[Coco] Coco virus/worms are possible!

[Stan Blazejewski]

On Mon, 13 Dec 2004 01:07:27 -0500 (EST), you wrote:

>On Sun, 12 Dec 2004, Robert Gault wrote:
>
>> A topic that comes up occasionally is "can a Coco be infected in a 
>> manner similar to current PCs". Generally the answer is no but I've just 
>> come across a method that could make infection a possibility.
>> 
>> I was asked about a Coco game that was stated to start running when the 
>> DIR command was issued. Now how can that be possible as DIR just prints 
>> text to the screen. Well, DIR does much more in order to get that text 
>> for printing.
>> 
>> One of the things done by DIR is to load the disk FAT table into a 
>> buffer at $600. As this table is no larger than a 256 byte sector, this 
>> should be safe. However, the game formats track 17 with six 1024 byte 
>> sectors. That means when DIR loads T17S2 (the FAT) it gets more than 
>> bargained for. The buffer is flooded way past the NMI vector at $983.
>> 
>> Since all disk I/O makes use of the NMI, this game probably puts an 
>> address into $982 that vectors to some code loaded from T17S2. Nothing 
>> really bad can happen on a floppy system but on a hard drive system a 
>> malicious program could erase the hard drive.
>> 
>> 
>
>This sounds like an urban legend to me, at least in the absence of information
>about what game supposedly does this.  Steve Bjork wrote a CoCo virus of this
>sort, he said, but never released it, just to see if it could be done.  But it
>seems highly unlikely to me that there would have been a game that used this
>technique without anyone prior to just now having remarked upon it.
>
>Art

I can't remember the name of the game but I definitely remember a disk
that would start the game on ANY access of track 17, be it DIR, BACKUP
or any other 3rd party software for reading disks.


--

Australia isn't "down under", it's "off to one side"!

stanblaz at netspace.net.au
www.cobracat.com (home of the Australian Cobra Catamaran)
http://groups.yahoo.com/group/cobra-cat/