the giant black book of computer viruses phần 3 potx

... system;file. The location is fixed because this area is free at the time of the ;execution of the boot sector. ORG 0500HDISK_BUF: DB ? ;Start of the buffer;Here is the start of the boot sector ... loading, the virus would have crashed the system. (And that, incidently, is why the virus we’re discussing is the Kilroy-B. The Kilroy virus dis-cussed in The Little Black Book of Computer Viruses ... [ (32 *ROOT_ENTRIES) + SEC_SIZE - 1]/SEC_SIZEand the size of the file in sectors. The file size in bytes is stored atoffset 1CH from the start of the directory entry at 0000:0500H. The number of...

the giant black book of computer viruses phần 4 potx

... writes. First, DEVIRUS finds the end of the host file and usesthat as the offset for the new STRAT routine, writing this value into the header. Next it hides the address of the old STRAT routineinternally ... routineinternally in itself at STRJMP, and then writes the body of its codeto the end of the SYS file. That’s all there is to it. The logic of DEVIRUS is depicted in Figure 14 .3, and its action on a typicalSYS ... as the data segmentselector, once we have finished defining it. 3. Define the base of the segment associated to the new descriptor.This is the linear address of where that segment starts. The...

the giant black book of computer viruses phần 1 ppsx

... willalready understand the majority of viruses being written today.Most of them are one of these three types and nothing more.Before we dig into how the simplest of these viruses, the overwriting ... far. Not so, the computer virus, becauseit attaches itself to otherwise useful programs. The computer userwill execute these programs in the normal course of using the computer, and the virus ... and the anti-viral community at the time, 3 and despite the fact that the person incharge of those reviews was specifically notified of the problem.With a bit of technical knowledge and the...

the giant black book of computer viruses phần 2 pdf

... relative to the start of the code in the EXE file. This is relocated by DOS at load time. 18H 2 Reloc Tbl Offset Offset of the start of the relocation table from the start of the file, in ... be the first byte of the virus. 3. Write the virus code currently executing to the end of the EXE filebeing attacked.4. Write the initial value of ss:sp, as stored in the EXE Header, to the location ... [FFF8H] The first is the address 100H, used to return from the subroutinejust placed on the stack to offset 100H, where the host will be. The next is the address of the routine hiding just under the...

the giant black book of computer viruses phần 5 pot

... function andthen disassemble it. the virus is run. Thus, all of Developer A and Developer B’s clientscould suffer loss from the virus, regardless of whether or not theydeveloped software of their ... pushed on the stack and the function is called with a far call. In OS/2 the function namesand the names of the modules where they reside are different, of course. For example, instead of calling ... Most of the people who buy Developer A’s software will never even have the opportunity to watch the virus replicate because they don’tdevelop software and they don’t have any C files on their...

the giant black book of computer viruses phần 6 pot

... data at the end of the file where the virus is hiding, the virus can defeat the read, or simply truncateit so that only the host is read.If the read requests data at the beginning of the file, ... relative to the end of the file using Function42H, Subfunction 2 must be adjusted to be relative to the end of the host. The virus handles this by first doing a move to the end of the file with the ... directory full of Slips-infected EXE files anduse PKZIP on them to create a ZIP file of them, all of the files in the ZIP file will be uninfected, even if all of the actual files in the directory...

the giant black book of computer viruses phần 7 pot

... should include them. At the other end of the scale, the fancier you want to get, the better. You can probablythink of a lot of instructions that modify at most one register. The more possibilities ... such techniques in the early 90’s. Some of the first viruses which employed such tech-niques were the 1260 or V2P2 series of viruses. Before long, aBulgarian who called himself the Dark Avenger ... 32 -bit 8 038 6 code.This is a pretty good generator for the VME, however, youcould get an even better one, or write your own. There is anexcellent dissertation on the subject in The Art of Computer...

the giant black book of computer viruses phần 8 pot

... interrupt 13H. If the virus scannedand found the scan string in memory, it could also locate the interrupt 13H handler, even if layered in among several otherTSR’s. Then, rather than reproducing, the ... much work.All one has to do is calculate the size of the file from the EXEheader, rather than from the file system, and use that to add the virusto the file. An alternative would be to simply ... routine moves the virus (this program) to the end of the EXE file;Basically, it just copies everything here to there, and then goes and;adjusts the EXE file header and two relocatables in the program,...

the giant black book of computer viruses phần 9 pdf

... 158,151,28,10,245,45,110,150,187 ,37 ,189,120,76,151,155 ,39 ,99, 43, 254,1 03, 133 , 93, 89, 131 ,167,67, 43, 29,191, 139 ,27,246,21,246,148, 130 , 130 ,172, 137 , 60, 53, 238 ,216,159,208,84 ,39 , 130 ,25,1 53, 59,0,195, 230 ,37 ,52,205,81 ,32 ,120, ... 19,1 13, 64, 231 , 232 ,104,187 ,38 ,27,168,162,119, 230 ,190,61,252,90,54,10,167, 140,97,228,2 23, 1 93, 1 23, 242,189,7,91,126,191,81,255,185, 233 ,170, 239 ,35 , 24,72,1 23, 1 93, 210, 73, 167, 239 , 43, 13, 108,119,112,16,2, 234 ,54,169, 13, 247, ... 172,226, 23, 133 ,180,69,190,59,148,152,246,44,9,249,251,196,85 ,39 ,154,184, 74,141,91,156,79,121,140, 232 ,172,22, 130 ,2 53, 2 53, 154,120,211,102,1 83, 145, 1 13, 52,246,189, 138 ,12,199, 233 ,67,57,57 ,31 ,74,1 23, 94,1,25,74,188 ,30 , 73, ...

the giant black book of computer viruses phần 10 doc

... beginning of the file, al=1 moves the pointer relative to the currentlocation, al=2 moves the pointer relative to the end of the file.Function 43H: Get and Set File AttributesRegisters: ah = 43H ... Hydroxide virus.; (C) 1995 by The King of Hearts, All rights reserved.;Licensed to American Eagle Publications, Inc. for use in The Giant Black Book ;of Computer Viruses ;;Version 1.00; Initial ... mov dx,OFFSET WELCOME_MSG int 21H xor ax,ax mov ds,ax mov si,13H*4 ;save the old int 13H vector mov di,OFFSET OLD_13H movsw movsw mov ax,OFFSET INT_13H ;and set up new interrupt 13H mov...

Xem thêm