TweetFollow Us on Twitter

Virus Protection
Volume Number:8
Issue Number:2
Column Tag:Pascal Workshop

Related Info: Resource Manager

Simple Antivirus Protection

An anti-virus scheme that can be painlessly added to every application.

By Nicholas Pisarro, Jr., Westport, Connecticut

About the author

Nick Pisarro is the principle architect of Aperture Visual Information Manager by the Graphic Management Group, Inc. He has been involved with all aspects of computer design including both hardware and software since 1961 and with the Macintosh since 1986.

The Virus Scout Pascal unit described in the January 1991 Programmer’s Forum is a nice idea. One problem with Virus Scout was that it was coded to handle only those specific viruses that the author knew about and could offer no protection against any future viruses that may infect an application.

It did set me to wondering, however, if there is a way to make both a simpler yet more universal virus detection scheme. I began to think about how viruses infect and reproduce themselves through an application, and how I could have applications I have developed protect themselves from becoming infected.

In order for a virus to infect an application it needs to either modify the existing resources of an application and/or add resources of its own. In order to reproduce it needs to seize program control from the application and the user’s Macintosh in order to issue its own instructions of death and destruction. This requires modification of a code resource such as ‘CODE’, ‘WDEF’, ‘MDEF’, or ‘LDEF’ resource types.

Usually a virus inserts a small stub of code in an existing resource to branch to one of its own resources, or it inserts a whole new code resource of its own to seize control. I don’t believe any viruses try to insert all their code in an existing application resource but always have to add a resource. Adding to a code resource, by linking in code, is a difficult operation and runs the risk of overflowing the size restrictions of code resources.

One advantage a virus detection scheme has within an application is that it knows how many and what types of resources the application should have! Rather than checking for the addition of specific virus resources, the virus detection scheme presented here just checks the number of resources the application should have against the number it actually has. In addition there is a Toolbox call that tells me the number of types of resources a resource fork has as well as specific counts. This may be used to check for the addition of additional types of resources. As the resource map for an application is in memory when it is running these types of checks do not use significant amounts of computer time.

It would be possible to check counts of all the resource types an application has, but I believe just checking the specific counts of its code resources is sufficient. A virus must insert or modify a code resource to gain control.

The Pascal unit here reads a resource with a count of the number of types of resources an application has as well as counts of specific types. If it finds any mismatch between expectations and reality, it notifies the user and causes the application to quit early. Note the “Get1” form of the resource call is used to get counts only from this application. This unit must be run before any data file resource forks are opened. If the application modifies its own resource fork, it must be careful not to do it in a way that triggers this virus check.

In the sample code no specific resource type has been assigned for the information resource. If all applications used the same type for this resource, a new virus could be written to circumvent this protection scheme. Use your own type.

Note that the code here is only concerned with viruses that infect an application, rather than viruses that infect files in the System Folder or the Desktop. Code like that from Virus Scout or elsewhere could be added to do this additional checking.

Listing

{Written by Nicholas Pisarro, Jr., Aperture Technologies, Inc.
 No rights reserved.}

UNIT VirusCheck;

INTERFACE

USES
 {$LOAD}
 MemTypes, QuickDraw, OSIntf, ToolIntf, PackIntf;
 

{Returns TRUE if Application can run.}
FUNCTION ApplicationCanRun: BOOLEAN;


IMPLEMENTATION

{Returns TRUE if Application can run.}
FUNCTION ApplicationCanRun: BOOLEAN;
 CONST
 kVirusChkKinds  = '????';{Rsrc type for the # 'CODE' & # of Kinds of 
resources}
 kVirusChkID=  32; {Resource ID for the Virus Check Rsrc}
 
 {The Virus found alert and its sub-messages}
 kVirusAlrt =  1282; {A Virus has been detected!}
 kCountRsrcMissing = 1;   {The Resource count Resource is missing}
 kTypeMiscount   = 2;{Wrong number of resource types}
 kRsrcMiscount   = 3;{Wrong number of a specific res. kind}
 
 TYPE
 {Resource & Count list.}
 RsrcCount = RECORD
 RType: ResType;
 RCount:INTEGER;
 END;
 
 RsrcRSRC = ARRAY[0..0] OF RsrcCount;
 pRsrcRSRC = ^RsrcRSRC;
 hRsrcRSRC = ^pRsrcRSRC;
 
 VAR
 {For counting Resources.}
 theResType:ResType; { The kind we’re looking for }
 subMsgNo:INTEGER; { Submessage number }
 msgStr,{ Submessage to go into dialog}
 workStr: Str255;{ Resource name to go into the message }
 
 aRsrcRSRC: hRsrcRSRC;  { Handle to the Count Rsrc}
 
 i:INTEGER;
 dummy: INTEGER;
 
 LABEL 100;
BEGIN   { ApplicationCanRun }
 ApplicationCanRun := FALSE;{Assume failure.}
 
 {Virus Check: Load resources with counts of various kinds of resources
  in Application. Make sure the counts in the resource match the actual
  counts in Application.}
 workStr[0] := CHR(0);    {Make WorkStr have no length.}
 
 {Try to get the counts of the various resources in the Application.}
 aRsrcRSRC := hRsrcRSRC(Get1Resource(kVirusChkKinds, kVirusChkID));
 IF aRsrcRSRC <> NIL THEN BEGIN
 
 {Check out each of the counts read.}
 FOR i := 0 TO GetHandleSize(Handle(aRsrcRSRC)) div SIZEOF(RsrcCount) 
- 1 DO BEGIN
 
 {If the kind is a 0, a total resource count is wanted.}
 IF ORD(aRsrcRSRC^^[i].RType[1]) = 0 THEN BEGIN
 
 {Does the total number of resource kinds in the Application
  match the count the resource?}
 IF (Count1Types <> aRsrcRSRC^^[i].RCount) THEN BEGIN
 
 subMsgNo := kTypeMiscount; { Sub message }
 
 {Issue a Virus Alert to the user.}
100:    GetIndString(msgStr, kVirusAlrt, subMsgNo);
 ParamText(msgStr, workStr, '', '');
 dummy := StopAlert(kVirusAlrt, NIL);
 
 EXIT(ApplicationCanRun);
 END;
 END
 
 {Otherwise, check a specific type.}
 ELSE BEGIN
 
 {Does the number of this kind of resource in the Application
  match the count the resource?}
 theResType := aRsrcRSRC^^[i].RType;
 IF Count1Resources(theResType) <> aRsrcRSRC^^[i].RCount THEN BEGIN
 
 { Make a string out of the resource type. }
 WorkStr[0] := CHR(4);
 BlockMove(@theResType[1], @workStr[1], 4);
 
 subMsgNo := kRsrcMiscount; { Sub message }
 
 GOTO 100;
 END;
 END;
 END;   {End FOR i }
 
 {Finished with the resource}
 ReleaseResource(Handle(aRsrcRSRC));
 END    {End IF aRsrcRSRC <> NIL}
 
 {Count Resource not found.}
 ELSE BEGIN
 subMsgNo := kCountRsrcMissing;    { Sub message }
 
 GOTO 100;
 END;
 
 {Possibly put other virus checks, checks for the proper system version,
  etc. here.}
 
 ApplicationCanRun := TRUE; {Success!}
END;    { ApplicationCanRun }

END.
 

Community Search:
MacTech Search:

Software Updates via MacUpdate

Minecraft 302 - Popular sandbox building...
Minecraft allows players to build constructions out of textured cubes in a 3D procedurally generated world. Other activities in the game include exploration, gathering resources, crafting, and combat... Read more
FotoMagico 5.2b8 - Powerful slideshow cr...
FotoMagico lets you create professional slideshows from your photos and music with just a few, simple mouse clicks. It sports a very clean and intuitive yet powerful user interface. High image... Read more
TeamViewer 11.0.65452 - Establish remote...
TeamViewer gives you remote control of any computer or Mac over the Internet within seconds, or can be used for online meetings. Find out why more than 200 million users trust TeamViewer! Free for... Read more
Dropbox 9.4.49 - Cloud backup and synchr...
Dropbox is an application that creates a special Finder folder that automatically syncs online and between your computers. It allows you to both backup files and keep them up-to-date between systems... Read more
Geekbench 4.0.0 - Measure processor and...
Geekbench provides a comprehensive set of benchmarks engineered to quickly and accurately measure processor and memory performance. Designed to make benchmarks easy to run and easy to understand,... Read more
Nisus Writer Pro 2.1.5 - Multilingual wo...
Nisus Writer Pro is a powerful multilingual word processor, similar to its entry level products, but brings new features such as table of contents, indexing, bookmarks, widow and orphan control,... Read more
Default Folder X 5.0.6 - Enhances Open a...
Default Folder X attaches a toolbar to the right side of the Open and Save dialogs in any OS X-native application. The toolbar gives you fast access to various folders and commands. You just click on... Read more
Alfred 3.1 - Quick launcher for apps and...
Alfred is an award-winning productivity application for OS X. Alfred saves you time when you search for files online or on your Mac. Be more productive with hotkeys, keywords, and file actions at... Read more
MYStuff Pro 2.0.25 - Create inventories...
MYStuff Pro is the most flexible way to create detail-rich inventories for your home or small business. Add items to MYStuff by dragging and dropping existing information, uploading new images, or... Read more
OmniOutliner Pro 4.6 - Pro version of th...
OmniOutliner Pro is a flexible program for creating, collecting, and organizing information. Give your creativity a kick start by using an application that's actually designed to help you think. It's... Read more

Lifeline: Crisis Line (Games)
Lifeline: Crisis Line 1.0.0 Device: iOS Universal Category: Games Price: $2.99, Version: 1.0.0 (iTunes) Description: | Read more »
BLUK (Games)
BLUK 1.1 Device: iOS Universal Category: Games Price: $1.99, Version: 1.1 (iTunes) Description: ** ‘Upcoming Game of the Year’ Finalist at NGF Awards 2015 ** ** ‘Big Indie Pitch’ Nominee at Pocket Gamer Connects 2016... | Read more »
Six! Tips, tricks, and hints for beginne...
There's nothing pretentious about Six!, the latest release from Gram Games. As puzzlers go, it's so unassuming that it took me some time to even realize why it was called what it was. Somewhere, my high school geometry teacher is now sobbing... | Read more »
Mobius Final Fantasy: Multiplayer update...
Up until now, Mobius Final Fantasy has been about as single-player an experience as an RPG can be. Not only do you play solo, but you are literally one among a seemingly unending wave of faceless warriors on the road toward the same goal. [Read... | Read more »
Find out the story behind League of Ange...
If you’re looking for a new thrilling MMORPG to play with your friends then you’ll be excited to hear that there is a sequel to one of the most well known titles in the genre – namely League of Angels 2. With a brand new 3D engine offering... | Read more »
Naruto Shippuden: Ultimate Ninja Blazing...
I'm not sure if it's possible to say you are an anime fan but also never have seen one episode of Naruto. If it is, then I resemble that remark, and if not, I offer a hearty apology. [Read more] | Read more »
5 mobile games that let you explore spac...
No Man's Sky hasn't exactly turned out to be everything it was promised. Though its core concept of exploring an unimaginably vast universe of different planets is an intriguing one, the execution has left many PS4 and PC gamers feeling like they... | Read more »
Mummy madness in new action game Tomb He...
Hot on the tail of Bump Hero, ZPlay is giving gamers another reason to get screen bashing with a brand new release. Tomb Heroes is a challenging action game in which you battle enemies in various tombs around the world. You can select from nine... | Read more »
Siralim 2 (RPG / Roguelike) (Games)
Siralim 2 (RPG / Roguelike) 1.0 Device: iOS Universal Category: Games Price: $4.99, Version: 1.0 (iTunes) Description: Siralim 2 is an old-school monster catching RPG. Summon and customize hundreds of creatures to fight for you as... | Read more »
Clean Text (Productivity)
Clean Text 1.0 Device: iOS Universal Category: Productivity Price: $3.99, Version: 1.0 (iTunes) Description: | Read more »

Price Scanner via MacPrices.net

That Upgrade Itch; How Often Do You Upgrade Y...
I have a quandary to resolve as we head into what is typically a major Apple product upgrade season. My mid-2013 MacBook Air will be three years old and my iPad Air 2 will be two come late November.... Read more
Apple refurbished 12-inch iPad Pros available...
Apple has Certified Refurbished 12″ iPad Pros available for up to $160 off the cost of new iPads. An Apple one-year warranty is included with each model, and shipping is free: - 32GB 12″ iPad Pro... Read more
Tim Cook Posts Open Letter To The Apple Commu...
Apple Inc. CEO Tim Cook has posted an open letter commenting on the European Commission’s bizarre demand that Apple pay more than $14 billion in allegedly underpaid back taxes on its Irish... Read more
Streetwise Drivers Club App Now Features Open...
Streetwise Drivers Club, an app that rewards drivers with deals on everything from dining and gift cards to tires and insurance, has announced the launch of a new enhancement connecting app users... Read more
15-inch Retina MacBook Pros on sale for up to...
B&H Photo has 15″ Retina Apple MacBook Pros on sale for up to $200 off MSRP. Shipping is free, and B&H charges NY tax only: - 15″ 2.2GHz Retina MacBook Pro: $1799 $200 off MSRP - 15″ 2.5GHz... Read more
RESCUECOM 2016 Semi-Annual Computer Reliabili...
The beginning of a new school year is upon us again, in which students and parents have some very important choices to make, often including the purchase of a computer or tablet. Whether you are... Read more
VRS Design Damda Glide Series iPhone 7 and 7...
What makes the Damda Glide Series for the iPhone 7 and iPhone 7 Plus special? Case maker VRS Design says its Damda Glide Series is the first mobile case to incorporate a semi-automatic mechanism for... Read more
Apple refurbished iMacs available for up to $...
Apple has Certified Refurbished 2015 21″ & 27″ iMacs available for up to $350 off MSRP. Apple’s one-year warranty is standard, and shipping is free. The following models are available: - 21″ 3.... Read more
Clearance 2015 13-inch MacBook Airs available...
B&H Photo has clearance 2015 13″ MacBook Airs available for $350 off original MSRP. Shipping is free, and B&H charges NY sales tax only: - 13″ 1.6GHz/4GB/128GB MacBook Air (MJVE2LL/A): $829... Read more
Check Apple prices on any device with the iTr...
MacPrices is proud to offer readers a free iOS app (iPhones, iPads, & iPod touch) and Android app (Google Play and Amazon App Store) called iTracx, which allows you to glance at today’s lowest... Read more

Jobs Board

*Apple* Retail - Multiple Positions Norfolk,...
Job Description: Sales Specialist - Retail Customer Service and Sales Transform Apple Store visitors into loyal Apple customers. When customers enter the store, Read more
*Apple* Retail - Multiple Positions- Tampa,...
Job Description:SalesSpecialist - Retail Customer Service and SalesTransform Apple Store visitors into loyal Apple customers. When customers enter the store, Read more
SW Engineer *Apple* TV - Apple Inc. (United...
The Apple TV team is looking for excellent software engineers with experience in hardware, media management, media playback, content delivery and a passion for Read more
*Apple* Solutions Consultant - Apple (United...
Apple Solutions ConsultantJob Number: 51218534Pleasant Hill, California, United StatesPosted: Aug. 18, 2016Weekly Hours: 40.00Job SummaryAs an Apple Solutions Read more
*Apple* Solutions Consultant - Apple (United...
# Apple Solutions Consultant Job Number: 51218354 Fredericksburg, Virginia, United States Posted: Aug. 18, 2016 Weekly Hours: 40.00 **Job Summary** As an Apple Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.