Results 1 to 4 of 4
  1. #1
    Vitrix Maggot
    Vitrix Maggot is offline
    Member-in-training Vitrix Maggot's Avatar
    Join Date
    2013 Apr
    Location
    Brasil
    Posts
    58
    Thanks
    0
    Thanked 43 Times in 24 Posts
    Rep Power
    0

    [AntiVirus Function]CheckForVirusSignature

    This function check if the signature of the virus, if you find delete or erase (always suggest that you delete the file) ... I hope you enjoy:

    //by Vitrix
    function CheckForVirusSignature(FileName : string;Sig : array of byte;DeleteVirus : Boolean) : boolean;
    //STRING FileName
    //Local do arquivo a ser checado
    //ARRAY OF BYTE Sig
    //Esta é a assinatura do vírus
    //BOOLEAN DeleteVirus
    //Se encontrar virus, deleta o arquivo, caso seja falso o programa NOPa a assinatura
    var
    hFile : THandle;
    szBuff : Byte;
    dwTemp : DWORD;
    dwSize : DWORD;
    i : DWORD;
    ii : DWORD;
    iii : DWORD;
    Count : DWORD;
    Label
    CleanUp;
    begin
    Result := false;
    hFile := CreateFileA(PChar(FileName), GENERIC_READ or GENERIC_WRITE, FILE_SHARE_READ or FILE_SHARE_WRITE, nil, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL); //Cria o arquivo
    if (hFile = INVALID_HANDLE_VALUE) then Goto CleanUp; //Em caso de erro
    dwSize := GetFileSize(hFile, nil); //Pega o tamanho do arquivo
    if (dwSize = INVALID_FILE_SIZE) then Goto CleanUp;
    for i := 0 to dwSize do begin //Loop para checar todos os bytes
    SetFilePointer(hFile, i, nil, 0);
    ReadFile(hFile, szBuff, 1, dwTemp, nil); //Lê o primeiro em i
    if ((szBuff = Sig[0]) and (i + sizeof(Sig) >= dwSize)) then begin //Se os primeiros bytes da assinatura forem iguais aos lidos e couber a assinatura
    for ii := 0 to sizeof(Sig) do begin
    SetFilePointer(hFile, i + ii, nil, 0);
    ReadFile(hFile, szBuff, 1, dwTemp, nil);
    if (szBuff = Sig[i]) then begin
    Inc(Count);
    end;
    end;
    if (Count = sizeof(Sig)) then begin
    //Achamos o virus!
    if (not DeleteVirus) then begin
    DeleteFile(FileName);
    end else begin
    for iii := 0 to sizeof(Sig) do begin
    SetFilePointer(hFile, i + iii, nil, 0);
    szBuff := $90; //NOP
    WriteFile(hFile, szBuff, 1, dwTemp, nil);
    end;
    end;
    end;
    end;
    end;
    return := true;
    CleanUp:
    CloseHandle(hFile);
    end;
    I admire most other programmers not paid any dick!!

    Admiro outros Programadores mais nao pago pau pra nenhum !!


    Skype: Vitor Monteiro

  2. #2
    robt
    robt is offline
    Guest
    Join Date
    2013 Jan
    Posts
    1
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0
    and where to get these signatures?
    what their format?

  3. #3
    Yumi
    Yumi is offline
    Guest
    Join Date
    2013 Dec
    Posts
    2
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0
    Cool to start.
    Thanks ...

    For those looking for something more advanced ....
    To create a median antivirus Should at least run the process in a sandbox and analyzing the functions of the software.

  4. #4
    samuelrizzo
    samuelrizzo is offline
    Guest
    Join Date
    2013 Jul
    Posts
    2
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0
    Get them in Olly Dbg. Format is Array of Byte

Similar Threads

  1. Which Antivirus/Internet Security Software do you use?
    By GhostRaid3r in forum Software & Hardware
    Replies: 23
    Last Post: 2014-06-30, 04:26 AM
  2. Help scan function
    By proseco91 in forum Forsaken World Bots, Hacks, Cheats
    Replies: 0
    Last Post: 2012-07-20, 03:38 PM
  3. [Hack] Console Function
    By Dwar in forum CrossFire Hack
    Replies: 2
    Last Post: 2011-03-14, 02:20 AM
Visitors found this page by searching for:
Nobody landed on this page from a search engine, yet!

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •