BootX v3.40 User Manual December 12, 1990 Requires the arp.library DISCLAIMER BootX has been thoroughly tested and is the result of a constant process of changes and updates that started in April 1989. The program has proven to be stable in everyday use. The author is not responsible for any loss of data, damages to software or hardware that may result directly or indirectly from the use of this program. The BootX package consists of: BootX3.40 The program file BootX.BBLib The BootX bootblock library BootX.Brain An example of a brainfile BootX3.40.doc This file Note that the BootX.BBLib nor the BootX.Brain files are required to run the program. BootX will display an errormessage when either of these two files are not found. See further. This documentation will always be updated at the top. Users of previous versions of BootX need only read the paragraphs reflecting the changes since their last version. Changes from BootX v3.30 ------------------------ - Added a check for the Peter Stuer Anti-Virus 3.0 bootblock - Cleanup up a lot of the code - Squashed some potential bugs - Completely rewrote the LinkVirusCheck routine to use a client call-back function. - Completely rewrote the MemoryCheck routine and added a few more vectors to check. - Added checks for 2 more bootblocks and 7 more bootblockviruses - Added checks for several new linkviruses. - Rewrote the BootBlock library routines - BootX now detects if another copy is running. This was asked by some users who always forgot they still had a dormant copy of BootX hanging around on the Workbench. - For users of the SetPatch -r option BootX now asks if it is allright to reset any memory vectors. - More vectors are shown that are potential targets for viruses. - Fix a bug in the View Brainfile option. - Fix a bug in the Save Brainfile option. - Added the Merge Brainfile option: Since version 3.30 BootX has been able to create brainfiles. This option allows you to 'merge' a brainfile you got from a friend. BootX takes care of all the details. It won't add any signatures that already exist. You select the brainfile you wish to merge in the ARP file requester. Merging occurs in memory, so don't forget to save the updated brainfile (BootX will warn you though. - Fixed a bug in the startup code. BootX now uses the same current directory as the CLI it was started from. - Added the Quit menuitem Changes from BootX v3.20 (The big one) -------------------------------------- - Fixed a bug in the font name. BootX should now always use the Topaz 80 font (Hopefully). - Fixed a bug in the startup code. - Optimized the code completely - BootX now checks for viruses on startup - Completely rewrote the MemoryCheck routine - All information is now printed using a console (Now I can use formated output for several functions. For the Amiga programmers: I understand the RawDoFmt() function now (at last)). - Completely rewrote the link virus check routine. It can be stopped by pressing the left mousebutton. - BootX tries to reconise a bootblock that is loaded. - Added checks for PVL Virus Protector 6.5 and Anti-Virus 2.0 and added both to the built-in bootblocks. - Removed some of the spelling errors from this doc file Changes from BootX v3.1 ------------------------ - Fixed a bug in the new recognition routine. Changes from BootX v3.0 ----------------------- - Some internal code optimizations. - Added Anti-Virus 1.0 from Peter Stuer. - Finally removed the NorthStar 2 bootblock from the installable bootblocks. Changes from BootX v2.9 ----------------------- - Reformated this doc file so it can be read from the CLI using type. - The detection on/off switch now flashes when it is selected. - Added a new bootblock to the recog list. - Added my own viruschecker to the installable bootblocks: Thor Anti-Virus v1.0 When you boot a disk with this bootblock, it first checks the ExecBase vectors that are most likely to change when a virus installs itself. For the programmers among you: ColdCapture, CoolCapture (WarmCapture isn't supported in KickStart1.2 and 1.3), KickMemPtr, KickTagPtr and KickCheckSum. OldOpenLibrary (IRQ Virus) and PutMsg or DoIO are not checked because these vectors are reset upon booting. When nothing suspicious is found, a title picture is shown signaling everything is OK. You can either wait or click the left mousebutton to continue. When Thor Anti-Virus v1.0 finds something in the above mentioned vectors the screen flashes red for a short period. It is up to you to react within this period and click the right mousebutton. When you NOTHING is changed and all vectors are left alone. I put in this option because some programs (TurboPrint, ATool) use these vectors to stay resident. Note that there is no way telling wheter there is a virus in memory or some useful resident code. When you don't press the right mousebutton, Thor Anti-Virus resets ExecBase and TRASHES any code found in the Resident vectors. I found this the only effective way of killing a Resident structure in this little code. I know its not pretty but its damn effective !!! The Amiga then resets as if nothing happened. Normally you should only get the title screen then. Thor Anti-Virus v1.0 works completely legally, that is reserving memory for its screen and structure, so it should be compatible with KickStart 1.3 and 1.4(?). I have not had a chance to try this out. If you have any problems please let me know. Short introduction ------------------ BootX v3.40 is an attempt to make the ultimate viruskiller. BootX v3.40 is fast (written completely in assembler), small and tries to be as user friendly as possible (use of the arp.library). This program is freeware. It can be copied by anyone except for commercial use as long as this documentation file and the program icon accompanies the program. Note that this program requires the Arp library to run. No source code accompanies this program for the obvious reason that everybody would be able to change the checking algorithm. If you find any new viruses or linkviruses that BootX does not recognize yet, please send them on a disk to me (my address is at the bottom of this document). I will return the disk with an updated copy of BootX. P. Stuer How to start BootX v3.40 ------------------------ BootX v3.40 (from here on referred to as BootX) was written be used both beginners and experienced users. BootX can be started both from CLI and the Workbench. Starting BootX from the CLI To start BootX from the CLI simply type: 1> BootX3.40 followed by a return. This loads the BootX program and starts it. BootX then detaches itself from the CLI. This means that you can start BootX, bring the Workbench screen back to the front and then close the CLI window with the EndCLI command. Starting BootX from the WorkBench This is the easy part. Simply click on the accompaning icon and BootX starts. How to use BootX v3.40 ---------------------- A lot of viruscheckers and viruskillers are already written for the Amiga but none of them offered all the features I needed. Hence the various disk offering several different programs for doing the job. Enters BootX. BootX can check the bootblock of a disk, check memory for any resident viruses and scan a disk for linkviruses. It can load bootblock libraries for you to write on your disks as an alternative for the boring DOS Install bootblock. It can load "brain files" so you can add any new bootblocks that BootX does not recognise yet. Let's start a guided tour of the screen. The main screen offers several gadgets (I hate menus when I want to work fast). Just click the appropriate gadget to perform an action. Quit Does just what the gadget says: it releases all used memory and quits the program. Read to buffer This gadget explicitly instructs BootX to read the bootblock from the current selected drive into the buffer. Normally BootX detects when a new disk is inserted and automatically reads its bootblock. But some old 5 1/4 drives don't support automatic diskchange. This gadget can also be used to read the bootblock after another programs has modified the bootblock. Write to buffer Here you instruct BootX to write the bootblock currently in the buffer to the selected drive. BootX maintains a buffer that holds the last read bootblock. This buffer is also visible in the large display window in semi-ASCII form (more about this later). The buffer allows you to read a bootblock from one disk and then copy it to another. The 4 drivegadgets You can connect 4 disk drives to the Amiga. BootX checks how many drives are connected to the Amiga and installs a gadget for every one of them. When a drive is not found the gadget will read "N/A": not available. Note that although a drive is connected the Amiga will not recognize its presence when it is turned off (only applicable for external drives). Install BootBlock Here you can write the selected built-in bootblock to the bootblock of the current drive. When no bootblock library is loaded only the normal Install v1.3 bootblock is available. At startup BootX looks for a file called "BootX.BBLib" in the directory from which BootX started. It contains several alternative bootblocks. It is possible to load another bootblock library using the "Load bootblock library" menuitem (see further). Next and Previous These gadgets show the next or the previous bootblocks in the currently loaded bootblock library. If no library is loaded, only the normal Install 1.3 bootblock will be available. Among the bootblocks are the normal DOS bootblock, Ralph Babel's Install2 and several others. Thanks to all groups and programmers whose bootblock I included. Note however that when you press Next and Previous the bootblock buffer is not updated. BootBlock window This window shows the name of the selected built-in bootblock. Message window This window reports messages and errors resulting from the various operations. Main display window Shows the bootblock currently in the buffer in semi-ASCII representation. Only the readable characters are shown. This allows you to check for readable text signifying the nature of the bootblock when BootX reports "Unknown bootblock". About Display information about BootX and the version number. Always try to get the latest version available to have optimum virus protection. Load from/Save to file BootX can save the bootblock in the buffer to any valid Amiga device. 'Save to file' can be used to save the bootblocks of games, mega demos and other programs to a separate data disk. In case of a virus attack or a bad disk you can load the previously saved bootblock back in the buffer and write it back to the original disk. Note: no checking is done on the loaded bootblock. So it is possible to load f.i. the parallel.device and write it to the boot block. This allows you to write self-made bootblock to the disk. BootX now asks you if it should correct the bootblock checksum when it is wrong. Memory check Checks the memory for any known virus ignoring all known resident virus checkers. When BootX finds a virus it will display an Alert identifying which virus was in memory and will try to kill it. BootX also removes any known linkvirus from memory. BootX also shows some important vectors from Execbase in the main display window. These vectors are mostly altered by viruses. A normal vector will be display in white. When BootX thinks that something is not normal it will display the vector in white on red. Note that this not necessarily means that there is a virus in memory. Resident programs as f.i. TurboPrint use these vectors too. I will try to keep BootX's knowledge base as up to date as possible. In case of doubt, save all data and cold-start the Amiga. Goto sleep Closes the main BootX screen and releases as much memory as possible. A small window on the workbench screen is opened showing that you that BootX is still in memory. In this state BootX uses no CPU time and just waits for you to make the window active and click in it with the menu button (the right mouse button). Then the main BootX screen and window is opened again and you can go on again. BootX does not unload a brain file or a bootblock library. Also, when asleep BootX doesn't do any checking ( like VirusX does). I did this on purpose. There is no need to continuously keep checking every disk that is inserted. Just check them once to make sure there virus-free. Kill LinkVirus This gadget pops up the file requester for you to specify a device to search for linkviruses. In the current version this can only be a device. Later version will support directory and file checking. When you select OK BootX starts searching for linkviruses in any executable file it encounters. Note that the complete disk is searched. In case BootX finds a link virus you are given the option to remove it from the infected file. BootX removes the linkvirus and save the file under the same name with an extension ".bx". Currently only the IRQ and the TTV1 linkviruses are checked for. Help This gadget toggles the help feature. When it is turned on you can click any gadget to get a short help message about its function. Click Help again to turn off the help feature. Detection on/off This gadget works as an on/off switch. It turns off diskchange detection. Sometimes it is not useful to have BootX read the bootblock of every disk you insert, especially when you have a bootblock in the buffer you wish to write to another disk. This gadget allows one drive user to copy bootblocks. Learn Clicking this gadget prompts you for a name when BootX does not known the bootblock in the buffer yet. Enter an empty string when you want to cancel the operation. BootX then adds the bootblock to the current brain file (if present). Else it make a brain file in memory. The Menu -------- Load Bootblock library Selecting this menuitem (or the key combination Right-Amiga-B) allows you to load another bootblock library than the default BootX.BBLib Load Brainfile Selecting this menuitem (or the key combination Right-Amiga-L) allows you to load another brainfile than the default BootX.Brain. BootX will load only valid brainfiles. Before loading it asks you if you want this brainfile to replace the one in memory. Save Brainfile Selecting this menuitem (or the key combination Right-Amiga-S) allows you to save the brainfile that is currently in memory. Learn Bootblock Selecting this menuitem (or the key combination Right-Amiga-A) is the same as clicking on the Learn gadget (see higher). I realize this documentation is brief but I made BootX to be as intuitively as possible. BootX is updated frequently to recognize new bootblocks and viruses. Peter Stuer Kauwlei 21 B-2550 Kontich Belgium - Europe _ _ // Thanks to \X/ Amiga for being the best computer ever ! Thanks to BSB for beta testing and giving useful comments.