;
; deice.asm by Inbar Raz
;
; Notice - this is for COM only
;
 .model tiny
 .code
 org 0100h
CODESTART EQU $
Start: jmp Begin
NewName db 'OPENED.COM', 000h
Handle dw ?
Old60 dd ?
M_Prog db 'DeIce - A program to extract executables compressed under ICE.'
 db 00Dh, 00Ah
 db 'By Inbar Raz, 2:401/100.1 or 2:403/123.42.'
CrLf db 00Dh, 00Ah, 024h
AlgorithmSize EQU 00200h
; ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
;
; First Breakpoint - Encryption Loop
CallerOff EQU word ptr ss:[bp+00002h]
RetAddress EQU word ptr ss:[bp+00008h]
HereCount db 2
New60 proc far
 push bp
 mov bp,sp
 dec cx ; When CX=1, LOOP simply proceeds.
 jnz Wrong
; By now, the encryption has been finished. Now we will replace the second
; loop also with a CD 02, and we will self-modify the routie so it would handle
; the second loop.
; First, let's find the address for the next breakpoint
 push ax
 push cx
 push dx
 push di
 push ds
 std
 mov cx,AlgorithmSize
 mov di,RetAddress
 mov al,001h
Scan2: repnz scasb
 or cx,cx
 jnz NotDone
 jmp NotIce
NotDone:
 cmp word ptr es:[di+2],0FF2Eh ; The LOOP we are searching
 jne Scan2
 cmp word ptr es:[di+4],00A26h
 jne Scan2
 inc di
 inc di
 mov ax,060CDh ; Replace with INT 60
 stosw
 mov ax,02560h
 push cs
 pop ds
 lea dx,New60_
 int 21h
 pop ds
 pop di
 pop dx
 pop cx
 pop ax
 pop bp
 iret
Wrong: push ax
 mov ax,CallerOff
 sub ax,00008h
 mov CallerOff,ax
 pop ax
 pop bp
 iret
New60 endp
; ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
New60_ proc near
 int 3
 push ds
 push cs
 pop ds
 mov ah,03Ch
 mov cx,00020h
 lea dx,NewName
 int 21h
 jnc Created
 call Print
 db 'Unable to create destination file.$'
Created:
 mov word ptr cs:[Handle],ax
 mov bx,ax
 mov ah,040h
 mov cx,di
 sub cx,001ACh
 mov dx,si
 pop ds
 int 21h
 mov ah,03Eh
 mov bx,word ptr cs:[Handle]
 int 21h
 call Print
 db 'Extracting file completed.$'
New60_ endp
; ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß
;
; Beginning of activation code
Begin: mov ah,009h
 lea dx,M_Prog ; 'DeIce - A program to extract...'
 int 21h ; Display $-terminated string at ds:dx
 mov ax,03560h
 int 21h
 mov word ptr [Old60],bx
 mov word ptr [Old60+2],es ; Store old vector
 mov ax,02560h
 lea dx,New60
 int 21h
 push cs
 pop es
 mov si,00080h ; Count of chars on CommandLine
 lodsb
 or al,al
 jnz FetchName
 call Print
 db 'No file specified.$'
FetchName:
 cld
 mov di,00082h ; Command line start in PSP
 mov al,00Dh ; Search for end of line ( 00Dh )
 mov cx,007Fh ; Maximum size of commandline
 repnz scasb
 dec di
 mov al,000h
 stosb ; Repace it with 0, to make it ASCIIZ
 mov ax,03D00h
 mov dx,00082h
 int 21h
 jnb Opened
 call Print
 db 'Unable to open specified file.$'
Opened: mov word ptr Handle,ax
 mov ax,cs
 add ax,((CODEEND-CODESTART) shr 4) + 16 ; Stack space
 mov ds,ax
 lea sp,NEWSTACK
 mov ah,03Fh
 mov bx,word ptr cs:[Handle]
 mov cx,0FFFFh ; Maximum size of COM file
 mov dx,00100h
 int 21h ; Read cx bytes from handle bx to ds:dx
 mov ah,03Eh
 mov bx,word ptr cs:[Handle]
 int 21h ; Close file handle in bx
 push ds
 pop es
 mov cx,AlgorithmSize
 mov al,0D0h
 mov di,00100h
Scan1: repnz scasb ; Search for al in es:[di]
 jcxz NotIce
 cmp word ptr es:[di],0F8E2h ; The LOOP we are searching
 jne Scan1
 mov ax,060CDh ; Replace with INT 60
 stosw
 push es
 mov ax,0100h
 push ax
 retf ; Jump to COM program
; ***************************************************************************
NotIce: call Print
 db 'Program is not compressed under ICE.$'
; ***************************************************************************
Print proc near
 push cs
 pop ds
 mov ah,009h
 pop dx
 int 21h
 mov ah,009h
 lea dx,CrLf
 int 21h
 mov ax,02560h
 lea dx,Old60
 int 21h
 mov ah,04Ch
 int 21h ; Terminate program
Print endp
; ***************************************************************************
CODEEND EQU $
NEWSTACK EQU CODEEND+04Dh
 end Start

.