YESTERYEAR

March 6, 2006

In order to learn how computers work, we need to return to a time before computer innards consisted of featureless silicon blocks. We need to go back to a time where you could learn by tugging on wires and watching the red glow of LEDs.

---

19,435 PAGES

December 7, 2005

A disassembly of iTunes

iTunes disassembly, as a text file. 1,107,740 lines.
iTunes disassembly, as a PDF. 19,435 pages.

If you want to understand the disassemblies, you should look at this PowerPC reference. That's the microprocessor in current generation Macintoshes. Scroll down to the section titled PowerPC application-level registers and look at the number and kinds of registers it has, and a little further down to PowerPC application-level instruction set and study the summary of its assembly language instructions. Notice that for all it's advances, the microprocessor still basically branches, does math, and plays with memory. Just what microprocessors did 30 years ago.

What is a disassembly? It's when you take the binary of a program and turn it back into a more readable text file. It's similar to what the author may've originally written (if the code were written in assembly language), but it lacks the author's variable and function names, and any comments that might've been in the sources. Typically programs are written in higher level languages, such as C, so a disassembly is the first step to figuring out what the program does and how it works, but it's not the end. A good knowledge of what compiler-generated assembly code looks like is a big help.

Viruses

Wikipedia has a good set of introductory articles about computer viruses:

• Computer viruses.
• Zombie computers and zombie networks (aka botnets).

I'm a fan of the book Firewalls and Internet Security by William Cheswick. The library has it. I first learned about the silliness of "Security through obscurity" from this book. It's a classic.

Regarding the vulnerability of various operating systems:

• As of November 2005, Symantec had not identified a single Macintosh virus.
• In the first half of 2005, 11,000 new viruses for Windows were identified.

(From Newsweek, "Ask the Technologist," November 7, 2005)

Recently a huge botnet was discovered and broken up by Dutch police and the FBI. A 19-year-old programmer and two accomplices in their 20s were responsible for comprising over a million computers world-wide. It's got everything: viruses, child pornography, distributed denial of service revenge attacks. Here are a few articles that covered it:

• October 10, 2005 "Cops smash 100,000 node botnet"
• October 21, 2005 "Botnet operation controlled 1.5m PCs"
• November 7, 2005 "Adware firm helps FBI nab botnet hackers"

Another botnet in the news. "3 accused of inducing ill effects on computers at local hospital," Seattle Times, February 11, 2006.

It turns out the Seattle hospital's computers — along with up to 50,000 others across the country — had been turned into an army of robots controlled by 20-year-old Christopher Maxwell of Vacaville, Calif., according to a federal indictment issued Thursday. And Maxwell, along with two juveniles, earned about $100,000 in the process, court documents state.

Their scheme was to install adware on the remote computers and receive payment from the adware companies.

---

OF CODES

November 30, 2005

Phase 1

0010000000000000001000010000000100011000010000000010100011110000110100010000000001000010010010010010100000000000110100010000000001000010010010011110011111110111  

Phase 2

0010000000000000 0010000100000001 0001100001000000 0010100011110000 1101000100000000 0100001001001001 0010100000000000 1101000100000000 0100001001001001 1110011111110111

(Mary's interpretation)

Phase 3

0010000000000000    MOV   R0, #0
0010000100000001    MOV   R1, #1
0001100001000000    ADD   R0, R0, R1
0010100011110000    CMP   R0, #240
1101000100000000    BNE   +4
0100001001001001    NEG   R1, R1
0010100000000000    CMP   R0, #0
1101000100000000    BNE   +4
0100001001001001    NEG   R1, R1
1110011111110111    B     -14

Phase 4

0   MOV   R0, #0        x = 0;
2   MOV   R1, #1        dx = 1;
4   ADD   R0, R0, R1    loop: x = x + dx;
6   CMP   R0, #240      if (x == 240)
8   BNE   +4
10  NEG   R1, R1        dx = -dx;
12  CMP   R0, #0        if (x == 0)
14  BNE   +4
16  NEG   R1, R1        dx = -dx;
18  B     -14           goto loop;

Phase 5

x = 0;
dx = 1;
while (1) {
   x = x + dx;
   if (x == 240) {
      dx = -dx;
   }
   if (x == 0) {
      dx = -dx;
   }
}