Virus on CP/M (does it exist?)
Dr Henry Brancik
Does somebody know (or did anybody come across) a computer virus on
CP/M machines (I mean CP/M-2.* and CP/M-3.*)? I do not think that
it is possible to have such a "program" that will go into the system
and not being noticed during the transfer of files and then run on its
own (without the user actually typing the program name or including it
in the .SUB files). My claim is that such a program never existed
on those machines. Can anyone support me on that?
- Henry Brancik,
E-mail: hen...@aix00.csd.unsw.oz.au
Ewen McNeill
> Does somebody know (or did anybody come across) a computer virus on
> CP/M machines (I mean CP/M-2.* and CP/M-3.*)? I do not think that
> it is possible [...]
It's definitely possible - the fact that most CP/M machines boot from
disk makes it possible. However, it is unlikely to be able to do
much/survive across many machines simply because of the inherient
differences between the various machines that ran CP/M.
> in the .SUB files). My claim is that such a program never existed
> on those machines. Can anyone support me on that?
>
I've heard rumours that there was a CP/M virus, down to some details of
what it was supposed to do. I'm sceptical because when I heard it was
really too late for anyone to bother with CP/M for writing a virus
because it wasn't mainstream any longer.
> - Henry Brancik,
--
Ewen McNeill, ew...@naos.actrix.gen.nz (or ew...@actrix.gen.nz)
Andrew Scott Beals
>I've heard rumours that there was a CP/M virus, down to some details of
>what it was supposed to do.
Yeah, it's called the "BD Software C Compiler". There are many versions
of it. Somehow it ends up on everyone's diskettes even though they don't
know where it came from.
--
Andrew Scott Beals (415) 905-6590 any time KC6SSS
abe...@catnip.berkeley.ca.us ...!apple!catnip.berkeley.ca.us!abeals
Albert Einstein, when asked to describe radio, replied: "You see, wire
telegraph is a kind of a very, very long cat. You pull his tail in New
York and his head is meowing in Los Angeles. Do you understand this?
And radio operates exactly the same way: you send signals here, they
receive them there. The only difference is that there is no cat."
Josef Moellers
>Does somebody know (or did anybody come across) a computer virus on
>CP/M machines (I mean CP/M-2.* and CP/M-3.*)? I do not think that
>it is possible to have such a "program" that will go into the system
>and not being noticed during the transfer of files and then run on its
>own (without the user actually typing the program name or including it
>in the .SUB files). My claim is that such a program never existed
>on those machines. Can anyone support me on that?
Well, I've never seen a virus on my CP/M machine (actually it's an
SB180FX running ZSYSTEM, but that's compatible to CP/M) but I assume
that one could get a virus into such a system.
A virus does not necessarily have to be a complete "program", virusses
(viri/vira?) can also be attached to existing programs. I have the
impression that this is actually the usual way to have a virus.
There is one big difference between MS/DOS and CP/M that make having a
"free" virus in CP/M a little more difficult: the management of free disk
blocks. CP/M rebuilds (part of) it's free block list every time the
current list drains (call this "garbage collection"). That means that a
virus occupying a disk block that does not belong to a file, will sooner
or later be allocated to a growing file. MS/DOS on the other hand, has
it's FAT, which describes ON THE DISK which blocks are free and which
are in use. Therefore a virus can hide in a "non free" but also "non
allocated" block, pretty much like a "bad block". Under CP/M You would
have to group bad blocks into a file.
Of course, You can always attach a virus to an existing file. All CP/M
executables are "COM"-files, i.e. the entire contents of the file are
placed into memory and then execution commences at address 100h (0x100).
You could place a "JMP virus" there which jumps to the added code and
the added code then returns to e.g. 103h. However, think about what You
can (or cannot) do with a mere 56k of free memory (some CP/M systems
have even less).
As I said, I've never tried to write a virus myself, I've never seen one
on CP/M, and thanks to the widespread (commercial) use of MS/DOS, I
am glad no-one actually cares enough about CP/M to actually launch a
viral attack b-{)
> - Henry Brancik,
>E-mail: hen...@aix00.csd.unsw.oz.au
--
| Josef Moellers | c/o Siemens Nixdorf Informationssysteme AG |
| USA: molle...@sni-usa.com | Abt. STO-XS 113 | Riemekestrasse |
| !USA: molle...@sni.de | Phone: (+49) 5251 835124 | D-4790 Paderborn |
Paul Martin
> Does somebody know (or did anybody come across) a computer virus on
> CP/M machines (I mean CP/M-2.* and CP/M-3.*)? I do not think that
Yes, it's perfectly possible to write a CP/M 3 virus. The important
difference between CP/M 2 and 3 is that you can turn off error reporting
in CP/M 3.
I have written such a virus, but deleted all trace of it except its source
code. The virus would propagate on any Z80 CP/M 3.1 machine, and it would
detect and do nothing on 8080 or CP/M 2 machines. Its code was position
independent, and it tagged on to the end of .COM files (also modified the
first 8 bytes).
The action of the virus was benign -- spread to .COM files on the current
drive, and print a silly message every 10 invocations. Its length was three
sectors (768 bytes).
--
Paul Martin
Internet: pm.no...@spuddy.uucp pm.nowster%spudd...@uknet.ac.uk
Fidonet: 2:250/107.3