Currently all existing softmod programs are closed source. The source code of the core program, such as Vista Loader's grldr and WoW's wow.exe (inside the floppy image), is not available. They are all excellent work, but I wish to have a better understanding of softmod. I don't understand how they work. I only know that they patch the memory. Could someone please tell me how to patch the memory to emulate BIOS SLIC, or just point me to some useful materials? If I succeed in making a softmod program, I will release the source code. Thank you!
I'm also interested in wow.exe source codes or something like that, the reason is because I want to add my custom RSDT keys used for cable card and other ones used for SLI but I need the part to adding this into memory.
Hazars method uses a MS boot sector rewriter tool that rewrites a patched version of Grub4Dos which emulates Slic. If you understand the activation principal, you should be able to modify Grub4Dos to redirect all calls to the Slic table to the generated one. Although, you need to have ASM knowledge in order to do this, since bootstrappers must be written in ASM.
Hi, I was one of the cooperator at wow project. I'm no programer and I haven't got any source to share. Flagmax did all the coding. AFAIK WoW was programed in FASM. But I know everything about wow. Most approaches were ideas I had got. You should know about acpi specifications. Basically you have to read / write memory at 4 GB address range. You have to know how the AcpiTables are chained. OSPM-->RSDP--->RSDT/XSDT----->other tables (SLIC) WoW is quite different to vista lo*der. WoW doesn't emulate a SLIC it introduces it like it's just from bios... If you have any further questions feel free to ask. I still have got the flowchart of WoW.
this raises the question: how does other bootloaders emulate slic? to let windows see a slic in the acpi tables there should be only 1 method, it follows the chain, so normal loaders should do the same thing?
I can't agree with you more. For Vista lo*der, I find it hard to contact the author. Actually I cannot find the initial source, i.e. where the author publish Vista lo*der. In China, there are many many rubbish websites that merely copy articles. So a googling just gives you a confusing result, from which it is difficult to pick out the genuine initial source.
I think it can't be like that. You can't achieve the goal by redirection, because the code will be erased once Windows NT starts and enters the protected mode. That's my limited view. Please forgive me if you find that a silly one.
Wow, you are the great one. We must thank you, for you have helped lots of people here, and so have other members of your team. And we hope that your team can teach us how to make a lo*der in depth. Though I only know a little ASM, I can learn. And there are so many people in this cummunity, among which there is sure to be some people who can help make a better lo*der.
I've got the source code of WOW7, well sort of ;-) Thanks Yen for sharing your insights. Its a shame, that you don't have access to the source code, having spent so much time on the design. Maybe Flagmax could still be contacted? Having the design flowchart would already be a great help, I'm sure. Knowing that WOW it was written in assembler is also nice, as it is quite easy to disassemble the code and learn from that. Its only a 4000 Byte executable DOS MZ, so it should be possible to follow the code. Anyways here is the source code of WOW7 - well sort of : Code: ; ; +-------------------------------------------------------------------------+ ; |This file is generated by The Interactive Disassembler (IDA) | ; | | ; +-------------------------------------------------------------------------+ ; ; InputMD5 :18C44B80FB63441F38CD0AFE8079DEAA ; File Name :WOW.EXE ; Format :MS-DOS executable (EXE) ; Base Address:0h Range: 0h-F70h Loaded length: B61h ; EntryPoint :0:10 .386 .model large ; =========================================================================== ; Segment type:Pure code seg000segmentbyte public 'CODE' use16 assume cs:seg000 assume es:nothing, ss:nothing, ds:dseg,fs:nothing, gs:nothing db 10h dup(0) assume ss:seg002, ds:nothing ; =============== S U BR O U TI N E ======================================= ; Attributes: noreturn public start startproc near ; FUNCTION CHUNK AT 0084 SIZE 00000008 BYTES ; FUNCTION CHUNK AT 0095 SIZE 00000369 BYTES movax, segdseg movds, ax assume ds:dseg movbx, ss subbx, ax shlbx, 4 movss, ax assume ss:dseg addsp, bx pushcs popds assume ds:seg000 callsub_B20 jbshort loc_84 callsub_6ED callsub_9CE jbshort loc_73 pushcs popds leabx, byte_7DD moveax, cs:[bx] cmpeax, 0 jzshort loc_60 leabx, byte_7D9 movesi, cs:[bx] cmpesi, eax jlshort loc_56 leabx, byte_805 movcs:[bx], eax jmpshort loc_95 ; --------------------------------------------------------------------------- loc_56:; CODE XREF: start+3Aj leabx, byte_805 movcs:[bx], esi jmpshort loc_95 ; --------------------------------------------------------------------------- loc_60:; CODE XREF: start+2Dj leabx, byte_7D9 movesi, cs:[bx] leabx, byte_805 movcs:[bx], esi jmploc_207 ; --------------------------------------------------------------------------- loc_73:; CODE XREF: start+1Dj pusha callsub_7B startendp ; sp-analysis failed ; --------------------------------------------------------------------------- and[di], cl orah, [si] ; =============== S U BR O U TI N E ======================================= ; Attributes: noreturn sub_7Bproc near; CODE XREF: start+64p movah, 9 popdx int21h; DOS -PRINT STRING ; DS:DX-> string terminated by"$" popa jmploc_406 sub_7Bendp ; sp-analysis failed ; --------------------------------------------------------------------------- ; STARTOF FUNCTION CHUNK FOR start loc_84:; CODE XREF: start+15j pusha callsub_8C ; --------------------------------------------------------------------------- and[di], cl orah, [si] ; END OF FUNCTION CHUNKFOR start ; =============== S U BR O U TI N E ======================================= ; Attributes: noreturn sub_8Cproc near; CODE XREF: start+75p movah, 9 popdx int21h; DOS -PRINT STRING ; DS:DX-> string terminated by"$" popa jmploc_406 sub_8Cendp ; sp-analysis failed ; --------------------------------------------------------------------------- ; STARTOF FUNCTION CHUNK FOR start loc_95:; CODE XREF: start+44jstart+4Ej callsub_56F cmpeax, 1 jnzshort loc_BC callsub_73E callsub_535 callsub_716 callsub_535 callsub_47D callsub_523 callsub_716 callsub_523 callsub_47D jmploc_406 ; --------------------------------------------------------------------------- loc_BC:; CODE XREF: start+8Cj callsub_535 movecx, gs:[edi] cmpecx, 0 jnzshort loc_128 movecx, gs:[edi+4] cmpecx, 0 jnzshort loc_128 loc_D6:; CODE XREF: start+189j start+19Aj callsub_547 cmpeax, 0 jzloc_406 callsub_73E callsub_535 leabx, byte_809 moveax, cs:[bx] movgs:[edi], eax xoreax, eax movgs:[edi+4], eax moveax, gs:[esi+4] addeax, 8 movgs:[esi+4], eax callsub_535 callsub_716 callsub_535 callsub_47D callsub_523 callsub_716 callsub_523 callsub_47D jmploc_406 ; --------------------------------------------------------------------------- loc_128:; CODE XREF: start+B8jstart+C4j callsub_535 moveax, edi callsub_4DD cmpeax, 1 jnzshort loc_1AD leabx, byte_801 movcs:[bx], esi callsub_535 moveax, gs:[edi+4] leabx, byte_805 movesi, cs:[bx] callsub_44A cmpeax, 0 jzloc_406 leabx, byte_805 movcs:[bx], esi callsub_535 leabx, byte_805 movesi, cs:[bx] movebx, eax callsub_50B leabx, byte_805 movesi, cs:[bx] leabx, byte_801 moveax, cs:[bx] movgs:[eax], esi callsub_535 moveax, edi callsub_523 callsub_4AF cmpeax, 1 jnzloc_D6 leabx, byte_805 moveax, cs:[bx] movgs:[esi], eax jmploc_D6 ; --------------------------------------------------------------------------- loc_1AD:; CODE XREF: start+125j callsub_651 cmpeax, 1 jzshort loc_1C1 callsub_684 cmpeax, 1 jnzloc_406 loc_1C1:; CODE XREF: start+1A4j leabx, byte_7F5 movcs:[bx], esi callsub_547 cmpeax, 0 jzloc_406 callsub_73E leabx, byte_7F5 moveax, cs:[bx] leabx, byte_809 movesi, cs:[bx] movgs:[eax], esi callsub_535 callsub_716 callsub_535 callsub_47D callsub_523 callsub_716 callsub_523 callsub_47D jmploc_406 ; --------------------------------------------------------------------------- loc_207:; CODE XREF: start+60j callsub_5AD cmpeax, 1 jnzshort loc_222 callsub_73E callsub_523 callsub_716 callsub_523 callsub_47D jmploc_406 ; --------------------------------------------------------------------------- loc_222:; CODE XREF: start+1FEj callsub_523 movecx, gs:[edi] cmpecx, 0 jnzshort loc_26D loc_230:; CODE XREF: start+2BEj start+3C8j callsub_547 cmpeax, 0 jzloc_3DB callsub_73E callsub_523 leabx, byte_809 moveax, cs:[bx] movgs:[edi], eax moveax, gs:[esi+4] addeax, 4 movgs:[esi+4], eax callsub_523 callsub_716 callsub_523 callsub_47D jmploc_406 ; --------------------------------------------------------------------------- loc_26D:; CODE XREF: start+21Ej callsub_523 moveax, edi callsub_4AF cmpeax, 1 jnzshort loc_2D1 leabx, byte_801 movcs:[bx], esi callsub_523 moveax, gs:[edi+4] leabx, byte_805 movesi, cs:[bx] callsub_44A cmpeax, 0 jzloc_406 leabx, byte_805 movcs:[bx], esi callsub_523 leabx, byte_805 movesi, cs:[bx] movebx, eax callsub_50B leabx, byte_805 movesi, cs:[bx] leabx, byte_801 moveax, cs:[bx] movgs:[eax], esi jmploc_230 ; --------------------------------------------------------------------------- loc_2D1:; CODE XREF: start+26Aj callsub_5EB cmpeax, 1 jzshort loc_2E3 callsub_61E cmpeax, 1 jnzshort loc_31D loc_2E3:; CODE XREF: start+2C8j leabx, byte_7F5 movcs:[bx], esi callsub_547 cmpeax, 0 jzloc_406 callsub_73E leabx, byte_7F5 moveax, cs:[bx] leabx, byte_809 movesi, cs:[bx] movgs:[eax], esi callsub_523 callsub_716 callsub_523 callsub_47D jmploc_406 ; --------------------------------------------------------------------------- loc_31D:; CODE XREF: start+2D1j callsub_6B7 cmpeax, 1 jnzloc_3DB leabx, byte_7E9 movcs:[bx], esi moveax, gs:[esi+28h] leabx, byte_7ED movcs:[bx], eax callsub_523 movecx, gs:[edi] cmpecx, 54445344h jnzloc_3DB leabx, byte_805 movesi, cs:[bx] leabx, byte_7ED movedi, cs:[bx] moveax, gs:[edi+4] callsub_44A cmpeax, 0 jzshort loc_3DB leabx, byte_805 movcs:[bx], esi leabx, byte_7ED movedi, cs:[bx] movebx, eax callsub_50B leabx, byte_805 movesi, cs:[bx] leabx, byte_7ED movedi, cs:[bx] callsub_7AE cmpecx, 1 jnzshort loc_3DB leabx, byte_7E9 movesi, cs:[bx] leabx, byte_7ED movedi, cs:[bx] cmpgs:[esi+28h], edi jnzshort loc_3DB leabx, byte_7E9 movesi, cs:[bx] leabx, byte_805 moveax, cs:[bx] movgs:[esi+28h], eax leabx, byte_7E9 movesi, cs:[bx] callsub_47D jmploc_230 ; --------------------------------------------------------------------------- loc_3DB:; CODE XREF: start+227j start+314j ... pusha callnear ptr loc_3EF+1 ; --------------------------------------------------------------------------- and[bp+si], ch subch, [bp+si] and[bp+61h], al imulbp, [si+75h], 6572h and[bp+si], ch subch, [bp+si] loc_3EF:; CODE XREF: start+3CCp andal, 0B4h or[bp+si-33h], bx and[bx+di+60h], sp callsub_3FE ; --------------------------------------------------------------------------- and[di], cl orah, [si] ; END OF FUNCTION CHUNKFOR start ; =============== S U BR O U TI N E ======================================= ; Attributes: noreturn sub_3FEproc near; CODE XREF: start+3E7p movah, 9 popdx int21h; DOS -PRINT STRING ; DS:DX-> string terminated by"$" popa jmpshort $+2 loc_406:; CODE XREF: sub_7B+6jsub_8C+6j ... movax, 4C01h int21h; DOS -2+ - QUIT WITH EXIT CODE (EXIT) sub_3FEendp ; sp-analysis failed ; AL = exit code ; --------------------------------------------------------------------------- db 60h,66h, 83h, 0EEh,8, 66h,83h, 0C7h, 8, 67h, 65h db 8Ah,6, 66h,46h, 0B9h, 2, 0, 0E8h, 8Eh, 6, 60h, 0E8h db 2, 0, 20h, 24h, 0B4h, 9, 5Ah, 0CDh, 21h, 61h, 66h, 3Bh db 0F7h, 75h, 0E3h, 60h, 0E8h, 4, 0, 20h, 0Dh, 0Ah, 24h db 0B4h, 9, 5Ah, 0CDh, 21h, 2 dup(61h),0C3h, 60h, 0B9h db 8, 0, 0E8h, 66h, 6, 61h, 0C3h ; =============== S U BR O U TI N E ======================================= sub_44Aproc near; CODE XREF: start+140p start+285p ... xoredx, edx movebx, esi subebx, 100000h loc_457:; CODE XREF: sub_44A+22j sub_44A+2Aj cmpedx, eax jzshort locret_47C incedx decesi cmpesi, ebx jlshort loc_476 movcl, gs:[esi] cmpcl, 0 jzshort loc_457 movedx, 0 jmpshort loc_457 ; --------------------------------------------------------------------------- loc_476:; CODE XREF: sub_44A+19j moveax, 0 locret_47C:; CODE XREF: sub_44A+10j retn sub_44Aendp ; =============== S U BR O U TI N E ======================================= sub_47Dproc near; CODE XREF: start+9Apstart+A6p ... moval, 0 movgs:[esi+9], al movedi, gs:[esi+4] addedi, esi xoreax, eax xorecx, ecx pushesi loc_495:; CODE XREF: sub_47D+23j moval, gs:[esi] addcl, al incesi cmpesi, edi jnzshort loc_495 popesi xorcl, 0FFh inccl movgs:[esi+9], cl retn sub_47Dendp ; =============== S U BR O U TI N E ======================================= sub_4AFproc near; CODE XREF: start+182p start+263p movedi, gs:[esi+4] addedi, esi addesi, 24h ; '$' subesi, 4 subedi, 4 loc_4C4:; CODE XREF: sub_4AF+23j addesi, 4 cmpgs:[esi], eax jzshort loc_4D6 cmpesi, edi jleshort loc_4C4 jmpshort locret_4DC ; --------------------------------------------------------------------------- loc_4D6:; CODE XREF: sub_4AF+1Ej moveax, 1 locret_4DC:; CODE XREF: sub_4AF+25j retn sub_4AFendp ; =============== S U BR O U TI N E ======================================= sub_4DDproc near; CODE XREF: start+11Ep movedi, gs:[esi+4] addedi, esi addesi, 24h ; '$' subesi, 8 subesi, 8 loc_4F2:; CODE XREF: sub_4DD+23j addesi, 8 cmpgs:[esi], eax jzshort loc_504 cmpesi, edi jleshort loc_4F2 jmpshort locret_50A ; --------------------------------------------------------------------------- loc_504:; CODE XREF: sub_4DD+1Ej moveax, 1 locret_50A:; CODE XREF: sub_4DD+25j retn sub_4DDendp ; =============== S U BR O U TI N E ======================================= sub_50Bproc near; CODE XREF: start+161p start+2A6p ... xoreax, eax moval, gs:[edi] movgs:[esi], al incesi incedi decebx cmpebx, 0 jnzshort sub_50B retn sub_50Bendp ; =============== S U BR O U TI N E ======================================= sub_523proc near; CODE XREF: start+9Dpstart+A3p ... leabx, byte_7D9 movesi, cs:[bx] movedi, gs:[esi+4] addedi, esi retn sub_523endp ; =============== S U BR O U TI N E ======================================= sub_535proc near; CODE XREF: start+91pstart+97p ... leabx, byte_7DD movesi, cs:[bx] movedi, gs:[esi+4] addedi, esi retn sub_535endp ; =============== S U BR O U TI N E ======================================= sub_547proc near; CODE XREF: start:loc_D6p start+1B9p... leabx, byte_805 movesi, cs:[bx] moveax, 176h callsub_44A cmpeax, 0 jzshort locret_56E leabx, byte_809 movcs:[bx], esi leabx, byte_805 movcs:[bx], esi locret_56E:; CODE XREF: sub_547+15j retn sub_547endp ; =============== S U BR O U TI N E ======================================= sub_56Fproc near; CODE XREF: start:loc_95p xoreax, eax callsub_535 addesi, 24h ; '$' subesi, 8 subedi, 8 loc_581:; CODE XREF: sub_56F+29j addesi, 8 movecx, gs:[esi] cmpdword ptr gs:[ecx], 43494C53h jzshort loc_59B cmpesi, edi jnzshort loc_581 retn ; --------------------------------------------------------------------------- loc_59B:; CODE XREF: sub_56F+24j moveax, 1 movesi, ecx leabx, byte_809 movcs:[bx], esi retn sub_56Fendp ; =============== S U BR O U TI N E ======================================= sub_5ADproc near; CODE XREF: start:loc_207p xoreax, eax callsub_523 addesi, 24h ; '$' subesi, 4 subedi, 4 loc_5BF:; CODE XREF: sub_5AD+29j addesi, 4 movecx, gs:[esi] cmpdword ptr gs:[ecx], 43494C53h jzshort loc_5D9 cmpesi, edi jnzshort loc_5BF retn ; --------------------------------------------------------------------------- loc_5D9:; CODE XREF: sub_5AD+24j moveax, 1 movesi, ecx leabx, byte_809 movcs:[bx], esi retn sub_5ADendp ; =============== S U BR O U TI N E ======================================= sub_5EBproc near; CODE XREF: start:loc_2D1p xoreax, eax callsub_523 addesi, 24h ; '$' subesi, 4 subedi, 4 loc_5FD:; CODE XREF: sub_5EB+29j addesi, 4 movecx, gs:[esi] cmpdword ptr gs:[ecx], 4746434Dh jzshort loc_617 cmpesi, edi jnzshort loc_5FD retn ; --------------------------------------------------------------------------- loc_617:; CODE XREF: sub_5EB+24j moveax, 1 retn sub_5EBendp ; =============== S U BR O U TI N E ======================================= sub_61Eproc near; CODE XREF: start+2CAp xoreax, eax callsub_523 addesi, 24h ; '$' subesi, 4 subedi, 4 loc_630:; CODE XREF: sub_61E+29j addesi, 4 movecx, gs:[esi] cmpdword ptr gs:[ecx], 544F4F42h jzshort loc_64A cmpesi, edi jnzshort loc_630 retn ; --------------------------------------------------------------------------- loc_64A:; CODE XREF: sub_61E+24j moveax, 1 retn sub_61Eendp ; =============== S U BR O U TI N E ======================================= sub_651proc near; CODE XREF: start:loc_1ADp xoreax, eax callsub_535 addesi, 24h ; '$' subesi, 8 subedi, 8 loc_663:; CODE XREF: sub_651+29j addesi, 8 movecx, gs:[esi] cmpdword ptr gs:[ecx], 4746434Dh jzshort loc_67D cmpesi, edi jnzshort loc_663 retn ; --------------------------------------------------------------------------- loc_67D:; CODE XREF: sub_651+24j moveax, 1 retn sub_651endp ; =============== S U BR O U TI N E ======================================= sub_684proc near; CODE XREF: start+1A6p xoreax, eax callsub_535 addesi, 24h ; '$' subesi, 8 subedi, 8 loc_696:; CODE XREF: sub_684+29j addesi, 8 movecx, gs:[esi] cmpdword ptr gs:[ecx], 544F4F42h jzshort loc_6B0 cmpesi, edi jnzshort loc_696 retn ; --------------------------------------------------------------------------- loc_6B0:; CODE XREF: sub_684+24j moveax, 1 retn sub_684endp ; =============== S U BR O U TI N E ======================================= sub_6B7proc near; CODE XREF: start:loc_31Dp xoreax, eax callsub_523 addesi, 24h ; '$' subesi, 4 subedi, 4 loc_6C9:; CODE XREF: sub_6B7+29j addesi, 4 movecx, gs:[esi] cmpdword ptr gs:[ecx], 50434146h jzshort loc_6E3 cmpesi, edi jnzshort loc_6C9 retn ; --------------------------------------------------------------------------- loc_6E3:; CODE XREF: sub_6B7+24j moveax, 1 movesi, ecx retn sub_6B7endp ; =============== S U BR O U TI N E ======================================= sub_6EDproc near; CODE XREF: start+17p moveax, es:[di+10h] leabx, byte_7D9 movcs:[bx], eax moval, es:[di+0Fh] cmpal, 2 jnzshort locret_715 moveax, es:[di+18h] cmpeax, 0 jzshort locret_715 leabx, byte_7DD movcs:[bx], eax locret_715:; CODE XREF: sub_6ED+13j sub_6ED+1Ej retn sub_6EDendp ; =============== S U BR O U TI N E ======================================= sub_716proc near; CODE XREF: start+94pstart+A0p ... addesi, 0Ah movedi, 0Eh addedi, esi leaebx, aHpqoemslicMpc ; "HPQOEMSLIC-MPC" loc_728:; CODE XREF: sub_716+25j xoreax, eax moveax, cs:[ebx] movgs:[esi], al incesi incebx cmpesi, edi jnzshort loc_728 retn sub_716endp ; =============== S U BR O U TI N E ======================================= sub_73Eproc near; CODE XREF: start+8Epstart+D1p ... leabx, byte_809 movesi, cs:[bx] movedi, 176h addedi, esi leaebx, byte_858 movedx, 0 loc_75A:; CODE XREF: sub_73E+30j xoreax, eax moveax, cs:[edx+ebx] movgs:[esi], al incesi incedx cmpesi, edi jnzshort loc_75A leabx, byte_809 movesi, cs:[bx] moval, 0 movgs:[esi+9], al movedi, 176h addedi, esi xoreax, eax xorecx, ecx loc_78E:; CODE XREF: sub_73E+5Bj moval, gs:[esi] addcl, al incesi cmpesi, edi jnzshort loc_78E leabx, byte_809 movesi, cs:[bx] xorcl, 0FFh inccl movgs:[esi+9], cl retn sub_73Eendp ; =============== S U BR O U TI N E ======================================= sub_7AEproc near; CODE XREF: start+386p movecx, gs:[edi+4] addecx, edi loc_7B7:; CODE XREF: sub_7AE+22j xoreax, eax xorebx, ebx moval, gs:[esi] movbl, gs:[edi] cmpal, bl jnzshort locret_7D8 incesi incedi cmpedi, ecx jnzshort loc_7B7 movecx, 1 locret_7D8:; CODE XREF: sub_7AE+19j retn sub_7AEendp ; --------------------------------------------------------------------------- byte_7D9db 4 dup(0); DATA XREF: start+2Fostart:loc_60o ... byte_7DDdb 0Ch dup(0); DATA XREF: start+21osub_535o ... byte_7E9db 4 dup(0); DATA XREF: start+318o start+38Fo ... byte_7EDdb 8 dup(0); DATA XREF: start+326o start+349o ... byte_7F5db 0Ch dup(0); DATA XREF: start:loc_1C1o start+1C7o ... byte_801db 4 dup(0); DATA XREF: start+127o start+16Co ... byte_805db 4 dup(0); DATA XREF: start+3Costart:loc_56o ... byte_809db 4 dup(0), 52h, 53h, 44h, 20h, 50h, 54h, 52h,20h, 0 ; DATA XREF: start+D7ostart+1CFo ... db 58h,41h, 4Dh, 47h, 41h, 4Ch, 46h, 1Bh dup(0) aHpqoemslicMpcdb 'HPQOEMSLIC-MPC',0 ; DATA XREF: sub_716+Do db 11h dup(0) byte_858db 53h,4Ch, 49h, 43h, 76h, 1, 2 dup(0), 1, 0ABh, 48h ; DATA XREF: sub_73E+11o db 50h,51h, 4Fh, 45h, 4Dh, 53h, 4Ch, 49h, 43h,2Dh, 4Dh db 50h,43h, 1,3 dup(0), 48h, 50h, 51h, 20h, 1, 7 dup(0) db 9Ch,3 dup(0), 6, 2,3 dup(0), 24h, 2 dup(0), 52h, 53h db 41h,31h, 0,4, 2 dup(0), 1,0, 1, 0, 5Bh, 0ABh, 60h db 56h,0BCh, 58h, 1Eh,0E8h, 0C1h, 0D2h, 0A1h,5Ch, 0E5h db 4Fh,0BBh, 0FDh, 1Dh, 0A9h, 8Ch, 94h, 0B4h, 0AEh, 8 db 11h,0DCh, 13h, 59h,0D3h, 7Fh, 0F6h, 3Eh, 87h, 31h db 0B9h, 95h, 74h, 10h,0DAh, 3Bh, 0A4h, 5Bh, 0B5h, 19h db 82h,7Ch, 39h, 0D7h,0Dh, 7Ch, 22h, 0ACh, 1Ch, 2Ah db 84h,0E9h, 0Ah, 88h,6Dh, 0FAh, 0B1h, 0E2h, 0D8h, 0E8h db 21h,96h, 0E1h, 2Eh,68h, 9Ah, 0BFh,44h, 45h, 3Eh db 3Ch,8Eh, 99h, 90h, 0DEh, 37h, 38h, 57h, 0Bh, 92h, 15h db 0BCh, 0DEh, 0FFh, 0F2h, 7, 7Eh, 0B5h, 40h, 8Ch, 51h db 3Ah,0C3h, 2, 48h, 0F6h, 13h, 12h, 72h, 0FBh, 42h, 78h db 0E6h, 47h, 88h, 54h,0C7h, 0B0h, 0F0h, 93h, 9Eh, 0FBh db 4, 0B7h, 2 dup(0B8h), 90h, 0DEh, 0DBh, 0EDh,32h, 0E1h db 0FBh, 54h, 0A6h, 1, 3 dup(0), 0B6h, 5 dup(0), 2, 0 db 48h,50h, 51h, 4Fh, 45h, 4Dh, 53h, 4Ch, 49h,43h, 2Dh db 4Dh,50h, 43h, 57h, 49h, 4Eh, 44h, 4Fh, 57h,53h, 20h db 1, 0, 2, 11hdup(0),30h, 90h, 1Fh, 0B4h, 0A4h, 0BEh db 80h,1Eh, 0E9h, 33h,0ECh, 7Fh, 0FCh, 0B1h, 28h, 0Eh db 0A6h, 0CEh, 43h, 72h, 8Ch, 79h, 30h,0B4h, 0F4h, 59h db 0EAh, 7Dh, 0CFh, 0B7h, 11h, 8Bh, 0DAh, 70h, 0C5h, 0C8h db 3Fh,79h, 20h, 8, 6Fh, 64h, 0CAh, 7,88h, 0B3h, 0B1h db 16h,0B4h, 0BAh, 1Ah, 0F1h, 85h, 52h, 0B1h, 0F5h, 7 db 55h,0B5h, 70h, 61h,0EFh, 44h, 8Ch,0AAh, 5Fh, 78h db 14h,66h, 98h, 9Ch, 0F3h, 58h, 0D8h,0AAh, 48h, 0E0h db 37h,0F8h, 0F6h, 0ABh, 64h, 0FAh, 0DAh, 17h,2Ah, 62h db 0E3h, 4, 1Dh, 32h, 2Dh, 0D5h, 0EAh, 33h, 66h, 5Ch, 5Bh db 3Bh,0Eh, 0F7h, 9, 66h, 42h,32h, 0AAh, 14h,99h, 0C3h db 0EEh, 1Ah, 62h, 3Bh,7, 5Fh,0F0h, 48h, 44h,0C4h, 0E6h db 32h,59h, 1Fh, 14h, 3Eh, 0F1h, 0B2h,38h ; =============== S U BR O U TI N E ======================================= sub_9CEproc near; CODE XREF: start+1Ap pushesi callsub_9EB jbshort loc_9E8 callnear ptr byte_A21 jbshort loc_9E8 callsub_A8C jbshort loc_9E8 pushax movax, cs xorax, ax movgs, ax assume gs:seg000 popax clc loc_9E8:; CODE XREF: sub_9CE+5j sub_9CE+Aj ... popesi retn sub_9CEendp ; =============== S U BR O U TI N E ======================================= sub_9EBproc near; CODE XREF: sub_9CE+2p pushax movax, 4300h int2Fh; - Multiplex -XMS - INSTALLATION CHECK ; Return: AL = 80h XMS driver installed ; AL <>80h no driver cmpal, 80h; '€' popax stc jzshort locret_9F8 clc locret_9F8:; CODE XREF: sub_9EB+Aj retn sub_9EBendp ; --------------------------------------------------------------------------- db 8 dup(0), 3 dup(0FFh), 2 dup(0), 9Ah, 2 dup(0), 3 dup(0FFh) db 2 dup(0), 92h, 2 dup(0), 3 dup(0FFh), 2 dup(0), 92h db 8Fh,0, 1Fh,0, 0F9h, 9, 4 dup(0) byte_A21db 0Fh,20h, 0C0h, 66h,0D1h, 0C8h, 72h, 62h, 8Ch, 0C8h ; CODE XREF: sub_9CE+7p db 8Eh,0D8h, 66h, 0Fh,0B7h, 0C0h, 66h, 0C1h, 0E0h, 4 db 66h,1, 6, 1Bh, 0Ah,0Fh, 1,16h, 19h, 0Ah, 8Ch, 0C8h db 66h,25h, 2 dup(0FFh), 2 dup(0), 66h, 0C1h, 0E0h, 4 db 0A3h, 3, 0Ah, 0A3h, 0Bh, 0Ah, 66h, 0C1h, 0C8h, 10h db 0A2h, 5, 0Ah, 0A2h, 0Dh, 0Ah, 88h, 26h, 8, 0Ah, 88h db 26h,10h, 0Ah, 0FAh,0Fh, 20h, 0C0h,0Ch, 1,0Fh, 22h db 0C0h, 0EAh, 71h, 0Ah, 8, 0, 0B8h, 18h, 0, 8Eh, 0D8h db 8Eh,0C0h, 8Eh, 0E0h, 8Eh, 0E8h, 0Fh, 20h, 0C0h, 24h db 0FEh, 0Fh, 22h, 0C0h, 0EAh, 89h, 0Ah dw seg seg000 ; --------------------------------------------------------------------------- clc sti retn ; =============== S U BR O U TI N E ======================================= sub_A8Cproc near; CODE XREF: sub_9CE+Cp pushax moval, 0D1h ; 'Ñ' out64h, al; AT Keyboard controller 8042. callsub_AA5 moval, 0DFh ; 'ß' out60h, al; AT Keyboard controller 8042. callsub_AA5 moval, 0FFh out64h, al; AT Keyboard controller 8042. ; Resetthe keyboard and start internaldiagnostics callsub_AA5 clc popax retn sub_A8Cendp ; =============== S U BR O U TI N E ======================================= sub_AA5proc near; CODE XREF: sub_A8C+5p sub_A8C+Cp ... inal, 64h; AT Keyboard controller 8042. jmpshort $+2 andal, 2 jnzshort sub_AA5 retn sub_AA5endp ; --------------------------------------------------------------------------- pushcx pushdx pushcx xorch, ch movdx, 8 subdx, cx movcx, dx shlcx, 2 roleax, cl popcx loc_AC1:; CODE XREF: seg000:0ACDj roleax, 4 movdl, al anddl, 0Fh callsub_AD2 looploc_AC1 popdx popcx retn ; =============== S U BR O U TI N E ======================================= sub_AD2proc near; CODE XREF: seg000:0ACAp pushdx adddl, 30h; '0' cmpdl, 3Ah; ':' jbshort loc_ADE adddl, 7 loc_ADE:; CODE XREF: sub_AD2+7j pushax pushbx pushcx movah, 2 int21h; DOS -DISPLAYOUTPUT ; DL = character to send to standard output popcx popbx popax popdx retn sub_AD2endp ; =============== S U BR O U TI N E ======================================= sub_AEAproc near; CODE XREF: sub_AF8+6p pushsi pushax movcx, 0FFFFh loc_AEF:; CODE XREF: sub_AEA+9j inccx lodsb cmpal, 0 jnzshort loc_AEF popax popsi retn sub_AEAendp ; =============== S U BR O U TI N E ======================================= sub_AF8proc near; CODE XREF: sub_B20+Ep sub_B20+21p ... pushsi pushdx pushcx pushbx pushax pushcx callsub_AEA movdx, cx popcx lodsb loc_B05:; CODE XREF: sub_AF8+1Ej repne scasb stc jcxzshort loc_B1A pushsi pushdi repe cmpsb movbx, si popdi popsi subbx, si cmpbx, dx jlshort loc_B05 decdi clc loc_B1A:; CODE XREF: sub_AF8+10j popax popbx popcx popdx popsi retn sub_AF8endp ; =============== S U BR O U TI N E ======================================= sub_B20proc near; CODE XREF: start+12p leasi, aRsdPtr; "RSD PTR " movax, 0E000h moves, ax assume es:nothing movcx, 0FFFFh xordi, di callsub_AF8 jnbshort locret_B57 leasi, aRsdPtr; "RSD PTR " movax, 0F000h moves, ax assume es:nothing movcx, 0FFFFh xordi, di callsub_AF8 jnbshort locret_B57 leasi, aRsdPtr; "RSD PTR " movax, 9F00h moves, ax assume es:nothing movcx, 1000h xordi, di callsub_AF8 locret_B57:; CODE XREF: sub_B20+11j sub_B20+24j retn sub_B20endp ; --------------------------------------------------------------------------- aRsdPtrdb 'RSD PTR ',0 ; DATA XREF: sub_B20o sub_B20+13o ... db ? seg000ends ; =========================================================================== ; Segment type:Pure data dsegsegmentpara public 'DATA' use16 assume cs:dseg ;org 2 align 10h dsegends ; =========================================================================== ; Segment type:Uninitialized seg002segmentbyte stack 'STACK' use16 assume cs:seg002 assume es:nothing, ss:nothing, ds:dseg,fs:nothing, gs:nothing db 400hdup(?) seg002ends end start The disassembler did a pretty good job, but not perfect as you can see. There are still at least four areas which require manual reworking. I hope someone here knows enough x86 assembler to figure it out. Violin, would you like to dig into assembly language? Please share what you find out. The Interactive Disassembler (IDA) is probably the best software to use for this purpose. It also creates a nice graph of the application.
Personally I don't think it is wise to release the source code since it is a crack. For all you know Microsoft guys are here and can add it into Windows Defender or circumvent it more quickly if they have a good idea of the source.
You don't think Microsoft is capable of disassembling any of this stuff on its own if they're really interested? I'm sure they're already quite up on how people are cicumventing their protection schemes. It's not rocket-science.
You've done a great job. How I wish I could handle the code! But I just know a little on 8086 real-mode ASM. And this is quite different as it is 80386 protected-mode ASM, I think. I've seen people use IDA to do excellent reverse engineering work. I think human endeavor and experience is indispensable.