

        TridenT Polymorphic Engine                       version 1.3
        ============================================================

        Written by Masud Khafir of the TridenT virus research group.



What is it?
~~~~~~~~~~~

        The TPE is a module that can be included in programs to make
        them able to produce polymorphic programs. The TPE comes as
        an OBJ file. If you want to include the TPE in your program
        you must link it to it. If you have never linked an object
        file to a program, DON'T start with the TPE. First do this,
        then return to the TPE.

        The TPE does two things. First, it will encrypt the original
        code. This is done in a different way each time the TPE is
        called. Second, it will generate a decryption routine for it.
        The encrypted code will be put right after the decryption
        routine. The size of the decryption routine will not be very
        big. At most a few hundred bytes. Of course, the decryptor
        will also be different each time the TPE is called. The TPE
        can produce plain decryptors or decryptors with some random
        non-functional instructions inserted.

        The size of the TPE is 1411 bytes; We believe this is not too
        big.



What's new?
~~~~~~~~~~~

        Read the file HISTORY.DOC for more information about this
        new version of TPE.



How can I use it?
~~~~~~~~~~~~~~~~~

        The TPE offers you 3 subroutines: 'rnd_init', 'rnd_get' and
        'crypt'. It also can give you the addresses of the begin and
        end of TPE. If you write your program in assembler, you must
        include the following in your source code:

                .model  tiny
                .code

                extrn   rnd_init:near
                extrn   rnd_get:near
                extrn   crypt:near
                extrn   tpe_bottom:near
                extrn   tpe_top:near

        The first (rnd_init) is a subroutine to initialize the random
        number generator. You are advised to call this subroutine
        before the first time you call the encryption subroutine. If
        you don't, the random number generator may not function
        perfectly. All registers will be preserved.

        The second is a subroutine that returns a random number in AX.
        This subroutine is used by TPE, but you can use it also for
        other things in your program. Your imagination is the limit.
        All registers, except AX, are preserved.

        The third is the actual encryption subroutine. This one needs
        several input parameters. When it finishes, it will return
        some output parameters. All parameters are passed in registers
        (see below).

        The last two are the begin and end addresses of the TPE in
        your program. You may need these if your program is going to
        include the TPE in the generated program.

        You can leave out 'extrn' commands of things you don't use
        in your source code. 

        Be sure that there is enough stack space for the TPE. (100
        bytes appear to be enough). If you use the TPE in a resident
        program, it is recomended to maintain your own stack.
        Otherwise the chance is that you will blow the DOS stack.

        Of course, you must link TPE.OBJ to you program!
        If you are using more than one segment in your program, the
        complete TPE will be put in the CODE segment (called _TEXT). 



Input parameters of the crypt routine:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

        ES = Work segment

            This is the place where the decryptor and the encrypted
            code will be generated. Be sure that it is large enough.
            It must at least be as large as the size of the code to
            encrypt plus the size of the decryptor. 512 bytes plus
            the length of the code ought to be enough.

        DS:DX => Code to encrypt

            This must point to the code you want to encrypt.

        CX = Length of code to encrypt

            Put the size of the piece of code you want to encrypt
            in CX. The TPE cannot encrypt more than 32768 bytes,
            so the value of CX must be lower.

        BP = Offset where the decryption routine will be executed

            You must put the address where the decryptor will start
            in BP. For example, if the generated program will be a
            COM file which starts with the decryptor, you must set
            this value to 100h.

        SI = Distance between decryptor and encrypted code

            In this register you must put the distance that will be
            between the decryptor and the encrypted code. If the
            encrypted code will be right after the decryptor (this
            is the normal case) you must set this value to 0.

        AX = Bit field

            In this register you can provide some options about the
            way the decryptor must be.

            bit 0:  DS will not always be equal to CS

                If you are not sure that DS will be equal to CS when
                the decryptor takes control, you must set this bit
                high. This is the case when the decryptor is in an
                EXE file.

            bit 1:  Insert random non-functional instructions in 
                    decryptor

                If this bit is high, the decryption routine will
                contain several non-functional instructions. Since
                these instructions are non-functional, they don't
                disturb the decryptor.

            bit 2:  Put random instructions before decryptor

                If this bit is high, several random instructions
                are put before the decryption routine. These
                instructions may affect the registers, but they
                won't disturb the decryptor.

            bit 3:  Preserve AX with decryptor

                If you want to preserve the original value of AX
                after decryption, you must set this bit high.



Output parameters of the crypt routine:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

        ES = Work segment (preserved)

            ES will still point to the work segment.

        DS:DX => Decryptor + encrypted code

            This will now point to the decryptor, immediatly followed
            by the encrypted code. DS:DX will be the same as ES:0000.
            If SI was set to 0 before the TPE was called, the code
            is now ready to be put in a file.

        CX = Length of decryptor + encrypted code

            CX now has the summary length of both the decryptor and
            the encrypted code. You can use this value to write the
            decryptor plus the encrypted code to a file (in case SI
            was set to 0 before the TPE was called).

        DI = Length of decryptor

            If SI was not set to 0 before the TPE was called, you
            will need this value when you want to write the decryptor
            to a file. This value can also be used as an offset of
            the encrypted code. This will be at DS:DI (because DX
            will be 0). If SI was 0, you can ignore this value.

        AX = length of encrypted code

            This value will be the same as the value of CX before
            the TPE was called. If SI was not set to 0 before the
            TPE was called, you will need this value when you want
            to write the encrypted code to a file. If SI was 0, you
            can ignore this value.



Final notes.
~~~~~~~~~~~~

        First, I want to thank the Dark Avenger from Bulgaria for his
        nice 'Mutation Engine' program. This fine program has been a
        great source of inspiration for the TPE!

        Check out the source of TPE-GEN to learn more about the TPE
        and how it works.

        Please, remember that the author of the TPE and the TridenT
        virus research group are not responsible if you use the TPE
        in an illegal or naughty way.        

        Good luck.
