Создание антивирусного программного обеспечения с применением языка программирования низкого уровня: Методические указания по выполнению лабораторных работ по курсу «Информационная безопасность», страница 12

            pop   ebp

            jmp   dword ptr [eax]

@@OpFile:

            pushad

            mov   edi, [FileNameBuf]

            mov   al, [@@Drive]

            cmp   al,0FFh

            jz    @@NoDrive

            add   al, 40h

            mov   ah, ':'

            mov   [edi], ax

            inc   edi

            inc   edi

@@NoDrive:

            mov   eax, [@@PioReq]

            mov   eax, [eax + 0Ch]

            add   eax, 4

            VxDCall UniToBCSPath, <edi, eax, 100, 0>

            mov   byte ptr [edi + eax], 0

            cmp   dword ptr [edi + eax - 4],"TXT."

            jnz   @@1

            ;Here, read file and check it for a "virus"

            mov   eax, [@@PioReq]

            cmp   word ptr [eax + 018h], ACTION_OPENEXISTING

            ;check is made only when we're opening existing file

            jnz   @@1

            inc   [MyReq]

            ;open this file and check it

            mov   eax, R0_OPENCREATFILE

            xor   ecx, ecx

            mov   edx, 1

            mov   ebx, 2

            mov   esi, [FileNameBuf]

            VxDCall IFSMgr_Ring0_FileIO

            jc    @@E1  ;error

            mov   ebx, eax

            ;ebx = handle

            ;Read file into buffer

            mov   eax, R0_READFILE

            mov   ecx, 8000h

            xor   edx, edx

            mov   esi, [FileBuf]

            mov   dword ptr [esi], 0

            VxDCall IFSMgr_Ring0_FileIO

            ;Check for a virus...

            ;Here you can insert anything you want checking

            ;data into [FileBuf] for a virus...

            mov   edi, OFFSET32 VirusTxt

            xor   ecx, ecx

@@t1:

            mov   al, [edi + ecx]

            test  al, al

            jz    @@VirusFound

            cmp   al, [esi + ecx]

            jnz   @@E2; Not a virus

            inc   ecx

            jmp   @@t1

@@VirusFound:

            ;Close file

            mov   eax, R0_CLOSEFILE

            VxDCall IFSMgr_Ring0_FileIO

            ;Optional - show message for a user

            dec   [MyReq]

            VMMCall Get_Sys_VM_Handle

            xor   eax, eax

            mov   ecx, [FileNameBuf]

            mov   edi, OFFSET32 VirusFoundTxt

            VxDCall SHELL_SYSMODAL_Message

            ;Deny access

            mov   eax, [@@PioReq]

            mov   word ptr [eax + 01Ah], 5h

            popad

            mov   eax, 1

            pop   ebp

            ret

@@E2:

            ;Close file

            mov   eax, R0_CLOSEFILE

            VxDCall IFSMgr_Ring0_FileIO

@@E1:

            dec   [MyReq]

@@1:

            popad

            jmp   @@def

EndProc     FileSysApiHook

BeginProc   OnSysInit

            ;This is called when WMM loads my VxD

            VMMCall _HeapAllocate, <65536, HEAPZEROINIT>

            mov   [Buf1], eax

            mov   [FileNameBuf], eax

            add   eax, 200h

            mov   [FileBuf], eax

            VxDCall IFSMgr_InstallFileSystemApiHook, <OFFSET32 FileSysApiHook>

            mov   [pOldFSHook], eax

            VMMCall Get_Sys_VM_Handle

            xor   eax, eax

            mov   ecx, OFFSET32 HelloTxt

            xor   edi, edi

            xor   esi, esi

            VxDCall SHELL_Message

            xor   eax,eax

            ret

EndProc     OnSysInit

;-- OnSysExit

BeginProc   OnSysExit

            ;This is called before WMM unloads my VxD

            VxDCall IFSMgr_RemoveFileSystemApiHook, <OFFSET32 FileSysApiHook>

            VMMCall _HeapFree, <[Buf1], 0>

            xor   eax,eax

            ret

EndProc     OnSysExit

;-- OnDeviceIoControl

BeginProc   OnDeviceIoControl

            cmp   [esi + DIOCParams.dwIoControlCode],DIOC_Open

            jne   short @@m1

            xor   eax,eax

            ret

@@m1:

            mov   eax,1

            stc

            ret

EndProc     OnDeviceIoControl

VxD_LOCKED_CODE_ENDS

            End