From: akcs.joehorn@hpcvbbs.cv.hp.com (Joseph K. Horn) Newsgroups: comp.sys.hp48 Subject: VIRUS ALERT Keywords: virus vaccine Message-ID: <294dc568:401comp.sys.hp48@hpcvbbs.cv.hp.com> Date: 17 Dec 91 09:40:11 GMT Lines: 141 * * * * * * * * * * * * * * * * * * * V I R U S A L E R T * * * * * * * * * * * * * * * * * * * "Next to a battle lost, the greatest misery is a battle gained." -- Wellington It was just a matter of time. Three viruses (all very similar) have been written for the HP 48. As if this weren't bad enough, they are being spread around on college campuses as a practical joke. Not funny at all, when it's your 48 that gets sick, then goes psychotic, and finally dies. I must admit, however, a certain morbid respect for the author(s); these little timebombs are well written. When stripped from their host program, they look like this harmless little 3-object snippit: "*" External Code where the * is the null character (displayed as a little square blob). The "External" is not at all what it appears to be! It's really an "external type 2" object, one of the four unused object types; and it contains the real body of the virus, in System RPL. The subsequent Code object merely jumps backwards into the External object, just past its object header, thus executing its contents as an RPL program. If you engage in promiscuous I/O with college students (who doesn't?), be on the lookout for the following bogus "error messages": "System Malfunction" "Defective ROM" "Damaged ROM" "Invalid Addressing" Also, the virus attaches itself to other program objects in the current directory (thereby earning the name "virus"). Since it modifies objects without your knowledge, it may wreak havoc that the author(s) never intended, especially if you are into System RPL programming. It may cause objects to be purged, entire directories to be lost, memory corrupted, and even total Memory Clear. And the null character at the beginning prevents you from removing the virus by normal editing, because when you hit EDIT you'll get the "Can't Edit Null Char." error message. This sucker not only propagates itself, it even has self-preservation instincts! Geez. Since the current "strains" of this virus all contain the same Code object, it's easy to write a "vaccine" that checks a program for the virus, and if found, "disinfects" it. If you'd like to do it yourself, here's the recognizable 29.5-byte Code object: In ASC-> format: %%HP:T(1); "CCD20630001741433450000EA1411C414334A0000CA14134E8F60DA808C4ECA" Source code: HP AG opcode -------- ------------ -------- D1=D1+ 5 ADD.A #5,D1 174 A=DAT1 A MOVE.A @D1,A 143 LC(5) 5 MOVE.P5 #5,C 3450000 A=A-C A SUB.A C,A EA DAT1=A A MOVE.A A,@D1 141 D1=D1- 5 SUB.A #5,D1 1C4 A=DAT1 A MOVE.A @D1,A 143 LC(5) 10 MOVE.P5 #A,C 34A0000 A=A+C A ADD.A C,A CA DAT1=A A MOVE.A A,@D1 141 LC(5) #06F8E MOVE.P5 #06F8E,C 34E8F60 A=C A MOVE.A C,A DA PC=(A) JUMP.A @A 808C The "External" object immediately precedes this Code object. It consists of its five-nibble prolog (02BCC), followed by a five-nibble length field (nib distance to the following Code object). The length field is immediately follwed by an RPL program object (beginning D9D20, of course), which is the nucleus of the virus, the part that does all the dirty work; the "DNA" part, as it were. For obvious reasons, I will not post the virus itself. Brian Maguire considered this sordid situation to be a delightful programming challenge, and whipped up the following two programs. 'VACCINE.1' disinfects program objects, and 'CLEAN' disinfects entire directories. INSTRUCTIONS: Place program on stack and press VACCINE.1 to disinfect it, or run CLEAN to disinfect all the programs in the current directory. Obviously it is best to keep these programs protected in a card switched to the ROM position. They can be run from there, for example via a CST key, or a user-mode key assignment. %%HP:T(1); @ VACCINE.1 and CLEAN, by Brian Maguire "69A20E33A8000000005034C45414E450D9D20E1632C53A2FA1A1A59C19C2A2DB BF10A132D6E20109678BF104B0284E20906514343494E454E213DBBF1DCC02C4 23293632B2130B7000906514343494E454E21390D9D20D2951D9F81F3040D9D2 02A170D9D2013236A9226DA9160CA308813030040C9B267E126DA916C0126132 3698226DA916C0126D0040C9B2679E60CCD20630001741433450000EA1411C41 4334A0000CA14134E8F60DA808C79B30B2130EE170980505E170B2130B213072 25" -------< Begin VACCINE in UUencoded format >------- begin 600 virus M2%!(4#0X+466*N`SB@`````%0TQ%04X%G2W@82-=+1`C8YHBUIIAP#J`&`,#0,"Y8N------- Here's the source code for the curious and curiouser: 'VACCINE.1' ( in System RPL ) :: CK1NoBlame CK&DISPATCH0 EIGHT :: BEGIN :: DUPLENCOMP #2= NOTcase FALSE DUP TWO NTHCOMPDROP DTYPECOL? NOTcase DROPFALSE DUPLENCOMP #3= NOTcase DROPFALSE THREE NTHCOMPDROP ' CODE 49 1741433450000EA1411C414334A0000CA14134E8F60DA808C EQUAL ; WHILE CARCOMP REPEAT ; ; 'CLEAN' ( in User RPL ) \<< 8 TVARS LIST\-> 1 SWAP FOR i DUP RCL VACCINE.1 SWAP STO NEXT \>> Many thanx to Brian Maguire for making this potentially terrifying situation so easy to cope with. -jkh- EQU akcs.joehorn@hpcvbbs.cv.hp.com