; ; deice.asm by Inbar Raz ; ; Notice - this is for COM only ; .model tiny .code org 0100h CODESTART EQU $ Start: jmp Begin NewName db 'OPENED.COM', 000h Handle dw ? Old60 dd ? M_Prog db 'DeIce - A program to extract executables compressed under ICE.' db 00Dh, 00Ah db 'By Inbar Raz, 2:401/100.1 or 2:403/123.42.' CrLf db 00Dh, 00Ah, 024h AlgorithmSize EQU 00200h ; ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß ; ; First Breakpoint - Encryption Loop CallerOff EQU word ptr ss:[bp+00002h] RetAddress EQU word ptr ss:[bp+00008h] HereCount db 2 New60 proc far push bp mov bp,sp dec cx ; When CX=1, LOOP simply proceeds. jnz Wrong ; By now, the encryption has been finished. Now we will replace the second ; loop also with a CD 02, and we will self-modify the routie so it would handle ; the second loop. ; First, let's find the address for the next breakpoint push ax push cx push dx push di push ds std mov cx,AlgorithmSize mov di,RetAddress mov al,001h Scan2: repnz scasb or cx,cx jnz NotDone jmp NotIce NotDone: cmp word ptr es:[di+2],0FF2Eh ; The LOOP we are searching jne Scan2 cmp word ptr es:[di+4],00A26h jne Scan2 inc di inc di mov ax,060CDh ; Replace with INT 60 stosw mov ax,02560h push cs pop ds lea dx,New60_ int 21h pop ds pop di pop dx pop cx pop ax pop bp iret Wrong: push ax mov ax,CallerOff sub ax,00008h mov CallerOff,ax pop ax pop bp iret New60 endp ; ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß New60_ proc near int 3 push ds push cs pop ds mov ah,03Ch mov cx,00020h lea dx,NewName int 21h jnc Created call Print db 'Unable to create destination file.$' Created: mov word ptr cs:[Handle],ax mov bx,ax mov ah,040h mov cx,di sub cx,001ACh mov dx,si pop ds int 21h mov ah,03Eh mov bx,word ptr cs:[Handle] int 21h call Print db 'Extracting file completed.$' New60_ endp ; ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß ; ; Beginning of activation code Begin: mov ah,009h lea dx,M_Prog ; 'DeIce - A program to extract...' int 21h ; Display $-terminated string at ds:dx mov ax,03560h int 21h mov word ptr [Old60],bx mov word ptr [Old60+2],es ; Store old vector mov ax,02560h lea dx,New60 int 21h push cs pop es mov si,00080h ; Count of chars on CommandLine lodsb or al,al jnz FetchName call Print db 'No file specified.$' FetchName: cld mov di,00082h ; Command line start in PSP mov al,00Dh ; Search for end of line ( 00Dh ) mov cx,007Fh ; Maximum size of commandline repnz scasb dec di mov al,000h stosb ; Repace it with 0, to make it ASCIIZ mov ax,03D00h mov dx,00082h int 21h jnb Opened call Print db 'Unable to open specified file.$' Opened: mov word ptr Handle,ax mov ax,cs add ax,((CODEEND-CODESTART) shr 4) + 16 ; Stack space mov ds,ax lea sp,NEWSTACK mov ah,03Fh mov bx,word ptr cs:[Handle] mov cx,0FFFFh ; Maximum size of COM file mov dx,00100h int 21h ; Read cx bytes from handle bx to ds:dx mov ah,03Eh mov bx,word ptr cs:[Handle] int 21h ; Close file handle in bx push ds pop es mov cx,AlgorithmSize mov al,0D0h mov di,00100h Scan1: repnz scasb ; Search for al in es:[di] jcxz NotIce cmp word ptr es:[di],0F8E2h ; The LOOP we are searching jne Scan1 mov ax,060CDh ; Replace with INT 60 stosw push es mov ax,0100h push ax retf ; Jump to COM program ; *************************************************************************** NotIce: call Print db 'Program is not compressed under ICE.$' ; *************************************************************************** Print proc near push cs pop ds mov ah,009h pop dx int 21h mov ah,009h lea dx,CrLf int 21h mov ax,02560h lea dx,Old60 int 21h mov ah,04Ch int 21h ; Terminate program Print endp ; *************************************************************************** CODEEND EQU $ NEWSTACK EQU CODEEND+04Dh end Start