--=[ REC/Small - ROSE EXE cryptor ]=---------------------------------------- The simplest EXE file cryptor without relocation routines and a little encryption. You must compress your EXE file before adding REC to it because REC/Small will not handle relocations. After all you should protect your EXE files with HS to avoid false positive from virus scanners! :) Currently REC/Small adds nearby 70 bytes to protected files. I release this stuff because: 1.) it's the shortest cryptor in the world I know 2.) because it's a "beta" test for HackStop 1.20 Usage: recsmall file_to_protect.exe Generates the encrypted file OUT.EXE Bugs: * Stack is weired -> TbScan & ExeHead * Can "only" handle files up to 640 KB length :) * Uses stack of program to be protected Copyright: * (c) by ROSE SWE - all rights reserved * Free for personel use only! * NO WARRANTIES! Hints: * The first one who releases an unpacker for REC/Small will get the title "World's greatest unpacker coder! (a.k.a. lamer)" }:-(( * Use Com2Exe from the HackStop package to convert COM's to EXE's for encrypting. * Next version will contain a stack trick, killing real mode tracers. History: Version Protector Date Remarks length 1.01 71 26-Nov-97 Prefetch queue bug fixed. Stronger encryption added. Stack is now even. 1.00 66 20-Nov-97 Initial release Mail to ------- (C)opyright 1987-97 (ALL RIGHTS RESERVED!) ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿ ³ ROSE Softwareentwicklung ³Û ³ Dipl.-Ing. (FH) Ralph Roth ³Û ³ Finkenweg 24 ³Û ³ ³Û ³ D 78658 Zimmern o. R. ³Û ³ ³Û ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙÛ ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß See ROSEBSS.TXT for full address (PGP key, Email, FAX etc.) Some notes by users :) ------------------------------- Message Contents ------------------------------- Hiya Ralph, here a message from your truly lamest beta tester (if no one was first.. ;)) RECSmall is buggy. I'm not the one to blame you for that, but you forgot the prefetch queue. You change the segment in the JMP FAR SEG:OFS, but you forget to do a jmp $+2 to forbid the prefetch queue to jump to the old value!! I unpacked the thing merely with Decay and CUP386, it's not really a hard job. Remember to use CUP386 /7/d/k when you really really can't find the bug ;)