Virus in SPS release

Crashdisk · 23 July 2012, 05:02

I found some bootblock viruses in IPF disk officially recognized by SPS. Mastered with virus?!

Code:

0011 - Espionage - The Computer Game
Espionage.ipf
=> NorthStar 2 Bootblock

Code:

0206 - Backgammon
Backgammon.ipf
=> SCA Bootblock

Code:

0712 - The President is Missing
PresidentIsMissing,The.ipf
=> Byte Warrior (DASA) Bootblock

Code:

1246 - Chase H.Q. II: Special Criminal Investigation
ChaseHQII-SpecialCriminalInvestigation_Disk2.ipf
=> Lamer Exterminator Bootblock

Code:

1255 - Ooze - Als die Geister mürbe wurden
Ooze.ipf
=> PvL Virus Protector v5.0 Bootblock

Code:

1304 - Beam
Beam.ipf
=> NorthStar 2 Bootblock

Code:

1589 - Legend of Faerghail 
LegendOfFaerghail_Disk3.ipf
=> Byte Bandit Bootblock

Code:

1612 - StarRay
StarRay_BootDisk.ipf
=> SCA Bootblock

Code:

2159 - Astatin
Astatin.ipf
=> Sector 1086 is destroyed by The Lamer Exterminator virus (No file damage)

Code:

2669 - The Shortgrey
Shortgrey,The_Disquette0.ipf
Shortgrey,The_Disquette1.ipf
Shortgrey,The_Disquette2.ipf
Shortgrey,The_Disquette4.ipf
=> SADDAM disk-validator

Code:

2768 - Zombi
Zombi.ipf
=> Lamer Exterminator Bootblock

Code:

2804 - Chariots of Wrath
ChariotsOfWrath.ipf
=> Sector 1369 is destroyed by The Lamer Exterminator virus (No file damage)

Codetapper · 23 July 2012, 05:40

Indeed. I discussed this with IFW years ago and my opinion was they should have the viruses cleaned off them before creating the final IPF file, but IFW wanted them stored as they were mastered.

I still stand by that too. The only one that I knew about at the time was Chase HQ 2: SCI.

If someone accidentally boots off those disks they'll get infected, and none of those viruses would prevent the original game from running with a clean bootblock installed instead.

Methanoid · 23 July 2012, 08:46

I'd have mastered both with and without ... after all TOSEC is filled with so many Alts why shouldn't SPS have a few

Crashdisk · 23 July 2012, 14:18

Too bad the originals can not be clean. it looks unprofessional ...

Updated first post

Cassiel · 23 July 2012, 21:59

How crap is that! Though I guess stuff like that isn't exactly unusual now either... wasn't it some Acer OEM HD images 2 years ago that were found to include a virus? As well as TomTom's a few years before.

I have to say I do agree with original decision though... these absolutely should represent the original (albeit unfortunately virus infected) disks...

Crashdisk · 23 July 2012, 22:07

I also agree, but we must warn users of risks...

Cassiel · 23 July 2012, 22:09

Well, speaking for TOSEC you know we have a [v ] flag...

Crashdisk · 23 July 2012, 22:14

mai? where are you? we need you! If it is not too late for the next release...

mai · 23 July 2012, 22:22

Quote:

Originally Posted by Crashdisk

mai? where are you? we need you! If it is not too late for the next release...

Sorry, there are still some problems/issues, how to maintain SPS sets, especially if we would begin to add [v] flag.

-multiple files in one single zip.
-files inside zips fits not TNC.

Crashdisk · 23 July 2012, 22:37

Code:

Zombi (1989)(Ubi Soft)(FR)[v][2768]

There are already certain in any case...where is the problem for the other release?

mai · 23 July 2012, 22:41

Quote:

Originally Posted by Crashdisk

Code:

Zombi (1989)(Ubi Soft)(FR)[v][2768]

There are already certain in any case...where is the problem for the other release?

Quote:

Legend of Faerghail v2.0e (1990-07-24)(Rainbow Arts)[1589]

in this case, how could it be done properly?

Crashdisk · 23 July 2012, 22:54

if a game is an inseparable set. the [v] flag can be used for the set without changing the subset. no?

mai · 25 July 2012, 19:17

Quote:

Originally Posted by Crashdisk

if a game is an inseparable set. the [v] flag can be used for the set without changing the subset. no?

LegendOfFaerghail_Disk3.ipf
contains the virus, but not disk 1 and 2.
If i would name the relevant multi-zip, it would be misleading.
The solution would be to rename IPFs inside zip to TNC style.
If so, it would be:
1. a huge job
2. i am not sure, if it would annoying SPS guys.

In TOSEC forum was also proposed to create single zipped sets, instead of current multi zipped sets in SPS release.
This would cause another problem,

Cassiel · 25 July 2012, 23:16

Yes, this is why one of my recommendations was to have the IPF images as single-file rather than multi-file (no different from ADF images, or any other >1 disk images in fact).

IMO there's no reason to have IPF images grouped up/unrenamed in this way, and in fact goes against TOSEC/TNC convention.

The only reason is historical and/or blindly copying CAPS convention, and (again in *my* opinion) that's not a good enough reason...

mr.vince · 26 July 2012, 00:01

Quote:

Originally Posted by Codetapper

Indeed. I discussed this with IFW years ago and my opinion was they should have the viruses cleaned off them before creating the final IPF file, but IFW wanted them stored as they were mastered.

I still stand by that too. The only one that I knew about at the time was Chase HQ 2: SCI.

If someone accidentally boots off those disks they'll get infected, and none of those viruses would prevent the original game from running with a clean bootblock installed instead.

The reasons are still true today. The IPF is the representation as the disk was mastered. If you are using e.g. WinUAE, you can enable writing and install a fresh bootblock. Unlike disks that were damaged during mastering and won't work without fixing them (in which cases we exactly do that), these disks deliver historical proof how little precautions were taken for replication.

Again, these images are easy to fix when using them, the IPF stores the state you'd get as if you'd just bought the game.

lesta_smsc · 26 July 2012, 03:29

I wonder where the creators of the viruses are these days lol ...

Codetapper · 26 July 2012, 05:53

I'd still prefer to have this marked as virus infected, maybe release an alternative clean IPF of those disks.

If you have a Kyroflux you could write the IPF back and install the clean bootblock, but if you're using IPFs in an emulator you're not going to have a clean IPF file - only a saved disk image state combined with the IPF which is not ideal imho. Boot of that game then switch to another write enabled disk and bingo, infected disk.

dlfrsilver · 26 July 2012, 16:20

We could ask Kaffer to generate clean unofficial IPF

Keir · 26 July 2012, 17:21

Don't even need to completely re-generate the IPF. Just search-and-replace the virus bootblock, the two sectors of which will be verbatim in the IPF, with standard bootblock, and fix up a CRC.
Oh, and bork some of the IPF header values to make it an obviously 'unofficial' IPF. That seems only polite.

prowler · 26 July 2012, 20:48

Quote:

Originally Posted by mr.vince

Unlike disks that were damaged during mastering and won't work without fixing them (in which cases we exactly do that), these disks deliver historical proof how little precautions were taken for replication.

I am, quite frankly, dismayed by this attitude. Personally, I find it very discouraging.

I have to say that, although the warts and all approach is an honourable one, I think it would be a mistake to give unofficial IPFs the opportunity to become the preferred versions in this instance, or indeed in any instance for whatever reason.

Just my 2 cents.

23 July 2012, 22:37	#10
Crashdisk Moderator Join Date: Jun 2009 Location: France Age: 46 Posts: 1,982	Code: Zombi (1989)(Ubi Soft)(FR)[v][2768] There are already certain in any case...where is the problem for the other release?

26 July 2012, 17:21	#19
Keir Registered User Join Date: May 2011 Location: Cambridge Posts: 682	Don't even need to completely re-generate the IPF. Just search-and-replace the virus bootblock, the two sectors of which will be verbatim in the IPF, with standard bootblock, and fix up a CRC. Oh, and bork some of the IPF header values to make it an obviously 'unofficial' IPF. That seems only polite. Last edited by Keir; 26 July 2012 at 17:27.

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
SPS website	AGN	project.SPS (was CAPS)	5	16 October 2008 17:21
Sps Ipf??? [SPS vs. ADF dats]	NLS	project.MAGE	7	10 August 2008 17:41
The SPS Team would release certain games and not others	NewDeli	project.SPS (was CAPS)	6	26 July 2008 01:09
Lookup by SPS ID	jotd	HOL suggestions and feedback	2	02 August 2006 00:45

23 July 2012, 05:40	#2
Codetapper 2 contact me: email only! Join Date: May 2001 Location: Auckland / New Zealand Posts: 3,182	Indeed. I discussed this with IFW years ago and my opinion was they should have the viruses cleaned off them before creating the final IPF file, but IFW wanted them stored as they were mastered. I still stand by that too. The only one that I knew about at the time was Chase HQ 2: SCI. If someone accidentally boots off those disks they'll get infected, and none of those viruses would prevent the original game from running with a clean bootblock installed instead.

23 July 2012, 08:46	#3
Methanoid Retired Quartex Sysop Join Date: Sep 2001 Location: Roman Verulamium Age: 58 Posts: 1,873	I'd have mastered both with and without ... after all TOSEC is filled with so many Alts why shouldn't SPS have a few

23 July 2012, 14:18	#4
Crashdisk Moderator Join Date: Jun 2009 Location: France Age: 46 Posts: 1,982	Too bad the originals can not be clean. it looks unprofessional ... Updated first post

23 July 2012, 21:59	#5
Cassiel Registered User Join Date: Oct 2011 Location: - Posts: 82	How crap is that! Though I guess stuff like that isn't exactly unusual now either... wasn't it some Acer OEM HD images 2 years ago that were found to include a virus? As well as TomTom's a few years before. I have to say I do agree with original decision though... these absolutely should represent the original (albeit unfortunately virus infected) disks...

23 July 2012, 22:07	#6
Crashdisk Moderator Join Date: Jun 2009 Location: France Age: 46 Posts: 1,982	I also agree, but we must warn users of risks...

23 July 2012, 22:09	#7
Cassiel Registered User Join Date: Oct 2011 Location: - Posts: 82	Well, speaking for TOSEC you know we have a [v ] flag...

23 July 2012, 22:14	#8
Crashdisk Moderator Join Date: Jun 2009 Location: France Age: 46 Posts: 1,982	mai? where are you? we need you! If it is not too late for the next release...

23 July 2012, 22:54	#12
Crashdisk Moderator Join Date: Jun 2009 Location: France Age: 46 Posts: 1,982	if a game is an inseparable set. the [v] flag can be used for the set without changing the subset. no?

25 July 2012, 23:16	#14
Cassiel Registered User Join Date: Oct 2011 Location: - Posts: 82	Yes, this is why one of my recommendations was to have the IPF images as single-file rather than multi-file (no different from ADF images, or any other >1 disk images in fact). IMO there's no reason to have IPF images grouped up/unrenamed in this way, and in fact goes against TOSEC/TNC convention. The only reason is historical and/or blindly copying CAPS convention, and (again in my opinion) that's not a good enough reason...

26 July 2012, 03:29	#16
lesta_smsc Registered User Join Date: Feb 2012 Location: United Kingdom Posts: 3,173	I wonder where the creators of the viruses are these days lol ...

26 July 2012, 05:53	#17
Codetapper 2 contact me: email only! Join Date: May 2001 Location: Auckland / New Zealand Posts: 3,182	I'd still prefer to have this marked as virus infected, maybe release an alternative clean IPF of those disks. If you have a Kyroflux you could write the IPF back and install the clean bootblock, but if you're using IPFs in an emulator you're not going to have a clean IPF file - only a saved disk image state combined with the IPF which is not ideal imho. Boot of that game then switch to another write enabled disk and bingo, infected disk.

26 July 2012, 16:20	#18
dlfrsilver CaptainM68K-SPS France Join Date: Dec 2004 Location: Melun nearby Paris/France Age: 46 Posts: 10,412	We could ask Kaffer to generate clean unofficial IPF

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)