Date: Wed, 26 Nov 1997 12:53:22 -0800 (PST)
Message-Id: <199711262053.MAA16581@adit.ap.net>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: "Packard" <packard AT blueriver DOT net>, djgpp AT delorie DOT com
From: Nate Eldredge <eldredge AT ap DOT net>
Subject: Re: Quake.exe: not COFF
Precedence: bulk

At 11:50  11/25/1997 -0500, Packard wrote:
>BTW, I'm saying Win95 MAY or MAY NOT create viruses from file fragments.
>IE4, without the new patch, can create a virus on the fly if you connect to
>a certain server type, who's path contains more than 255 char.
>
>Also, Could COFF stand for 'Quake.exe: not Clear Of File Fragments'?
No. COFF is DJGPP's object file format, which originated on Unix. It stands
for "Common Object File Format." It is converted into an EXE file by
prepending a small stub, which switches to protected mode and loads the COFF
image. If it examines the COFF image and can't find all the necessary magic
bytes, it says that it is "not COFF." This is why the virus topic came up; a
virus could change the COFF image in the file, causing it to be
unrecognizable as such.

Nate Eldredge
eldredge AT ap DOT net