FROM:    Michael Weiner                Area # 42 (      VIRUS       )
TO:      Jan Terpstra                  MSG # 471, Oct-3-90 4:32pm
SUBJECT: Re: Mother Fish Virus

Hi, Jan !

 > I disagree. *ANY* piece of code can de disassembled, but the
 > resulting isassembly won't always make sense.

Well, it seems we have a different idea of the word 'disassemble'. Of 
course, any piece of code can be disassembled - even text files can be 
loaded into DEBUG and "disassembled" :-), but the resulting assembler 
instructions would be senseless. If a program employs time-dependant 
encryption techniques to hide itself away from debuggers, hardware 
tools might be necesssary to create a disassembly that makes sense. 
Something similar can be said about encryption routines that utilize 
low-level hardware to decrypt themselves: If you don't have the doc's, 
it is hard to understand what's happening. 

 > I'll chat to Righard about Mother Fish. I don't want to boast
 > about my talenst, but I once was a designer of hardware and system
 > software, so I may as well have a go at it. Hopefully the rusted skills
 > will come to life again :-)

I don't doubt your ability.

 > BTW, the hardware/software design I did had to do with crypto.
 > Mother FISH seems "fascinating" as Mr. Spock would say.

I am sure a number of us will be able to disassemble "Mother Fish". It 
might just take some time :-)

PS: The "binary" virus concept really worries me. If one virus carries 
another virus in it's body (in encrypted form) and a different virus 
carries the decryption routine or key, it is *NOT* possible to make 
sense of the encrypted code unless the "matching" decryptor virus is 
available. Imagine a pseudo-evolutionary virus that would employ such 
features. A nightmare :-(

Best regards,

Michael

--- FD 1.99c
 * Origin: Info Link [Vienna/Austria/Europe] (2:310/23)
SEEN-BY: 2/225 241/1 2 242/20 244/1 310/11 490/1 10 20 40 60 
SEEN-BY: 504/156 310 507/1 13 430 440 642 7000 9001 512/0 515/1 
SEEN-BY: 515/801 821 841 871 
