One day, I got something infected with a virus named Romania.856 (I will always remember this name), a COM infector, as I found out from F-Prot Antivirus (which came with a great db with information about viruses -- such a great read for the young me!).
The tools available to me were still very limited; I had not yet discovered TDD (Borland Turbo Debugger). But I was dead set to understand how the virus worked. There I was, using the very limited `debug` tool that came with MS-DOS. I've learned x86 Assembler from various texts downloaded from BBS's. I reverseengineered Romania.856, and learned how it worked, and did my own experiments. That's how I spent my summer vacation that year.
This was the beginning of some of the most beautiful years of my life, with regard to computers. It lasted for a bit over half a decade, time in which tech evolved fast, I got an internet connection (still dialup back then), I discovered IRC, met people with similar interests and so on. What I miss the most now is the feeling of everything being new, the possibility for exploration and discovery.
Oh, good... it's not just me. :-)
For me it was Tai-Pan.438.A. I printed out(!) the disassembly code and studied it for weeks. I remember the stack modifications (not matching push/pop instructions) were super troubling for me to understand because such tricks were not really explained it the normal books.
I've often wondered-- if you want to learn low level C and/or hacking techniques, would it make sense to start by hacking Ms-Dos? It's easy, there is little to no protection, even for system calls, and you can do a lot with little code.
Of course, there is no "practical" use, but it would be really interesting as a learning excercise.
I often thought of creating a few tutorials about this, but not sure if anyone cares... (or if anyone else has done so).
That’s a bizarre platform to learn to exploit...
Text of the book here - https://web.archive.org/web/20090420151624/http://vx.netlux....
If you enjoyed MtE you might enjoy the polymorphic engine from Natas (published in 40Hex[0]). It's not as complex as MtE. It's a bit oddball in that it appends the decryption routine to the payload.
[0] http://cd.textfiles.com/group42/VIRUS/40HEX/40HEX122.HTM
When I was 14 I made my first virus/prank. It would increment a counter every time input was sent to the PS/2 port, ie. keyboard. Once it hit 2000 strokes it would switch to 80x50 textmode, print "This is a shareware keyboard. You have used all of your free keystrokes" and then close the PS/2 connection until a physical reboot.
I thought it was hilarious, but it did have some unintended consequences. Especially because that the IT guy in charge actually believed the message. So, also my last virus.
https://www.reddit.com/r/netsec/comments/3hr9f0/i_am_john_mc...
