... enlarging it.
109 The Little Black Book of Computer Viruses
:10049000A2AF00FEC0A2FD00E80100C3E8510 073 56
:1004A0004C803EFD000 074 3FFE0EFD00BFAF00BE5D
:1004B000AA00E8BB00 475 7E 876 0 075 235F32C0AA60
:1004C000BFAF00BB4F00A0FD00B22BF6E203D88BFC
:1004D000F3E89C0057E8C4FF7412E 876 0 074 DDFE70
:1004E00006FD005F32C0AAB0010AC0C35F32C0C3BC
:1004F000BA0600B41ACD21BFAF00BEA300E 870 00...
... sort? Per-
haps they are the electronic analog of the simplest one-celled
8 The Little Black Book of Computer Viruses
The Little Black Book
of
Computer Viruses
Volume One:
The Basic Technology
By ... protected.
4 The Little Black Book of Computer Viruses
day to day computing. Many people think of viruses as sort of a
black art. The p...
... completion of the program.
Any other value indicates some kind of error, as determined by the
50 The Little Black Book of Computer Viruses
program making the DOS call. So, the simplest COM program
would ... risk! It’s not like any other computer program you’ve ever run!
52 The Little Black Book of Computer Viruses
infecting every EXE file on the sys...
... motor startup is
156 The Little Black Book of Computer Viruses
In all, this CD is one of the most fascinating collections of secret
underground computer software on earth—a full 1 57 megabytes in total.
We ... and 7 - Not used
Function 47H: Get Current Directory
Registers: ah = 47H
162 The Little Black Book of Computer Viruses
Computer Viruses,
Arti...
... bytes)
and so on.
Potentially RAND_INSTR will need classes with very limited
capability, like (1), so we should include them. At the other end of
the scale, the fancier you want to get, the better. ... such techniques in the
early 90’s. Some of the first viruses which employed such tech-
niques were the 1260 or V2P2 series of viruses. Before long, a
Bulgarian who called...
... COM file.
26 The Little Black Book of Computer Viruses
essors. In the CP/M world, 64 kilobytes was all the memory a
computer had. The lowest 256 bytes of that memory was reserved
for the operating ... when they are correctly written. Which-
ever assembler you decide to use, though, the viruses in this book
19 The Little Black Book of Computer Virus...
... Found
Yes
No
34 The Little Black Book of Computer Viruses
cx:dx is used as the offset from the end of the file. Since the first
thing the virus must do is place its code at the end of the COM file
it ... [HANDLE]
44 The Little Black Book of Computer Viruses
Now, with the main body of viral code appended to the end
of the COM file under a...
... SEC_SIZE - 1]/SEC_SIZE
and the size of the file in sectors. The file size in bytes is stored at
the offset 1CH from the start of the directory entry at 0000:0500H.
The number of sectors to load is ... 0000:7C00H. If the BIOS doesn’t find a
disk in drive A:, it looks for the hard disk drive C:, and tries to load
68 The Little Black Book of Computer Viruses...
... DOS
92 The Little Black Book of Computer Viruses
VIRUS_START:
call GET_START ;get start address
;This is a trick to determine the location of the start of the program. We put
;the address of GET_START ... point of view) if it infects the diskette even when the disk
is full, and it will have to overwrite a file to infect the disk
84 The Little Black...