Viruses on the Spectrum - how to write your own virus.

                                  
                                         

  Viruses on the Spectrum          

                                         
                              (C) !mPeR!0
                                         
   The article was written by me for the PC
magazine Social Distortion #2, therefore
many moments in it may seem
too chewed, because the calculation was carried out
on people unfamiliar with Speck.    
  The source was cut from the article Power
Xhumator 4.1 due to its publication in
IMPULSE 3.                               
                                         
                From the author                
                                         
 That's all o6mah, I'm your king, I'm the only one.  
 People are like animals when power over mmpom is given,                                         
 Armenia, "06mah"
                                         
  To begin with, I want to say that I am not a virtual maker. If I
I wrote on Spec bmpyc, even if it’s the best, it doesn’t give me
the right to consider yourself a maker. Just I'm very mean:)       
                                         
  Secondly,  I've never really been interested in bmpycamm
Speck, so I may not know exactly the principles of the work. And
especially since I have no desire to make any preparations
mchodnmkov, 6o for hemmehmem such, everything will be alright nmcatb m
tectmpobatb from scratch, andtime isnot only money, but also m
good health.                                             
                                         
  B-tpetbmx,  Speck is not a PC, it is not so flexible
interrupt system, file system (TR-DOS - this is not cmctema,
a just a big glitch) etc., therefore it is not particularly suitable for
a bunch of fancy things to die for.                                 
                                         
And fourthly,I haven't written serious articles for a very long time
I'm used to hitting the lmrmk most often, so I'm smack
We will come to terms with the reminder of this ctatbm.           
                                         
             A little history             
                                         
 Different blood, different wounds,
                                    Very different times    
 Other mmeha.               
                                         
 Armenia, "Vicious Circle"
                                         
The whole thing began a few years ago so 5 years ago.I was still
very smallhowever, tpoxm is already in ASMe varml, so
adequately perceived the surrounding activity. It's clear that
like in all more or less scenic cities, we had tmna
Curly lights, considering themselves the navel of the earth. We probably
We were lucky - we had as many as 2 pieces. Odmn mz nmkh, Andy Tacker,already
sold software to the local population for about 5 years, and another,YfNG/NHG,
I considered myself the coolest hacker on Spec. I don't know what the first one is
told the second one, but the second one decided to do a great meanness.    
                                         
 This meanness was expressed in hanmcahmm bmpyca for the purpose
brought him into the enemy camp. I don't know if YfNG succeeded,
but there were tons of versions, I only got the last one -7.06,
sort of.  bmpyc itself was hanmcah rather clumsy, but forFIRST
bmpyca at that time it was pretty cool. Again, I don't
I claim that this was the first bmpyc, but it seems like this...          
                                         
 Young and inexperienced !mPeR!0, then bmsh I, let nmcatbahtmbmpyc. Ahtmbmpyca outputs as many as 3 bepcmm, each mz of which
buggy in its own way, but mmey all 3 can be quite successfully "y6mbatb"
die...                                                       
                                         
 A couple of months later, a racial mischief appears Last battle
(I address bhmmahme chronic alconauts - not Bottle, but Battle
;).  Something like a bmpyca sticks out in it, not even a bmpyca, but
just feces, increasing with each start of the counter
soon bpemehm making a fool's errand.  They say it was tmna
protection from nmpatctba. This protection died in a couple of mmhyt.      
                                         
 Pass 3 years...                                         
                                         
 To end of 98 receives oxepehhoe pacnpoctpahehme Zx-Net m
other crap. 0 bmpycax nm hearing, nm spirit (maybe it was, but in
at least I don'taware). After a long stupidity, I'm dying
dammit die, so that the people in Zx-Nete drag less. Versmy
there were a bunch, but the last one, 4.1, is being released into the wild. Govormlm,
that the trick was good :)                                     
                                         
First since 99 in different Cnekobckmx electronic devices
Articles of various stupid idiots about bmpycax appear. I don't
I know how this can be done nmcatb. This is equivalent to me sitting down
6s nmcatb about methods of rodent control.                       
                                         
  In the fall of '99  someone will raise the topic of bmpycax in the echo
ZX.SPECTRUM. Few people turn up, but we manage to get the source out
npmmmtmbhorooverwrite-bmpyca.  I didn't even let him in, I just
looked and erased. Then I get from the moderator "+" for
that he hid his Xhumator in the echo. The moderator promised another "+" for
every damaged medical center, but there seem to be no complaints;)...    
                                         
 For today, that's probably all.  If I do something
yupyctml, then sorry - I’m not the highest.                        
                                         
    Types of viruses, methods for    
     fights, and also a lot of swearing :(     
                                         
 From mhtepheta          
 B my computer       
 A terrible bmpyc got in...
                                         
 Freak dETSYL m friends
                                         
1).  That very first bmpyc, which was hanmcah YfNG, mmel
code name"YIR",which once again proved
the narrow-mindedness of its creator :)                              
                                         
 This bmpyc took up about a kilometer of free weight, which itself
to myselfcomes across bad thoughts.  Okay, if on PC
NutCracker becmt 7 kml, so he m tbopmt ecchm, and here...     
                                         
 In short, bmpyc tried to transfer the basic files it had
It worked out well.  Prm infected mchodny basic loader
was lost, becoming a tmna erased file, and a modmfmtsmrovanny
basic loader rushed to the end of the emergency room.  To the beginning of the bmpyc file
inserted something tmna:                                         
                                         
   1 RAND0MIZE USR XXXXX: code bmpyca                          
                     └─────^                                  
     ...the program continues                                    
                                         
m changed the starting line of the program to "1" accordingly.
After completing the bmpyc, the valve was restored
in his place, he handed over the execution to her.                      
                                         
 In his body bmpyc mmel countmk, which increased from
each launch of the infected nporm m prm doctmzhenmm
of a certain value, the zero track on the tmxo dmsk was deleted.  Disadvantage:                          
                                         
  - bmpyca is too big (imho, the compilation is the same
action on which Pascal, it was possible to get a smaller code);
   - not pa6otocnoc6nosti m galmmoroperability (I don’t
I checked it, but I can say this with 100% certainty) bmpyca
onmonoblock files.The fact is that it was intended for local
Dmstrmbyutera, from which everything was divided into files
(zagryzchmk separately, kaptmhka separately, code separately), m
it was quite possible to replace the loader with a liftable one; c
we will have monoblock programs, where everything bmcmt is in one file,
which can mmetb size 64 kmla m loadyzhmk dlmnoy, to
npmmepy, 112 bytes, industrialize it, rewrite this bmpycy not
by film.                                                  
                                         
2). Bmpb mz last battle (Last Battle).  B "readme" there was a stern warning for Mgryshka,
that tmna, who mmeet the ball version of our mgryshkm, that after
The Nth number of its launches will result in horseradish with oil, and not
mrpy.                                                         
                                         
 Horseradish with oil represented itself as a load of energy,
containing 2 kilobytes of so many clumsinesses, subsequently
turned out to be a bit of a bastard.                                 
                                         
This bastard did not know how to spread, but it put people on
counter  ;), which increased with each launch of MGR,
after which I did something bad (I didn’t wait for it
moment, but simply mowed down this rubbish).                       
                                         
3).  Simple overwrite bmpyc (I don’t know the name, I flew by
somehow in the echo of ZX.SPECTRUM). Bmpyc was an independent basic VMD file:   
                                         
   10 RAND0MIZE USR XXXXX: code bmpyca                         
                      └─────^                                 
                                         
 I didn’t really imagine the algorithm of its action
something reminiscent of:                                     
                                         
  1. We are looking for a suitable victim.                                 
  2. If the victim is found, then step 3, otherwise y6mbaem zero track.
   3. We put ourselves, dear ones, in the place of the victim.                   
  4. We fly to Kydykmny Mountain (tmna the program is corrupted and not
      starts).                                             
                                         
 Disadvantage: - hepa6otocnoco6ness with a monoblock file (oh, they don’t like
mx rodmmyh);                                                  
   - debmlny overwrite.  Sorry, but y6mbahme nporm prm
infected is insanity. Only a stupid user wouldn't suspect
something is wrong.                                                    
                                         
4). Devils that infect code files.                         
                                         
 Of course, I didn’t see one like that, but I heard it. Yes m
You don't have to be particularly smart to know how they work.      
                                         
 Naturally, resizing any code file is something special
area of the unreal. Each mz nmx mmeet has its own ynmKALnyaddress
launch, detect which bmpycy is not compatible.  But c
we will see the appearance of separate kaptmhokpackages, it has become quite
reality to infect although 6s are the most packed kaptmhkm. Yes
in principle, not only kapthmkm - it is important to find such a tmpfiles, the launch address of which can be detected by some name
prmsign.                                                     
                                         
  Example:  you should pack the kaptmhky in some way  Laser
Compacte, then the file c
extend  ".p"  - this is already a sign. You can watch the beginning
file for some kind of unpacking (if the file
packed).                                                
                                         
 Then you can understand it in two ways:                            
                                         
  1.  Delete the old file and put a new one with a larger length in
end of dmska (a la "YIR").                                     
  2.  Use the free space in the last
sector of the file (if it exists). Next, we paste "JP on bmpyc" into the beginning of the file and that's it...  
                                         
 Disadvantage:                          
                                         
  -  now it is quite difficult to find something lying on the market
separate files that can be so shamelessly yrpo6mtb, a
if it's good all over the city center, then it won't be noticed
person with vision nmzhe -7 ;)                                 
                                         
                                         
5). Power Xhumator.                                           
                                         
 I don’t want to boast about myself, but my creation has a lot of shortcomings
tkob, but still there are advantages.                          
                                         
 Bmpyc uses free space in the last sector of the file.
Botlmchmm from bmpycob 4) it does not touch code files, since
Nowadays they are not very common, but they mean basic
zagryzchmkm.                                                   
                                         
 Except from bmpycob 1) it does not restart the infected
file at the end of dmsk m perfectly pa6otaet as with separate
loading, so m with monoblock.                            
                                         
The algorithm does not pretend to be cool:                        
                                         
  1. Find the victim.                                           
  2. If there are victims, then step 3, otherwise y6mbaem is a zero track.   
  3. Infect her.                                            
  4. Continueexecute the program.                         
                                         
 Checking on the victim's console is a nomck of files,
in which the size of the basic download does not exceed 114 bytes. So
as bmpyc mmeet the length is 138 bytes, and the sector is 256, plus we need
octabmtb another 4 bytes to the autorun lines of the basic file, we need
mmehho takme files.                                           
                                         
The infected person passes through two stages:                        
                                         
  1. Save bmpyca to a file.                                   
  2. Refer to TR-DOS (#3D13).  If one is found,
      then it is replaced with the bmpyca starting address.            
                                         
 To bmsh, regardless of whether there is an appeal to TR-DOS, mlm
no, bmpyc in the program is still bctabmt your cult. Otherbusiness,
that it will be called only prm nalmhmm CALL (JP) #3D13.   
                                         
 IMHO, Xhumator is ideal for all-in-one PCs, where 90%
cases the load contains the loading of the subsequent block via
#3D13.                                                        
                                         
 Disadvantage:                          
                                         
  - often in files we find the left two bytes #13 m #3D,
and why should I replace the file with the file (oco6ehho not
monoblock), but I had to sacrifice this in order to reduce the size
code;                                                         
  - bmpyc xepmt alternative registers A`,B`,C`,D`,E`,H`,L`.
So often this matter can be fatal
consequences, ifthe infected program mx is useful, but again
I had to sacrifice a few bytes;              
  - the infected basic file cannot mmetb be longer than
8759 bytes (for the basic, not the whole candy bar) - again
optmmmzatsya;                                                  
  - well, a few more little things that became the same
optmmmzatsmm.                                                  
                                         
          Real prospects          
                                         
 6erm, 6erm behind the sun,       
Sbmvaya horm in the blood          
 6erm, 6erm, don't be afraid         
 Play with fate again and again.
                                         
Armenia, "6erm behind the sun"
                                         
 Especially excited about the future y bmpycob on Spec ctpomtb
not ctomt.  Perhaps everything is deaddead, so I won’t appear much.
Well, as for momx plans and Xhumatora, in particular, then
makcmmym, what can be squeezed out is to save 2 bytes per
control protection of the dmsk from spare parts.Ilm, maybe I
How can I do it - decrease by 1 quantity
Pozmtsmonmrovanny head dmskovod, which will be even smaller
turn on yourself bhmmahme.   Instead of sequences
"infected file -> read 0 track -> infected new file
-> save 0 tracks -> infected file" there will be a sequence
"infected file -> read+record 0 track -> infected new
file -> infected file."                                    
                                         
There is also a way to use non-standard format 8 sectors 0
track m put bmpyc there, then it will be executed directly
everyoneaddressed to dmsky mz TR-DOS. True, this matter is easy
It will get caught, but what the hell! ;)                       
                                         
PS: It is quite possible that, while talking about all this nonsense, I missed
    something important.  I'm even sure that I missed something. I, in
    I'm sorry, I'm not complaining about my memory, but you'll understand that it's pere-
    She's not crazy. So, people, call me.