the giant black book of computer viruses phần 9 pdf
the giant black book of computer viruses phần 9 pdf
... 158,151,28,10,245,45,110,150,187,37,1 89, 120,76,151,155, 39, 99, 43,254,103,
133 ,93 , 89, 131,167,67,43, 29, 191 ,1 39, 27,246,21,246,148,130,130,172,137,
60,53,238,216,1 59, 208,84, 39, 130,25,153, 59, 0, 195 ,230,37,52,205,81,32,120,
220,148,245,2 39, 2,6, 59, 145,20,237,14,1 49, 146,252,133,18,5,206,227,250,
... 236,173,211,150,34,220,218,217 ,93 ,170,65 ,99 ,115,235,0,247,72,227,123...
the giant black book of computer viruses phần 2 pdf
... relative to the start of
the code in the EXE file. This
is relocated by DOS at load time.
18H 2 Reloc Tbl Offset Offset of the start of the
relocation table from the start
of the file, in ... be the first byte of the virus.
3. Write the virus code currently executing to the end of the EXE file
being attacked.
4. Write the initial value of ss:sp, as s...
the giant black book of computer viruses phần 1 ppsx
... autonomous from man was the science fiction of the 195 0’s
and 196 0’s. However, with computer viruses it has become the
reality of the 199 0’s. Just the idea that a program can take off and
go-and gain ... PC Magazine, March 16, 199 3, p.
2 09.
2 Virus Bulletin, January, 199 4, p. 14.
3 The Crypt Newsletter, No. 8.
Part I
Self-Reproduction
The
GIANT
Black Book
o...
the giant black book of computer viruses phần 3 potx
... free at the time of the
;execution of the boot sector.
ORG 0500H
DISK_BUF: DB ? ;Start of the buffer
;Here is the start of the boot sector code. This is the chunk we will take out
;of the compiled ... loading, the
virus would have crashed the system. (And that, incidently, is why
the virus we’re discussing is the Kilroy-B. The Kilroy virus dis-
cussed in...
the giant black book of computer viruses phần 4 potx
... writes. First, DEVIRUS finds the end of the host file and uses
that as the offset for the new STRAT routine, writing this value into
the header. Next it hides the address of the old STRAT routine
internally ... STRAT routine
internally in itself at STRJMP, and then writes the body of its code
to the end of the SYS file. That’s all there is to it. The logic of
D...
the giant black book of computer viruses phần 5 pot
... function and
then disassemble it.
the virus is run. Thus, all of Developer A and Developer B’s clients
could suffer loss from the virus, regardless of whether or not they
developed software of their ... pushed on the stack and
the function is called with a far call. In OS/2 the function names
and the names of the modules where they reside are different, of
course. For...
the giant black book of computer viruses phần 6 pot
... data at the end of the file where
the virus is hiding, the virus can defeat the read, or simply truncate
it so that only the host is read.
If the read requests data at the beginning of the file, ... relative to the end of the file using Function
42H, Subfunction 2 must be adjusted to be relative to the end of the
host. The virus handles this by first doing...
the giant black book of computer viruses phần 7 pot
... should include them. At the other end of
the scale, the fancier you want to get, the better. You can probably
think of a lot of instructions that modify at most one register. The
more possibilities ... such techniques in the
early 90 ’s. Some of the first viruses which employed such tech-
niques were the 1260 or V2P2 series of viruses. Before long, a
Bulgarian wh...
the giant black book of computer viruses phần 8 pot
... in the directory where the file is missing, and you don’t
have integrity data for any of them anymore. You scan them, sure,
but the scanner turns up nothing. Why was the file missing? Are
any of ... much work.
All one has to do is calculate the size of the file from the EXE
header, rather than from the file system, and use that to add the virus
to the file. An altern...
the giant black book of computer viruses phần 10 doc
... Publications, Inc. for use in The Giant Black Book
;of Computer Viruses
;
;Version 1.00
; Initial release - beta only
;Version 1.01
; Upgrade to fix a number of bugs in 1.00, gets rid of casual encryption
; ... di,2
cmp di,OFFSET HDKEY+16
jnz EHD37
mov di,OFFSET HDKEY
EHD37: loop EHD35
pop ds
The KOH.ASM Source
;Source Listing for the Potassium Hydroxide virus.
; (C)...