; Name		:	BASTARD
; Description	:	XFD external slave to detect BASTARD linkvirus
; Author	:	Zbigniew `Zeeball` Trzcionkowski
; Date		:	10.04.2001
; Version	:	1
; Supports	:	BASTARD linkvirus

; In future	:	-
; Disclaimer	:	The slave and this source are Public Domain.
; Comment	:	
;			At the moment only detection :-(
;			Sorry for absolute offsets in the source.
;			I know it is quite stupid to use,
;			xfd to detect viruses, but for me it is enough.


;TO PROGRAMMERS:
;
;USE IT FOR FREE IF YOU HAVE GOOD SCANFILES ENGINE,
;AND PLEASE RELEASE SUCH QUICK DETECTOR.
;I DON'T OWN SUCH AN ENGINE, SO WHY I AM GIVING AWAY
;THIS FILE DETECTION CODE.
;I AM AWARE OF IT'S VICES, BUT IT SHOULD WORK.





	section	ZbL!,code
ZbL:
	moveq	#-1,d0		;security
	rts			;ender
	
	dc.b	"XFDF"		;XFDF_ID
	dc.w	1,0
	dc.l	0,0,Motaba

	dc.b	"$VER: BASTARD 1 (10.04.01) by Zbigniew `Zeeball` Trzcionkowski",10,0


MotabaName:	dc.b	"[BASTARD! virus]",0

	even

Motaba:		dc.l	0		;next slave
		dc.w	1		;version
		dc.w	38		;master version
		dc.l	MotabaName	;name
		dc.w	0		;XFDPFF_RELOC
		dc.w	0
		dc.l	RecogMotaba	;recog buffer
		dc.l	RemMotaba	;decrunch buffer
		dc.l	0		;recog segment
		dc.l	0		;decrunch segment
		dc.w	0,0		;slave/replace id
		dc.l	80		;min. file length for header and data



maximalblocksize=2500

RecogMotaba:
	moveq	#0,d0




.lup:	
	addq.l	#1,d0
	cmp.l	#800,d0
	beq.w	.no
	cmp.l	#$000003e9,(a0)+	;look for CodeHunk
	bne.b	.lup
	
	move.l	(a0)+,d0		;HUNKCODE len in longs

	cmp.b	#$61,(a0)		;jump to virus?
	bne	.no

	add.l	d0,a0
	add.l	d0,a0
	add.l	d0,a0
	add.l	d0,a0

	sub.l	#maximalblocksize,a0


	moveq	#120,d0

.loop
	cmp.l	#$48e7fffe,(a0)+	;get static MOVEM
	bne	.x



	moveq	#0,d2			;I will call this method
	move.w	#0,d0			;checksum detector.
.count					;I don't have any books
	cmp.w	#$41fa,(a0)		;or knownledge to call
	bne	.x00			;the decrypter or decoder
					;'LEVEL something'
	addq.l	#2,d2			;or 'KUKU technology' :-)
	addq.l	#2,a0			;I think it doesn't matter
	addq.l	#1,d0			;at 5:32 am.
	bra.b	.x04
.x00
	cmp.w	#$41f8,(a0)
	bne	.x00b

	addq.l	#2,d2
	addq.l	#2,a0
	addq.l	#1,d0
	bra.b	.x04
.x00b
	move.w	(a0),d1
	and.w	#$b090,d1
	cmp.w	#$b090,d1
	bne	.x00c

	addq.l	#3,d2
	addq.l	#4,a0
	addq.l	#2,d0
	bra.b	.x04
.x00c
	cmp.l	#$2c780004,(a0)
	bne	.x01
	addq.l	#2,d2
	addq.l	#2,a0
	addq.l	#1,d0
	bra.b	.x04
.x01
	cmp.l	#$4eaefd84,(a0)
	bne	.x02
	addq.l	#2,d2
	addq.l	#2,a0
	addq.l	#1,d0
	bra.b	.x04
.x02
	move.w	(a0),d1
	and.w	#%1110000000000000,d1
	cmp.w	#%1110000000000000,d1
	bne	.x03
	addq.l	#1,d2
	bra.b	.x04
.x03
	move.w	(a0),d1
	and.w	#$7000,d1
	cmp.w	#$7000,d1
	bne	.x04
	addq.l	#1,d2
.x04
	addq.l	#2,a0

	addq.l	#1,d0
	cmp.l	#128,d0
	blt	.count

	bclr	#0,d2
	bclr	#1,d2
	cmp.l	#128-4,d2
	bne	.no

.Yes:
	moveq	#1,d0
	rts
	
.x	
	dbra	d0,.loop

	
.no:
	moveq	#0,d0
	rts


;--------------------------------------------------


;sorry :-(

RemMotaba:
	movem.l	d2-d7/a0-a6,-(sp)

	moveq	#0,d0
.Err:
	movem.l	(sp)+,d2-d7/a0-a6
	rts