodsb
            xor     al,15h
            stosb
            loop    encript

            int     3                               ; start decription

        encripted:
            xor     eax,eax                         ; simply show a message box
            push    eax
            call    push_caption
            db      'SEH',0
        push_caption:
            call    push_text
            db      'A simple SEH test :P',0
        push_text:
            push    eax
            call    [MessageBox]
        encripted_size    =   $-encripted

            ret


;
; import section...
;

section '.idata' import data    readable

    ; image import descriptor
    dd      0,0,0,RVA usr_dll,RVA usr_thunk
    dd      0,0,0,0,0

    ; dll name
    usr_dll     db      'user32.dll',0

    ; image thunk data
    usr_thunk:
        MessageBox      dd      RVA __imp_MessageBox
                        dd      0

    ; image import by name
    __imp_MessageBox    dw      0
                        db      'MessageBoxA',0