Old Malware, New Tools: Analyzing Commodore 64 Viruses with Ghidra
Cesare Pizzi uses NSA Ghidra and custom 6502 plugins to reverse engineer vintage Commodore 64 malware, uncovering surprising polymorphic complexity.
Summary
The Historical Architecture of 8-Bit Malware
In the 1980s and 1990s, early virus writers developed ingenious, ultra-compact malicious code operating under severe memory constraints (64 KB RAM).
Configuring Ghidra for MOS 6502 Architecture
Cesare Pizzi demonstrates setting up custom Ghidra processor modules and loader plugins to analyze Commodore 64 disk images (D64) and PRG binaries.
Dissecting Vintage Polymorphic and Stealth Viruses
Pizzi walks through reverse engineering classic 8-bit malware, analyzing disk drive controller hooking, interrupt hijacking, and memory-resident stealth techniques.
Timeless Lessons in Reverse Engineering
The author shows how analyzing constrained retro architectures sharpens modern binary analysis intuition and reverse engineering skills.
Related talks
Creator Stage·22 min
Max 'Libra' Kersten
Demonstrates how to generate and distribute custom FunctionID and BSim symbol databases in Ghidra to accelerate reversing stripped Go binaries.
Main Stage·44 min
Wesley McGrew
Wesley McGrew uses Commodore Amiga 16/32-bit vintage computing environments to teach foundational reverse engineering and exploit development using Ghidra.
Main Stage·39 min
Agostino Panico
Presents a dynamic analysis framework for automatically unpacking and deobfuscating nested virtual-machine-based software protectors used in advanced malware.