中断与计算机病毒 Interrupt and computer viruses

1.中断基本概念什么是中断？ 1 What is the basic concept of interrupt interrupt? 先打个比方。 The first analogy. 当一个经理正处理文件时，电话铃响了（中断请求），不得不在文件上做一个记号（返回地址），暂停工作，去接电话（中断），并指示“按第二方案办”（调中断服务程序），然后，再静下心来（恢复中断前状态），接着处理文件……。 When a manager is handling the file, the phone rang (interrupt request), had to make a mark in the document (return address), to suspend the work, pick up the phone (interrupt), and directed "by the second program to do" (tune interrupt service routine), then, and then stop (to resume previous state), then processing the file ... .... 计算机科学家观察了类似实例，“外师物化，内得心源”，借用了这些思想、处理方式和名称，研制了一系列中断服务程序及其调度系统。 Computer scientists observed a similar instance, "foreign teacher materialized, in the very heart source", to borrow these ideas, approaches and name, developed a series of interrupt service routine and scheduling system.

中断是CPU处理外部突发事件的一个重要技术。 CPU processing external interrupt is an important technical emergencies. 它能使CPU在运行过程中对外部事件发出的中断请求及时地进行处理，处理完成后又立即返回断点，继续进行CPU原来的工作。 It allows the CPU to run during the course of external events interrupt request issued in a timely manner for processing, processing is complete and then return immediately break, continue with the work of the original CPU. 引起中断的原因或者说发出中断请求的来源叫做中断源。 Cause of the interruption or the source of an interrupt request is called the interrupt source. 根据中断源的不同，可以把中断分为硬件中断和软件中断两大类，而硬件中断又可以分为外部中断和内部中断两类。 According to the different interrupt sources, interrupts can be divided into hardware interrupts and software interrupts two categories, and hardware interrupts can be divided into two types of external interrupts and internal interrupts.

外部中断一般是指由计算机外设发出的中断请求，如：键盘中断、打印机中断、定时器中断等。 External interrupt is usually issued by a computer peripheral interrupt request, such as: keyboard interrupt, printer interrupt, timer interrupts. 外部中断是可以屏蔽的中断，也就是说，利用中断控制器可以屏蔽这些外部设备的中断请求。 External interrupt is maskable interrupt, that is, the use of interrupt controller can be masked by the external device interrupt request.

内部中断是指因硬件出错（如突然掉电、奇偶校验错等）或运算出错（除数为零、运算溢出、单步中断等）所引起的中断。 Hardware interrupt is due to internal error (such as a sudden power failure, parity error, etc.) or operator error (division by zero, arithmetic overflow, single-step interrupt, etc.) caused by the interruption. 内部中断是不可屏蔽的中断。 Internal interrupt is not maskable interrupts.

软件中断其实并不是真正的中断，它们只是可被调用执行的一般程序。 Software interrupts are not really break, but they can be called the general procedure execution. 例如：ROM BIOS中的各种外部设备管理中断服务程序（键盘管理中断、显示器管理中断、打印机管理中断等，）以及DOS的系统功能调用（INT 21H）等都是软件中断。 For example: ROM BIOS for the external device management interrupt service routine (the keyboard interrupt management, display management interrupt, printer management interrupt, etc.), and DOS system function call (INT 21H) are all software interrupts. CPU为了处理并发的中断请求，规定了中断的优先权，中断优先权由高到低的顺序是： （1）除法错、溢出中断、软件中断（2）不可屏蔽中断（3）可屏蔽中断（4）单步中断。 In order to handle concurrent CPU interrupt request, provided the interrupt priority, interrupt descending order of priority: (1) the wrong division, overflow interrupts, software interrupts (2) Non-Maskable Interrupt (3) maskable interrupt ( 4) single-step interrupt.

2.中断与计算机病毒计算机操作系统是开放的，用户可以修改扩充操作系统，在计算机上实现新的功能。 2 interrupt and computer viruses computer operating system is open, the user can modify the expansion of the operating system on the computer realization of new features.
修改操作系统的主要方式之一是扩充中断功能。 Modify the operating system is one of the main ways to expand the interrupt capabilities. 计算机提供很多中断，合理合法地修改中断会给计算机增加非常有用的新功能。 Computer provides many interrupts, interrupt the reasonable and legitimate to modify the computer will increase very useful new features. 如INT 10H是屏幕显示中断，原只能显示西文，而在各种汉字系统中都可以通过修改INT 10H使计算机能够显示中文。 Such as INT 10H is a screen display interrupt, the former can only display Western, and Chinese characters in a variety of systems can be modified to INT 10H enables the computer to display Chinese. 另一方面，计算机病毒则篡改中断为其达到传染、激发等目的服务，与病毒有关的重要中断有： INT 08H和INT 1CH定时中断，每秒调用18.2次，有些病毒利用它们的记时判断激发条件。 On the other hand, tampering with computer viruses is to interrupt its transmission to inspire other purposes, an important break with the virus are: INT 08H and INT 1CH timer interrupt, called 18.2 times per second, some viruses use to stimulate their mind when the judge conditions. INT 09H键盘输入中断，病毒用于监视用户击键情况。 INT 09H keyboard interrupt, the virus used to monitor user keystrokes. INT 10H屏幕输入输出中断，一些病毒用于在屏幕上显示字符图形表现自己。 INT 10H interrupt input and output screen, a number of viruses for the character on screen graphics to express themselves. INT 13H磁盘输入输出中断，引导型病毒用于传染病毒和格式化磁盘。 Input and output interrupt INT 13H disk, boot virus for transmission of the virus and formatting the disk. INT 21H DOS功能调用，包含了DOS的大部分功能，已发现的绝大多数文件型病毒修改INT 21H中断，因此也成为防病毒的重点监视部位。 INT 21H DOS function calls, most of the features include DOS, the vast majority have been found to modify the file INT 21H interrupt virus, anti-virus and therefore become the focus of monitoring sites. INT 24H DOS的严重错误处理中断，文件型病毒常进行修改，以防止传染写保护磁盘时被发现。 INT 24H DOS interrupt a serious error handling, file virus often be modified to prevent the transmission of write-protected disk was found.

中断子程序的入口地址存放在计算机内存的最低端，病毒窃取和修改中断的人口地址获得中断的控制权，在中断服务过程中插入病毒的“私货”。 Interrupt subroutine entry address is stored in the memory of most low-end computer virus to steal and modify the interrupt receive interrupt address population control, the interrupt service routine into the virus's "motives."

总之，中断可以被用户程序所修改，从而使得中断服务程序被用户指定的程序所替代。 In short, the interrupt can be modified by the user program, which allows the interrupt service routine is replaced by the procedures specified by the user. 这样虽然大大地方便了用户，但也给计算机病毒制造者以可乘之机。 Although this greatly facilitates the user, but also to the computer virus writers an opportunity to exploit. 病毒正是通过修改中断以使该中断指向病毒自身来进行发作和传染的。 It is by modifying the virus so that the break point to break its own to carry out attacks and virus infection.