Evading Thunder_byte...
-----------------------------------------------------------------
   OK, in this section some methods of evading heuristic
analyses.... but, enough talk..!


A) Recognizing MZ
   ^^^^^^^^^^^^^^
   Many antivirus products which use heuristics are a pain in the
ass with theme:

 EXE/COM termination!!! WARNING WORLDWIDE CATASTROPHE!!!

   Well, so as to frighten the users of these programs we can, when
we verify it is MZ, instead of verifying "ZM" directly, verify byte
for byte: first if it's "M" and then if it's "Z".

B) Fixing the search routine
   ^^^^^^^^^^^^^^^^^^^^^^^^^
   Another way to null this other false alarm :-), is to search for
*.c?* instead of *.COM, which takes care of a large percentage of
the possibilities.  Once we find a file which meets this condition,
all that remains is to find out if the unknown letter is an "O".
With this, TBAV "shuts up".

C) Calls to undocumented services
   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   Now, this is one of the biggest idiocies on the planet...
For example, instead of coding:
                                 MOV AX, 3546h
                                 INT 21h
                          code:
                                 PUSH 3546h
                                 POP AX
                                 INT 21h
(I can't believe you haven't thought of this.:)

D) Return to the entry point
   ^^^^^^^^^^^^^^^^^^^^^^^^^
   Another TBAV false alarm is in recognizing the return to the
entry point.  But don't despair, because this bug can be corrected
in the same way as before.

For example, for a .COM file we'd do as follows:
                                 MOV AX, 100h
                                 JMP AX
We then change the code to:
                                 PUSH 100h
                                 POP AX
                                 JMP AX

E) Suspicious access to files
   ^^^^^^^^^^^^^^^^^^^^^^^^^^
   Something TBAV doesn't like is the moment in which the virus
CHANGES the file attributes.  Well, you already know what to do:
instead of calling by using the MOV instruction, use PUSH and POP.

F) Flexible Entry Point
   ^^^^^^^^^^^^^^^^^^^^
   Another thing TBAV dislikes is when we calculate the offset (you
know, BP and all that shit)....  There's a parallel way of getting
around this.

Instead of:
          CALL FALSO
     FALSO:
          POP  BP
          SUB  BP, OFFSET FALSO
          ...
          ...
we can try the following..:

          CALL FALSO
     FALSO:
          MOV  DI, SP
          MOV  BP, WORD PTR SS:[DI]
          SUB  BP, OFFSET FALSO
          INC  SP
          INC  SP
          ...
          ...
What this does is to simulate a POP, which spoofs TBAV.

Now that we've shit on TBAV, let's shit on F-Prot!!

A) Lets execute it!  Hahaha!