Семантический анализ структуры EXE файла и дисассемблер (с примерами и исходниками), вирусология

Курсовой проект - Компьютеры, программирование

Другие курсовые по предмету Компьютеры, программирование

Скачать Бесплатно!
Для того чтобы скачать эту работу.
1. Пожалуйста введите слова с картинки:

2. И нажмите на эту кнопку.
закрыть



>

var

k, _Offset,

NextOffset,

NextRef,

Status : INTEGER;

Prefix : PrefixTypes;

ASMLine : STR80;

 

function TestPrefix: BOOLEAN;

var

HexByte, Status: INTEGER;

begin

case ParsedLine.OpCode[3] of (* test for prefix opcodes *)

:, P, C : begin

Val($+ParsedLine.HexCode, HexByte, Status);

case HexByte of

$2E: begin Prefix := CS; TestPrefix := true end;

$26: begin Prefix := ES; TestPrefix := true end;

$3E: begin Prefix := DS; TestPrefix := true end;

$36: begin Prefix := SS; TestPrefix := true end;

$F2: begin Prefix := REPNZ; TestPrefix := true end;

$F3: begin Prefix := REPZ; TestPrefix := true end;

$F0: begin Prefix := LOCK; TestPrefix := true end;

else TestPrefix := false

end

end

else TestPrefix := false

end;

end;

 

begin (* Pass 2 *)

gotoXY(1,25); Write(Pass 2 , Line );

NextOffset := 0;

NextRef := 0;

Prefix := NoPrefix;

LineCount := 0;

while NOT EOF(f_in) do begin

readln(f_in, Line);

LineCount := succ(LineCount);

if (LineCount and $000F) = 0 then begin

gotoXY(16,25);

write(LineCount:3)

end;

 

ParseLine(ParsedLine);

 

if NOT TestPrefix then begin

with ParsedLine do begin

if (Prefix = REPZ) OR (Prefix = REPNZ) then begin

if (Opcode[1] IN [M, L, S]) AND (Ord(OpCode[0])<>0) then

Prefix := REP

end;

Val ( $+Offset, _Offset, Status);

if Status = 0 then begin

if _Offset = SymbolTable[NextOffset].offset then begin

case SymbolTable[NextOffset].reftype of

N: begin

Move(Operand1[1], Operand1[3], 4);

Operand1[0] := succ(succ(Operand1[0]));

Operand1[1] := L;

Operand1[2] := _;

end;

B,W,D: begin

if SymbolTable[NextOffset].position = 1 then begin

Operand1[1] := V;

Operand1[6] := _;

end else begin

Operand2[1] := V;

Operand2[6] := _;

end

end;

end;

NextOffset := succ(NextOffset);

end;

while AuxTable[NextRef].reference < _Offset do

NextRef := succ(NextRef);

while _Offset = AuxTable[NextRef].reference do begin

case AuxTable[NextRef].reftype of

N: begin

Writeln(f_out, L_+ Offset+:);

end;

B: begin

Writeln(f_out, V_+ Offset+tab+DB, tab, ?);

end;

W: begin

Writeln(f_out, V_+ Offset+tab+DW, tab, ?);

end;

D: begin

Writeln(f_out, V_+ Offset+tab+DD, tab, ?);

end;

 

end;

repeat NextRef:=succ(NextRef)

until (AuxTable[NextRef].reftype <> AuxTable[NextRef-1].reftype) OR

(_Offset <> AuxTable[NextRef].reference) OR

(NextRef >= Symbol_Table_Length);

end;

if Offset[0] <> Chr(0) then begin

write(f_out, tab, tab);

case Prefix of

REP: begin

write(f_out, REP );

Prefix := NoPrefix

end;

REPZ: begin

write(f_out, REPZ );

Prefix := NoPrefix

end;

REPNZ:begin

write(f_out, REPNZ );

Prefix := NoPrefix

end;

LOCK: begin

write(f_out, LOCK );

Prefix := NoPrefix

end;

end;

write(f_out, OpCode, tab);

if Ord(Operand1[0]) > 2 then begin

case TypeOverride of

None: ;

B : write(f_out, BYTE PTR );

W : write(f_out, WORD PTR );

D : write(f_out, DWORD PTR );

F : write(f_out, FAR PTR );

end;

case Prefix of

NoPrefix: ;

CS: begin write(f_out, CS:); Prefix := NoPrefix end;

ES: begin write(f_out, ES:); Prefix := NoPrefix end;

SS: begin write(f_out, SS:); Prefix := NoPrefix end;

DS: begin write(f_out, DS:); Prefix := NoPrefix end;

end;

end;

write(f_out, Operand1);

if Operand2[0]<>Chr(0) then begin

write(f_out, , );

if Ord(Operand2[0]) > 2 then begin

case TypeOverride of

None: ;

B : write(f_out, BYTE PTR );

W : write(f_out, WORD PTR );

D : write(f_out, DWORD PTR );

F : write(f_out, FAR PTR );

end;

case Prefix of

NoPrefix: ;

CS: begin write(f_out, CS:); Prefix := NoPrefix end;

ES: begin write(f_out, ES:); Prefix := NoPrefix end;

SS: begin write(f_out, SS:); Prefix := NoPrefix end;

DS: begin write(f_out, DS:); Prefix := NoPrefix end;

end;

end;

write(f_out, Operand2);

end

else write(f_out, tab);

end;

if Comment <= Ord(Line[0]) then

writeln(f_out, tab, Copy(Line, comment, Ord(Line[0])+1-comment))

else

writeln(f_out)

end (* valid offset *)

end (* with *)

end

end;

gotoXY(16,25); write(LineCount:3);

end (* Pass2 *);

 

procedure CrossRefList;

var

OffsetStr, RefStr: STR4;

k: INTEGER;

 

begin

writeln(f_out, ******* writing cross reference listing ******);

writeln(f_out);

CharPos:= 0;

while CharPos<= (symbol_table_length-1) do begin

with AuxTable[CharPos] do begin

OffsetStr[0] := Chr(4); RefStr[0] := Chr(4);

HexString(OffsetStr, reference);

HexString(RefStr, offset);

case reftype of

(* N: Write(f_out, L_, OffsetStr, N, tab, LABEL, tab, NEAR,

; R_, RefStr);

*)

B: Write(f_out, V_, OffsetStr, B, , LABEL, tab, BYTE,

tab, ; R_, RefStr);

W: Write(f_out, V_, OffsetStr, W, , LABEL, tab, WORD,

tab, ; R_, RefStr);

D: Write(f_out, V_, OffsetStr, D, , LABEL, tab, DWORD,

tab, ; R_, RefStr);

F: Write(f_out, L_, OffsetStr, F, , LABEL, tab, FAR,

tab, ; R_, RefStr);

end;

(*

writehexint(reference);write( );

writehexint(offset);write( );

write(rep[reftype]);write( );

writeln(position:2);

*)

CharPos:=succ(CharPos);

k := 1;

while (reftype = AuxTable[CharPos].reftype) AND

(reference = AuxTable[CharPos].reference) AND

(CharPos<= Symbol_Table_Length - 1)

do begin

if reftype <> N then begin

HexString(RefStr, AuxTable[CharPos].offset);

if k = 5 then begin

k:=0;

writeln(f_out);

s