计算机病毒的磁盘存储结构 Computer viruses, disk storage structure

对于计算机病毒的存储结构来说，不同类型的病毒，在磁盘上的存储结构是不同的。 For the storage structure for computer viruses, different types of virus, disk storage structure is different. 1.磁盘空间的总体划分经过格式化后的磁盘包括：主引导记录区（只有硬盘有）、引导记录区、文件分配表（FAT）、目录区和数据区。 1 The overall division of disk space after formatting the disk include: master boot record area (only hard disk), boot record area, the file allocation table (FAT), directory area and data area.
主引导记录区和引导记录区中存有DOS系统启动时所用的信息。 Master boot record area and there is DOS Boot Record area in the system startup information used. 文件分配表（FAT）是反映当前磁盘扇区使用状况的表。 File Allocation Table (FAT) is used to reflect the current status of the disk sector table. 每张DOS盘含有两个完全相同的FAT表，即FAT1和FAT2，FAT2是一张备份表。 Each disk contains two identical DOS FAT table, which FAT1 and FAT2, FAT2 is a backup of the table. FAT与目录一起对磁盘数据区进行管理。 Along with FAT and directory data to the disk area management. 目录区存放磁盘上现有的文件目录及其大小、存放时间等信息。 Directory on the disk storage area existing file directory and its size, storage time and other information.
数据区存储和文件名相对应的文件内容数据。 Storage and file name data area corresponding to the contents of the file data. （1）软盘空间的总体划分当使用DOS的外部命令FORMAT格式化一张软盘后，不仅把磁盘划分为若干磁道，每一磁道划分为若干扇区，而且同时把划分的扇区分为五大区域，它们分别是引导记录区、文件分配表1、文件分配表2、根目录区以及数据区。 (1) the overall space floppy disk into the external command when using DOS FORMAT to format a floppy disk, not only the disk is divided into several tracks, each track is divided into several sectors, but also to divide the sector into five regions, They are the boot record area, a file allocation table, file allocation table 2, the root directory area and data area.

对于软盘只有一个引导区，引导区在磁盘的0面0道1扇区，它的作用是在系统启动时负责把系统两个隐含文件IO.SYS和MSDOS.SYS装入内存，并提供DOS进行磁盘读写所必需的磁盘I/O参数表。 For only a boot floppy, boot sector on the disk surface 0 sector 1, its role is in charge of the system when the system starts two hidden files IO.SYS and MSDOS.SYS into memory, and provide the DOS required for disk read and write disk I / O parameter table.
文件分配表（FAT表）是反映磁盘上所有文件各自占用的扇区的一个登记表，此表非常重要，一旦被破坏，将无法查找文件的内容。 File Allocation Table (FAT tables) to reflect all the files on the disk sectors occupied by each of a registration form, this table is very important, once destroyed, can not find the file. 即使对DOS内部精通的人，要修复FAT表损坏的磁盘文件，亦非易事，开销很大。 Even within the DOS master who, to repair a damaged disk file FAT table is also easy, expensive. 为此系统在划分磁盘区域时，保留了两份完全相同的文件分配表。 This system into the disk area, retained the two identical file allocation table.
根目录区是记载磁盘上所有文件的一张目录登记表。 Root zone is recorded in a disk directory of all files on the registration form. 主要记载每个文件的文件名、扩展名、文件属性、文件长度、文件建立日期、建立时间以及其他一些重要信息。 Contains, each file name, extension, file attributes, file size, file creation date, setup time and other important information.
（2）硬盘空间的总体划分对于不同类型、不同介质的磁盘，DOS划分磁盘的格式是不同的。 (2) the overall hard disk space into different types, different media disk, DOS disk into a different format. 对于硬盘来说，由于其存储空间比较大，为了允许多个操作系统分享硬盘空间，并希望能从磁盘启动系统，DOS在格式化硬盘时，把硬盘划分为主引导记录区和多个系统分区。 For the hard drive, because of its relatively large storage space, in order to allow multiple operating systems to share hard disk space, and it would be to start the system disk, DOS formatted hard disk, the hard disk into the master boot record partition area and multiple systems .

对于硬盘空间的分配由两个部分组成：第一部分就是整个硬盘的第一扇区，这一扇区称之为硬盘的主引导程序扇区，它由两部分内容组成，一是主引导程序，二是分区信息表。 For hard disk space allocation consists of two parts: the first part is the first sector of the hard disk, the hard disk master boot sector program called sectors, which is composed of two parts, first the master boot program, Second, the partition table.
主引导程序是硬盘启动时首先执行的程序，由它装入执行活动分区（活动分区）引导程序， 从而进一步引导系统。 Hard disk master boot program is executed when the program first, into the implementation of activities by its partition (active partition) boot process to further guide the system. 分区信息表登记各个分区引导指示符、操作系统指示符以及该分区占用硬盘空间的位置及其长度；第二部分是各个系统分区。 Registration of each partition table, partition boot indicator, indicator, and the operating system partition disk space occupied by the location and length; the second part of each system partition. 各个系统分区是提供给各操作系统使用的区域，每一区域只能存放一种操作系统，在该区域中的系统具有自己的引导记录、文件分配表区、文件目录区以及数据区。 Each system partition is available to the operating system area, each region can only store an operating system, the system in the region has its own boot record, file allocation table area, the file directory area and data area. 若整个硬盘归DOS使用，硬盘上信息由5部分即第1扇区的主引导程序和分区信息表、分区引导程序、文件分配表区、文件根目录区、文件数据区。 If you return the entire hard drive using DOS on the hard disk information from the 5 part of the first sector of the master boot program and partition table, partition boot program, the file allocation table area, the document root zone file data area.

硬盘主引导扇区很特殊，它不在DOS的管辖范围内。 Hard disk master boot sector is very special, it is not within the jurisdiction of the DOS. 所以用DOS的非常驻命令FORMAT、FDISK、DEBUG都不能触及它。 Therefore, the use of non-resident DOS command FORMAT, FDISK, DEBUG can not touch it. 当该扇区损坏时，硬盘不能启动。 When the sector is damaged, the hard disk can not be started.
用FORMAT、FDISK都不能修复它。 Use FORMAT, FDISK can not fix it. DEBUG的L命令和W命令都不能用于主引导扇区。 W L-DEBUG command and the command can not be used for the main boot sector. 只有在DEBUG下借用INT 13H或低级格式化方能修复。 DEBUG borrow only under low-level format can only INT 13H or repair.
2.系统型病毒的磁盘存储结构系统型病毒是指专门传染操作系统的启动扇区，主要指传染硬盘主引导扇区和DOS引导扇区的病毒。 (2) disk storage system virus structural system is a special type of virus infection of the operating system boot sector, mainly referring to infect the hard disk master boot sector and DOS boot sector virus. 系统型病毒在磁盘上的存储结构是这样的，病毒程序被划分为两部分， 第一部分存放在磁盘引导扇区中，第二部分则存放在磁盘其他的扇区中。 Virus system on the disk storage structure is like this, the virus program is divided into two parts, the first stored in the disk boot sector, the second part of the disk is stored in other sectors. 病毒程序在感染一个磁盘时，首先根据FAT表在磁盘上找到一个空白簇（如果病毒程序的第二部分占用若干个簇，则需要找到一个连续的空白簇），然后将病毒程序的第二部分以及磁盘原引导扇区的内容写入该空白簇，接着将病毒程序的第一部分写入磁盘引导扇区。 Infected with a virus program on disk, the first under the FAT table to find a gap in the disk cluster (if the virus program's second part of the occupation number of clusters, you need to find a row of empty clusters), then the second part of the virus and the contents of the disk of the original boot sector written to the empty cluster, then the first part of the virus program written to the disk boot sector. 但是，由于磁盘不同，病毒程序第二部分所占用的空白簇的位置就不同，而病毒程序在侵入系统时，又必须将其全部程序装入内存，在系统启动时道德装入的是磁盘引导扇区中的病毒程序，该段程序在执行时要将其第二部分装入内存，这样第一部分必须知道其第二部分所在簇的簇号或逻辑扇区号。 However, due to a different disk, the virus program second part of the space occupied by the location of clusters is different, and when the virus program into the system, and all procedures must be loaded into memory at boot time into the disk guide moral sector of the virus program, the section of the program's execution to the second part is loaded into memory, so you must know the first part of the second part of the cluster where the cluster number or logical sector numbers. 为此，在病毒程序感染一个磁盘时，不仅要将其第一部分写入磁盘引导扇区，而且必须将病毒程序第二部分所在簇的簇号（或该簇第一扇区的逻辑扇区号）记录在磁盘的偏移地址01F9处，存放其第二部分所在簇第一扇区的逻辑扇区号。 To this end, a disk in the virus infection, not only to write the first part of the disk boot sector virus program and must be where the second part of the cluster of cluster number (or the first sector of the cluster the logical sector number) recorded in the disk at offset 01F9, storage clusters where the second part of the first sector of the logical sector number.
另外，由于DOS分配磁盘空间时，必须将分配的每一簇与一个文件相联系，但是，系统型病毒程序第二部分所占用的簇没有对应的文件名，它们是以直接磁盘读写的方式被存取的，这样它们所占用的簇就有可能被DOS分配给新建立的磁盘文件，从而被覆盖。 In addition, because DOS distribution disk space must be allocated to each cluster associated with a file, but the second part of the system virus program no corresponding cluster occupied by file name, which is the way to read and write directly to disk be accessed, so that they occupied cluster is likely to be assigned to the newly created DOS disk files to be overwritten. 为了避免这样的情况发生，病毒程序在将其第二部分写入空白簇后，立即将这些簇在FAT中登记项的内容，强制地标记为坏簇（FF7H），经过这样处理后，DOS就不会将这些簇分配给其他新建立的文件。 To avoid such a situation occurs, the virus program will write the second part of the cluster blank immediately after the registration of these clusters in the FAT entry of the content, force marked as bad clusters (FF7H), after such treatment, DOS will These clusters will not be allocated to other newly created file. 3.文件型病毒的磁盘存储结构文件型病毒是指专门感染系统中的可执行文件，即扩展名为.COM、.EXE的文件。 3 file virus disk storage structure is a special file type virus infected system, the executable file that extension. COM,. EXE files. 对于文件型的病毒来说，病毒程序附着在被感染文件的首部、尾部、中部或“空闲”部位，病毒程序没有独立占用磁盘上的空白簇。 For the file-type virus, the virus infected file attached to the first, tail, middle, or "idle" position, the virus program does not take up disk space independent of the cluster. 也就是说，病毒程序所占用的磁盘空间依赖于其宿主程序所占用的磁盘空间。 In other words, virus programs take up more disk space depends on its host program take up more disk space. 但是，病毒入侵后一定会使宿主程序占用的磁盘空间增加。 However, the virus will host the program after a certain amount of disk space to increase.
绝大多数文件型病毒属于所谓外壳病毒，什么是文件外壳呢？ Most file viruses belong to the so-called shell virus, what is the file shell it? 简单地说是计算机软件的一种层次结构。 Simply put, a computer software hierarchy. 比方说计算机软件公司编制了一种教育软件，经过设计调试，软件本身的功能已经很完善，可以作为独立的磁盘文件提供给用户。 For example, computer software, developed an educational software company, through the design and debugging, the software itself functions have been perfect, can be provided as a separate disk file to the user. 但为了提高产品的商品化程序，公司决定为软件加一个漂亮的封面，为此设计人员可以在已经完成的软件基础上附加一段显示封面的程序。 However, in order to improve the commercialization of the product program, the company decided to software plus a beautiful cover, this designer has completed the software can be added based on the program cover a show. 通常我们称软件本身为内核，而附加的显示封面程序称为外壳，加载运行关系。 Usually we call the kernel software itself, and the display cover additional program called the shell, load the operating relationship.

尽管在结构上外壳接在内核后面，但运行的顺序仍然是先显示封面再跳转去执行内核。 While connected to the core shell structure on the back, but the order is still running the show first and then jump to cover the implementation of the kernel. 可执行文件的外壳一般具有相对独立的功能和结构，去掉外壳将不会影响内核部分的运行。 Executable shell tended to have relatively independent of the function and structure, remove the shell will not affect the core part of the run. 如果我们用“病毒外壳”去替换图中的“封面外壳”，那么就已经说明了文件型病毒的基本机理。 If we use "virus shell" to replace the figure "cover shell", then file virus has indicated that the basic mechanism.
计算机病毒一般不传染数据文件，这是由于数据文件是不能执行的，如果病毒传染了数据文件以后，病毒自身得不到执行权，也就不能进行进一步的传播，所以计算机病毒不可能存在于数据文件中，但可能修改和破坏数据文件。 Computer viruses generally do not infect data files, this is because the data files can not be executed, if the data file after the virus infection, the virus's own lack of executive power, it can not spread further, so computer viruses can not exist in the data file, but may modify and destroy data files.