| 40Hex |
| -=PHALCON/SKiSM=- |
40Hex has existed as an online magazine since June 1991. The magazine has changed management several times and has consequently gone through many stages. However, the purpose of the magazine has always been to distribute information on the computer virus phenomenon in an uncensored forum. 40Hex has become the most popular virus magazine in the underground.
40Hex magazine is now also available in hardcopy format. The two magazines will not contain the same articles, as each medium is better suited to a different audience and a different volume of information.
The price for 40Hex Hardcopy is $35 per year for individuals, $50 per year for corporations. The magazine is bimonthly (six issues per year). Make all checks payable to 40Hex.
Correspondence:
40Hex Magazine PO Box 252 New City, NY, 10956If you have access to Internet e-mail, you can send a note to fortyhex@mindvox.phantom.com
Here are several issues in HTML format.
Here is an online version via a cool web interface via vx underground.
PHALCON/SKiSM was a group that wrote computer viruses in the 1990s. It was formed by the merger of two New York City-based virus writing groups: SKISM (for "Smart Kids Into Sick Methods"), formed by the virus writer called "Hellraiser", and Phalcon. They wrote and distributed the online magazine 40Hex (1991–1998), as well as the virus creation tool PHALCON/SKiSM Mass Produced Code Generator (1992). In 1992, the group claimed to have around 12 members, aged 15 to 23 years.
40Hex - Volume 1, Issue 1 (June 1991)
40Hex - Volume 1, Issue 2 (July 1991)
40Hex - Volume 1, Issue 3 (October 1991)
40Hex - Volume 1, Issue 4 (December 1991)
40Hex - Volume 2, Issue 1 (February 1992)
Welcome to Issue 5 of 40Hex, the monthy semi-annual magazine published for all those interested in learning more about computer viruses. Lots of new news: 1) Well, Hellraiser has lost computer and housing temporarily, so DecimatoR had taken over the magazine. There has been so much new stuff, a lot got changed since the time I received this issue. Special BIG ASS greets to him for all of his work on this issue. 2) Digital Warfare is down, as Instigator got busted for phreaking. We will let you know more when we know more. Before its demise, its virus collection had grown incredibly, thus stocking 40Hex for life. 3) LandFill BBS went back up. I am back in the scene again. Give it a ring. 4) As of the release of this file, I have heard of more busts, specifically, Gengis Kahn and Rain Man.... could be rumor. BTW, for those of you who have the "Anti-FiRe" virus, SCAN 86 catches it as "Infinity"... probably due to the text it contains. Course, it was distributed on a VGA loader for the InFiniTy boards... heh heh heh... DecimatoR -)GHeap File 000..............................You Are Here File 001..............................BUSTED! Instigator's Story File 002..............................Virus Spotlight: Ambulance Car File 003..............................The 1963 Virus File 004..............................Alliance w/McAfee and Dvorak File 005..............................Virus Author's Constitution File 006..............................The SKISM Vengeance Virus Hex File 007..............................Finding Scan Strings II
40Hex - Volume 2, Issue 2 (April 1992)
Welcome to 40Hex issue 6. If this is your first time reading an issue of 40 Hex, I welcome you, but recommend that you start with an earlier issue. This issue will have a Virus Spotlite on Creeping Death(Dir-2). It isn't in the normal Hex Dump format, and it is fully commented. - Landfill is temporarily down(again!). This is due to several [NuKEd] hard drive controllers... we are down but NOT out. Hopefully we should be up within several weeks of the release of this issue. Hellraiser is still unable to edit the magazine, hopefully next issue he will be back in charge. - I think we must discuss one problem. Recently, we have been verbally "attacked" by some lamers in the virus scene who like to jerk off on Fidonet. To clear up the issue at hand, we personally don't use all of the methods found in the articles. For example, we don't sit around all day and PKLite infected files and then remove the PKLite header. We let you people do it. As a matter of fact, we made it a hell of a lot easier due to this month's article called NoLite. No self-respecting virus group would do it. Not everyone that reads this magazine is a virus programmer, but wants to learn. Ya gotta start somewhere. Another person who has been insulting us on FidoNet is Sara Gordon. I do not know the whole story behind her hatred, but I know it stems from a phone conversation between her and Hellraiser. From what I understand, they disagreed on many topics, and HR may have gotten insulting (I don't know the whole story) - Anyone that would like to submit articles feel free to do so, as long as what you write is not stolen from another source and is of good quality. If you would like to write articles contact any PHALCON/SKISM member or upload them to either Digital Warfare or PHUN LINE. File 000.............................You Are Here File 001.............................Finding anti-viral programs in memory File 002.............................Code Concealing: Part I File 003.............................More Busts and Updates File 004.............................The NoLite Utility File 005.............................PHALCON/SKISM Update File 006.............................Some Dick who wants to bust virus authors File 007.............................The Kennedy Virus File 008.............................Cornell students nailed for viruses File 009.............................The Truth Behind Virus Scanners File 00A.............................Virus Spotlite-Dir2 Full commented source File 00B.............................Scan strings, and how to avoid them File 00C.............................!Virus Contest!
40Hex - Volume 2, Issue 3 (June 1992)
Welcome to 40Hex issue 7! As you may have noticed, we are a little late in releasing this issue. This is mainly because very little has gone on for us to write about. Enough of the excuses, on with the show. We are going to start by giving you a little news update on what we've been up to. First of all, Hellraiser is back in New York. He moved back towards the end of May. Once he gets settled and I give him his computer, I am sure he will be back writing more virii, and possibly editing 40Hex (not sure if he wants the task of editing 40Hex). Anyways, to say the least, its great having him back where he belongs. Second, we have several new virii out, these will NOT appear on Virus BBSs. Not even ours. The reason is simple. Anti-Virus people are not in the dark anymore. They are on Virus BBSs. Since we want our virii to remain as undetectable as possible, giving them to the general public is just no longer an option. Nonetheless, the new virii will be sure to surprise everyone. Third, LandFill BBS is back online. The number won't be given out in the mag, I don't want it getting posted on FidoNet. I am silly that way. The other reason I am not putting the number in it is because I don't want 100+ lamers reading it, and giving the BBS a call. Fourth, a new installment of Dark Angel's Virus Writing Guide came out, get it, it is chunky. Finally, greetings to three new members, Black Mischief (Hacker), and iNVALiD MEDiA (Hacker, SysOp Of Unphamiliar Territories, which is now invite only!), and Stingray(Ex-VIPER). 40Hex-7.000....................You've Just Read it 40Hex-7.001....................Virii in the News Part I 40Hex-7.002....................Code Concealment [2] 40Hex-7.003....................An Introduction to Non-overwriting Virii 40Hex-7.004....................Enough Tinys to Sink a Ship 40Hex-7.005....................MtE News Stories 40Hex-7.006....................Virus Spotlite:Dissassembly of Leap Frog 40Hex-7.007....................Spammies Reminder 40Hex-7.008....................Virii in the News Part II 40Hex-7.009....................Debug Script for Pogue Mahone
40Hex - Volume 2, Issue 4 (July 1992)
Welcome to 40 Hex issue 8. First off, this month is going to be Boot Sector Appreciation Month at 40Hex. We will have a fully disassembled Michelangelo, along with a Pakistani Brain variant called Ashar. But as always, there is a lot of other news that I have to discuss with all you, so on with the show. For the last couple months, we have recieved quite a bad rap on Fidonet. This has to do with the original SKISM Viruses (Like SKISM 1-14). Like everyone, we had to start somewhere. So what if our original virii blew large goats. Judge us on some of our newer stuff. Oh, what is this you say? You can't find our newer stuff? Well, neither can McAfee. Everyone will become enlightened soon enough. Other people on Fido who have been giving us a hard time, think it bothers us? Think again, we love it! One of our personal favorites is Gary Watson, who amuses us with each new post, and Tag Line (which are hysterical). Secondly, Hellraiser is back as an author for 40Hex! He currently doesn't have a modem, but he can at least do some slave work. Great to have you back HR. Another way in which 40Hex is going to help support virus community is by the brand new PHALCON/SKISM Macintosh Programming Team! The four people involved in that are Renegade, Sixo, Trojan, and Wintermute! They will be cranking out a lot of quality Macintosh utilities, trojans and other interesting things very soon! Look for them on all of our BBS's. -=PHALCON/SKISM=- Net will be arriving to a BBS near you very soon. If you are interested, leave mail to any one of our fine support systems. 40Hex-8.000......................You Are Here! 40Hex-8.001......................PS-MPC (MassProducedCode) 40Hex-8.002......................Putav, an expose! 40Hex-8.003......................Findav -P/S- Style 40Hex-8.004......................Checkav -P/S- Original 40Hex-8.005......................StarShip Virus Info 40Hex-8.006......................Virus Spotlite: Michelangelo 40Hex-8.007......................EXE Infectors and you 40Hex-8.008......................Disassembly of ASHAR 40Hex-8.009......................Ear-6 source en Espanol 40Hex-8.010......................Letter to the Editor
40Hex - Volume 2, Issue 5 (December 1992)
Welcome to the ninth issue of 40 Hex! This month brings lots of exciting and neat-o stuff. The feature article this month is Dark Angel's tutorial on SYS infections. As always, we have more virii news and more disassemblies and yes, even more debug scripts. A few quick notes: - Join PS/Net! Contact your friendly neighborhood Phalcon/Skism sysop for details. - We have been copied extensively by virtually every virus group in existence and, with few exceptions, have not been given credit for our work. It is getting tedious, to say the least, to reread what we have already written. In the future, please don't be quite so lame. - Landfill is down again, but a new board, Liquid Euphoria, run by our newest member, Hawkmoon, has taken its place. The board is stable and will not go down without warning, we promise! Call it, love it, hold it as your own. Special thanks to Hawkmoon for editing portions of 40Hex. - All are invited to contribute to 40Hex, be it in the form of an article, original virus, or whatever. Contact a Phalcon/Skism board for details. - Finally, happy new year to all virus and anti-virus people everywhere! The new year promises to bring more nify innovations in both virii and viral toolkits from Phalcon/Skism. Stay tuned. 40Hex-9.000......................You Are Here! 40Hex-9.001......................40Hex Editorial 40Hex-9.002......................SYS Virii 40Hex-9.003......................Phoenix 2000 Debug Dump 40Hex-9.004......................More antidebugger techniques 40Hex-9.005......................Virus Spotlite: 4096 40Hex-9.006......................Nina disassembly 40Hex-9.007......................A New Virus Naming Convention 40Hex-9.008......................Code Optimization 40Hex-9.009......................FirstStrike's Catfish virus
40Hex - Volume 3, Issue 1 (March 1993)
Welcome back to yet another issue of 40Hex, Phalcon/Skism's magazine chock full of virus writing techniques, news, source code, and related info. First off, Phalcon/Skism welcomes its newest member, FirstStrike. We have watched him grow from humble beginnings and are confident that he will continue to produce quality viruses in the future. We will, beginning with this issue, be phasing out the debug scripts in 40Hex. Although many people find them useful, we feel that source code is more interesting and worthwhile. The disassemblies are almost always done by Dark Angel, who advises those with difficulty understanding some parts of the disassemblies to first skim the entire disassembly to learn how the virus works. Some portions, he continues, are not commented because their functions are self-evident and the label names reflect their respective purposes. In the spirit of friendly competition, we have, in this issue, the Ontario 3 virus written by Death Angel of YAM. While on the topic of YAM, we find it immensely amusing that they continue to adamantly state on FidoNet and elsewhere that the IVP was not a mere hack of PS-MPC. Ok, it was a rewrite in Pascal, but the only significant changes were in the labels; even the comments were remarkably familiar. Please cease this farce; you are fooling nobody. 0000............................You are here 0001............................Virus creation aids 0002............................Phalcon/Skism Shiny Happy virus 0003............................RNA virus source code 0004............................ARCV Busted 0005............................Green Caterpillar Debug Script 0006............................Virus Spotlite: Bad Boy 2 0007............................A Case Against Encryption 0008............................Ontario 3 source code 0009............................40Hex Survey
40Hex - Volume 3, Issue 2 (June 1993)
Welcome to 40Hex, the industry-standard virus information magazine, brought to you by your friends at Phalcon/Skism, where our mottoes are "We don't care" and "We write viruses until we're blue in the face and green in the eyes." Once again, we continue to bring you only the best in virus news, programming, and miscellaneous source code. We welcome our newest member, Priest, who has written a number of advanced viruses. The source code to one of his viruses, Predator, is included in this issue. Also in this issue is Dark Angel's Multiple Encryptor (DAME). This is one of the more advanced polymorphic routines available. Since source code is included, you'll probably see SPEW (Sweet Potato Encryption Writer) coming soon to finer P0taT0 boards near you. Well, enough ranting -- enjoy the magazine! -)Gheap 0000.................This file, of course. 0001.................Today's Phalcon/Skism Gripe 0002.................Advanced Polymorphism Primer, Part 1 0003.................Phalcon/Skism Trigger Virus & DAME Source Code 0004.................Virus Censorship (Gripe Part II) 0005.................Virus Spotlite: Leech 0006.................Fun with System File Tables 0007.................SVC 5.0 disassembly 0008.................Predator Source Code
40Hex - Volume 3, Issue 3 (December 1992)
Welcome to 40Hex issue 12. This issue confirms that we are no longer in our hibernation period (i.e. laziness). We have been out of the virus scene for quite some time, due to physical circumstances beyond our control. We have done a lot of reorganization, and trimmed our fat a little bit. You can expect a lot from us in the upcoming year, and I can assure you, you won't be dissappointed. Due to the large gap of time between issue 11 and issue 12, some of the information in here may be a little outdated. We are going to get a little bit more political then we used to be, but we will still keep cranking out the high quality technical information that you all enjoy. I would strongly recommend that you don't skip over the political parts of the magazine, because there are people who want to make laws that will affect every reader of this magazine. On a completely seperate note, we can now be reached via Internet. If you have any comments about the magazine, news articles, editorials, etc. we'd like to know, and we'll probably put all of the interesting letters into the magazine. Email us at: fortyhex@mindvox.phantom.com ->GHeap 40Hex-12.000....................We're ba-ack 40Hex-12.001....................DAME Source 'Updated' 40Hex-12.002....................40Hex Hardcopy Rumors Confirmed 40Hex-12.003....................A Self Dis-Infecting .COM File 40Hex-12.004....................AIS BBS Commentary 40Hex-12.005....................Natas Virus By Priest 40Hex-12.006....................A Commentary by Sara Gordon 40Hex-12.007....................Nympho Mitosis 2.0 Debug Script 40Hex-12.008....................Viruses In The News 40Hex-12.009....................OS/2 Virus Source
40Hex - Volume 4, Issue 1 (May 1994)
No, we are not dead. We are however insanely busy. This upcoming year will be a legendary year for P/S with regards to various programming projects. Can I tell you about them? Yes, but I won't. I will say that we will be contributing immensely to the virus community. Notice, I did not say Vx. Whenever I refer to the virus community, I am not refering specifically to virus writers, virus collectors or Vx BBS sysops. I am refering to everyone who has an interest in viruses. Whether its stopping them or making them. It may be a split community, but I still percieve it as ONE community. I am not going to ramble, I am not going to ramble... Anyway, enjoy the issue. If you like this magazine, please let us know. Email: fortyhex@phantom.com Snail Mail: ---------- 40Hex P.O. Box 252 New City, NY 10956 40hex-13.000.............You're soaking in it! 40hex-13.001.............Letters To The Editor/Virus News 40hex-13.002.............Self Dis-Infecting .EXEs 40hex-13.003.............Removing Scan Strings From F-Prot 40hex-13.004.............Paul Fergusons Response to 40H12 40hex-13.005.............Mirror Virus Courtesy of TridenT 40hex-13.006.............Shifting Objective 3 Virus 40hex-13.007.............TiC's 40hex Index #1 40hex-13.008.............New Feature: This Old Virus.
40Hex - Volume 5, Issue 1 (April 1995)
Knowledge is Power