Chapter 266: The Killing is Out

Suppose a situation, a large box to put several different flavors of melon seeds, different flavors of melon seeds can not be mixed, but also to be able to calculate the weight of each type of melon seeds very conveniently, what will we do?

There is such a method, in the box to make a lot of the same size, and isolated from each other, the weight of the melon seeds that can be stored in each grid is certain, assuming that it is 50 grams, we put each kind of melon seeds in turn into these grids, for example, the five-spiced ones occupy five complete grids, the sixth grid is not full, we want to know the weight of the melon seeds, we only need to weigh the melon seeds in the sixth grid that is not full, if the weight accuracy requirements are not high, We can even directly calculate the melon seeds in the last unfilled grid as 50 grams, so that the calculation of the weight of the melon seeds will be more convenient and fast.

According to this method, other flavors of melon seeds are stored from the seventh grid, weighed by counting the grids, and so on.

At this time, only considering the lattice with melon seeds, we have a problem, after we put all the melon seeds in the box, there will inevitably be a lot of lattices that are not occupied, that is, the utilization rate of space is not 100%, and the space that is not used and wasted can be called space debris.

In the computer operating system, the functional module of disk file management is called the file system, although the management method of disk files by different file systems is different, but one thing is the same, that is, all file systems, when storing files in the disk, will divide the disk storage space into a grid of the same size, this kind of grid has a term in the computer profession, called the disk sector, the process of drawing a grid to the disk, is what we usually call formatting.

Similar to the calculation of the weight of melon seeds, the file system generally calculates the file size according to the sector, and if it is less than one sector, it will also be calculated according to one sector.

It is the same as the principle of putting melon seeds in the box described above, because the file size is random, and it cannot be exactly an integer multiple of the disk sector size, so the utilization rate of disk space by any file system cannot be 100%, and those disk spaces that cannot be used are what we often call disk fragmentation.

Although the disk space cost by each disk fragment is very small, we know that the number of files in the disk is extremely large, therefore, the number of disk fragments is also extremely large, so that the huge number of disk fragments, the lang fee for disk space is very considerable, these disk fragments will not only cause disk space lang fees, but also have a great impact on disk read and write efficiency, the reasons for this are more complex, and will not be described here.

Therefore, any file system will have a mechanism to deal with disk fragmentation, more advanced file systems, such as NTFS used on WindowsNT, have strong management capabilities for disk fragmentation, which can greatly reduce the LANG fee of disk fragmentation on space, and more advanced file systems than NTFS, and even with the passage of disk use time, fragmentation is becoming less and less.

However, the FAT32 used on Microsoft's operating system windows98 is a kind of suffocating file system, which has a very weak ability to manage disk fragmentation, so that with the passage of disk use, the fragmentation is used more and more, and then you have to use some external disk defragmentation tools to re-plan and arrange the disk files to achieve the purpose of reducing disk fragmentation.

We usually think that disk fragments cannot be used, but some computer experts can use these fragments to achieve their special purposes through some clever means.

Viruses infect disk files, which will generally increase the size of disk files, but imagine what will happen if the virus files do not occupy new disk sectors when infecting disk files, but store themselves in disk sectors that are not full of infected file data, and the file system calculates the disk file size in sector units?

This is easy to understand, at this time, although the virus file writes itself into the file, but the size of the disk file does not change, this phenomenon is like we put a basin of water into a bucket of sand, the water is poured in, but the volume of the sand in the bucket does not increase.

Gu Wolf threw the paper clip into Mei Li's plate, and the paper clip fell into the gap between the disc boxes, which is also the reason.

Gu Wolf thought further, because the CIH virus infected the file itself uses this mechanism to store itself, and the virus protogen they get is also extracted from the disk fragments of the infected file, but he and everyone ignore one point, that is, when the virus protogen itself occupies the disk fragments, it will also produce new disk fragments, if the virus writer stuffs the core code of the virus into the new disk fragments generated by these virus protogens, and uses some means to hide it, Then, it is understandable that they could not get the mutation code of the virus protogen by disassembling it earlier, and that the virus could not be cleaned by the killing tool.

Hurriedly ran back to the technical department, Gu Wolf sat down next to the computer, and secretly prayed, hoping that his guess just now was correct.

He opened a disk data scraping tool, grabbed all the data in the disk space where the virus protogen was located, including fragments, and then compared it with the original virus protogen file data, so he got some discrepancy data, which was actually obtained before, but they had filtered out these data as garbage data before, and at this time, he had to focus on analyzing these data.

Importing this data into another data analysis software, when he started to analyze, Gu Wolf's heart suddenly rose to his throat, because this was the only way he could think of, if this method didn't work, he felt that he was really a little exhausted.

With his eyes slightly closed, Gu Wolf waited for a few minutes, then took a deep breath, slowly opened his eyes, and looked at the computer screen, the analysis results of the data analysis software had come out.

"So that's really the case, what a clever method!"

Gu Wolf looked at the analysis report given by the software, the heart he was originally carrying suddenly fell into his stomach, he clenched his fist and waved it in the air, then stood up and said loudly, "Everyone come over and have a meeting!" ”

Gathering the employees of the technical department again, Gu Wolf concisely told him what he had discovered, which caused another exclamation.

"Wuyang, don't care what's going on with this mutation algorithm, directly clear the virus-infected disk sector, and use the fastest time to improve the virus killing tool, the longer the time drags on, the more unfavorable it will be for us, let's break up." Gu Wolf commanded Wu Yang.

In fact, there was no need for Gu Wolf to tell him, Wu Yang had been depressed for so long, and this time there was a breakthrough, he couldn't wait and was eager to try, so as soon as Gu Wolf's words fell, he left in a hurry with his two assistants.

After Wu Yang left, Gu Wolf processed the mutation algorithm code of the virus he obtained, and then disassembled it to obtain a piece of assembly code, so with a strong curiosity, he began to study and analyze this code.

This code is easy to understand, it contains a random mutation algorithm, it can be said that as long as this code can't be found, then this mutation algorithm, once it detects that the CIH virus it generates is killed, it will generate a different mutant virus again, in addition, this code also includes a CIH virus immunity code judgment and bypass mechanism, this mechanism is not a particularly clever thing, when Gu Wolf was hired by Chi Xiang, when dealing with Xiao Yuan, he used a similar method.

When he was studying this code, Wu Yang was also working nervously, and an hour later, the new version of the killing tool came out, and after testing, the killing tool successfully killed the virus in the virtual machine.

"Immediately send the killing tool to the network department, publish and upload it to the Xuanni forum, and I will go to Mr. Tang now to report it, you have worked hard."

Gu Wolf was a little excited at this time, ordered Wu Yang, and then hurriedly came out of the technical department, took a deep breath, and went to Tang Xinyu's office.