4 ms·

My high school rascalry: This was from 1993 to 1996, on MS-DOS 486 machines in the computer lab. I had found a program on some local BBS that could resize a h

by T-hawk 14y ago

My high school rascalry: This was from 1993 to 1996, on MS-DOS 486 machines in the computer lab. I had found a program on some local BBS that could resize a hard disk partition. So on a few of the machines, I shrank C: by a few dozen megabytes and created my own D: drive and copied games into it. How to hide that D drive? With Norton DiskEdit, I figured out how to manipulate the partition table manually, setting the partition type to a null value so that DOS wouldn't see it. Next I figured out how to read and write that disk sector in assembly language. Soon I had a command-line executable that would hide or unhide my private partition with a single command. Best of all, DOS would only read the partition table on boot. So I could boot with my partition enabled, then hide it, and play games knowing that any reboot would render the partition hidden again. The last thing I needed to cover up was the missing space on the C drive, which could be revealed by the DIR command. So I wrote a memory-resident program (assembly again) that constantly scanned for the string of "bytes free" in video memory, and patched in a larger value. Okay, now the MEM command might reveal the existence of my TSR. So I named my program as VSAFE, which was the name of a memory-resident antivirus program on each of these machines. I had my program output the same text as the real VSAFE did on startup, and overwrote the real VSAFE executable with my own. So I had a pretty well concealed partition, that would have required some heavy duty skills to find and remove. "format c:" would not affect it, and even FDISK would just show the space as empty, not a partition. Never got caught for any of it; the computer lab supervisor and other students knew I was up to something but never found any of the hidden stuff. Man, I could have had a career as a malware author...

shurane 14y ago
That is impressive. That's a lot of work to hide your activities from other people, though. Sufficiently paranoid? I say yes. But then again, I have not met many impressive hackers in real life. How much reading up did you have to do to figure each of those things out? Or was it trial by fire? Figuring out all that on your own? Seriously, kudos. Those are some hacker chops.
- T-hawk 14y ago
  More the other way around, that I'd read about how to do such things and then saw an opportunity to put them to use. I had been self-teaching assembly for a couple years from library books and doing other toy programs. One book, possibly one of Peter Norton's, covered the partition table in sufficient detail. (And I was hacking only one byte in it, nothing sophisticated.) Reading and writing a disk sector in assembly was commonly covered in reference books. So was writing a TSR to hook the timer interrupt, which I'd already done for some other purposes. The actual logic of looping through segment B800 looking for text wasn't hard in assembly. Overwriting and masquerading as a legit program (VSAFE) isn't a technical challenge at all. The hacker chops were thinking my way through the detection methods and countermeasures, more so than the actual programming. If I hadn't had that background, I would probably have hidden the games with less sophisticated methods. Bury them in deep subdirectories, maybe zip them with password encryption. And it was done for the challenge more than the results; I had a home computer that could play all the same games. Anyway, I'll relate another story. There was an annoying kid in my computer science classes, the type who thought he knew it all but was pretty clueless. One day he was complaining that a game he had downloaded required more RAM than his home computer had. I told him I'd give him a copy of a utility that would do on-the-fly compression of RAM in DOS. (At the time, Stacker was big for disk compression, and there were real utilities that did memory compression in Windows. So it was plausible.) Of course, my "utility" was a trojan. But I was subtle about it. The trojan dropped an executable with a blank name (an Alt-255 character) and stuck a reference to it in AUTOEXEC.BAT, which was invisible and looked like a blank line. The payload would trash the partition table, only if the system date was a month later than I originally did this, so he wouldn't be tracing the time bomb back to me. (Yeah, this was nasty. I was a youth with power.) I don't know if he actually ran it or if the payload ever went off; the bomb date was in the summer after school ended. But the real fun part is the postscript. The outer trojan was in QuickBasic (the dropped payload was assembly.) Years later, my brother was playing with QuickBasic to learn it, so I gave him a copy of my QB directory with several dozen of my programs to play with. A few days later he tells me that his computer won't boot. Yikes. I put together a boot floppy with a Norton disk repair utility to start digging, and eventually notice that the partition table had some corruption that looked oddly familiar. You guessed it, my own brother had run my old nasty trojan and got his partition table nuked!
yitchelle 14y ago
Whoa, you had some serious hacks in there. It funny that we were jumping through hoops just to able to play some games on the school's computers. Funny days.

by T-hawk 14y ago

shurane 14y ago

That is impressive. That's a lot of work to hide your activities from other people, though. Sufficiently paranoid? I say yes. But then again, I have not met many impressive hackers in real life. How much reading up did you have to do to figure each of those things out? Or was it trial by fire? Figuring out all that on your own? Seriously, kudos. Those are some hacker chops.

T-hawk 14y ago
More the other way around, that I'd read about how to do such things and then saw an opportunity to put them to use. I had been self-teaching assembly for a couple years from library books and doing other toy programs. One book, possibly one of Peter Norton's, covered the partition table in sufficient detail. (And I was hacking only one byte in it, nothing sophisticated.) Reading and writing a disk sector in assembly was commonly covered in reference books. So was writing a TSR to hook the timer interrupt, which I'd already done for some other purposes. The actual logic of looping through segment B800 looking for text wasn't hard in assembly. Overwriting and masquerading as a legit program (VSAFE) isn't a technical challenge at all. The hacker chops were thinking my way through the detection methods and countermeasures, more so than the actual programming. If I hadn't had that background, I would probably have hidden the games with less sophisticated methods. Bury them in deep subdirectories, maybe zip them with password encryption. And it was done for the challenge more than the results; I had a home computer that could play all the same games. Anyway, I'll relate another story. There was an annoying kid in my computer science classes, the type who thought he knew it all but was pretty clueless. One day he was complaining that a game he had downloaded required more RAM than his home computer had. I told him I'd give him a copy of a utility that would do on-the-fly compression of RAM in DOS. (At the time, Stacker was big for disk compression, and there were real utilities that did memory compression in Windows. So it was plausible.) Of course, my "utility" was a trojan. But I was subtle about it. The trojan dropped an executable with a blank name (an Alt-255 character) and stuck a reference to it in AUTOEXEC.BAT, which was invisible and looked like a blank line. The payload would trash the partition table, only if the system date was a month later than I originally did this, so he wouldn't be tracing the time bomb back to me. (Yeah, this was nasty. I was a youth with power.) I don't know if he actually ran it or if the payload ever went off; the bomb date was in the summer after school ended. But the real fun part is the postscript. The outer trojan was in QuickBasic (the dropped payload was assembly.) Years later, my brother was playing with QuickBasic to learn it, so I gave him a copy of my QB directory with several dozen of my programs to play with. A few days later he tells me that his computer won't boot. Yikes. I put together a boot floppy with a Norton disk repair utility to start digging, and eventually notice that the partition table had some corruption that looked oddly familiar. You guessed it, my own brother had run my old nasty trojan and got his partition table nuked!

yitchelle 14y ago

Whoa, you had some serious hacks in there. It funny that we were jumping through hoops just to able to play some games on the school's computers. Funny days.