无意中看到这一段，2000的帖子，中间用到了特权指令，如cli;mov eax,dr0这些，纳闷中...
难道那个时候都可以用这些特权指吗，咋的现在却不行了
redly (2000-05-24 19:17:00)
本人以前做的一个检测内存中CIH的程序。
其中用到ASM，希望对你有所帮助
unit CIHForm;
interface
uses
Windows, Messages, SysUtils, Classes, Graphics, Controls, Forms, Dialogs,
StdCtrls, Menus, ExtCtrls, Buttons, ToolWin, ComCtrls;
type
TMainForm = class(TForm)
CheckButton: TButton;
Panel1: TPanel;
Bevel1: TBevel;
ExitButton: TButton;
AboutButton: TButton;
ToolBar1: TToolBar;
SpeedButton1: TSpeedButton;
SpeedButton2: TSpeedButton;
MainMenu1: TMainMenu;
filse1: TMenuItem;
N1: TMenuItem;
N2: TMenuItem;
N3: TMenuItem;
N4: TMenuItem;
Memo1: TMemo;
StatusBar: TStatusBar;
Timer1: TTimer;
procedure CheckButtonClick(Sender: TObject);
procedure ExitButtonClick(Sender: TObject);
procedure AboutButtonClick(Sender: TObject);
procedure Timer1Timer(Sender: TObject);
private
{ Private declarations }
public
{ Public declarations }
end;
var
MainForm: TMainForm;
IDTAddr,CIH_Begin, Int5_dw:dword;
CIH_IN_Mem, BoxRet:integer;
cStr:Pchar;
PageAddr:pointer;
implementation
uses AboutCIH;
{$R *.DFM}
procedure TMainForm.CheckButtonClick(Sender: TObject);
var
i:integer;
begin
CIH_Begin:=0;
StatusBar.Panels[1].text:='开始检查内存...';
asm
push ebp
push ebx
push eax
sidt [esp-2]
pop ebx //中断描述符表的地址送入EBX中
add ebx,$2c //指向INT 5
mov IDTAddr,ebx
cli
mov eax,[ebx]
mov ax,[ebx-4]
mov int5_dw,eax //保存原来的INT 5的入口地址
mov eax,offset @@int5
mov [ebx-4],ax
shr eax,$10
mov [ebx+2],ax //设置新的INT 5的入口地址
int 5 //调用INT 5
mov eax,int5_dw
mov ebx,IDTAddr
mov [ebx-4],ax
shr eax,$10
mov [ebx+2],ax //恢复原来的INT 5 入口地址
sti
pop ebx
pop ebp
jmp @@out
@@int5:
mov eax,dr0
cmp eax,$11 //寄存器dr0=11H是我们设立的识别标志
jnz @@Begin
iretd
@@Begin:
pushad
mov eax,offset @@File_Hook
push eax
int $20
@@addr:
db $67,0,$40,0 //VXDCall IFSMgr_InstallFileSystemApiHook
add esp,4
mov ebx,offset @@addr
mov ebx,[ebx]
mov eax,[ebx] //系统中原来的IFSMgr_InstallFileSystemApiHook的入口地址送EAX
mov ebp,eax
and eax,$FFFFF000
cmp dword ptr[eax],$24448d55 //检测病毒特征
jnz @@nofound
cmp dword ptr[eax+$302],$0708b866
jnz @@nofound
mov CIH_Begin,eax //保存病毒代码驻留的开始地址
push eax
call @@ModiPrg //修改病毒代码，以便将其从内存中释放
pop eax
add eax,$e2
push eax
int $20 //除去病毒设置的文件钩子函数
db $68,0,$40,0 //VXDCall IFSMgr_RemoveFileSystemApiHook
add esp,4
mov CIH_IN_Mem,eax //成功时，EAX=0
mov eax,CIH_Begin
push eax
int $20 //释放病毒代码占用的内存
db $55,0,1,0 //VXDCall _PageFree
add esp,4
@@nofound:
mov eax,offset @@File_Hook
push eax
int $20
db $68,0,$40,0 //VXDCall IFSMgr_RemoveFileSystemApiHook
add esp,4
call @@SetNewHook //设置新的IFSMgr_InstallFileSystemApiHook函数
popad
mov eax,$11
mov dr0,eax //内存免疫
iretd
@@ModiPrg:
mov edi,eax
mov ecx,$380
mov eax,$4558452e
cld
@@Modi11:
repnz scasb
cmp [edi-1],eax
jnz @@Modi12
cmp dword ptr [edi-5],$fc067c81
jz @@Modi13
@@Modi12:
jecxz @@Modi14
loop @@Modi11
@@Modi13:
xor eax,eax
mov [edi-1],eax
cmp [edi-1],eax
jz @@Modi14
mov ecx,1
@@Modi14:
and edi,$fffff000
cmp dword ptr [edi+$D2],$53ff5350
jnz @@Modi15
mov word ptr [edi+$d2],$8eb
mov word ptr [edi+$312],$ecec
@@Modi15:
mov eax,[ebp+$26]
cmp eax,$c0000000
jbe @@Modi16
mov [ebx],eax
@@Modi16:
db $c3 //ret
@@SetNewHook:
mov esi,offset @@addr
mov ebp,[esi]
mov edi,[ebp]
and edi,$fffff000
cmp dword ptr[edi+8],$fefecdcd //判断是否已设置过IFSMgr_InstallFileSystemApiHook
jnz @@SetN1
cmp dword ptr [edi+12],$abcdefab
jnz @@SetN1
ret
@@SetN1: //以下为具体的设置过程
db $6a,$0f //push $0f
xor eax,eax
push eax
db $6a,$ff
push eax
push eax
push eax
db $6a,1
db $6a,1
int $20 //分配１页内存
db $53,0,1,0 //VXDCall _PageAllocate
add esp,$20
mov PageAddr,eax
mov edx,offset @@newH10
inc edx
mov [edx],eax //修改调用地址
mov edi,eax
mov ecx,offset @@out
mov esi,offset @@NewHook
sub ecx,esi
cld
rep movsb //将代码移到高位内存区
mov edi,[ebp]
mov [eax],edi //保存原来的IFSMgr_InstallSysytemFileHookApi函数的地址
mov esi,PageAddr
lea esi,[esi+4]
mov eax,[eax]
mov [esi],eax //保存原来的文件系统挂钩函数的地址
mov edx,PageAddr
lea esi,[esi+12]
mov [ebp],esi //修改IFSMgr_InstallFileSystemApiHook函数的入口地址
db $c3 //ret
@@NewHook: //安装的FSMgr_InstallFileSystemApiHook函数
dd 0,0,$fefecdcd,$abcdefab //对自身进行识别的标志
@@newH1:
push ebp
mov ebp,esp
push esi
push edi
push ebx
@@newH10:
mov esi,offset @@newHook
mov ebx,[ebp+8]
cmp dword ptr [ebx],$e860 //判断要驻留的是否为病毒代码
jnz @@newH2
mov edi,ebx
mov ecx,$300
cld
mov eax,$0708b866 //继续进行判断
@@newH11:
repnz scasb
jecxz @@newH2
cmp [edi-1],eax
jnz @@newH11
mov edi,[ebp+4]
lea edi,[edi+4]
mov eax,$90900beb //修改病毒引导部分的代码
mov [edi],eax
mov eax,[ebp+8]
and eax,$fffff000
push eax
int $20 //释放病毒引导代码分配的内存
db $55,0,1,0 //VXDCall _PageFree
add esp,4
jmp @@newH3
@@newH2:
push dword ptr [ebp+8]
call dword ptr [esi] //调用原来的IFSMgr_InstallFileSystemApiHook函数
add esp,4
@@newH3:
pop ebx
pop edi
pop esi
pop ebp
db $c3 //ret
@@File_Hook:
ret
@@out:
end;
if(CIH_Begin=0)then begin
For i:=0 to 10000 do ;
StatusBar.Panels[1].text:='内存检查完毕';
MessageBox(0,'内存中没发现CIH 病毒','程序提示',MB_OK)
end
else
begin
GetMem(cStr,256);
try
lstrCpy(cStr,'内存中发现CIH 病毒在:');
lstrcat(cStr,Pchar(IntToHex(CIH_Begin,8)+#13#10));
if (CIH_IN_Mem=0)then lstrcat(cStr,#13#10'已被清除，');
lstrcat(cStr,'建议立即启动系统！');
if (CIH_IN_Mem=0)then
lstrcat(cStr,#13#10'并用杀毒软件清除文件中的CIH病毒。');
BoxRet:=MessageBox(0,cStr,'警告!!!',MB_ICONEXCLAMATION+MB_OKCANCEL);
finally
FreeMem(cStr,256);
end;
if(BoxRet=ID_OK)then ExitWindowsEx(EWX_REBOOT,0);
end;
//For i:=0 to 1000 do ;
//StatusBar.Panels[1].text:='内存检查完毕';
//close;
end;
procedure TMainForm.ExitButtonClick(Sender: TObject);
begin
close;
end;
procedure TMainForm.AboutButtonClick(Sender: TObject);
begin
AboutBox.show;
end;
procedure TMainForm.Timer1Timer(Sender: TObject);
var
i:integer;
begin
for i:=1 To 1000do
;
end;
end.
[培训]《安卓高级研修班(网课)》月薪三万计划，掌握调试、分析还原ollvm、vmp的方法，定制art虚拟机自动化脱壳的方法
