Семантический анализ структуры EXE файла и дисассемблер (с примерами и исходниками), вирусология

Курсовой проект - Компьютеры, программирование

Другие курсовые по предмету Компьютеры, программирование

Скачать Бесплатно!
Для того чтобы скачать эту работу.
1. Пожалуйста введите слова с картинки:

2. И нажмите на эту кнопку.
закрыть



Hex: ARRAY [0 .. 15] OF CHAR = 0123456789ABCDEF;

var

i: integer;

begin

for i:= 1 downto 0 do

write(Hex[((B shr (i shl 2)) and $000F)])

end;

procedure WritelnHex(B: byte);

begin

WriteHex(B);

writeln

end;

procedure WriteHexInt(N: integer);

begin

WriteHex(N shr 8);

WriteHex(N and $00FF)

end;

procedure WritelnHexInt(N: integer);

begin

WriteHex(N shr 8);

WritelnHex(N and $00FF)

end;

procedure WriteAddress(N, M: integer);

begin

WriteHexInt(N);

Write(:);

WriteHexInt(M)

end;

procedure HexString(var Str; N: INTEGER);

const

Hex: ARRAY [0 .. 15] OF CHAR = 0123456789ABCDEF;

var

i: byte;

begin

for i:= 0 to Mem[Seg(Str):Ofs(Str)] - 1 do

Mem[Seg(Str):(Ofs(Str)+Mem[Seg(Str):Ofs(Str)]-i)] :=

Ord(Hex[((N shr (i shl 2)) and $000F)])

end;

 

procedure WriteDouble(High, Low: INTEGER);

type

LongInt = ARRAY [0..3] OF BYTE;

const

Divisors : ARRAY [0..9] OF LongInt = ( ( 0, 0, 0, 1),

( 0, 0, 0, $A),

( 0, 0, 0, $64),

( 0, 0, 3, $E8),

( 0, 0, $27, $10),

( 0, 1, $86, $A0),

( 0, $F, $42, $40),

( 0, $98, $96, $80),

( 5, $F5, $E1, 0),

($3B, $9A, $CA, 0) );

var

i, j : INTEGER;

CharOffset,

Digit : BYTE;

Rep : ARRAY [0..9] OF CHAR;

Number : LongInt absolute Low;

OldNumber : LongInt;

stop : BOOLEAN;

begin

CharOffset := Ord( );

OldNumber := Number;

Rep := ;

for i:=9 downto 0 do begin

Digit := 0;

Number := OldNumber;

stop := false;

repeat

(* subtract Divisor from TestNumber *)

for j:=0 to 3 do begin

Number[j] := Number[j] - Divisors[i][3-j];

if (Number[j] > OldNumber[j]) AND (j<>3) then

Number[j+1] := number[j+1] - 1;

end;

if (Number[3] <= OldNumber[3]) then begin

Digit := succ(Digit);

CharOffset := Ord(0);

OldNumber := Number

end

else stop := true;

until stop;

Rep[9-i] := Chr(CharOffset+Digit);

end;

Write(Rep)

end;

 

procedure ComOut(var par);

const

WriteCommand = 1;

var

regs: RECORD

AX, BX, CX, DX, BP, SI, DI, DS, ES, Flags: INTEGER

END;

B : BYTE absolute par;

begin

with Regs do begin

AX := (WriteCommand shl 8) + B;

DX := 0;

Intr($14, Regs);

end

end;

 

 

procedure BlockRead (var f: file; var buffer; var n: integer);

const

readfunction = $3F;

 

var

regs: RECORD

AX, BX, CX, DX, BP, SI, DI, DS, ES, Flags: INTEGER

END;

 

begin

with Regs do begin

AX := (readfunction shl 8);

BX := MemW[Seg(f):Ofs(f)];

CX := n;

DX := Ofs(buffer);

DS := Seg(buffer);

Intr($21, Regs);

if (Flags and $0001) = 1 then begin

write(I/O Error );

writeHex(AX shr 8);

writeln ( during BlockRead);

end

else

n := AX

end;

end;

 

function FileSize (var f: file): INTEGER;

const

seekfunction = $42;

from_begin = 0;

from_current = 1;

from_end = 2;

 

var

regs: RECORD

AX, BX, CX, DX, BP, SI, DI, DS, ES, Flags: INTEGER

END;

CurrentFilePointer_low,

CurrentFilePointer_high : INTEGER;

 

begin

with Regs do begin

AX := (seekfunction shl 8) + from_current;

BX := MemW[Seg(f):Ofs(f)]; (* handle ! *)

CX := 0; (* offset-high *)

DX := 0; (* offset-low *)

Intr($21, Regs);

if (Flags and $0001) = 1 then begin

write(I/O Error );

writeHex(AX shr 8);

writeln ( during FileSize);

end;

CurrentFilePointer_low := AX;

CurrentFilePointer_high := DX;

(* determine file size *)

AX := (seekfunction shl 8) + from_end;

BX := MemW[Seg(f):Ofs(f)]; (* handle ! *)

CX := 0; (* offset-high *)

DX := 0; (* offset-low *)

Intr($21, Regs);

if (Flags and $0001) = 1 then begin

write(I/O Error );

writeHex(AX shr 8);

writeln ( during FileSize);

end;

FileSize := AX;

(* restore FilePointer *)

AX := (seekfunction shl 8) + from_begin;

BX := MemW[Seg(f):Ofs(f)]; (* handle ! *)

CX := CurrentFilePointer_high;

DX := CurrentFilePointer_low;

Intr($21, Regs);

if (Flags and $0001) = 1 then begin

write(I/O Error );

writeHex(AX shr 8);

writeln ( during FileSize);

end;

end

end;

 

 

procedure BlockWrite (var f: file; var b; var n: integer);

const

writefunction = $40;

 

var

regs: RECORD

AX, BX, CX, DX, BP, SI, DI, DS, ES, Flags: INTEGER

END;

 

begin

with Regs do begin

AX := (writefunction shl 8);

BX := MemW[Seg(f):Ofs(f)];

CX := n;

DX := Ofs(b);

DS := Seg(b);

Intr($21, Regs);

if (Flags and $0001) = 1 then begin

write(I/O Error );

writeHex(AX shr 8);

writeln ( during BlockWrite);

end

end;

end;

 

procedure Open(var f: file; VAR Name);

const

OpenFunction = $3D;

OpenMode = 128; (* read only *)

 

var

FName: STRING [255] ABSOLUTE Name;

regs: RECORD

AX, BX, CX, DX, BP, SI, DI, DS, ES, Flags: INTEGER

END;

 

begin

FName := FName + chr (0);

with Regs do begin

AX := (OpenFunction shl 8) + OpenMode;

DX := Ofs (FName) + 1;

DS := Seg (FName);

Intr($21, Regs);

MemW [Seg (f) : Ofs (f)] := AX;

if (Flags and $0001) = 1 then begin

write(I/O Error );

writeHex(AX shr 8);

writeln ( during Reset);

end

end

end;

 

----------- start of source ---- CUT HERE FOR DEB2ASM.PAS -------------

 

const

blank = ;

tab = #9;

comma = ,;

colon = :;

semicolon = ;;

 

type

STR4 = STRING[4];

STR5 = STRING[5];

STR6 = STRING[6];

STR12 = STRING[12];

STR18 = STRING[18];

STR80 = STRING[80];

ReferenceTypes = (None, B, W, D, N, F);

ParseTypes = RECORD

Offset : STR4;

HexCode : STR12;

OpCode : STR6;

Operand1,

Operand2 : STR12;

Comment : BYTE; (* position where comment starts *)

TypeOverride : ReferenceTypes

END;

 

var

f_in, f_out : text[$2000];

Line : STR80;

LineCount,

CharPos : INTEGER;

FileName : STR80;

FileExt : BOOLEAN;

Rep : ARRAY [ReferenceTypes] OF STR5;

ParsedLine : ParseTypes;

 

\io.inc*)">(*$I \io.inc *)

\sort.box*)">(*$I \sort.box *)

 

const

SymbolTableSize = 2000;

 

type

TableEntry = RECORD

offset,

reference : INTEGER;

reftype : ReferenceTypes;

position : BYTE

END;

 

 

var

SymbolTable,

AuxTable : ARRAY [0 .. SymbolTableSize] OF TableEntry;

 

Current_SymbolTable_Index,

Symbol_Table_Length,

SortInpu

s