TweetFollow Us on Twitter

Virus Protection
Volume Number:8
Issue Number:2
Column Tag:Pascal Workshop

Related Info: Resource Manager

Simple Antivirus Protection

An anti-virus scheme that can be painlessly added to every application.

By Nicholas Pisarro, Jr., Westport, Connecticut

About the author

Nick Pisarro is the principle architect of Aperture Visual Information Manager by the Graphic Management Group, Inc. He has been involved with all aspects of computer design including both hardware and software since 1961 and with the Macintosh since 1986.

The Virus Scout Pascal unit described in the January 1991 Programmer’s Forum is a nice idea. One problem with Virus Scout was that it was coded to handle only those specific viruses that the author knew about and could offer no protection against any future viruses that may infect an application.

It did set me to wondering, however, if there is a way to make both a simpler yet more universal virus detection scheme. I began to think about how viruses infect and reproduce themselves through an application, and how I could have applications I have developed protect themselves from becoming infected.

In order for a virus to infect an application it needs to either modify the existing resources of an application and/or add resources of its own. In order to reproduce it needs to seize program control from the application and the user’s Macintosh in order to issue its own instructions of death and destruction. This requires modification of a code resource such as ‘CODE’, ‘WDEF’, ‘MDEF’, or ‘LDEF’ resource types.

Usually a virus inserts a small stub of code in an existing resource to branch to one of its own resources, or it inserts a whole new code resource of its own to seize control. I don’t believe any viruses try to insert all their code in an existing application resource but always have to add a resource. Adding to a code resource, by linking in code, is a difficult operation and runs the risk of overflowing the size restrictions of code resources.

One advantage a virus detection scheme has within an application is that it knows how many and what types of resources the application should have! Rather than checking for the addition of specific virus resources, the virus detection scheme presented here just checks the number of resources the application should have against the number it actually has. In addition there is a Toolbox call that tells me the number of types of resources a resource fork has as well as specific counts. This may be used to check for the addition of additional types of resources. As the resource map for an application is in memory when it is running these types of checks do not use significant amounts of computer time.

It would be possible to check counts of all the resource types an application has, but I believe just checking the specific counts of its code resources is sufficient. A virus must insert or modify a code resource to gain control.

The Pascal unit here reads a resource with a count of the number of types of resources an application has as well as counts of specific types. If it finds any mismatch between expectations and reality, it notifies the user and causes the application to quit early. Note the “Get1” form of the resource call is used to get counts only from this application. This unit must be run before any data file resource forks are opened. If the application modifies its own resource fork, it must be careful not to do it in a way that triggers this virus check.

In the sample code no specific resource type has been assigned for the information resource. If all applications used the same type for this resource, a new virus could be written to circumvent this protection scheme. Use your own type.

Note that the code here is only concerned with viruses that infect an application, rather than viruses that infect files in the System Folder or the Desktop. Code like that from Virus Scout or elsewhere could be added to do this additional checking.

Listing

{Written by Nicholas Pisarro, Jr., Aperture Technologies, Inc.
 No rights reserved.}

UNIT VirusCheck;

INTERFACE

USES
 {$LOAD}
 MemTypes, QuickDraw, OSIntf, ToolIntf, PackIntf;
 

{Returns TRUE if Application can run.}
FUNCTION ApplicationCanRun: BOOLEAN;


IMPLEMENTATION

{Returns TRUE if Application can run.}
FUNCTION ApplicationCanRun: BOOLEAN;
 CONST
 kVirusChkKinds  = '????';{Rsrc type for the # 'CODE' & # of Kinds of 
resources}
 kVirusChkID=  32; {Resource ID for the Virus Check Rsrc}
 
 {The Virus found alert and its sub-messages}
 kVirusAlrt =  1282; {A Virus has been detected!}
 kCountRsrcMissing = 1;   {The Resource count Resource is missing}
 kTypeMiscount   = 2;{Wrong number of resource types}
 kRsrcMiscount   = 3;{Wrong number of a specific res. kind}
 
 TYPE
 {Resource & Count list.}
 RsrcCount = RECORD
 RType: ResType;
 RCount:INTEGER;
 END;
 
 RsrcRSRC = ARRAY[0..0] OF RsrcCount;
 pRsrcRSRC = ^RsrcRSRC;
 hRsrcRSRC = ^pRsrcRSRC;
 
 VAR
 {For counting Resources.}
 theResType:ResType; { The kind we’re looking for }
 subMsgNo:INTEGER; { Submessage number }
 msgStr,{ Submessage to go into dialog}
 workStr: Str255;{ Resource name to go into the message }
 
 aRsrcRSRC: hRsrcRSRC;  { Handle to the Count Rsrc}
 
 i:INTEGER;
 dummy: INTEGER;
 
 LABEL 100;
BEGIN   { ApplicationCanRun }
 ApplicationCanRun := FALSE;{Assume failure.}
 
 {Virus Check: Load resources with counts of various kinds of resources
  in Application. Make sure the counts in the resource match the actual
  counts in Application.}
 workStr[0] := CHR(0);    {Make WorkStr have no length.}
 
 {Try to get the counts of the various resources in the Application.}
 aRsrcRSRC := hRsrcRSRC(Get1Resource(kVirusChkKinds, kVirusChkID));
 IF aRsrcRSRC <> NIL THEN BEGIN
 
 {Check out each of the counts read.}
 FOR i := 0 TO GetHandleSize(Handle(aRsrcRSRC)) div SIZEOF(RsrcCount) 
- 1 DO BEGIN
 
 {If the kind is a 0, a total resource count is wanted.}
 IF ORD(aRsrcRSRC^^[i].RType[1]) = 0 THEN BEGIN
 
 {Does the total number of resource kinds in the Application
  match the count the resource?}
 IF (Count1Types <> aRsrcRSRC^^[i].RCount) THEN BEGIN
 
 subMsgNo := kTypeMiscount; { Sub message }
 
 {Issue a Virus Alert to the user.}
100:    GetIndString(msgStr, kVirusAlrt, subMsgNo);
 ParamText(msgStr, workStr, '', '');
 dummy := StopAlert(kVirusAlrt, NIL);
 
 EXIT(ApplicationCanRun);
 END;
 END
 
 {Otherwise, check a specific type.}
 ELSE BEGIN
 
 {Does the number of this kind of resource in the Application
  match the count the resource?}
 theResType := aRsrcRSRC^^[i].RType;
 IF Count1Resources(theResType) <> aRsrcRSRC^^[i].RCount THEN BEGIN
 
 { Make a string out of the resource type. }
 WorkStr[0] := CHR(4);
 BlockMove(@theResType[1], @workStr[1], 4);
 
 subMsgNo := kRsrcMiscount; { Sub message }
 
 GOTO 100;
 END;
 END;
 END;   {End FOR i }
 
 {Finished with the resource}
 ReleaseResource(Handle(aRsrcRSRC));
 END    {End IF aRsrcRSRC <> NIL}
 
 {Count Resource not found.}
 ELSE BEGIN
 subMsgNo := kCountRsrcMissing;    { Sub message }
 
 GOTO 100;
 END;
 
 {Possibly put other virus checks, checks for the proper system version,
  etc. here.}
 
 ApplicationCanRun := TRUE; {Success!}
END;    { ApplicationCanRun }

END.
 

Community Search:
MacTech Search:

Software Updates via MacUpdate

TunnelBear 3.0.1 - Subscription-based pr...
TunnelBear is a subscription-based virtual private network (VPN) service and companion app, enabling you to browse the internet privately and securely. Features Browse privately - Secure your data... Read more
ExpanDrive 5.4.0 - Access cloud storage...
ExpanDrive builds cloud storage in every application, acts just like a USB drive plugged into your Mac. With ExpanDrive, you can securely access any remote file server directly from the Finder or... Read more
Opera 40.0.2308.62 - High-performance We...
Opera is a fast and secure browser trusted by millions of users. With the intuitive interface, Speed Dial and visual bookmarks for organizing favorite sites, news feature with fresh, relevant content... Read more
Apple iOS 10.0.2 - The latest version of...
iOS 10 is the biggest release of iOS ever. A massive update to Messages brings the power of the App Store to your conversations and makes messaging more personal than ever. Find your route with... Read more
Herald 7.0 - Notification plugin for Mai...
Note: Versions 2.1.3 (for OS X 10.7), 3.0.6 (for OS X 10.8), 4.0.8 (for OS X 10.9), 5.0.2 (for OS X 10.10), and 6.0.3 (for OS X 10.11) are no longer supported by the developer. Herald is a... Read more
Postbox 5.0.2 - Powerful and flexible em...
Postbox is a new email application that helps you organize your work life and get stuff done. It has all the elegance and simplicity of Apple Mail, but with more power and flexibility to manage even... Read more
Yummy FTP Pro 1.11.10 - $29.99
Yummy FTP Pro is an advanced Mac file transfer app which provides a full-featured professional toolkit combined with blazing speeds and impeccable reliability, so whether you want to transfer a few... Read more
Tidy Up 4.1.17 - $29.99
Tidy Up is a full-featured duplicate finder and disk-tidiness utility. Features With Tidy Up you can search for duplicate files and packages by the owner application, content, type, creator,... Read more
Logitech Control Center 3.9.5 - Keyboard...
Logitech Control Center (LCC) is designed to support OS X and allows you to take full advantage of your Logitech keyboard, mouse, or trackball. With the LCC you can: Browse the Internet using... Read more
Macgo Blu-ray Player 2.16.17 - Blu-ray p...
Macgo Blu-ray Player can bring you the most unforgettable Blu-ray experience on your Mac. Overview Macgo Mac Blu-ray Player can satisfy just about every need you could possibly have in a Blu-ray... Read more

How to build and care for your team in D...
Before you hit the trail and become a dog sledding legend, there’s actually a fair bit of prep work to be done. In Dog Sled Saga, you’re not only racing, you’re also building and caring for a team of furry friends. There’s a lot to consider—... | Read more »
How to win every race in Dog Sled Saga
If I had to guess, I’d say Dog Sled Saga is the most adorable racing game on the App Store right now. It’s a dog sled racing sim full of adorable, loyal puppies. Just look at those fluffy little tails wagging. Behind that cute, pixelated facade is... | Read more »
Let the war games commence in Gunship Ba...
Buzz Lightyear famously said, “This isn’t flying, this is falling – with style!” In the case of Gunship Battle: Second War, though, this really is flying - with style! The flight simulator app from Joycity puts you in control of 20 faithfully... | Read more »
How to get a high score in Fired Up
Fired Up is Noodlecake Games’ high score chasing, firefighting adventure. You take control of a wayward firefighter who propels himself up the side of a highrise with blasts of water. Sound silly? It is. It’s also pretty difficult. You can’t... | Read more »
NBA 2K17 (Games)
NBA 2K17 1.0 Device: iOS iPhone Category: Games Price: $7.99, Version: 1.0 (iTunes) Description: Following the record-breaking launch of NBA 2K16, the NBA 2K franchise continues to stake its claim as the most authentic sports video... | Read more »
Dog Sled Saga (Games)
Dog Sled Saga 1.0.1 Device: iOS Universal Category: Games Price: $3.99, Version: 1.0.1 (iTunes) Description: A game by Dan + Lisa As a rookie musher, foster a dogsledding team whose skills will grow if they're treated right. Week by... | Read more »
60 Seconds! Atomic Adventure (Games)
60 Seconds! Atomic Adventure 1.2 Device: iOS Universal Category: Games Price: $2.99, Version: 1.2 (iTunes) Description: 60 Seconds! is a dark comedy atomic adventure of scavenge and survival. Collect supplies and rescue your family... | Read more »
Tons of Bullets! (Games)
Tons of Bullets! 1.0 Device: iOS Universal Category: Games Price: $1.99, Version: 1.0 (iTunes) Description: Tons of BulletsA retro 2D pixel platformer infused with tons of bullets and tons of features!Fight as Kenji the Ninja and... | Read more »
Sorcery! 4 (Games)
Sorcery! 4 1.0 Device: iOS Universal Category: Games Price: $4.99, Version: 1.0 (iTunes) Description: *** PLEASE NOTE: Sorcery! 4 requires a minimum of iPad 3 or iPhone 4 *** An epic adventure through a cursed citadel of monsters,... | Read more »
Building the perfect Animation Throwdown...
Animation Throwdown is a casual card game full of plenty of inside jokes from some of your favorite cartoons. It’s accessible as far as card games go, but that’s not to say that it hands your victories to you easily. There’s quite a bit that goes... | Read more »

Price Scanner via MacPrices.net

Duplicate Sweeper Free On Mac App Store For O...
To celebrate the launch of Apple’s latest macOS Sierra, Stafford, United Kingdom based Wide Angle Software has announced that its duplicate file finder software, Duplicate Sweeper, is now available... Read more
13-inch Retina MacBook Pros on sale for up to...
B&H Photo has 13″ Retina Apple MacBook Pros on sale for up to $150 off MSRP. Shipping is free, and B&H charges NY tax only: - 13″ 2.7GHz/128GB Retina MacBook Pro: $1174.99 $125 off MSRP - 13... Read more
Evidence Surfaces Pointing To New A10X Chip F...
Citing a job description for a Project Lead position at Apple’s Austin, Texas engineering labs, Motley Fool’s Ashraf Eassa deduces that development is progressing well on Apple’s next-generation in-... Read more
Check Print’R for macOS Allows Anyone to Easi...
Delaware-based Match Software has announced the release and immediate availability of Check Print’R 3.21, an important update to their easy-to-use check printing application for macOS. Check Print’R... Read more
Apple refurbished 11-inch MacBook Airs availa...
Apple has Certified Refurbished 11″ MacBook Airs (the latest models), available for up to $170 off the cost of new models. An Apple one-year warranty is included with each MacBook, and shipping is... Read more
Apple refurbished 15-inch Retina MacBook Pros...
Apple has Certified Refurbished 2015 15″ Retina MacBook Pros available for up to $380 off the cost of new models. An Apple one-year warranty is included with each model, and shipping is free: - 15″ 2... Read more
Major Version 5 Release Of Free myTuner Radio...
AppGeneration Software has announced the release of myTuner Radio 5.0.1, an important update to their live radio app for iOS and Android platforms. With myTuner Radio, you can listen to more than 30,... Read more
TheAppStore Searches And Filters iOS And macO...
Boston based InchWest has announced the official launch of TheAppStore, a free web based service that lets users search iOS and Mac apps on the web without iTunes or the App store. TheAppStore... Read more
2TB Time Capsule on sale for $199, save $100
Amazon has 2TB Apple Time Capsules on sale for $199 including free shipping. Their price is $100 off MSRP. Choose Amazon as the seller when making your purchase, rather than a third party seller. Read more
12-inch 1.2GHz Rose Gold Retina MacBook on sa...
Amazon.com has the 2016 12″ 1.2GHz Rose Gold Retina MacBook on sale for $1254.02 including free shipping. Their price is $345 off MSRP, and it’s the lowest price available for this model from any... Read more

Jobs Board

Senior *Apple* Administrator - Pratt Instit...
POSITION SUMMARY: Directs the coordination and standardization of campus-wide Apple systems, including planning, analysis and implementation of Apple -related Read more
Restaurant Manager (Neighborhood Captain) - A...
…in every aspect of daily operation. WHY YOU'LL LIKE IT: You'll be the Big Apple . You'll solve problems. You'll get to show your ability to handle the stress and Read more
*Apple* Retail - Multiple Positions- Napervi...
Job Description: Sales Specialist - Retail Customer Service and Sales Transform Apple Store visitors into loyal Apple customers. When customers enter the store, Read more
US- *Apple* Store Leader Program - Apple (Un...
…Summary Learn and grow as you explore the art of leadership at the Apple Store. You'll master our retail business inside and out through training, hands-on Read more
*Apple* Retail - Multiple Positions (US) - A...
Sales Specialist - Retail Customer Service and Sales Transform Apple Store visitors into loyal Apple customers. When customers enter the store, you're also the Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.