[comp.virus] 639/640k

mweiner@bene.at.eu.net (Michael Weiner) (07/23/90)

 > WELFARE@ILNCRD.BITNET (A. SOLOMON EAGLSTEIN) writes:
 > >I just ran Immune version 9.0 and was informed that there was only
 > >639K insatead of 640K (PS/2 - 60). I then ran Scanres 1.4V61 and it
 > >checked out ok at 640K ! Is anyone familiar with the probl Do I
 > >have some mean and nasty bug ?

On my system (a 386 equipped with an AMI BIOS) the setup-program
(ROM-resident) asks you whether you want the BIOS to use a stack area
somewhere in low memory or you want it to reduce your base memory size
by 1 K. I am not sure what this area is being used for - I guess it is
used to store the user configurable HD drive information, but I am not
sure. I do not believe you have a bug - what you could do is use Quaid
Analyzer or a similar debugger to look into that top area of RAM (You
might have to patch it back to 640k by changing 0:413 hex [dw]). By
looking at the data stored there, you should be able to find out what
is going on there. If that doesn't help, you could still use the Quaid
Analyzer function "Go until memory location is modified" to trace the
system starting at the boot so you can see at which point data is
written to the hidden area.  Not to forget: Quaid Analyzer itself also
uses such a technique to hide itself from debugged programs if it is
used in 'boot' mode.

Kind regards,

      Michael

+------------------------------------------------------------+
I UUCP:     mweiner@bene.at.eu.net                           I
I Internet: mweiner@f23.z2.FIDONET.ORG  Voice ++43 1 8232400 I
I Michael Weiner -- Ghelengasse 4 -- A-1130 Wien -- Austria  I
+------------------------------------------------------------+