On Wed, 18 Jul 2001, Carlos Murillo wrote:
> Yes, but contiguous 0's are special and easy enough to detect,
> and, it would not be difficult for the assembler to include
> some initialization code.
Yup. Stick the virus in there, and alter the file header's notion of
the entry point to be the virus text. The virus does its dirty work when
the binary is run and then jumps to the real text,
--
Jeffrey S. Sharp
jss_at_ou.edu
Received on Thu Jul 19 2001 - 01:07:45 BST