作者:风泽[EvilHsu]
出处:[EST]
ps:终于知道了杀毒软件是怎么杀毒的了!呵呵!
相信大多数人都用过杀毒软件吧,也知道病毒软件需要经常的更新病毒库吧,呵呵,其实这个病毒库里面收集的就是从病毒中提取的特征码。然后通过特征码的比较来判断文件是否为病毒。知道了这些我们就可以自己动手来做一个简单的病毒判断程序了。
首先我们要自己提取病毒特征码,为了安全起见,我就用CA来做例子吧,什么?不知道CA?那你就到百度搜索一下吧,我就不在这里多说了。
经过UltraEdit的编辑,我们找到以下东西
如果你用过ca的话,应该知道这个就是ca帮助里面的内容了,如下
相信这个代码在别软件出现几率应该是很底的吧,当然你也可以选其他的作为特征码。这里我就用这个了。
从上面我们可以知道:
我们现在就可以用程序来实现代码的比较了,以下就是写好的程序:
是不是很简单呢,如果我们再加上其他功能,比如遍历所有文件查找病毒,清除病毒并清楚病毒留下的东西,是不是就成为了专杀软件了。
以下就是增加了目录遍历功能的程序,有空我在增加其他的~~~
以下增加的目录遍历功能
出处:[EST]
ps:终于知道了杀毒软件是怎么杀毒的了!呵呵!
相信大多数人都用过杀毒软件吧,也知道病毒软件需要经常的更新病毒库吧,呵呵,其实这个病毒库里面收集的就是从病毒中提取的特征码。然后通过特征码的比较来判断文件是否为病毒。知道了这些我们就可以自己动手来做一个简单的病毒判断程序了。
首先我们要自己提取病毒特征码,为了安全起见,我就用CA来做例子吧,什么?不知道CA?那你就到百度搜索一下吧,我就不在这里多说了。
经过UltraEdit的编辑,我们找到以下东西
00000c90h:0A 73 53 41 2E 65 78 30 5C 5C 31 39 32 2E 31 36 sSA.ex0//192.16
00000ca0h:38 2E 30 B0 64 21 73 05 3C 83 98 1B 76 5B 36 8B 8.0癲!s<儤v[6?
00000ca0h:38 2E 30 B0 64 21 73 05 3C 83 98 1B 76 5B 36 8B 8.0癲!s<儤v[6?
如果你用过ca的话,应该知道这个就是ca帮助里面的内容了,如下
C:/>ca
Shadow Administrator, by netXeyes 2002/04/28
Written by netXeyes 2002, dansnow@21cn.com
Usage: SA //IP Account Password CloneAccount ClonePassword
Account: Username (Own Administrator Privilege)
Password: Password of User
CloneAccount: CloneUser's Account Name (Must Already Exsited)
ClonePassword: Set Password of CloneUser
Examples:
=========
SA.exe //192.168.0.16 Administrator Password IUSR_VICTIM SetNewPass
Clone Privillege of Administrator to IUSR_VICTIM,
And Set IUSR_VICTIM Password to "SetNewPass"
Shadow Administrator, by netXeyes 2002/04/28
Written by netXeyes 2002, dansnow@21cn.com
Usage: SA //IP Account Password CloneAccount ClonePassword
Account: Username (Own Administrator Privilege)
Password: Password of User
CloneAccount: CloneUser's Account Name (Must Already Exsited)
ClonePassword: Set Password of CloneUser
Examples:
=========
SA.exe //192.168.0.16 Administrator Password IUSR_VICTIM SetNewPass
Clone Privillege of Administrator to IUSR_VICTIM,
And Set IUSR_VICTIM Password to "SetNewPass"
相信这个代码在别软件出现几率应该是很底的吧,当然你也可以选其他的作为特征码。这里我就用这个了。
从上面我们可以知道:
文件偏移地址0x0c90
提取特征码长度:0x20(32)
特征码内容:0A 73 53 41 2E 65 78 30 5C 5C 31 39 32 2E 31 36
38 2E 30 B0 64 21 73 05 3C 83 98 1B 76 5B 36 8B
提取特征码长度:0x20(32)
特征码内容:0A 73 53 41 2E 65 78 30 5C 5C 31 39 32 2E 31 36
38 2E 30 B0 64 21 73 05 3C 83 98 1B 76 5B 36 8B
我们现在就可以用程序来实现代码的比较了,以下就是写好的程序:
#include
#include
bool scanvir(const char *file,long offset, int length, void *vir);
main()
{
int i;
unsigned char vir[]=
{ 0x0A,0x73,0x53,0x41,0x2E,0x65,0x78,0x30,0x5C,0x5C,0x31,0x39,0x32,0x2E,0x31,0x36,0x38,0x2E,0x30,0xB0,0x64,0x21,0x73,0x05,0x3C,0x83,0x98,0x1B,0x76,0x5B,0x36,0x8B };
i=scanvir("c://CA.exe",0x0c90,0x20,vir); //调用查毒函数
if(i==1) printf("警告!发现病毒。/n");
if(i==0) printf("没有发现病毒。/n");
}
bool scanvir(const char *file,long offset, int length, void *vir)
{
FILE *fp = NULL;
int a=0;
char rvir[255]={ 0 };
bool b=false;
fp=fopen(file,"rb"); //以2进制打开指定文件
if(NULL==fp)
{ goto novir; }
fseek(fp,offset,SEEK_SET); //把文件指针指向偏移地址
fread(rvir,length,1,fp); //读取length长度的代码
a=memcmp(vir,rvir,length); //与我们提取的代码比较,返回值放到a中
if(a==0)
{
b=true;
}
novir:if(fp){ fclose(fp); fp=NULL; }
return b;
}
#include
bool scanvir(const char *file,long offset, int length, void *vir);
main()
{
int i;
unsigned char vir[]=
{ 0x0A,0x73,0x53,0x41,0x2E,0x65,0x78,0x30,0x5C,0x5C,0x31,0x39,0x32,0x2E,0x31,0x36,0x38,0x2E,0x30,0xB0,0x64,0x21,0x73,0x05,0x3C,0x83,0x98,0x1B,0x76,0x5B,0x36,0x8B };
i=scanvir("c://CA.exe",0x0c90,0x20,vir); //调用查毒函数
if(i==1) printf("警告!发现病毒。/n");
if(i==0) printf("没有发现病毒。/n");
}
bool scanvir(const char *file,long offset, int length, void *vir)
{
FILE *fp = NULL;
int a=0;
char rvir[255]={ 0 };
bool b=false;
fp=fopen(file,"rb"); //以2进制打开指定文件
if(NULL==fp)
{ goto novir; }
fseek(fp,offset,SEEK_SET); //把文件指针指向偏移地址
fread(rvir,length,1,fp); //读取length长度的代码
a=memcmp(vir,rvir,length); //与我们提取的代码比较,返回值放到a中
if(a==0)
{
b=true;
}
novir:if(fp){ fclose(fp); fp=NULL; }
return b;
}
是不是很简单呢,如果我们再加上其他功能,比如遍历所有文件查找病毒,清除病毒并清楚病毒留下的东西,是不是就成为了专杀软件了。
以下就是增加了目录遍历功能的程序,有空我在增加其他的~~~
以下增加的目录遍历功能
#include
#include
#include
bool scanvir(const char *filename,long offset,int length,void *vir);
int viewfiles(char *directory,long offset,int length,void *vir);
void main(void)
{
unsigned char vir[]=
{ 0x4A,0x75,0x6D,0x55,0x70,0x85,0x0B,0x73,0x4E,0x85,0x02,0x54,0x69,0x9A,0x07,0xD0,
0xA1,0x4A,0x6F,0x00,0x62,0x61,0x6B,0x61,0x33,0x00,0x53,0x4F,0x0B,0x46,0x54,0x57,
0x41,0x55,0x11,0x5C,0x6A,0x9C,0x29,0x5C,0xE3,0x97,0x5C,0x0F,0x7F,0x20,0xF0,0xB6 };
char directory[MAX_PATH];
int count;
printf(" ============================================/n");
printf(" 震荡波病毒查找工具 /n");
printf(" www.chinahackers.cn.st/n" );
printf(" ============================================/n");
printf("/n");
printf("请输入待检查分区或目录名/n");
printf("提醒:分区后要加':',目录路径要输入完整/n");
printf("请输入:");
gets(directory);
printf("查找病毒开始,请耐心等待....../n");
count=viewfiles(directory,0x32A0,0x30,vir);
if(count>0)
printf("这次检查共在目录里面发现%d个病毒./n",count);
else
printf("%s中安全,未发现病毒./n",directory);
getch();
}
bool scanvir(const char *filename,long offset,int length,void *vir)
{
FILE *fp;
char *rvir;
bool b=false;
fp=fopen(filename,"rb");
if(fp!=NULL)
{
fseek(fp,0,SEEK_END);
if(offset+length<=ftell(fp))
{
fseek(fp,offset,SEEK_SET);
rvir=new char[length];
fread(rvir,length,1,fp);
b=memcmp(vir,rvir,length)==0;
delete[] rvir;
}
fclose(fp);
}
return b;
}
int viewfiles(char *directory,long offset,int length,void *vir)
{
WIN32_FIND_DATA fdFindData;
HANDLE hFind;
char *filename;
int count=0;
BOOL done;
filename=new char[strlen(directory)+5];
strcpy(filename,directory);
strcat(filename,"//*.*");
hFind=FindFirstFile(filename,&fdFindData);
delete[] filename;
done=hFind!=INVALID_HANDLE_VALUE;
while(done)
{
if(strcmp(fdFindData.cFileName,".") && strcmp(fdFindData.cFileName,".."))
{
filename=new char[strlen(directory)+strlen(fdFindData.cFileName)+2];
strcpy(filename,directory);
strcat(filename,"//");
strcat(filename,fdFindData.cFileName);
if((fdFindData.dwFileAttributes&FILE_ATTRIBUTE_DIRECTORY)==FILE_ATTRIBUTE_DIRECTORY)
count+=viewfiles(filename,offset,length,vir);
else
if(scanvir(filename,offset,length,vir))
{
count++;
printf("警告!发现病毒。病毒路径%s/n",filename);
}
delete[] filename;
}
done=FindNextFile(hFind,&fdFindData);
}
FindClose(hFind);
return(count);
}
#include
#include
bool scanvir(const char *filename,long offset,int length,void *vir);
int viewfiles(char *directory,long offset,int length,void *vir);
void main(void)
{
unsigned char vir[]=
{ 0x4A,0x75,0x6D,0x55,0x70,0x85,0x0B,0x73,0x4E,0x85,0x02,0x54,0x69,0x9A,0x07,0xD0,
0xA1,0x4A,0x6F,0x00,0x62,0x61,0x6B,0x61,0x33,0x00,0x53,0x4F,0x0B,0x46,0x54,0x57,
0x41,0x55,0x11,0x5C,0x6A,0x9C,0x29,0x5C,0xE3,0x97,0x5C,0x0F,0x7F,0x20,0xF0,0xB6 };
char directory[MAX_PATH];
int count;
printf(" ============================================/n");
printf(" 震荡波病毒查找工具 /n");
printf(" www.chinahackers.cn.st/n" );
printf(" ============================================/n");
printf("/n");
printf("请输入待检查分区或目录名/n");
printf("提醒:分区后要加':',目录路径要输入完整/n");
printf("请输入:");
gets(directory);
printf("查找病毒开始,请耐心等待....../n");
count=viewfiles(directory,0x32A0,0x30,vir);
if(count>0)
printf("这次检查共在目录里面发现%d个病毒./n",count);
else
printf("%s中安全,未发现病毒./n",directory);
getch();
}
bool scanvir(const char *filename,long offset,int length,void *vir)
{
FILE *fp;
char *rvir;
bool b=false;
fp=fopen(filename,"rb");
if(fp!=NULL)
{
fseek(fp,0,SEEK_END);
if(offset+length<=ftell(fp))
{
fseek(fp,offset,SEEK_SET);
rvir=new char[length];
fread(rvir,length,1,fp);
b=memcmp(vir,rvir,length)==0;
delete[] rvir;
}
fclose(fp);
}
return b;
}
int viewfiles(char *directory,long offset,int length,void *vir)
{
WIN32_FIND_DATA fdFindData;
HANDLE hFind;
char *filename;
int count=0;
BOOL done;
filename=new char[strlen(directory)+5];
strcpy(filename,directory);
strcat(filename,"//*.*");
hFind=FindFirstFile(filename,&fdFindData);
delete[] filename;
done=hFind!=INVALID_HANDLE_VALUE;
while(done)
{
if(strcmp(fdFindData.cFileName,".") && strcmp(fdFindData.cFileName,".."))
{
filename=new char[strlen(directory)+strlen(fdFindData.cFileName)+2];
strcpy(filename,directory);
strcat(filename,"//");
strcat(filename,fdFindData.cFileName);
if((fdFindData.dwFileAttributes&FILE_ATTRIBUTE_DIRECTORY)==FILE_ATTRIBUTE_DIRECTORY)
count+=viewfiles(filename,offset,length,vir);
else
if(scanvir(filename,offset,length,vir))
{
count++;
printf("警告!发现病毒。病毒路径%s/n",filename);
}
delete[] filename;
}
done=FindNextFile(hFind,&fdFindData);
}
FindClose(hFind);
return(count);
}