瑞星卡卡安全论坛

The Obfuscated Trick of Whale
      pop    ax          ; POP 0xE9CF into AX register
      xor    ax,020C    ; decrypt 0xEBC3 in AX (0xc3  RET)
      cs:
      mov    [trap],al  ; try to overwrite INT 3 with RET
      add    ax,020C    ; fill the prefetch queue
trap:
      INT  3            ; Will change to RET
                          ; Only if the prefetch queue is
                          ; already full (on 8088 only) or
                          ; flushed (Pentium+)

INT3:                    ; Points to Rubbish
      Invd                ; Random Rubbish (2 bytes)
      ret



The virus writer expected that the INT 3 would be successfully replaced with a RET instruction to take the control flow to the proper place. His computer was an XT (8088), which has a 4-byte processor prefetch queue size (later replaced with 6 bytes on 8086). This is why the preceding code worked on his computer.

Other viruses use prefetch queue attacks to mislead debuggers and emulators. In single-stepping (or emulation not supporting the prefetch queue), such self-modification always takes place. Therefore the attacker can detect tracing easily by checking that the modified code is running instead of the instructions in the prefetch queue.