lol
so decided to look at this newly dumped warez CD: https://archive.org/details/blobby58_cracked
(yay for the wordart used in the menu, btw)
...there's some extra protection trojan horse there.
basically, autorun.inf points to GO.COM which is a compiled batch file: cd BLOB && MENU.EXE
menu.exe is a VB exe which runs RAR32.EXE (the actual menu in delphi).
...except, if "C:\PROGRAM FILES\EASY-CD PRO 95\ECDPRO.EXE" exists, then it will also delete "C:\PROGRAM FILES\EASY-CD PRO 95\*.*" and copy MSVB.DLL over C:\WINDOWS\WIN.COM
MSVB.DLL is a .COM file that's packed by hackstop, which isn't effective if you allow usage of modern tools: run it in dosbox debugger, let it run, when it actually executes, break and step out of any interrupt routine, and CS:IP hits the unpacked code which can be dumped out of memory (it's a .COM file so guaranteed to be a single segment)
anyway, it claims to run FORMAT C: (although forgets the ">" in the dos prompt); waits for a keyboard press which then acts as if "Y" was pressed. instead of formatting the drive, it prints a "progress" and busy loops (but also writes unremarkable data to C:\WINDOWS\BLOB.DAT to simulate disk activity)
after the "format" completes it shows a message in yellow " THANK YOU FOR FLYING WITH BLOBBY INTERNATIONAL.... HAVE A NICE DAY.. ", sets C:\WINDOWS\BLOB.DAT to hidden, and exits to dos.
all text printing is done by int 10h.
also, there's a bug with the file writing: if opening C:\WINDOWS\BLOB.DAT fails (due to C:\WINDOWS not existing for example), the carry flag is not checked, and will proceed to use the error code as file handle. for C:\WINDOWS not existing, that means it writes to stderr instead of a file. lol.
#reversing #ReverseEngineering #DOS #MS_DOS #TrojanHorse #warezCD
