#Mac 1994 emulator code

This code will then be executed when the system starts up next. The virus copies all 712 bytes of itself into this INIT resource. This is where the name of the virus comes from. It will then create a new entry in the INIT resource section with an ID of 29. This will retrieve the System resource file. When an infected application is run it will call UseResFile passing in a refNum value of zero. You can see how it has saved the original jump table entry to the CODE resource with ID 1. The image below shows a section of the virus code. This should be the entry point to the application but the INIT 29 virus has modified the jump table entry to point to itself instead. You can see based on the resource names that ID 1 has a name of вЂњMainвЂќ and is the largest section of code. In the case of the jump table above, the first entry in the jump table actually points to the CODE resource with ID 3. The first entry in the jump table points to the main entry point for the executable. Normally when the compiler builds an application it would create CODE resources sequentially and similarly the jump table would also be laid out in a linear fashion. If itвЂ™s a small application it might only have one or two entries in the table. Each executable has a CODE resource with ID 0 that contains the jump table. The second indicator can be seen in the jump table. The first indicator is a CODE resource of exactly 712 bytes. Infected applicationДЄn application infected with the INIT 29 virus can be easily identified using ResEdit. The virus can only spread via system files and application files. Document files are infected, but they are not contagious. Also, unlike Scores and nVIR, INIT 29 can and will infect almost any file, including applications, system files, and document files. Unlike Scores and nVIR, you do not have to run an application for it to become infected. The original strain is called вЂњINIT 29 AвЂќ. There are no significant difference between the two strains. A second minor variant appeared in March, 1994. The INIT 29 virus first appeared in late 1988. The Disinfectant 3.7.1 help file has a good short description of the virus: The first virus I decided to look at is called INIT 29. Second, it provides an interesting perspective on the history of malicious software. First, it provides a good overview of 68k assembly. I think taking a look at old viruses is interesting for two reasons. One of my goals of getting the emulator set up was to be able to look at and analyze viruses that affected older versions of Mac OS.

#Mac 1994 emulator mac os

In my previous post I covered my вЂњClassicвЂќ Mac OS emulator set up.