

       My dear friends,

        Finaly  I  have  moved  my  ass  around  and finished the very first
 commercial version of my  polymorphic  engine.   This  is  the engine I was
 talking about in my article 'Analisis on the polymorphic decryptor',  which
 you can read in the 29A magazine (http://29A.islatortuga.com).

        A  few  words  before  you  start  playing with it.  First of all, I
 called it version 0.1 because it has  a few bugs.  The thing is it actually
 has only one bug, but I didn't find  the  necessary  time  to  dig  it  in.
 Therefore,  I  released  it  as  v  0.1  Beta 1.  The bug appeares when you
 generate a number of files, for  example  30,  and  out of these 30 files 4
 files will hang.  If you have the time to debug them you'll nottice that it
 stops  at  some  instructions  that  look  like  this:   <math  op>  <reg>,
 [bp+si+<number>] (of course not only for bp+si, but  any  general  register
 type  refference),  when  bp+si+<number>  =  FFFFH.   Why ?  Dunno... yet !
 Anyhow, by reducing the types  of  instructions the engine can generate you
 can remove the bug, but leaving the engine weaker.

        Anyway, I don't know if any future versions of this Engine  will  be
 available to public, but until then, it's a start...

        Lemme number the +'s and -'s of this engine:

        '-':   -> the engine is too long (unoptimized code)
               -> the decryptor still looks 'too much' like a generated one

        '+':  -> can generate fake  Calls  to  fake routines
              -> can generate conditional jumps
              -> generates almost all combinations of  math operations
              -> generates interrupt calls
              -> generates Coprocessor instructions
              -> generates priviledged instructions

        In the future versions I  will  add some advanced polymorphism stuff
 (like placing the decryptor anywhere within the code).

        Before you start playing with the code, here is the data  about  the
 files you have here (so don't kick me if you have a virus):

        File  name     | Length (bytes) | Date
        ---------------+----------------+----------
        mof_demo.asm   | 78449          | 04-05-98
        mof_demo.exe   |  9654          | 04-05-98
        asmwiz.lib     | 36553          | 01-02-96
        mof00000.com   |  2026          | 04-05-98 -> working sample
        ---------------+----------------+----------

        The assembled file is good, if you mess the source, I don't care ;-)

        As you can read in the original comment inside the code, I  used  an
 ASM  library  in  order  to  make  the demo making easier.  This library is
 called ASMWiz. And, by the way,  speaking of the original comment.  Some of
 the things said there  are  not  true,  like  for  example  the  parameters
 returned by the engine.  As soon as I clear all the bugs of, I will correct
 this too.

        Anyway, if any of you has any suggestions, comments, bug reports, or
 anything, please write me to:

               lordjulus@geocities.com

        Whoever  is  useful  to this code will be placed in the credits area
 and will receive for free  all  the  future versions... plus will become my
 friend ;-))

        All the Best and don't forget, check out my articles at:

               Http://members.tripod.com/~lordjulus

                                                  Lord Julus


