; Name		:	Bobek 2
; Description	:	XFD external slave to detect Bobek2 linkvirus
; Author	:	Zbigniew `Zeeball` Trzcionkowski
; Date		:	15.06.2001
; Version	:	1
; Supports	:	BOBEK2 linkvirus
;
; In future	:	-
; Disclaimer	:	The slave and this source are Public Domain.
; Comment	:	
;			At the moment only detection :-(
;			Sorry for absolute offsets in the source.
;			I know it is quite stupid to use
;			xfd to detect viruses, but for me it is enough.


;TO PROGRAMMERS:
;
;USE IT FOR FREE IF YOU HAVE GOOD SCANFILES ENGINE,
;AND PLEASE RELEASE SUCH QUICK DETECTOR.
;I DON'T OWN SUCH AN ENGINE, SO WHY I AM GIVING AWAY
;THIS FILE DETECTION CODE.
;I AM AWARE OF IT'S VICES, BUT IT SHOULD WORK.




;100% bugfree as far as I could check
;0% false-positives during my own tests




	section	ZbL!,code
ZbL:
	moveq	#-1,d0		;security
	rts			;ender
	
	dc.b	"XFDF"		;XFDF_ID
	dc.w	1,0
	dc.l	0,0,Motaba

	dc.b	"$VER: BOBEK2 1 (15.06.01) by Zbigniew `Zeeball` Trzcionkowski",10,0


MotabaName:	dc.b	"[BOBEK2! virus]",0

	even

Motaba:		dc.l	0		;next slave
		dc.w	1		;version
		dc.w	38		;master version
		dc.l	MotabaName	;name
		dc.w	0		;XFDPFF_RELOC
		dc.w	0
		dc.l	RecogMotaba	;recog buffer
		dc.l	RemMotaba	;decrunch buffer
		dc.l	0		;recog segment
		dc.l	0		;decrunch segment
		dc.w	0,0		;slave/replace id
		dc.l	80		;min. file length for header and data



vir_size	=	1036

;--------------------------------
;allocated memory fragmentation!
;
;9 LONGS for 9 characteristics
;
_1	=	4
_2	=	8
_3	=	12
_4	=	16
_5	=	20
_6	=	24
_7	=	28
_8	=	32
_9	=	36
;--------------------------------


RecogMotaba:
	movem.l	d2-d7/a0-a6,-(sp)
	bsr.b	dupa
	movem.l	(sp)+,d2-d7/a0-a6
	rts


Dupa:
	moveq	#0,d0

.lup:	
	addq.l	#1,d0
	cmp.l	#800,d0
	beq.w	.no
	cmp.l	#$000003e9,(a0)+	;look for CodeHunk
	bne.b	.lup
	
	move.l	(a0)+,d0		;HUNKCODE len in longs

	cmp.b	#$61,(a0)		;jump to virus?
	bne	.no

	add.l	d0,a0
	add.l	d0,a0
	add.l	d0,a0
	add.l	d0,a0

	sub.l	#vir_size,a0


;AllocMem(10*4, _CLEAR+_ANY) hehehe!

	moveq	#10-1,d0
.alloc:
	clr.l	-(a7)
	dbra	d0,.alloc
	move.l	a7,a5



;*************************************************************
;Look for 9 characterstics in 128 bytes of shit!

	moveq	#0,d6
	moveq	#128/2-1,d7
.loop

	cmp.l	#$48e7fffe,(a0)		;movem.l d0-a6,-(sp)
	bne.b	.x1
	st	_1(a5)
.x1
	cmp.w	#$343c,(a0)		;move.w	#len,d2
	bne.b	.x2
	st	_2(a5)
.x2
	cmp.w	#$123c,(a0)		;move.b	#xxx,d1
	bne.b	.x3
	st	_3(a5)
.x3
	cmp.w	#$1010,(a0)		;move.b	(a0),d0
	bne.b	.x4
	st	_4(a5)
.x4
	cmp.w	#$10c0,(a0)		;move.b	d0,(a0)+
	bne.b	.x5
	st	_5(a5)
.x5
	cmp.w	#$5342,(a0)		;subq.w	#1,d2
	bne.b	.x6
	st	_6(a5)
.x6

	lea.l	_Coders(pc),a1		;one of coders:
	moveq	#8-1,d0			;eor.b d1,d0 ;	 sub.b d1,d0 ;
.loop1:					;ror.b d1,d0 ;	 not.b d0 ;
	move.w	(a1)+,d1		;neg.b d0    ;	 rol.b #1,d0 ;
	cmp.w	(a0),d1			;ror.b #1,d0 ;	 subq.b #1,d0.
	bne.b	.x7
	st	_7(a5)
.x7	dbra	d0,.loop1


	cmp.w	#$41fa,(a0)		;LEA x(pc),a0
	bne.b	.x8a
	st	_8(a5)
.x8a	cmp.w	#$487a,(a0)		;PEA x(pc)
	bne.b	.x8b			;move.l	(sp)+,a0
	cmp.w	#$205f,4(a0)
	bne.b	.x8b
	st	_8(a5)
.x8b

	cmp.l	#$2c780004,(a0)		;move.l	4.w,a6
	bne.b	.x9a			;jsr	-636(a6)
	cmp.l	#$4eaefd84,4(a0)
	bne.b	.x9a
	st	_9(a5)
.x9a	cmp.l	#$4df80004,(a0)		;lea	4.w,a6
	bne.b	.x9b			;move.l	(a6),a6
	cmp.l	#$2c56206e,4(a0)	;move.l	-634(a6),a0
	bne.b	.x9b			;jsr	(a0)
	cmp.l	#$fd864e90,8(a0)
	bne.b	.x9b
	st	_9(a5)
.x9b	cmp.l	#$2c780004,(a0)		;move.l	4.w,a6
	bne.b	.x9c			;lea	-634(a6),a0
	cmp.l	#$41eefd86,4(a0)	;move.l	(a0),a0
	bne.b	.x9c			;jsr	(a0)
	cmp.l	#$20504e90,8(a0)
	bne.b	.x9c
	st	_9(a5)
.x9c
	addq.l	#2,a0
	dbra	d7,.loop


;Calculate characteristics!
;*************************************************************

	lea.l	4(a5),a0
	moveq	#0,d0
	moveq	#9-1,d1
.count:
	tst.l	(a0)+
	beq.b	.x
	addq.l	#1,d0
.x
	dbra	d1,.count


;FreeMem(10*4) :-)
	lea.l	10*4(a7),a7


;Check if we have found 9 characteristics of BOBEK2
;*************************************************************

	cmp.l	#9,d0
	bne	.no

.Yes:
	moveq	#1,d0
	rts
.no:
	moveq	#0,d0
	rts


;guess!
_Coders:
	eor.b	d1,d0
	add.b	d1,d0
	rol.b	d1,d0
	not.b	d0
	neg.b	d0
	ror.b	#1,d0
	rol.b	#1,d0
	addq.b	#1,d0


RemMotaba:
	movem.l	d2-d7/a0-a6,-(sp)

	moveq	#0,d0
.Err:
	movem.l	(sp)+,d2-d7/a0-a6
	rts