ProfitPress Mega CDROM2 …eeware (MSDOS)(1992)(Eng)/ProfitPress-MegaCDROM2.B6I/UTILITY/VIRUS/CVIRPROT.ZIP/PATCH.DOC

Text File | 1989-09-30 | 5.1 KB | 117 lines

        PATCH - A program to include anitivirus code
                      into programs


  PATCH consists of two programs, one of which gets included in your
source code (acheck.c) and  a second program (patch.exe) which is run
on a newly compiled program and patches that program to provide
the antivirus code with information it needs to determine if the
file has been altered.

How patch works:
    PATCH works by calculating CRCs (or checksums) for variable
length blocks of the executable file.  These CRCs are very
sensitive to changes in the file, and changing just one bit will
change the CRC, alerting you that a virus may have changed the
file.  The CRC values calculated by PATCH are embedded in a
structure (static struct avirus) so that every time the file is
executed, CHECK (the patch function you include in your code)
can recalculate the CRCs and compare them to the ones originally
calculated by PATCH.

    The structure avirus is the key to the operation of PATCH.
The first variable in the structure is an 8 character string
which must be initialized to a string that does not occurr
elsewhere in your file.  The only purpose of this string is to
provide a key so that PATCH can find the avirus structure in
your executable file.  Once PATCH has located the structure, it
calculates the CRCs and writes them into the executable file.
Later, when CHECK is called from you program, it recalculates
the CRCs, comparing them to the ones patched into the file by
PATCH.  When it reaches the avirus structure, however, it must
insert 0's instead of the CRC values PATCH placed in the code
(since PATCH saw only zero's before it patched the code).

    Patch will not keep a virus from infecting your program, but
it will tell you when one has invaded.

How to use patch:
    To use patch, you must include the file ACHECK.C in your
source file.  Early in the program (first?), you should call the
function check(argc, argv).  Check will return an integer code,
which have the following meanings:

  /* Return codes */
  /* 0 - File checked out OK               */
  /* 1 - File never patched, no protection */
  /* 2 - User turned off protection        */
  /* 3 - File has been changed since patch */

    See test.c for an example on how to use check.  I have
included a command line option to turn off virus checking.  If
the token /a appears on the command line, CHECK will not check
the file.  This allows for more rapid file loading if the user
is sure that no virus has attacked since last checking the file.
 An alternative would be to make the default no checking, and
only check the file when the user requested it.

    Once your program has been compiled, your should run
PATCH.EXE on it.  PATCH will give you an option on how big you
want your block size.  Larger blocks will run faster, but always
designate a block size less than the actual file size.  This
makes it more difficult for viruses to defeat the protection.
PATCH will then display the values it is inserting into the
file, after which your executable file is patched and virus
resistant.

A question of speed:
    While CRC values are very sensitive to alterations in the
code, they also take quite awhile to calculate.  On large files,
the wait can be frustrating.  As an alternative, I have also
included code to use checksum values.  These are less secure,
but very quick to calculate. To change to checksums, comment out
the line "#define CRC_METHOD" in both ACHECK.C and PATCH.C.

Et Cetera:
    This program is a revision of code originally submitted to
PC Magazine, and which appeared in the August issure
(Vol.6,#14).  That code unfortunately had a bug in PATCH which
did  not allow it to work on large files.  FOr those who might
have tpyed it in, the correction is:
  anitvir.lowcrc = (sector-1) * 512 + offset;
should read:
  anitvir.lowcrc = (sector-1) * 512L + offset;

    I woud like to thank the anonynous  programmer who provided
the CRC code used in this program.  The code came from an
archive called CRCFAST, with no mention of the author's name.

Caveat:
    #1: This program will only work if the linker you are using
stores the structure avirus complete with the uninitialized
zeroes in avirus.crcs.  If your linker optimizes and removes
these zeroes in the file written to disk, then you may have to
initialize the structure to 1s f.ex.  If you do this, remember
that check should then insert 1s and not zeroes when going over
the structure.  Specifically, use of the Microsoft overlay
linker with the /e option will require some changes in the code.

    #2: Be aware of combining object code from different
compilers.  ANSI C does not specify how structures should be
aligned internally, only that the addresses of members be
increasing in order of declaration.  Using one compiler for
PATCH and another for CHECK could result in incompatabilities
from different alignments.


Author:
    Mike Caprio, Graduate Student in Entomology (thats insects!)
at the University of Hawaii, Manoa.  He can be reached via
bitnet at :  caprio@uhccux.
Address:  Dept. of Entomology
          3050 Maile Way, Gilmore 310
          Honolulu, HI  96822
          [phone]