  Nutcracker.AB2.6982.
----------------------------------


ࠧ ᪠,   筮 讥 ⢮ ᮢ
ᥬ⢠ Nutcracker.AB2.   ⠭  ᫥  -
  ⮩ "饩 ".  롮 ।⠢ 
 ࠢ, ..   ⮣  
   -䥢ࠫ 1996-97 . ⠪,    
 䥪権... ;)


 .

ଠ쭮    䠩-㧮, -
, १, ⥫-ᮬ, ࠦ騬 䠩 ଠ COM, EXE,
ࠩ (SYS, BIN),  ⠪  㧮  (MBR) -
  㧮  (BOOT-ᥪ) ᪥.  
   䠩, ⠪   稪.  ଠ樨 ..
ᯥ᪮     ᫮  .


 .

 㧪 ࠦ 䠩 ࢮ砫쭮 ࠢ ।
   ணࠬ-஢騪.  ணࠬ
믮 ஢ ᫥饩 ணࠬ, 室饩 "" 
  ।   ࠢ. , 稢 ࠢ, -
뢠 ᮮ⢥   ᫥饩 ணࠬ 
.. ᫥ ணࠬ    
 䭮 ணࠬ ஢ ᭮ ⥫  
।   ࠢ.  ணࠬ  ᭮-
 ᭮ ⥫, 室  祭 ࢮ  ஢ 01
(஢)  03 (窠 ⠭).  ଠ쭮 樨 (..
 ⫠稪)   ᮤঠ  ⢥ 
IRET ( 0CFh). ,   , 砫쭮 祭
   뢠,  ⭮,  ᯮ짮  -
஢  NOT,NEG,ROL,ROR.

ਬ 䭮 ணࠬ  楯窨 ஢騪 (1):

2A7A:4BE6 3E            DS:                    ; 
2A7A:4BE7 8CD9          MOV     CX,DS          ;
2A7A:4BE9 49            DEC     CX             ;
2A7A:4BEA 02BF3106      ADD     BH,[BX+0631]   ;
2A7A:4BEE 840B          TEST    CL,[BP+DI]     ;
2A7A:4BF0 8D2EB800      LEA     BP,[00B8]      ;  㬮 ணࠬ
2A7A:4BF4 89E9          MOV     CX,BP          ; 뫠  - 稪
2A7A:4BF6 54            PUSH    SP             ; 
2A7A:4BF7 3A2A          CMP     CH,[BP+SI]     ;
2A7A:4BF9 44            INC     SP             ;
2A7A:4BFA 44            INC     SP             ;
2A7A:4BFB E300          JCXZ    4BFD           ;
2A7A:4BFD 8D3E294B      LEA     DI,[4B29]      ; ᬥ饭 㬮 ணࠬ
2A7A:4C01 8CD6          MOV     SI,SS          ; 
2A7A:4C03 57            PUSH    DI             ;  ᬥ饭  ⥪
2A7A:4C04 0A734F        OR      DH,[BP+DI+4F]  ; 
2A7A:4C07 D2CF          ROR     BH,CL          ;
2A7A:4C09 B0CD          MOV     AL,CD          ; ᪠  ஢
2A7A:4C0B 0295D2FB      ADD     DL,[DI+FBD2]   ; 
2A7A:4C0F FFC6          INC     SI             ;
2A7A:4C11 8CCE          MOV     SI,CS          ;
2A7A:4C13 F8            CLC                    ; CF=0
2A7A:4C14 1805          SBB     [DI],AL        ; 㥬 
2A7A:4C16 8A7178        MOV     DH,[BX+DI+78]  ; 
2A7A:4C19 7C01          JL      4C1C           ;
2A7A:4C1B 43            INC     BX             ;
2A7A:4C1C F6D0          NOT     AL             ; 塞 
2A7A:4C1E 2A5F85        SUB     BL,[BX-7B]     ;
2A7A:4C21 F8            CLC                    ; CF=0
2A7A:4C22 F5            CMC                    ; CF=1
2A7A:4C23 1805          SBB     [DI],AL        ; 㥬 
2A7A:4C25 7B03          JPO     4C2A           ; 
2A7A:4C27 D0DF          RCR     BH,1           ;
2A7A:4C29 FB            STI                    ;
2A7A:4C2A D0C0          ROL     AL,1           ; 塞 
2A7A:4C2C 9F            LAHF                   ; 
2A7A:4C2D 0005          ADD     [DI],AL        ; 㥬 
2A7A:4C2F F7DD          NEG     BP             ; 
2A7A:4C31 51            PUSH    CX             ;
2A7A:4C32 8D5855        LEA     BX,[BX+SI+55]  ;
2A7A:4C35 44            INC     SP             ;
2A7A:4C36 44            INC     SP             ;
2A7A:4C37 D3CB          ROR     BX,CL          ;
2A7A:4C39 2805          SUB     [DI],AL        ; 㥬 
2A7A:4C3B 3217          XOR     DL,[BX]        ; 
2A7A:4C3D F8            CLC                    ; CF=0
2A7A:4C3E 1005          ADC     [DI],AL        ; 㥬 
2A7A:4C40 0E            PUSH    CS             ; 
2A7A:4C41 83C402        ADD     SP,+02         ;
2A7A:4C44 347F          XOR     AL,7F          ; 塞 
2A7A:4C46 8DB39217      LEA     SI,[BP+DI+1792] ; 
2A7A:4C4A 3ABBA802      CMP     BH,[BP+DI+02A8] ;
2A7A:4C4E 7D00          JGE     4C50           ;
2A7A:4C50 24C2          AND     AL,C2          ; 塞 
2A7A:4C52 47            INC     DI             ; ६ ᫥騩 
2A7A:4C53 49            DEC     CX             ; 㬥蠥 稪
2A7A:4C54 75B9          JNZ     4C0F           ; ᫨ ஢  , 
2A7A:4C56 F7D6          NOT     SI             ; 
2A7A:4C58 26            ES:                    ;
2A7A:4C59 847605        TEST    DH,[BP+05]     ;
2A7A:4C5C 56            PUSH    SI             ;
2A7A:4C5D 81F573BB      XOR     BP,BB73        ;
2A7A:4C61 83C402        ADD     SP,+02         ;
2A7A:4C64 D3E2          SHL     DX,CL          ;
2A7A:4C66 0228          ADD     CH,[BX+SI]     ;
2A7A:4C68 22A640C8      AND     AH,[BP+C840]   ;
2A7A:4C6C 5B            POP     BX             ; ⠫  ⥪ ᬥ饭 ᫥. ணࠬ
2A7A:4C6D FFE3          JMP     BX             ; ।   ࠢ

ਬ 䭮 ணࠬ  楯窨 ஢騪 (2):

2A54:4BF9 1C74          SBB     AL,74          ; 
2A54:4BFB 52            PUSH    DX             ;
2A54:4BFC 5D            POP     BP             ;
2A54:4BFD 045D          ADD     AL,5D          ;
2A54:4BFF 7C00          JL      4C01           ;
2A54:4C01 2D3F1B        SUB     AX,1B3F        ;
2A54:4C04 8D0EDB00      LEA     CX,[00DB]      ;  㥬 ணࠬ
2A54:4C08 221C          AND     BL,[SI]        ; 
2A54:4C0A BF1B4B        MOV     DI,4B1B        ; ᬥ饭 㬮 ணࠬ
2A54:4C0D 9E            SAHF                   ; 
2A54:4C0E 91            XCHG    CX,AX          ;
2A54:4C0F 91            XCHG    CX,AX          ;
2A54:4C10 57            PUSH    DI             ;  祭 ᬥ饭  ⥪
2A54:4C11 81EDB649      SUB     BP,49B6        ; 
2A54:4C15 45            INC     BP             ;
2A54:4C16 B055          MOV     AL,55          ; 砫쭮 祭 ᪨ ஢
2A54:4C18 80EBB2        SUB     BL,B2          ; 
2A54:4C1B D1ED          SHR     BP,1           ;
2A54:4C1D 1A27          SBB     AH,[BX]        ;
2A54:4C1F 2805          SUB     [DI],AL        ; 㥬 
2A54:4C21 AE            SCASB                  ; ६ ᫥騩
2A54:4C22 49            DEC     CX             ;  ?
2A54:4C23 75F6          JNZ     4C1B           ;  - ஢ ᫥騩
2A54:4C25 8CD0          MOV     AX,SS          ; 
2A54:4C27 81DEC1B2      SBB     SI,B2C1        ;
2A54:4C2B 2F            DAS                    ;
2A54:4C2C 7B00          JPO     4C2E           ;
2A54:4C2E 7000          JO      4C30           ;
2A54:4C30 93            XCHG    BX,AX          ;
2A54:4C31 80F63A        XOR     DH,3A          ;
2A54:4C34 7F00          JG      4C36           ;
2A54:4C36 5D            POP     BP             ; ⠫  ⥪ ᬥ饭 ᫥. ணࠬ
2A54:4C37 FFE5          JMP     BP             ; ।   ࠢ

 ⬥,  樨, ।⢥ 騥 ணࠬ
  SUB/SBB/ADD/ADC.  ᯨ᮪ 権  ᪮ 㤠 
ࠧࠧ: INC/DEC/SUB/ADD/XOR/NOT/NEG/ROL/ROR/SHR/SHL/OR/AND.  ⢥
ॣ஢ 樨  ᯮ짮 SI/DI/BX.  樨  :
[BaseRegister], [BaseRegister+XX], [BaseRegister+XXXX].  ⠪  ᯮ-
ᮡ । ࠢ: JMP WordRegister/RETN/RETN 0000/RETF/RETF 0000/IRET.


ਬ 䭮 ணࠬ ஢ ᭮ ⥫ (1):

2A54:0100 38EC          CMP     AH,CH          ; \
2A54:0102 FFC3          INC     BX             ;  -  樨
2A54:0104 383A          CMP     [BP+SI],BH     ; /
2A54:0106 8D1E0000      LEA     BX,[0000]      ; BX=0
2A54:010A 53            PUSH    BX
2A54:010B 07            POP     ES             ; ES=0
2A54:010C 26            ES:
2A54:010D C5770C        LDS     SI,[BX+0C]     ; ६  Int 03h
2A54:0110 FA            CLI                    ; 頥 뢠
2A54:0111 3E            DS:                    ; ୠ 
2A54:0112 8A04          MOV     AL,[SI]        ; 砥  AL 祭 ࢮ  Int 03h
2A54:0114 B9D91B        MOV     CX,1BD9        ;  㥬 ⪠
2A54:0117 BE9E52        MOV     SI,529E        ; ⭮⥫쭮 ᬥ饭 ⪠
2A54:011A 2E            CS:
2A54:011B F6949AAD      NOT     BYTE PTR [SI+AD9A]   ;㥬 
2A54:011F 80E0F9        AND     AL,F9          ; 塞  (  砥  ᯮ)
2A54:0122 46            INC     SI             ; ६ ᫥騩 
2A54:0123 E2F5          LOOP    011A
2A54:0125 F6D4          NOT     AH             ;
2A54:0127 8A2E3B6D      MOV     CH,[6D3B]      ;
2A54:012B F602BF        TEST    BYTE PTR [BP+SI],BF  ;
2A54:012E 2251AD        AND     DL,[BX+DI-53]  ;
2A54:0131 F7D9          NEG     CX             ;   樨
2A54:0133 227A94        AND     BH,[BP+SI-6C]  ;
2A54:0136 A6            CMPSB                  ;
2A54:0137 47            INC     DI             ;
2A54:0138 ??            ᭮ ⥫ 

ਬ 䭮 ணࠬ ஢ ᭮ ⥫ (2):

2A5E:0100 86E7          XCHG    AH,BH          ; 
2A5E:0102 3270C4        XOR     DH,[BX+SI-3C]  ; 
2A5E:0105 31C0          XOR     AX,AX          ; AX=0
2A5E:0107 50            PUSH    AX
2A5E:0108 07            POP     ES             ; ES=0
2A5E:0109 26            ES:
2A5E:010A C4360C00      LES     SI,[0004]      ;   Int 01h
2A5E:010E 26            ES:
2A5E:010F 8A3C          MOV     BH,[SI]        ; 祭 ࢮ   Int 01h
2A5E:0111 8D0E191B      LEA     CX,[1B19]      ;  㥬 ⪠
2A5E:0115 BFEA03        MOV     DI,03EA        ; ⭮⥫쭮 ᬥ饭
2A5E:0118 FA            CLI                    ;  뢠
2A5E:0119 F6D7          NOT     BH             ;  
2A5E:011B 2E            CS:
2A5E:011C 283D          SUB     [DI],BH        ; ஢ 
2A5E:011E 83EFFF        SUB     DI,-01         ;  ᫥騩
2A5E:0121 81E90100      SUB     CX,0001        ; 稪 ௠ ?
2A5E:0125 75F2          JNZ     0119           ;  - ஢ ᫥騩 
2A5E:0127 84B80050      TEST    BH,[BX+SI+5000]  ;
2A5E:012B 8CD1          MOV     CX,SS          ;
2A5E:012D F6475CC2      TEST    BYTE PTR [BX+5C],C2 ;
2A5E:0131 81CB536C      OR      BX,6C53        ;
2A5E:0135 95            XCHG    BP,AX          ;  
2A5E:0136 FA            CLI                    ;
2A5E:0137 FA            CLI                    ;
2A5E:0138 ??            ᭮ ᭮ ⥫

᫥ ஢  ।,   䠩  室  ⠫-
    ()  .  ந ᫥ ᫥-
⥫쭮 ⢨:

   1) ⠫   (䭮 ࠦ MBR);

 砥  ᪮ ࠩ Fn=13h (Int 2Fh)   쭥襬 -
뢠 Int 13h १ 祭 .   室  -
    (ADM-).   ࠧ頥  ᫥
14- ᥪ ࢮ ஦ ࢮ . ࢮ砫쭮 ⥫ 뢠-
  ஢ .  ।⥫쭮 ஢, 稭  -
-  ࠧ  ࢮ ஦ , ᫨ 稭,  ஢
MBR  ந室.  MBR  뢠  ணࠬ 㧪
᭮  .    ਣ쭮 MBR- ( -
宦  CLD   45-  ਣ쭮 MBR, 稭  
)   砫 MBR-. ।⥫쭮  ஢  
   ᮮ⢥⢨ JMP SHORT, JMP NEAR, CALL NEAR  砥  -
   MBR.

   2)   ࠧ MBR  १ ⥪騩 MCB  ⠥
      १⭮  , 墠뢠 Int 13h  Int 21h.  ⮬ 砥
       ࠦ  䠩   ᪠.

      ⠫    䠩.

ࢮ砫쭮  ⠥ 뤥 ᥡ   UMB   ᭮ .
 㤠 (⢨ ᢮  室饩 )  १
⥪騩 MCB (MCB ணࠬ)  室 稭,  ⥬  ࠧ
뤥 ᥡ    ᮧ ⠬ १ .   
MCB  ⠢ 0008 (ਭ DOS). ᫥ ⮣ ந室 墠 -
஢ 뢠 13h, 21h.  ⮣  ନ    室
(JMP FAR)  ᠬ 0:4F6h (Int 13h)  0:4FBh (Int 21h)  ᮡ⢥ -
稪 뢠 Int 13h  Int 21h,   ⠡ 뢠  뫪 
ᮮ⢥騥 JMP FAR.  ⬥,  ᥣ  ᬥ饭 ஢ -
뢠  ᮬ  ࠧ -,  ⠪ ࠧ, ⮡ -
᪨  ᥣ 㪠뢠  0:4F6h  0:4FBh ᮮ⢥⢥.  쭥襬
 ࠥ ६ ᥡ  UMB    १⭮  DOS 
᭮ .
 ࠩ ⠫      ᮡ.  ⮬
砥  ᮧ ᢮ १   ᥣ 6E00h:0000.  墠-
뢠 Int 13h/21h 㪠  ᯮᮡ.  쭥襬,  ᪥ ࢮ
ணࠬ १ Fn=4b00h/Int 21h  뤥 ᥡ   ७ -
⨢    뤥 ᥣ.

   3) ந  ணࠬ.

 COM  EXE, ਢ ᮬ  ଠ COM, ணࠬ ந
᫥騬 ࠧ. ..  室  । ணࠬ,   
 ᮧ ᢮    ᥣ ணࠬ.  ⢨ 筮
-     뢠  믮 (INT 20h).  ᮧ
,  । ࠢ.   ந  室 ⢨
 ⠫樨    (, ,  ),  ⥬:

- ⠭  3  ணࠬ;
-  ࠭ ⮪ ணࠬ ;
-  ⮪ ७     ணࠬ (ணࠬ ⠭-
    );
- ᫨ 㦠  - EXE,  믮 ன relocation table 
  ணࠬ ७ "" PSP (ࠥ EXE Header  relocation table);
- 믮 ன  ॣ஢  ᮮ⢥⢨  祭ﬨ, ।-
  묨 DOS;
- ࠢ । ਣ쭮  ணࠬ.

 稨   ⨢ १⭮   ணࠬ ந
.  ⮬ 砥 ६ ࠡ   ᮧ.

 EXE ணࠬ, ஢ ᯮᮡ  窨 室  
ந ᫥騬 ࠧ:

- ந ன CS:IP, SS:SP  ᮮ⢥⢨  ࠭묨 祭ﬨ;
- 믮 ன  ॣ஢  ᮮ⢥⢨  祭ﬨ, ।-
  묨 DOS;
- ࠢ । ਣ쭮  ணࠬ.

 ࠩ (SYS/BIN):

- ⠭ ਣ  ணࠬ ⥣ ࠩ;
-  ࠭ ⮪ ணࠬ ;
-  ⮪ ७     ணࠬ (ணࠬ ⠭-
    );
- ⠭ 祭  ॣ஢, ࠭  室  楯
   ஢騪;
- ࠢ ।  ਣ ணࠬ ⥣ ࠩ.


 .

 㧪   ᪥ ࢮ砫쭮 ࠢ 砥 -
  稪, 室騩  BOOT-ᥪ ᪥.

ਬ 䭮 稪  ᪥ (1):

2B3E:013E 29C9          SUB     CX,CX         ; CX=0
2B3E:0140 F8            CLC                   ; 
2B3E:0141 8ED1          MOV     SS,CX         ; SS=0
2B3E:0143 BC007A        MOV     SP,7A00       ; SP=7A00h
2B3E:0146 1AE9          SBB     CH,CL         ; 
2B3E:0148 30E4          XOR     AH,AH         ; AH=0
2B3E:014A CD13          INT     13            ;  
2B3E:014C 8EC4          MOV     ES,SP         ; ES=7A00h
2B3E:014E 8D1E0000      LEA     BX,[0000]     ; BX=0
2B3E:0152 FD            STD                   ; 
2B3E:0153 8D160000      LEA     DX,[0000]     ; =0/ன⢮=0 (A:)
2B3E:0157 90            NOP                   ; 
2B3E:0158 B9C250        MOV     CX,50C2       ; ४=80/ᥪ=194
2B3E:015B F8            CLC                   ; 
2B3E:015C 8D060E02      LEA     AX,[020E]     ; 㭪=2 (⥭)/- ᥪ஢=14
2B3E:0160 3E            DS:                   ; 
2B3E:0161 CD13          INT     13            ;  ⥫
2B3E:0163 F5            CMC                   ;  CF
2B3E:0164 73E2          JNB     0148          ;  訡,  
2B3E:0166 80E895        SUB     AL,95         ; 
2B3E:0169 F6D4          NOT     AH            ; 
2B3E:016B 06            PUSH    ES            ;   ⥪ ᥣ
2B3E:016C 8D165600      LEA     DX,[0056]     ; ᬥ饭  । -  
2B3E:0170 52            PUSH    DX            ;   ⥪ ᬥ饭
2B3E:0171 CB            RETF                  ; । ࠢ  ᭮ 

ਬ 䭮 稪  ᪥ (2):

2B3E:013E 31ED          XOR     BP,BP         ; BP=0
2B3E:0140 2E            CS:                   ; 
2B3E:0141 55            PUSH    BP
2B3E:0142 17            POP     SS            ; SS=0
2B3E:0143 BC0071        MOV     SP,7100       ; SP=7100h
2B3E:0146 26            ES:                   ; 
2B3E:0147 28E4          SUB     AH,AH         ; AH=0
2B3E:0149 CD13          INT     13            ;  
2B3E:014B FD            STD                   ; 
2B3E:014C 8EC4          MOV     ES,SP         ; ES=7100h
2B3E:014E F8            CLC                   ; 
2B3E:014F 8D160000      LEA     DX,[0000]     ; =0/ன⢮=0 (A:)
2B3E:0153 B98D50        MOV     CX,508D       ; ४=80/ᥪ=141
2B3E:0156 26            ES:                   ; 
2B3E:0157 26            ES:                   ; 
2B3E:0158 B80E02        MOV     AX,020E       ; 㭪=2 (⥭)/- ᥪ஢=14
2B3E:015B FA            CLI                   ; 
2B3E:015C BB0000        MOV     BX,0000       ; BX=0
2B3E:015F 36            SS:                   ; 
2B3E:0160 CD13          INT     13            ;  ⥫
2B3E:0162 72E2          JB      0146          ;  訡, 
2B3E:0164 EA431B0071    JMP     7100:1B43     ; । ࠢ  ᭮ 

 稪 ந 㧪 ᭮ ᭮ , 室饣
 ⠭⭮ ଠ஢ ୮ ஦ ᪥  । 
 ࠢ. 稢 ࠢ, ᭮   ⠭
   BOOT-稪   ਣ쭮   ந ᢮ -
⠫  .  訡 ⠫樨 ( , 訡 -
...)  ४砥  䠩 ० ࠡ (.. ᮬ 
ࠤ 䠩   ᪠).  ⨢ 砥  㤥 ࠦ
䠩 ⮫쪮  ᪥ ( ⮬ ᫥   ஢)  ⥢ ᪠.
⥬  墠뢠 뢠 Int 13h  ⤠ ࠢ ਣ-
 BOOT-ᥪ.   ࠡ⪨ Int 13h   祭
ᥣ  Int 21h ,   ⠭  0800h (.. DOS 㦥
㦥), 墠뢠 Int 21h.

㧪      ᮡ:

- ᫨ 㧪 ࢠ (..  ᠭ  ஢ ), 
     ஢騪   ᢮ . 祬 
  ⢥ 砫쭮 ᪨  ஢ ᯮ 祭 ࢮ
    ࠡ稪 BIOS Int 01h  Int 03h.   祭 -
     ᯮ짮 (   NEG/NOT/ROR/ROL).
   ⮣,   㧪 DOS   ⠭ ⪮ 
  IRET  ࠭ ண 祭 , ஢ ᭮ 
   - DOS  ।⠢ !
  ᫥  १뢠 ᢮ ஢   ஢.
-   ந ⢨,  ࠡ  ० 㧪 
  BOOT ᪥ (⮫쪮  ந ⪠ ஢ ).


STEALTH .

室  ,  ।ਭ ᫥騥 ⢨  ᮪ ᢮
⢨  :

-  ⥭ ᥪ஢, ᮤঠ ᭮ ⥫  ࢮ ४ 
   ⠢   ⥭ 㫨;
-  ⥭ ஢ MBR  ⠢   ஢
  ࠧ;
-  ⪥ , ଠ஢,   ᥪ஢ ஢
  MBR  ᥪ஢ ᭮ ⥫    樨  
  " ᪠", .. 믮  権 ;
-  ⪥   ஢ 䠩 १ 맮 㭪樨 Find
  First/Find Next  Find First via FCB/Find Next via FCB,  ⠢
    ਣ  䠩. 饭 䠩  ࠦ  -
    ᫥   ஢ 䠩.


    .

 㤭 ᢮ 㦥   ᮬ ᯮ ६饭
⨢   .  ⮣ ᮬ ᫥ 믮 DOS Fn=
4B00h (Exec)  :

- .. । 㧪 䠩   ᢮ ,  ⠥
  뤥   室  (,  UMB);
- ᫨  뤥 ᯥ譮,  ᮬ ஢  ᥣ 뤥-
      ७ ᢮    ᥣ  砥, ᫨:
  a) ⥪騩 ᥣ 室  ᭮ ,  뤥  UMB;
  b) ⥪騩 ᥣ  ᭮  室     ⭮-
     襭  뤥;
  c) ⥪騩 ᥣ  UMB 室     ⭮襭  뤥-
     .
  ᫨      ᫮  믮,   ᢮ -
     ⠥  ⥪饬.
- ᫥ ७ᥭ ⥫      ४ ᥣ
    JMP FAR  ࠡ稪 뢠.


 .

஢ 䠩 ந室  ᪥, २, ⨨,
ᮧ.  ࠦ  । - ᢮   ᪥
 ࠦ 䠩    ᫥, ᫨  筮.
। ࠦ  ⪫砥 ० 䨪樨, 뢠  䠩
ਡ.   ਡ⮬ "⥬" ᮬ  ࠦ.  -
 COM,SYS,BIN   EXE 䠩 ⮤ ७  ।,
 ᭮  EXE ⮤      窨 室.
⮤ ७  । ࠦ ⮫쪮  EXE 䠩, ࠧ -
  50K,   ᬥ饭 relocation table < 40h (.  Win-
䠩),  ⮬ 砥  ਢ   ଠ COM 䠩, .. ⠢-
  JMP  CALL NEAR   砫.

⮤ ७  ।:

-   砩 ᫮   ,  ᨬ  ,
  뢠   ந쭮  䠩.    -
     6982...7236 ;
- ᫥ ⮣      ।   
   砩 ᮪  뢠 ஢    䠩;
-     ᮡ⢥ ⥫  뢠   
  ⠭ ⪠;
- ᫥⥫쭮  楯窠 ਯ஢,  뢠
    䠩;
-  砫 䠩 뢠  JMP  CALL NEAR  ᫥ -
   ਯ (騩    䠩).

⮤ ७   EXE - 䠩:

-    ᢮ ⥫    뢠    䠩;
- ᫥⥫쭮  楯窠 ਯ஢,  뢠
    䠩;
- 祭 CS ⠭   ᥣ, IP   ஢-
  騪. 祭 SS:SP ⠪ ⠭ ⠪ ࠧ, ⮡  ᯮ-
    .

EXE 䠩, ࠧ   䠩 ⫨砥  ࠧ  , 祬
 511  (  ᫥ ࠭)  ࠦ.
  䠩 뢠   饭 .
ਧ ࠦ 䠩 ⠭   ᥪ㭤    -
ᨬ  祭   ६ ᮧ 䠩, 祬  ⭮
1/29 ਧ  祭 ᥪ㭤  ⠢, .. ⠪ 䠩  
஢ ᮬ ୮.
 ࠡ  䠩 ᮬ 墠뢠 뢠: Int 23h (Ctrl/Break)-
IRET, Int 24h (I/O error), Int 2Ah (Microsoft Network) - IRET.  ६ -
 १ 㭪樨 DOS  ⠭ Int 3 (Break Point)   -
ࠡ稪 Int 21h  뢠 Int 21h १ Int 3.
ᮬ ⠪ 墠뢠 DOS 㭪 5701h (Set File Data/Time) , 
⪥  ६, ᮤঠ饥 ਧ ஢   ᥪ㭤,
 ⠭ ਧ  ᮮ⢥⢨   祭.


 .

, 墠뢠 Int 13h, ᫥ 饭  ⥭ BOOT-ᥪ
᪠ A:  B:  (᫥  ⥭):

- ஢  BOOT ਧ ஢ , ᫨ BOOT 㦥 ஢,
  쭥訥 ⢨ ;
- ᫨ ᥪ஢  ४ , 祬 14, BOOT  ࠦ;
-   室  㧮  (  JMP SHORT,JMP NEAR,CALL
  NEAR);
- ᫨ 室 ந ᫨誮 ""  ,  BOOT  -
  ;
-  뢠 MBR  ᪥ (஢ઠ   );
- ᫨  諠 ᯥ譮,     ୮ 樫
   ⠭⭮ ଠ  (砩   砫쭮 ᥪ);
-  뢠 ᢮ ⥫  . ४,   BOOT ᢮ 
  稪  뢠 稪  ᪥.


 .

  ᮤন    (  ணࠬ -
樨 䭮 ):

-  䭮 ணࠬ ஢ ᭮  ;
-  䭮 稪 ( MBR  BOOT);
-  楯窨  ஢騪  䠩.

  筮 ᫮  ஬ ⬮ ⠫쭮 ᠭ
 ஢  ᪠. ᫨    ᮢ,
४   ᥬ஢ ।⢥ ᭮ .


 .

 㤭 祭 , 室  㧮筮 ० ࠡ (..
㧪  ந室  MBR)   ᥪ ४਩ -
.  ⢥ 砫쭮 ᪨ ஢ ᯮ ६ ᮧ
 ४ਨ,  ⢥ 筮 (᪨ ४樨) - 祭 ᬥ-
 BIOS Int 00h.  祭    뢠  
  DOS , ..  Int 00h ⠭  㧪 DOS
⪮  DOS-ࠡ稪  ࠭ BIOS-.   ⮣, 㧨-
  ⮩ ⥬ ᪥ ஢ ⠫  ।⠢ -
. ஢ ந室 ᫥騬 ࠧ:

- ᫥ 樨 ⥭   ᥪ஢       ᨣ-
  , ᮮ⢥ 砫 ४ਨ , ᫨ ⠪ , ஢-
  : ஢   ᥪ, ᫨ ᥪ ஢,   -
       ;
-    ஢ ᥪ  .


  .

ᮬ ᫥    䠩  ᫥騬 :
SCAN,CLEAN,VSAFE,NAV,AVP,AIDS,GUARD,NOD,F-PROT,DESINF,VIRSTOP,VSH,
FINDVIRU,VIVERIFY,TB,RKSD,COMMAND,SETVER,WEB,DRWEB.

ᮬ 㤠 ᫥騥 䠩  ⪥ 㯠  :
CHKLIST  - 䠩 ஫ 㬬 VSAFE.
ADINF    - ⨢-ॢ.
SMARTCHK - ???.
ANTI-VIR - 䠩 ஫ 㬬 TBSCAN.
 ⠪ 䠩  ७  - ⠭⭮ ७ ⠡ ADinf.

 ६ ࠡ ਢ 䠩 ᮬ ⪫砥 Stealth-०:
CHKDSK,PKZIP,PKLITE,WEB,DRWEB.


   NOVELL.

 㭪樮஢  쭮  Novell ᮬ ਭ  :

- ᫨ ᪠  믮 䠩   NET?, EMSNEXT, XMSNET,
  (⥢ ࠩ)   ⠭ 뢠 Int 21h, -
  ࠭   ࠡ稪;
-  ந 㧪  믮 䠩;
- ᫥ ⮣  ᭮ 墠뢠 Int 21h    ᢮ ⥫
  祭 Int 21h, 㪠뢠饥  १  ⥢ ࠩ.
  ..  "" ⥢ ᪨.


 .

⨢ ⪠  砥 ࠢ ⮫쪮  㧪  -
   ᪥  ⮫쪮  12- ﭢ  . 
믮  ᫮  ⪫砥   ଠ  16
஭   樫  ᪨ ᪮, ⠭  -
. 祬 ଠ஢   ᫥⥫쭮   ᪮, 
"ࠫ쭮", .. ᭠砫 ଠ  樫  ࢮ ᪥, -
⥬  ஬  .., ⥬ ன 樫  ࢮ  ..

                    Nice // SPS06.
                     2:454/7.64@FidoNet

