Morris Worm Decompiled (1988)
foo.be
foo.be
Morris is an American professor at Massachusetts Institute of Technology. He co-founded the online store Viaweb, one of the first web-based applications, with Paul Graham.
Frankly he's up there with Steve Jobs and maybe Fabrice Bellard in terms of "people who I'd like to know what it is they're doing so right so consistently." It's the consistency that tends to surprise me.
Three independent groups, at Berkeley, MIT, and Purdue disassembled the .o and poked at its contents, slowly figuring it out.
Mark Eichin's timeline (http://web.mit.edu/user/e/i/eichin/www/virus/chronology.html) is a fun read, written from the MIT viewpoint, that chronicles how the Unix nerd community basically sprung up to dissect and deal with the worm, and contains a section on their attempts to disassemble the worm.
object objects[69]; /* Don't know how many... */
/* This report a sucessful breakin by sending a single byte to "128.32.137.13"
* (whoever that is). */
/* This appears to be a structure unique to this program. It doesn't seem that
* the blank slots are really an array of characters for the hostname, but
* maybe they are.
*/
/* There are pieces of "stub" code, presumably from something like this to
get rid of error messages */Berkeley, apparently.
If I had to guess, the only people who had access to the original source are rtm, whoever he gave it to, and whoever accessed his account at Cornell when they looked through his homedir.
And it's unlikely that any of them would have distributed it. Remember, at the time this code was potentially really dangerous; this was essentially a new type of attack that folks weren't really ready or prepared to defend against.
"The students were safe. Their computers weren't."
"The suspect, somewhere, a dark genius."
"I suspect it's an 'A' student. A good 'A' student."
Someone in 1989 or 1990 ran an ad in the back of "2600" magazine, selling the source code on paper. I bought a copy back then, I can remember the date because of the apartment I was in when I read the code. I think the "2600" version is the same as this one, but with someone different header comments.
I have a copy of this code from a tar archive with date of 1991-06-05 on it, so it's been floating around the Internet for almost 20 years at this point.
text offsets are also put in comments next to the function declarations. For example: "h_clean() /* 0x31f0 */"
Excerpted from the book Cyberpunk: Outlaws and Hackers on the Computer Frontier (published 1991). The quoted speaker is Paul Graham.