;/***************************************************************************\
;                       Loader for Reach For The Sky
;                 Full Source Tested With TASM 4.0 and 5.0
;                                +gthorne'97
;\***************************************************************************/

.model small
.code
org 100h

start:

int_service     equ     03Dh    ; the interrupt service to be hooked

                jmp     real_start        

filename        db      'reach.exe', 0          ; file to crack

int_entry:                                  
                push    bp                      ; Push All
		mov	bp,sp
		push	ax
		push	dx
		push	ds
                pushf                           

;/***********************************************\
;  Code specific to the target program goes here
;\***********************************************/

                cmp     ah,int_service  
                jne     time_to_go

                cmp     dx, 13CEh  ; Does it attempt to open a file at 13CE?
                jnz     time_to_go

                mov     ax,[bp+4]        ; get data segment 
		mov	ds,ax

                ;***********************;
                ; LOOK FOR BYTE PATTERN ;
                ;***********************;

                cmp     byte ptr ds:0B6DAh, 74h
                jne     time_to_go

                cmp     byte ptr ds:0B6DBh, 0Fh 
                jne     time_to_go

                cmp     byte ptr ds:0B6DCh, 80h 
                jne     time_to_go

                ;****************************;
                ; APPLY THE CRACK ON THE FLY ;
                ;****************************;

                mov     byte ptr ds:0B6DAh, 0EBh
                mov     byte ptr ds:0B697h, 90h 
                mov     byte ptr ds:0B698h, 90h 
                mov     byte ptr ds:0B699h, 90h 
                mov     byte ptr ds:0B69Ah, 90h 
                mov     byte ptr ds:0B69Bh, 90h 

                mov     dx,cs:data_9            ; Restore old int 21 ds:dx
                mov     ds,word ptr cs:data_9+2
		mov	ax,2521h
		int	21h			; DOS Services  ah=function 25h
                                                ;  set intrpt vector 21 to ds:dx
;/*****************************\;
;  End of user-defined payload  ;
;\*****************************/;

time_to_go:
                popf                            ; Pop All
		pop	ds
		pop	dx
		pop	ax
		pop	bp

                jmp     dword ptr cs:data_9     ; Jump to normal int 21 now

standard_data_block:

data_9          dw      0
                dw      8758h
data_12         dw      0
                dw      01B2h
data_13         dw      8758h                  
                dw      01B2h
data_14         dw      8758h                  
                dw      01B2h
data_15         dw      8758h                  
                dw      0

real_start:                                     
		cli				; Disable interrupts
		push	cs
		pop	ds
		mov	sp,3B4h
		sti				; Enable interrupts

                mov     data_13,ds              ; Store ds 3 times
                mov     data_14,ds              ; 
                mov     data_15,ds              ; 

		mov	ax,3521h
		int	21h			; DOS Services  ah=function 35h
						;  get intrpt vector al in es:bx
                mov     data_9,bx               
                mov     word ptr data_9+2,es    
                mov     dx,offset int_entry
		mov	ax,2521h
		int	21h			; DOS Services  ah=function 25h
						;  set intrpt vector al to ds:dx
		push	cs
		pop	es

		mov	bx,3B4h
		add	bx,0Fh
		mov	cl,4
		shr	bx,cl			; Shift w/zeros fill
		mov	ax,4A00h
		int	21h			; DOS Services  ah=function 4Ah
						;  change memory allocation
						;   bx=bytes/16, es=mem segment
                mov     dx,offset filename      
                mov     bx,offset data_12       
		mov	ax,4B00h
		int	21h			; DOS Services  ah=function 4Bh
						;  run progm @ds:dx, parm @es:bx

exit:           int 20h                         ; Quit Happily
                end start

