
Ŀ
                                                                    
                        
                                    
                           
                                          
Ĵ
                                  5                           
ٰ



        ⥪஢ । ணࠬ: த 室
                               by DrMAD

                                            -...  窮 ⮫쪮
                                             ⨪...

                                            .⮩. ⮩ 稪

    
    1. ᭮ ਭ樯
    2. ⠪᪨ 
    3.  ஬
    4.  ᥬ⨪
    5. ᪮ ᯮ
    5.1. ᭮ ।
    5.2. 뤥 ࠪ ਧ
    5.3. ஡ 뢭 ⮪ ࠢ
    5.4. ᪨ ⮤
    5.5. ⠪᪨ 室
    5.6. ᪨ 室
    5.7. 
    祭
    
    ਫ. ਬ.

                               

     ࠧ ਧ,      ᠭ   ᭮   祬,
஬      ࠢ  ᫥.        ࠭⨨,      
ᮮ⢥   ⢨⥫쭮,   饩         ॠ
⨢ᮢ.    ७,  堬  ୠ  ࠭栬  
த  ᮢ襭  㤮  (    ⮬  ᮫⭮  )
     ⥬,      ⮢୮  ଠ樨      
।.
          祣  .  ,  ᠭ    ,  ⨢
ࠧ    10-12  ,        ⭨  
ਬ⨢ "娦类"     ᮢ-,    ⫨
  㣠 祬,  ஬  浪 ᯮ  .
 ⥬᪨ ᭮    ,  ୮,    50,
᫨    .  ॢ,      襤訥    窨 ७
ਬ塞  祣  ⠪   . 祭 直
 ᯠ᪮ 뫮 ᥣ ⥪  筮 ⠪ ,   10 
 ⥪஢ "娦直".
    祭 ,  ⮡   ॠ஢    ,  
      ⮢  襭.  ᫨  -   ᮢ६
"檥" १⥫쭮 ਢ, ⠢,  "᫨ 㯮 MS-
DOS,       ⮬       㦭"...  ᪮॥
ᥣ,      ⮩ . :)
    ,       -   ਧ   㬠       _⨢_
⨪.

                         1. ᭮ ਭ樯

      ᯮ   .  㣮 .  
ᯮ  .
     ⠪, ।  ணࠬ 䠩.  ॡ  ࠢ쭮
⢥  :     ?
     襭  ᪫뢠  鸞 蠣.

      1.  ⠪᪨  .  室  ४⭮  
 ,  , ८ࠧ   -  㤮 .
      2.  .     ᯮ ,
᪮  ⥪஢   ⮪ ᭮ 易   㣮
,  ..  ணࠬ.       ᥣ  ,      ᥣ
室.
      3.  ᪨  .  室    ⤥
   㯯.
      4.   ࠣ᪨  .  室,      
⤥    㯯,    ⬠.

    襭    ᯮ  ⢥  ࠧ  ⥪  
१⮢,  祭  ᫥ 蠣.  " த",  ࠢ, 
㤮⢨  㦤        蠣,      - 
 .   ﭥ 㡦    ,    㤥
ᬠਢ   .

                       2. ⠪᪨ 

     ⮨  ᢮ ⨥ ᨭ⠪᪮  ⮫쪮  ஡
ᥬ஢ 権 i80x86 (,   ᥩ  ࠦ,
IA-16/32).    ஢   ணࠬ  WordBasic-e 
VBA  (          ஬   ),   ணࠬ   
ப஫஢  ⥫䮭  .   ,  ⮩  
⠥ ,    ᨭ⠪᪨  室     ⥪஢
ᮢ    ᭮.
     ⨥ "ᨭ⠪᪨  "  ᥣ  ࠧ㬥   ஢
ᮮ⢥⢨ - "ࠧ" - "".  ⮬ 室
- ଠ쭮   .
     ந쭮 ⢮  - ⮢ (㪢,  ,  ⮢,
etc.)  "䠢⮬",   ᠬ    "ᨬ  䠢".
  ,  ⠢      ࠧ ᫥⥫쭮
(楯窨),   砥 ࠧ "ࠧ". ஥ ⪮ ࠭祭
⢮   ࠧ      "몮",  ⠫  ࠧ  
ࠢ묨  窨 ७ ⮣ "몠".
     모      ଠ쭮  ( 権 i80x86,
 Java,   ᮡ  -  ,  㡮,  ),  㣨  -  
(⢥ 모).  ᫨    ଠ쭮,    筮
      "ࠬ⨪".    ᪮쪮  権     
ࠬ⨪,   ਬ:      -쬠,    -,
᪠    .   ਬ 樨 - ( -
-஢   ଠ)      ࠬ⨪,  뢠饩  ࠢ
ଫ 楫 ᥫ:

     <>  ::= + | - | <>
     <> ::= 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9
     <> ::= <> [<>]
     <᫮> ::= <> <>

    ⠪᪨ ஠஢  ࠧ  砥 - ஢ 楯
ᨬ  ᮮ⢥⢨ ࠬ⨪.  筮      ।⢠
  ⮬⮢.  "⮬"  -   ꥪ,   
室  ⢥ ࠧ ﭨ S1,  S2...  SN,   ஬
ந室 ࠧ ᮡ E1,  E2... EM. ᫨  ⮬⮬ ந室
- ᮡ⨥,      室    -  ﭨ,    
ﭨ     ⮣,  1)   ﭨ ⮬ 室 
室 ᮡ,    2)      ᮡ⨥  ந諮.  ""
⮬   뢠   ⮬,      ࠭        室  
"饥"  ﭨ    稢  ࠡ.    ᨭ⠪᪮
 ᮡ  䠪⠬ 㯫  室 ⮬ 
ᨬ 䠢.  ⮬ 㤮    ⠡,  窠
ன  뢠    ﭨ.   ਬ  ᯮ⥫
楫 ᥫ (砫쭮 ﭨ S1, 騥 S4  S5):

        E1     E2      E3      E4
      <> <> <> <>
     -------------------------------
  S1 |  S2     S3      S5      S5
  S2 |  S5     S3      S5      S5
  S3 |  S5     S3      S5      S4
  S4 |   楫 ᫮
  S5 |  訡

     ணࠬ ⮬   祭   .      ᨢ
᫠ (ࠬ ﭨ) ,   ࠦ  ᯥ᪨, 
  "᪠  宩".    让  ⮬    ନ  
᪮쪨  "case"  "if"  (  ਫ  ਢ  ਬ,
ᯮ騩  ன 室).
      権  i80x86  쭮  ⮩  ⪨,  ⮬ 
 㤮 ᥣ  ᯮ짮    ⠪  ᯮᮡ.    ᫨  
室  ஢ ⥪  - ᮪஢ 몥
(ਬ,   VBA),    ᠬ⥫쭮  ந  ⮬  (    
ணࠬ஢   ᥬ) ᮢᥬ  ,  쬠 㯮.
 ⮨  ॢ 稭     ࠭  .
  ⮣    ᯥ樠  ,  ਬ,  CocoL/R   ᫠
窠 Lex/Yacc.     ⠪,  ᬮਬ    ⮬    ਬ  -
 ᯮ⥫ 楫 ᥫ.
      ⥪⮢  몮   ஢ન ࠧ  ᮮ⢥⢨ 
筮 ࠧ   ⠯:
     1) ᪨  ,    ६ ண 뤥 
, ௨稪 ⥪ - "ᥬ" ( "⮪"), ਬ, <>
 <>  (    -    㯭  ,  ⨯ <᫮> 
<祢 ᫮>);
     2) ᮡ⢥   ᨭ⠪᪨   ,       ६    ண
஢,  ࠢ쭮  浪  ᥬ ᯮ.
     ᮧ   ᪮     㦨  Lex.    
室  ᯮ  ⢥  ᫠.      ᥬ   
?      (   ᥬ DIGITS)   ( 
ᥬ SIGNS).

     DIGITS [0-9]+
     SIGNS  [\+\-]*
     %%

      "+" 砥 "1  ",   "*" 砥 "0
  ",    "0-9"    "\+\-"  ।   ᨬ  ⮩
ᥬ.    "\-"      "+"  ᯮ,   ⮡   
९    ,  ᬠਢ  ᨬ,   묨
.  "%%"  -  ᨬ-ࠧ⥫   ᥪ樨   ᠭ      ᥪ樨
᪨ ࠢ.
     ।,   ॠ஢, ᫨  室 ⥪ 
  ᥬ.   ॠ஢  :
    1) ࠭ 祪  ப,  㤮⢮ਢ襩  ⮬  ࠢ  (
㬮砭  㦥   ६ yytext);
    2) ᣥ஢  ᥬ (Yacc/Lex  㬥 짮⥫᪨
ᥬ, 稭  257).
      ⠢ -譮   㦭 ப ࠬ⨪:

    {SIGNS}{DIGITS}"."{DIGITS}    {save=strdup(yytext);return(257);}

      4 ப ய᪠ १ Lex  ॢ  
  몥   楤 yylex(), 㬥饩 ᯮ ᠭ
ᥬ      祭  257,  ᫨  ⨫  ࠧ   ⨯
"-123.4567".    楤  yylex()  룫廊  筮   
祫᪮ ,  ᮤন ᫮ ᨢ  ᠭ ⮬ 
ப  ᪠   ⮬ ᨢ.    ᮮ⢥ ᠬ ॢ
⠭   ,  ⮬ 㤥  ஡ ஢ 
஬      樮 ⥬.   ,  뢠 
ணࠬ஢  ⮬  﫮     ⪨  ࠧ  
६!
     ᮧ   ᨭ⠪᪮      ᯮ   Yacc.
 ᯮ짮  筮  ⠪  ,        Lex,  ⮫쪮
室         㣮.            ᯮ
䬥᪨ 樨  ⢥묨 ᫠ (㦥  뤥묨 
 Lex).  ᠭ ࠬ⨪:

    %{
    #include <stdio.h>
    float r;
    extern char *save;
    %}

    %start begin
    %token REALNUM
    %%
    begin: arifmop "=" {printf("%f",result);} ;
    arifmop:
      REALNUM {r=atof(save);} "+" REALNUM  {result=r+atof(save);}
    | REALNUM {r=atof(save);} "-" REALNUM  {result=r+atof(save);}
    | REALNUM {r=atof(save);} "*" REALNUM  {result=r+atof(save);}
    | REALNUM {r=atof(save);} "/" REALNUM  {result=r+atof(save);}
    ;
    %%

     "%{"   "%}" ࠧ  - ப,   ⥫
   ணࠬ.  祢 ᫮ "%start"  뢠  ⮢
ᨭ⠪᪮   ࠢ  ࠬ⨪  (    砥   "begin").
祢 ᫮ "%token" 뢠 ᥬ,     
ࠬ⨪,  ⮬᪨ 㬥  , 稭  257,   
.   "|"  ࠧ  ਠ  ᨭ⠪᪮  ࠢ,    ";"
⬥砥  .  ᫨ ண  ப १ Yacc,    室
  -  室  楤  yyparse(),      ⨢
頥        楤    yylex().         樨
ᨭ⠪᪮ ⮬  㦭   믮  -  ப,
    ⠢    ࠬ⨪,    - ப,  ந騥
᫥.
    ⠫    main(),  ᪮஢    ᪮
  .  ࠭ ࠦ ⨯ "3.14*2.71=" ⮢!
     ࠩ ᫮ ஢   ࠬ⨪,  ⮡    㬥
࠭᫨஢  ᫮ 䬥᪨ ࠦ  ᪮  ..,  
 㩤  15. ⮡ ⠢  ⫠ ࠬ⨪  WordBasic
-,  㩤 ,  ਬ,   ࠡ稩 .  .   
 ⮬  ﬨ!
    :  ࠧ ,      몠  設  
i80x86 (ᥬ஢) -   ࠩ । 砩,  
 ᮡ⢥ ⮬,  祬 ᯮ짮 Lex/Yacc.  ,  뫮
 ᪠  㤥  த஢, ᨭ⠪᪨ ࠧ 
⥪஢ ᮢ 砥    ⮫쪮    ᥬ஢
 Intel-᪨ ஢.

                      3.  ஬

     ⢥ ,    㦥  筮  諨     ।   
ᨭ⠪᪮ .  易   ⥬,    ⪠ ஥
   Yacc/Lex ⮬⮢     ⮫쪮    
ﭨ,     ᮤঠ⥫ ⢨ (- ). 
⥩襬   砥            ⮩   뢮      ࠭
஢  ,  ..  १  ॢ  室  몠
 - 㣮, -  ⢨ 뢠 "樥".
          ⨫   த 砩 -  ⥫쭮
    ,    室 ⥪. ᪨,
      ॠ   㣮   ⨯  ࠭:    ॠ
"".
     㦭     ᯮ  ᮢ  "",    㦭  
"".   ⨭ : " ". :)
        ଥ  ॢ  筮 몠  㠫,  ..
⮡ࠦ ஢  ,  㦭,  ਬ,    ⫠
⨢.       祭   䥪⭠   ,   ࠢ   
ਧ ⨢.    ⭮,   ⮡ࠦ   㥬
 㬥 MultiScan ⨭ ᭨.

 Ŀ
              5 Internal disassembler [+,-,,,,] [x] 
              AX 6246 BX 0000 CX 5BAD DX 7F8B SI 0000 DI 0000 VK 
        SP 3112 BP 0000 CS D222 SS 1A5D DS 1A5D ES 1A5D AV 
             Ĵ 
      M21ͳ04C5 80FC0B         CMP    AH,0B                O=0 
            04C8 7203           JC     04CD                 D=0 
            04CA 50             PUSH   AX                   I=0 
       ᨳ04CB EB1B           JMP    04E8                 T=0 
      :04CD 50             PUSH   AX                   S=0 
        ࠳04CE 53             PUSH   BX                   Z=0 
            04CF 8ADC           MOV    BL,AH                A=0 
      ĳ04D1 B700           MOV    BH,00                P=0 
       ߳04D3 2E8A872204     MOV    AL,CS:[BX+0422]      C=0 
             04D8 B400           MOV    AH,00                    
 D:\HOWCAT\MS04DA 5B             POP    BX                       
 D:\HOWCAT\MS04DB 05F404         ADD    AX,04F4                  
 D:\HOWCAT\MS; 
                                                                    
 

     㦭  ᯮ ? , .
     ࢠ 稭  砥  ⮬,   ணࠬ -  ᪨
ꥪ,   ᯮ      饬  砥   ᪨   ⮤
.   ⮩  ਬ  -  ᠬ騥  ணࠬ,
 .  筠 ᨣ    ⮫쪮  ᫥
믮 । ⢠ ,  ࠭.
      稭 砥  ⮬,   ⮫쪮 ⠪ ࠧ  
 ᯮ   .   ⮬   .
     ⠪, 믮 .   㤭  ,    
 ᯮᮡ.
      砥     ⮬,  ⮡  ⭮  믮    
,     騥 ⫠稪, ᨢ  Int 1.
    DOS,   Windows. 㣮 ਠ -   Int 3
 ᮢ뢠  CCh  砫  । .    
ࠧ 孮,    ⠥   ⮩ :   砥 
  ,   ⭠ ஢   ணࠬ. 
ࠡ ⫠稪  ࠭ ᫥ 祫,   ࠢ 
஢   ⠭      室.  ᫨  ணࠬ
    饭ﬨ    譥 ।,  ..   
䨧᪨ ன⢠ ,         .  .,  
⮫쪮   祫     ।,  ⥫쭮    ஢騪
믮  ᮮ⢥騥  .    ᫨  祫  ,     
⨢?  ᪠    ⮬᪮  ( 祫) ஢
FORMAT.COM, ⮡ ஢,    , 뫮  ᪮. :)
     ன 室   砥      ⮬,   ⮡  믮  
"",       । - ன⢠,
  .   稫  樨 .  
 ⮬ ॠ쭮 ଠ஢    (  ᫠ !),
  몠  ⨢ ஡ -  室
⭮ ஢   (   !).  ,  
      ᤥ  .    砩  ᠬ   
 ᯮᮡ   ⨢    饭    
譥 ன. ਬ,   ⠪:

Subr:
     in al, 40h  ; 訩  稪 ⠩
     mov ah, al
More:
     in al, 40h  ; 訩  稪,    㦥
     in al, 40h  ;  訩 
     cmp al, ah
     jnz More
     sub ah, al
     ret

       믪:    ah ᫥ ⠭? ⢥: ᫮
2.     ᮧ  ணࠬ    ⠩,    1.19  
    稪    ?    IMHO,    .        
᫥⥫쭮  横 ஢:

     mov esi, offset Decrypt
     mov ecx, CryptLen
     call Subr
Repeat:
     xor  [esi], ah
     inc esi
     loop Repeat

        㢥७,   ⨢  㫨 ࠡ ⮣
஢騪.  (..   믮   横    "⭮"  
⮬᪨      ⥭樠 ࠧ,   ᫥ ⮣,
      㪨  ᮫,    ᯮ    ᢮  /
楤,  ୮ ஢뢠   直 饭
 ⠩).
     쪮    ⠩    ᮧ    ᯮ짮  
ࠧ ,   ஬ ⠩    ॠ쭮 ६,
᫥⥫   ࠫ ,  ,  ஫ HDD 
FDD, , 㪮 ...
      ,  㬨  ࠬ   墠.    ᬮਬ
஡   ᫥⥫쭮.   砫  ।,      㫨㥬
DOS- ணࠬ.
      㫨஢  ࠡ    ॣࠬ  ?   ୮.
 ,   ⨯ Registers  ᪠  ,   
ᯮ ப ⨯

                             MOV AX,1234h

ᬥ  ᢮  ᪠  믮

                             R.AX:=$1234.

      㫨஢  ࠡ  ?  ⥩訩 ( 祭 
ᯮᮡ):  뤥  ᪥ 䠩 ࠧ஬  1,  ᪮஢  㤠  
⨢ , ⨢ - ⨯

                             MOV [21h*4], 1234h

㯠  -譮  ⠪:

                             tmp = 0x1234;
                             lseek(f, 0x84);
                             write(f, &tmp, 2);

        ⮦        ,   ਬ,      祩   0:46h
뢠 ᫮ ⠩ 뢠.  ᪨, ࠣ 
 ᥣ⮬ 40h -  裡  譨 ன⢠,     
 ⠪ ,      .
     ᪮  뤥 1   ७      ࠡ
묨  ⮤ (EMS/XMS  ..)  ⨬ ࠣ⮬.  ,  ,
㯠 ⨫ AVPDOS32.  ,      ४᭮ 
ᮢ६  KAV-᪨      ࠡ⠥    ஡!  ,
⪠  প ⮩ ⨫    GUI-⮢,
IMHO,    થ⨭  襭     " GUI"  "⨢
᮫" -  䫮. , ᯮ ᯥ᪨!   졠! :(
     㫨஢  ࠡ    譨 ன⢠?   饬 砥,
. :(  㦥 ⬥砫,  ⮣      
    譥  ன⢠,    ,  ୮,
.  ⭮, ࠡ ⮣  ⠩     ०
( ,  奬 ⠩  ࠡ  6 ०,  ⮫쪮
 㬮砭 ࠡ⠥  ०  3?),   BIOS- (  ,  
      㪠      㬮砭      ⠩
樠  ०   2?),    稯  (    ,  
  稯  ন ࠡ  ᨬ ⠩஢?),  
.   㦥 ⮨   COM-⮬,     CMOS-    
.    뢠 ,   譨 ன⢠ ।祭 
ࠡ  譨 ஬,  ⮬  ᢮⢠  ﭨ ।
 ⮫쪮  ,     . ,  㡠. :(
 襬 砥  ⠢ ᯨ᮪   ᪮쪨  ⪮  ⮢
-뢮,  祭  ⪮ ।   
।᪠㥬.   砥,    , ⮬  ॣ஢, 
묨  ⠪ 㯨 - ⭨. (᫨   뫮  ⠪, 
 ⠢  Windows     ⢮      騩  㭨ᠫ
ࠩ    ஢, 㪮  ⥢ , etc.)
  ,  IMHO,    㢠饬  ᥡ  ⨢    ࠩ  
  ॣ஢   㫨஢.
      㫨஢  ⥬   맮?      ࠪ᪨   ,
ᮡ,  ᫨  ,    設⢮       
譨 ன⢠.   㫨஢ ⮫쪮  让  業
, ,    祬    祣  , 
⮫쪮  - ଠ. , ਬ,  DOS-  ah
=52h/Int  21h  -  ,   頥  ⥬ 
List Of Lists,   Ah=30h/Int 21h - ,   頥  
ᨨ DOS.  ஬ ⮣,  ⠪ 맮, ୮,  ⮨ ஢
(   ⮬  諮    ந  樮!),    
ॠ쭮  믮    ।      १ 믮.   
,  ᪮ ⥬ 맮,   ࠢ, ᭮ 易  
㣮  (᫥,  ਬ,  ࠧ  ⨥ 䠩  ⥭,
᫨ ࠭  ⮩   ணࠬ  뫮  饭  ⨥      
)  ,  ᯨ祪  ⠪  㫨㥬  ࢨᮢ   祭
쪨. :(
              믫    祭     
--   祭 ᫠ .  :)   ⮬,    
   室    㫨஢  ࠡ    譨  ன⢠  
⥬  맮.        ।⠢     ᫮ 
᪮,      祭  .    㫨஢
   樨   砥    ⮬,    ᫥    ᯮ
⠭ ।묨 祭    ॣ஢    ⥩
. ਬ, ᫥

         dw 310Fh ;   RDTSC

        祭  ⢮ 
⠪⮢  頥   EDX:EAX.   祭   ᫨ 
।᪠ ।⢠  㠫쭮  設.        !    ⮩
樨      ,     RDTSC 类 믮 
  ॣ஢ EDX  EAX 䫠 "祭 ।", த
믮  ணࠬ  ।묨 祭ﬨ ॣ஢.  ⭮,
  祭  ࠭      -    ணࠬ  ᯮ
(ਬ,  ᫥)  ।묨 ⠭ ⠪ 祭 
- 㣨 ॣ஢  ⥩ .  祣 譮,    
ணࠬ          - 饭 ।
- 묨 祭ﬨ,  ⠪      ᪫祭,    १
᪮쪮  蠣  ।  祧.     ࠭ 㣠 
뢠  ணࠬ.   "ࠡ" ᯮᮡ 樨 ਭ
       쭥襬 ᬮ७ ⮤ ⥪஢
ᮢ.

    ... 砭:    ,            ᪠,    ᠥ
"ࠬ쭮" ⨢, ࠡ饣  "᢮" ᫮.
    ਬ, ⠪ ⮨   ⨢ᮬ,  ࠡ騬  MS-DOS, 
᪠ DOS-᪨ ᮢ (ਬ,    ᨩ   ). 
室  饭 ०, ⨢   ᢮ ᯮ殮 ०
V86 - ..  ࣠  㥬 ணࠬ ⤥쭮
᭮ ࠭⢮  ﬨ ⠡ ஢ 뢠,  BIOS-  
..  -  ,   ᫥⢨,   ਭ 㯠  ⠬ 
࣠樨 ⠫  ன.            
࠭   ⨢  (,  ,      ..)?    
஢ ⠬ - .   ⮬   MS-DOS  㦥  諠  
 ६  쭮 ᫮  ᫥.
      ᠬ  ᪠  ⨢  Windows, ࠡ騩 
Windows.  ୮,  ९ ,    ன
  Windows,  ⠪  樮  ⥬,  ⨯  VMWare,  ...
।⠢ ᥡ,   ⨢,  ࠡ饬  Windows 95, 㫨
, ਥ஢  䠩 ⮪ NTFS -  ,  Windows
NT  㫨஢?.  ।⠢  ᥡ,    ⨢,  ࠡ饬 
  Intel,  ।  ,  ਥ஢    ७
  AMD  -    ,      த 
 㫨஢?  ᮡ    ⮬  ⮣,  ᪮쪮  "⭮"
Microsoft      Intel      ᢮   "孥",  100%-  
।⠢ .
    (஬ ⮣,  쬠  ⭮,       
祭 ⮩ 稭 -  ⮫쪮  壠㧥  ᯮᮡ  ᠬ  
ᥡ    ,   ᠬ ᥡ ᬮ஢   
ਭ樯).
    ࠡ稪 ⨢ᮢ    稬  㧨⠬    
 ⢫ 100%- 樨,     ,   , 
 ,    㣨  ⨢ ⮣   .  
ࠩ   ,     ⨢    㬥    ०  樨  
稢  ਯ⮢騪   ⨯   UPX      ASProtect,   窠
⨮⫠묨 ,  -  ⪠ ⢫  묨
 묨 ।⢠ (,   㯠騪, ⨢ "᭨"
  ᯥ樠쭮 楤ன  ⪮ ).    ॠ
㠫쭠      業⮢    50  -  ࠧ  
 ?!...

     ᬮਬ ⠪    "㡨  樨",   ..   ⢠
㫨㥬      ணࠬ.     ⮬,     
᫮ ᫥  .
     , -,    ।  楫 樨.   - 
 稭 堭,  ࠢ  襭 ⭮  .
ਬ, ᫨ ⨢ 㤮⮢ਫ,   ।  100%- ࠧ,
  ४.  ⮬ 筮 㫨    쪠
 ⥫쭮 ணࠬ.
     -,   ⮨  (  ᥣ!)  ४   樨,
  㯠   ।᪠㥬.  ਬ,  
ணࠬ   諨   INT-      IN/OUT-.      ଥ஢     
ࠤ⢮  ᯮ짮    ,    ᮫  
 ਯ 㡠   㪠.
     -,   ४  樨,    ᫨誮
 㫠    쭥襥    믮   ᫥.   ਬ,
筮  ࠭   㡠   樨:

                           Label: jmp Label

        ४ ,  ᫨ த⥫쭮 ६
 ந室  祣 ⥫쭮 -  ࠪ୮  "ଠ"
ணࠬ.    ?  ਠ.
      ਠ   -      饥  ⢮  蠣  樨.
ਬ,   , 믮 65535 蠣  믮 ⠪ 
⢮ _ࠧ_ .  ,   _ࠧ_ !  ᠬ , 
    64 NOP-   64 宫 横.
     ன ਠ,      ⮩  窨 ७ ।⥫,  -
⢮     ।  ࢠ  ६.    
⠩   ਭ㤨⥫쭮 㡠  १ 1 ᥪ㭤.  "稫
  稫 ,  ࠢ - ᫥  ⥫" :)
     ,  ⮨ 몫, ᫨ 㫨㥬 ணࠬ ᠬ
訫 ⢥ ࠧ.
    , ᪠     DOS,  ࠪ᪨    ⭮    
Windows,   ᪫祭 ⮣,   ,  , ﭠ 
㫨஢  ,    ⭮襭  ,   ⠪ ⥬
 (TIB/TEB/PEB,  ⠡ ਯ஢  ..).   ᪠,
  ﭠ ᮢᥬ  ,  - 筮  뫮  
஬஢.  ਬ,  ᭠     TEB/PEB,    
࠭,    ணࠬ  () १    ᪠  
KERNEL32,    ⮬ 砥 ⮦ ਤ  ஢?...  ஬
⮣, ଠ  ࠢ 㯠  ࠧ ࠣ⠬   
⨯ 樮 -  Windows 95  ,    Windows NT -  㣨,  
ணࠬ   ⨢  ⠬  ⠬    .  ..,   ਭ樯 
 ...   ॡ   ᨫ   ࠧࠡ稪
⨢,   ⪮ 殮  ᮢ  (ਬ,
ᠬ 筮 -  ).    ?
      ࠡ ᮢ६ ⨢ᮢ 뢠,     
஡      ।    ࠬ,       ᥣ 訬
ࠧ.

                          4.  ᥬ⨪

     ணࠬ   믮  ⢮  ࠧ  ⢨  -
 祭 ॣ஢,  䫠 ,  ⥩  
..            뢠   ᯮ ᮢ?
筮    !    ᯮ   ᯮ   ⠪   뢠
"⭮-ᮡ⨩"   ᮢ,      ணࠬ
⢨  ࠬ ⠪  砥  "ᮡ".      ⮬
     ᫥饬 ࠧ,     ᥩ - ࠧ,
  ᯮ  ⤥    権.
       ᯮᮡ - ᪨  ᪨.
    ᪨.  ᥣ  ணࠬ ࠣ⮢ ᯮ
 ० 蠣 믮 ணࠬ ( ஢騪 
஬).  ᪨,   ⮣ 筮   ﭨ
ꥪ  -    믮 ࠣ,    .  ਬ,  Z0mbIE
⠫ 21  ᯮᮡ  㫨  ॣ  (  ᠬ      ࠧ
).      ।    㤥 ॣ AX.   
ᯮ ᮡ "㫥 AX" 筮 ஢  ᫮: 1)
᭠砫 뫮 AX<>0; 2)  ⮬ ⠫ AX=0.  ᮫⭮  ࠧ, 
  뫮 ⨣:  <PUSH 0/POP AX>,   <MOV AX,0>,  <XOR
AX,AX>,   -.
    ᫨  ᪨ ⠪ 室  - 稭 㯥,
  ⠥  ⮫쪮  - ᪨ ᯮ ⢨  ࠭
 ⪨ "蠡", 뢠騬 ⨯ ᫥⥫쭮 
ଠ   .  ᪨,        ࠧࠡ⪥    
⤥쭮    ⤥쭮  ࠬ⨪,      ॠ樨      
ᯮ饣  ⮬   ਬ    ணࠬ.  ਬ,
ࠬ⨪  ᮡ "㫥 AX"  룫拉 ⠪:

    <㫥 AX> ::= XOR AX,AX | SUB AX,AX | MOV AX,0

      ࠧ ᫮ ,  <PUSH 0/POP AX>, <AND AX,
0>  㣨 ਠ,    砥 ᯨ᮪  . 蠥
:      99%   砥     㫥  ॣ  AX  ⢨⥫쭮
ᯮ ᥣ 3-4 ਠ.
    , ⭮,     ⮬ ਬ    ⥪,    
設    ᮢ.  ⮬  ࠦ  ⨯  <>  ᫥
ਭ   ᥬ,       ⥪,
  ⮢  ,  뤥塞 ᪨ ஬   .
, ᫨ ⭮,  ਬ  ਪ᪮ ⥭ (ਭ饣
ଥ Symantec): 饭 ᪠  ᯮ   䠩.

                  assembly language          machine code

                  MOV DX, ????               BA ?? ??
                  MOV CX, ????               B9 ?? ??
                  MOV AX, 4000               B8 00 40
                  INT 21                     CD 21

     ⮬  ਬ ᥬ <MOV DX,> ᮮ⢥ 筮   ⥪
'MOV DX,',  ⮢  0xBA.  "??"  ६ .
     ⮣   쭮  ᫮,      䥪⨢
ணࠬ,  ,  ⥬  ,  -⠪ 㤥 ᯮᮡ 㤮-
믮 ᢮ .   ⠪ ணࠬ 뫨  !  ᫨ 㤨  
⤥   ९      ॢ  ⏠ࠬ,      
ᯥਬ⮢ 稭 15   ࠭ ᨨ TBAV,  Lie Detector
 . (,  ᫥ - .᫨ aka SEH, த⥫ 
HIEW-).    室  । 90-  ।
    .ﭮ  ᯮ짮  AVSP .  ᮢ.  ,
ਪ᪨ ࠧࠡ稪   -  ⥭⮢  
孮  (   饩 孮 樨  ᪮
)!  ⠫   ⥭⮢  , ୮?
    , ᪮஢     ⠢   ࠡ   ⠪   ⥬
ᯮ - 祭 ਢ쭠 ᪠  ࠪ᪠ .
⥫ 㤠  १  室, - ।!
    祬,  ᯮ   ⥪ (ਬ,    
  ஢) ⠪ 室  祬 ਥ,  ਬ,  
,    ᮡ  .Import/.Exprt      MacroCopy   ᯮ   (
஢ !)  类 樨.

                    5. ᪮ ᯮ

      饬    楫     室  ᯮ 祣   
뫮:
     1) ;
     2) ᪨.

     室 ࠧ㬥,  祫 ࠭ ⭮, 
 ⮢ ⮨ ᯮ ꥪ,    ⭮襭 
室.    楫ࠢ ନ "⥬ "  ⮬
ꥪ,    쭥襬 ᯮ   ᯮ.  ⢮
ᯮ  ० ᥣ  ⮣, ᪮쪮 ⭮ 祫
  ன ꥪ,  ᪮쪮 ४⭮ ନ  .
ਬ,   ᯮ ᨬ 祫 ࠭ ,   㪢
"" -    窨,  ᮥ 設,   筠
४    .   뢠  ⥬   
ࠢ ୮   砥 ⫨  ⥬ ᯮ,
   㢥७   ᯮ   ᠬ   ࠧࠧ,  ਢ,
᪠   ਠ 㪢 "". ?   ᮢᥬ. 
  ⮬,      筮   ᠬ ୮ ᠭ  "
魮",  ⮫쪮   ॢ    ⭮襭    㪢  ""  
ଠ誠.    㪠    ਥ  ஢,   
㪠  ਥ 㪢.  諮 뢠 ⥬ ࠢ.
 ଠ쭮?  ,   㣠 ஡:  ᫠᪮ 㪥 㪢
"" 룫廊   㣮.    ᯮ    ⮢  㪢  ""
祫 室  ९뢠  ⥬ ࠢ,  ..
    ᪨ 室  ࠧ㬥,      ᯮ   
ந        "祭".    室  ,    
।  讥  ⢮   ⨯   ࠧ殢,   ਭ
,    ,  ࠨ    ⨯  ࠧ
ꥪ.  ਬ,  ⪠ 88  १  ᬠਢ ⭨
    ࠧ ਠ⮢ 㪢 "".  ⥯ ନ ࠧ
㪢 ""    砥  ⥬  窨    ⮩    
⪥      ⮩    㯯 ⮪.   ᪮ 室
⭮    ⠪  뢠  ⮤  "ਧ樨",     
_ᠬ砥_   ࠢ ⤥ ࠧ殢   㣮 
᪫뢠   "窨"  ਧ "宦".    ⮬   㣮
砥   ⥬      ନ   ᠬ        祭
(ᠬ祭).  ⨥  ⮬    祫    ଠ쭮.
᪫砥  ꥪ⨢  䠪  (..  ﭨ  祫  ⢮
ᯮ), ⠥  ⨪.
     ࠧ  ⨢  ࠧ ६ ᯮ짮, ᯮ
  ᯮ짮  ,  㣮 室.
     室    ⮩      ⥯    ,  
室 祫᪠      襭        ஡.
⮬  ⮤    ꥪ⮢,  ᭮     室,
  뢠  "᪨"     ᪮   ᫮   heurisco,
饣 "".

                       5.1. ᭮ ।

      ।.
    ﭨ -   䨪஢      祭  ਡ⮢  ꥪ.
ਡ ணࠬ  -    祭  ॣ஢,   䫠   ,
६ , ᮤন ⥪  ..
    ⨥ - ᬥ ﭨ ꥪ,  ..  ᬥ  祭    
 ਡ  ꥪ.  ਬ,  MOV  AX,AX  -    ᮡ⨥ (,
筮, 祭 IP -⠪ ),   NEG  AX  -  筮  .
      ஢, ਬ, ⠪:
    - "ᮡ"  ᮡ,-  ,          窨 ७
ᯮ;
    - "吝"  ᮡ,-  ,    ࠧ 㯯   
 冷 ᯮ  ⮩ 㯯;
    - "吝" ᮡ,- ,   ᠬ  ᥡ,  裡 
㣨 ᮡﬨ.
     ᫮ ꥪ (ணࠬ),    ନ ᮡ⨩ 
ﭨ - ⭮-ᮡ⨩ .

                 5.2. 뤥 ࠪ ਧ

    ०, 祬   ᯮ,  室  祭
ਧ,     ᯮ 㤥  ந.  ⮩
ਬ:  ᮡ⨥  "⨫  㫥  AX"        
ᯮ ,   ᮡ⨥  "⨫  -ᬥ饭"  -  ᮢᥬ
,   ᠬ  ᨬ⮬ ࠧ.
      ࠭訪,   ,   ⭮  믨  
㬠 ᪮쪮 ⪮ ⠪ ᨬ⮬.   ⮬ - 
  ய,   - 㭤  ࠪ  .
       讥  ⢮  ᮢ  ࠧ  ⨯  ஢
ணࠬ  ண  १ ᥬ᪨   ,  ⭮
뢠 ᫮ ⨢ ᮡ⨩.   騥 
,    騥  ஢  ணࠬ,  ᮡ    
᪮묨  ਧ.      ࠭,   ।  ਧ 
"譨"?  ਬ,  ।  ਧ  ਯ  䨪஢:  ᮪
⥬,    ,  ᬮ,  ஧ 梥 ,  
.  ।  譨 - " "  "஧ 梥 ", ⮬
      -  ᫥⢨  "᮪ ⥬".   ⠪ 뢠
"५஢" (..  ᪨ 易) ਧ,   
,   ᥣ   ᤥ " ".
     ⮣,  ⮡  ⤥      ᨬ⮬      ,   
易⥫      譨,      ᯥ樠쭠   ⥬᪠
樯 -  "䠪  ".    ⮩  祭  ᫮  樯
ᬠਢ ᪮쪮 ࠧ ⮤ (⮤  ⮢,
業ந ⮤  ..),       ⨬  ᠬ,  
ਧ  -  ᬠਢ,      孮⭮,  䠪  
  뫮  㬨.    ࠢ,  ।⥫  
뤥    ਧ ᤥ ࠩ ⥫쭮.    
⮣,  ⮡ ⢥ ⨬஢ ⨢   த⢨  
ࠧ .
    ,   ⮦    ⮢  楯⮢,    ਢ  
襬   १.   ଠ쭮     ⪮  ।  ⥬᪨
⨬   祭   ਧ,            ,   
ᮮ⢥騥   ᮡ  祭 殮 ᯮ  ⠯
ᥬ᪮ .  -襬,  । ᨬ⮬    ⠢
⮫쪮 ,  易  ⥬묨 맮:
    -  DOS-ᮢ  Int 21h/Int 20h/Int 27h  .;
    -  BOOT-ᮢ  Int 13h;
    -  ஢ᮢ  MacroCopy/.Import/.Export  .;
    -  Win32-ᮢ  饭ﬨ  KERNEL32.DLL;
    -   ⥢  类    饭ﬨ    MPR.DLL,   MAPI32.DLL,
WSOCK32.DLL  .
     ᯨ᮪,  筮,     ⪨  .  
DrWEB ⥫쭮 뢠,  ਬ, ⠪ "᫠ ᨣ", 
䫠 ࠧ襭   ᥪ樨 .text.  ਪ᪮ ⥭ 6.357.
008 । 뢠 ⠪ ᫮⠢ ਧ, 

    ...⢨ 樨   室        䠩  (SEEK),
    ᫥饩   (WRITE)  䠩 樨  JMP,    SEEK
     । ࠧ 䠩  ,   JMP ந
     ࠢ  襥 ﭨ...

     ⥪஢  ⥢  ࠧ,  ,  稥  "ᢥ"
ਧ    (㯠   ६   UPX-      ASProtect-,
ய뢠   ॥ "HKLM \...\Run"   ..)    
  ஫.  ..  ⥬⨪ -⥬⨪,  ᮢ-ᮢ⠬,  
 - ᮡ⢥ ,   ࠢ .
     ,  ,   樨 ᪠ -     ᮡ
㬥 ॠ஢ ⨢ MultiScan ⨭ ᭨:

    01 ணࠬ 뫠  䠩
    02 뫮 ⠭  䠩 24-28 
    03 뫮 ⠭  䠩  24 
    04 ணࠬ ᠫ  䠩 24-28 
    05 ணࠬ ᠫ  䠩  24 
    06 뫮 ᠭ  29  10000 
    07 ணࠬ 뫠  䠩
    08 뫮 ⠭  祭 int 21
    09 뫮 ⠭  祭 int 13
    10 ணࠬ ⠫  int 21
    11 ணࠬ ⠫  int 13
    12 뫠 맢 㭪 ____ ண 뢠
    13 뫠 맢 㭪 ____ ண 뢠
    14 ந ⠭ ६ ᮧ ண 䠩
    15 ணࠬ 㧭 ६ ᮧ ண 䠩
    16 ணࠬ ⠭ ਡ  ண 䠩
    17 ணࠬ ⠫ ਡ ண 䠩
    18  ६饭 㪠⥫ ண 䠩   䠩
    19  ६饭 㪠⥫ ண 䠩  砫 䠩
    20 ணࠬ ᪠  䠩  ஬ ⠫
    21 ணࠬ ᪠ .COM 䠩  ஬ ⠫
    22 ணࠬ ᪠ .EXE 䠩  ஬ ⠫
    23 ணࠬ ᪠ ᫥騩 䠩
    24 ணࠬ ⠫ 㧮 ᥪ ண ᪠
    25 맮 㭪樨   㧮 ᥪ ண ᪠
    26   ᪮쪨 ᥪ஢  
    27 ணࠬ ⠫  32000   ண 䠩
    28 ணࠬ 뤥  
    29 뫮 ⠭  祭 int 24
    30 ணࠬ ᠫ ஥ ᫮   ࠭  䠩
    31   ࠭  䠩

              5.3. ஡ 뢭 ⮪ ࠢ

      ணࠬ   ᫥⥫쭮 樨  ,  
࠭      ⮫    ⥬,      ⢨  
      .      ⨯   ࠣ   -
१⭮ :

;
;  ணࠬ --  #1
;
Begin:

     ...

     push cs
     pop  ds
     mov  si, Begin        ; 㥬  ᢮ 

     push NewSeg
     pop  es
     mov  di, NewBegin     ; 㥬  "ᠭ" 

     mov  cx, VirLen
     cld
     rep  movsb      ; ஢   "ᠭ" 

     ...

     mov  ax, 2521h
     mov  dx, offset Int21
     int  21h        ; ⠭  ࠡ稪 Int21

     ...

     push 100h       ;  ࠢ ਣ쭮 ணࠬ
     retn            ;     樨

     ...
;
;  ࠡ稪 Int21 --  #2
;
Int21:

     cmp ah, 4Bh   ;   ண?
     jne Next1                         ;  2.1
     ...
     iret

Next1:                                 ;  2.2
     cmp ah, DEDAh ;  ஫?
     jne Next2
     mov ah, BABAh ; 
     iret

Next2:                                 ;  2.3
     ...

     ᫨   ।ਭ    ⥫  ,   
㥬  ४  ࠡ      RETN,    ⨢  
⥫ ⢨  ஭ .   ᫨ ।, 
 - ࠧ   ࠡ稪 Int21,   ஡ -  
 ⪥ ?
       ᢮ ࠡ     ࠭  (ਬ,  
⥪),     (    ,    ⮫쪮  易    ।묨
ॣࠬ) 窨 室   ⢨ ,   襭 樨
  ⢨,  室   㣮.   襬 砥 
ਤ  ⥫쭮  ᪠஢  ,  稭    ⪨
Int21,      㤠,  ᪠஢  "᭮ ⮪"  室 
⪨ Next1    Next2.    ,  㦥  ४ᨢ 室  
⢥ ॢ ࠢ.
      㯠,  ਬ,  ᫥ ᨨ ᥬ IDA  
஥ ॢ ணࠬ, ⠪   㯠  ⨢.

                        5.4. ᪨ ⮤

     㯯 ⮤ 稫 ᢮  ⮬,   ᭮
 ᫥  ᪠뢠    ᫥  ।⮢.  ᬮ  
㬭 ନ,  ᥣ ⮣ 祭 . ⮣ ᯮ
  १ ஢ન ⨭      ⠢
। (᫮), ਬ:

    
     (
     "⨫ Int 27h"          
     "⨫ Int 21h/ah=31h"   
     "஢  MCB" 
     "஢  PSP:[2]"
     )
       
     (
     " ணࠬ 䠩"   
     "  ணࠬ 䠩" 
     " ணࠬ 䠩"
     )
      
     ணࠬ =  .

     ᪨,       ⮬,  ⮡  ⠢    ᮮ⢥⢨
 ᮡ   ᪨  䫠  ,  ᪠  ணࠬ,
⠭      ,   ⮬ ந  
 ᪨ ८ࠧ  ਩  ஬ 뢮.
       ⮩      ᯮ㥬  ⨢
⮤.      ⪨.
    -,      ஢ ᫥⥫쭮 
ᮡ⨩.    ⭮,    ॠ      ,    ।
ணࠬ,   ன 䠩 ᭠砫 ,  ⮬ ᠭ, ⮬ .
ᮡ  묨  "䥪⠬"  ࠤ   ⥬   ᯮ
⨢ DrWeb.
    -,   ⮤    筮     ᥣ 
⢥  "",   "".   ⮬ ਭ樯쭮 
 (    讬 ⢥):
     - "訡   ࢮ  த",    ஢  ணࠬ  ⠥
쭮;
    - "訡   ண   த",        ⠥  ଠ쭮
ணࠬ.
     ,   ⢮   ࠡ 祭 ᨫ쭮  ꥪ⨢
䠪.     ࠢ쭮  ⠢  ।⮢,    
    ᫮  ᯮ ⥬ ।⮢ 室
९뢠 .

                      5.5. ⠪᪨ 室

      室 ,    祣 ਭ樯쭮  ।饬
⮤,      ⪮. ⨬ , 
ᯮ    ।  ᫥⥫쭮 ᮡ -   
ࠧ । 몠!
     ⮩ ਬ稪  -   楯窥 ᮡ⨩ ஢  ⮫쪮
⢨,    ࠢ 冷 ᯮ ᮡ⨩ O -  "
䠩",  W - "  䠩",  C - " 䠩".  ந ਬ⨢
⮬:

           O     W     C  <else> <eof>
        ------------------------------
     S1   S2    S1    S1    S1    S5
     S2   S2    S3    S1    S2    S5
     S3   S2    S3    S4    S3    S5
     S4   ⨫ 楯窠 O-W-C
     S5   訡

     ᫨   ਫ  ⠢ ⮣ ⮬ (ꥪ⨢
䠪,  ),   ࠢ묨 , ਬ,  楯窨 
"O-O-W-W-W-C"  ࠢ묨 - "O-W-O-C",    .
     "⠪᪨" 室    ⬥  "᪮",    쭮
㤠筮  .    ᭮ ।,  設⢮
ᮢ६ ᪨ ⨢ᮢ  ᯮ      "᫠
",      ᯥ稢 業 ᪮ ᯮ 
஢ 95-98%.   ⥭樠  쭥襣 ࠧ   ⮩  ⥬
⮤,   ᥬ,  .

                      5.6. ᪨ 室

     ᪮ 室   ᮮ⢥    㯯  ⮤,
᭮  ଠ쭮    砥 䨪樮
ਧ.    ⮤      䨪権 - ஬ ⢮,  
     ⮤  ᪮쪮 ࠧ .
      ⮤ ꥪ⨢,    饬 砥  ࠡ  ᨬ  
, 㬥    ⭮  祫.  ஬  ⮣,   
ᤥ ⪨,  ⭮ 뢮  १  ᯮ.  
⮬  ⪨,  ⮬    ⮨⢠.
        ᯥ᪮:

     " ६    ᢮   ࠡ   ᪠      
     ᯮ짮        ,    ந     ⠡
          ()   ᭮ ⮩
     ଠ樨  뢮  ࠦ  䠩  ᮬ.  
     ⮤ 䥪⨢  ᪠   ᮢ .
     .      ᯮ  ࠭祭       
     ਯ,  ⮣   "" 䠩 ᯮ ᮢ襭
     㣨   㣮 ⮩.  ਬ,    ணࠬ
       MS DOS  ᯮ 뢠 21h ( CDh 21h),
       ਯ    DOS  ᮢ    
     ࠪ᪨  砥".

     ਬ  ⨯筮  ᪮ 室.  ,   
訩 ਬ,    ⮬,     㭨ᠫ    
ᯮ   㣨   ⨯   ᮢ.     ᭮  祭  -
㦨  "Random  Push  Generator"-      稥   ஢騪,
⠢騥  ,   ࠧ  (.,  ਬ,  
ᥬ⢠ Nostardamus).  祬,  ⮩  㦥  10,     
ᮢ६   KAV ᯮ ⮫ ਬ⨢  
.
      ୠ⨢ ᬮਬ 祭  ⮤,  ᭮  
㫥   ⥮ਨ ⭮⥩.

     P(Di|Sj) = (P(Di)*P(Sj|Di))/(P(D1)*P(Sj|D1)+P(D2)*P(Sj|D2)+...),

     S - ᨬ⮬;  D - ; P(Di) - ਮୠ ⭮ i-
; P(Si|Dj) -   i- ᨬ⮬  j- ;
P(Di|Sj)   -   ᫮   ⭮   ⨭  i-    
㦥 j- ᨬ⮬.
    砫       롮ઠ  ᮢ   ଠ
ணࠬ (祬 ⢥ ய樨    ਬ୮ ⠪
,    )    ᥬ᪨ ᪠஬ । 室
祭  P(Di).  ⮬            ᮢ,   ࠭
᪫஢    ⨯  (१/१,  search  
⠫,  search  path  ..)    ।  P(Si|Dj).  
⮬   "祭"  ᮢ᪮  ᯮ⥫  襭.  祭
 訢  ⨢.
     稭   "ࠡ".   ⨬,     ⥫쭠
ணࠬ.  ⨢ ᪠    室        
 k ᨬ⮬ S={s1,s2...sk}.  ।, 室 業, 
⭮ ⮣,   ணࠬ  ⠢    Di.    ⮬
砥   㫥   ⭮ P(Di|sj)   sj,
室      S.      ।,         ᨬ⮬
᪨ ᨬ  (   ᥣ ⠪;  祬,  ᮫
ᠬ  -  뫮 롨 ५஢ ਧ),  ⮬

                P(Di|S)=P(Di|s1)*P(Di|s2)*...*P(Di|sk).

    ,           ⭮     
,         ᨬ  -   㤥 १⮬
䨪樨.
    ,     ࠧ  ⮤ ,   
⮬᪮ 祭 ᯮ⥫   祫.   ᠬ
,  ᫨    㢥७  ᯮ,    -  
ਮ ⭮ , ᫮ ⭮ ᨬ⮬  .. -
      묨 祭ﬨ.
     ᯮ ᮢ in the wild ,  ୮, 㤥 
ࠡ.       ࠡ⠥  ᯮ ᯠ,   ᯠ
  ﭭ  ஫    ᮤন  ᢮  ᥬ,      
楫ࠢ    ࠧ    ࠪ    ਧ   ⢨
ࠪ, ࠧ뢠 ⥬ ᠬ   ᯮ⥫ ⭮.
     ⮪  ᮢ᪮  ⮤:         뢠
冷  ᯮ  ਧ.

                            5.7. 

     ᥬ⢮ 譮,  ⪮,  謠୮    ᥩ
⮤,   ࠡ   . ,   㣨
ᮢ६ "⥫㠫" 孮,    㯮 
⥪ ⨢᭮  (ਬ,  "᪨ "), 
  ,      ⮩  ⮢       
᪮.     ஡ ᯮ짮.
       ࠧ⥩  ⥩  (  宭,  䨫,
४७,  etc.),     ⪮  ᬮਬ  ᠬ  ,  ᠬ
    ᠬ  祭  ࠧ - ᫮ 
楯஭    ࠭ 訡.
     祭  .    ᥣ ।⠢ ᥡ   
讣  ⢠  㧫.    ᪮쪮  ਧ   (ᨬ⮬),
      ⠢    ᮮ⢥⢨ 㧥 "室" ᫮.  
᪮쪮     १⮢   ᯮ,      ⠢   
ᮮ⢥⢨  㧫 "室" ᫮.  -ࠧ:
     -  ,  ᪮ १ -  㧥;
     -       ,     㧥  -    ࠧ    筮
।⠢ 楫᫥ १;
     -   ,  㧥  ⢥ 室   १
ࠧ.
        ᪮쪮  ஬  ᫮.   ⨯筮 砥 
㧥 N  ᫮ ᮥ  ᥬ 㧫 ᥤ ᫮:

                            N1  w12 N2
                  x1=y1 ->  *-------*   y2
                             \     / \
                           w14\   /   \ w25
                               \ /     \
                                \       * N5 -> Y
                               / \     /
                           w32/   \   / w45
                             /  w34\ /
                  x2=y3 ->  *-------*   y4
                            N3      N4

                      室   ஬.  室
                      ᫮      ᫮   ᫮
                      N1,N3     N2,N4  N5

      ॡࠬ ࠭ ᫮ 祭.  ஬ ⮣, 
ॡ  ਯᠭ ஥ ६ ᫮ W, "" ॡ ( 
뢠 "ᨭᠬ"    宦 ⠬   ᪨
஭).  ᯮ騥  ᢮⢠  ஭    
䨪஢ 祭 ᮢ W.
    ।,   ᫮ ਧ x1  x2,   
ᮮ⢥騥  㧫  室 ᫮.   祭 ࠭ 
  ᮡ   㧫 ஬筮 (    쭥)
᫮, 뢠     ࠢ:

                        y2 = F(x1*w12 + x2*w32)
                        y4 = F(x1*w14 + x2*w34)
                                  ...
                        Y  = F(y2*w25 + y4*w45)

    㭪 F -    㧫.  ᯮ ᪮쪮 ਠ⮢
⮩ 㭪樨,  ᥣ - "᪠":

                          F(x) = A/(B+exp(-C*x)).

                     F(x) ^
                          |-------------------
                          |        
                          |      
                          |     
                          |     
                          |   
                          |
                        0 +------------------> x

      室  砥  ஥ 祭 Y (  祭).
᫨ ᨭ W ࠢ쭮 ࠭,    Y  -        ࠢ
"⢥".  ਭ樯 "ࠡ" .
      ᭠砫,  ० 祬 "ࠡ",  㦤  "祭", 
ன  ᨭᮢ  W.    讥 ⢮  ࠧ殢
(ਬ,  ᮢ)      믮 ᪮쪮
( 쭮  - ⭨  !  - 権).   ६ ࢮ
樨  室 砥  ஥  祭  Y,  ஥  ᪮॥
ᥣ   ᨫ쭮  ⫨砥    ॡ㥬  १  Z,  祬  
᪮ 㭪樨 稭 訡 뢠 :

                           D=(Z-E)*E*(1-E).

     訡  D  稭 ⭮ ࠭  ,   ⮬
뢠 祭 ᮢ W:

                           E5 = Y5*(1-Y5)*(Z-Y)
                           E2 = (1-Y2)*E5*W25
                           E4 = Y4*(1-Y4)*E5*W45

                           w25 = W25 + n*Y2*E5
                           w45 = W45 + n*Y4*E5
                           w12 = W12 + n*Y1*E2
                           w34 = W34 + n*Y3*E4

     n - 쪠 "ଠ" 祭, ਬ,  n=0.1.   
  ᫮,  ⥬  権 ॡ,   ⥬  筮 
᫥ ࠢ 祭 ᮢ W.    室  ᫮,  
८ࠧ           אַ  ࠢ    ⮬
⠭ ᮢ 樥⮢,   ⠪ .      
饣  ࠧ  室 믮 ⪨,  ⭨   
権.  ਩ 襭 -  祭    "ࠢ쭮"
⢥⮢.  ⢮      ࠧ殢  ⨣ ⪮
. .. 祭 - 쭮 ⥫ .
           ᥣ ਢ  襬 १.   
⮬,    ଠ ਥ,    ࠧ  ᯮ짮
ࠢ  ⮯  - ⢮ ᫮  ⢮ 㧫  .
 饥 ।⠢,    ⢮  ᫮    ᮢ  
⢮     ௮孮⥩,  묨  ।
ࠧ 㥬 ꥪ.   ⢮ 㧫  ᫮  
ᮢ    ⢮  ""  孮⥩.   ,
᪮    㢨    ࠧ,    
ࠪ⨪ ⨬쭠 ⥪  ࠥ  १ ⪮
 ⥭ ᯥਬ⮢.
     ⮫쪮   ࠢ쭮  ࠭  ⥪      ࠢ쭮
஥ ᨭ,         ⨢  ᯮ짮 
⥪஢  ᮢ.
     㯮      ஡.     ⮬,   楯஭
 ᯮ 祫  ࠧ, .. ࠧ, 
  ᫮    ⮢ ,   ਭ ⮣  
        ࠪ   ਧ         
砥    - 窥 ࠦ  ।
.  祢,     ।⠢   ⠪
ࠦ.    ⢮  ਧ,     
,  冷   ࠭  ।.
       ?
     -,   訩  ⥢  室,   
    ஡  -  ਬ  ⠪   뢠   "४७"
⥢  権.    ஭  ,     
⮫쪮 ﬠ  室  室,    ⭠ - 室  室,
ਬ:

                                  +-
                                  | \
                                  v  \
                               N1 *---* N2
                                   \ /
                                    \
                                   / \
                               N3 *---* N4
                                  ^  /
                                  | /
                                  +-

      ⥬    쥧 ,     ⥫   
   㦤.    ⮣  ᬮਬ  㣮  室,    ஬
ਬ ᪮饥 "".    ᯮ짮 ᬮ७
   ᫮   楯஭.      ⠪:        
᫥⥫쭮      ணࠬ   (         
"") ᥢ ਧ (ਬ, O - Open, W - Write, R -
Read,  C - Close, ᥣ  N=4). 롥६ 筮 ⪮ (ਬ,
L=3)   "",      ६      ⮫쪮  3  冷
ᯮ ਧ.  饥 ᫮  ஥  M=N^L=4^3=64,
⠪  㤥  ᫮ 㧫  室 ᫮ 楯஭.   㧫
㤥 ⠢  ᮮ⢥⢨ 㭨   3- ਧ.
    祭 : ६ 讥 ⢮ ᮢ  "ᮢ"  
  ⠪  ணࠬ  ᪮짨    楯窠      
ਧ   L=3.      ᥢ  ன
冷    ਧ.  ᫨  ਧ ⨫  ணࠬ,   
ᮮ⢥饩 室 ६    塞  1.  ਬ,  
楯窨 O-O-O-O-W-O-O-W 稬 ன O-O-O, O-O-O, O-O-W, O-W-O, W-O-
O  O-O-W.    ⮩ 楯窨 㤥:

    O-O-O : 2
    O-O-W : 2
    O-W-O : 1
    W-O-O : 1,

    ⠫ 60  室  ६  ࠢ  0.  ᪮   ன
ਧ "楯"  ᥤﬨ ᢮  "",      
࠭ ଠ  ⮫쪮  稨  ⢨ ਧ,   
  ᯮ.  筮,      㦥,  祬  ⮬
ᨭ⠪᪮  ,    ࠢ ଠ ࠭ (
 ).  ᯮ㥬       ⢥  饣  
楯஭,  ⠪  㯨   ⠫묨 祡묨 ࠧ栬. 
ࠡ⠥  ⮩ ,    ᠬ  ᫮  楯஭.
ᯮ  ⠪   ணࠬ,  ।⠢   
஥ ਧ.
    㬥,    "஥"   ਧ      ᯮ짮  
"⢥ન",  "ન"  ..  ᯮ⥫ 㤥 ࠡ ,  
 ⭮ ᫮.    砥,  ᯮ⥫ ᫠
㤥 뢠  ⭮襭  ਧ,  ᯮ    
㣠 , 祬   -   ⢥ ⮪.
    ⮬  ࠧ ,   ,   ⮤ 㤥 ࠡ
 㤮⢮⥫쭮,   㦥,  祬 ᭮    ४७
.    ᯮ짮      ⮩  ⮫쪮  樨 ⮣
䠪,   ஭ ⥩   ⮫쪮  ⥪
ᠬ ,    ᯮᮡ ⮢ 室   .
        饬    楫,  ᯮ騥    ஭  ⥩
⥭樠쭮  ஬,  ୮,  99%    .  㣮   ,   
䥪⨢  ஭        ᪫뢠 
室 ⢥ ⡮  祭 ⪮  ⥭  ,  
⮫쪮  稭   ୮.  ⮬  祭 ।
     ⥬,  ᭮    ஭
.   ᯥਬ⠫ ࠧ,  ⨯  
 - 70-80 %  㤠筮 ᯮ ᮢ.  ᪮쪮      ,  
᪨  ⨢  㤠  ⪨  ᯮ짮 ⥢
⮤ 㭨.  ,    ਬ஬   㦨
⥬  ᯮ 㧮 ᮢ,  ᯮ짮  ⮭
⨢  ᭮   ࠭ ࠧࠡ⪠  IBM.

                              祭

     ⠪,     ஬  뫠  믮  ⪠  ᮡ 
   㬥,      ᭮  ࠢ  ᫠  
뫥  ᪮쪮  宦   ࠢ  ࠪ᪨ ॠ㥬 ,
          ᭮  ॠ쭮  饣
ᮢ६ ⨢. 筮  稫 -  ⥫.
    , ⠢ ,   ⠢  ।    
ᯮᮡ  ᪮    ᮢ,      ᨫ    ᫠
஭,      뭥譨      ᯥ⨢  쭥襣
ࠧ.
     訡  筮⥩, ୮, ,     襬. ,
     㡦   ⥬,     ᭮ ᠭ
  ⢥ த.
     , ⠩  ⨪.

                              

     1. ப  .,  設᪨  .,  쭨  .,  뭥   .
㠫 .  ⢥  ⥫        ᮢ 
ணࠬ . // 䨤, 2003 - #2 (50). - . 64-69, 97.
     http://stocona.ru/technology/antivirus/virtWar.html
     2.    .,  ࠭  .,  ୧  .  ᪨  ᭮
஥஢ ஢. - .: , 1979. - 654 .
     3. 襢 .    ࠡ⪠ . 樠 ࠢ筨.
- : , 2001. - 752 .
     4.    .   ᭮   楯樨   ஭   ⥩.  -  .:
⥫᪨  "", 2003. - 288 .
     5. ᭨ . ᪨   // ᪨ 蠫,
#2.
     6. http://www.research.ibm.com/antivirus/SciPapers/Tesauro/NeuralNets.html
     7. http://www.decision-support.ru/rffi/results.htm
     8. US Patent 6.357.008.  Dynamic  heuristic  method  for  detecting
computer viruses using decryption exploration and evaluation phases.


               ਫ. ਬ ⨢ ""

      ⢥  ਬ  ।   ணࠬ,  ॠ
 ᬮ७   .  ᪨,    맮  㣮,
 ᫮ ணࠬ,  ⮬     - 譥, 
   ⠫ 㤠.  ⨢ᮬ   ᫮,  ᪮॥  
   ⨢  ਠ    ,  ᬮ७    ;
⥫⢮,       ॠ㥬,      ᫨    
 쥧 (   ),    - ࠡᯮᮡ
 .
      "㪮" ⨢ 㬥:
     - ᪠஢  -᪨  COM-ணࠬ  (  ⮬ "뢭"
⮪   ࠢ),   騥           ᥣ    ᪮쪨
ࠧ⥩;
     - ஢  ⮡ࠦ  ;
     - ""  믮      ணࠬ,      ᮤন
ॣ஢;
     - ஢  ᮡ,  易      묨   ⥬묨
맮;
     - ਭ 襭  "᭮" ᪠㥬 ணࠬ.

/**********************************************************************
 BURATINO - ਬ⨢ 樮 ᪠ ணࠬ.
() 쥢 ..,  1999, 2005.
**********************************************************************/
#include <stdio.h>
#include <dos.h>
#include <mem.h>
#include <io.h>
#include <fcntl.h>

/*
ᯮ    設 ஢:
 MOV R,N : 1011 XRRR NNNNNNNN/NNNNNNNN NNNNNNNN
 MOV R,R : 1000 101X 11RRRRRR
 JMP A   : 1110 1011 AAAAAAAA
 MOV A,N : 1100 111X NNNNNNNN/NNNNNNNN NNNNNNNN
 MOV A,R : 1000 100X 00RRR110 AAAAAAAA
 MOV R,A : 1000 101X 00RRR110 AAAAAAAA
 INT N   : 1100 1101 NNNNNNNN
 RET     : 1100 0011
 IRET    : 1100 FFFF

 ॣ஢:
 RRR  X=1/0
 ----------
 000  AX/AL
 001  CX/CL
 010  DX/DL
 011  BX/BL
 100  SP/AH
 101  BP/CH
 110  SI/DH
 111  DI/BH

 ਩ ᭮: 稥 楯窨  OPEN-WRITE-CLOSE
 ஢ ⮬⮬:

       O     W     C
    ------------------
 S1   S2    S1    S1
 S2   S2    S3    S1
 S3   S2    S3    S4
 S4   !

*/

/*    ࠭ 祭 ॣ஢ */
struct X {unsigned int ax, bx, cx, dx, si, di, bp, sp, ip; };
struct H {unsigned char al, ah, bl, bh, cl, ch, dl, dh; };
union RRR {
 struct X x;
 struct H h;
 unsigned char r8[18];
 unsigned int r16[9];
};

#define TRUE -1
#define FALSE 0

/*  ᯮ ᮡ⨩ */
#define CODE_OF 1
#define CODE_RF 2
#define CODE_WF 3
#define CODE_CF 4
#define CODE_WD 5
#define CODE_RD 6
#define CODE_SI 7
#define CODE_EX 8
#define CODE_SR 9
#define CODE_SF 10
#define CODE_FD 11
#define CODE_GI 12
#define CODE_NO 0

/*  ﭨ ᪮ ⮬ */
#define S1 1
#define S2 2
#define S3 3
#define S4 4

#define NO_BRANCH 0xFFFF

int f;                         /*  ᪠㥬 䠩 */
int Finish=FALSE;              /* ਧ  ᪠㥬 ⢨ */
size_t new_branch=NO_BRANCH;   /*    ⢥ */
int Result = FALSE;            /*  ⥪஢ */
unsigned char c , c1;
unsigned int  n1, n2;
unsigned int  m1, m2;
unsigned int  r1, r2;
int e = CODE_NO;               /* ⨥ */
int l = 0;                     /* ஢  ⢥ */
unsigned int n = 0;            /* 稪 蠣 樨 */
int i, j, k;

/*  ஢ /ᮡ */
pr(union RRR *r) {
 printf(" %04X %04X %04X %04X %04X %04X %04X %04X",
         r->x.ax, r->x.bx, r->x.cx, r->x.dx,
         r->x.sp, r->x.bp, r->x.si, r->x.di);
 switch (e)
  {
   case CODE_OF: printf(" OPEN FILE"); break;
   case CODE_RF: printf(" READ FILE"); break;
   case CODE_WF: printf(" WRITE FILE"); break;
   case CODE_CF: printf(" CLOSE FILE"); break;
   case CODE_WD: printf(" WRITE SECTOR"); break;
   case CODE_RD: printf(" READ SECTOR"); break;
   case CODE_SI: printf(" SET INTERRUPT"); break;
   case CODE_EX: printf(" EXIT PROGRAM"); break;
   case CODE_SR: printf(" STAY RESIDENT"); break;
   case CODE_SF: printf(" SEARCH FILE"); break;
   case CODE_FD: printf(" FORMAT TRACK"); break;
   case CODE_GI: printf(" GET INTERRUPT"); break;
  }
 printf("\n");
}

/* ⥭  */
unsigned char fg(int st) {
 unsigned char _tmp;
 read( st, &_tmp, 1);
 n++;
 if (eof(st)||(n==0xFFFF)) Finish=TRUE;
 return _tmp;
}

/* 뤥   ⮢  */
int _b(unsigned char n, int l, int r) {
 int i, tmp, mask=0;
 if (l>r) { tmp=l; l=r; r=tmp; }
 for (i=l;i<=r;i++) {
  mask |= (1<<i);
 }
 return (n&mask)>>l;
}

/*  8-⮢ ॣ */
int _r8(int r) {
  int rn;
  switch (r)
   {
    case 0  : printf("AL"); rn=0; break;
    case 1  : printf("CL"); rn=4; break;
    case 2  : printf("DL"); rn=6; break;
    case 3  : printf("BL"); rn=2; break;
    case 4  : printf("AH"); rn=1; break;
    case 5  : printf("CH"); rn=5; break;
    case 6  : printf("DH"); rn=7; break;
    case 7  : printf("BH"); rn=3; break;
    default : printf("?");  rn=-1;
   };
  return rn;
}

/*  16-⮢ ॣ */
int _r16(int r) {
  int rn;
  switch (r)
   {
    case 0  : printf("AX"); rn=0; break;
    case 1  : printf("CX"); rn=2; break;
    case 2  : printf("DX"); rn=3; break;
    case 3  : printf("BX"); rn=1; break;
    case 4  : printf("SP"); rn=7; break;
    case 5  : printf("BP"); rn=6; break;
    case 6  : printf("SI"); rn=4; break;
    case 7  : printf("DI"); rn=5; break;
    default : printf("?");  rn=-1;
   };
  return rn;
}

  /* ᪨ ⮬ */
  autom(int *s)
   {
    switch (*s)
    {
     case S1:

        switch (e)
         {
          case CODE_OF : *s=S2; break;
          case CODE_WF : *s=S1; break;
          case CODE_CF : *s=S1; break;
         } break;

     case S2:

        switch (e)
         {
          case CODE_OF : *s=S2; break;
          case CODE_WF : *s=S3; break;
          case CODE_CF : *s=S1; break;
         } break;

     case S3:

        switch (e)
         {
          case CODE_OF : *s=S2; break;
          case CODE_WF : *s=S3; break;
          case CODE_CF : *s=S4; break;
         }
    }
   }

  /* ନ஢  ᮡ, 易  INT21 */
  code21h(union RRR *r)
  {
   switch ((int)r->h.ah)
    {
     case 0x00: case 0x4C:  { e=CODE_EX; Finish=TRUE; break; }
     case 0x31: { e=CODE_SR; Finish=TRUE; break; }
     case 0x4E: case 0x4F: { e=CODE_SF; break; }
     case 0x3D: { e=CODE_OF; break; }
     case 0x3E: { e=CODE_CF; break; }
     case 0x3F: { e=CODE_RF; break; }
     case 0x40: { e=CODE_WF; break; }
     case 0x25: { new_branch = (size_t) (r->x.dx-0x100); e=CODE_SI; break; }
     case 0x35: { e=CODE_GI; break; }
    }
  }

  /* ନ஢  ᮡ, 易  INT13 */
  code13h(union RRR *r)
  {
   switch ( (int)r->h.ah )
    {
     case 0x2: { e=CODE_RD; break;  }
     case 0x3: { e=CODE_WD; break; }
     case 0x5: { e=CODE_FD; break; }
    }
  }

  /*  ᥬ⨪ ⥬ 맮 */
  seman(union RRR *r)
  {
   switch ((int) c1)
   {
    case 0x20: e=CODE_EX; Finish=TRUE; break;
    case 0x21: code21h(r); break;
    case 0x13: code13h(r); break;
    case 0x25: e=CODE_RD; break;
    case 0x26: e=CODE_WD; break;
    case 0x27: e=CODE_SR; Finish=TRUE; break;
   }
  }

  /* ⠪᪨  , 稭饩   0x */
  codeC(union RRR *r)  {
   switch ( _b(c,0,3) )  {
     case 0xD : c1=fg(f);
                printf("INT 0x%X     ",c1);
                r->x.ip+=2;
                seman(r);             // 맮 ᥬ᪮ 
                break;
     case 0x3 : printf("RETN         "); r->x.ip++; Finish=TRUE; break;
     case 0xF : printf("IRET         "); r->x.ip++; Finish=TRUE; break;
     default  : printf("?");
    }
  }

  /* ⠪᪨  , 稭饩   0xB */
  codeB(union RRR *r) {
   n1 = _b(c,0,2); printf("MOV ");   //   ()
   switch ( _b(c,3,3) )  {           // ஢  ()
    case 0 : r1=_r8(n1);             //   ॣ ()
                                     //  ᫥   ()
             m1=fg(f);               // ⥭ ⠭ ()
             r->r8[r1]=m1;           //  ॣ ⠭⮩ ()
             r->x.ip+=2;             // ६ 稪  ()
             printf(",0x%02X  ",m1); //  ⠭ ()
             break;
    case 1 : r1=_r16(n1); m1=fg(f)+256*(int)fg(f); r->r16[r1]=m1;
             printf(","); printf("0x%04X", m1); r->x.ip+=3; break;
    }
  }

  /* ⠪᪨  , 稭饩   0x8 */
  code8(union RRR *r) {
   c1 = fg(f);
   if (_b(c1,6,7)==3) {
    n1 = _b(c1,3,5); n2 = _b(c1,0,2); printf("MOV ");
    switch ( _b(c,0,3) ) {
     case 0xA : r1=_r8(n1); printf(","); r2=_r8(n2);
                r->r8[r1]=r->r8[r2]; r->x.ip+=2; break;
     case 0xB : r1=_r16(n1); printf(","); r2=_r16(n2);
                r->r16[r1]=r->r16[r2]; r->x.ip+=2; break;
     default  : printf("??,??");
    }
    printf("    ");
   }
   else printf("?");
  }

  /* ࠡ⪠  */
  decompile(union RRR *r)
  {
  for (i=0;i<l;i++) printf(" "); // ஡  砫 ப
  printf("%04X: ", r->x.ip);
  switch( _b(c,4,7) )
   {
      case 0xC : codeC(r); break;
      case 0xB : codeB(r); break;
      case 0x8 : code8(r); break;
      default  : printf("?");
   }
   pr(r);
   if (new_branch!=NO_BRANCH)
    {
     l++; // ஢  ⢨
     detect(new_branch);
     l--;
     new_branch=NO_BRANCH;
    }
  }

  /* ࠡ⪠ ணࠬ ⢨ */
  detect(size_t a)
  {
   size_t a_tmp;
   union RRR r;
   int s=S1; // ﭨ ⮬  ⢨

   new_branch = NO_BRANCH;
   setmem(&(r.r8[0]), sizeof(r), 0);
   printf("\nBEGIN BRANCH 0x%X\n", a);
   a_tmp = tell(f);
   lseek(f, a, SEEK_SET);
   Finish=FALSE;
   r.x.ip = a+0x100;
   while (!Finish)
    {
     c=fg(f);
     e=CODE_NO;
     if (!Finish) decompile(&r); //  !!!
     autom(&s);
     if (s==S4) Result=TRUE;
    }
   Finish=FALSE;
   lseek(f, a_tmp, SEEK_SET);
   printf("END BRANCH\n\n");
  }

/*   */
main(int argn, char *argv[] )
{
 if (argn>1)
 {
  printf("  IP  MOV   COMMAND   AX   BX   CX   DX   SP   BP   SI   DI\n");
  printf("-----------------------------------------------------------\n");
  n=0;
  f = open(argv[1], O_BINARY|O_RDWR);
  detect(0);
  close(f);
  if (Result) printf("IT IS VIRUS !!!");
 }


  ਬ ࠡ:

  IP  MOV   COMMAND   AX   BX   CX   DX   SP   BP   SI   DI
-----------------------------------------------------------

BEGIN BRANCH 0x0
0100: MOV AX,0x2521 2521 0000 0000 0000 0000 0000 0000 0000
0103: MOV DX,0x010A 2521 0000 0000 010A 0000 0000 0000 0000
0106: INT 0x21      2521 0000 0000 010A 0000 0000 0000 0000 SET INTERRUPT

BEGIN BRANCH 0xA
 010A: MOV AH,0x3D   3D00 0000 0000 0000 0000 0000 0000 0000
 010C: INT 0x21      3D00 0000 0000 0000 0000 0000 0000 0000 OPEN FILE
 010E: MOV AH,0x40   4000 0000 0000 0000 0000 0000 0000 0000
 0110: INT 0x21      4000 0000 0000 0000 0000 0000 0000 0000 WRITE FILE
 0112: MOV AH,0x3D   3D00 0000 0000 0000 0000 0000 0000 0000
 0114: INT 0x21      3D00 0000 0000 0000 0000 0000 0000 0000 OPEN FILE
 0116: MOV AH,0x40   4000 0000 0000 0000 0000 0000 0000 0000
 0118: INT 0x21      4000 0000 0000 0000 0000 0000 0000 0000 WRITE FILE
 011A: MOV AH,0x40   4000 0000 0000 0000 0000 0000 0000 0000
 011C: INT 0x21      4000 0000 0000 0000 0000 0000 0000 0000 WRITE FILE
 011E: MOV AH,0x3E   3E00 0000 0000 0000 0000 0000 0000 0000
 0120: INT 0x21      3E00 0000 0000 0000 0000 0000 0000 0000 CLOSE FILE
END BRANCH

0108: INT 0x27      2521 0000 0000 010A 0000 0000 0000 0000 STAY RESIDENT
END BRANCH

IT IS VIRUS


