我在XueTr 中发现系统中断表中有十几个未知模块，不知是否是病毒 ，我导出了编码，求懂汇编的看看这段编码是做什么的
原始函数地址的编码
[XT][[Disasm]]: 40
地址 二进制 汇编
80540DB4 68 62000000 push 62
80540DB9 E9 E9050000 jmp 805413A7
80540DBE 68 63000000 push 63
80540DC3 E9 DF050000 jmp 805413A7
80540DC8 68 64000000 push 64
80540DCD E9 D5050000 jmp 805413A7
80540DD2 68 65000000 push 65
80540DD7 E9 CB050000 jmp 805413A7
80540DDC 68 66000000 push 66
80540DE1 E9 C1050000 jmp 805413A7
80540DE6 68 67000000 push 67
80540DEB E9 B7050000 jmp 805413A7
80540DF0 68 68000000 push 68
80540DF5 E9 AD050000 jmp 805413A7
80540DFA 68 69000000 push 69
80540DFF E9 A3050000 jmp 805413A7
80540E04 68 6A000000 push 6A
80540E09 E9 99050000 jmp 805413A7
80540E0E 68 6B000000 push 6B
80540E13 E9 8F050000 jmp 805413A7
80540E18 68 6C000000 push 6C
80540E1D E9 85050000 jmp 805413A7
80540E22 68 6D000000 push 6D
80540E27 E9 7B050000 jmp 805413A7
80540E2C 68 6E000000 push 6E
80540E31 E9 71050000 jmp 805413A7
80540E36 68 6F000000 push 6F
80540E3B E9 67050000 jmp 805413A7
80540E40 68 70000000 push 70
80540E45 E9 5D050000 jmp 805413A7
80540E4A 68 71000000 push 71
80540E4F E9 53050000 jmp 805413A7
80540E54 68 72000000 push 72
80540E59 E9 49050000 jmp 805413A7
80540E5E 68 73000000 push 73
80540E63 E9 3F050000 jmp 805413A7
80540E68 68 74000000 push 74
80540E6D E9 35050000 jmp 805413A7
80540E72 68 75000000 push 75
80540E77 E9 2B050000 jmp 805413A7
被替换后的当前函数地址的编码
[XT][[Disasm]]: 50
地址 二进制 汇编
8A5A8954 54 push esp
8A5A8955 55 push ebp
8A5A8956 53 push ebx
8A5A8957 56 push esi
8A5A8958 57 push edi
8A5A8959 83EC 54 sub esp, 54
8A5A895C 8BEC mov ebp, esp
8A5A895E 894424 44 mov dword ptr [esp+44], eax
8A5A8962 894C24 40 mov dword ptr [esp+40], ecx
8A5A8966 895424 3C mov dword ptr [esp+3C], edx
8A5A896A F74424 70 00000200 test dword ptr [esp+70], 20000
8A5A8972 0F85 2B010000 jne 8A5A8AA3
8A5A8978 66:837C24 6C 08 cmp word ptr [esp+6C], 0008
8A5A897E 74 23 je 8A5A89A3
8A5A8980 8C6424 50 mov dword ptr [esp+50], fs
8A5A8984 8C5C24 38 mov dword ptr [esp+38], ds
8A5A8988 8C4424 34 mov dword ptr [esp+34], es
8A5A898C 8C6C24 30 mov dword ptr [esp+30], gs
8A5A8990 BB 30000000 mov ebx, 30
8A5A8995 B8 23000000 mov eax, 23
8A5A899A 66:8EE3 mov fs, bx
8A5A899D 66:8ED8 mov ds, ax
8A5A89A0 66:8EC0 mov es, ax
8A5A89A3 64:8B1D 00000000 mov ebx, dword ptr fs:[0]
8A5A89AA 64:C705 00000000 FFFFFFFF mov dword ptr fs:[0], 0FFFFFFFF
8A5A89B5 895C24 4C mov dword ptr [esp+4C], ebx
8A5A89B9 81FC 00000100 cmp esp, 10000
8A5A89BF 0F82 B6000000 jc 8A5A8A7B
8A5A89C5 C74424 64 00000000 mov dword ptr [esp+64], 0
8A5A89CD FC cld
8A5A89CE 8B5D 60 mov ebx, dword ptr [ebp+60]
8A5A89D1 8B7D 68 mov edi, dword ptr [ebp+68]
8A5A89D4 8955 0C mov dword ptr [ebp+C], edx
8A5A89D7 C745 08 000DDBBA mov dword ptr [ebp+8], 0BADB0D00
8A5A89DE 895D 00 mov dword ptr [ebp], ebx
8A5A89E1 897D 04 mov dword ptr [ebp+4], edi
8A5A89E4 64:F605 50000000 FF test byte ptr fs:[50], 0FF
8A5A89EC 75 0D jne 8A5A89FB
8A5A89EE BF 18895A8A mov edi, 8A5A8918
8A5A89F3 E9 28CDF9F5 jmp 80545720
8A5A89F8 8D49 00 lea ecx, [ecx]
8A5A89FB F745 70 00000200 test dword ptr [ebp+70], 20000
8A5A8A02 75 09 jne 8A5A8A0D
8A5A8A04 F745 6C 01000000 test dword ptr [ebp+6C], 1
8A5A8A0B 74 E1 je 8A5A89EE
8A5A8A0D 0F21C3 mov ebx, dr0
8A5A8A10 0F21C9 mov ecx, dr1
8A5A8A13 0F21D7 mov edi, dr2
8A5A8A16 895D 18 mov dword ptr [ebp+18], ebx
8A5A8A19 894D 1C mov dword ptr [ebp+1C], ecx
 |
发表于 2013-1-28 18:40:56
楼主
