tailieunhanh - the giant black book of computer viruses phần 6

hiện tại đĩa. Ngoài ra, người ta có thể chỉ định ký tự ổ đĩa trên dòng lệnh và GBSCAN sẽ quét ổ đĩa để thay cả các quyền. mô hình mã nhỏ, tương đương Đây là những lá cờ được sử dụng để xác định các chuỗi quét và những gì họ dành cho. | How a Virus Detector Works 331 current disk. Alternatively one can specify a drive letter on the command line and GBSCAN will scan that drive instead. GBSCAN can be assembled with MASM TASM or A86. GB-SCAN Virus Scanner C 1995 American Eagle Publications Inc. All Rights Reserved. .model tiny .code Equates dbUf_size EQU 16384 size of data buffer for scanning These are the flags used to identify the scan strings and what they are for BOOT_FLAG EqU 00000001B Flags a boot sector MBR_FLAG eQu 00000010B Flags a master boot sector EXE_FLAG EQU 00000100B Flags an EXE file COM_FLAG EQU 00001000B Flags a COM file RAM_FLAG EQU 00010000B Search RAM END_OF_LIST EQU 00100000B Flags end of scan string list ORG 100H GBSCAN mov ax cs mov ds ax mov ah 19H get current drive number int 21H mov BYTE PTR CURR_DR al and save it here mov ah 47H get current directory mov dl 0 mov si OFFSET CURR_DIR int 21H mov bx 5CH mov al es bx get drive letter from FCB or al al was one specified jnz GBS1 yes go adjust as necessary mov ah 19H no get current drive number int 21H inc al GBS1 dec al adjust so A 0 B 1 etc. mov BYTE PTR DISK_DR al save it here mov dl al mov ah 0EH and make this drive current int 21H push cs pop es mov di OFFSET PATH set up path with drive letter mov al DISK_DR add al A mov ah stosw mov ax stosw mov dx OFFSET HELLO say hello mov ah 9 int 21H call SCAN_RAM is a virus in RAM jc GBS4 yes exit now cmp BYTE PTR DISK_DR 2 is it drive C 332 The Giant Black Book of Computer Viruses jne call GBS2 SCAN_MASTER_BOOT no don t mess with master boot record GBS2 cmp BYTE PTR DISK_DR 2 is it drive D or higher jg GBS3 yes don t mess with boot sector call SCAN_BOOT GBS3 mov dx OFFSET ROOT go to root directory mov ah 3BH int 21H call SCAN_ALL_FILES GBS4 mov dl CURR_DR restore current drive mov ah 0EH int 21H mov dx OFFSET CURR_DIR restore current directory mov ah 3BH int 21H mov ax 4C00H exit to DOS int 21H This routine scans the Master Boot Sector. The drive to scan is supplied in dl. .