SHA-1:bde53ddafa82ed4266ada13488af219736b766e2

检测vmware虚拟机的两种方式

1

mov dx, 5658h
in eax, dx
cmp ebx,564d5868h
setz al
test al,al
jnz DIE   ;br=1 死
ALIVE

2

ip地址存在192.168.100.*

该病毒内的一个代码结构抽象

int v1=0, v2=0, v3=0;
int v4=0xa, v5=3;
char *n=NULL;
while(!v1)
{
  if(v2>=v4)
  {
    v2 = 0;
  }
  v3=1;
  if(v5>=1)
  {
    while(1)
    {
      if(v1)
        goto label_1;
      n = recvcommand();
      if(n==NULL)
        goto label_2;
      if(!strcmp(n,"fuckit"))
        goto label_1;
      if(strcmp(n,"damnit"))
        break;
      v1 = 1;
label_2:
      if(++v3>=v5)
        goto label_1;
    }
    if(!strcmp(n,"ohyeah"))
      v1 = 1;
    goto label_2;
  }
label_1:
  ...
  ++v2;
}