
Ŀ
                                                                    
                        
                                    
                           
                                          
Ĵ
                                  5                           
ٰ



                       DOC-
                               by DrMAD


    
    1.     
    2.   D-
    3.   WORD-
    4.  
    5.  
    
    .   .

    

           ᮢ  ⥬,      㧭,  
⭮  ஢,     ᬮ ,    
㯠  窠.

    1.     

    쪮  ஢  MS Word.  ஢  MS  Access,  MS
Excel  ..    ᬠਢ.
    ஬ ⮣,  㤥    ,    ᬠਢ  -᭮
஢, ᠭ  몥 Visual Basic for Application (VBA) 
MS Word ᨩ 97,  2000  XP.  ஢   Word  6.0/7.0  㦥  
㠫,    ⮨  Word 2003 -   ᫨誮 ⭮.

    2.   D-

    ஡ .  /1,2/,   .
     䠩    ७  .DOC  (  .DOT)    ᫮ ७
ன      "஢  ࠭"  (structured
storage).   MS  Word  ⠪    ᮧ  㬥    "த"
ଠ, ਬ,  .RTF,     ᬠਢ  㤥.
    ࠢ structured storage ।ᬠਢ, :
    - 䠩  ࠧ  ⢮ ᥪ஢ (ࠧ ᥪ  㬮砭 -
512 ⮢);
    - ᥪ ஭㬥஢  易  楯窨;

                 +-----------------------+
                 |                       V
+---------+ +----+----+ +---------+ +---------+ +---------+  +---------+
|| |    0    | |    1    | |    2    | |    3    |->|    4    |
+---------+ +---------+ +----+----+ +---------+ +---------+  +---------+
                             |                       ^
                             +-----------------------+

    -  䠩  , 뢠騩 ࠬ ࠭;
    -  䠩  FAT-⠡,  뢠,   ᥪ 
楯窠 ਭ;
    -  䠩  ⠫,  뢠騥  楯窨     
ࢮ ᥪ.
    窨 ࠧ  ⮪  (streams),        ᮤন 
 ଠ.  ( ᠬ ,    lock bytes,    
  ࠭  "ﭭ" ଠ,   ன MS Word 祣 
).

    3.   WORD-

    ஡ .  /3,4/,   .
     饬 砥 㬥  ᪮쪮 ⮪  䠩 (
 易⥫쭮 !).   筮 ⨯筠 䨣 ⮪ 
஢ 㬥:

    1Table
    <1>CompObj
    ObjectPool
    WordDocument    <-  ⥪ 㬥
    <5>SummaryInformation
    <5>DocumentSummaryInformation

       㬥, ᮤঠ饣  ():

    1Table
    Macros
     VBA
      dir
      __SRP_0       <-+
      __SRP_1         |  exe-code ᮢ
      __SRP_2         |
      __SRP_3       <-+
      ThisDocument  <-   s-code  p-code 
      Tralivali     <-   
      Newmacros     <-    ⮦
      _VBA_PROJECT  <-   ᠭ ࠧ ⥩ ஥
     PROJECT
     PROJECTwm
    [1]CompObj
    ObjectPool
    WordDocument    <-  ⥪ 㬥
    [5]SummaryInformation
    [5]DocumentSummaryInformation

         ।  ࠧ ⮪:
    1) s-code -   ᦠ ⮤ LZSS ⥪⮢ 室;
    2) p-code -  ४஢ 室   ஬ 䨪
, ਬ

    ; a = 1234

    00A4 Let
    1234 1234
    0027 ->
    0220   ᯨ᪥  ६

    3) exe-code -   , ᪮  ᯮ 㠫쭮
VBA-設,   ⨯:

    Push 㬥1
    Push 㬥2
    [⥪] := [⥪] + [⥪+2]

    S-code  ᮮ⢥騩  p-code     ⮪.
     ⠪ ⮪ 稭   ᨣ 01 16 01,  ⮬ ਧ  
     ⫨.

    4.  

    -,   95%   砥   室   ⥪      
筮,  ⮡  ᯮ        
ࠧ.  稨 ࠧ,  ࠢ,  ⢨ ⮤:

    1) OrganizerCopy;
    2) .Import/.Export;
    3) .InsertLine, .AddFile,  ..

    ⠫ 5% 室  砨:

    1) 1%  ( ᠬ ,   ०) -   室  
䠩 㤠 (ਬ, - ਢ ⨢ᮬ);
    2) 4% -   .

     ஡  ⠪:    ஢  p-code    ⥬  
ex-code      㬥஢  Microsoft-᪨    (  ⠪
㯠    ""  ⨢),    ,    
  VBA-ࠬ⨪    -  Yacc    ࠭
s-code    ᢮  ᮡ⢥  ७  .        ⮬   
(饭    ஡,  ਥ,  "᪫"  ப   .  .)
ᯮ ३    㫨஢   ᪨.

    5.  

    ன⢮ DOC-䠩            DocFile
Browser      FAR   Manager-:   㢨  ॢ  ꥪ⮢,  ᬮ
७  ⮪      16-筮  ...    FAR    㬥
ᯠ뢠  뢠 室 ⥪ 뢠  ᮢ,
  㬥 /3/.   ⢥  ਬ  -  ᮫쭠  ⨫⪠,  
室  doc-䠩 ⮪, 室   ᨣ 01 16 01, 室 
 ⮪   室,  ᯠ뢠  ,      
ப '.Import'  '.Export'  㣠,  ᫨  諠.  ⨫
ᯮ ⥪ OLE2.DLL   ⮤    ࠡ    structured
storage /5/.  ஬ ⮣,  Windows 95/ 98 ⨫⪠ ࠡ  㤥
  ,  ⮬    樮   ⮫쪮
맮   ⥪   NTDLL.DLL.   襭  ஡:  1)    
"襩"    ⥪      楤    RtlDecompressBuffer;    2)
ᠬ⥫쭮 ᯠ뢠 室 ᮢ,  筮 .

    

    1. Martin Schwartz. Laola file system.
    2. DrMAD. ७ ଠ 㬥⮢ MS Word.
    3. DrMAD. אַ   ᠬ  㬥 MS Word.
    4. DrMAD.  묠   .  6. 졠  ஢ᠬ.
    5. ⥬ . ActiveX  蠣.

    .   .

//*********************************************************************
//  ᪠  ३  㬥
//  Borland C/C++ v5.02
// (c) 쥢 . aka DrMAD,  2003
//*********************************************************************
#include "windows.h"
#include "ole2.h"
#include "iostream.h"

#define MAXBUF 0xFFFF
#define NAMELEN 256

char Buf[MAXBUF];  //   ⮪
char SBuf[MAXBUF]; //   ᯠ ⥪

/*  㭪  ⮪ */
ULONG search_chunk( char *Buf, ULONG streamlen)
{
 ULONG ch_pos; //  㭪  ⮪

 if ((Buf[0]==1)&&(Buf[1]==0x16)&&(Buf[2]==1))
  {
   ch_pos = streamlen/2;
   while ((ch_pos<(streamlen-3)) && ((Buf[ch_pos]!=1)||
         ((Buf[ch_pos+2]&0xF0)!=0xB0))) ch_pos++;
   if (ch_pos < (streamlen-3)) return ch_pos;
  }
  return 0;
}

/*   室 .Import/.Export */
LookAtVirus() {
 int i=0;
 while (SBuf[i]) {
  if ((SBuf[i]=='.')   &&
      (SBuf[i+3]=='p') &&
      (SBuf[i+4]=='o') &&
      (SBuf[i+5]=='r') &&
      (SBuf[i+6]=='t')) cout << endl << "*** Maybe virus! ***" << endl;
  i++;
 }
}

typedef UINT (WINAPI* RTLD)(ULONG, PVOID, ULONG, PVOID, ULONG, PULONG);

/* ᯠ 室 */
view_src( char *StreamName, char *Buf, ULONG ch_pos)
{
 HMODULE h;                //  ⥪ NTDLL.DLL
 RTLD RtlDecompressBuffer; // ⥫  㭪
 ULONG ulen;               //  ᯠ ࠣ
 int i=0;

 LoadLibrary("ntdll.dll");
 h = GetModuleHandle("ntdll.dll");
 RtlDecompressBuffer = (RTLD) GetProcAddress(h, "RtlDecompressBuffer");
 if (RtlDecompressBuffer)
  {
   RtlDecompressBuffer(0x2, SBuf, MAXBUF, &(Buf[ch_pos+1]), MAXBUF-ch_pos, &ulen);
   cout << " *** " << StreamName << " *** " << endl;
   while (SBuf[i]) cout << SBuf[i++];
   LookAtVirus();
  }
}

/* ᨢ 室 ⮪ */
walk(char *s, LPSTORAGE ls)
{
 OLECHAR FileName[NAMELEN];	// Unicode-  structured storage
 char StreamName[NAMELEN];	// ASCII- ⮪
 LPENUMSTATSTG lpEnum=NULL;	// 䥩 ᫨⥫
 LPSTORAGE pIStorage=NULL;	// 䥩 ஢ ࠭
 LPSTORAGE pIStorage2=NULL;	// 䥩 ࠭  ஢
 LPSTREAM pIStream=NULL;	// 䥩 ⮪
 STATSTG stat;		// ।   ⠫
 ULONG uCount;		// 稪 ᫥
 ULONG streamlen;	// 쭠  ⮪
 ULONG ch_pos;		//  㭪  ⮪

 if (!ls) //  맮
  {
   mbstowcs(FileName, s, 256);
   StgOpenStorage(FileName,NULL,STGM_READ|STGM_SHARE_EXCLUSIVE,
                  NULL,0,&pIStorage);
   walk("", pIStorage);
  }
 else //  ४ᨢ 맮
 {
  ls->EnumElements(0,NULL,0,&lpEnum);
  if (lpEnum)
  while (lpEnum->Next(1,&stat,&uCount)==S_OK)
   {
    if (stat.type==STGTY_STORAGE) //  ࠭
     {
      ls->OpenStorage(stat.pwcsName,NULL,STGM_READ|STGM_SHARE_EXCLUSIVE,
                      NULL,0,&pIStorage2);
      walk("", pIStorage2);
     }
    else //  ⮪
     {
      ls->OpenStream(stat.pwcsName,NULL,STGM_READ|STGM_SHARE_EXCLUSIVE,
                     0,&pIStream);
      pIStream->Read(Buf, MAXBUF, &streamlen);
      wcstombs(StreamName, stat.pwcsName, 256);
      ch_pos = search_chunk(Buf, streamlen);
      if (ch_pos) view_src(StreamName, Buf, ch_pos);
     }
    };
   ls->Release();
  }
}

int main(int argc, char* argv[]) {
 if (argc>1) walk(argv[1],NULL);
 else cout << "Usage: SVIR docfile" << endl;
}
