Phoenix Rising BBS/phoenixrising.zip/phoenixrising/vir-docs/crptlt19.arj/BWFPU21S.DOC

Text File | 1993-10-17 | 9KB | 173 lines

                 Black Wolf's File Protection Utilities 2.1s

                    Special Release Version W/Source Code!

              PassCOM, PassEXE, EncrCOM, EncrEXE, and ULTIMUTE

                                   All

                      (c) 1993 Black Wolf Enterprises.
                       Included in Crypt Newsletter 19

MODIFICATIONS:
                   None as of yet - initial release 08/05/93.

LISCENSE:

    Released As Freeware - These files may be distributed freely.  If
they are modified, please note modifications in source code and above
under the "MODIFICATIONS:" header.  With notice, include your name/handle,
the date, and the modification's purpose. NOTE THAT MODIFICATION PRIVILEDGES
APPLY ONLY TO THIS VERSION (2.1s)!  I'd appreciate notification of any
modifications if at all possible, reach me through the address listed
at the bottom of this file.  Sorry, but all of the code is written in
.ASM for size and effectiveness and some of the commenting may be
a bit cryptic.  If you would like to incorporate this code into a project,
or some similair situation - please contact me so I'll know what's going
on and can, perhaps, even offer input and improvements on the code.  You
are, however, welcome to do so on your own as long as there is at
least a string with my copyright in it presented in a visible place
(i.e. a note in the documentation, distributed source, displayed on
execution, whatever.... I just don't want to have to look for it with
a hex editor).

    Files protected by these programs may be  distributed non-commercially
as is.  Commercial programs utilizing this protection system MUST display
a notice of the protection in their program AND in the documentation to
give credit where it is due - it is, however free under those conditions.
The notice should consist of the following:

     Which programs were used, the version number (2.1s), and my copyright
     string. For example, the following would be acceptable:

 SuperProg 1.3 is protected by EncrEXE 2.1s, (c) 1993 Black Wolf Enterprises.


DISCLAIMER:

    THE AUTHOR IS NOT RESPONSIBLE FOR ANY DAMAGES THAT MAY OCCUR FROM THE
USE AND/OR MISUSE OF THIS PROGRAM!  SOME FILES WILL NOT WORK AFTER
BEING PROTECTED - FOR THIS PURPOSE, BACKUP FILES ARE CREATED WITH A
.OLD EXTENSION.  KEEP THESE BACKUPS UNTIL YOU ARE SURE THAT THE PROTECTED
VERSION WORKS!!!  ALSO, IF YOU LOSE YOUR PASSWORD TO A PASSWORD PROTECTED
FILE, UNLESS YOU'RE AWFULLY GOOD WITH ASSEMBLY THERE IS NO WAY TO RECOVER
THE FILE.  THERE IS NO UN-INSTALL PROGRAM.

PassCOM and PassEXE Password Protection Programs:

   PassCOM and PassEXE are file-protection utilities that will attach a
password routine to a specified file.  When that file is executed, from
then on, it  will prompt the user for a password.  If that password is
correct, it will execute normally, if it is not, then it will terminate.
PassCOM should ONLY be used for .COM files, and PassEXE should only be
used for .EXE files.  Before protecting a file, make sure to make a backup
copy of it.  THESE UTILITIES MAY DAMAGE CERTAIN FILES!  Generally, the only
files that will have difficulties are certain types of overlay files and
files that perform a self-check when they run. Basically, a good rule of
thumb is - if the file can be compressed with PKlite or similar executable
compression program, then you can protect it with the password.  WINDOWS
files will not work, because WINDOWS executes a different section of the
program entirely from DOS (if you do protect a windows .EXE, then you
will most likely only see the password prompt just before you see
"This program requires Microsoft Windows" or something like that :).

EncrCOM and EncrEXE Encryption Protection Programs:

     EncrCOM and EncrEXE are file-protection utilities that will attach a
decryption routine to specified files after encrypting them.  When an
encrypted file is executed, it automatically decrypts itself and runs
normally - the user will notice no difference.  Would be "crackers",
however, will DEFINITELY notice the change the second they try to modify
the program.  Every time a file is protected, the decryption code for it
is put inside a polymorphic envelope with several anti-debugging and anti-
disassembling techniques peppered throughout it.  This makes stepping through
the program extremely difficult.  Also, the encryption protections can be
layered - each one will be different from the last.  This makes it possible
to have multiple layers of "ICE" which would give even the best crackers
a headache.  Also - any data inside the program will be rendered unreadable
by anyone on the disk, giving the extra security that no one can simply
modify the program with a hex editor.

EXTRA NOTES:

     All of the protection utilities keep the time/date stamp the same
after protection as it was beforehand.

     If an EXE file crashes when protected, try protecting it again after
restoring it from the backup.  It it still does not work - try compressing
it with one of the executable-compression preograms and trying again.  In
some cases, this will fix the problem.  Otherwise, probably the encryptions
interfere with file overlays.  I will work on fixing this at some point
in the future.

      It may be possible for a protected program to set off some
anti-viral program that have heuristical abilities.  This has not happened
to my knowledge (they cannot seem to trace through the decryption algorithm)
but some ARE set to alert the user if they detect an decryption algorithm
at the beginning of a file's execution.  So far, however, none of the
heuristic programs I've tested seem to be able to identify the decryption
algorithm as being such.

HOW GOOD IS THIS, REALLY?:

How good is the security these provide?  Well...  It isn't hacker proof
- a good assembly programmer with some "specialized" experience should be
able to break through the password protection given enough time.  However -
I've put a lot of effort into making it a very large pain.  The passwords
are kept encrypted, and every time a new file is protected the protection
code is surrounded by a COMPLETELY DIFFERENT ENCRYPTION ALGORITHM, complete
with several anti-debugging techniques that, while benign, are VERY painful
to step through.  Why am I not telling you that it is hacker proof?  Well,
a few reasons.  One is that very few things are.  Another is that if the
computer needs to decrypt the file to execute it - a method must be present
to do so.  Simple logic - unfortunately it cuts down on security quite a
bit.  And the last reason is that when you say something is XXXX-proof,
you're just asking for it.  If someone does find a simple solution to
cracking this program, however, E-Mail me and I'll see about fixing it.

The big advantages of these programs' security are as follows:

1.) You aren't going to run into two exact copies of the decryption routine -
    it's extremely flexible.  This eliminates the possibility of a simple
    "hack one, hack 'em all" solution that most protection programs suffer
    from.

2.) The decryption algorithm generally includes multiple anti-debugging
    tactics.  While these can be bypassed by an experienced programmer with
    time, they can be VERY frustrating to anyone without previous knowledge
    of such techniques.

3.) After you set a password, it never again shows on the screen OR IN
    MEMORY.  When a password is checked, it is encrypted and the RESULT
    is checked against the true password, rather than carelessly leaving
    the true password in memory as many programs do.

4.) Passwords can be up to 12 characters long.  While this is not
    enourmous, it provides enough to prevent most easy guessing.  Most
    ALT-Keypad combinations will work if you want to use special symbols
    to increase security.  NOTE - I recommend using a full 12 characters
    for added security.

5.) Multiple layers of these programs can be used to protect the target
    file to a VERY high degree.  If you think one layer of polymorphic
    encryptions is a pain......


Well, here you go.  That's about it.  Again, I accept NO RESPONSIBILITY FOR
ANY DAMAGES IT MAY CAUSE.  Backup files are automatically made with the
extension of 'OLD' - if a file crashes after being protected, copy it back
from this backup and try protecting it again.  If it crashes again, it's
unprotectable by this version.  Do try twice, however, as in a few cases
one polymorphic protection may not be compatible with a program where another
would - especially after several layers of protection have been applied.

If you want to test the polymorphic abilities of these programs, try creating
multiple copies of some small .COM or .EXE file in a directory and protect
each of them.  You will notice that there is a VERY large range in size and
contents of the protection code due to the mutating decryption algorithm.

                                     Black Wolf