The 808 Virus
Here another virus from skism. It ' s a quick overwriting virus but
You can use the source code to write your own viruses.
------------------------------------------------------------------------------; The SKisM 808 Virus. Created 1991 by the Smart Kids into Sick Methods.FileName EQU used to find file nameFileAttr EQU used to find file attributesFiledate EQU used to find file dateFILETIME EQU used to find file timeCode_start EQU 0100h; start of all. COM filesVirus_size EQU 808
1. Data Transmission commands ── ─ they transmit data between the storage and registers, registers and input and output ports. 1. general data transmission commands. moV transfers words or bytes. movsx first extends the symbol and then transmits it. movzx is not extended before transmission. push pushes words into the stack. pop pops up the word stack. pusha pushes ax, CX, dx, BX, SP, BP, Si, di into the stack in sequence. popa pops up the stack of DI
, such as Read_track, where POPs and push directives were used, so it was set up to load the SETUP.S module at the back of the Bootsec.s; get the drive parameters, this should be a value floppy , mainly obtains the number of sectors per track, outputs "Loading system ..." in the screen, then loads the system module that is the kernel module, determines the root file system device, jumps between segments, and executes in the SETUP.S; Here is my understanding of some of the code in BOOTSEC.S. Bo
is typically used to store the segment address to access the data. For example, if we want to read the contents of the 10000H unit, we can do it with the following program sections:mov bx,1000h mov DS,BX mov al,[0][......] Represents a memory unit, 0 represents the offset address of a memory cellTransmission of Word8086CPU is a 16-bit structure that can transmit 16 bits of data at once, i.e. one word at a
Write the operating system to a floppy disk and open the operating system in a floppy disk boot. Reboot the computer, boot the existing operating system, and display and set the clock (the so-called operating system). The debug phase is completed under Vmware+msdos.
Experimental tips:
1, in order to facilitate our experiments under the virtual machine, I choose VMware;
2, for debugging convenience we install MS-DOS 7.10 (with Debug), download address: http://www.onlinedown.net/soft/2465.htm;
3,
The has done some theoretical groundwork before, and this time we can look at the code. One, code listing
; listing 11-1; filename: c11_mbr.asm; File Description: Hard drive main boot sector code; Date Created: 2011-5-16 19:54; set stack segments and stack pointers MOV ax,cs mov ss,ax mov sp,0x7c00; calculate the logical segment of the GDT address mov ax,[cs:g DT_BASE+0X7C00]; Low 16-bit MOV dx,[cs:gdt_base+0x7c00+0x02]; high 16-bit MOV bx
PHP Compressed Shell format
Recently through the shell_exec Execute zipinfo command, get the corresponding ZIP package inside the file list information, returned is the string, how to format the output return value in the form of an array?
Archive:222.zipZip file size:1358592 bytes, number of entries:69-RW----6.3 Fat 33897 bx defN 12-jul-09 23:47 pear.php-RW----6.3 Fat 34308 bx defN 12-jul-09 23:47 ch
This blog series reference from Computer CPU data processing consists of two basic questions: 1. Where is the data? 2. How big is the data? This chapter serves as a summary section of the preceding content, mainly to illustrate these two issues. We define two symbols Reg and Sreg. Where Reg is register, Sreg is segment registerReg includes: Ax,bx,cx,dx,ah,al,bh,bl,ch,cl,dh,dl,sp,bp,si,diSreg includes: ds,ss,sp,es8.1
as follows:
MoV ax, 2000 h
MoV [BX], 10
Immediate number addressing is mainly used to assign an initial value to a register or storage unit. It is an operation number or an address value.
Register addressing: The operands required in the instruction are in a register of the CPU. The access to these operands is completely carried out within the CPU, and the bus cycle is not required, so the execution speed is fast. Register addressing directly writes
BX, si, Di, bp1, in 8086CPU, only these 4 registers (BX, BP, Si, di) can be used in the "[...]" to address the memory unit.2. In "[...]", these 4 registers (BX, BP, Si, di) can appear either individually or only in four combinations:bx and Si, bx and di, BP and Si, BP and di1 the correct instructions:2 movAX,[
(i) the foregoingThe two basic questions that the title says are:
Where is the data being processed? ?
How long is the data to be processed ? ?
These two problems, in the machine instructions must be given explicit or implicit instructions, otherwise the computer will not work.We define descriptive symbols: Reg and Sreg.Reg represents a register that represents a segment register with Sreg.The collection of Reg includes:ax, BX, CX,
, head 0MOV cx, #0x0002! Sector 2, Track 0! Sector 2, Track 0MOV bx, #0x0200! Address = Initseg! Buffer offset, es in the above code has been set to 0x9000mov ax, #0x0200 +setuplen! Service 2, NR of sectors! Read 4 disk Sectors to memoryint 0x13! Read it! Call breakJNC Ok_load_setup! Ok-continue! CF No bit indicates read success, jump to Ok_load_setupMOV dx, #0x0000! Reset Drive and Headmov ax, #0x0000! Reset the disketteint 0x13! ResetJ Load_setup! K
; This program is compiled by TASM
; CIH file-type virus detection and elimination program
Gofirst MACRO
XOR CX,CX
XOR DX,DX
MOV ax,4200h
INT 21H; file pointer to top of file
Endm
Alterline MACRO
MOV DL,0DH
MOV ah,02h
INT 21H; carriage return
MOV dl,0ah
MOV ah,02h
INT 21H; line Wrap
Endm
Copyhandle MACRO
PUSH BX
MOV ah,45h
INT 21H; copy file handle
MOV Bx,ax
MOV Ah,3eh
INT 21H; turning off copying files
POP
7.1 and and or directivesbinary and or can place a bit 0 or 17.2 About ASCII code7.3 Giving the data in character formData segmentDB ' UnIX '//equivalent to DB 75h,6eh,49h,58hDB ' FoRK '//equivalent to DB 66H,6FH,52H,4BHData endsmov al, ' a '//equivalent to MOV al,61h7.4 Capitalization conversion issuesDB ' BaSiC 'DB ' Information 'How do I turn the first string into uppercase and the second lowercase?Let's compare the ASCII code:Uppercase hexadecimal binary lowercase hexadecimal binaryA 0100000
different segments.(i) Use of data in code snippetsThe following 8 data are programmed and the results exist in the AX register:0123h, 0456h, 0789h, 0abch, 0defh, 0fedh, 0cbah, 0987hI wrote the following code:Assume Cs:codeCode segmentDW 0123h,0456h,0789h,0abch,0defh,0fedh,0cbah,0987hMOV bx,0MOV ax,0MOV cx,8S:add AX,CS:[BX]Add bx,2Loop sMOV ax,4c00hint 21hCode e
errorOpen_output ENDPClose_input proc near; close input fileMOV bx,input_handle; Bx=handleMOV Ah,3ehint 21hRetClose_input ENDPClose_output proc near; close output fileMOV bx,output_handle; Bx=handleMOV Ah,3ehint 21hRetClose_output ENDPGet_char proc near; get one character from input bufferMOV
is 0x07c0,initseg value of 0x9000, and then the MOVW instruction copies the 512 bytes of address 0x07c00 to the 0x90000 address, and then jumps to the label at go.Go:mov ax,csmov ds,axmov es,ax! Put stack at 0x9ff00. mov ss,axmov sp, #0xFF00! Arbitrary value >>512From the Jmpi command can be seen in the segment address is the value of CS 0x9000, then the DS, ES and SS register here The value of 0X9000,SP is 0xff00, that is, the stack pointer points to the address 0x9ff00.The first phase of the
3.1 Storage of in-memory wordsThe registers in the CPU are 16 bits, which can be used to store a word in high and low bytes, but each memory unit is 8 bits and only one byte is stored.So memory uses 2 contiguous memory units to store a word's high and low bytesFor example: 20000 value (4e20h) in address 0 of the memory unit value is 20H, the memory cell value in Address 1 is 4EHTwo memory units storing a font data is called a word unit ,The starting address of the word cell is n, which is called
EndsCode segmentStart:mov AX, dataMOV ds, axmov ax, tableMOV es, axMOV bx, 0; BX is used to represent the offset address in the data segmentmov si, 0; Si used to represent the offset address in the data segmentmov di, 0;d i is used to represent the offset address in the table segmentMOV dx, 0;d x is used to store the high data of the divisorMOV cx, 21S0:mov ax, [bx
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.