C: GEMDOS,BIOS and XBIOS Calls
PART III
THE ULTIMATE VIRUS KILLER BOOK APPENDICES
C - GEMDOS-, BIOS-AND XBIOS FUNCTIONS
The Operating System (TOS) has many convenient functions built
in, ready for programmers to be used. These can roughly be
divided into those belonging to GEMDOS, BIOS and XBIOS. The
relevant entries (i.e. the ones often used by viruses) will be
explained here. At the end you will find a list of TOS error
messages.
- GEMDOS -------------------------------------------------------
GEMDOS calls are invoked by the mnemonic command TRAP #1. Then,
the Operating System will jump through the GEMDOS vector at
address $84 (which can be bent by viruses).
$01 CONIN
This function is used to get a character from the keyboard, and
is used in viruses that wait for the user to type in a word. It
echoes the input to the screen, and the character will get into
register D0.
MOVE.W #1,-(SP)
TRAP #1
ADDQ.L #2,SP
$09 PRINT LINE
This function is mostly used to output a string of text to the
screen, i.e. to tell the user a virus has struck, or that is has
just been booted. It also processes the Atari's VT-52 Terminal
Escape Codes.
MOVE.L #text,-(SP) ;the address of the text
MOVE.W #$9,-(SP)
TRAP #1
ADDQ.L #6,SP
TEXT DC.B 'This is the text',0
- BIOS ----------------------------------------------------------
BIOS calls are invoked by the mnemonic command TRAP #13. Then,
the Operating System will jump through the BIOS vector at address
$B4. This vector can be bent by viruses.
4 RWABS
This is the universal function to read and write sectors from
and to hard disk as well as floppy disk. This is also the core
routine behind the XBIOS calls floprd and flopwr, explained
later. The address of this routine is located in the system
variable hdv_rw, and can thus easily be manipulated by viruses.
Accidentally, RAM disks and hard disks also manipulate this
vector for their own use (to install their driver software).
The return value is an error code in D0.
MOVE.W dev,-(SP)
MOVE.W recnr,-(SP)
MOVE.W qty,-(SP)
MOVE.L buffer,-(SP)
MOVE.W rwflag,-(SP)
MOVE.W #4,-(SP)
TRAP #13
ADD.L #14,SP
The meaning of the variables is:
rwflag 0 read a sector
1 write a sector
2 read sector, ignore media change
3 write sector, ignore media change
buffer The buffer whereto the disk sector will be
read or from which it will be written. In
viruses, the _Dskbufp system variable is
often used here (see appendix B)
qty The amount of sectors that have to written
or read
recnr The logical sector number where to start
dev The device number (A=0, etc.) to work on.
Note that this routine allows device
numbers of 2 or higher, i.e. hard disk
manipulations are possible!
- XBIOS ---------------------------------------------------------
The XBIOS offers more comfortable functions to be used by the
programmer. These calls are invoked by the mnemonic command TRAP
#14, at which moment the Operating System will jump through the
XBIOS vector located at address $B8. This vector can also be bent
by viruses.
8 FLOPRD
This is the easier to use variety of the BIOS function rwabs,
but it is limited to use for floppy disks only, and it can only
read a disk sector (or multiple of them).
The return value will be an error code in D0.
MOVE.W qty,-(SP)
MOVE.W side,-(SP)
MOVE.W track,-(SP)
MOVE.W sector,-(SP)
MOVE.W dev,-(SP)
MOVE.L filler,-(SP) ; can be replaced by CLR.L -(SP)
MOVE.L buffer,-(SP)
MOVE.W #8,-(SP)
TRAP #14
ADD.L #20,SP
The meaning of the variables is:
count The number of sectors that have to be read
(these have to be in a sequence). Values
between 1 and the number of sectors per
track are possible here
side The side from which should be read. Side 1
is 0, side 2 is 1
track The number of the track from which the
sector(s) should be read, varying from 0
to the number of tracks per side (usually
79)
sector The number of the first sector to be read,
varying from 1 to the number of sectors
per track
dev Specification of the device to be used.
Floppy A is 0, B is 1. Others are not
possible
filler Something very Atari-esque (and, thus,
strange). A longword that is not used
buffer The buffer to which the sector(s) should
be read. Often the address of the system
variable _Dskbufp is used here (see
appendix B)
9 FLOPWR
This is the exact opposite of the above function, floprd. With
this, one can write sectors to disk instead of reading them. The
same remarks apply, so I will therefore limit myself to giving
the assembler syntax.
MOVE.W qty,-(SP)
MOVE.W side,-(SP)
MOVE.W track,-(SP)
MOVE.W sector,-(SP)
MOVE.W dev,-(SP)
MOVE.L filler,-(SP) ; can be replaced by CLR.L -(SP)
MOVE.L buffer,-(SP)
MOVE.W #9,-(SP)
TRAP #14
ADD.L #20,SP
The meaning of the variables is identical to XBIOS function 8,
floprd.
10 FLOPFMT
This routine allows you to format a disk, one track at a time.
Any viruses that format (parts of) disks are likely to use this
routine for their evil purposes.
The return value will be an error code in D0. If this is -16,
then it means that some formatted sectors could not be properly
read back (i.e. bad sectors). A list of these can then be found
in the buffer in word-length values, ending with a zero.
This routine can only format floppy disks - hard disks can't be
formatted with this!
As of TOS version 3.06, this routine can also format 18 sectors
per track, for High Density disks, or 26 sectors per track, for
Extra-high density disks.
MOVE.W virgin,-(SP)
MOVE.L magic,-(SP)
MOVE.W interleave,-(SP)
MOVE.W side,-(SP)
MOVE.W track,-(SP)
MOVE.W spt,-(SP)
MOVE.W dev,-(SP)
MOVE.L filler,-(SP) ;can be replaced by CLR.L -(SP)
MOVE.L buffer,-(SP)
MOVE.W #10,-(SP)
TRAP #14
ADD.L #26,SP
The meaning of the variables is:
virgin The value with which a 'virginal' track
should be filled. Mostly '$E5E5' is used
here. It is not allowed to use $xFxF here!
magic This magic longword needs to have the
value '$87654321'. This magic longword has
been introduced so that programs are less
likely to spontaneously format any tracks
when you have accidentally given a wrong
function number in your program source
code, for example
interleave The order in which sectors are written on
disk. Usually, this is 1 which results in
the following order:
1-2-3-4-5-6-7-8-9
When the interleave is 2, this will result
in a sector order like this:
1-3-5-7-9-2-4-6-8
This is useful for optimal disk loading
speed, but this is beyond the scope of
this book to describe.
side Specifies the side on which a track should
be formatted (0 or 1)
track Specifies the track to be formatted (0-79)
spt Number of sectors per track that need to
be formatted (usually 9, though 10 is also
quite common)
dev Device on which the format the track (0
for A, 1 for B)
filler Yep. Another one of those unnecessary
longwords that is not used
buffer The address of the buffer. Watch out: This
buffer needs to equal the length of an
entire track (including the system
information between the actual data
tracks), and should thus be about 8 Kb for
9 sectors per track, or 9 Kb for 10
sectors per track. Increased values are
needed for HD or ED disks
18 PROTOBT
For lazy virus programmers, this is usually the routine they use
to make freshly written copies of their virus executable after
having been copied to a bootsector. This routine enables a non-
executable bootsector to be made executable (and can do some
other things as well, but these are not of need to viruses).
MOVE.W execflag,-(SP)
MOVE.W disktype,-(SP)
MOVE.L serialnr,-(SP)
MOVE.L buffer,-(SP)
MOVE.W #18,-(SP)
TRAP #14
ADD.L #14,SP
The meaning of the variables is:
execflag 0 Disk bootsector should not be executable
1 Disk bootsector should be executable
-1 Bootsector should remain as it is
disk type 0 40 tracks, single sided (180 Kb)
1 40 tracks, double sided (360 Kb)
2 80 tracks, single sided (360 Kb)
3 80 tracks, double sided (720 Kb)
4 80 tracks, double sided HD (1.44 Mb)
5 80 tracks, double sided ED (2.88 Mb)
-1 Disk type should remain as it is
Values '4' and '5' are only available as
of TOS 3.06, and allow the use of High
Density and Extra-high Density floppy
disks respectively.
serialnr This is a 24-bit random number which will
be written to the bootsector to allow the
Operating System to check whether a disk
has been changed or not.
When the value specified here is bigger
than 24 bits ($1000000), a random number
will be generated. When it is -1
(hexadecimal $FFFFFFFF), it will not be
changed.
buffer The buffer to which the sector(s) should
be read. Often the address of the system
variable _Dskbufp is used here (see
appendix B)
32 DOSOUND
On its own, this function really has very little to do with
viruses. However, many 'fun' viruses and many anti-viruses use it
to have a kind of bleep sound appear from the monitor speaker, or
even more or less complex tunes of limited length. I will not
explain the format of the sound data here, as that would be
beyond the scope of this book to explain.
MOVE.L #sounddata,-(SP)
MOVE.W #32,-(SP)
TRAP #14
ADDQ.L #6,SP
'Sounddata' is the memory location where the sound data is
stored.
TOS ERROR MESSAGES
When calls connected to disk drives are executed, data register
D0 gets a return value. This return value is the error code
supplied below. Though in the case of viruses it is usually only
checked whether D0 contains a negative (error occurred) or non-
negative (zero - no error occurred), a full list has been
included here anyway.
0 OK. No error
- 1 General error
- 2 Drive not ready
- 3 Unknown command
- 4 CRC error (checksum error)
- 5 Bad request, invalid command
- 6 Seek error (track not found)
- 7 Unknown media (invalid bootsector)
- 8 Sector not found
- 9 No paper (?! Atari hath strange ways ?!)
-10 Write error
-11 Read error
-12 General error
-13 Disk is write-protected
-14 Disk has been changed
-15 Unknown device
-16 Bad sector at verify
-17 Insert disk (when one drive is connected)
