- Henry Brancik,

E-mail: hen...@aix00.csd.unsw.oz.au

hen...@aix00.csd.unsw.OZ.AU (Dr Henry Brancik) writes:

> Does somebody know (or did anybody come across) a computer virus on
> CP/M machines (I mean CP/M-2.* and CP/M-3.*)?  I do not think that

It's definitely possible - the fact that most CP/M machines boot from
disk makes it possible. However, it is unlikely to be able to do
much/survive across many machines simply because of the inherient
differences between the various machines that ran CP/M.

> in the .SUB files).  My claim is that such a program never existed
> on those machines.  Can anyone support me on that?
>

>                                       - Henry Brancik,

--
Ewen McNeill, ew...@naos.actrix.gen.nz (or ew...@actrix.gen.nz)

>I've heard rumours that there was a CP/M virus, down to some details of
>what it was supposed to do.

Yeah, it's called the "BD Software C Compiler".  There are many versions
of it.  Somehow it ends up on everyone's diskettes even though they don't
know where it came from.

--
Andrew Scott Beals (415) 905-6590 any time                             KC6SSS
abe...@catnip.berkeley.ca.us           ...!apple!catnip.berkeley.ca.us!abeals

Albert Einstein, when asked to describe radio, replied: "You see, wire
telegraph is a kind of a very, very long cat.  You pull his tail in New
York and his head is meowing in Los Angeles.  Do you understand this?
And radio operates exactly the same way: you send signals here, they
receive them there.  The only difference is that there is no cat."

Well, I've never seen a virus on my CP/M machine (actually it's an
SB180FX running ZSYSTEM, but that's compatible to CP/M) but I assume
that one could get a virus into such a system.
A virus does not necessarily have to be a complete "program", virusses
(viri/vira?) can also be attached to existing programs. I have the
impression that this is actually the usual way to have a virus.

There is one big difference between MS/DOS and CP/M that make having a
"free" virus in CP/M a little more difficult: the management of free disk
blocks. CP/M rebuilds (part of) it's free block list every time the
current list drains (call this "garbage collection"). That means that a
virus occupying a disk block that does not belong to a file, will sooner
or later be allocated to a growing file. MS/DOS on the other hand, has
it's FAT, which describes ON THE DISK which blocks are free and which
are in use. Therefore a virus can hide in a "non free" but also "non
allocated" block, pretty much like a "bad block". Under CP/M You would
have to group bad blocks into a file.

Of course, You can always attach a virus to an existing file. All CP/M
executables are "COM"-files, i.e. the entire contents of the file are
placed into memory and then execution commences at address 100h (0x100).
You could place a "JMP virus" there which jumps to the added code and
the added code then returns to e.g. 103h. However, think about what You
can (or cannot) do with a mere 56k of free memory (some CP/M systems
have even less).

As I said, I've never tried to write a virus myself, I've never seen one
on CP/M, and thanks to the widespread (commercial) use of MS/DOS, I
am glad no-one actually cares enough about CP/M to actually launch a
viral attack b-{)

> - Henry Brancik,

>E-mail: hen...@aix00.csd.unsw.oz.au
--
| Josef Moellers                | c/o Siemens Nixdorf Informationssysteme AG  |
|  USA: molle...@sni-usa.com        | Abt. STO-XS 113           | Riemekestrasse   |
| !USA: molle...@sni.de        | Phone: (+49) 5251 835124 | D-4790 Paderborn |

In a message hen...@aix00.csd.unsw.OZ.AU (Dr Henry Brancik) writes:

> Does somebody know (or did anybody come across) a computer virus on
> CP/M machines (I mean CP/M-2.* and CP/M-3.*)?  I do not think that

Yes, it's perfectly possible to write a CP/M 3 virus. The important
difference between CP/M 2 and 3 is that you can turn off error reporting
in CP/M 3.

I have written such a virus, but deleted all trace of it except its source
code. The virus would propagate on any Z80 CP/M 3.1 machine, and it would
detect and do nothing on 8080 or CP/M 2 machines. Its code was position
independent, and it tagged on to the end of .COM files (also modified the
first 8 bytes).

The action of the virus was benign -- spread to .COM files on the current
drive, and print a silly message every 10 invocations. Its length was three
sectors (768 bytes).

--
Paul Martin
Internet: pm.nowster@spuddy.uucp      pm.nowster...@uknet.ac.uk
Fidonet:  2:250/107.3