Clean documentation
-------------------

Virus information by Joseph K. Horn
CLEAN program by Brian Maguire

[
[ Opmerking door STORC:
[
[ Het virus is nog niet buiten de Verenigde Staten gesignaleerd,
[ alle programma's zoals die op de STORC disks komen worden getest.
[ Op dit moment is het probleem nog vrij lokaal, namelijk op Amerikaanse
[ universiteiten en scholen.
[
[ Wees dus niet al te ongerust, maar gebruik het CLEAN programma als u
[ zeker van de zaak bent.
[
[ Kijk wel uit met programma's die u bijvoorbeeld van het HP BBS in Amerika
[ haalt. (Dit is overigens overbodig, daar al deze programma's van dit BBS
[ door STORC worden getest, en de werkende programma's komen op dit soort
[ disks)
[

                * * * * * * * * * * * * * * * *
                *                             *
                *    V I R U S   A L E R T    *
                *                             *
                * * * * * * * * * * * * * * * *


It was just a matter of time. Three viruses (all very similar) have
been written for the HP 48. As if this weren't bad enough, they are
being spread around on college campuses as a practical joke.  Not
funny at all, when it's your 48 that gets sick, then goes psychotic,
and finally dies.

I must admit, however, a certain morbid respect for the author(s);
these little timebombs are well written.  When stripped from their
host program, they look like this harmless little 3-object snippit:

                    "*" External Code

where the * is the null character (displayed as a little square blob).
The "External" is not at all what it appears to be!  It's really an
"external type 2" object, one of the four unused object types; and it
contains the real body of the virus, in System RPL.  The subsequent
Code object merely jumps backwards into the External object, just past
its object header, thus executing its contents as an RPL program.

If you engage in promiscuous I/O with college students (who doesn't?),
be on the lookout for the following bogus "error messages":

                    "System Malfunction"
                    "Defective ROM"
                    "Damaged ROM"
                    "Invalid Addressing"

Also, the virus attaches itself to other program objects in the
current directory (thereby earning the name "virus").  Since it
modifies objects without your knowledge, it may wreak havoc that the
author(s) never intended, especially if you are into System RPL
programming.  It may cause objects to be purged, entire directories to
be lost, memory corrupted, and even total Memory Clear.  And the null
character at the beginning prevents you from removing the virus by
normal editing, because when you hit EDIT you'll get the "Can't Edit
Null Char." error message.  This sucker not only propagates itself, it
even has self-preservation instincts!  Geez.

One virus disables library 2 (the internal list of most of the
functions), and another virus disables library 1792 (the internal
list of the rest of the built-in functions).
It's only the third virus that gives bogus error messages.  All three
propagate themselves.  Contrary to the original description, they infect
programs anywhere in the current path, including the HOME directory.

Since the current "strains" of this virus all contain the same Code
object, it's easy to write a "vaccine" that checks a program for the
virus, and if found, "disinfects" it.  If you'd like to do it
yourself, here's the recognizable 29.5-byte Code object:

Source code:

       HP                AG             opcode
    --------        ------------        --------
    D1=D1+ 5        ADD.A #5,D1         174
    A=DAT1 A        MOVE.A @D1,A        143
    LC(5) 5         MOVE.P5 #5,C        3450000
    A=A-C A         SUB.A C,A           EA
    DAT1=A A        MOVE.A A,@D1        141
    D1=D1- 5        SUB.A #5,D1         1C4
    A=DAT1 A        MOVE.A @D1,A        143
    LC(5) 10        MOVE.P5 #A,C        34A0000
    A=A+C A         ADD.A C,A           CA
    DAT1=A A        MOVE.A A,@D1        141
    LC(5) #06F8E    MOVE.P5 #06F8E,C    34E8F60
    A=C A           MOVE.A C,A          DA
    PC=(A)          JUMP.A @A           808C

The "External" object immediately precedes this Code object.  It
consists of its five-nibble prolog (02BCC), followed by a five-nibble
length field (nib distance to the following Code object).  The length
field is immediately follwed by an RPL program object (beginning
D9D20, of course), which is the nucleus of the virus, the part that
does all the dirty work; the "DNA" part, as it were.

For obvious reasons, I will not list the virus itself.

Brian Maguire considered this sordid situation to be a delightful
programming challenge, and whipped up the following program.
'CLEAN' disinfects entire directories.

INSTRUCTIONS: Run CLEAN to disinfect all the programs in
the current directory.  Obviously it is best to keep this
program protected in a card switched to the ROM position.
It can be run from there, for example via a CST key, or a
user-mode key assignment.

Here's the source code for the curious and curiouser:

'CLEAN'
\<< 8 TVARS LIST\-> 1 SWAP
  FOR i DUP RCL

  CK1NoBlame CK&DISPATCH0 EIGHT
  :: BEGIN
    :: DUPLENCOMP #2= NOTcase FALSE DUP TWO NTHCOMPDROP
      DTYPECOL? NOTcase DROPFALSE DUPLENCOMP #3= NOTcase
      DROPFALSE THREE NTHCOMPDROP '
      CODE 49 1741433450000EA1411C414334A0000CA14134E8F60DA808C
      EQUAL
    ; WHILE CARCOMP REPEAT
  ;

  SWAP STO
  NEXT
\>>

Many thanx to Brian Maguire for making this potentially terrifying
situation so easy to cope with.