
Ŀ
                                                                    
                        
                                    
                           
                                          
Ĵ
                                  5                           
ٰ



                     
                               by DrMAD

    
    1.  
    1.1.  ।⥫쭮 砭
    1.2. 饭 ᨣ
    1.3.  ᨣ
    1.4. 뢨 ᨣ ("᪨")
    1.5.   "" 䨪
    1.6.   "㫫" ᮢ
    2.  ஫ 
    2.1. ஫쭠 㬬
    2.2. ᪨  
    2.3. 㣨 ⮫ 
    2.4. "ࠢ쭮" ᯮ짮 ᨣ  ஫ 
    3.  ᪨ ⮤
    3.1. ᪨ ⮤
    3.2. ⮤ ᯮ ࠧ
    祭

                               

    ,   㤥  ⥬,    ।⠢ ᥡ,
  ⨢  室    ᯮ  ࠧ.     ⥪
室  ⥬⨪  ꥬ 3-    饮ࠧ⥫쭮
誮. :-)

                             1. 

     -  ᪨  ᯮᮡ,  騩 㦨  筮
ᯮ 設⢮ __ ᮢ.
     ண   ᫥   ᫮,   ᨣ     -  㭨  
ࠪ⨪, 筮 ࠪਧ  ꥪ (  砥
- ).  ॢ  ᫮ 砥 "".
    ⭮,       ࠪ⨪      
⢠ ࠪ⨪,   ꥪ.  ਬ,    
ᯮ ᢮ 㣠  ()    쭮  ࠭祭  
ࠬ஢, ⠪  ଠ , 梥   ..,   
⮬ 稥 - ⠬ த  -  . 
(ਬ,    栬)   ਢ  誠.
     ⮩ 窨 ७  ᨣ  -    ਠ  -㭪樨,  ..
  ⮡ࠦ  讣  ⢠  ꥪ⮢  쪮
⢮ 権  ਧ.

    1.1.   

     筮 塞  㬥,  ᫨        
窠,     窠 -    ᨣ.  ।⠢ ᥡ,
  筮 ⠪  窠 ⯥⠭      ୮
ਭ.    祭 㡨  .  㤥    ⠪
㬥?  筮, .  㤥  ⮫쪮 ⮩ , 
।⠢  ᮡ   ୨ ⥭   㬠,  祬 
⮩ 㬠    ࠧ  㭨    ⭮
祫 ⨭  ஧, த ஬  ਪ 窨.
    筮 ⠪      ⮨       ᠬ.   ਬ,   ,
ࠪ   ,     EXE-ணࠬ,
    ࠦ  ⮩  ணࠬ.  ..       ⨥
"ᨣ"   室      ⠪  ᢥ  ࠪ⨪,    ⨯
஢塞 ꥪ,  ⮯ ⮣ ꥪ    㣨
ࠬ.    筮    ࠪ⨪  "뭮  ᪮",  
 ஢       砥  .    
⠪   㭤,   - ந諮  ⪥  ⨢
(MSAV) ᪠ 㧮 (!!!)   ணࠬ ⥫ (!!!) 㣮
⨢ (AIDSTEST).
     "ᢥ"  ਧ (⨯ 䠩,  ࠧ,  ६ ᮧ,
  ᯮ  ࠧ  ⥩  ணࠬ    ..)   
뢠 "᫠묨 ᨣࠬ".

    1.2.  

     ᮢ६ ⨢  ᨣன  ⢮ ஥

                         {<, , >}.

    "" -  祭 ,  ᫮,   㣮 ࠣ
;
    "" -  ⮯ ⮣ ࠣ  ணࠬ;
    "" -      蠣  ࠡ  ணࠬ,    ஬ 
ࠣ 室   .
         㭨쭮   ࠪ୮  ,  ..
⠪,  ⮡ ࠢ   ࠣ⠬ ணࠬ,  뫮 筮
᪠:     .
    ᬮਬ  砨 ᨣ.

    1.3.  

     設⢠   ᮢ      ᨣ   祭   :    
᫥⥫쭮  ᯮ      㣮 ⮢   
䠩   砫  ⮩  ᫥⥫쭮.  (,  ࠧ㬥,  㦭
,  ᫨    ࠧ  ᮢ ᯮ ࠧ ᨣ)
ਬ,      Win95.CIH    ந  ⠪   ᨣ,
稭  0- : 55 8D 44 24 F8 33 DB 64.
          ᨣ?  -,  祬 ,  ⥬
,    -    室  塞   .
  । ।  ⨯筮  1  ⢮ ᥩ
 ⨢᭮  50000,  稬 50  ⮫쪮  ࠭ ᨣ.
-...  ⮬  㦥  ࠧ㬭  ஬.  ।,  
"ଠ쭠"    ᨣ  -  44  .  ⢥,    ᫮
"ଠ쭮" ⮫쪮  ᮢ,   ⥫ 뫮  44 ⮢,  
  ᮢ  室  ᯮ짮    ⪨  ᨣ;
    ⪮ ᨣ - ६  .
     ⮣ ⠥ ஡ -     롨 ᨣ?
ਬ, ᬮ७  ᨣ   ᮢ Win95.CIH.
A,  B  .  , 㦭 롨 뢭 ᨣ  ⠪ ,
    ᨨ  ࠧ  (  ࠧ    -   ।
᭮ ⥫,  ᥣ  ᪮쪨 ,  ࠡ뢠 ࠦ
ᠬ稢   ZIP-).        ᤥ  ᠬ⥫쭮,
⥫쭮 稢  ᮢ,     ᮢ ⪨,  ⭨ 
, ⠪ 室 ਥ.

    1.4. ""  ("")

     㪠    ⪠  ,    "뢨"
ᨣ, 騥  ⤥ 窮.  ⮬ 砥 ᨣ 
ᮢ ᥬ⢠ Win95.CIH     ⥩:  1)  饩
  ᮢ ᥬ⢠;  2)      㭨쭮      ᨨ
.
      ᯮ짮 ࠧ  "뢨"  ᨣ  
⮫쪮  ஢ ⮢,     ஢ ⤥ ⥩ ⮢,  ..
⮢ .   㤮   ᯮ  ""  ᮢ,
..    ᮢ      筮   䭮.      ਬ   
"" ஢騪:

    ;  ਠ
    00: B90010   mov    cx, 1000 ;  ஢ 
    03: BE1201   mov    si, 0112 ; 砫 ஢ 
    06: 3E       ds:
    07: 81343412 xor    [si], 1234 ;  砩 箬
    0B: 83C602   add    si, 02
    0E: 83E901   sub    cx, 1
    11: 75F4     jne    00000006

    ; ன ਠ
    00: B80010   mov    ax,1000 ;  ஢ 
    03: BB1201   mov    bx,0112 ; 砫 ஢ 
    06: 26       es:
    07: 81072143 add    [bx]4321 ;  砩 箬
    0B: 83C302   add    bx, 02
    0E: 2D0100   sub    ax, 1
    11: 75F4     jne    00000006

     ᨣ    ᯮ ⮣    ᫥騥
 (,祭):  (1,00),  (2,10h),  (4,12h),  (5, 1), (7,81h),
(0Bh, 83h), (11h,75h),  ..
           ᯮ짮   ⤥ ⮢.
㬥,   ⮣        ⤥  
. ਬ,    

    MOV , 

     ᠬ   ⮢ ଠ

    1011 0RRR NNNNNNNNNNNNNNNN,

     RRR  -  塨⮢    ॣ.  窠    ⮢   10110
ﭭ   ⮩      ᯮ짮  ⢥
ᨣ,  ஢   ਬ୮ ⠪:

    if ( (Byte & 0xF8) == 0xB0 )...

    1.5.   "" 

    䨪 -     ,          
ᨣ-"".   , ᯮ짮 堭 ᨣ  
.    ⮬,     ࠡ  ஢뢠 ᢮
,   ᫥ ⮣ 㦥  ᮤন    塞  .
-,   ᨣ    "" -   蠣 
 뢠 ஢ 誠.
    ਬ,      ᬮ७        砩    8-
஢騪 1000-⮢ 誨  ࠧ  ⮩  誨  
१ 8*1000=8000 蠣.
     ᫨    ᯮ  ਥ "饩"  (஢뢠
 । ᯮ塞 ࠣ    ஢뢠  㦥  믮
ࠣ),         ᯮ짮   "뢨"   ᨣ   
뢨  ⮫쪮  ࠭⢥,    ६.
        ࠧ.   믮     蠣
०.
    ,  DOS-   ਬ୮ ⠪:
    - ᢮     Int21h/ah=4Ah;
    -    㧨 㥬 ணࠬ   Int21/ah=
4B01h,  (㣮 ਠ - ᮧ PSP   Int21/ah=26h  㧨
ணࠬ ᠬ⥫쭮, ࠨ fixup- 窠);
    - ⠢   ᮡ⢥   ࠡ稪   Int1,     㤥  
ࠢ ᫥  믮  ணࠬ ;
    - ⠢    ॣ  䫠    T  (ਬ,  ⠪:  push
303h/popf);
    -       ࠡ稪  Int1  믮      ⢨
(쭮 -   蠣,    ᠬ  ⠬ 祭 
祣  ,  ਬ, ஢ ᯮ塞 , ⮡
   ⨮⫠ ).
         Windows:
    - 㥬 ணࠬ ᪠      CreateProcess  
ࠬ஬ DEBUG_ONLY_THIS_PROCESS;
    -    GetContext      ⥪        䫠
⠢  ;
    - ࣠ 横    ࠡ⪨  ᮡ⨩    㥬
ணࠬ, ਬ୮  ⠪:

    while (WaitForDebugEvent(...)==TRUE) //  ᮡ
     {
      ...
      ContinueDebugEvent(...); // த ஢
     }

    -   ⮬ 横  ᮡ:  ᭠砫  CREAT_PROCESS_DEBUG_
EVENT=0 ,  ⮬  EXCEPTION_DEBUG_EVENT=1;
    -   ᮡ⨥,  ६  ⢮ 蠣   
ReadFromMemory ⠥  믮 .
           㫨஢   ࠡ ணࠬ,  믮
   "".   (   _⥫᪮_        
஢騪  ।⥫쭥 㫨饣.     㡨
⮫쪮  ⫠ ,   ⠪   㢨  ⮣  ᯥ᪨
䥭祪,   _ᯮ_ ᮢ).
      ⭮      ஢ᠬ,    ⭠
蠣 ஢   , ⠥ ⮫쪮 .
    祬,  ᭠  ᫮  ⥬  -    ⤥쭮  让
.

    1.6.    

    ,     ନ  "㫫" ,   ᮮ⢥
ᠬ,      ࠧ      ᢮  ,  
⠢  ﭭ "஢"   ஢ .   ᠬ
祭  㫫䨪  ᯮ    ਭ樯  樨,  ..
ਭ樯  砩 ६訢 ᢮  (,  ࠧ 
஬). ਬ:

    ;  ਠ
        jmp m1
    m3: add sp, 2
        int 21h
        jmp m4
    m2: mov dx, offset Mess
        call m3
    m1: nop
        mov ah,9
        jmp m2
    m4: ...


    ; ன ਠ
        call m1
    m2: cli
        mov dx, offset Mess
        sti
        jmp m3
    m3: int 21h
        jmp m4
    m1: add sp, 2
        mov ah, 9
        jmp m2
    m4: ...

    㤭 ,    ᨣ  -⠪   .      ࠧ
"ॡ" .  ।   ⠪:   ( ⮬ 室!)
।  믮  (  㫨),    ⨯   nop/cli/sti
ய᪠,   "蠬" 뢠 ⮫쪮 稬 

        mov ah,9
        mov dx, offset Mess
        int 21h

       ࠧ   筮 ⮣ ᨣ.   ᫨  ⠪
 ⢮   䨪 ਥ ⭮ 
稬  ,  ਬ,  mov  ah,9    push 9/pop ax...   ⠪
ᮢ ,  ᪮쪮   ,    . ( ⤥
⪨,   १  ஦, ਬ,  ᥬ⢠ VCG, 
   ⠢  ᥡ    ஢    ﭭ
⠡ ,  ⮬ ⮦   騬 㫫䨪).
       ਠ  "㫬䨪"  -    ᪨   ⠬   "random
push"-孮,  ..  ⪨  ।⠢       ஬
⢠ PUSH- / MOV-,   宭 ନ - 
 ⨭  ࠧ  .  ᫨  ன    楯 ନ
  ,   ࠭   ࠧ 筠 ᨣ.
 ⨢ 祣 㦥   㦭.

    2.  

    ᭮ ⮪  ᨣ  -      (   饬 砥 -
ࠧ筠!) .  ⮬      ᪨  ⨢
ᯮ   㣨      -㭪権:   ஫   .   
-⢥ ᫮,  뢠    ( )
 ࠪਧ饥  __ 㭨 ࠧ.
    "" 砥,     ਭ樯,    ⢮  ᪮쪮
ࠧ  ᮢ        ⥬    ஫   ( 
뢠 ""),     ࠪ⨪  ⭮  ⮣  쭮
.

    2.1.  

    ⥩訩   ஫쭮    -  㬬  ⮢ ( ᫮)
ࠣ  (᭮ ).  ਬ,  ᫨   
Win95.CIH ࠢ 55 8D 44 24 F8 33 DB 64,   㬬 ⠢ 3B4h, 
 ᫮  뫮  ᯮ짮   ᪠  ணࠬ,  ࠦ
⨬ ᮬ.
      뫮  祭 㤠 襭 ஡. -, ࠩ
   -   ᫥⥫쭮  8 ⮢ 
⠪  㬬.  -,  ᫨ ⠢ ⠬   ,
 祭 㬬  .
     ਠ, ᨫ쭮 ᫮騥  ,  騥
⢮ ஫쭮 㬬஢,  ਬ,   _⥪⮢_  
 ࠡ ஫ 㬬 :

    sum := sum*A + s[i]

      ,  :

    sum := (sum*A + S[i]) mod N,  N - ࠧ來.

     ᯥ᪨  "孨   䨫䨨  堪᪨  ⠪"  
      ஬,          ୨      "
ணࠬ஢ ++" ⬥砥,          ᯥ宬
ᯮ짮  A=31 __⪨_⥪⮢_  (⤥ ᫮ 
ਫ  ⥪,     ଠ .DBF  ).
    ⮬ ஫ 㬬  த  ᯮ  ⮫쪮  
祭     ⢥⢥ ஢ப,  ਬ,   ।
楫⭮  BIOS.  ᪠ ᮢ  ᯮ짮 .

    2.2.   

    CRC -  横᪨    .    5-  ᪥  "᪮
蠫"   ⥬  祭   by Sassa, ⮬  
஡ ᯮ짮  ⮤  ⠬.
    ⪮ 㯮ﭥ,      CRC  -      筮
童,  祭    室  ,    㣮   (⥫쭮
࠭!)  童,    䨪஢ ⪠.  ⮪
-   ᪮ ஫ .
    童-⥫       .    
童-⥫,   CRC-16 (A001h  8005h)  CRC-32  (0DB88320h
 04C11DB7h).   ,               襩
ᯮ 㭨쭮.
    ⭮,       ⨢       ᯮ       
童-⥫,  ࠭,  ⥬    ,      ,    
ᮮ⢥⢨  ।묨 ࠢ.  ⮬    ਬ୮
⠪    ᢮⢠,    ⠭,    ⫨稥  ,  ᥭ
, ᥪ祭.

    2.3.   

     ⢥ ஫    ᯮ짮    㣠
 -㭪,  ਬ,  SHA  MD5. ᭮ ⮪ ⠪
㭪権 - ⭮⥫쭠 ᫮ ணࠬ஢. 㣮 ⮪ -
筮  १,   ⠢  ࠧ ਠ  256
 512 .   100000-200000 ᮢ   .  ਥ  
ࠧ㬭  ⢮ ⥭樠 ,   墠⨫   32-48
⮢.  ,   ⨢ᮢ ﭭ ,   த
ﭭ  堥     ,  ⠪   ᪥,    ᮡ
.
    ᯮ     ⨢,   ⮢୮ ⭮.
୮, -⠪ .  ४ 楫. :)

    2.4. ""     

    -,    ஫      -        ,  
-㭪樨.  - 祭 ,   50 , ஢ 뫮 
ࠧ    ਤ㬠    _᪮७_  ᪠   筮 ஢
ᨢ  .  (  ⠪  뢠  "樠⨢"   ).   
ᮮ⢥⢨  ⨬ 室, ⨢  뫨  ࠡ ⠪:
    - ࠭      ᨣ;
    - ⠪  ࠭       ⪨ ஫ 
(襩),  祬         ()      饬   砥   
ᮮ⢥⢮ ᪮쪮 ࠧ ᮢ  ᢮ ᨣࠬ;
    -   ᯮ    ॢ砫쭮   ࠢ
      ஢塞 䠩;
    - ᫨     ᮢ,  䠩 ⠥ ஢;
    - ᫨   襩 ᮢ,    ⢫  㦥
 ⮢ ࠢ  ᨣ,  ᮮ⢥ 
.
           ⨢ᮢ   (ਬ,   )      ᢮
᪨    ⬥,    ᯮ  ᢮  
⪨ ஫   ᪫⥫쭮    _㬥襭_ࠧ_.
⮬,      ।,  "ࠢ쭠"  ⮤      
ਬ (.., , 㢥稢 ).

    3.  

     ᪮  ᫮  heurisco,    砥  "㧭  ",
"뢠".  ⮬  "᪨" 뢠 ⮤,  騥
    祫᪮    諥.            室    
ᥬ஢ ⨭ ணࠬ,  祫 筮  ।
-        ,  ᭮뢠    稨    ⭮襭
ࠧ   ࠪ ࠣ⮢:  楤 䠩 -뢮,
楤 ஢    ᮢ    㬥    㣮  ..
    㬥, 室  ᫮ ⮣   
 ⮣,    믮       ࠣ,  ..  ⠪
뢠 "ᥬ⨪".
     ⮣,  ⮡    ⨢  ᯮ   ࠧ,   
᭠      祫᪨  ⢮  -  㬥 ஢
ᥬ⨪.    祫   ᥣ ⠪   ,  
  ணࠬ...  ,  ⨢  ॡ ࠧ 
ᥬ⨪  ࠣ ணࠬ,    ""  ⮫쪮  
,  ࠪ, 㧫 ࠣ⮢. :
    -  㧮  ணࠬ  -  맮  Int  13h    ⮬  
祭 ॣ஢;
    -  DOS-᪨ ணࠬ - 맮 Int 21h;
    -  Windows-ணࠬ - 맮 ࢨᮢ Win32 API  ࢨᮢ VMM 
⮬ ᮤন ⥪  ॣ஢;
    -  ᮢ MS Office  -  饭    ⠭  㭪  
⮤ ⨯ MacroCopy, OrganizerCopy  Import/Export;
    -     ..,   ࠧ ᪨஢ ᯮᮡ  
맮  饭.
     "⥫" ࠣ   ᪠  ணࠬ
 ᨣࠬ  ஫ .  ⠪ ⨢ 뫨 (ਬ,
Lie Detector by SEH).   ⠪  室 쭮 ⮫.  
᪠,        ᪮      䠩   ணࠬ
⥫  ࠣ  -  ࠢ?   ᪠,
 ॣ  㦠 ⮫쪮  MOV R,NNNN   祬  
। 浪?
     祬  ᮢ६  ⨢      ᪠   ⥫
ࠣ⮢   ண    Int 1,    
樨 ("筮" 믮) .  ⨦, ਬ,
Int  21h (   室  ᥣ DOS-) 筮 ஢
ᮤন ॣ஢,   ᥬ⨪  ⮣  ࠣ  ࠧ    ⠭
᭮!
       室 ६ ᯥ樠 ⮤,  
⢨  ࠣ⮢,   ਭ 襭 -  
.

    3.1.  

     ᥣ ਭ 襭,  ⠢    ஢ਢ    ⨭
᫮ ᪮ ᫮ ("।"), ⨯:

    
     ("CALL XXX/POP R") and
     ("___") and
     (("_=COM") or ("_=EXE"))...,
    ...

    ,   ਥ           ਬ      設⢥
⨢ᮢ.  ⮡    訡,    뢠,     浪
⨫ ⥫  ࠣ,    ⨢      
,    ..    ⮣ "訩" ।    
⥭ ࠧ  ᫮.  ᮫  ஡
뢠  ⮭ ,   ⮣ ஦ Ninnyish.Generik-. :)
     ⮪ (   -  ⮨⢮!)  ⠪ ⮤
- 㦤 筮 ⢥:  "/", "/".  
   ࠧ   "୮/":      
訡  (intended),  ,    砩 (  砩 :) )
宦   ணࠬ,  .

    3.2.   

       㯯 ⥬᪨ ⮤,  ᭮  ᮧ
饭 ᭮  "ࠧ"      ࠢ    ⥫
ணࠬ    ⨬ ࠧ.  ᪮쪮   ,   騩  
᪨ ⨢  ⮤ ᯮ  ।,   -  
᫥⥫᪨  樮 /-ணࠬ.     
⮤ 㤠    ᯮ, ਬ, ᯠ  
  e-mail- 쬠 ᫮  㪢⠭.
    ⭮ ,   祭 ᭠ ⥬,   ᥩ 
஡ 㦤.  ᫨ ᮢᥬ ⥭쪮, ...
     ᥣ ᯮ ⮤, ॡ騥 ।⥫쭮 ன
(祭)   ᯮ饣   ⬠     ᫥  "⨯"
ਬ.
    -,  ⮤,  ᭮    㫥      ⥮ਨ
⭮⥩.  -,   ⮤  䨪樨 (ਬ,
ਬ 䨪  ).  ,    譮  
ᥩ ⮤  ᭮ ஭ ⥩.
      ⮤  饬  楫         .  ᫨
।⠢  ⢮  ᬠਢ  ꥪ⮢  (    砥 -
ணࠬ)        ᫮  ࠪ⨪  /   ᪨
᫮,         ࠪ⨪/᫮    ᬠਢ  
न 祪,  ᮮ⢥  ꥪ⠬,    -  ୮
࠭⢥.   ⮤   ᯮ   ࠧ      ந
孮  (    砥  -  ௫᪮,      -
- "㫨") 襩 ࠧ୮,  ࠧ騥   
  (  砥 -  ""/" ").

    ^
    I  V    / N
    I    V /
    I  V  / N
    I    /
    I   /  N
    I  / N
    +----------->

      ⮦ ⥬ 让  ᮢᥬ 㣮 .

    

     ,  ⠪    ⥬ ⠫ 楫 ࠪ. :)
  ,  ,     - ਣ, 
  㤥    ᢮  ⨢    ⠥  祩-
㦮.
