컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 CSCRYPT Pro (c) 1995,96,97 by Christian Schwarz Version 3.30/386 GutsMuthsplatz 18 Shareware 99610 Soemmerda 11-27-1997 Germany 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 컴Content of this DOC컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� What's CSCRYPT ? Method of working System requirements Features Safety level Future versions Status of CSCRYPT Hints Parameters ERRORLEVEL codes Source code The author History of development 컴What's CSCRYPT ?컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 CSCRYPT is a little tool, which represents a fine possibility to protect executable files - also with password - against unauthorized modifications. This is very advisable if your program contains password queries or even an important algorithm. So nobody is able to patch or dump parts of the program. 컴Method of working컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� At first, CSCRYPT encrypts the entire program code and - if in existence - the relocation table. If you used the password-feature, the password will be used for encryption. Following, CSCRYPT adds a small decryption routine, which deciphers the program code after execution within splits of seconds. That's why you can run protected programs as usual (see also chapter Hints for exceptions). 컴Features컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 + very proof, very fast + complex encryption algorithm + number of encryption layers is only limited by system memory + password is used for encryption + merely the CRC of the password is saved within the protected program + protection against unauthorized decryption + use of anti-debugging techniques + several layers of self-encryption + low-polymorphic self-encryption (complicates decryption by well-known utilities like TRON, UNP and UP) + additional an extremely polymorhic self-decryption-routine for the first layer (since v3.00�) + 32 bit CRC check after decryption + compression of the relocation table (EXE files) + any message can be insert in the header of EXE files 컴System requirements컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� required: � IBM PC or 100% compatible � DOS 3.3 � at least 100 KB free working storage recommended system: � 80386/33 � hard disk � TEMP-directory on RAM disk (for generating protected programs) 컴Safety level컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 In general, CSCRYPT-protected programs are proof. But a versed hacker with very much time is able to crack such programs. On the other hand it's impossible to decrypt password-protected programs without knowing the right password. 컴Future versions컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� I will (or want to) improve CSCRYPT in the following ways: � speed up, using special features of the 32 bit processors (avoiding dependencies on Pentium processors to take advantage of the two pipelines) � implement a compression algorithm (similar to DIET, LZEXE, PKLITE) 컴Status of CSCRYPT컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� CSCRYPT is shareware. You are allowed to use it in private as well as commercial environment within the trial period of 30 days. If you want to pass CSCRYPT, then you have to obey the following conditions: � Don't charge any money (exception: distribution on shareware/ freeware/PD CD-ROMs) ! � Don't separate the files containing to CSCRYPT (CSCRYPT.EXE, CSCRYPT.TXT, CSCRYPT.DOC, FILE_ID.DIZ) ! � Don't change these files in any way ! When the trial period is over you either have to order the registered version or delete CSCRYPT and all CSCRYPT-protected programs. The trial version and the registered version have got the same functions and do exactly the same, because I guess that's the only way for you to test all functions. The latest registered version costs 20,- DM (c. 14,- US dollar). Please comment all bugs or suggestions to me. 컴Hints컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� ATTENTION! There're some heuristic anti-virus programs like F-PROT and TBAV, which produce false alarms (armored program, unknown virus) while scanning CSCRYPT-protected (version 2.13b or earlier, as well as versions 3.00� or higher) programs. This happens, since the decryption routine has some specialities which are typical for viruses (flexible entry point, anti-debugging techniques). So there's no reason to panic. There are programs which aren't to be changed in any way. Either these programs check themselves for modifications (the most antiviral programs) or they modify its own code (SETVER.EXE). I also advice you against protecting any command interpreter (as a rule COMMAND.COM, but also 4DOS.COM and NDOS.COM). I assume no responsibility for any damage resulting from the use of CSCRYPT - use it on your own risk. 컴Parameters컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 Usage: CSCRYPT filename [/PW:password] [/T[:textfile]] [/POLY{0-9}] "password" is a string which has 1 to 32 characters. If you want to insert a string into the header of a protected EXE file, you have to use "/T[:textfile]". When you specify a textfile with ":textfile", CSCRYPT inserts its content. Otherwise CSCRYPT uses following message: This program was protected by CSCRYPT Pro v3.30/386 ! Modifications are explicitly prohibited by the author. To control the insertion-level of useless instructions within the decryption routine you have to use the /POLY{0-9} switch. The number (from 0 to 9) specifies this polymorphic level. The hightest number (9) stands for the maximum polymorphic level, "/POLY0" on the other hand instructs CSCRYPT to insert no senseless instructions. example: CSCRYPT SECRET.EXE /PW:ABCDEF -T:HDRTEXT.TXT -POLY9 encryption of SECRET.EXE using the password "ABCDEF", content of HDRTEXT.TXT is insert into the EXE header, maximum polymorphic level 컴ERRORLEVEL codes컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 CSCRYPT returns some ERRORLEVEL codes. So you can use it in batch files. 0 - success, no error 1 - syntax error 2 - DOS version older than 3.3 3 - not enough free memory 4 - password not between 1 and 32 characters long 5 - polymorphic level not between 0 and 9 255 - CSCRYPT has been modified (probably a virus infection) 컴Source code컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� The source code consists of 6127 lines (260 kb) Pascal/Inline-Assembler and 2169 lines (50 kb) 8086 assembler. 컴The author컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 � Christian Schwarz, 18 years old � Address: GutsMuthsplatz 18 99610 S봫merda Germany � Phone: +03634-23559 컴History of development컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 v1.0: � early May 1995 � private version v1.1: � 6-18-1995 + added low-polymorphic self-decryption v1.1b: � 6-20-1995 � no public release + internal improvements v1.1c: � 8-3-1995 + added the possibility to insert a message into the EXE header v1.1d: � 8-4-1995 + extended error messages + fixed some minor bugs Pro v2.0: � 8-6-1995 + added encryption with password + minor improvements of decryption Pro v2.10: � 9-8-1995 + added a second layer of self-encryption + major improvements of anti-debugging techniques + added possibility to protect a program more than once + fixed a minor bug Pro v2.11: � 9-25-1995 + improved self-encryption + CSCRYPT now catches Ctrl-Break and Ctrl-C during password query + wildcards are now allowed + some other minor changes Pro v2.12: � 11-11-1995 + fixed a serious bug concering decryption of high-loaded COM programs + minor improvements of the decryption algorithm (speed slightly increased) Pro v2.13: � 01-01-1996 + slightly increased decryption speed + minor modifications Pro v2.13b: � 01-03-1996 + minor internal modification Pro v2.20: � 01-17-1996 + added another layer of self-encryption + added a few anti-debugging techniques + anti-virus utilities (F-PROT, TBAV) don't identify CSCRYPT-protected programs as unknown virus any longer Pro v2.21: � 01-21-1996 + compression of the relocation table (less memory, smaller files) Pro v2.22: � 02-11-1996 + improved compression of the relocation table by using a LZEXE-like technique + new warning message + minor internal modification Pro v2.22b: � 02-13-1996 + fixed a serious bug (modified COM files droped off after showing the error message) Pro v2.22c: � 02-21-1996 + some minor internal modifications Pro v3.00�: � 08-12-1996 + NEW: another extremely high polymorphic decryption routine + a new option (/POLY{0-9}) to control the polymorphic level + protected programs should now run under MS-Windows Pro v3.01�: � 08-13-1996 + random anti-debugging-code from now on also in the extremely high polymorhic decryption routine + fixed a minor bug Pro v3.10� � 08-20-1996 + improvement of the screen output and the error-handling + new option "?", shows extended English and German help + fixed a famous bug within the polymorphic encryption Pro v3.10b � 09-02-1996 + fixed a small bug Pro v3.20a � 09-14-1996 + improved the polymorphic encryption Pro v3.21a � 10-21-1996 + fixed a small bug within the polymorphic engine Pro v3.22 � 02-16-1997 + added some anti-debugging-code Pro v3.30/386 � 11-27-1997 + added some 386 anti debugging tricks to shout general tracers like CUP386, GTR, ... - runs only on 386+ processors 컴The End컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴�