Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A dive into the world of MS-DOS viruses (2019)

blog.benjojo.co.uk

Post reply on HN
Print view View original

21–30 of 32 posts

Re: A dive into the world of MS-DOS viruses (2019)

#21

Post by jzawodn »

drclau wrote: post #11

This brings back fond memories. It's been a _long_ time since then, and I was about 14yo. This was pre-internet, the BBS era. My computer, an old PC XT, 8086 based. I was getting new software via mail order from various specialized magazines, or from BBS's (to which I did not have access directly at that time -- not particularly relevant to this story). One day, I got something infected with a virus named Romania.856…

> What I miss the most now is the feeling of everything being new, the possibility for exploration and discovery.

Oh, good... it's not just me. :-)

Re: A dive into the world of MS-DOS viruses (2019)

#23

Post by Ingon »

My fascination with viruses actually brought me to programming. After reading a lot about them, one evening I said to my father (who was a programmer) that I want to learn how to write a virus. So, he gave me a book called “The C programming language”… But I never actually wrote one :)

Re: A dive into the world of MS-DOS viruses (2019)

#25

Post by dblohm7 »

jzawodn wrote: post #21
drclau wrote: post #11

This brings back fond memories. It's been a _long_ time since then, and I was about 14yo. This was pre-internet, the BBS era. My computer, an old PC XT, 8086 based. I was getting new software via mail order from various specialized magazines, or from BBS's (to which I did not have access directly at that time -- not particularly relevant to this story). One day, I got something infected with a virus named Romania.856…

> What I miss the most now is the feeling of everything being new, the possibility for exploration and discovery. Oh, good... it's not just me. :-)

Me three!

Re: A dive into the world of MS-DOS viruses (2019)

#26

Post by seppel »

drclau wrote: post #11

This brings back fond memories. It's been a _long_ time since then, and I was about 14yo. This was pre-internet, the BBS era. My computer, an old PC XT, 8086 based. I was getting new software via mail order from various specialized magazines, or from BBS's (to which I did not have access directly at that time -- not particularly relevant to this story). One day, I got something infected with a virus named Romania.856…

> I got something infected with a virus named Romania.856 (I will always remember this name)

For me it was Tai-Pan.438.A. I printed out(!) the disassembly code and studied it for weeks. I remember the stack modifications (not matching push/pop instructions) were super troubling for me to understand because such tricks were not really explained it the normal books.

Re: A dive into the world of MS-DOS viruses (2019)

#27

Post by EvanAnderson »

bnjf wrote: post #13

for those interested in the polymorphic libraries which became prevalent in the early 90s, I've got a disassembly of MtE at https://github.com/bnjf/mte/

I'll be interested to look at that MtE disassembly in detail. Thanks for doing that work.

If you enjoyed MtE you might enjoy the polymorphic engine from Natas (published in 40Hex[0]). It's not as complex as MtE. It's a bit oddball in that it appends the decryption routine to the payload.

[0] http://cd.textfiles.com/group42/VIRUS/40HEX/40HEX122.HTM

Re: A dive into the world of MS-DOS viruses (2019)

#28

Post by StanislavPetrov »

My first experience with an MS-DOS virus was in the late 1980s with the Jerusalem virus. We wanted to play Nethack during programming class (PASCAL) in the computer lab, and so brought a disk with a downloaded version (1200 baud) from home to install on the school's computers. Needless to say, someone had an infected copy, and before long it spread to most of the machines. It would cause weird things to happen like little blue rectangles to randomly appear. At that time, nobody was familiar with viruses (the computer teacher was actually a math teacher picking it up on the fly), and so the computers stayed infected for months until someone figured it out.

Re: A dive into the world of MS-DOS viruses (2019)

#29

Post by mycall »

seppel wrote: post #26
drclau wrote: post #11

This brings back fond memories. It's been a _long_ time since then, and I was about 14yo. This was pre-internet, the BBS era. My computer, an old PC XT, 8086 based. I was getting new software via mail order from various specialized magazines, or from BBS's (to which I did not have access directly at that time -- not particularly relevant to this story). One day, I got something infected with a virus named Romania.856…

> I got something infected with a virus named Romania.856 (I will always remember this name) For me it was Tai-Pan.438.A. I printed out(!) the disassembly code and studied it for weeks. I remember the stack modifications (not matching push/pop instructions) were super troubling for me to understand because such tricks were not really explained it the normal books.

I understand the modifications part, but why would push/pop counts be mismatched?

Re: A dive into the world of MS-DOS viruses (2019)

#30

Post by mycall »

marcodiego wrote: post #18
buescher wrote: post #8

Earlier quoted context omitted.

DOS programming could be caricatured as "bare metal with a file system".

Complementing sibling answer, the architecture used in CP/M, and somewhat mimicked by MS-DOS, allowed very high portability of the system. Ideally, no user space program should access the hardware directly. All its interactions should be through int 21h. The kernel implemented filesystem access and other system routines, occasionally making bios calls. Bios calls were very simple calls to a jump table in a predefined…

QDOS was originally a clone of CP/M, but for legal reasons was changed just enough to become 86-DOS (then became MS-DOS)

https://en.wikipedia.org/wiki/86-DOS

Post reply on HN