Skip to content

Commit

Permalink
Update ghost.md
Browse files Browse the repository at this point in the history
  • Loading branch information
shazz authored Aug 19, 2024
1 parent 7f01313 commit 02b537c
Showing 1 changed file with 5 additions and 4 deletions.
9 changes: 5 additions & 4 deletions content/blog/ghost.md
Original file line number Diff line number Diff line change
Expand Up @@ -422,20 +422,21 @@ What is important to understand, and took me some time and debug:

I drawed a kind of timeline, trying to show the various steps and where the relocatable virus code is copied and executed.

<!-- ![timeline]({attach}images/ghost_timeline.png "Ghost virus timeline") -->
<a href="{attach}images/ghost_timeline.png" target="_blank"><img src="{attach}images/ghost_timeline.png" width="400"></a>

## Conclusion

I start to think this is why this virus was called the **Ghost Virus**, and not the mouse inversion virus (or any name linked to the symptoms), as the magic is really in this transient routine automatically called then deleted, leaving no trace of its execution but making sure the replication vector (`hdv_bpb`) is still alive.

You can download the full commented (and tested identical to the original virus after assembling with `vasm`) here: [GHOST.S]({attach}sources/GHOST.S)
If technically, it think this is pretty impressive for 1988, it doesn't let much space for the symptoms themselves and even if using the "ghost" code to setup the `hdv_bpb` vector after a warm reset is pretty cool (and took me some time and debug to understand), I wonder what it would change to simply setup the `hdv_bpb` vector fron the `resvector` reset vector directly, as without `resvector`, the *ghost code* cannot be rewritten after each reset.

You can download the full commented (and tested identical to the original virus after assembling with [vasm](http://www.compilers.de/vasm.html)) here: [GHOST.S]({attach}sources/GHOST.S)

## Appendices

### System calls (From the Atari Compendium)

#### Floprd
#### XBIOS Floprd

```
Floprd()
Expand Down Expand Up @@ -466,7 +467,7 @@ Floprd() reads sectors from a floppy disk.
- CAVEATS This function reads sectors in physical order (not taking interleave into account). Use Rwabs() to read logical sectors.
```

#### Flopwr
#### XBIOS Flopwr

```
Flopwr()
Expand Down

0 comments on commit 02b537c

Please sign in to comment.