1. Forum
  2. AmigaNet
  3. VIRUS AMY

  • SADDAM deactivate

    From Strahinja Bojovic@39:902/505 to All on Sat Dec 25 11:04:05 2021
    ; SADDAM VIRUS disable routine (from DeSaddam v1.1 Virus Killer)
    ; --------------------------------------------------------------
    ; by Strahinja Bojovic 2021.

    ; This little code will disable Saddam virus in memory. Virus will stay in
    ; memory but with no possibility to spread. Then you can copy files from
    ; infected disk to the clean one and files will be decrypted and saved.

    ; IMPORTANT: SADDAM VIRUS works only on kickstarts 1.2 & 1.3

    RTS_Check
    move.l 4,a6
    move.l $2a(a6),a0
    RTS_Check1
    move.l 336(a0),d0 ; cmpi.w #$002,$0002(a0)
    cmp.l #$0c680002,d0
    bne RTS_CheckFALSE
    clr.l d0
    move.w 340(a0),d0
    cmp.w #$0002,d0
    bne RTS_CheckFALSE
    move.w 342(a0),d0 ; bne.b $xxxxxx
    cmp.w #$6610,d0
    bne RTS_CheckFALSE
    move.w 1278(a0),d0 ; jsr (a5)
    cmp.w #$4e95,d0
    bne RTS_CheckFALSE
    RTS_CheckOK
    move.w #$4e75,342(a0) ; put RTS (1)
    move.w #$4e75,1278(a0) ; put RTS (2)
    rts
    RTS_CheckFALSE
    rts
    --- SBBSecho 3.11-Linux
    * Origin: AmigaCity (39:902/505)
  • From Wilfred van Velzen@39:150/200 to Strahinja Bojovic on Thu Dec 30 11:02:39 2021
    Hi Strahinja,

    On 2021-12-25 11:04:05, you wrote to All:

    RTS_Check
    move.l 4,a6
    move.l $2a(a6),a0
    RTS_Check1
    move.l 336(a0),d0 ; cmpi.w #$002,$0002(a0)
    cmp.l #$0c680002,d0
    bne RTS_CheckFALSE
    clr.l d0
    move.w 340(a0),d0
    cmp.w #$0002,d0
    bne RTS_CheckFALSE
    move.w 342(a0),d0 ; bne.b $xxxxxx
    cmp.w #$6610,d0
    bne RTS_CheckFALSE
    move.w 1278(a0),d0 ; jsr (a5)
    cmp.w #$4e95,d0
    bne RTS_CheckFALSE
    RTS_CheckOK
    move.w #$4e75,342(a0) ; put RTS (1)
    move.w #$4e75,1278(a0) ; put RTS (2)
    rts
    RTS_CheckFALSE
    rts

    Wow, I haven't seen any 68K assembler in like 3 decades! ;-)

    Bye, Wilfred.

    --- FMail-lnx64 2.1.0.18-B20170815
    * Origin: FMail development HQ (39:150/200)