[转载]29a编制的W32/W64.Shrug病毒源代码

信息来源：29a

some of its features:
- parasitic direct action infector of PE exe/dll (but not looking at suffix)
- infects files in current directory and all subdirectories
- infects both IA32 and AMD64 files
- directory traversal is linked-list instead of recursive to reduce stack size
- reloc section inserter/last section appender
- EPO (TLS infection)
- code executes after ExitProcess() is called
- uses CRCs instead of API names
- uses SEH for common code exit
- no infect files with data outside of image (eg self-extractors)
- no infect files protected by SFC (including under Windows XP/2003)
- infected files are padded by random amounts to confuse tail scanners
- uses SEH walker to find kernel address (no hard-coded addresses)
- correct file checksum without using imagehlp.dll :) 100% correct algorithm
---

　optimisation tip: Windows appends ".dll" automatically, so this works:
　　　　push "cfs"
　　　　push esp
　　　　call LoadLibraryA
---

to build this thing:
tasm
----
tasm32 /ml /m3 shrug
tlink32 /B:400000 /x shrug,,,import32

1. build shrug.asm in link_only mode
2. run it to retrieve code size
3. define code size here
4. build shrug64.asm
5. run it to create shrug64.dmp
6. build shrug.asm in not link_only mode

Virus is not self-modifying, so no need to alter section attributes
---

We"re in the middle of a phase transition:
a butterfly flapping its wings at
just the right moment could
cause a storm to happen.
-I"m trying to understand-
I"m at a moment in my life-
I don"t know where to flap my wings.
(Danny Hillis)

(;