
 Author: M.Hering, BTU-Cottbus, student                    Date: SEP-02-1999
 ######                                                    ^^^^
         Tools: "TR v2.51" / "HIEW v6.10" / "MS-Edit v2.0.024"

     No  authorized  for  public !        

     ROSE can support this, when he likes.       R.Roth be authorized ONLY ! 
 ---------------------------------------------------------------------------

 COMMENT: Protection-Loop "INT 2D downto INT 00" coded by ROSE
 #######
          ripped from unpacked "RCC286 v1.12/hard"

 Attention this is a universal ROSE-Protection loop, see in HS, RSCC etc.
 #########

 Problem: When any interrupt (00..2D) points to FFFF:FFFF then
   crashed your system, when it uses HMA!

          I have found random this bug!
          No printer works currently on my system and that`s the reason
          for a INT 05 value of FFFF:FFFF.

 Evaluation: Boot your system without parallel devices!
         (No cable on parallel port)
             Than looking for the value of INT 05, he must be FFFF:FFFF!
             Run a hackstoped file and your system crashed, because
             the follow protection!

 My preference System is "MS-Win98" under dos whitout loaded WIN-Shell
  (no "vmm32.dll" in memory)
 maybe "emm386.exe" and EMS support, DOS loaded in HMA!

 My Hardware is AMDk6/2 300MHz, MSI Aladdin5 with AMI-Bios95, Erazor 4MB/AGP


 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

 Solution for cracker: single - JUMP over this loop and you can healing this bug.
 ^^^^^^^^^^^^^^^^^^^^  always - Hooked INT 05 over a tsr-progy into RAM
                                before you will run rose-protected files!


 000000BA: E96900  ~~~ changed ~~~      jmp       000000126   -------- (1)
 ---------------------------------------------------------------------------
 000000BA: B92D00                       mov       cx,02d ;"-"

 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
 000000BD: 51                           push      cx
 000000BE: B435                         mov       ah,035 ;"5"                  
 000000C0: 8AC1                         mov       al,cl                        
 000000C2: CD21                         int       021     ~~~ GET INTAddr ~~~                 
 000000C4: 06                           push      es      ~~~ out: ES:BX  ~~~                     
 000000C5: 1F                           pop       ds                           
 000000C6: BE0500                       mov       si,00005 ;"  "               
 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

 Solution for programmer: for ROSE from M.Hering  "herinmi@tu-cottbus.de"
 ^^^^^^^^^^^^^^^^^^^^^^^
                  ~~~ included ~~~      mov       AX, ES
 first compare segment                  cmp       AX, 0FFFFh
                                        jne       0000000C9   -------- ()
 second sub and compare with            sub       AX, BX
 FFFF-maximal offset :=xx = 06          cmp       AX, xx
                                        jbe       000000123   -------- ()
 ----------------------------------------------------------
 or shorter only for FFFF:FFFF          mov       AX, ES
                                        sub       AX, BX
                                        jz        000000123   -------- ()

 ---------------------------------------------------------------------------

 In follow instructions is DS:[BX+xx] the memory address for access!
 Code will looking for special values, because detected debugger and more!

 Example: DS=FFFF, BX=FFFF     shit     mov       ax,FFFF:[FFFF+06]
                                ???     cmp       FFFF:[FFFF],0FC80
                                        jne
                    still more shit     cmp       FFFF:[FFFF+2],07430

 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
 000000C9: 8B4706                       mov       ax,[bx][00006]
 000000CC: 813F80FC                     cmp       w,[bx],0FC80 ;""           
 000000D0: 7513                         jne       0000000E5   -------- (2)     
 000000D2: 817F023074                   cmp       w,[bx][00002],07430 ;"t0"    
 000000D7: 750C                         jne       0000000E5   -------- (3)     
 000000D9: 817F040F80                   cmp       w,[bx][00004],0800F ;" "    
 000000DE: 7505                         jne       0000000E5   -------- (4)     
 000000E0: 3DFC35                       cmp       ax,035FC ;"5"               
 000000E3: 7419   "80FC30 740F 80FC35"  je        0000000FE   -------- (5)     
 ---------------------------------------------------------------------------
 000000E5: 813F2E3A                     cmp       w,[bx],03A2E ;":."
 000000E9: 7516                         jne       000000101   -------- (6)     
 000000EB: 817F02265D                   cmp       w,[bx][00002],05D26 ;"]&"    
 000000F0: 750F                         jne       000000101   -------- (7)     
 000000F2: 817F040D74                   cmp       w,[bx][00004],0740D ;"t "    
 000000F7: 7508                         jne       000000101   -------- (8)     
 000000F9: 3D05EA                       cmp       ax,0EA05 ;" "               
 000000FC: 7503   "2E3A265D0D 7405 EA"  jne       000000101   -------- (9)
 ---------------------------------------------------------------------------
 000000FE: FA                           cli                                    
 000000FF: EBFE   ~~~ wait for god ~~~  jmps      0000000FF   -------- (10)     
 ---------------------------------------------------------------------------
 00000101: 813F502E                     cmp       w,[bx],02E50 ;".P"
 00000105: 7515                         jne       00000011C   -------- (11)     
 00000107: 817F02FE06                   cmp       w,[bx][00002],006FE ;" "    
 0000010C: 750E                         jne       00000011C   -------- (12)     
 0000010E: 817F0412AC                   cmp       w,[bx][00004],0AC12 ;" "    
 00000113: 7507                         jne       00000011C   -------- (13)     
 00000115: 3D2EA1                       cmp       ax,0A12E ;"."               
 00000118: 7502   "50 2EFE0612AC 2EA1"  jne       00000011C   -------- (14)     
 0000011A: 1F        ~~~ DS=CX ~~~      pop       ds                           
 0000011B: CF   ~~~ go to nirvana? ~~~  iret
 ---------------------------------------------------------------------------
 0000011C: 43                           inc       bx                           
 0000011D: 4E                           dec       si
 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

 0000011E: 0BF6   ~~~ changed ~~~       or        si,si
 00000120: 75A6   ~~~ changed ~~~       jnz       0000000C9   -------- (15)
 00000122: 90     ~~~ remove ~~~        nop
 ---------------------------------------------------------------------------
 0000011E: 83FE00                       cmp       si,000 ;" "
 00000121: 77A6                         ja        0000000C9   -------- (15)

 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
 00000123: 59                           pop       cx
 00000124: E297                         loop      0000000BD   -------- (16)     

 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
 Here follow different code, this is code from RC286 v1.12/hard

 00000126: 3BC0                         cmp       ax,ax
 00000128: 7422                         je        00000014C   -------- (17)     
 0000012A: 54                           push      sp                           

 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-


  #######################################################################

   >>>>>>>>>>>>>>>>>>>> <- CUT here when PUBLIC -> <<<<<<<<<<<<<<<<<<<<<

  #######################################################################


  Hint: See in Adflt2a to stop TR
  ^^^^
       EliCZ  has hooked int 03 & int 01, using FS, GS
               (enable bkp-routine with "mov GS:[xxxx],y")

              makes breakpoints via DRX-settings
               (settings over INT 67h when EMS)
                asm
                  push  AX           
                  mov   AX, DE09h    
                  int   67h          crash in second far call newINT 03 
                  ..
                  pop   AX
                  ret
                end;
               for INT67h/AH=DEh: AL=0 initial, =8 get value, =9 put value

              handles port 40h to make/get the crypt key
                asm      { It`s a question of runtime speed }
                @@loop:
                  in    AL, 40h
                  jcxz  +$2
                  mov   AH, AL      (or xchg  AH, AL)
                  in    AL, 40h
                  jcxz  +$2
                  or    AX, AX
                  je    @@loop
                  mov   word ptr CS:[xxxx], AX
                end;
      Question: The loop is that a Prefetchqueue?  when not, what else.. 

              When 32-bit encryption follow them, then is very strong
               against any debugger, maybe adflt2a has a simple 8-bit add
               en-/decryption routine.

  --------------------------------------------------------------------------

      Do you have listen from BW v2.5 (Blastwave author is dingboy)?

      What "tr" cannot unpacked "bw" break through the protection when
       the protected-program run fine on your system!

       Hooked INT`s:

        BW     10 /13 /1A /21      {unpacker,dos}
        TR         05 /08 /09 /22
        CUP|1  01 /05 /09 /21
           |3     /05     /21 /CE  (very slow)
           |7     /05     /21 /CE
      DECAY                        /D6 /D7 /E7 /F7
    Insight    03 /05 /09          (russian debugger,dos)

   What is your opinion on compare the segment from INT`s of equal values? 

  --------------------------------------------------------------------------
  That`s all for you from me..  Bye says Michael !


  Apropos: Ich suche
               RSCC v1.03, (wie kann man diese Mutation engine erkennen
                            ohne endstring-kennung)
               REC  v0.33b und grsser
               HS   v1.0x - 1.12, 1.14 - 1.16

           und viele ltere Protectoren, Scrambler..
                            eine Adresse wre sehr hilfreich!
