ša A CVL #03, 98/03 ----------------------------------------------------------------------> Red_Fox 40Hex Number 9 Volume 2 Issue 5 File 008 ************************************* ša A, a aa ************************************* CODE OPTIMISATION, A BEGINNER'S GUIDE ************************************* Written by Dark Angel ************************************* aai Abi ae ae Aa. aaa aáA i w ỡ aa ei g a aA Ea. eAe a aa ai e wA Ё waVa. AAe a w a. aa i áe šai Aa e a. check_install: mov ax,1234h int 21h cmp bx,1234h ret install_virus: call check_install jz exit_install ᷁ we a { A i a. install_virus: mov ax,1234h int 21h cmp bx,1234h jz exit_install iQ {e aaa aq {e a ei ɷЁ aa qqi ea. ae, we aa ae waǥa. a 苡 (get attributes) w a e (open file read/only) a (read file) a h (close file) qqAae qq AA (exit if already infected) (clear attributes) /a a e (open file read/write) a b e a (get file time/date) Ё a (write new header) a {a ͡ (move file pointer to end of file) aa a be (restore file time/date) a h (close file) (restore attributes) { (exit) ᷁ aa qq i aqa a a. 苡 (get attributes) (clear attributes) /a a e (open file read/write) a (read file) a qqAae a h (if infected, exit to close file) a b e 苡 (get file time/date) ͡i {a (move file pointer to end of file) aa concatenate virus qa ͡ (move file pointer to beginning) Ё a (write new header) a be (restore file time/date) a h (close file) (restore attributes) {(exit) 弁 wi awae e i a. ša Ae aq {a. {e Зi ae a bewwa a e a. aa aw ge Ae aq {e a. mov ax,0 ; wwe 3 aa a. mov bp,0 ; xor ax,ax ; {e i ae 2 aa a. xor bp,bp ; a sub ax,ax ; b 2 aa a. sub bp,bp a a. aw ᶅ A we Aaa ti w i a. mov bh,5h ; 2 bytes mov bl,32h ; 2 bytes ; :4 aa --> mov bx,532h ; 3 aae Ea. 1 aai a. Awe s‚e ai e Жi AX A BX a Ѕi ti aa w a. mov bx,ax ; 2 bytes --> xchg ax,bx ; 1 byte ae Ae ͡ i a. mov ax,4202h ; "mov ah,42h / mov al,2" A 1 aai a. xor dx,dx ; "mov dx,0" A 1 aai a. xor cx,cx ; b {a. int 21h --> mov ax,4202h cwd ; "xor dx,dx" when ax < 8000h e xor dx,dx aa. xor cx,cx ; cwd e 1 aaa. int 21h e 廡A ti a ti bi BP SI i awae i a. [si+1] te se awa aa. mov ax,[bp] ; 3 bytes mov word ptr cs:[bp],1234h ; 6 bytes add ax,[bp+1] ; 3 bytes mov ax,[si] ; 2 bytes mov word ptr cs:[si],1234h ; 5 bytes add ax,[si+1] ; 3 bytes a 1 wa aq wi awaa. inc al ; 2 bytes inc bl ; 2 bytes --> inc ax ; 1 byte inc bx ; 1 byte Ae ϩae šai a. yy aa w a Aa Ai aae wa eA, aa a wi ie a ae aỡe ea. Aa a áwⷥ A Ѕii awaeE a. mov ax, 4300h ; a 苡 mov dx, offset filename int 21h push dx ; a q w push cx ; a w inc ax ; ax = 4301h = a ew push ax ; w AX=4301h xor cx,cx ; /a a int 21h ...qq aỡ ... pop ax ; ax = 4301h pop cx ; cx = a pop dx ; dx-> a q int 21h e aae le a aBⷥ aai ei a. 80x86 š ai e i šai e w ea. w b i sa.