Please tell me how to do a softmod

Discussion in 'Windows 7' started by Violin, Jul 30, 2009.

  1. Violin

    Violin MDL Novice

    May 23, 2008
    7
    0
    0
    Currently all existing softmod programs are closed source. The source code of the core program, such as Vista Loader's grldr and WoW's wow.exe (inside the floppy image), is not available. They are all excellent work, but I wish to have a better understanding of softmod.
    I don't understand how they work. I only know that they patch the memory. Could someone please tell me how to patch the memory to emulate BIOS SLIC, or just point me to some useful materials?
    If I succeed in making a softmod program, I will release the source code.
    Thank you!
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  2. Violin

    Violin MDL Novice

    May 23, 2008
    7
    0
    0
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  3. enb141

    enb141 MDL Novice

    Feb 14, 2009
    29
    0
    0
    I'm also interested in wow.exe source codes or something like that, the reason is because I want to add my custom RSDT keys used for cable card and other ones used for SLI but I need the part to adding this into memory.
     
  4. JakeL

    JakeL MDL Novice

    Aug 1, 2009
    5
    0
    0
    Hazars method uses a MS boot sector rewriter tool that rewrites a patched version of Grub4Dos which emulates Slic. If you understand the activation principal, you should be able to modify Grub4Dos to redirect all calls to the Slic table to the generated one. Although, you need to have ASM knowledge in order to do this, since bootstrappers must be written in ASM.
     
  5. Yen

    Yen Admin
    Staff Member

    May 6, 2007
    11,172
    10,932
    340
    Hi,

    I was one of the cooperator at wow project. I'm no programer and I haven't got any source to share.:( Flagmax did all the coding.
    AFAIK WoW was programed in FASM.

    But I know everything about wow. Most approaches were ideas I had got.

    You should know about acpi specifications. Basically you have to read / write memory at 4 GB address range.
    You have to know how the AcpiTables are chained. OSPM-->RSDP--->RSDT/XSDT----->other tables (SLIC)

    WoW is quite different to vista lo*der. WoW doesn't emulate a SLIC it introduces it like it's just from bios...

    If you have any further questions feel free to ask. I still have got the flowchart of WoW.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  6. mcbyte

    mcbyte MDL Junior Member

    Jul 26, 2009
    94
    1
    0
    this raises the question: how does other bootloaders emulate slic? to let windows see a slic in the acpi tables there should be only 1 method, it follows the chain, so normal loaders should do the same thing?
     
  7. Violin

    Violin MDL Novice

    May 23, 2008
    7
    0
    0
    I can't agree with you more. For Vista lo*der, I find it hard to contact the author. Actually I cannot find the initial source, i.e. where the author publish Vista lo*der. In China, there are many many rubbish websites that merely copy articles. So a googling just gives you a confusing result, from which it is difficult to pick out the genuine initial source.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  8. Violin

    Violin MDL Novice

    May 23, 2008
    7
    0
    0
    I think it can't be like that. You can't achieve the goal by redirection, because the code will be erased once Windows NT starts and enters the protected mode. That's my limited view. Please forgive me if you find that a silly one.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  9. Violin

    Violin MDL Novice

    May 23, 2008
    7
    0
    0
    Wow, you are the great one. We must thank you, for you have helped lots of people here, and so have other members of your team.
    And we hope that your team can teach us how to make a lo*der in depth. Though I only know a little ASM, I can learn. And there are so many people in this cummunity, among which there is sure to be some people who can help make a better lo*der.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  10. peterpaulw

    peterpaulw MDL Novice

    Dec 2, 2007
    36
    0
    0
    #12 peterpaulw, Aug 5, 2009
    Last edited by a moderator: Apr 20, 2017
    I've got the source code of WOW7, well sort of ;-)

    Thanks Yen for sharing your insights. Its a shame, that you don't have access to the source code, having spent so much time on the design. Maybe Flagmax could still be contacted? Having the design flowchart would already be a great help, I'm sure. Knowing that WOW it was written in assembler is also nice, as it is quite easy to disassemble the code and learn from that. Its only a 4000 Byte executable DOS MZ, so it should be possible to follow the code.

    Anyways here is the source code of WOW7 - well sort of ;) :
    Code:
    
    ;
    ; +-------------------------------------------------------------------------+
    ; |This file is generated by The Interactive Disassembler (IDA)    |
    ; |                                                                    |
    ; +-------------------------------------------------------------------------+
    ;
    ; InputMD5   :18C44B80FB63441F38CD0AFE8079DEAA
    
    ; File Name   :WOW.EXE
    ; Format      :MS-DOS executable (EXE)
    ; Base Address:0h Range: 0h-F70h Loaded length: B61h
    ; EntryPoint :0:10
    
    .386
    .model large
    
    ; ===========================================================================
    
    ; Segment type:Pure code
    seg000segmentbyte public 'CODE' use16
    assume cs:seg000
    assume es:nothing, ss:nothing, ds:dseg,fs:nothing, gs:nothing
    db 10h dup(0)
    assume ss:seg002, ds:nothing
    
    ; =============== S U BR O U TI N E =======================================
    
    ; Attributes: noreturn
    
    public start
    startproc near
    
    ; FUNCTION CHUNK AT 0084 SIZE 00000008 BYTES
    ; FUNCTION CHUNK AT 0095 SIZE 00000369 BYTES
    
    movax, segdseg
    movds, ax
    assume ds:dseg
    movbx, ss
    subbx, ax
    shlbx, 4
    movss, ax
    assume ss:dseg
    addsp, bx
    pushcs
    popds
    assume ds:seg000
    callsub_B20
    jbshort loc_84
    callsub_6ED
    callsub_9CE
    jbshort loc_73
    pushcs
    popds
    leabx, byte_7DD
    moveax, cs:[bx]
    cmpeax, 0
    jzshort loc_60
    leabx, byte_7D9
    movesi, cs:[bx]
    cmpesi, eax
    jlshort loc_56
    leabx, byte_805
    movcs:[bx], eax
    jmpshort loc_95
    ; ---------------------------------------------------------------------------
    
    loc_56:; CODE XREF: start+3Aj
    leabx, byte_805
    movcs:[bx], esi
    jmpshort loc_95
    ; ---------------------------------------------------------------------------
    
    loc_60:; CODE XREF: start+2Dj
    leabx, byte_7D9
    movesi, cs:[bx]
    leabx, byte_805
    movcs:[bx], esi
    jmploc_207
    ; ---------------------------------------------------------------------------
    
    loc_73:; CODE XREF: start+1Dj
    pusha
    callsub_7B
    startendp ; sp-analysis failed
    
    ; ---------------------------------------------------------------------------
    and[di], cl
    orah, [si]
    
    ; =============== S U BR O U TI N E =======================================
    
    ; Attributes: noreturn
    
    sub_7Bproc near; CODE XREF: start+64p
    movah, 9
    popdx
    int21h; DOS -PRINT STRING
    ; DS:DX-> string terminated by"$"
    popa
    jmploc_406
    sub_7Bendp ; sp-analysis failed
    
    ; ---------------------------------------------------------------------------
    ; STARTOF FUNCTION CHUNK FOR start
    
    loc_84:; CODE XREF: start+15j
    pusha
    callsub_8C
    ; ---------------------------------------------------------------------------
    and[di], cl
    orah, [si]
    ; END OF FUNCTION CHUNKFOR start
    
    ; =============== S U BR O U TI N E =======================================
    
    ; Attributes: noreturn
    
    sub_8Cproc near; CODE XREF: start+75p
    movah, 9
    popdx
    int21h; DOS -PRINT STRING
    ; DS:DX-> string terminated by"$"
    popa
    jmploc_406
    sub_8Cendp ; sp-analysis failed
    
    ; ---------------------------------------------------------------------------
    ; STARTOF FUNCTION CHUNK FOR start
    
    loc_95:; CODE XREF: start+44jstart+4Ej
    callsub_56F
    cmpeax, 1
    jnzshort loc_BC
    callsub_73E
    callsub_535
    callsub_716
    callsub_535
    callsub_47D
    callsub_523
    callsub_716
    callsub_523
    callsub_47D
    jmploc_406
    ; ---------------------------------------------------------------------------
    
    loc_BC:; CODE XREF: start+8Cj
    callsub_535
    movecx, gs:[edi]
    cmpecx, 0
    jnzshort loc_128
    movecx, gs:[edi+4]
    cmpecx, 0
    jnzshort loc_128
    
    loc_D6:; CODE XREF: start+189j start+19Aj
    callsub_547
    cmpeax, 0
    jzloc_406
    callsub_73E
    callsub_535
    leabx, byte_809
    moveax, cs:[bx]
    movgs:[edi], eax
    xoreax, eax
    movgs:[edi+4], eax
    moveax, gs:[esi+4]
    addeax, 8
    movgs:[esi+4], eax
    callsub_535
    callsub_716
    callsub_535
    callsub_47D
    callsub_523
    callsub_716
    callsub_523
    callsub_47D
    jmploc_406
    ; ---------------------------------------------------------------------------
    
    loc_128:; CODE XREF: start+B8jstart+C4j
    callsub_535
    moveax, edi
    callsub_4DD
    cmpeax, 1
    jnzshort loc_1AD
    leabx, byte_801
    movcs:[bx], esi
    callsub_535
    moveax, gs:[edi+4]
    leabx, byte_805
    movesi, cs:[bx]
    callsub_44A
    cmpeax, 0
    jzloc_406
    leabx, byte_805
    movcs:[bx], esi
    callsub_535
    leabx, byte_805
    movesi, cs:[bx]
    movebx, eax
    callsub_50B
    leabx, byte_805
    movesi, cs:[bx]
    leabx, byte_801
    moveax, cs:[bx]
    movgs:[eax], esi
    callsub_535
    moveax, edi
    callsub_523
    callsub_4AF
    cmpeax, 1
    jnzloc_D6
    leabx, byte_805
    moveax, cs:[bx]
    movgs:[esi], eax
    jmploc_D6
    ; ---------------------------------------------------------------------------
    
    loc_1AD:; CODE XREF: start+125j
    callsub_651
    cmpeax, 1
    jzshort loc_1C1
    callsub_684
    cmpeax, 1
    jnzloc_406
    
    loc_1C1:; CODE XREF: start+1A4j
    leabx, byte_7F5
    movcs:[bx], esi
    callsub_547
    cmpeax, 0
    jzloc_406
    callsub_73E
    leabx, byte_7F5
    moveax, cs:[bx]
    leabx, byte_809
    movesi, cs:[bx]
    movgs:[eax], esi
    callsub_535
    callsub_716
    callsub_535
    callsub_47D
    callsub_523
    callsub_716
    callsub_523
    callsub_47D
    jmploc_406
    ; ---------------------------------------------------------------------------
    
    loc_207:; CODE XREF: start+60j
    callsub_5AD
    cmpeax, 1
    jnzshort loc_222
    callsub_73E
    callsub_523
    callsub_716
    callsub_523
    callsub_47D
    jmploc_406
    ; ---------------------------------------------------------------------------
    
    loc_222:; CODE XREF: start+1FEj
    callsub_523
    movecx, gs:[edi]
    cmpecx, 0
    jnzshort loc_26D
    
    loc_230:; CODE XREF: start+2BEj start+3C8j
    callsub_547
    cmpeax, 0
    jzloc_3DB
    callsub_73E
    callsub_523
    leabx, byte_809
    moveax, cs:[bx]
    movgs:[edi], eax
    moveax, gs:[esi+4]
    addeax, 4
    movgs:[esi+4], eax
    callsub_523
    callsub_716
    callsub_523
    callsub_47D
    jmploc_406
    ; ---------------------------------------------------------------------------
    
    loc_26D:; CODE XREF: start+21Ej
    callsub_523
    moveax, edi
    callsub_4AF
    cmpeax, 1
    jnzshort loc_2D1
    leabx, byte_801
    movcs:[bx], esi
    callsub_523
    moveax, gs:[edi+4]
    leabx, byte_805
    movesi, cs:[bx]
    callsub_44A
    cmpeax, 0
    jzloc_406
    leabx, byte_805
    movcs:[bx], esi
    callsub_523
    leabx, byte_805
    movesi, cs:[bx]
    movebx, eax
    callsub_50B
    leabx, byte_805
    movesi, cs:[bx]
    leabx, byte_801
    moveax, cs:[bx]
    movgs:[eax], esi
    jmploc_230
    ; ---------------------------------------------------------------------------
    
    loc_2D1:; CODE XREF: start+26Aj
    callsub_5EB
    cmpeax, 1
    jzshort loc_2E3
    callsub_61E
    cmpeax, 1
    jnzshort loc_31D
    
    loc_2E3:; CODE XREF: start+2C8j
    leabx, byte_7F5
    movcs:[bx], esi
    callsub_547
    cmpeax, 0
    jzloc_406
    callsub_73E
    leabx, byte_7F5
    moveax, cs:[bx]
    leabx, byte_809
    movesi, cs:[bx]
    movgs:[eax], esi
    callsub_523
    callsub_716
    callsub_523
    callsub_47D
    jmploc_406
    ; ---------------------------------------------------------------------------
    
    loc_31D:; CODE XREF: start+2D1j
    callsub_6B7
    cmpeax, 1
    jnzloc_3DB
    leabx, byte_7E9
    movcs:[bx], esi
    moveax, gs:[esi+28h]
    leabx, byte_7ED
    movcs:[bx], eax
    callsub_523
    movecx, gs:[edi]
    cmpecx, 54445344h
    jnzloc_3DB
    leabx, byte_805
    movesi, cs:[bx]
    leabx, byte_7ED
    movedi, cs:[bx]
    moveax, gs:[edi+4]
    callsub_44A
    cmpeax, 0
    jzshort loc_3DB
    leabx, byte_805
    movcs:[bx], esi
    leabx, byte_7ED
    movedi, cs:[bx]
    movebx, eax
    callsub_50B
    leabx, byte_805
    movesi, cs:[bx]
    leabx, byte_7ED
    movedi, cs:[bx]
    callsub_7AE
    cmpecx, 1
    jnzshort loc_3DB
    leabx, byte_7E9
    movesi, cs:[bx]
    leabx, byte_7ED
    movedi, cs:[bx]
    cmpgs:[esi+28h], edi
    jnzshort loc_3DB
    leabx, byte_7E9
    movesi, cs:[bx]
    leabx, byte_805
    moveax, cs:[bx]
    movgs:[esi+28h], eax
    leabx, byte_7E9
    movesi, cs:[bx]
    callsub_47D
    jmploc_230
    ; ---------------------------------------------------------------------------
    
    loc_3DB:; CODE XREF: start+227j start+314j ...
    pusha
    callnear ptr loc_3EF+1
    ; ---------------------------------------------------------------------------
    and[bp+si], ch
    subch, [bp+si]
    and[bp+61h], al
    imulbp, [si+75h], 6572h
    and[bp+si], ch
    subch, [bp+si]
    
    loc_3EF:; CODE XREF: start+3CCp
    andal, 0B4h
    or[bp+si-33h], bx
    and[bx+di+60h], sp
    callsub_3FE
    ; ---------------------------------------------------------------------------
    and[di], cl
    orah, [si]
    ; END OF FUNCTION CHUNKFOR start
    
    ; =============== S U BR O U TI N E =======================================
    
    ; Attributes: noreturn
    
    sub_3FEproc near; CODE XREF: start+3E7p
    movah, 9
    popdx
    int21h; DOS -PRINT STRING
    ; DS:DX-> string terminated by"$"
    popa
    jmpshort $+2
    
    loc_406:; CODE XREF: sub_7B+6jsub_8C+6j ...
    movax, 4C01h
    int21h; DOS -2+ - QUIT WITH EXIT CODE (EXIT)
    sub_3FEendp ; sp-analysis failed ; AL = exit code
    
    ; ---------------------------------------------------------------------------
    db 60h,66h, 83h, 0EEh,8, 66h,83h, 0C7h, 8, 67h, 65h
    db 8Ah,6, 66h,46h, 0B9h, 2, 0, 0E8h, 8Eh, 6, 60h, 0E8h
    db 2, 0, 20h, 24h, 0B4h, 9, 5Ah, 0CDh, 21h, 61h, 66h, 3Bh
    db 0F7h, 75h, 0E3h, 60h, 0E8h, 4, 0, 20h, 0Dh, 0Ah, 24h
    db 0B4h, 9, 5Ah, 0CDh, 21h, 2 dup(61h),0C3h, 60h, 0B9h
    db 8, 0, 0E8h, 66h, 6, 61h, 0C3h
    
    ; =============== S U BR O U TI N E =======================================
    
    
    sub_44Aproc near; CODE XREF: start+140p start+285p ...
    xoredx, edx
    movebx, esi
    subebx, 100000h
    
    loc_457:; CODE XREF: sub_44A+22j sub_44A+2Aj
    cmpedx, eax
    jzshort locret_47C
    incedx
    decesi
    cmpesi, ebx
    jlshort loc_476
    movcl, gs:[esi]
    cmpcl, 0
    jzshort loc_457
    movedx, 0
    jmpshort loc_457
    ; ---------------------------------------------------------------------------
    
    loc_476:; CODE XREF: sub_44A+19j
    moveax, 0
    
    locret_47C:; CODE XREF: sub_44A+10j
    retn
    sub_44Aendp
    
    
    ; =============== S U BR O U TI N E =======================================
    
    
    sub_47Dproc near; CODE XREF: start+9Apstart+A6p ...
    moval, 0
    movgs:[esi+9], al
    movedi, gs:[esi+4]
    addedi, esi
    xoreax, eax
    xorecx, ecx
    pushesi
    
    loc_495:; CODE XREF: sub_47D+23j
    moval, gs:[esi]
    addcl, al
    incesi
    cmpesi, edi
    jnzshort loc_495
    popesi
    xorcl, 0FFh
    inccl
    movgs:[esi+9], cl
    retn
    sub_47Dendp
    
    
    ; =============== S U BR O U TI N E =======================================
    
    
    sub_4AFproc near; CODE XREF: start+182p start+263p
    movedi, gs:[esi+4]
    addedi, esi
    addesi, 24h ; '$'
    subesi, 4
    subedi, 4
    
    loc_4C4:; CODE XREF: sub_4AF+23j
    addesi, 4
    cmpgs:[esi], eax
    jzshort loc_4D6
    cmpesi, edi
    jleshort loc_4C4
    jmpshort locret_4DC
    ; ---------------------------------------------------------------------------
    
    loc_4D6:; CODE XREF: sub_4AF+1Ej
    moveax, 1
    
    locret_4DC:; CODE XREF: sub_4AF+25j
    retn
    sub_4AFendp
    
    
    ; =============== S U BR O U TI N E =======================================
    
    
    sub_4DDproc near; CODE XREF: start+11Ep
    movedi, gs:[esi+4]
    addedi, esi
    addesi, 24h ; '$'
    subesi, 8
    subesi, 8
    
    loc_4F2:; CODE XREF: sub_4DD+23j
    addesi, 8
    cmpgs:[esi], eax
    jzshort loc_504
    cmpesi, edi
    jleshort loc_4F2
    jmpshort locret_50A
    ; ---------------------------------------------------------------------------
    
    loc_504:; CODE XREF: sub_4DD+1Ej
    moveax, 1
    
    locret_50A:; CODE XREF: sub_4DD+25j
    retn
    sub_4DDendp
    
    
    ; =============== S U BR O U TI N E =======================================
    
    
    sub_50Bproc near; CODE XREF: start+161p start+2A6p ...
    xoreax, eax
    moval, gs:[edi]
    movgs:[esi], al
    incesi
    incedi
    decebx
    cmpebx, 0
    jnzshort sub_50B
    retn
    sub_50Bendp
    
    
    ; =============== S U BR O U TI N E =======================================
    
    
    sub_523proc near; CODE XREF: start+9Dpstart+A3p ...
    leabx, byte_7D9
    movesi, cs:[bx]
    movedi, gs:[esi+4]
    addedi, esi
    retn
    sub_523endp
    
    
    ; =============== S U BR O U TI N E =======================================
    
    
    sub_535proc near; CODE XREF: start+91pstart+97p ...
    leabx, byte_7DD
    movesi, cs:[bx]
    movedi, gs:[esi+4]
    addedi, esi
    retn
    sub_535endp
    
    
    ; =============== S U BR O U TI N E =======================================
    
    
    sub_547proc near; CODE XREF: start:loc_D6p start+1B9p...
    leabx, byte_805
    movesi, cs:[bx]
    moveax, 176h
    callsub_44A
    cmpeax, 0
    jzshort locret_56E
    leabx, byte_809
    movcs:[bx], esi
    leabx, byte_805
    movcs:[bx], esi
    
    locret_56E:; CODE XREF: sub_547+15j
    retn
    sub_547endp
    
    
    ; =============== S U BR O U TI N E =======================================
    
    
    sub_56Fproc near; CODE XREF: start:loc_95p
    xoreax, eax
    callsub_535
    addesi, 24h ; '$'
    subesi, 8
    subedi, 8
    
    loc_581:; CODE XREF: sub_56F+29j
    addesi, 8
    movecx, gs:[esi]
    cmpdword ptr gs:[ecx], 43494C53h
    jzshort loc_59B
    cmpesi, edi
    jnzshort loc_581
    retn
    ; ---------------------------------------------------------------------------
    
    loc_59B:; CODE XREF: sub_56F+24j
    moveax, 1
    movesi, ecx
    leabx, byte_809
    movcs:[bx], esi
    retn
    sub_56Fendp
    
    
    ; =============== S U BR O U TI N E =======================================
    
    
    sub_5ADproc near; CODE XREF: start:loc_207p
    xoreax, eax
    callsub_523
    addesi, 24h ; '$'
    subesi, 4
    subedi, 4
    
    loc_5BF:; CODE XREF: sub_5AD+29j
    addesi, 4
    movecx, gs:[esi]
    cmpdword ptr gs:[ecx], 43494C53h
    jzshort loc_5D9
    cmpesi, edi
    jnzshort loc_5BF
    retn
    ; ---------------------------------------------------------------------------
    
    loc_5D9:; CODE XREF: sub_5AD+24j
    moveax, 1
    movesi, ecx
    leabx, byte_809
    movcs:[bx], esi
    retn
    sub_5ADendp
    
    
    ; =============== S U BR O U TI N E =======================================
    
    
    sub_5EBproc near; CODE XREF: start:loc_2D1p
    xoreax, eax
    callsub_523
    addesi, 24h ; '$'
    subesi, 4
    subedi, 4
    
    loc_5FD:; CODE XREF: sub_5EB+29j
    addesi, 4
    movecx, gs:[esi]
    cmpdword ptr gs:[ecx], 4746434Dh
    jzshort loc_617
    cmpesi, edi
    jnzshort loc_5FD
    retn
    ; ---------------------------------------------------------------------------
    
    loc_617:; CODE XREF: sub_5EB+24j
    moveax, 1
    retn
    sub_5EBendp
    
    
    ; =============== S U BR O U TI N E =======================================
    
    
    sub_61Eproc near; CODE XREF: start+2CAp
    xoreax, eax
    callsub_523
    addesi, 24h ; '$'
    subesi, 4
    subedi, 4
    
    loc_630:; CODE XREF: sub_61E+29j
    addesi, 4
    movecx, gs:[esi]
    cmpdword ptr gs:[ecx], 544F4F42h
    jzshort loc_64A
    cmpesi, edi
    jnzshort loc_630
    retn
    ; ---------------------------------------------------------------------------
    
    loc_64A:; CODE XREF: sub_61E+24j
    moveax, 1
    retn
    sub_61Eendp
    
    
    ; =============== S U BR O U TI N E =======================================
    
    
    sub_651proc near; CODE XREF: start:loc_1ADp
    xoreax, eax
    callsub_535
    addesi, 24h ; '$'
    subesi, 8
    subedi, 8
    
    loc_663:; CODE XREF: sub_651+29j
    addesi, 8
    movecx, gs:[esi]
    cmpdword ptr gs:[ecx], 4746434Dh
    jzshort loc_67D
    cmpesi, edi
    jnzshort loc_663
    retn
    ; ---------------------------------------------------------------------------
    
    loc_67D:; CODE XREF: sub_651+24j
    moveax, 1
    retn
    sub_651endp
    
    
    ; =============== S U BR O U TI N E =======================================
    
    
    sub_684proc near; CODE XREF: start+1A6p
    xoreax, eax
    callsub_535
    addesi, 24h ; '$'
    subesi, 8
    subedi, 8
    
    loc_696:; CODE XREF: sub_684+29j
    addesi, 8
    movecx, gs:[esi]
    cmpdword ptr gs:[ecx], 544F4F42h
    jzshort loc_6B0
    cmpesi, edi
    jnzshort loc_696
    retn
    ; ---------------------------------------------------------------------------
    
    loc_6B0:; CODE XREF: sub_684+24j
    moveax, 1
    retn
    sub_684endp
    
    
    ; =============== S U BR O U TI N E =======================================
    
    
    sub_6B7proc near; CODE XREF: start:loc_31Dp
    xoreax, eax
    callsub_523
    addesi, 24h ; '$'
    subesi, 4
    subedi, 4
    
    loc_6C9:; CODE XREF: sub_6B7+29j
    addesi, 4
    movecx, gs:[esi]
    cmpdword ptr gs:[ecx], 50434146h
    jzshort loc_6E3
    cmpesi, edi
    jnzshort loc_6C9
    retn
    ; ---------------------------------------------------------------------------
    
    loc_6E3:; CODE XREF: sub_6B7+24j
    moveax, 1
    movesi, ecx
    retn
    sub_6B7endp
    
    
    ; =============== S U BR O U TI N E =======================================
    
    
    sub_6EDproc near; CODE XREF: start+17p
    moveax, es:[di+10h]
    leabx, byte_7D9
    movcs:[bx], eax
    moval, es:[di+0Fh]
    cmpal, 2
    jnzshort locret_715
    moveax, es:[di+18h]
    cmpeax, 0
    jzshort locret_715
    leabx, byte_7DD
    movcs:[bx], eax
    
    locret_715:; CODE XREF: sub_6ED+13j sub_6ED+1Ej
    retn
    sub_6EDendp
    
    
    ; =============== S U BR O U TI N E =======================================
    
    
    sub_716proc near; CODE XREF: start+94pstart+A0p ...
    addesi, 0Ah
    movedi, 0Eh
    addedi, esi
    leaebx, aHpqoemslicMpc ; "HPQOEMSLIC-MPC"
    
    loc_728:; CODE XREF: sub_716+25j
    xoreax, eax
    moveax, cs:[ebx]
    movgs:[esi], al
    incesi
    incebx
    cmpesi, edi
    jnzshort loc_728
    retn
    sub_716endp
    
    
    ; =============== S U BR O U TI N E =======================================
    
    
    sub_73Eproc near; CODE XREF: start+8Epstart+D1p ...
    leabx, byte_809
    movesi, cs:[bx]
    movedi, 176h
    addedi, esi
    leaebx, byte_858
    movedx, 0
    
    loc_75A:; CODE XREF: sub_73E+30j
    xoreax, eax
    moveax, cs:[edx+ebx]
    movgs:[esi], al
    incesi
    incedx
    cmpesi, edi
    jnzshort loc_75A
    leabx, byte_809
    movesi, cs:[bx]
    moval, 0
    movgs:[esi+9], al
    movedi, 176h
    addedi, esi
    xoreax, eax
    xorecx, ecx
    
    loc_78E:; CODE XREF: sub_73E+5Bj
    moval, gs:[esi]
    addcl, al
    incesi
    cmpesi, edi
    jnzshort loc_78E
    leabx, byte_809
    movesi, cs:[bx]
    xorcl, 0FFh
    inccl
    movgs:[esi+9], cl
    retn
    sub_73Eendp
    
    
    ; =============== S U BR O U TI N E =======================================
    
    
    sub_7AEproc near; CODE XREF: start+386p
    movecx, gs:[edi+4]
    addecx, edi
    
    loc_7B7:; CODE XREF: sub_7AE+22j
    xoreax, eax
    xorebx, ebx
    moval, gs:[esi]
    movbl, gs:[edi]
    cmpal, bl
    jnzshort locret_7D8
    incesi
    incedi
    cmpedi, ecx
    jnzshort loc_7B7
    movecx, 1
    
    locret_7D8:; CODE XREF: sub_7AE+19j
    retn
    sub_7AEendp
    
    ; ---------------------------------------------------------------------------
    byte_7D9db 4 dup(0); DATA XREF: start+2Fostart:loc_60o ...
    byte_7DDdb 0Ch dup(0); DATA XREF: start+21osub_535o ...
    byte_7E9db 4 dup(0); DATA XREF: start+318o start+38Fo ...
    byte_7EDdb 8 dup(0); DATA XREF: start+326o start+349o ...
    byte_7F5db 0Ch dup(0); DATA XREF: start:loc_1C1o start+1C7o ...
    byte_801db 4 dup(0); DATA XREF: start+127o start+16Co ...
    byte_805db 4 dup(0); DATA XREF: start+3Costart:loc_56o ...
    byte_809db 4 dup(0), 52h, 53h, 44h, 20h, 50h, 54h, 52h,20h, 0
    ; DATA XREF: start+D7ostart+1CFo ...
    db 58h,41h, 4Dh, 47h, 41h, 4Ch, 46h, 1Bh dup(0)
    aHpqoemslicMpcdb 'HPQOEMSLIC-MPC',0   ; DATA XREF: sub_716+Do
    db 11h dup(0)
    byte_858db 53h,4Ch, 49h, 43h, 76h, 1, 2 dup(0), 1, 0ABh, 48h
    ; DATA XREF: sub_73E+11o
    db 50h,51h, 4Fh, 45h, 4Dh, 53h, 4Ch, 49h, 43h,2Dh, 4Dh
    db 50h,43h, 1,3 dup(0), 48h, 50h, 51h, 20h, 1, 7 dup(0)
    db 9Ch,3 dup(0), 6, 2,3 dup(0), 24h, 2 dup(0), 52h, 53h
    db 41h,31h, 0,4, 2 dup(0), 1,0, 1, 0, 5Bh, 0ABh, 60h
    db 56h,0BCh, 58h, 1Eh,0E8h, 0C1h, 0D2h, 0A1h,5Ch, 0E5h
    db 4Fh,0BBh, 0FDh, 1Dh, 0A9h, 8Ch, 94h, 0B4h, 0AEh, 8
    db 11h,0DCh, 13h, 59h,0D3h, 7Fh, 0F6h, 3Eh, 87h, 31h
    db 0B9h, 95h, 74h, 10h,0DAh, 3Bh, 0A4h, 5Bh, 0B5h, 19h
    db 82h,7Ch, 39h, 0D7h,0Dh, 7Ch, 22h, 0ACh, 1Ch, 2Ah
    db 84h,0E9h, 0Ah, 88h,6Dh, 0FAh, 0B1h, 0E2h, 0D8h, 0E8h
    db 21h,96h, 0E1h, 2Eh,68h, 9Ah, 0BFh,44h, 45h, 3Eh
    db 3Ch,8Eh, 99h, 90h, 0DEh, 37h, 38h, 57h, 0Bh, 92h, 15h
    db 0BCh, 0DEh, 0FFh, 0F2h, 7, 7Eh, 0B5h, 40h, 8Ch, 51h
    db 3Ah,0C3h, 2, 48h, 0F6h, 13h, 12h, 72h, 0FBh, 42h, 78h
    db 0E6h, 47h, 88h, 54h,0C7h, 0B0h, 0F0h, 93h, 9Eh, 0FBh
    db 4, 0B7h, 2 dup(0B8h), 90h, 0DEh, 0DBh, 0EDh,32h, 0E1h
    db 0FBh, 54h, 0A6h, 1, 3 dup(0), 0B6h, 5 dup(0), 2, 0
    db 48h,50h, 51h, 4Fh, 45h, 4Dh, 53h, 4Ch, 49h,43h, 2Dh
    db 4Dh,50h, 43h, 57h, 49h, 4Eh, 44h, 4Fh, 57h,53h, 20h
    db 1, 0, 2, 11hdup(0),30h, 90h, 1Fh, 0B4h, 0A4h, 0BEh
    db 80h,1Eh, 0E9h, 33h,0ECh, 7Fh, 0FCh, 0B1h, 28h, 0Eh
    db 0A6h, 0CEh, 43h, 72h, 8Ch, 79h, 30h,0B4h, 0F4h, 59h
    db 0EAh, 7Dh, 0CFh, 0B7h, 11h, 8Bh, 0DAh, 70h, 0C5h, 0C8h
    db 3Fh,79h, 20h, 8, 6Fh, 64h, 0CAh, 7,88h, 0B3h, 0B1h
    db 16h,0B4h, 0BAh, 1Ah, 0F1h, 85h, 52h, 0B1h, 0F5h, 7
    db 55h,0B5h, 70h, 61h,0EFh, 44h, 8Ch,0AAh, 5Fh, 78h
    db 14h,66h, 98h, 9Ch, 0F3h, 58h, 0D8h,0AAh, 48h, 0E0h
    db 37h,0F8h, 0F6h, 0ABh, 64h, 0FAh, 0DAh, 17h,2Ah, 62h
    db 0E3h, 4, 1Dh, 32h, 2Dh, 0D5h, 0EAh, 33h, 66h, 5Ch, 5Bh
    db 3Bh,0Eh, 0F7h, 9, 66h, 42h,32h, 0AAh, 14h,99h, 0C3h
    db 0EEh, 1Ah, 62h, 3Bh,7, 5Fh,0F0h, 48h, 44h,0C4h, 0E6h
    db 32h,59h, 1Fh, 14h, 3Eh, 0F1h, 0B2h,38h
    
    ; =============== S U BR O U TI N E =======================================
    
    
    sub_9CEproc near; CODE XREF: start+1Ap
    pushesi
    callsub_9EB
    jbshort loc_9E8
    callnear ptr byte_A21
    jbshort loc_9E8
    callsub_A8C
    jbshort loc_9E8
    pushax
    movax, cs
    xorax, ax
    movgs, ax
    assume gs:seg000
    popax
    clc
    
    loc_9E8:; CODE XREF: sub_9CE+5j sub_9CE+Aj ...
    popesi
    retn
    sub_9CEendp
    
    
    ; =============== S U BR O U TI N E =======================================
    
    
    sub_9EBproc near; CODE XREF: sub_9CE+2p
    pushax
    movax, 4300h
    int2Fh; - Multiplex -XMS - INSTALLATION CHECK
    ; Return: AL = 80h XMS driver installed
    ; AL <>80h no driver
    cmpal, 80h; '€'
    popax
    stc
    jzshort locret_9F8
    clc
    
    locret_9F8:; CODE XREF: sub_9EB+Aj
    retn
    sub_9EBendp
    
    ; ---------------------------------------------------------------------------
    db 8 dup(0), 3 dup(0FFh), 2 dup(0), 9Ah, 2 dup(0), 3 dup(0FFh)
    db 2 dup(0), 92h, 2 dup(0), 3 dup(0FFh), 2 dup(0), 92h
    db 8Fh,0, 1Fh,0, 0F9h, 9, 4 dup(0)
    byte_A21db 0Fh,20h, 0C0h, 66h,0D1h, 0C8h, 72h, 62h, 8Ch, 0C8h
    ; CODE XREF: sub_9CE+7p
    db 8Eh,0D8h, 66h, 0Fh,0B7h, 0C0h, 66h, 0C1h, 0E0h, 4
    db 66h,1, 6, 1Bh, 0Ah,0Fh, 1,16h, 19h, 0Ah, 8Ch, 0C8h
    db 66h,25h, 2 dup(0FFh), 2 dup(0), 66h, 0C1h, 0E0h, 4
    db 0A3h, 3, 0Ah, 0A3h, 0Bh, 0Ah, 66h, 0C1h, 0C8h, 10h
    db 0A2h, 5, 0Ah, 0A2h, 0Dh, 0Ah, 88h, 26h, 8, 0Ah, 88h
    db 26h,10h, 0Ah, 0FAh,0Fh, 20h, 0C0h,0Ch, 1,0Fh, 22h
    db 0C0h, 0EAh, 71h, 0Ah, 8, 0, 0B8h, 18h, 0, 8Eh, 0D8h
    db 8Eh,0C0h, 8Eh, 0E0h, 8Eh, 0E8h, 0Fh, 20h, 0C0h, 24h
    db 0FEh, 0Fh, 22h, 0C0h, 0EAh, 89h, 0Ah
    dw seg seg000
    ; ---------------------------------------------------------------------------
    clc
    sti
    retn
    
    ; =============== S U BR O U TI N E =======================================
    
    
    sub_A8Cproc near; CODE XREF: sub_9CE+Cp
    pushax
    moval, 0D1h ; 'Ñ'
    out64h, al; AT Keyboard controller 8042.
    callsub_AA5
    moval, 0DFh ; 'ß'
    out60h, al; AT Keyboard controller 8042.
    callsub_AA5
    moval, 0FFh
    out64h, al; AT Keyboard controller 8042.
    ; Resetthe keyboard and start internaldiagnostics
    callsub_AA5
    clc
    popax
    retn
    sub_A8Cendp
    
    
    ; =============== S U BR O U TI N E =======================================
    
    
    sub_AA5proc near; CODE XREF: sub_A8C+5p sub_A8C+Cp ...
    inal, 64h; AT Keyboard controller 8042.
    jmpshort $+2
    andal, 2
    jnzshort sub_AA5
    retn
    sub_AA5endp
    
    ; ---------------------------------------------------------------------------
    pushcx
    pushdx
    pushcx
    xorch, ch
    movdx, 8
    subdx, cx
    movcx, dx
    shlcx, 2
    roleax, cl
    popcx
    
    loc_AC1:; CODE XREF: seg000:0ACDj
    roleax, 4
    movdl, al
    anddl, 0Fh
    callsub_AD2
    looploc_AC1
    popdx
    popcx
    retn
    
    ; =============== S U BR O U TI N E =======================================
    
    
    sub_AD2proc near; CODE XREF: seg000:0ACAp
    pushdx
    adddl, 30h; '0'
    cmpdl, 3Ah; ':'
    jbshort loc_ADE
    adddl, 7
    
    loc_ADE:; CODE XREF: sub_AD2+7j
    pushax
    pushbx
    pushcx
    movah, 2
    int21h; DOS -DISPLAYOUTPUT
    ; DL = character to send to standard output
    popcx
    popbx
    popax
    popdx
    retn
    sub_AD2endp
    
    
    ; =============== S U BR O U TI N E =======================================
    
    
    sub_AEAproc near; CODE XREF: sub_AF8+6p
    pushsi
    pushax
    movcx, 0FFFFh
    
    loc_AEF:; CODE XREF: sub_AEA+9j
    inccx
    lodsb
    cmpal, 0
    jnzshort loc_AEF
    popax
    popsi
    retn
    sub_AEAendp
    
    
    ; =============== S U BR O U TI N E =======================================
    
    
    sub_AF8proc near; CODE XREF: sub_B20+Ep sub_B20+21p ...
    pushsi
    pushdx
    pushcx
    pushbx
    pushax
    pushcx
    callsub_AEA
    movdx, cx
    popcx
    lodsb
    
    loc_B05:; CODE XREF: sub_AF8+1Ej
    repne scasb
    stc
    jcxzshort loc_B1A
    pushsi
    pushdi
    repe cmpsb
    movbx, si
    popdi
    popsi
    subbx, si
    cmpbx, dx
    jlshort loc_B05
    decdi
    clc
    
    loc_B1A:; CODE XREF: sub_AF8+10j
    popax
    popbx
    popcx
    popdx
    popsi
    retn
    sub_AF8endp
    
    
    ; =============== S U BR O U TI N E =======================================
    
    
    sub_B20proc near; CODE XREF: start+12p
    leasi, aRsdPtr; "RSD PTR "
    movax, 0E000h
    moves, ax
    assume es:nothing
    movcx, 0FFFFh
    xordi, di
    callsub_AF8
    jnbshort locret_B57
    leasi, aRsdPtr; "RSD PTR "
    movax, 0F000h
    moves, ax
    assume es:nothing
    movcx, 0FFFFh
    xordi, di
    callsub_AF8
    jnbshort locret_B57
    leasi, aRsdPtr; "RSD PTR "
    movax, 9F00h
    moves, ax
    assume es:nothing
    movcx, 1000h
    xordi, di
    callsub_AF8
    
    locret_B57:; CODE XREF: sub_B20+11j sub_B20+24j
    retn
    sub_B20endp
    
    ; ---------------------------------------------------------------------------
    aRsdPtrdb 'RSD PTR ',0         ; DATA XREF: sub_B20o sub_B20+13o ...
    db ?
    seg000ends
    
    ; ===========================================================================
    
    ; Segment type:Pure data
    dsegsegmentpara public 'DATA' use16
    assume cs:dseg
    ;org 2
    align 10h
    dsegends
    
    ; ===========================================================================
    
    ; Segment type:Uninitialized
    seg002segmentbyte stack 'STACK' use16
    assume cs:seg002
    assume es:nothing, ss:nothing, ds:dseg,fs:nothing, gs:nothing
    db 400hdup(?)
    seg002ends
    
    
    end start
    The disassembler did a pretty good job, but not perfect as you can see. There are still at least four areas which require manual reworking. I hope someone here knows enough x86 assembler to figure it out.

    Violin, would you like to dig into assembly language? Please share what you find out. The Interactive Disassembler (IDA) is probably the best software to use for this purpose. It also creates a nice graph of the application.
     
  11. weinter

    weinter MDL Member

    Feb 19, 2009
    249
    9
    10
    Personally I don't think it is wise to release the source code since it is a crack.
    For all you know Microsoft guys are here and can add it into Windows Defender or circumvent it more quickly if they have a good idea of the source.
     
  12. JFMuggs

    JFMuggs MDL Member

    Jan 13, 2009
    181
    1
    10
    You don't think Microsoft is capable of disassembling any of this stuff on its own if they're really interested? I'm sure they're already quite up on how people are cicumventing their protection schemes. It's not rocket-science.
     
  13. Violin

    Violin MDL Novice

    May 23, 2008
    7
    0
    0
    You've done a great job. How I wish I could handle the code! But I just know a little on 8086 real-mode ASM. And this is quite different as it is 80386 protected-mode ASM, I think.
    I've seen people use IDA to do excellent reverse engineering work. I think human endeavor and experience is indispensable.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...