00000c90h：0A 73 53 41 2E 65 78 30 5C 5C 31 39 32 2E 31 36 sSA.ex0\\192.16 00000ca0h：38 2E 30 B0 64 21 73 05 3C 83 98 1B 76 5B 36 8B 8.0癲!s<儤v[6?
如果你用过ca的话，应该知道这个就是ca帮助里面的内容了，如下 C:\>ca Shadow Administrator, by netXeyes 2002/04/28 Written by netXeyes 2002, dansnow@21cn.com
Usage: SA \\IP Account Password CloneAccount ClonePassword
Account: Username (Own Administrator Privilege) Password: Password of User CloneAccount: CloneUser's Account Name (Must Already Exsited) ClonePassword: Set Password of CloneUser
Examples: ========= SA.exe \\192.168.0.16 Administrator Password IUSR_VICTIM SetNewPass
Clone Privillege of Administrator to IUSR_VICTIM, And Set IUSR_VICTIM Password to "SetNewPass"
相信这个代码在别软件出现几率应该是很底的吧，当然你也可以选其他的作为特征码。这里我就用这个了。
从上面我们可以知道： 文件偏移地址0x0c90 提取特征码长度：0x20(32) 特征码内容：0A 73 53 41 2E 65 78 30 5C 5C 31 39 32 2E 31 36 38 2E 30 B0 64 21 73 05 3C 83 98 1B 76 5B 36 8B
我们现在就可以用程序来实现代码的比较了，以下就是写好的程序：
#include
i=scanvir("c:\\CA.exe",0x0c90,0x20,vir); //调用查毒函数
if(i==1) printf("警告!发现病毒。\n"); if(i==0) printf("没有发现病毒。\n"); } bool scanvir(const char *file,long offset, int length, void *vir) { FILE *fp = NULL; int a=0; char rvir[255]={0}; bool b=false; fp=fopen(file,"rb"); //以2进制打开指定文件 if(NULL==fp) {goto novir;} fseek(fp,offset,SEEK_SET); //把文件指针指向偏移地址 fread(rvir,length,1,fp); //读取length长度的代码 a=memcmp(vir,rvir,length); //与我们提取的代码比较，返回值放到a中 if(a==0) { b=true; } novir:if(fp){ fclose(fp); fp=NULL; } return b; }
是不是很简单呢，如果我们再加上其他功能，比如遍历所有文件查找病毒，清除病毒并清楚病毒留下的东西，是不是就成为了专杀软件了。
#include
bool scanvir(const char *filename,long offset,int length,void *vir); int viewfiles(char *directory,long offset,int length,void *vir);
void main(void) { unsigned char vir[]= {0x4A,0x75,0x6D,0x55,0x70,0x85,0x0B,0x73,0x4E,0x85,0x02,0x54,0x69,0x9A,0x07,0xD0, 0xA1,0x4A,0x6F,0x00,0x62,0x61,0x6B,0x61,0x33,0x00,0x53,0x4F,0x0B,0x46,0x54,0x57, 0x41,0x55,0x11,0x5C,0x6A,0x9C,0x29,0x5C,0xE3,0x97,0x5C,0x0F,0x7F,0x20,0xF0,0xB6}; char directory[MAX_PATH]; int count; printf(" ============================================\n"); printf(" 震荡波病毒查找工具 \n"); printf(" www.chinahackers.cn.st\n" ); printf(" ============================================\n"); printf("\n"); printf("请输入待检查分区或目录名\n"); printf("提醒:分区后要加':',目录路径要输入完整\n"); printf("请输入："); gets(directory); printf("查找病毒开始，请耐心等待......\n"); count=viewfiles(directory,0x32A0,0x30,vir); if(count>0) printf("这次检查共在目录里面发现%d个病毒.\n",count); else printf("%s中安全，未发现病毒.\n",directory); getch(); }
bool scanvir(const char *filename,long offset,int length,void *vir) { FILE *fp; char *rvir; bool b=false;
fp=fopen(filename,"rb"); if(fp!=NULL) { fseek(fp,0,SEEK_END); if(offset+length<=ftell(fp)) { fseek(fp,offset,SEEK_SET); rvir=new char[length]; fread(rvir,length,1,fp); b=memcmp(vir,rvir,length)==0; delete[] rvir; } fclose(fp); } return b; } int viewfiles(char *directory,long offset,int length,void *vir) { WIN32_FIND_DATA fdFindData; HANDLE hFind; char *filename; int count=0; BOOL done;
filename=new char[strlen(directory)+5]; strcpy(filename,directory); strcat(filename,"\\*.*"); hFind=FindFirstFile(filename,&fdFindData); delete[] filename; done=hFind!=INVALID_HANDLE_VALUE; while(done) { if(strcmp(fdFindData.cFileName,".") && strcmp(fdFindData.cFileName,"..")) { filename=new char[strlen(directory)+strlen(fdFindData.cFileName)+2]; strcpy(filename,directory); strcat(filename,"\\"); strcat(filename,fdFindData.cFileName); if((fdFindData.dwFileAttributes&FILE_ATTRIBUTE_DIRECTORY)==FILE_ATTRIBUTE_DIRECTORY) count+=viewfiles(filename,offset,length,vir); else if(scanvir(filename,offset,length,vir)) { count++; printf("警告!发现病毒。病毒路径%s\n",filename); } delete[] filename; } done=FindNextFile(hFind,&fdFindData); } FindClose(hFind); return(count); }
