reloc.asm

里面包含了N个病毒代码.汇编.c++/c编写

format  PE GUI 4.0
entry   __start

section '.idata' import data    readable executable

    dd      0,0,0,RVA usr_dll,RVA usr_thunk
    dd      0,0,0,0,0

    usr_dll     db      'user32.dll',0

    usr_thunk:
        MessageBox      dd      RVA __imp_MessageBox
                        dd      0

    __imp_MessageBox    dw      0
                        db      'MessageBoxA',0

    pszText     db      'A self-relocation test',0
    pszCaption  db      'RELOCATION',0
    
    __start:
            call    delta
        shit:
            nop
            nop
            nop
        delta:
            pop     ebp
            xor     ecx,ecx
            push    ecx
            lea     esi,dword [ebp+pszCaption-shit]
            push    esi
            lea     esi,dword [ebp+pszText-shit]
            push    esi
            push    ecx
            call    [MessageBox]
            ret