Upload
This commit is contained in:
commit
43352ff262
1291 changed files with 220976 additions and 0 deletions
471
FCP/UNPACK.ASM
Normal file
471
FCP/UNPACK.ASM
Normal file
|
|
@ -0,0 +1,471 @@
|
|||
NOJUMPS
|
||||
|
||||
calccrc MACRO start,end
|
||||
local l1
|
||||
mov cx,OFFSET end-OFFSET start
|
||||
mov si,OFFSET start
|
||||
l1: add dl,cs:[si]
|
||||
adc dh,0
|
||||
rol dx,1
|
||||
inc si
|
||||
loop l1
|
||||
ENDM
|
||||
uncryptxor MACRO beg,key
|
||||
local l1
|
||||
mov bx,OFFSET beg
|
||||
mov ax,key
|
||||
mov cx,(OFFSET _unpack_endcrypt-OFFSET beg)/2
|
||||
l1: xor ds:[bx],ax
|
||||
add bx,2
|
||||
dec cx
|
||||
jnz l1
|
||||
ENDM
|
||||
uncryptadd MACRO beg,key ;actually sub, uncrypts add-crypting
|
||||
local l1
|
||||
mov bx,OFFSET beg
|
||||
mov ax,key
|
||||
mov cx,(OFFSET _unpack_endcrypt-OFFSET beg)/2
|
||||
l1: sub ds:[bx],ax
|
||||
add bx,2
|
||||
dec cx
|
||||
jnz l1
|
||||
ENDM
|
||||
|
||||
unp_text SEGMENT para public 'CODE'
|
||||
ASSUME cs:unp_text
|
||||
PUBLIC _unpack_start,_unpack_end
|
||||
PUBLIC _unpack_data,_unpack_dataend,_unpack_data2,_unpack_code
|
||||
PUBLIC _unpack_stack0,_unpack_stack1
|
||||
PUBLIC _unpack_crc0,_unpack_crc1
|
||||
PUBLIC _unpack_crypt1 ;add 5f27h - INC
|
||||
PUBLIC _unpack_crypt2 ;xor 4493h - INC
|
||||
PUBLIC _unpack_crypt3 ;add 0073h - INC
|
||||
PUBLIC _unpack_crypt4 ;xor 4536h - none
|
||||
PUBLIC _unpack_crypt10 ;xor 0666h - none
|
||||
PUBLIC _unpack_crypt11 ;add 0656h - DEC
|
||||
PUBLIC _unpack_crypt12 ;xor 0466h - DEC
|
||||
PUBLIC _unpack_crypt13 ;add 0663h - none
|
||||
PUBLIC _unpack_crypt14 ;add DX - none
|
||||
PUBLIC _unpack_crypt15 ;xor 5cach - none
|
||||
PUBLIC _unpack_crypt16 ;add 3fach - INC
|
||||
PUBLIC _unpack_endcrypt
|
||||
_unpack_start LABEL BYTE
|
||||
|
||||
db 'FCP/IV' ;Future Protector IV
|
||||
|
||||
_unpack_code LABEL BYTE
|
||||
startup PROC NEAR
|
||||
mov sp,OFFSET _unpack_stack1
|
||||
io21data LABEL BYTE
|
||||
ret
|
||||
pntds2 LABEL WORd
|
||||
jmp cs:[farjump+2]
|
||||
startup ENDP
|
||||
int_iret PROC FAR
|
||||
iret
|
||||
int_iret ENDP
|
||||
|
||||
ALIGN 2
|
||||
_unpack_stack0 LABEL BYTE
|
||||
dw 50 dup(5555h)
|
||||
_unpack_stack1 LABEL BYTE
|
||||
dw OFFSET step1
|
||||
dw 0 ;popped by step 1 => DS
|
||||
dw OFFSET step2
|
||||
dw OFFSET step3
|
||||
dw OFFSEt step4
|
||||
stck1: dw OFFSET stepx1 ;the cracker blew it :-)
|
||||
dw 0fff0h,0000h
|
||||
disk0 dw 0
|
||||
disk1 dw 0
|
||||
vram dw 01234h
|
||||
hboottxt db '.;*',13,0
|
||||
pntds dw 0
|
||||
|
||||
_unpack_crc0 LABEL BYTE
|
||||
|
||||
.386P
|
||||
step1 PROC NEAR
|
||||
in al,21h
|
||||
mov cs:io21data,al
|
||||
mov al,255
|
||||
out 21h,al
|
||||
cli
|
||||
mov cs:pntds,ds
|
||||
pop ds
|
||||
cld
|
||||
;disk detect
|
||||
mov ah,08h
|
||||
mov dl,128
|
||||
mov dh,0
|
||||
int 13h
|
||||
cmp dh,0
|
||||
je jjj1
|
||||
mov cs:disk0,cx
|
||||
mov cs:disk1,dx
|
||||
jjj1: ;video detect
|
||||
mov ah,0fh
|
||||
int 10h
|
||||
cmp al,7
|
||||
je ismda
|
||||
mov cs:vram,0800h+1234h
|
||||
ismda: add cs:vram,0b000h-01234h
|
||||
;processor detect, at return: BP=0=real BP=1=protected mode
|
||||
push sp ; 86/186 will push SP-2;
|
||||
pop ax ; 286/386 will push SP.
|
||||
cmp ax, sp
|
||||
jz not86 ; If equal, SP was pushed
|
||||
;8086/80186
|
||||
noprot: mov bp,0
|
||||
ret
|
||||
not86: smsw cx ; Protected? Machine status -> CX
|
||||
ror cx,1 ; Protection bit -> carry flag
|
||||
jnc noprot ; Real mode if no carry
|
||||
mov bp,1
|
||||
ret
|
||||
step1 ENDP
|
||||
.8086
|
||||
|
||||
step3 PROC NEAR
|
||||
;DS=CS now (in step 2)
|
||||
;uncode crap
|
||||
mov byte ptr cs:int1code,40h ;INC AX
|
||||
int 3 ;clc set at step2's end
|
||||
uncryptadd _unpack_crypt1,5f27h
|
||||
ret
|
||||
step3 ENDP
|
||||
|
||||
ints PROC FAR ;SingleStep/DEBUG
|
||||
int_01: stc
|
||||
int_03: push bp
|
||||
mov bp,sp
|
||||
jnc int2
|
||||
push bx
|
||||
mov bx,ss:[bp+2] ;ip
|
||||
cmp byte ptr cs:[bx],49h ;inc cx
|
||||
jne int1
|
||||
int1code: inc bx
|
||||
int1: pop bx
|
||||
int3: pop bp
|
||||
iret
|
||||
int2: xor ss:[bp+6],256
|
||||
mov bp,cs:stck1to
|
||||
mov word ptr cs:[stck1],bp
|
||||
jmp int3
|
||||
ints000:
|
||||
ints ENDP
|
||||
|
||||
_unpack_crc1 LABEL BYTE
|
||||
|
||||
itable LABEL WORD
|
||||
itablelen equ 4
|
||||
dw OFFSET int_iret,0f000h ;int 0
|
||||
dw OFFSET int_01,0f000h ;int 1
|
||||
dw OFFSET int_iret,0f000h ;int 2
|
||||
dw OFFSET int_03,0f000h ;int 3
|
||||
;Stack contents on ints:
|
||||
; [bp+6]: flags
|
||||
; [bp+4]: cs
|
||||
; [bp+2]: ip
|
||||
; [bp+0]: bp
|
||||
|
||||
_startzeroing LABEL BYTE
|
||||
|
||||
step2 PROC NEAR ;WARNING! ROUTINE OVERWRITTEN BY INNER STACK
|
||||
mov cs:hboottxt[0],'b'
|
||||
;set interrupts
|
||||
mov bx,'FG'
|
||||
mov si,OFFSET itable
|
||||
xor di,di
|
||||
mov cx,itablelen
|
||||
mov dx,'JM'
|
||||
mov cs:hboottxt[1],'C'
|
||||
st2a: segcs
|
||||
lodsw
|
||||
xchg ds:[di],ax
|
||||
mov cs:[si-2],ax
|
||||
mov ax,cs
|
||||
xchg ds:[di+2],ax
|
||||
mov cs:[si],ax
|
||||
add si,2
|
||||
add di,4
|
||||
loop st2a
|
||||
;carry=0 for di won't rotate
|
||||
mov di,dx ;='JM'
|
||||
mov dx,OFFSET hboottxt
|
||||
mov ax,cs
|
||||
mov ds,ax
|
||||
mov si,bx ;='FG' ;if this enabled, ICE will reboot
|
||||
mov ax,0911h
|
||||
ret
|
||||
step2 ENDP
|
||||
|
||||
stepx1 PROC NEAR
|
||||
mov ax,0f000h
|
||||
retf ;reboots
|
||||
stepx1 ENDP
|
||||
|
||||
_unpack_crypt1 LABEL BYTE
|
||||
|
||||
step4 PROC NEAR
|
||||
;DS=CS
|
||||
mov ax,cs:pntds
|
||||
mov cs:pntds2,ax
|
||||
uncryptxor _unpack_crypt2,4493h
|
||||
_unpack_crypt2 LABEL BYTE
|
||||
uncryptadd _unpack_crypt3,0073h
|
||||
_unpack_crypt3 LABEL BYTE
|
||||
jmp stp4o
|
||||
stck1to dw OFFSET step5
|
||||
hboottxt2 db 'Bc*',13,0
|
||||
stp4o: sub ax,ax
|
||||
mov si,'FG'
|
||||
mov di,'JM'
|
||||
mov ax,0911h
|
||||
mov dx,OFFSET hboottxt2
|
||||
clc
|
||||
int 3
|
||||
uncryptxor _unpack_crypt4,4536h
|
||||
ret ;goes to step5
|
||||
step4 ENDP
|
||||
|
||||
_unpack_crypt4 LABEL BYTE
|
||||
|
||||
innerstack LABEL BYTE
|
||||
dw OFFSET stepx1
|
||||
|
||||
step5 PROC NEAR
|
||||
;enter inner stack
|
||||
mov sp,OFFSET innerstack
|
||||
uncryptxor _unpack_crypt10,0666h
|
||||
_unpack_crypt10 LABEL BYTE
|
||||
i1c0: mov dx,0656h
|
||||
sub ax,ax
|
||||
mov es,ax
|
||||
mov ax,es:[6]
|
||||
mov bx,cs
|
||||
cmp ax,bx
|
||||
je i1c1
|
||||
mov word ptr cs:[i1c0+1],0CA3Fh
|
||||
mov dx,3FC1H
|
||||
i1c1: cmp word ptr es:[4],OFFSET int_01
|
||||
je i1c2
|
||||
mov word ptr cs:[i1c0+1],0CA3Fh
|
||||
mov dx,3CF2H
|
||||
i1c2: mov byte ptr cs:int1code,48h ;DEC AX
|
||||
sub ax,ax
|
||||
int 3
|
||||
uncryptadd _unpack_crypt11,dx
|
||||
_unpack_crypt11 LABEL BYTE
|
||||
uncryptxor _unpack_crypt12,0466h
|
||||
_unpack_crypt12 LABEL BYTE
|
||||
mov byte ptr cs:int1code,40h ;INC AX
|
||||
sub ax,ax
|
||||
int 3
|
||||
uncryptadd _unpack_crypt13,0663h
|
||||
_unpack_crypt13 LABEL BYTE
|
||||
;calc checksum of exe start
|
||||
xor dx,dx
|
||||
mov byte ptr cs:int1code,43h ;INC BX
|
||||
calccrc _unpack_crc0,_unpack_crc1
|
||||
uncryptadd _unpack_crypt14,0 ;dx
|
||||
_unpack_crypt14 LABEL BYTE
|
||||
uncryptxor _unpack_crypt15,5CACh
|
||||
_unpack_crypt15 LABEL BYTE
|
||||
mov byte ptr cs:int1code,40h ;INC AX
|
||||
sub ax,ax
|
||||
int 3
|
||||
uncryptadd _unpack_crypt16,3FACh
|
||||
_unpack_crypt16 LABEL BYTE
|
||||
mov word ptr cs:innerstack,OFFSET execute
|
||||
sub ax,ax
|
||||
int 3
|
||||
ret
|
||||
step5 ENDP
|
||||
|
||||
ALIGN 2
|
||||
|
||||
execute PROC NEAR
|
||||
;unpack data
|
||||
mov dx,cs:pntds2
|
||||
add dx,10h
|
||||
xor si,si
|
||||
xor di,di
|
||||
cmp cs:mcrcon,0
|
||||
je exec11
|
||||
;calc machine crc
|
||||
mov ax,0ff00h
|
||||
mov ds,ax
|
||||
mov bx,0
|
||||
mov cx,1024
|
||||
mcrc1: add si,ds:[bx]
|
||||
add di,ds:[bx+2]
|
||||
rol si,1
|
||||
add bx,4
|
||||
loop mcrc1
|
||||
add si,cs:disk0
|
||||
add di,cs:disk1
|
||||
exec11: add si,cs:regcs
|
||||
add di,cs:regip
|
||||
add si,cs:regsp
|
||||
add di,cs:regss
|
||||
add si,cs:regkey
|
||||
add di,cs:regkey
|
||||
mov cx,cs:regcs0
|
||||
exec1: mov ds,dx
|
||||
sub ds:[0],si
|
||||
sub ds:[2],di
|
||||
xor si,5354h
|
||||
xor di,1525h
|
||||
sub ds:[4],si
|
||||
sub ds:[6],di
|
||||
add si,1234h
|
||||
ror si,1
|
||||
add di,4321h
|
||||
rol di,1
|
||||
sub ds:[8],si
|
||||
sub ds:[10],di
|
||||
xor si,5354h
|
||||
xor di,1525h
|
||||
sub ds:[12],si
|
||||
sub ds:[14],di
|
||||
add si,1234h
|
||||
ror si,1
|
||||
add di,4321h
|
||||
rol di,1
|
||||
inc dx
|
||||
add si,ds:[0]
|
||||
add di,ds:[8]
|
||||
add si,ds:[2]
|
||||
add di,ds:[10]
|
||||
add si,ds:[4]
|
||||
add di,ds:[12]
|
||||
add si,ds:[6]
|
||||
add di,ds:[14]
|
||||
loop exec1
|
||||
mov bp,OFFSET errormsg1
|
||||
cmp si,cs:keychk0
|
||||
jne error
|
||||
cmp di,cs:keychk1
|
||||
jne error
|
||||
cld
|
||||
_endzeroing LABEL BYTE ;may overflow a byte, but who cares
|
||||
mov dx,cs:pntds2
|
||||
mov ax,cs
|
||||
mov es,ax
|
||||
mov cx,(OFFSET _endzeroing-OFFSET _startzeroing+1)/2
|
||||
mov di,OFFSET _startzeroing
|
||||
mov ax,'..'
|
||||
rep stosw
|
||||
call resetints
|
||||
mov al,cs:io21data
|
||||
out 21h,al
|
||||
mov ax,cs
|
||||
mov es,ax
|
||||
mov cx,OFFSET _startzeroing-OFFSET _unpack_code
|
||||
mov di,OFFSET _unpack_code
|
||||
mov al,'.'
|
||||
rep stosb
|
||||
;load stack and cs:ip for the actual program and run it.
|
||||
mov ds,dx
|
||||
mov es,dx
|
||||
mov bx,cs
|
||||
mov cx,cs:regcs0
|
||||
mov ax,cs:regss
|
||||
add ax,bx
|
||||
sub ax,cx
|
||||
mov ss,ax
|
||||
mov sp,cs:regsp
|
||||
add cs:regcs,bx
|
||||
sub cs:regcs,cx
|
||||
push cs:regcs
|
||||
push cs:regip
|
||||
mov cs:regcs,ax
|
||||
mov cs:regip,ax
|
||||
mov cs:regss,ax
|
||||
mov cs:regcs0,ax
|
||||
mov cs:keychk1,ax
|
||||
mov cs:regkey,ax
|
||||
sti
|
||||
jmp endprg2
|
||||
|
||||
_endzeroing2 LABEL BYTE
|
||||
error: ;destroy and exit with error at OFFSET BP
|
||||
cld
|
||||
mov dx,cs:pntds2
|
||||
mov ax,cs
|
||||
mov es,ax
|
||||
mov cx,(OFFSET _endzeroing2-OFFSET _startzeroing+1)/2
|
||||
mov di,OFFSET _startzeroing
|
||||
mov ax,'..'
|
||||
rep stosw
|
||||
call resetints
|
||||
mov al,cs:io21data
|
||||
out 21h,al
|
||||
mov ax,cs
|
||||
mov es,ax
|
||||
mov di,OFFSET _unpack_code
|
||||
mov cx,OFFSET _startzeroing-OFFSET _unpack_code
|
||||
mov al,'.'
|
||||
rep stosb
|
||||
mov cs:regcs,ax
|
||||
mov cs:regip,ax
|
||||
mov cs:regss,ax
|
||||
mov cs:regcs0,ax
|
||||
mov cs:keychk1,ax
|
||||
mov cs:regkey,ax
|
||||
mov sp,OFFSET _unpack_data
|
||||
sti
|
||||
jmp endprg1
|
||||
execute ENDP
|
||||
|
||||
resetints PROC NEAR
|
||||
;reset interrupts
|
||||
xor ax,ax
|
||||
mov es,ax
|
||||
mov si,OFFSET itable
|
||||
xor di,di
|
||||
mov cx,itablelen*2
|
||||
st20a: segcs
|
||||
lodsw
|
||||
stosw
|
||||
loop st20a
|
||||
ret
|
||||
resetints ENDP
|
||||
|
||||
ALIGN 2
|
||||
_unpack_data LABEL BYTE
|
||||
farjump LABEL DWORD
|
||||
regcs dw 0
|
||||
regip dw 0
|
||||
regss dw 0
|
||||
regsp dw 0
|
||||
regcs0 dw 0
|
||||
errormsg1 db 'File corrupted!$'
|
||||
_unpack_data2 LABEL BYTE
|
||||
regkey dw 0
|
||||
mcrcon dw 0 ;1=machine crc enabled
|
||||
keychk0 dw 0
|
||||
keychk1 dw 0
|
||||
_unpack_dataend LABEL BYTE
|
||||
|
||||
ALIGN 2
|
||||
|
||||
endprg1: ;****************
|
||||
mov dx,bp
|
||||
mov ax,cs
|
||||
mov ds,ax
|
||||
mov ah,9h
|
||||
int 21h
|
||||
mov ax,4c03h
|
||||
int 21h
|
||||
endprg2: ;****************
|
||||
retf
|
||||
|
||||
ALIGN 2
|
||||
_unpack_endcrypt LABEL BYTE
|
||||
db 000h,0fch
|
||||
_unpack_end LABEL BYTE
|
||||
unp_text ENDS
|
||||
END
|
||||
|
||||
Loading…
Reference in a new issue