RAR & ZIP archivez management RARLIB.INC and ZIPLIB.INC provides similar interface part to work with RAR and ZIP archives. Available operations are: - scan archives (i.e. read headers & filenames) file by file; - modify file information (name,time,crc,...) for any file; - add new file to archive (with 'storing' method) Archive infection method: find first .EXE file, add dropper with same name to the end of archive, then rename .EXE file to '.EX_'. Archive is 'alredy infected' if .EX_ file present with special datetime signature. Each include file has ONLY ONE public subroutine called process_xxx; all other functions uses variables defined on the process_xxx's stack, i.e. they're internal. To use these functions in your allpication, move rar_data/zip_data structures into udata section and remove [ebp] addressing from code. ========================================================================== FUNCTIONs INPUT REGISTERS DESCRIPTION ========================================================================== process_rar EDX=archive name open archive; process_zip ESI=file data skip sfx part if present; ECX=file size find first .EXE file; add new file with the same name; rename .EXE file to .ZMB Returns CF=0 if archive changed ========================================================================== internal functions: ========================================================================== rar_open EDX=archive name open file; zip_open skip sfx part; read main archive headers/other info; -------------------------------------------------------------------------- rar_findnext none read current header(s)/file name zip_findnext (rar_fh/zip_fh structures); calculate offset of next header; -------------------------------------------------------------------------- rar_update none write current header(s)/file name zip_update (rar_fh/zip_fh, rar_fname/zip_fname) -------------------------------------------------------------------------- rar_add EDX=file data add new file to archive; zip_add ECX=file size if ESI and/or EBX = 0, name/time will ESI=fname (0=default) be taken from current file header EBX=ftime (0=default) (rar_fh/zip_fh); -------------------------------------------------------------------------- rar_close none close file zip_close ==========================================================================