Hacker News Reader

It was a whole new world to create a .com file with just debug.com and some assembly (most of the work is already in interrupt 21h). Good times.

I looked at DOS .exe (NE? or was that the format for Win 3.1...) format too. Still relatively simple. Then came the PE which was super complicated.

View on HN

RE: debug.com

As a teenager who didn't know any better, it was empowering to gain that level of access to a computer, to realize a certain level of control over it that was previously abstracted away. It felt like some insider knowledge that I was becoming aware of.

At 14, I wrote a functional virus on paper, hand-calculated the jump offsets and entered the "code" in debug.com. The first version was 273 bytes long. It did not do much, just printing the BELL character, then looking for non-infected COM files in the current directory and infecting one of them. F-Prot identified it as a generic virus and killed it. That made me a little mad at that time, so added some polymorphism to it by decoding and encoding the virus code with a different key every time (using XOR). The code size has increased by about 60 bytes, and only around 10 bytes were unencrypted, which did the in-place decryption in memory. F-Prot identified it as a generic polymorph virus and killed it again... After that tried to make it resident, but intercepting the int 21h calls turned out to be a tough nut to crack, so tried to do something with EXE files instead. A basic variant was nearly ready, when I have fucked up my 40MB hard drive and lost everything... But that's an other story of my early self-education :)

Reply on news.ycombinator.com