Introduction
Hoden is a computer virus written for the Commodore Amiga. It is an old bootvirus.
Summary
- Overwriting the original bootblock when inserting an unprotected disk in the floppy-drive
- It is not crypted
- Hooks DoIO()-vector from the exec.library
- Makes itself reset resident by using the KickTag
- Works on Kickstart 1.2 only
Details
After booting with an infected disk the virus copies itself to ChipRam location $7F000 without allocation. If another programm overwrites this area the Amiga will crash. Then it makes itself resident by using the KickTag and finally hooks the DoIO()-vector of the exec.library. From now on any unprotected disk which is inserted in the Amiga floppy-drive will be infected. Additionally the virus will clear the CoolCapture and ColdCapture vectors on an DoIO()-access to remove other viruses.
The virus works only on Kickstart 1.2 Amigas because it assumes ROM locations which are only valid and existent on this version of the Amiga ROM:
infect:
(...)
move.l #$400,$24(a1)
move.l #0,$2C(a1)
jsr $FC06DC ; DoIO() original ROM-address only valid on Kickstart 1.2
Therefore on any other Kickstart-version than 1.2 the virus will crash the Amiga immediately while booting.
If the right mouse-button is pressed while resetting the Amiga the virus won't install the DoIO()-vector hook (so no disks will be infected until next reboot), however the KickTag vectors won't be removed!
On each infection the virus increases a counter which resides at ram-location $7FE00. If this counter reaches the value 5 the virus activates a graphical routine which runs a yellow sprite (a yellow head) one time through the screen from left to right:
At the end of the virus-code you can read the following text:
02d0h: 20 20 20 20 48 4F 44 45 4E 20 56 33 33 2E 31 37 ; HODEN V33.17
The routine used for infection is very similar to the routine used by the Coder virus.
