tailieunhanh - the giant black book of computer viruses phần 3

Trong cuốn sách này bạn sẽ học những điều cơ bản của virus sinh sản thông qua email, và sau đó đi để khám phá làm thế nào chương trình chống virus bắt họ và làm thế nào Wiley virus trốn tránh việc chương trình chống virus. Bạn sẽ tìm hiểu về virus đa hình và phát triển. | An Introduction to Boot Sector Viruses The boot sector virus can be the simplest or the most sophisticated of all computer viruses. On the one hand the boot sector is always located in a very specific place on disk. Therefore both the search and copy mechanisms can be extremely quick and simple if the virus can be contained wholly within the boot sector. On the other hand since the boot sector is the first code to gain control after the ROM startup code it is very difficult to stop before it loads. If one writes a boot sector virus with sufficiently sophisticated anti-detection routines it can also be very difficult to detect after it loads making the virus nearly invincible. In the next three chapters we will examine several different boot sector viruses. This chapter will take a look at two of the simplest boot sector viruses just to introduce you to the boot sector. The following chapters will dig into the details of two models for boot sector viruses which have proven extremely successful in the wild. 132 The Giant Black Book of Computer Viruses Boot Sectors To understand the operation of a boot sector virus one must first understand how a normal uninfected boot sector works. Since the operation of a boot sector is hidden from the eyes of a casual user and often ignored by books on PC s we will discuss them here. When a PC is first turned on the CPU begins executing the machine language code at the location F000 FFF0. The system BIOS ROM Basic-Input-Output-System Read-Only-Memory is located in this high memory area so it is the first code to be executed by the computer. This ROM code is written in assembly language and stored on chips EPROMS inside the computer. Typically this code will perform several functions necessary to get the computer up and running properly. First it will check the hardware to see what kinds of devices are a part of the computer . color or mono monitor number and type of disk drives and it will see whether these devices are working .