Introduction
Detlef is a computer virus written for the Commodore Amiga. It is a bootvirus.
Summary
- Overwrites the bootblock of an unprotected floppy disk when inserted in the disk drive.
- It is fully encrypted using register $dff00a
- Uses DoIO() of the exec.library for infection
- Resident by using KickTag
Details
If you boot with an infected disk the virus will decrypts itself by an simple "add.b" loop. This will crash on Amigas with higher CPUs (68020, 030 etc..) installed because this routine is not cache-aware.
Then the virus checks if it is already installed in memory by writing to the absolute address $300. This is dangerous and could cause a crash, too. If it is not already in memory it allocates 1024 byte of ChipRam, makes itself resident via KickTag and finally hooks the DoIO()-vector of the exec.library.
If a floppy disk is inserted in the disk drive the DoIO()-hook becomes active and does the following:
- resets the DoIO()-vector to original state
- saves the original IOReq-struct to $70000 (direct access, no allocation!!)
- checks if the disk is unprotected
- if no, then the DoIO()-vector will be altered again and nothing happens
- if yes, the virus encrypts itself to address $70400 (direct access, no allocation!!) by using a random-byte out of hardware-register $dff00a. Then the disk will be infected.
While resetting the Amiga a 1:15 chance exists that a routine is triggered which decrypts a text-area within the virus to $73000 (direct access, no allocation!!). This text will be then shown in an alert:
Fully decrypted you can read the following text:
0370h: 19 47 75 74 65 6E 20 54 61 67 2E 00 01 00 B9 28 ; .Guten Tag....¹(
0380h: BB 20 49 63 68 20 68 65 69 DF 65 20 44 45 54 4C ; » Ich heiße DETL
0390h: 45 46 20 AB 00 01 00 4B 36 49 63 68 20 77 65 72 ; EF «...K6Ich wer
03a0h: 64 65 20 53 69 65 20 69 6E 20 64 65 72 20 6E E4 ; de Sie in der nä
03b0h: 63 68 73 74 65 6E 20 5A 65 69 74 20 65 74 77 61 ; chsten Zeit etwa
03c0h: 73 20 6E 65 72 76 65 6E 2E 00 01 00 55 46 47 65 ; s nerven....UFGe
03d0h: 6D 61 63 68 74 20 77 75 72 64 65 20 69 63 68 20 ; macht wurde ich
03e0h: 76 6F 6E 20 B7 20 20 20 20 20 20 4D 20 20 41 20 ; von · M A
03f0h: 20 58 20 20 20 20 20 20 20 2E B7 00 53 41 55 2E ; X .·.SAU.
Clones and variants
None
