1
00:00:00,330 --> 00:00:02,100
- Welcome to DEF CON.

2
00:00:02,100 --> 00:00:03,180
How many first timers?

3
00:00:03,180 --> 00:00:04,890
Raise your hands.

4
00:00:04,890 --> 00:00:06,590
Alright, good amount, good amount.

5
00:00:07,620 --> 00:00:08,940
So I guess everybody's here

6
00:00:08,940 --> 00:00:13,230
for the 10:00 AM Old Malware,
New Tools on a Commodore 64.

7
00:00:13,230 --> 00:00:15,750
So we have Cesare here to our left.

8
00:00:15,750 --> 00:00:18,564
Welcome him, he's a first time speaker.

9
00:00:18,564 --> 00:00:22,290
(audience applauds)

10
00:00:22,290 --> 00:00:24,040
So everybody knows what that means.

11
00:00:25,400 --> 00:00:28,380
(intermittent audience shouts)

12
00:00:28,380 --> 00:00:29,433
Yes, it does.

13
00:00:30,440 --> 00:00:32,580
(audience cheers and applauds)

14
00:00:32,580 --> 00:00:36,290
Good morning, and let's
have Cesare kick it off.

15
00:00:36,290 --> 00:00:37,740
- Thank you very much.

16
00:00:39,370 --> 00:00:40,860
Okay, good morning everyone.

17
00:00:40,860 --> 00:00:42,720
Thank you for being here with me.

18
00:00:42,720 --> 00:00:45,210
And okay, let's start immediately.

19
00:00:45,210 --> 00:00:47,460
Speaking about those strange
things for DEFCON maybe,

20
00:00:47,460 --> 00:00:50,520
something like coming from the past,

21
00:00:50,520 --> 00:00:52,680
but I think that it makes sense,

22
00:00:52,680 --> 00:00:54,750
especially for this ER team.

23
00:00:54,750 --> 00:00:57,690
Let's speak about me for a second,

24
00:00:57,690 --> 00:01:00,600
but just for a few slide, for one slide.

25
00:01:00,600 --> 00:01:01,590
My name is Cesare Pizzi.

26
00:01:01,590 --> 00:01:04,020
I work, my main job is reverse engineer.

27
00:01:04,020 --> 00:01:09,020
So I spend most of my time
looking at other codes,

28
00:01:09,090 --> 00:01:12,270
but sometimes I also
trying to write something

29
00:01:12,270 --> 00:01:13,440
for the community.

30
00:01:13,440 --> 00:01:16,650
And I like a lot, for
example, to write software,

31
00:01:16,650 --> 00:01:21,450
always about security,
regarding security tools.

32
00:01:21,450 --> 00:01:24,840
Like for example, Volatility,
OpenCanary, Cetus, Speakeasy

33
00:01:24,840 --> 00:01:28,080
and also have a couple
of main projects running,

34
00:01:28,080 --> 00:01:32,310
similar in respect, which
are entirely done by me.

35
00:01:32,310 --> 00:01:35,820
If you want to reach me out,
you can obviously reach me

36
00:01:35,820 --> 00:01:37,860
on Twitter or on Github, open an issue,

37
00:01:37,860 --> 00:01:40,830
just get in touch with me,
I will be more than happy

38
00:01:40,830 --> 00:01:44,760
to speak with you about
everything about security.

39
00:01:44,760 --> 00:01:46,612
But okay, let's start with the why.

40
00:01:46,612 --> 00:01:49,200
It sounds pretty weird in 2022

41
00:01:49,200 --> 00:01:51,970
to speak about Commodore 64 viruses

42
00:01:53,070 --> 00:01:55,930
and what made me decide to do this

43
00:01:57,000 --> 00:02:00,949
was this picture coming
from the DEFCON 30 theme.

44
00:02:00,949 --> 00:02:05,163
I don't know, something went
in my mind when I saw it.

45
00:02:07,554 --> 00:02:10,650
I decided I had to do something like,

46
00:02:10,650 --> 00:02:13,590
try to bring my knowledge
that I have today

47
00:02:13,590 --> 00:02:18,480
back with something that I
was using when it was I child,

48
00:02:18,480 --> 00:02:23,480
for example, but be assured
that it's not a nostalgic talk.

49
00:02:24,300 --> 00:02:26,550
It's not something
about the good old days,

50
00:02:26,550 --> 00:02:28,950
because that's not my way
of approaching things.

51
00:02:30,240 --> 00:02:32,850
I want also to report another
sentence that is coming

52
00:02:32,850 --> 00:02:34,710
from the DEFCON 30 team.

53
00:02:34,710 --> 00:02:37,020
And so that's exactly
what this talk is about.

54
00:02:37,020 --> 00:02:41,510
So trying to move what was interesting

55
00:02:42,360 --> 00:02:44,190
in the past, into the future.

56
00:02:44,190 --> 00:02:48,364
And so try to not lose
what we learned in the past

57
00:02:48,364 --> 00:02:52,650
and try to keep it and
make experience about it.

58
00:02:52,650 --> 00:02:57,650
So doing this, I also realized
that there were a lot more,

59
00:02:58,080 --> 00:03:01,440
for example, I saw this kind of viruses

60
00:03:01,440 --> 00:03:06,440
which was really illuminating
and very, very interesting

61
00:03:06,900 --> 00:03:08,430
to do with this kind of exercise.

62
00:03:08,430 --> 00:03:09,480
And remember that we're speaking

63
00:03:09,480 --> 00:03:11,280
about few hundred bytes software,

64
00:03:11,280 --> 00:03:13,470
everything written back then about viruses

65
00:03:13,470 --> 00:03:16,170
were more or less one
kilobytes of software.

66
00:03:16,170 --> 00:03:18,450
This is particular that
we are looking at today,

67
00:03:18,450 --> 00:03:20,310
it's in 700 bytes and we will see

68
00:03:20,310 --> 00:03:23,850
that there will be a lot of
things done in 700 bytes.

69
00:03:23,850 --> 00:03:26,790
Okay, let's set some common
historical background

70
00:03:26,790 --> 00:03:29,640
about Commodore 64 because
maybe not all of you

71
00:03:29,640 --> 00:03:31,650
knows what we are speaking about.

72
00:03:31,650 --> 00:03:34,470
And okay, this is a
picture of Commodore 64.

73
00:03:34,470 --> 00:03:38,250
In Italy, where I come from,
it was called the big biscuit

74
00:03:38,250 --> 00:03:41,130
because of the shape and
the color of chassis.

75
00:03:41,130 --> 00:03:42,840
I dunno if it's the same
in other countries as well,

76
00:03:42,840 --> 00:03:44,220
but that was the way,

77
00:03:44,220 --> 00:03:48,450
and it was one of the first
home computer that born in 1982

78
00:03:48,450 --> 00:03:51,600
together with Apple two
and a lot of others.

79
00:03:51,600 --> 00:03:55,920
It was mainly used for gaming actually,

80
00:03:55,920 --> 00:03:57,780
because of several reasons,

81
00:03:57,780 --> 00:03:59,673
but viruses were a thing back then.

82
00:04:02,130 --> 00:04:04,680
So, they were existing,

83
00:04:04,680 --> 00:04:07,713
but it was very different
from the current reality.

84
00:04:08,970 --> 00:04:12,000
Okay, let's start in the defining
a virus before going ahead

85
00:04:12,000 --> 00:04:14,730
so that we are all on same page.

86
00:04:14,730 --> 00:04:17,340
Okay, a virus, it's a kind of a program

87
00:04:17,340 --> 00:04:20,700
that without user knowledge,
try to persist and replicate.

88
00:04:20,700 --> 00:04:24,570
I'm sure that this is not
a 100% fitting definition,

89
00:04:24,570 --> 00:04:26,580
but it's a good starting point

90
00:04:26,580 --> 00:04:28,200
for all of us into going ahead,

91
00:04:28,200 --> 00:04:30,550
understanding what we
are speaking about today.

92
00:04:31,581 --> 00:04:34,740
Okay, today if we think about
virus or malicious software

93
00:04:34,740 --> 00:04:35,584
we are thinking about something

94
00:04:35,584 --> 00:04:39,930
that is built to give
a gain to the attacker,

95
00:04:39,930 --> 00:04:42,210
mainly we are speaking
about financial gain

96
00:04:42,210 --> 00:04:47,100
or gain of information or
investing or something like that,

97
00:04:47,100 --> 00:04:51,090
where at in any case is going
to financial gain at the end.

98
00:04:51,090 --> 00:04:54,260
But if we think about
the situation back then,

99
00:04:54,260 --> 00:04:56,340
it was a completely different thing

100
00:04:56,340 --> 00:05:00,960
because there were no financial
motivation behind the virus,

101
00:05:00,960 --> 00:05:03,300
but it was something done more

102
00:05:03,300 --> 00:05:06,330
for a show of technical knowledge, really,

103
00:05:06,330 --> 00:05:09,236
and not doing something
malicious to the user,

104
00:05:09,236 --> 00:05:12,120
but pranking people, maybe?

105
00:05:12,120 --> 00:05:16,050
Or just to show something that is,

106
00:05:16,050 --> 00:05:18,390
I can do it so I can show
you that I can do it,

107
00:05:18,390 --> 00:05:20,703
but I don't want to harm
you or whatever else.

108
00:05:22,080 --> 00:05:26,280
And that's the reason why I
tend to define this more close

109
00:05:26,280 --> 00:05:27,510
to the demo scene back then.

110
00:05:27,510 --> 00:05:32,510
So the demo scene was the
way of showing the skills

111
00:05:32,970 --> 00:05:36,720
of a programmers doing
graphic sounds and so on.

112
00:05:36,720 --> 00:05:40,380
And in some way, viruses
where something like that,

113
00:05:40,380 --> 00:05:41,940
done for showing

114
00:05:41,940 --> 00:05:45,810
the low level technical
expertise, let's say.

115
00:05:45,810 --> 00:05:47,760
And you may think that the lack

116
00:05:47,760 --> 00:05:52,760
of financial gain behind this
may go to some naive code

117
00:05:54,720 --> 00:05:58,440
with few functionalities or
something written very badly,

118
00:05:58,440 --> 00:05:59,273
but it's not the case.

119
00:05:59,273 --> 00:06:01,230
We will see together
that these tiny programs

120
00:06:01,230 --> 00:06:04,750
are really little jewels of programming

121
00:06:07,436 --> 00:06:09,483
and technical skill set.

122
00:06:10,350 --> 00:06:11,970
Let's start from the State of the Art.

123
00:06:11,970 --> 00:06:14,703
So which are the viruses
known for Commodore 64?

124
00:06:15,840 --> 00:06:18,007
This is the list, pretty much complete.

125
00:06:18,007 --> 00:06:20,430
It sounds pretty funny if you look at it

126
00:06:20,430 --> 00:06:23,880
because we count seven entries here,

127
00:06:23,880 --> 00:06:27,243
which is more or less
what we can think it's,

128
00:06:28,230 --> 00:06:32,280
it's happens in a minute of
malware creation nowadays.

129
00:06:32,280 --> 00:06:34,623
So it's really nice to see

130
00:06:34,623 --> 00:06:38,910
that there were so few
weird viruses back then.

131
00:06:38,910 --> 00:06:42,960
And there are great analysis
already done on most of them,

132
00:06:42,960 --> 00:06:46,200
especially for BHP, which is the first one

133
00:06:46,200 --> 00:06:48,870
and considered to be
the first virus created

134
00:06:48,870 --> 00:06:53,870
for Commodore 64 and one of
the first virus ever created.

135
00:06:54,240 --> 00:06:56,700
But there is one which
is not analyzed yet.

136
00:06:56,700 --> 00:06:59,583
It's the BULA virus.

137
00:07:00,450 --> 00:07:04,200
The only thing, it was in
the list we saw before here,

138
00:07:04,200 --> 00:07:05,580
it was the fourth one.

139
00:07:05,580 --> 00:07:08,970
And the only thing that I found around

140
00:07:08,970 --> 00:07:10,470
before starting this kind of analysis

141
00:07:10,470 --> 00:07:14,070
was this little sentence
coming from wiki.com

142
00:07:14,070 --> 00:07:17,490
saying that nothing was
really known about this virus

143
00:07:17,490 --> 00:07:20,820
and there were some things
happening when you run it,

144
00:07:20,820 --> 00:07:23,730
but it was not clear how it
was replicating and so on.

145
00:07:23,730 --> 00:07:25,740
And so I decided to get this one

146
00:07:25,740 --> 00:07:30,240
and in order to try to
get this back to life,

147
00:07:30,240 --> 00:07:35,010
I obviously used some
tools and some things

148
00:07:35,010 --> 00:07:38,850
to having it running again.

149
00:07:38,850 --> 00:07:42,630
And these tools we are
going to list them right now

150
00:07:42,630 --> 00:07:44,880
are something to do static analysis,

151
00:07:44,880 --> 00:07:47,610
which is for example, the tool I use

152
00:07:47,610 --> 00:07:49,560
for static analysis is
Ghidra, a windows tool.

153
00:07:49,560 --> 00:07:51,120
I'm sure that you know it.

154
00:07:51,120 --> 00:07:55,050
With a specific plugin used to
load this Commodore 64 virus.

155
00:07:55,050 --> 00:07:58,770
I did some custom scripting
for analyzing the virus itself

156
00:07:58,770 --> 00:08:03,770
with Java and the
plugins of Ghidra itself.

157
00:08:04,290 --> 00:08:07,230
I also created a 0 1
0 8 or custom template

158
00:08:07,230 --> 00:08:10,500
in order to be able to
analyze the disc images.

159
00:08:10,500 --> 00:08:14,100
B 64 images are the
files representing a disc

160
00:08:14,100 --> 00:08:15,900
in Commodore 64.

161
00:08:15,900 --> 00:08:20,900
Then I did also some
dynamic analysis obviously,

162
00:08:22,525 --> 00:08:25,110
and I use the Vice
Emulator for doing that.

163
00:08:25,110 --> 00:08:26,280
Vice Emulator, it's a Emulator,

164
00:08:26,280 --> 00:08:28,680
which has also a very nice debugger in it.

165
00:08:28,680 --> 00:08:30,900
And then DirMaster 3 1 5,

166
00:08:30,900 --> 00:08:34,350
which is used to manage
the 64 images again.

167
00:08:34,350 --> 00:08:36,000
Couple of screenshots about this.

168
00:08:38,370 --> 00:08:41,370
And this is for example,
the screenshot from Vice,

169
00:08:41,370 --> 00:08:43,650
which is the emulator I
used for dynamic analysis.

170
00:08:43,650 --> 00:08:44,670
As you can see on the bottom,

171
00:08:44,670 --> 00:08:46,950
you see the Commodore 64 screen.

172
00:08:46,950 --> 00:08:48,570
And on the top you see the debugger.

173
00:08:48,570 --> 00:08:51,300
The debugger it's very well done.

174
00:08:51,300 --> 00:08:55,080
It allows you to step into
the code dumping memory,

175
00:08:55,080 --> 00:08:59,190
dumping up codes and there
is also this little window

176
00:08:59,190 --> 00:09:01,289
on top of right showing your register.

177
00:09:01,289 --> 00:09:04,800
And also this window's showing
computer and drive eight.

178
00:09:04,800 --> 00:09:06,660
Remember this because
it'll be very important

179
00:09:06,660 --> 00:09:07,740
for our analysis.

180
00:09:07,740 --> 00:09:10,020
So it looks like we don't have a register

181
00:09:10,020 --> 00:09:12,990
just only on the main CPU.

182
00:09:12,990 --> 00:09:16,950
And that's important to
remember for our analysis here.

183
00:09:16,950 --> 00:09:19,590
Then I use Ghidra, as I said,
this is a well known tool

184
00:09:19,590 --> 00:09:22,063
so it was for static
analysis disassembly code,

185
00:09:22,063 --> 00:09:24,960
it supports the Commodore 64 architecture,

186
00:09:24,960 --> 00:09:27,900
which is based on 6502 CPU.

187
00:09:27,900 --> 00:09:30,450
It also compiled the
code but in this case,

188
00:09:30,450 --> 00:09:32,880
it's not useful to have the
code compiled, to be honest.

189
00:09:32,880 --> 00:09:35,313
So I just look at the whole assembly code.

190
00:09:36,510 --> 00:09:40,710
Then here we have a
custom template I created

191
00:09:40,710 --> 00:09:45,710
for 010 Editor, which allows
me to inspect the content

192
00:09:46,230 --> 00:09:48,750
of a disk of Commodore 64.

193
00:09:48,750 --> 00:09:51,450
I'm going to release this template,

194
00:09:51,450 --> 00:09:53,070
already released it this morning.

195
00:09:53,070 --> 00:09:54,720
And I will give you some more details

196
00:09:54,720 --> 00:09:57,480
at the end of the presentation about it.

197
00:09:57,480 --> 00:10:00,990
Okay, let's now start giving some details

198
00:10:00,990 --> 00:10:05,133
about our specimen, the virus itself.

199
00:10:06,180 --> 00:10:09,540
The virus, from what we
know, exists in two variants,

200
00:10:09,540 --> 00:10:11,160
which are identified by a version,

201
00:10:11,160 --> 00:10:14,910
which is 6.13 and 8.32.

202
00:10:14,910 --> 00:10:17,490
So, major release for that.

203
00:10:17,490 --> 00:10:21,180
And both of them are available
to download, if you want to,

204
00:10:21,180 --> 00:10:23,910
I don't know, have a look to them to tweet

205
00:10:23,910 --> 00:10:26,970
or replicate analysis or
doing something by yourself.

206
00:10:26,970 --> 00:10:30,873
You can download it from CSDB.DK site.

207
00:10:32,970 --> 00:10:35,861
Okay, but before going into
to this we definitely need

208
00:10:35,861 --> 00:10:39,660
to set some common knowledge
on Commodore 64 hardware,

209
00:10:39,660 --> 00:10:40,800
because it's very important,

210
00:10:40,800 --> 00:10:41,777
you will see during the analysis

211
00:10:41,777 --> 00:10:45,450
that a lot of characteristic
of the Commodore 64

212
00:10:45,450 --> 00:10:48,180
will be used in the code
of the virus itself.

213
00:10:48,180 --> 00:10:50,560
And let's start from the main CPU.

214
00:10:50,560 --> 00:10:52,092
The main CPU of the Commodore 64

215
00:10:52,092 --> 00:10:56,850
is the well known 6510 CPU,
which is based on 6502,

216
00:10:56,850 --> 00:11:01,662
which was one of the first very
cheap CPU that were produced

217
00:11:01,662 --> 00:11:04,530
in early eighties.

218
00:11:04,530 --> 00:11:06,810
And probably it's the CPU

219
00:11:06,810 --> 00:11:11,010
that gave the start to the
home computer movement.

220
00:11:11,010 --> 00:11:15,219
It's the CPU on which

221
00:11:15,219 --> 00:11:17,610
most of the home computer
were based back then,

222
00:11:17,610 --> 00:11:21,330
Apple 2, Atari, Commadore
and a lot of others.

223
00:11:21,330 --> 00:11:25,230
So it was a very cheap
CPU doing a lot of things.

224
00:11:25,230 --> 00:11:29,160
In the case of Commodore 64 we
had a clock of one megahertz,

225
00:11:29,160 --> 00:11:34,160
64K of RAM and 58 kilobytes
for basic programs.

226
00:11:35,160 --> 00:11:36,540
Commodore 64 had a characteristic,

227
00:11:36,540 --> 00:11:40,908
a special one, it had also
some additional cheap set

228
00:11:40,908 --> 00:11:43,500
for managing video and sound

229
00:11:43,500 --> 00:11:46,680
and that's why it became very
popular for gaming mainly.

230
00:11:46,680 --> 00:11:49,020
But the main CPU, it's exactly the same

231
00:11:49,020 --> 00:11:52,890
as all the other home
computer at the time.

232
00:11:52,890 --> 00:11:56,700
What is interesting that I
learned doing this research

233
00:11:56,700 --> 00:11:58,140
is that it's still used.

234
00:11:58,140 --> 00:12:02,130
You can actually buy one,
if you want, from this site,

235
00:12:02,130 --> 00:12:03,930
the form factor is a
bit different right now,

236
00:12:03,930 --> 00:12:05,010
as you can see,

237
00:12:05,010 --> 00:12:09,693
but the 6502 and other variants
of CPU are still existing,

238
00:12:10,590 --> 00:12:13,230
are still used as according to the site.

239
00:12:13,230 --> 00:12:15,456
And so that's why I'm saying

240
00:12:15,456 --> 00:12:16,890
you are not wasting your time this morning

241
00:12:16,890 --> 00:12:18,150
looking at this presentation

242
00:12:18,150 --> 00:12:20,460
because you are going to learn
something very interesting,

243
00:12:20,460 --> 00:12:25,460
like basics on 6502 assembly
that we can use maybe,

244
00:12:26,430 --> 00:12:28,290
on your next automotive
project, I don't know,

245
00:12:28,290 --> 00:12:29,943
if you want to use the 6502 CPU.

246
00:12:32,332 --> 00:12:34,620
And okay, let's spend a couple
of words about mass storage.

247
00:12:34,620 --> 00:12:37,260
You see that picture
of Commodore 64 before,

248
00:12:37,260 --> 00:12:41,970
which was that keyboard
with some ports on that.

249
00:12:41,970 --> 00:12:46,440
It doesn't any kind of mass storage in it.

250
00:12:46,440 --> 00:12:47,730
So the mass storage, back then,

251
00:12:47,730 --> 00:12:49,620
was done with in two ways mainly,

252
00:12:49,620 --> 00:12:52,892
the cheap one was a tape player,

253
00:12:52,892 --> 00:12:56,700
which is awful, slow, unreliable.

254
00:12:56,700 --> 00:13:00,000
It was really probably one of
the worst piece of hardware

255
00:13:00,000 --> 00:13:03,750
ever created in human history. (chuckles)

256
00:13:03,750 --> 00:13:04,583
Really it was.

257
00:13:04,583 --> 00:13:07,083
I remember it as unusable mostly,

258
00:13:08,370 --> 00:13:09,840
and it was a cheap solution.

259
00:13:09,840 --> 00:13:12,750
So that's what I bought
for the first time.

260
00:13:12,750 --> 00:13:14,850
And then when you start
to save some money,

261
00:13:14,850 --> 00:13:17,310
you can buy another piece of hardware,

262
00:13:17,310 --> 00:13:18,210
which is a bit better.

263
00:13:18,210 --> 00:13:21,660
It's not really a great hardware as well,

264
00:13:21,660 --> 00:13:25,860
but it's a lot better than the
tape, which was a disc drive,

265
00:13:25,860 --> 00:13:29,100
reading the floppy disc, the
five inches floppy disk cube.

266
00:13:29,100 --> 00:13:31,530
I don't know if you ever
saw it, the black one,

267
00:13:31,530 --> 00:13:32,363
the floppy one?

268
00:13:32,363 --> 00:13:33,540
Exactly.

269
00:13:33,540 --> 00:13:37,860
And why I'm mentioning this hardware

270
00:13:37,860 --> 00:13:42,860
because it's a little less
known that the 1541 disc drive

271
00:13:45,600 --> 00:13:50,600
had exactly another 6502
CPU in it, running code,

272
00:13:52,620 --> 00:13:54,570
having some memories,
having some register,

273
00:13:54,570 --> 00:13:58,260
this is why I told you to have
a look to the register window

274
00:13:58,260 --> 00:14:01,980
before on the emulator debugger window,

275
00:14:01,980 --> 00:14:06,060
because actually you
really have another CPU

276
00:14:06,060 --> 00:14:08,430
equal to the one installed
on the main board.

277
00:14:08,430 --> 00:14:10,440
That means that you, in some way,

278
00:14:10,440 --> 00:14:14,040
had a multi processor
system back then in 1982.

279
00:14:14,040 --> 00:14:17,100
Because the two CPU can actually
communicate between them

280
00:14:17,100 --> 00:14:19,350
and they can transfer code between them

281
00:14:19,350 --> 00:14:21,030
and execute code at the same time.

282
00:14:21,030 --> 00:14:24,990
So it was pretty surprising to
understand that you actually

283
00:14:24,990 --> 00:14:28,227
had a multiprocessor
system with the main CPU

284
00:14:28,227 --> 00:14:29,973
and the one running of the drive.

285
00:14:30,900 --> 00:14:32,520
You can also offload some works

286
00:14:32,520 --> 00:14:34,473
on the CPU of the drive itself.

287
00:14:35,400 --> 00:14:37,560
It was not so easy because the connection

288
00:14:37,560 --> 00:14:41,550
between the two system was
done through a serial bus,

289
00:14:41,550 --> 00:14:44,910
so it was slow but it was actually usable

290
00:14:44,910 --> 00:14:49,910
and it was used also by
legit software, let's say,

291
00:14:50,040 --> 00:14:52,713
like Turbo Loader, which
were program to load things.

292
00:14:54,318 --> 00:14:55,151
And guess what?

293
00:14:55,151 --> 00:14:57,240
Yes, this can be abused
by viruses as well.

294
00:14:57,240 --> 00:14:59,730
And this is actually what the
BULA virus is going to do.

295
00:14:59,730 --> 00:15:02,520
And we will see how in a while,

296
00:15:02,520 --> 00:15:04,560
but before going into the details,

297
00:15:04,560 --> 00:15:09,390
I promised you a crash
course of 6502 assembly

298
00:15:09,390 --> 00:15:12,212
and so we will go very, very briefly.

299
00:15:12,212 --> 00:15:13,045
It's a crash course of two slides,

300
00:15:13,045 --> 00:15:14,403
so don't be afraid about it.

301
00:15:16,440 --> 00:15:19,920
Let's have a look on
how it actually works.

302
00:15:19,920 --> 00:15:22,500
So we have a few register in the CPU,

303
00:15:22,500 --> 00:15:25,770
a lot less than what we expect
from current architectures,

304
00:15:25,770 --> 00:15:28,170
like the intel one, let's say,
where we have a lot of them.

305
00:15:28,170 --> 00:15:30,240
And we have, basically, a program counter,

306
00:15:30,240 --> 00:15:31,890
which is more or less the same

307
00:15:31,890 --> 00:15:35,520
as the instruction EP of
the entire architecture

308
00:15:35,520 --> 00:15:37,230
and it's pointing to
the current instruction

309
00:15:37,230 --> 00:15:39,660
of the processor.

310
00:15:39,660 --> 00:15:42,210
And then three general parts of register.

311
00:15:42,210 --> 00:15:45,540
One is the A, which is
stands for accumulator

312
00:15:45,540 --> 00:15:47,430
and you can store values in it.

313
00:15:47,430 --> 00:15:49,830
And then X and Y, which
are indexing register,

314
00:15:49,830 --> 00:15:52,560
so these are three
general purpose register

315
00:15:52,560 --> 00:15:55,140
you can use in your
programs and that's all.

316
00:15:55,140 --> 00:15:56,460
You know what you have.

317
00:15:56,460 --> 00:15:58,770
You have also a Stack Pointer,

318
00:15:58,770 --> 00:16:01,410
pointing to a fixed set of memory region

319
00:16:01,410 --> 00:16:04,767
going from 0100 to 01FF.

320
00:16:04,767 --> 00:16:06,030
And then a flex status,

321
00:16:06,030 --> 00:16:10,350
which holds the results of
comparisons, carry and so on.

322
00:16:10,350 --> 00:16:13,290
So very basic structure, very simple one,

323
00:16:13,290 --> 00:16:16,190
but you can see that you can
do a lot of things with this.

324
00:16:17,040 --> 00:16:18,510
I'm adding also this slide here

325
00:16:18,510 --> 00:16:20,490
regarding the registers 00 and 01

326
00:16:20,490 --> 00:16:22,500
which are reported by device simulator,

327
00:16:22,500 --> 00:16:25,590
because these are out of our scope today.

328
00:16:25,590 --> 00:16:27,690
They are registered for
the sound interface device,

329
00:16:27,690 --> 00:16:30,430
which was one of the
chip I mentioned before

330
00:16:31,975 --> 00:16:32,850
are used for doing sounds,

331
00:16:32,850 --> 00:16:35,850
but we don't need them
in our analysis today

332
00:16:35,850 --> 00:16:38,433
just reporting for completeness.

333
00:16:39,510 --> 00:16:42,900
So, very basic crash
course about assembly.

334
00:16:42,900 --> 00:16:45,300
So we can basically do some
things with the register.

335
00:16:45,300 --> 00:16:47,340
We can store values there

336
00:16:47,340 --> 00:16:49,920
and load values from
the register themselves.

337
00:16:49,920 --> 00:16:51,600
So the instruction are pretty simple,

338
00:16:51,600 --> 00:16:55,770
It's a very, very simple
instruction set on the 6502,

339
00:16:55,770 --> 00:16:58,800
and you have LDA to load the
value in the accumulator.

340
00:16:58,800 --> 00:17:00,000
So you can put the value there.

341
00:17:00,000 --> 00:17:03,340
You can put an immediate value
by putting a dash before it

342
00:17:05,639 --> 00:17:08,490
or you can reference a memory address

343
00:17:08,490 --> 00:17:10,770
and on the opposite way you can also store

344
00:17:10,770 --> 00:17:12,540
the value that is in the
accumulator into memory.

345
00:17:12,540 --> 00:17:14,130
So you have LDA and SDA.

346
00:17:14,130 --> 00:17:19,130
At the same time, you have
LDX, STX and STY and LDY

347
00:17:20,451 --> 00:17:24,030
for the same operation
with other two registers.

348
00:17:24,030 --> 00:17:28,860
It's like the move operation
in internal assembly.

349
00:17:28,860 --> 00:17:31,260
Then we have another instruction,

350
00:17:31,260 --> 00:17:34,141
which it interesting for
us, which is the JSR,

351
00:17:34,141 --> 00:17:36,240
which is basically the same as the call

352
00:17:36,240 --> 00:17:38,640
in the entire architecture with closed

353
00:17:38,640 --> 00:17:40,020
usually by an RTS instruction,

354
00:17:40,020 --> 00:17:42,180
which is returning to
the calling function.

355
00:17:42,180 --> 00:17:45,330
And then obviously we have also
some branching instruction.

356
00:17:45,330 --> 00:17:48,841
So you can jump around basically

357
00:17:48,841 --> 00:17:51,800
on the results of several
operation and so on.

358
00:17:51,800 --> 00:17:53,640
So you have this set of instruction here,

359
00:17:53,640 --> 00:17:56,013
BPL, BMI, BVC and so on.

360
00:17:58,140 --> 00:18:00,990
Couple of slides, then we can
jump into the virus itself.

361
00:18:00,990 --> 00:18:04,110
So Kernal, that strange word,

362
00:18:04,110 --> 00:18:06,603
it's coming from Commodore 64 era.

363
00:18:07,710 --> 00:18:09,310
What is Kernal?

364
00:18:09,310 --> 00:18:12,540
It's sounds like it has been
misspelled and actually it was.

365
00:18:12,540 --> 00:18:16,500
It's something like, probably
it was meant to be Kernel

366
00:18:16,500 --> 00:18:20,010
with the E not the A, and
this is the Commodore 64

367
00:18:20,010 --> 00:18:21,840
ROM Resident Operating System Call.

368
00:18:21,840 --> 00:18:26,840
So you can call some routings
doing basic operation

369
00:18:27,390 --> 00:18:29,730
by calling a specific memory address.

370
00:18:29,730 --> 00:18:33,041
Compared to the "modem",
I put some quotes here,

371
00:18:33,041 --> 00:18:37,320
in PC world it's something like
the BIOS OS routing we have

372
00:18:37,320 --> 00:18:39,270
in current PC models.

373
00:18:39,270 --> 00:18:41,910
So we have this way to call basic

374
00:18:41,910 --> 00:18:46,320
and low-level Kernal codes
and then we have another way

375
00:18:46,320 --> 00:18:49,290
of calling more higher level routings,

376
00:18:49,290 --> 00:18:53,670
which are the basic one, which
are stored from A000 to BFFF.

377
00:18:53,670 --> 00:18:58,670
And this memory area holds the
code for the basic operation.

378
00:19:00,000 --> 00:19:02,460
So let's say if you want,
I want to do a print,

379
00:19:02,460 --> 00:19:04,950
the code of the print
it stored in this area

380
00:19:04,950 --> 00:19:07,800
and I call it directly by
calling the memory area

381
00:19:07,800 --> 00:19:10,290
instead of writing print
in my basic program.

382
00:19:10,290 --> 00:19:14,130
And that's a way of doing
things in Commodore 64.

383
00:19:14,130 --> 00:19:16,470
But let's start now with our analysis.

384
00:19:16,470 --> 00:19:19,210
So the BULA virus, which we saw before

385
00:19:20,631 --> 00:19:23,580
that it's one of the few viruses remained,

386
00:19:23,580 --> 00:19:24,980
which were not analyzed yet.

387
00:19:27,210 --> 00:19:29,670
Okay, we need to obviously
start it in some way.

388
00:19:29,670 --> 00:19:32,910
Remember, I said before
the virus never dies.

389
00:19:32,910 --> 00:19:35,760
So it's just a matter of giving
him the right environment

390
00:19:35,760 --> 00:19:39,600
and it starts again, and the
right environment in our case

391
00:19:39,600 --> 00:19:42,030
is the emulator obviously.

392
00:19:42,030 --> 00:19:45,180
And this is what happened
when you start the virus,

393
00:19:45,180 --> 00:19:46,740
something strange, actually.

394
00:19:46,740 --> 00:19:49,890
So you see this flashing screen here

395
00:19:49,890 --> 00:19:52,650
and some gibberish
printed out on the screen

396
00:19:52,650 --> 00:19:53,900
and then nothing happens.

397
00:19:55,874 --> 00:19:59,323
So, looks like really nothing
has been done to the user,

398
00:20:01,140 --> 00:20:05,160
but what happened behind
the scene in this case?

399
00:20:05,160 --> 00:20:07,650
So let's start with some code snippet.

400
00:20:07,650 --> 00:20:11,130
This is written really tiny
here, but no, don't worry

401
00:20:11,130 --> 00:20:13,200
I will go into details now.

402
00:20:13,200 --> 00:20:15,120
So we'll see with more details.

403
00:20:15,120 --> 00:20:17,460
So what happens doing these commands

404
00:20:17,460 --> 00:20:20,563
or running the program
virus is that a serial bus

405
00:20:22,170 --> 00:20:23,580
was open on the device.

406
00:20:23,580 --> 00:20:25,860
So remember that I spoke
that the two processor

407
00:20:25,860 --> 00:20:28,920
between the main CPU and
the one on the disk drive

408
00:20:28,920 --> 00:20:30,900
communicate between a serial bus.

409
00:20:30,900 --> 00:20:32,880
So this serial bus has been opened.

410
00:20:32,880 --> 00:20:34,980
There was an execution of a command.

411
00:20:34,980 --> 00:20:36,480
Then there was this flashing screen

412
00:20:36,480 --> 00:20:38,310
and then the bus has been closed.

413
00:20:38,310 --> 00:20:40,470
So let's see what really happened here.

414
00:20:40,470 --> 00:20:43,530
These are the set of instruction,
opening the serial bus.

415
00:20:43,530 --> 00:20:44,363
As you can see,

416
00:20:44,363 --> 00:20:47,550
there are a JSR and a jump
instruction point to the Kernal.

417
00:20:47,550 --> 00:20:51,420
Remember the addresses beginning with FF?

418
00:20:51,420 --> 00:20:55,800
So these JMP and JSR are
pointing to two Kernal codes,

419
00:20:55,800 --> 00:20:59,190
which are the codes actually
used to open the bus,

420
00:20:59,190 --> 00:21:04,190
the serial bus, to communicate
with the CPU of this 1541.

421
00:21:05,700 --> 00:21:07,920
And then there's the
execution of a command..

422
00:21:07,920 --> 00:21:08,753
The execution of command

423
00:21:08,753 --> 00:21:12,630
is simply sending a couple of characters,

424
00:21:12,630 --> 00:21:15,090
three characters in this case, M - W,

425
00:21:15,090 --> 00:21:17,100
which stands for memory of write

426
00:21:17,100 --> 00:21:20,301
and sending this command,
this aske character

427
00:21:20,301 --> 00:21:22,380
or petask in this case,

428
00:21:22,380 --> 00:21:26,823
because Commodore 64 had custom ask codes.

429
00:21:27,960 --> 00:21:31,890
Sending this in some codes,
what happened is that,

430
00:21:31,890 --> 00:21:34,200
some codes from the
main CPU is transferred

431
00:21:34,200 --> 00:21:38,190
to the memory of the
disc drive in this case.

432
00:21:38,190 --> 00:21:42,240
So what the virus is doing
right now is just getting

433
00:21:42,240 --> 00:21:46,500
hit code and transferring
it on the CPU drive.

434
00:21:46,500 --> 00:21:47,333
Yep.

435
00:21:48,270 --> 00:21:50,190
Then there was this flashing
screen and the closing,

436
00:21:50,190 --> 00:21:52,350
why the flashing screen?

437
00:21:52,350 --> 00:21:55,680
Back then IO operations were really slow

438
00:21:55,680 --> 00:21:58,500
and you were sometimes
really looking at the screen,

439
00:21:58,500 --> 00:22:01,710
trying to understand if
something was happening or not.

440
00:22:01,710 --> 00:22:04,020
And the flashing screen
was a way, a trick,

441
00:22:04,020 --> 00:22:06,390
used to let the user know
that something was happening

442
00:22:06,390 --> 00:22:07,620
during the IO operation.

443
00:22:07,620 --> 00:22:11,760
So that's why it has been
added probably in this case.

444
00:22:11,760 --> 00:22:14,580
So just to let the user know
that something was happening.

445
00:22:14,580 --> 00:22:18,330
And then, okay, the serial
bus had just closed.

446
00:22:18,330 --> 00:22:19,560
So at this point,

447
00:22:19,560 --> 00:22:21,690
what has been done is that the virus code

448
00:22:21,690 --> 00:22:25,410
has been transferred on
the CPU of the floppy,

449
00:22:25,410 --> 00:22:29,283
but nothing else, so the code
has not been executed yet.

450
00:22:30,120 --> 00:22:31,710
Why has this has been done?

451
00:22:31,710 --> 00:22:34,680
For two reason maybe, because
in this way it's dirtier

452
00:22:34,680 --> 00:22:37,560
obviously because the device
doesn't reside anymore

453
00:22:37,560 --> 00:22:42,560
on the main memory and it's
more persistent right now

454
00:22:43,950 --> 00:22:47,850
because even if power off
or reset the Commodore 64,

455
00:22:47,850 --> 00:22:50,430
actually, until you
don't power of the drive,

456
00:22:50,430 --> 00:22:54,120
the virus still resides there
and it's not going away.

457
00:22:54,120 --> 00:22:59,120
So that's a neat way to gain
persistent on the code itself.

458
00:23:01,800 --> 00:23:03,450
Yep.

459
00:23:03,450 --> 00:23:06,690
And so now the virus it's
on this drive memory.

460
00:23:06,690 --> 00:23:08,670
Okay, It's time to
execute it, to execute it,

461
00:23:08,670 --> 00:23:10,710
It's just a matter of
sending another command,

462
00:23:10,710 --> 00:23:14,250
like the M-W we saw before,
the command it's U3,

463
00:23:14,250 --> 00:23:18,420
it's another command coming
from the realm of the 1541.

464
00:23:19,563 --> 00:23:24,563
Which it just start codes at
the very specific address,

465
00:23:25,170 --> 00:23:27,360
which is 0500 on the disk drive.

466
00:23:27,360 --> 00:23:29,880
Since the set of
instruction, we said before,

467
00:23:29,880 --> 00:23:33,510
was transferring code to
that address, the U3 command

468
00:23:33,510 --> 00:23:36,150
is just executing code residing there.

469
00:23:36,150 --> 00:23:38,580
So what happens here, again, snippets

470
00:23:38,580 --> 00:23:40,800
and we are going into the details,

471
00:23:40,800 --> 00:23:43,140
is that the serial bus is open again.

472
00:23:43,140 --> 00:23:45,900
There is a U3 command
sent on the serial bus,

473
00:23:45,900 --> 00:23:48,150
and that means that the code starts.

474
00:23:48,150 --> 00:23:52,080
So the virus itself is
starting on this drive memory.

475
00:23:52,080 --> 00:23:57,080
There was a set of commands
U3 from U9 executing code

476
00:23:57,698 --> 00:24:01,350
at different addresses from 0500 to FF01.

477
00:24:01,350 --> 00:24:02,910
Just was a matter of what you want to do

478
00:24:02,910 --> 00:24:06,150
and execute in this case.

479
00:24:06,150 --> 00:24:09,060
And what happens meanwhile on the 1541?

480
00:24:09,060 --> 00:24:13,630
Obviously, there is some
code landing at 0500,

481
00:24:13,630 --> 00:24:16,710
where you have the code
waiting for something.

482
00:24:16,710 --> 00:24:20,040
And there is just this tiny loop here,

483
00:24:20,040 --> 00:24:21,630
which is just waiting for something,

484
00:24:21,630 --> 00:24:25,200
it's waiting for an attention
signal to be coming low

485
00:24:25,200 --> 00:24:27,780
and that means that it's
waiting for disc activity.

486
00:24:27,780 --> 00:24:31,857
So the virus has transferred
the code on the drive,

487
00:24:31,857 --> 00:24:34,720
and it's just waiting
for something to happen.

488
00:24:34,720 --> 00:24:38,220
If the user access the file or save a file

489
00:24:38,220 --> 00:24:40,233
or open one or whatever.

490
00:24:42,450 --> 00:24:45,630
Again, we need to set some other knowledge

491
00:24:45,630 --> 00:24:48,660
about the 1541 disk drive
structure and layout

492
00:24:48,660 --> 00:24:49,493
before going ahead

493
00:24:49,493 --> 00:24:53,795
so that you will get the
entire virus life cycle.

494
00:24:53,795 --> 00:24:58,050
Okay, disks were split in
tracks as today more or less.

495
00:24:58,050 --> 00:25:00,480
So no difference in with this.

496
00:25:00,480 --> 00:25:04,770
Floppy disks had 35 tracks in them

497
00:25:04,770 --> 00:25:07,230
with different number of
sectors for each track,

498
00:25:07,230 --> 00:25:09,884
obviously the smaller
tracks are the internal one

499
00:25:09,884 --> 00:25:13,380
where they're smaller and
so they had fewer sectors

500
00:25:13,380 --> 00:25:18,033
than the external one with
fewer storage capacity option.

501
00:25:20,250 --> 00:25:21,460
One interesting track is track 18.

502
00:25:21,460 --> 00:25:23,791
Track 18, it's a special track,

503
00:25:23,791 --> 00:25:28,710
a special track in the 1541
because it holds the information

504
00:25:28,710 --> 00:25:30,840
about the disc and which
files are on the disc.

505
00:25:30,840 --> 00:25:35,070
So it's the track holding the directory.

506
00:25:35,070 --> 00:25:38,400
It's like the MFT in Bitmap
in NTFS more or less.

507
00:25:38,400 --> 00:25:41,223
So holding all the
information about the disc.

508
00:25:42,840 --> 00:25:47,840
And the special track 18, which
is also 12 in (indistinct)

509
00:25:48,127 --> 00:25:50,733
has a special structure as well,

510
00:25:52,200 --> 00:25:55,440
sectors one to 18 of the directory track

511
00:25:55,440 --> 00:25:57,630
contain the directory entries.

512
00:25:57,630 --> 00:25:59,880
So all the files stored on the discs

513
00:25:59,880 --> 00:26:04,410
are listed in these sectors
and the real special sector,

514
00:26:04,410 --> 00:26:08,190
the sector zero, the very
first one, which is the BAM,

515
00:26:08,190 --> 00:26:10,740
Block Availability Map,
which holds the information

516
00:26:10,740 --> 00:26:15,570
about the free and used
blocks on the disc itself.

517
00:26:15,570 --> 00:26:17,520
Which is very important
because we will see the devices

518
00:26:17,520 --> 00:26:19,203
will use this information.

519
00:26:20,460 --> 00:26:23,800
This is the structure of
these sectors here, the BAM.

520
00:26:23,800 --> 00:26:26,250
Okay, you see the first two
bytes which are holding,

521
00:26:26,250 --> 00:26:30,270
okay, some data that we are
not interested in right now.

522
00:26:30,270 --> 00:26:33,570
So some generic data, but
what is interesting for us,

523
00:26:33,570 --> 00:26:35,970
it's the byte four,

524
00:26:35,970 --> 00:26:40,080
which holds the number of
free sectors of track one.

525
00:26:40,080 --> 00:26:45,080
And then the subsequent three
bytes holding the Bitmap

526
00:26:46,170 --> 00:26:48,990
of free sectors on the first track.

527
00:26:48,990 --> 00:26:50,970
And then these structure
is repeated again and again

528
00:26:50,970 --> 00:26:52,740
and again for all the tracks of the disk.

529
00:26:52,740 --> 00:26:55,110
So you have at byte eight,

530
00:26:55,110 --> 00:26:57,210
the number of free tracks for sector two,

531
00:26:57,210 --> 00:26:58,590
and then the Bitmap of sector two,

532
00:26:58,590 --> 00:27:01,290
the Bitmap is just a set of one or zero

533
00:27:01,290 --> 00:27:03,873
saying which blocks are
used and which aren't.

534
00:27:05,940 --> 00:27:07,423
Then all the other sections,

535
00:27:07,423 --> 00:27:10,560
and this is for the
sector zero of track 18.

536
00:27:10,560 --> 00:27:13,020
Then you have sectors one to 18.

537
00:27:13,020 --> 00:27:16,803
Sectors one to 18 are holding the files.

538
00:27:18,090 --> 00:27:21,450
There is this kind of structure
repeated for each file

539
00:27:21,450 --> 00:27:24,090
and with this specific structure here.

540
00:27:24,090 --> 00:27:25,350
You see that the first two bytes

541
00:27:25,350 --> 00:27:28,587
are pointed to the next one,
so when the two first two bytes

542
00:27:28,587 --> 00:27:31,290
are zero this means that
this is the last file used

543
00:27:31,290 --> 00:27:32,850
by the disc itself.

544
00:27:32,850 --> 00:27:35,580
Then you have very
important for our analysis,

545
00:27:35,580 --> 00:27:38,400
It's the byte starting
from 02, so the third byte

546
00:27:38,400 --> 00:27:41,190
and the fourth and fifth byte,

547
00:27:41,190 --> 00:27:45,300
because they are holding the
file type, which could be PRG,

548
00:27:45,300 --> 00:27:50,220
SEQ, REL or USL and the
track and sector number

549
00:27:50,220 --> 00:27:52,530
of the first block of the file.

550
00:27:52,530 --> 00:27:54,480
Remember this, because we will see

551
00:27:54,480 --> 00:27:57,390
that it'll be used by BAUL itself.

552
00:27:57,390 --> 00:27:58,740
Then there are some other information,

553
00:27:58,740 --> 00:28:01,233
like obviously the file
name, file size, and so on.

554
00:28:01,233 --> 00:28:04,260
This structure is repeated
for every single file

555
00:28:04,260 --> 00:28:08,373
into the Commodore 64
of the list of files.

556
00:28:10,147 --> 00:28:12,360
I told you that there
are different file types

557
00:28:12,360 --> 00:28:16,350
in Commodore 64, these are the known ones,

558
00:28:16,350 --> 00:28:19,260
PRG, SEQ, REL, USR, and DEL.

559
00:28:19,260 --> 00:28:21,090
PRG is what is interesting for us.

560
00:28:21,090 --> 00:28:23,730
PRG is the executable files.

561
00:28:23,730 --> 00:28:26,850
It's like the executable in the modern PC.

562
00:28:26,850 --> 00:28:30,450
So it's it all code that
can be loaded into memory.

563
00:28:30,450 --> 00:28:35,450
And the first two bytes of the
file itself are the address

564
00:28:36,000 --> 00:28:39,123
where the program itself
is, must be loaded.

565
00:28:40,950 --> 00:28:44,340
This is what it actually executes code.

566
00:28:44,340 --> 00:28:46,170
Then we have also other type of files,

567
00:28:46,170 --> 00:28:48,000
which are less interesting
for our analysis,

568
00:28:48,000 --> 00:28:50,463
but let's just have a quick look to them.

569
00:28:51,570 --> 00:28:55,500
We have sequential, which
are just byte streams,

570
00:28:55,500 --> 00:28:57,630
Yeah, sorry.

571
00:28:57,630 --> 00:29:02,630
A way to access files
without a random positioning.

572
00:29:03,760 --> 00:29:06,900
A REL one, which is a
similar way to access files,

573
00:29:06,900 --> 00:29:11,670
but with actually the possibility
to position the pointer

574
00:29:11,670 --> 00:29:12,930
in the file itself.

575
00:29:12,930 --> 00:29:15,510
Then USR, which is a user defined one,

576
00:29:15,510 --> 00:29:19,410
and that one is undocumented one.

577
00:29:19,410 --> 00:29:23,580
Commodore 64 also had a
basic integrity file system

578
00:29:23,580 --> 00:29:26,790
and so you had to close the
file before removing the disc.

579
00:29:26,790 --> 00:29:29,370
And you had also the
possibility to have a star

580
00:29:29,370 --> 00:29:31,830
before the type of the file,

581
00:29:31,830 --> 00:29:34,383
if the file has not been
closed in the proper way.

582
00:29:35,460 --> 00:29:36,870
Now, okay, we set this knowledge.

583
00:29:36,870 --> 00:29:39,870
We know now which are
the information we need

584
00:29:39,870 --> 00:29:44,038
to understand what happens now,

585
00:29:44,038 --> 00:29:48,750
and let's start to see what
happens when the program

586
00:29:48,750 --> 00:29:52,003
starts to infect the program itself.

587
00:29:52,003 --> 00:29:54,990
So we left the program
waiting for this activity.

588
00:29:54,990 --> 00:29:55,823
We remember.

589
00:29:56,700 --> 00:29:59,303
When this activity is recognized, okay,

590
00:29:59,303 --> 00:30:01,200
there is a start of a specific function,

591
00:30:01,200 --> 00:30:05,400
which is the 6-0-0, 600.

592
00:30:05,400 --> 00:30:10,400
This function in which
is residing on the 1541,

593
00:30:10,834 --> 00:30:12,663
does a very specific thing,

594
00:30:14,310 --> 00:30:19,310
it starts to find the first
free block on track 18,

595
00:30:19,770 --> 00:30:22,950
so on track 12 in exceldecal.

596
00:30:22,950 --> 00:30:25,320
So that means the virus is not trying

597
00:30:25,320 --> 00:30:27,330
to store itself in a file,

598
00:30:27,330 --> 00:30:30,450
It's trying to store itself
in the directory structure,

599
00:30:30,450 --> 00:30:33,060
which is something that should not be done

600
00:30:33,060 --> 00:30:37,764
because the directory structure
just holds file informations

601
00:30:37,764 --> 00:30:38,760
not the file itself.

602
00:30:38,760 --> 00:30:41,100
And so it starts counting
from the very end

603
00:30:41,100 --> 00:30:46,100
of the track itself and try
to find free blocks there.

604
00:30:48,450 --> 00:30:52,590
Okay, this is just the
way of doing that looping

605
00:30:52,590 --> 00:30:54,420
from in the BAM.

606
00:30:54,420 --> 00:30:58,770
So it loads the BAM, you
see the block zero here

607
00:30:58,770 --> 00:31:01,650
and then starts looping and
looking for free sectors

608
00:31:01,650 --> 00:31:03,000
at the end of the file.

609
00:31:03,000 --> 00:31:05,370
Why it starts from the
end of the track 18?

610
00:31:05,370 --> 00:31:08,280
Because it's more likely
to have them free.

611
00:31:08,280 --> 00:31:09,425
Commodore 64, these were not known

612
00:31:09,425 --> 00:31:12,810
to hold hundreds of files.

613
00:31:12,810 --> 00:31:16,380
Probably most of them had,
I dunno, 10, 20 files.

614
00:31:16,380 --> 00:31:20,460
And so usually the last
three blocks of the tracking

615
00:31:20,460 --> 00:31:22,320
were actually not used at all

616
00:31:22,320 --> 00:31:24,390
and so it's very likely to have them free.

617
00:31:24,390 --> 00:31:26,820
And so the device is trying just to check

618
00:31:26,820 --> 00:31:30,180
if these three blocks are free, actually.

619
00:31:30,180 --> 00:31:35,040
And if not, it's just try to
move it and look for the one

620
00:31:35,040 --> 00:31:37,500
going through the beginning of the file.

621
00:31:37,500 --> 00:31:39,960
And it does it through this loop here,

622
00:31:39,960 --> 00:31:42,270
when it detects three sectors, why three?

623
00:31:42,270 --> 00:31:45,029
Because the code of the virus itself,

624
00:31:45,029 --> 00:31:47,610
it has been all in three sectors.

625
00:31:47,610 --> 00:31:50,010
It marked them as used into the Bitmap.

626
00:31:50,010 --> 00:31:53,250
So it does not write the code again still,

627
00:31:53,250 --> 00:31:56,373
but it just marked the sector as used.

628
00:31:58,110 --> 00:32:03,110
Okay, now the virus itself
just found a way to,

629
00:32:05,224 --> 00:32:07,200
It can store its code on the disc,

630
00:32:07,200 --> 00:32:10,740
but it's not sure yet
if it can be re executed

631
00:32:10,740 --> 00:32:14,700
because actually the virus
itself wants to be executed

632
00:32:14,700 --> 00:32:17,380
in order to infect another
system, another disc

633
00:32:18,570 --> 00:32:23,430
and so its starts another
loop looking for a PRG file.

634
00:32:23,430 --> 00:32:26,280
We said before the PRG files
were the executable one.

635
00:32:26,280 --> 00:32:31,020
And so it starts a loop to
look for this kind of file.

636
00:32:31,020 --> 00:32:35,130
You can see here that it
loads the first sector

637
00:32:35,130 --> 00:32:37,260
and then tries to compare.

638
00:32:37,260 --> 00:32:39,210
For example, you see that it's comparing

639
00:32:39,210 --> 00:32:43,530
at the very end of the, I
dunno if I can point it.

640
00:32:43,530 --> 00:32:47,040
Yeah, there it compare the file type

641
00:32:47,040 --> 00:32:49,020
and it looks for the PRG one.

642
00:32:49,020 --> 00:32:53,190
When it found it, it start
the real infection phase.

643
00:32:53,190 --> 00:32:54,660
Until then it doesn't.

644
00:32:54,660 --> 00:32:58,770
So what happens is that,
okay, I found a PRG file there

645
00:32:58,770 --> 00:33:02,613
and so I want to start infection process.

646
00:33:03,510 --> 00:33:05,100
What does the infection process?

647
00:33:05,100 --> 00:33:09,540
It just get the very first
pointer of the program

648
00:33:09,540 --> 00:33:13,110
of the PRG file and it makes
it pointing to the track 18.

649
00:33:13,110 --> 00:33:16,770
So usually probably the pointer
of the file is just pointing

650
00:33:16,770 --> 00:33:18,450
to another track not to track 18

651
00:33:18,450 --> 00:33:22,470
because targeting is not
mean to be holding some codes

652
00:33:22,470 --> 00:33:25,270
and so it's just moved this
pointer to the track itself.

653
00:33:26,250 --> 00:33:31,250
And in this way, it just
basically try to be Re-executed

654
00:33:33,330 --> 00:33:36,453
when the user just load the file.

655
00:33:38,820 --> 00:33:39,990
There is an additional check.

656
00:33:39,990 --> 00:33:43,980
So the virus will also check
if the file's already infected.

657
00:33:43,980 --> 00:33:48,450
So if it find that the PRG
file is pointing already

658
00:33:48,450 --> 00:33:51,090
to track 18, which is basically impossible

659
00:33:51,090 --> 00:33:54,120
in a normal situation,
it just keep the file.

660
00:33:54,120 --> 00:33:56,280
And it says, okay, probably
it's already infected.

661
00:33:56,280 --> 00:33:59,190
So you can see that there
are also error checkings,

662
00:33:59,190 --> 00:34:01,950
and so nothing is left to random things.

663
00:34:07,388 --> 00:34:12,388
And so it's really something
that is well done in this case.

664
00:34:12,750 --> 00:34:14,853
So it's now time to infect the file.

665
00:34:18,000 --> 00:34:21,360
The virus itself, it's just
getting the track number

666
00:34:21,360 --> 00:34:22,800
for the file itself.

667
00:34:22,800 --> 00:34:25,410
It's replacing track and
sector number obviously.

668
00:34:25,410 --> 00:34:29,190
It replaced the values
with the track and sector.

669
00:34:29,190 --> 00:34:30,720
Track will be 18 for sure.

670
00:34:30,720 --> 00:34:33,750
Sector will be the sector where
it saves the three blocks.

671
00:34:33,750 --> 00:34:37,500
it replace them so that the
PRG file will point to that.

672
00:34:37,500 --> 00:34:41,356
And then it also makes the very last block

673
00:34:41,356 --> 00:34:45,900
of the virus itself pointing
back again to the PRG files,

674
00:34:45,900 --> 00:34:50,490
so that the execution of the PRG is kept

675
00:34:50,490 --> 00:34:53,700
and the user maybe does not realize

676
00:34:53,700 --> 00:34:55,080
that there was an infection.

677
00:34:55,080 --> 00:34:57,930
This is not really working every time,

678
00:34:57,930 --> 00:34:59,850
but it actually worked.

679
00:34:59,850 --> 00:35:04,260
So let's look up what actually
the infection process is.

680
00:35:04,260 --> 00:35:06,980
So we had, as you remember...

681
00:35:08,250 --> 00:35:10,080
On this activity,

682
00:35:10,080 --> 00:35:14,100
the loop waiting for on
this activity then okay.

683
00:35:14,100 --> 00:35:16,080
When there is a disc activity,

684
00:35:16,080 --> 00:35:19,290
track 18 has three free blocks, yes?

685
00:35:19,290 --> 00:35:21,390
If yes, it starts infection process.

686
00:35:21,390 --> 00:35:22,923
If not, just exit.

687
00:35:25,470 --> 00:35:29,850
Then if the three blocks are
free and a PRG file is found,

688
00:35:29,850 --> 00:35:31,770
it starts the infection process.

689
00:35:31,770 --> 00:35:36,360
If the PRG file is not found,
it does something like,

690
00:35:36,360 --> 00:35:38,370
let's say plan B,

691
00:35:38,370 --> 00:35:40,920
it just turns the disk to BULA rules

692
00:35:40,920 --> 00:35:42,840
and attacks it because, okay,

693
00:35:42,840 --> 00:35:45,660
just not trying to do something harmful

694
00:35:45,660 --> 00:35:47,427
or doing something bad
to the system itself,

695
00:35:47,427 --> 00:35:52,427
but just renaming the disc
itself with a new name.

696
00:35:53,730 --> 00:35:57,960
Okay, I promised you that
we were going through

697
00:35:57,960 --> 00:35:59,520
the two version of the virus.

698
00:35:59,520 --> 00:36:01,920
Basically the two version
were very similar.

699
00:36:01,920 --> 00:36:05,430
I dunno why there were too
major release between them.

700
00:36:05,430 --> 00:36:08,550
But okay, the two
version are very similar.

701
00:36:08,550 --> 00:36:10,110
The only difference between the two

702
00:36:10,110 --> 00:36:13,440
are the loading of the version eight,

703
00:36:13,440 --> 00:36:16,838
it's a bit sturdier so you
don't have the flashing screen

704
00:36:16,838 --> 00:36:19,590
and it also hooks the save command.

705
00:36:19,590 --> 00:36:24,080
So hooking in Commodore
64 was pretty trivial

706
00:36:24,080 --> 00:36:28,110
to try to obtain because
addresses for the routings

707
00:36:28,110 --> 00:36:31,980
are saved on 0300 to 03FF.

708
00:36:31,980 --> 00:36:34,140
So its just a matter of
replacing that addresses

709
00:36:34,140 --> 00:36:37,650
with a new one to redirect a command.

710
00:36:37,650 --> 00:36:41,730
In this case, the version eight
is replacing the save vector

711
00:36:41,730 --> 00:36:45,210
with a reset vector so that
if the user is typing save

712
00:36:45,210 --> 00:36:49,230
to save something, it just
got the computer itself reset

713
00:36:49,230 --> 00:36:52,170
and then, so everything is
cleaned up, but you still have,

714
00:36:52,170 --> 00:36:53,003
at this point,

715
00:36:53,003 --> 00:36:57,390
the virus is residing on
the CPU of the 1541 device.

716
00:37:04,320 --> 00:37:05,640
Okay.

717
00:37:05,640 --> 00:37:08,940
I published some tools
because this exercise was done

718
00:37:08,940 --> 00:37:09,960
through several tools,

719
00:37:09,960 --> 00:37:14,580
but I also built my own tools
for doing this analysis.

720
00:37:14,580 --> 00:37:16,950
I hope maybe you can find them useful also

721
00:37:16,950 --> 00:37:19,350
to do some other analysis
about another virus

722
00:37:19,350 --> 00:37:21,333
or maybe just other programs.

723
00:37:22,200 --> 00:37:26,220
This is the 010 Editor template,

724
00:37:26,220 --> 00:37:30,120
which has been built to read
and analyze the disc structure.

725
00:37:30,120 --> 00:37:33,987
As you can see, you can analyze
on the bottom side here,

726
00:37:33,987 --> 00:37:35,070
the structure, for example,

727
00:37:35,070 --> 00:37:38,220
of the BAM of the directory showing up,

728
00:37:38,220 --> 00:37:41,100
which is the Bitmap of
each blocks and so on.

729
00:37:41,100 --> 00:37:43,020
So it helped me to analyze

730
00:37:43,020 --> 00:37:44,530
what weird the virus was doing

731
00:37:45,882 --> 00:37:48,630
and printing it to use for
analyzing theses images

732
00:37:48,630 --> 00:37:51,690
of the Commodore 64 itself.

733
00:37:51,690 --> 00:37:53,400
Then I created a couple of Ghidra scripts,

734
00:37:53,400 --> 00:37:55,110
in order to mapping the code.

735
00:37:55,110 --> 00:38:00,110
As I said, you, the analyzer
was the data analyzer

736
00:38:01,200 --> 00:38:02,280
was also the compelling,

737
00:38:02,280 --> 00:38:04,380
but they must use assembly in this case.

738
00:38:04,380 --> 00:38:06,780
And these scripts are
just mapping, for example,

739
00:38:06,780 --> 00:38:10,140
all the Kernal and wrong
calls for Commodore 64

740
00:38:10,140 --> 00:38:13,950
into this assembly code,

741
00:38:13,950 --> 00:38:16,680
just adding comments on
what the code is doing.

742
00:38:16,680 --> 00:38:19,850
So it allows you to streamline
your analysis of the code,

743
00:38:19,850 --> 00:38:23,550
if you apply these kind of
scripts on your analysis,

744
00:38:23,550 --> 00:38:24,600
for example.

745
00:38:24,600 --> 00:38:28,500
And the same has been done
for the 1541 ROM codes

746
00:38:28,500 --> 00:38:32,790
because 1541 had its additional ROM codes,

747
00:38:32,790 --> 00:38:37,050
the M-W command we saw, the
U3 command we saw and so on.

748
00:38:37,050 --> 00:38:39,180
I'm also published the two database

749
00:38:39,180 --> 00:38:41,013
of the Ghidra database I created.

750
00:38:41,970 --> 00:38:45,030
These are two databases,
everything is heavily commented.

751
00:38:45,030 --> 00:38:46,320
As you can see here,

752
00:38:46,320 --> 00:38:49,590
these are the complete analysis
of the two virus sample.

753
00:38:49,590 --> 00:38:51,990
You can open it with your Ghidra

754
00:38:51,990 --> 00:38:54,533
and have a look to it if you want.

755
00:38:54,533 --> 00:38:58,353
They will be available
on the data as well.

756
00:38:59,485 --> 00:39:00,360
So just for reference,

757
00:39:00,360 --> 00:39:02,520
if you want to have a look.

758
00:39:02,520 --> 00:39:04,020
And let's jump to the conclusion,

759
00:39:04,020 --> 00:39:09,020
so why I decided to do
this talk today with you?

760
00:39:11,460 --> 00:39:12,293
Okay.

761
00:39:12,293 --> 00:39:13,126
We are at the end,

762
00:39:13,126 --> 00:39:14,970
and we saw that fully
functional malicious code

763
00:39:14,970 --> 00:39:16,800
can be put in 700 bytes.

764
00:39:16,800 --> 00:39:21,060
We saw that this was a virus
that was completely functional

765
00:39:21,060 --> 00:39:24,300
with a lot of functions
with everything done

766
00:39:24,300 --> 00:39:27,553
in the proper way,
replication, persistence,

767
00:39:27,553 --> 00:39:32,370
even some really nice
things like moving itself

768
00:39:32,370 --> 00:39:34,740
on different devices and so on.

769
00:39:34,740 --> 00:39:38,250
So the techniques used
by the virus were not new

770
00:39:38,250 --> 00:39:41,043
because they were used by
legit software as well.

771
00:39:44,010 --> 00:39:46,200
They were not discovered
by this virus for sure,

772
00:39:46,200 --> 00:39:49,890
but it was in any case interesting
to compete this knowledge

773
00:39:49,890 --> 00:39:54,890
because it was really helpful
for me as a reverse engineer.

774
00:39:55,140 --> 00:39:57,150
And I'll tell you also why.

775
00:39:57,150 --> 00:39:58,350
Okay, as I said,

776
00:39:58,350 --> 00:40:00,570
the scripting together with
the fully commanded community

777
00:40:00,570 --> 00:40:02,790
database are available on my GitHub

778
00:40:02,790 --> 00:40:06,660
and you can download them
and have a look if you want.

779
00:40:06,660 --> 00:40:09,120
And let's have a look on what
we learned or what I learned

780
00:40:09,120 --> 00:40:10,950
and I hope you will learn as well

781
00:40:10,950 --> 00:40:13,440
because that's the real core of the talk,

782
00:40:13,440 --> 00:40:14,445
from my point of view.

783
00:40:14,445 --> 00:40:16,605
As I said, I'm a reverse engineer

784
00:40:16,605 --> 00:40:20,310
and from a reverse
engineering point of view,

785
00:40:20,310 --> 00:40:22,110
what I learned or let's say recall,

786
00:40:22,110 --> 00:40:24,180
because sometimes it's just
a matter of recalling things,

787
00:40:24,180 --> 00:40:25,320
not really learning,

788
00:40:25,320 --> 00:40:27,570
but sometimes you tend
to forget some things.

789
00:40:28,800 --> 00:40:31,320
With this analysis
that, okay, for example,

790
00:40:31,320 --> 00:40:32,940
few assembly instructions does not mean

791
00:40:32,940 --> 00:40:34,830
that we have few functionality.

792
00:40:34,830 --> 00:40:39,182
We saw 700 bytes software
doing a lot of things,

793
00:40:39,182 --> 00:40:42,210
like replicating, writing,
checking for errors,

794
00:40:42,210 --> 00:40:47,051
which is not really something
that you can give for done

795
00:40:47,051 --> 00:40:48,870
even if higher level program.

796
00:40:48,870 --> 00:40:52,440
So that's something that
you have to consider.

797
00:40:52,440 --> 00:40:55,020
And that's really interesting for us

798
00:40:55,020 --> 00:40:56,895
as a reverse engineering.

799
00:40:56,895 --> 00:40:59,190
So it does not mean that a small program

800
00:40:59,190 --> 00:41:00,393
is doing few things.

801
00:41:01,740 --> 00:41:03,600
Then the other important things

802
00:41:03,600 --> 00:41:06,540
that I'm sure I tend to forget
and think it's a gray area

803
00:41:06,540 --> 00:41:08,760
in the malware analysis nowadays,

804
00:41:08,760 --> 00:41:11,550
it's that we don't have
to forget external devices

805
00:41:11,550 --> 00:41:13,650
when we are looking at malicious software.

806
00:41:14,880 --> 00:41:17,490
In this case, we saw that
we had two CPUs running

807
00:41:17,490 --> 00:41:20,520
on two different devices
of the computer itself.

808
00:41:20,520 --> 00:41:24,420
Right now think about how many chips

809
00:41:24,420 --> 00:41:27,903
you have in a modern computer.

810
00:41:28,740 --> 00:41:30,690
I'm sure that you can tell me that okay,

811
00:41:30,690 --> 00:41:32,130
but these are not executing code

812
00:41:32,130 --> 00:41:33,600
or you cannot access directly.

813
00:41:33,600 --> 00:41:34,500
Yeah, true.

814
00:41:34,500 --> 00:41:37,713
But you have device drivers
accessing these kind of things.

815
00:41:38,750 --> 00:41:39,720
And think about it.

816
00:41:39,720 --> 00:41:43,350
Think about the thing that
you may misuse a deVice driver

817
00:41:43,350 --> 00:41:46,710
in order to, I dunno,
execute code, write codes,

818
00:41:46,710 --> 00:41:48,780
store code somewhere
where we are not expected,

819
00:41:48,780 --> 00:41:50,520
we don't expect to see it.

820
00:41:50,520 --> 00:41:54,300
We have a lot of additional
things in our systems right now.

821
00:41:54,300 --> 00:41:57,240
And so far from what I think

822
00:41:57,240 --> 00:41:59,790
is that this is kind of a gray area.

823
00:41:59,790 --> 00:42:03,229
It's not really explored from what regard

824
00:42:03,229 --> 00:42:05,700
the mal issue software

825
00:42:05,700 --> 00:42:08,943
and so something we need
to take into consideration.

826
00:42:09,930 --> 00:42:11,580
And then there's first thing I learned

827
00:42:11,580 --> 00:42:13,380
and I would like also to pass to you

828
00:42:15,653 --> 00:42:18,090
it's that the assembly
proficiency opens a lot of doors.

829
00:42:18,090 --> 00:42:20,760
I tend to see that assembly's a bit,

830
00:42:20,760 --> 00:42:22,870
let's say a foreign language.

831
00:42:22,870 --> 00:42:23,703
So it's not teached anymore,

832
00:42:23,703 --> 00:42:26,493
nobody is caring about it.

833
00:42:28,200 --> 00:42:29,033
I'm not saying here

834
00:42:29,033 --> 00:42:31,650
that you have to write your
next word processor in assembly,

835
00:42:31,650 --> 00:42:32,850
which is not the case obviously,

836
00:42:32,850 --> 00:42:35,760
and probably you don't need
to write anything in assembly

837
00:42:35,760 --> 00:42:37,320
in most of the case.

838
00:42:37,320 --> 00:42:40,200
But it's very important from
my point of view that everybody

839
00:42:40,200 --> 00:42:41,850
working in security knows assembly

840
00:42:41,850 --> 00:42:44,250
and knows in a proper way.

841
00:42:44,250 --> 00:42:46,600
Because this really opens a lot of doors

842
00:42:48,300 --> 00:42:50,340
for example, in this kind of analysis,

843
00:42:50,340 --> 00:42:52,770
I didn't know the 6502 architecture,

844
00:42:52,770 --> 00:42:55,080
I learned in doing these analysis

845
00:42:55,080 --> 00:42:57,810
together with you this morning.

846
00:42:57,810 --> 00:43:01,620
And the fact that I had
knowledge of Intel assembly

847
00:43:01,620 --> 00:43:04,980
or arm assembly really streamlined for me

848
00:43:04,980 --> 00:43:06,660
the analysis of this simple architecture.

849
00:43:06,660 --> 00:43:09,210
So that's something that we need to keep

850
00:43:09,210 --> 00:43:11,040
into consideration also,

851
00:43:11,040 --> 00:43:14,400
when we think about studies of new people

852
00:43:14,400 --> 00:43:15,900
coming into security fields and so on.

853
00:43:15,900 --> 00:43:18,750
We don't have to forget
that the assembly language

854
00:43:18,750 --> 00:43:20,643
it's very important for our purposes.

855
00:43:23,430 --> 00:43:26,640
So these are all the
references for was what I used

856
00:43:26,640 --> 00:43:29,970
and what I was speaking about today.

857
00:43:29,970 --> 00:43:31,980
I want to leave these slides some seconds

858
00:43:31,980 --> 00:43:35,073
so that everybody's
credited in the proper way.

859
00:43:38,640 --> 00:43:42,303
So I think that I'm at the
end of my presentation,

860
00:43:43,187 --> 00:43:46,140
so I just want to say
thank you to everyone here

861
00:43:46,140 --> 00:43:49,350
and for staying with me for
the entire presentation.

862
00:43:49,350 --> 00:43:54,350
And if any question, maybe we
have some minutes, I dunno.

863
00:43:54,540 --> 00:43:56,130
Five minutes?

864
00:43:56,130 --> 00:43:58,623
Any of you have a question or something?

865
00:44:03,507 --> 00:44:04,340
Okay.

866
00:44:05,711 --> 00:44:09,878
(Audience member asking question)

867
00:44:33,990 --> 00:44:34,823
I'm sorry.

868
00:44:35,970 --> 00:44:40,970
I'm not sure if you say the
removal of the hook itself?

869
00:44:43,051 --> 00:44:45,300
The removal process is just
done by the reset itself.

870
00:44:45,300 --> 00:44:47,070
So when you erase the memory,

871
00:44:47,070 --> 00:44:50,400
everything it's bought
back to the original state.

872
00:44:50,400 --> 00:44:55,400
So they save, it's just replaced
with the correct address.

873
00:44:55,530 --> 00:44:58,950
So when you type save and
you replace the vector,

874
00:44:58,950 --> 00:45:01,410
the Commodore 64 has been erased.

875
00:45:01,410 --> 00:45:04,803
But everything that needs bring
back to the original state.

876
00:45:07,050 --> 00:45:07,883
Thank you.

877
00:45:11,346 --> 00:45:12,179
Oh.

878
00:45:13,812 --> 00:45:15,501
- [Male] So would you say that

879
00:45:15,501 --> 00:45:18,745
because this chip is still being made,

880
00:45:18,745 --> 00:45:23,328
that we're looking at potential
vector writing malware,

881
00:45:24,881 --> 00:45:29,317
to stay consistently on
top of the old architecture

882
00:45:29,317 --> 00:45:33,191
in modern devices
internet, things like that?

883
00:45:33,191 --> 00:45:34,560
- Yeah, I think so.

884
00:45:34,560 --> 00:45:36,005
Let's say that, okay,

885
00:45:36,005 --> 00:45:39,003
It's not just a matter
of this CPU obviously,

886
00:45:40,286 --> 00:45:43,230
but this is obviously a
CPU that is still used,

887
00:45:43,230 --> 00:45:46,800
so you can apply the same
concept that we saw today.

888
00:45:46,800 --> 00:45:48,210
Probably not all the concept

889
00:45:48,210 --> 00:45:50,760
because some of the
concepts we saw together

890
00:45:50,760 --> 00:45:54,900
were really specific to
Commodore 64 architecture.

891
00:45:54,900 --> 00:45:58,347
But all the rest of the
things like the assembly code

892
00:45:58,347 --> 00:46:00,123
and so on, it's exactly the same.

893
00:46:01,376 --> 00:46:04,020
- [Male] Yeah, the roadmap.

894
00:46:04,020 --> 00:46:05,220
- Yeah, yeah, yeah.

895
00:46:05,220 --> 00:46:06,483
That's exactly the same.

896
00:46:08,370 --> 00:46:09,203
Yeah.

897
00:46:16,420 --> 00:46:18,660
Okay, thank you so much.

898
00:46:18,660 --> 00:46:19,934
Thank you really.

899
00:46:19,934 --> 00:46:21,448
(audience applauding)