
           L O R D' S  ANTI-DEBUGGING AND ANTI-EMULATOR L A I R
<>

              Addendum to original article for the FPU chapter

<>

 These Examples are part of my article called

        'Lord's Anti-debugging and Anti-Emulator Lair'


 These sources are FREE, you can do anything you want with them, just give
 me a credit...

 The files included here are:

        hexword.asm  - prints a word in hexa on screen
        random.asm   - generates a random number within limits
        pyt.asm      - a very complex demo using Pythagora's formula
        taylor.asm   - a demo for computing EXP(x) using Taylor's formula
        pyt_c.asm    - a demo for encryption/decryption using pyt.asm
        taylor_c.asm - a demo for encryption/decryption using taylor.asm
        move.asm     - demonstration for moving memory using FPU instructions

        None of the above files were included in compiled or linked form.
 You link them on your own. I recomend this:

        TASM /M3 /O <file.asm>
        TLINK /X <file.obj>

        Besides... no other shity product will do it ;-).
        Note: All files should be compiled as EXE.

        Ok, now, some talk around the routines. In order to understand the
 formulas read my article. The encryption algorith is, of course, lame, but
 it's a very good demo for the FPU use. NO code-emulator or heuristic
 analyzer is able to go thru it. In order to break it, one AV guy should
 decrypt the code and look really deeeeep and understand what the procedure
 returns (for example Taylor returns: 1, 3, 7, 20, 55, 142,...) and override
 the procedure and replace it's results with there... But, of course, that
 means more work for the av... need for publicity... upgrade of product...
 and all the shit that follows.

        As I explained in the Taylor procedure the depth of the algorithm in
 the particular McLaurin Tayor type serie I used, when going too deep, the
 results for small x's give very wrong f(x)'s, but for larger x's a short
 depth gives wrong results. One might think that if I add to the encryption
 key the EXP(x), with x from 1 to 10, he could override my procedure and
 put himself the values... Do you really think so ? Nope... That's because
 starting from x=6, the McLaurin serie starts giving errors not only in the
 decimals but even in the integer part. This means that the aver should
 detach the procedure and compute the values. Anyway, there you just have an
 ideea. You may compute EXP(x) with let's say x from 100 to 500, only odd
 x's. Of course, that the serie will NEVER give the good result with a small
 depth (you can't push the depth too far because it slows the process). If
 you include a random way of taking the x's and find out a devious way to
 use f(x) you are KING ! But, beware of big errors !

        For you to develop here are some other formulas:

                  x      x^3    x^5     x^7
        sin(x) = ----- - ---- + ---- - ---- ...
                  1!      3!     5!     7!

                      x^2    x^4    x^6     x^8
        cos(x) = 1 - ----- + ---- - ---- + ---- ...
                      2!      4!     6!     8!

        Here you have the posibility to compare the result with the result
 given by the PU instructions. The difference should -> 0.

                       m     m(m-1)            m(m-1)...(m-n+1)
        (1+x)^m = 1 + ---x + ------x^2 + ... + ----------------x^n
                       1       2!                      n!

        Even if it looks ugly, it's so easy to code once you understood the
 FPU working style.

        About the Pythagoras procedure, now. I didn't work so much on that
 and as a whole it is more simplistic. It starts from 2 random numbers and
 after a thousand of FPU calculations it gives as a result 1. I used the
 1 to increase the pointer in decryption/encryption. But, you have there some
 very important procedures and those are: ArcSin and ArcCos (functions that
 cannot be computed unless some calculations are made; the FPU does not have
 them).

        A more nice approach would be this:

        - generate three numbers so that the sum of none two is smaller than
 the third.

        Now, you got a triangle with a,b,c as sides and A,B,C as angles...
        And the following formulas:

        cos(A) = -(a^2 - b^2 - c^2)/2bc
        cos(B) = -(b^2 - a^2 - c^2)/2ac
        cos(C) = -(c^2 - a^2 - b^2)/2ab

        This is the Extended Pythagora's Formula.

        And if cos(x) = y ==> x = arccos(y). So, you are able to compute the
 angles of the random triangle. Of course A+B+C = 180 (PI) and cos(pi)=1.
        So, compute:

                     cotg(A)*cotg(B)*cotg(C) - cotg(A)-cotg(B)-cotg(C)
        cos(A+B+C) = ---------------------------------------------------
                     cotg(A)*cotg(B)+cotg(B)*cotg(C)-cotg(C)*cotg(A)-1

        where cotg(x) = 1/tg(x)

        This should give you a result equal to 1.

        I wanna see a code-emulator emulating this formula !!

        So, this is mainly what I had to say. Look at the code and then try
 to be creative.

        Final word: all these sources have been fully tested and I am sure
 they can be compiled without any error. Now, if they don't work on a certain
 computer... I'm sorry. Anyway, they should.

        If you have ANY kind of questions or suggestions or ideas or comments
 or complains, please write me at:

                lordjulus@geocities.com
                                             Ŀ
                                               Lord Julus - 1998 
                                             
