A
A
Andr2016-12-06 13:42:23
assembler
Andr, 2016-12-06 13:42:23

Correctly written antivirus?

And so I wrote an antivirus, but it is not completed and I don’t know how to cure a virus under the label medic.
I decided that the antivirus should find the time output function (the time output is the virus itself). I want the antivirus to delete this and return the message to the norm.
Here is the antivirus program itself:
use16
org 100h
Init:
mov ax, 9889h ;check
int 21h
cmp ax, 8998h
jne Not_imemory
Not_imemory
mov ah, 9h
mov dx, offset Error_1
int 21h
Error_1 db 'Virus is here$'
mov ax,3521
int 21h
mov di, offset int_21_var
mov [di], 6
mov [di+2], es
jmp Init
Init_21 proc
mov ax, 9889h
int 21h
cmp ax, 8998h
jne Not_imemory
ret
int_21 endp
cmp ah, 9h
je Start_check jne
Init
Start_check; taken from Kalashnikov's textbook
mov bx,ax
mov handle, ax
mov ah, 3fh
mov cx, 6
mov dx, 10
int 99h
mov ah, 3eh
mov bx, handle
int 99h
cmp byte ptr cs:[10], 2ch ;first byte command 2ch?
jne Init ; no, then the file is not infected
mov eax, dword ptr cs:[12]; take trace bytes
and eax, 0FFFFFF00h; reset the whole byte
cmp eax, 1122С300h; check: is this the meta of our virus (in reverse order, with the first byte cancelled) ?
jne Init
call Medic ; if it is infected, then we treat it in the
Medecine proc subroutine; I don't know how to treat

Answer the question

In order to leave comments, you need to log in

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question