- [Duke's Virus Labs #9] - [Page 16] -

 "TPPE Detector"
(c) by DVL Team


     諠 ᥣ  ࠡ -  LazyC0DEr/BotH .
 ᮦ, Deviator/HAZARD ⪠     :(

   ।⠢塞 ⥫ - ⥪ by LazyC0DEr/BotH :

----------------------------------------------------------------------------
                㦨 䠩 ஢ TPPE v3.0?

    祭  .    १      ᫥  ᭨
᫥饥:

    1)   ஢ 䠩  砫 ᢮ ࠧ ᮤঠ  :
       08 74 70 70 65 2E 63 6F 6D 0F 2F 63 20 74 70 70
       65 2E 63 6F 6D 3E 6E 75 6C 55 89 E5 ?? ?? ?? ??

    2)  ஢ 䠩  窥 室 ᮤঠ ⠪ ᨣ :

       9A 00 00 ?? ?? ; CALL  FAR __SystemInit
       55             ; PUSH  BP
       89 E5          ; MOV   BP, SP
       31 C0          ; XOR   AX, AX
       9A ?? ?? ?? ?? ; CALL  FAR __CheckStackOverflow
       E8 ?? ??       ; CALL  ViriiMainProcedure
       C6 06 LW HW 00 ; MOV   [someWORD], 0
       80 3E LW HW 00 ; CMP   [someWORD], 0
       74 JV          ; JE    ExitProgramm

     LW -    someWORD,  HW -   .

      ExeEntry + 30 + JV 室 ⠪ ᮪  :

       5D             ; POP   BP
       31 C0          ; XOR   AX, AX
       9A ?? ?? ?? ?? ; CALL  HALT

, ᮡ⢥,  .

PS:  䠩 antiTPPE.ASM 室  ॠ ⥪ 䠩
ᯮ TPPE v3.0.

                                           (Cl)1999 by LazyC0DEr //BotH
E-Mail : b0th@meow.kiev.ua

===== Cut =====
;  樨 ᯫ짮 :
; Turbo Assembler v4.1
; Turbo Linker v6.10

; ஢ ⠪ :
;                     tasm /m9 antiTPPE.asm
;                     tlink /t/x antiTPPE.obj
;!!! ஢ 䠩 믮 ⮫쪮  ⥪饣 ⠫ !!!
.286
.model tiny
.code
.startup
locals
jumps

;  Copyright'
                mov     dx, offset Copyright
                mov     ah, 9
                int     21h
; ࠭ ⥪騩 
                mov     ah, 19h
                int     21h
                mov     oldDrv, al
; ࠭ ⥪騩 ⠫
                mov     dx, offset OldDir
                mov     ah, 47h
                int     21h
; ஢ਬ .ப
                mov     bl, byte ptr ds:[80h]
                or      bl, bl
                jne     ObOk
; ᫨ 祣 , 襬 Usage
                call    ErrExit
                db      13, 10, 'Usage : scanTPPE <path>', 13, 10, '$'
ObOk:
;    ᪠  .ப
                mov     ds:[81h+bx], bh
                mov     cx, bx
                mov     al, ':'
                cld
                mov     di, 81h
                mov     si, di
                repne   scasb
                jne     @@loc2           ; , ⢠

                mov     dl, byte ptr [di-2];⠭ ⥪騩 
                or      dl, 20h
                sub     dl, 'a'
                mov     ah, 0Eh
                int     21h
                mov     si, di
                lodsb
@@loc2:
; ⠭ ⥪騩 ⠫
                mov     dx, si
                mov     ah, 3Bh
                int     21h

                call    Recurse          ;  諨 ᪠ ⠫.

                mov     ah, 0Eh          ; ⠭ CurDrive
                mov     dl, oldDrv
                int     21h
                mov     dx, offset OldDir; ⠭ CurDirectory
                mov     ah, 3Bh
                int     21h

; ଠ 室  ணࠬ
exit:
                dec     byte ptr Xit+1
                call    ErrExit
                db      10, 13, 'All done!$'
; ଠ 室  ணࠬ
ErrExit:
                pop     dx
                mov     ah, 9
                int     21h
Xit:
                mov     ax, 4C01h
                int     21h

;  楤 믮 ᪠஢ 䠩,  । 㦥 TPPE v3.0
ProcessFile     proc
; ஥ 䠩  ⥭
                mov     ax, 3D00h
                mov     dx, offset FileName
                int     21h
                jnc     @@Loc1
                call    IOError
                ret
@@Loc1:
                xchg    ax, bx
; ⠥ 
                mov     dx, offset ExeHDR
                mov     cx, 1Ah
                mov     ah, 3Fh
                int     21h
                jnc     @@OkRead
@@BadRead:
                call    IOError
@@OkRead:
;  EXE  ?
                cmp     ExeHDR, 'MZ'
                je      @@Process
                cmp     ExeHDR, 'ZM'
                jne     @@FileIsClear
@@Process:
; ३  砫 ࠧ
                mov     ax, hdrSize
                mov     dx, 16
                mul     dx
                mov     cx, dx
                mov     dx, ax

                mov     ax, 4200h
                int     21h
; ⠥   
                mov     cx, 4
                mov     dx, offset Buffer
                mov     ah, 3Fh
                int     21h
                jc      @@BadRead
; ᫨  ࠢ 08 74 70 70,  ।   ஢
;ணࠬ  ᯮ짮 TPPE v3.0
                cmp     word ptr Buffer, 7408h
                jne     @@TestMutated
                cmp     word ptr Buffer+2, 7070h
                jne     @@TestMutated

; ,    .   ⮬ .
                call    WriteFileName
                mov     dx, offset TPPEBased
                mov     ah, 9
                int     21h
                mov     dx, offset PlainTPPE
                mov     ah, 9
                int     21h
                jmp     @@NextLap

; ஢ઠ  樨 TPPE v3.0
@@TestMutated:
                mov     ax, hdrSize
                add     ax, exeCS
                mov     dx, 16
                mul     dx
                add     ax, exeIP
                adc     dx, 0
; ३   室  EXE
                mov     cx, dx
                mov     dx, ax
                mov     ax, 4200h
                int     21h
                mov     cx, 512
                mov     dx, offset Buffer
                mov     ah, 3Fh
                int     21h
                jc      @@BadRead

; ஢ਬ ᨣ.

; 騩 ᮪  ᪮஢,  襩 筮 㦥.
;  ⮣  , ..  ⠪  ࠡ⠥  .

;                cmp     word ptr Buffer, 9Ah
;                jne     @@FileIsClear
;                cmp     word ptr Buffer + 5, 8955h
;                jne     @@FileIsClear
;                cmp     word ptr Buffer + 7, 31E5h
;                jne     @@FileIsClear
;                cmp     word ptr Buffer + 9, 9AC0h
;                jne     @@FileIsClear
;

                cmp     byte ptr Buffer + 15, 0E8h
                jne     @@FileIsClear
                cmp     word ptr Buffer + 18, 06C6h
                jne     @@FileIsClear
                cmp     word ptr Buffer + 23, 3E80h
                jne     @@FileIsClear

                mov     ax, word ptr Buffer + 20; someWORD
                add     al, byte ptr Buffer + 22; someWORD+0
                xor     ax, word ptr Buffer + 25; (someWORD+0) XOR someWORD
                or      ax, ax
                jnz     @@FileIsClear

                cmp     word ptr Buffer + 27, 7400h
                jne     @@FileIsClear

                mov     si, 30
                mov     al, byte ptr Buffer + 29
                add     si, ax

; ஢ਬ  ᨣ.
                cmp     word ptr Buffer + si, 315Dh
                jne     @@FileIsClear
                cmp     word ptr Buffer + si + 2, 9AC0h
                jne     @@FileIsClear

;  䠩 ஢ TPPE v3.0
                call    WriteFileName
                mov     dx, offset TPPEBased
                mov     ah, 9
                int     21h
                mov     dx, offset MutatedTPPE
                mov     ah, 9
                int     21h
                jmp     @@NextLap

; 襬,  .
@@FileIsClear:
                call    WriteFileName
                mov     dx, offset Clear
                mov     ah, 9
                int     21h

; ஢ਬ ᫥騩 䠩.
@@NextLap:
                mov     ah, 3Eh
                int     21h
                ret
ProcessFile     endp

;
; ᨢ ᪠஢ ⠫.
;
Recurse         proc
                pusha
                push    ds es

                mov     dx, oDTA
                add     oDTA, 44

                mov     si, dx
                add     si, 1Eh

                mov     ah, 1Ah
                int     21h

                mov     ah, 4Eh
                mov     cx, 100111b
                mov     dx, offset aMask
                int     21h
                jc      @@ScanDir
                jmp     @@CheckFile
@@ScanFiles:
                mov     ah, 4Fh
                int     21h
                jc      @@ScanDir
@@CheckFile:
                push    si
                mov     di, offset FileName
                call    GetWord
                call    ProcessFile
                pop     si
                jmp     @@ScanFiles
@@ScanDir:
                mov     dx, offset aMask
                mov     ah, 4Eh
                mov     cx, 10h
                int     21h
                jc      @@Exit
@@TestDir:
                test    byte ptr [si-9], 10h
                jz      @@GetNextDir
                cmp     byte ptr [si], '.'
                jz      @@GetNextDir
                mov     dx, si
                mov     ah, 3Bh
                int     21h

                call    Recurse

                mov     dx, si
                sub     dx, 1Eh
                mov     ah, 1Ah
                int     21h

                mov     dx, offset prevDir
                mov     ah, 3Bh
                int     21h
@@GetNextDir:
                mov     ah, 4Fh
                int     21h
                jnc     @@TestDir

@@Exit:
                sub     oDTA, 44
                pop     es ds
                popa
                ret
Recurse         endp

;   䠩  STDOUT
WriteFileName   proc
                mov     ah, 19h
                int     21h
                add     al, 'A'
                mov     dl, al
                mov     ah, 2
                int     21h
                mov     dl, ':'
                int     21h
                mov     si, offset CurDir
                mov     ah, 47h
                xor     dx, dx
                int     21h
                mov     ah, 2
                mov     dl, '\'
                int     21h
                mov     si, offset CurDir
                cld
@@loop0:
                lodsb
                or      al, al
                je      @@WriteFile
                mov     dl, al
                int     21h
                jmp     @@loop0
@@WriteFile:
                mov     ah, 2
                cmp     CurDir, 0
                je      @@wwww
                mov     dl, '\'
                int     21h
@@wwww:
                mov     si, offset FileName
@@loop1:
                lodsb
                or      al, al
                je      @@Exit
                mov     dl, al
                int     21h
                jmp     @@loop1
@@Exit:
                ret
WriteFileName   endp

IOError         proc
                call    WriteFileName
                mov     dx, offset IOErr
                mov     ah, 9
                int     21h
                ret
IOError         endp
;
;
;
Strip_Special   proc
                push    ax
                cld
@@Get_1sf_Space:
                lodsb
                or      al, al
                je      @@Exit
                cmp     al, 20h
                jle     @@Get_1sf_Space
@@Exit:
                dec     si
                pop     ax
                ret
Strip_Special   endp

; GetWord - 뤥  ப ᨬ ᫮.
;
; 室: DS:Si - 室 ⮪.
;       ES:Di - 
;
; 室:
;       ES:Di - ᫮  ଠ ASCIIZ
;
GetWord         proc
                push    di
                push    ax
                call    Strip_Special
                cld
@@MakeWord:
                lodsb
                cmp     al, 20h
                jle     @@Exit
                stosb
                jmp     short @@MakeWord
@@Exit:
                xor     ax, ax
                stosb
                dec     si
                pop     ax
                pop     di
                ret
GetWord         endp

.data
Copyright       db      13, 10
                db      '  Scaner for TPPE v3.0 based files (Cl)1999 by LazyC0DEr //BotH'
                db      10, 10, 13, '$'

Clear           db      ' - Ok', 13, 10, '$'
IOErr           db      ' - I/O error', 13, 10, '$'

TPPEBased       db      ' - TPPE v3.0 based$'
PlainTPPE       db      '(plain)', 13, 10, '$'
MutatedTPPE     db      '(mutated)', 13, 10, '$'
aMask           db      '*.*', 0
prevDir         db      '..', 0
root            db      '\', 0
oDTA            dw      offset DTA_buff + 44

.data?
ExeHDR          dw      ?
LastPage        dw      ?                ;  䠩 MOD 512
Pages           dw      ?                ; INT ( 䠩 / 512)
RelCount        dw      ?                ; - ⮢ ⠡ ன
hdrSize         dw      ?                ;    ࠣ
MinMem          dw      ?                ; 쭮 室 - ࠣ䮢
MaxMem          dw      ?                ; ᨬ쭮 室 - ࠣ䮢
exeSS           dw      ?                ; 饭 ᥣ  ⥪
exeSP           dw      ?                ; 祭 ॣ SP  室
CRC             dw      ?                ; ஫쭠 㬬 䠩
exeIP           dw      ?                ; ন ॣ IP  室
exeCS           dw      ?                ; 饭 ᥣ  ணࠬ
RelOffset       dw      ?                ; ⭮⥫  ࢮ 

OldDir          db      64 dup(?)        ;  ࠭   ண
                                         ;  ⨫.
oldDrv          db      ?                ;   ண  ⨫.

CurDir          db      64 dup(?)        ;
FileName        db      13 dup(?)        ;    䠩
Buffer          db      512 dup(?)       ;   ⥭ 䠩
DTA_buff        db      50 * 44 dup(?)

                end
===== Cut =====
