Virus that stays in memory even after shutdown

[cosmiq]

Some years ago, people told me that there were virusses for amiga that stay resident, even after the Amiga was powered-off for a few seconds. I cannot believe that this is possible, so the question for all you ami guru's... is it possible??

[Toni Wilen]

Not possible. And before someone asks: clock battery ram can't be used for code

[Rabbit80]

Originally Posted by Toni Wilen

Not possible. And before someone asks: clock battery ram can't be used for code

Exactly how long does the RAM retain its memory after power off? I remember that when using RAD: back when I had an A500 it would still be there after a power off for up to 20 seconds... I'm pretty sure that it would be possible to recover most of the contents of the RAM for up to a couple of minutes afterwards... There has been examples of this in recent months with encryption keys being recovered from RAM on PC's for up to 10 mins after power off although to do this the RAM chips need cooling (ie with liquid compressed air)

http://news.cnet.com/8301-1009_3-10003167-83.html

[Toni Wilen]

Originally Posted by Rabbit80

Exactly how long does the RAM retain its memory after power off? I remember that when using RAD: back when I had an A500 it would still be there after a power off for up to 20 seconds...

I read long time ago that few seconds is max for usual DRAM chips (and 5s power off has always caused execbase rebuild on my A500 = possible virus is gone) but perhaps it depends on chip types or power supply model or mobo revision or something like size of filter capacitors?

[Rabbit80]

Originally Posted by cosmiq

... even after the Amiga was powered-off for a few seconds. I cannot believe that this is possible, so the question for all you ami guru's... is it possible??

Since the question was whether it would be possible for a few seconds - I would say yes - but if you power down for 20-30 seconds you should be OK...

[cosmiq]

I always thought that memory is blank instantly when power is cut off. It would be interesting to test how long the memory is retained. Especially with virus-resident stuff in memory.
Thanks for the replies.

[Leffmann]

I'm thinking it doesn't really matter whether the RAM retains its contents for 1 millisecond or 1 hour.

A hard reset would go into configuring the RAM memory itself as well as other AutoConfig devices, and the Amiga OS Exec and other memory areas would be initialized properly. For the virus to activate it would have to be run in the first place which at that point isn't going to happen unless the Exec starts making wild jumps into uninitialized memory exactly where the virus still resides and could be activated properly. Simply having the virus in RAM isn't enough for it to spread.

This sort of reminds me of when I was a kid and one of the older guys at the local computer club told us in a dead serious voice (and we believed him) that viruses could spread between floppy disks if you pulled the metal covers back and held the disks close together

[jmmijo]

Originally Posted by Leffmann

This sort of reminds me of when I was a kid and one of the older guys at the local computer club told us in a dead serious voice (and we believed him) that viruses could spread between floppy disks if you pulled the metal covers back and held the disks close together

So is this like when you shake a floppy diskette really hard you shift the bits on the magenetic surface

[Rabbit80]

Originally Posted by Leffmann

I'm thinking it doesn't really matter whether the RAM retains its contents for 1 millisecond or 1 hour.

A hard reset would go into configuring the RAM memory itself as well as other AutoConfig devices, and the Amiga OS Exec and other memory areas would be initialized properly.

Maybe somebody could test this? I think I used to use statram - which I seem to remember could survive for quite some time and could survive a hard reset even... Maybe its my memory playing tricks (long term corruption - and a few cold resets after a few beers )?

[Leffmann]

Originally Posted by jmmijo

So is this like when you shake a floppy diskette really hard you shift the bits on the magenetic surface

Yes, and even come loose and fall off onto the other disk! At least that's what I imagined

Originally Posted by Rabbit80

Maybe somebody could test this? I think I used to use statram - which I seem to remember could survive for quite some time and could survive a hard reset even... Maybe its my memory playing tricks (long term corruption - and a few cold resets after a few beers )?

Do you mean that a mounted StatRam drive could sometimes remain mounted and usable after turning the Amiga off without you (or the startup-sequence) running the StatRam application? Or do you mean that you had to start StatRam up again and could then tell it to search the RAM and recover previous contents?

I never used StatRam but from what I understand it mounts a RAM drive for which it can search RAM and recover previous contents, am I right?

[Overdoc]

Ha, one of my A-500 cannot easily 'forget' it's code, which is somtimes quite annoying !
I remember the game 'Pinball WIzard' which had a soft-reset protection, and I have ot turn off this A-500 for at least!! half a minute before I can restart again without hearing the hahahaha sound and seeing the pinball table again...
But I'm not 100% sure, it might also have to do something with the psu, maybe some caps inside keep feeding the Amiga with power after shutoff ?

[T_hairy_bootson]

Originally Posted by Overdoc

Ha, one of my A-500 cannot easily 'forget' it's code, which is somtimes quite annoying !
I remember the game 'Pinball WIzard' which had a soft-reset protection, and I have ot turn off this A-500 for at least!! half a minute before I can restart again without hearing the hahahaha sound and seeing the pinball table again...
But I'm not 100% sure, it might also have to do something with the psu, maybe some caps inside keep feeding the Amiga with power after shutoff ?

That was especially annoying on the A1000 had to re kickstart the machine. Scared the crap out of me the first time.

[Rabbit80]

Originally Posted by Leffmann

Do you mean that a mounted StatRam drive could sometimes remain mounted and usable after turning the Amiga off without you (or the startup-sequence) running the StatRam application? Or do you mean that you had to start StatRam up again and could then tell it to search the RAM and recover previous contents?

I never used StatRam but from what I understand it mounts a RAM drive for which it can search RAM and recover previous contents, am I right?

I remember it sometimes annoying me because I had to power down for 20-30 seconds for it to clear - I used to boot from it and could do so after a power down for over 10 seconds....

Dont know if it makes any difference but it was an A500+ with a 1Mb Chip expansion and 8Mb Fast RAM on a GVP hard disk.

Originally Posted by cosmiq

Some years ago, people told me that there were virusses for amiga that stay resident, even after the Amiga was powered-off for a few seconds. I cannot believe that this is possible, so the question for all you ami guru's... is it possible??

You can use a 68000 coding instruction called TRAP and create a TRAP routine returning RTE on a LOOP and insert it into the SOFT BOOT of the Amiga's RESET.

What this means is, when you soft or even hard reset your computer it executes the TRAP routine and stays 'stuck' inside the looped routine not allow the computer to properly complete its reset cycle.

I've coded one years ago, you will also find it in megademos, demos, crackros, etc. It can be really annoying to flush out. **When Datel released the Action Amiga Replay III cartridge they included new code to release and flush out any COLD CAPTURE routines thus stopping this from happening.

An example is VISION's MEGADEMO II for the a500, when the computer is soft/hard rebooted it JMP (jumps) straight back into a TRAP LOOP routine playing the demo's intro.

** TRAP INTERRUPT ROUTINES.

Obviously this can be exploited and misused in the form of virii or just plain annoyance.

[Toni Wilen]

Originally Posted by SkippyAR

You can use a 68000 coding instruction called TRAP and create a TRAP routine returning RTE on a LOOP and insert it into the SOFT BOOT of the Amiga's RESET.

What does this have to do with reset proof programs? (and what exactly is it even supposed to mean? )

Just set Cold Capture (or other similar exec reset vectors) and its done. Note that non-setpatched KS 1.3 or older always rebuilds execbase if 1MB or larger chip ram due to exec bug.

[StingRay]

Originally Posted by Toni Wilen

What does this have to do with reset proof programs? (and what exactly is it even supposed to mean? )

You took the words right out of my mouth.

[Frog]

i remember too that when i used a RAD disk on A500, it took at least 10 seconds to be cleared after power off !

[Mad-Matt]

Joshua was a virus I remember having on my A600 more then once (school disk swapping - a virus haven ) It often seemed to survive a power cycle if not leaving off for more then 30 seconds or so. effect was big joshua mouse pointer, visable on kickstart screen to if i recall right.

Originally Posted by Toni Wilen

What does this have to do with reset proof programs? (and what exactly is it even supposed to mean? )

Just set Cold Capture (or other similar exec reset vectors) and its done. Note that non-setpatched KS 1.3 or older always rebuilds execbase if 1MB or larger chip ram due to exec bug.

HUH?

[StingRay]

Originally Posted by SkippyAR

HUH?

Trap instruction has nothing to do with patching Cold/CoolCapture vectors.