컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� iLUCRYPT v4.018 Copyright (c) 1995-98 by Christian Schwarz [iLUVATAR] 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 훇hat is iLUCRYPT ?컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 iLUCRYPT is a nice DOS executable file protector. 횲eatures컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴  several layers of self-encryption  using 386 hardware breakpoints  using 386 floating point operations for decryption  password protection (block cipher using 128bit key and 64bit data blocks)  compressing relocation table ...and all the usual stuff like  INT0,INT1,INT3,INT4,INT8  running line  disable keyboard  invalid opcode trick ...and some new techniques to kick TEU, UPC and similar shit Following programs are known to be "incompatible" with iLUCRYPT v4.018.  AUP386 1.00 - crash  COMDUMP 1.0 - does nothing  COMUNP v0.1f - crash  CUP386 [3.0b,3.2,3.3a,3.4] - abort/crash  DECAY 0.05 - crash ? DEGLUGGER 0.04b3 - who knows ?!?� (crashed any system i've tested on)  DECOM 1.26/RVK 1.26 - nothing to say :D  DUMPCOM v3.55 PRO - hangs  ENTPACK 16.1.98 - reboot  GTR [1.84,1.90,1.A0,1.B0] - abort/crash/reboot  ICEUNP 0.1.5 - reboot  IUP 0.6.7 - crash  RIPPER/32 2.01 - reboot  SoftICE 2.80 - crash  TEU 1.81�3 - reboots (only if known compiler code was found by TEU)  TR 2.00 - reboot  TRON 1.30 -u - abort/crash  TD/TD286/TD386 - crash  UCOMUX - does nothing  UNP 4.12� -t - crash  UPC [1.04,1.05,1.10,1.11] - reboot Also some resident anti virus blockers (like IBMAV, which is part of PC-DOS 7.0) may interference with iLUCRYPTed programs. Besides iLUCRYPT uses special code to kick all tracers/debuggers which store programs registers anywhere in the 1st meg. 훃sage컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� iLUCRYPT Program [/STAMP:h] [/PW:x] [/EXIT] [/MOD:x[,y[,z]]] /STAMP:n This option forces the loader of a protected program to store a 32 bit hexadecimal number (hhhhhhhh) at PSP:007C. So your program can easily check if the protection had been removed ! /PW:x The program will be protected by a password (1-31 characters long, case sensitive). /EXIT iLUCRYPT inserts spezial code (executes the DOS-termination function 4c00h) to kick some stupid dumpers. (�-version) /MOD:x[,y[,z]] Use this option to add own anti debugging moduls to the loader. X, y and z are COM files, starting with the IC4M header which must have the following structure: +00h 4 byte - badge (IC4M) +04h 1 word - header version (at the moment 0) +06h 10 byte - name of the modul +10h 20 word - relocation table +38h ? byte - code (up to 4KB) This example should be enough to show you the general structure of a modul. code segment assume cs:code org 100h start: db 'IC4M' ; badge dw 0 ; header version db '_testmodul' ; name of the modul dw offset rel00 ; 1st relocation dw 19 dup (0ffffh) ; ffffh = no entry push cs pop ds mov ah,9 mov dx,offset mess0 rel00 equ this word-2 ; adress of reloc. int 21h ret ; return to loader mess0 db 'Hello world !',13,10,'$' code ends end start Note: Your modul should keep some rules in order to run without problems. - don't change registers BP, SP, FS, GS and SS - restore all interrupt vectors you've changed - use a NEAR RET to exit the modul 훀equirements and incompatibilities컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 protected programs won't run without:  80386+ processor AND 80387+ coprocessor  DOS protected programs were successfully tested with:  i486DX, UMC U5SD, Cyrix 486S, i486DX2, Cyrix 6x86, AMD K5, Pentium, Pentium MMX, AMD K6 ? If someone has got a i386, a Pentium II or any other processor not ? mentioned above, please let me know if iLUCRYPT works correctly.  MS-DOS [6.20,6.22], Caldera OpenDOS 7.01  EMM386 [v4.48,v4.49,v4.95], QEMM v8.0 In no case protected programs will run under Windows 95 or Windows NT ! So far I could not test it, but I think this also applies to OS/2 and Linux. 횴istory컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� + added * modified ! bug fix v4.014� [04-01-98] + loader patches the interrupt handlers of COMDUMP v1.0, DUMPCOM v3.53 and UCOMUX to avoid unpacking + added a new procedure which should be able to fuck up all tracers/ debuggers (CUP386 /1/7, ICEUNP, TR, TRON, UNP, ...) which stores programs registers within the 1st meg v4.015 [04-14-98] * rewritten the first part of the loader + NOTing the complete interrupt table + new algorithm using memory hardware breakpoints to kick ENTPACK, UPC and similar shit + protected programs now cancel if running under Windows or OS/2 + new option /STAMP:hhhhhhhh (a hex double word) which forces the loader of a iLUCRYPTed program to store hhhhhhhh at PSP:007C + invalid opcode trick v4.016 [05-11-98] * loaders structure has changed very much - the foundation for the use of plugins within one of the next versions + password protection added ! bug fix: invalid opcode trick hang on some systems (thanx Szaszi) v4.017 [06-10-98] * improved the use of memory hardware breakpoints against ENTPACK, UPC, ... (since v4.015) * some minor enhancements v4.018 [07-03-98] + switch /MOD:x[,y[,z]] to add own anti debugging moduls + test if hardware breakpoints are working (hw bp are not available under any Win) * minor speed up 횲uture versions컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� + mutation engine (CSCRYPT-like) ! bug fix: ILUCRYPT.EXE hang (in very rare cases) while doing BOUND-encryption What else do you need ? 훂hanks컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 Christian Rommel^[CR�ATUR�] nothing to say Thomas Neumann for placing his E-mail address to my disposal Jibz for making a bloody good executable packer Fauzan Mirza for his Tiny Encryption Algorithm (iLUCRYPT uses a modified version for password encryption) Cat Rapes Dog for making the best music i ever heard 횳reetings컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Szaszi UnPackStop 0.95 is not only incompatible with Win but also with the most DOS systems I've tested it on :) JauMing Tseng (JMCE), Christoph Gabler (TRAP), .... Note: SMI instruction will NEVER work under a V86 manager!!! - that's why your protectors are completely useless Are there Runtime-웦eaks at TU Ilmenau ?? 횫uthor컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 Christian Schwarz GutsMuthsplatz 18 99610 S봫merda Germany thneum@aol.com 훂he End컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴�