How to Fight
with a closed source.
(In addition to the saga of adaptation)
(C) 1996 A. Aksenov
________________________________
I am extremely pleased that someone
managed to survive after reading my boring articles about
adaptation programs to TR-DOS.
O than at present will be discussed?
We represent this situation:
after reading articles about the remaking
code downloaders, a young hacker
FEAR Soft has decided to demonstrate his coolness on
Rodionovskaya version of BATMAN-3. If his familiarity with
assembly language is limited to the contents of the above
article, it is likely Two hours later he leaves on a steep
cliff, tie on your neck Monitor and shot himself.
What is it? But the fact that
any more or less self-respecting hacker would not leave his
boot open to the eyes of laymen. Loaders zaksorivayut at help
small protsedurok and when they start rasksorivayutsya -
ie given in the operating position. The author of "ksorka"
considered AN Rodionov, and the name
comes from the fact that usually
for coding procedures use the command XOR. XOR - addition
modulo 2. Main property of the operation A XOR B
XOR B = A, ie repeated twice with one argument operation
neytrolizuet itself, restoring the same number (for XOR
acts peremestitelny law, and who are interested in theory,
read the algebra of logic). In short, consider this program
from:
LD HL, adr
LD BC, len
LD A, (HL) <- L1
XOR 176
LD (HL), A
INC HL
LD A, B
OR C option cycle.
JR NZ, L1
This example is taken from N.
Rodionova. As you can see, this is very
Simple programm at startup
draw a complete nonsense that
located at adr (len -
number of encoded bytes). If this program from running a second
time, then the designated address to restore the information.
I believe that the essence of the process
more or less clear. Real programs differ only in the way
get argument ksorki.
Naturally, this idiotically simple ksorki you do not
never meet. As a rule,
ksorki used to register
R - a sort of internal clock
computer. When you perform each operation, R increases its
value. Alas, his testimony
difficult to relate to the time of the command in processor
cycles, which can take from the table. A simple example ksorki
using R:
XOR A
LD R, A zeroing R
LD HL, adr
LD B, len
LD A, R <- L1
XOR (HL)
LD (HL), A
INC HL
DJNZ L1
R is reset at the start, so
he must have a concrete
value (to ksorka could open).
Now - what to do, meeting zaksorenny boot? Naturally, it
must be disclosed. How? Scroll ksorku and exit
back to the monitor. Almost
always put the decoding cycle
in emphasis to the program so that
passage ksorki will run
open source. To
after decoding the exit
the monitor, you need to move the program back a bit (on the
smaller address), and after a cycle supply
command, which performs the desired
transition. This could be a trap
monitor or direct transfer. For
this example can be extended codes cycle by 3 bytes back (from
the XOR A, to DJNZ L1 inclusive), and at the end
he put a trap:
DJNZ L1 <-end of the cycle
JP MON.
