Windows’ Hidden Self Destruct Code

Windows’ Hidden Self Destruct Code

I come bearing good news. Today's sponsor, Fasthosts have gone all out,   and are offering one lucky person a dream PC setup worth up to five grand! There's a question you need to answer, so stay tuned and I'll ask it later! Imagine it's 1992 and rather than installing a fresh copy of MS-DOS 5.0 on your computer like a   good little person, you instead opted for a rival OS. All seemed dnady, until you went to install   Windows 3.1, and then you received THIS horrific error message.

 [panicked screams of disarray] Hello there, I'm Nostalgia Nerd, and today, we're looking at the AARD Code. If you watched my last video, you may be getting some dejavu, because we're back   on the subject of Digital Research DOS. What a time to be alive. Digital Research,   once the industry leader in Operating Systems had, by 1990, been on the back-foot for about 10 years;   ever since Microsoft Gazumped them by licencing 86-DOS and making a deal with IBM to have it the   cheapest choice on their IBM Personal Computer. They had been trying to claw back steadily,   but without too much success. You might think then that Microsoft would no longer see them   as a threat. Wrong.

 DR-DOS were still small-fry, but from 1990 to 1991 their   sales revenue doubled from $15 million to £30 million, and by the first quarter of 1992,   they were set to double that, yet again. The main driver for these sales were tech savvy PC vendors   and computer magazine journalists switching to what they deemed, a more favourable experience. To overcome Microsoft, Digital Research had been doing the only thing they could.   Make a better product. DR-DOS 5.0, released in May 1990 was just that. It was the first DOS   which allowed you to load drivers into both high and extended memory, saving vital conventional   RAM space.

 It also had a more pleasant command set and generally better utilities. It's success meant that Novell would purchase Digital Research with an agreement   on the 17th July 1991, worth $80million dollars.   Their plan was to heavily gear DR-DOS up for networking, posing an even more serious threat. DR-DOS 6.0, released in September 1991, also built upon the foundations of 5. It included   the TAXMAX task switching API, for a pseudo multitasking environment, a visual directory   manager and even SuperStor's on the fly disk compression. Something Microsoft hadn't even   considered at this point. 

All these factors meant that Microsoft were feeling some serious strain. Their initial response was to try and purchase Novell, but to no avail. In fact, Novell instead   made agreements with IBM to ship and promote DR-DOS with their systems, rather than MS-DOS. Microsoft's secondary plan was therefore to mount a somewhat more sinister plan,   based around Windows. After all, Windows was the future; THEIR future,   and so in the run up to releasing Windows 3.1, various meetings were setup and emails exchanged. // On the exact day that Novell purchased Digital Research, 

Jim Allchin, who was then in charge   of Microsoft's unreleased Cairo Operating System sent out an email voicing concerns   with Novell and IBM's partnership. The email mentions speaking to Novell about their plans,   about getting serious with their in-house networking efforts, and about including getting   Winball (which was the codename for Windows with Workgroups) into Windows 3.1 as soon as possible. But it's point (G) which is most of interest;

 "We consider changing our apps to not run unless the OS is our OS" This clearly sparked the imagination of many employees within Microsoft. Shortly after Brad Silverberg would sent email back to Jim, concurring his concerns with DR-DOS; "After IBM announces support for DR-DOS at Comdex, my best hunch is that they will offer DR-DOS   as the preferred solution. DR-DOS has problems running Windows today,   and I assume will have more problems in the future" But the thing is, DR-DOS didn't really have any issues running Windows at all. 

  That last statement seemed to be making a cloaked point, more than anything. Jim Allchin would respond "You SHOULD make sure it has problems in the future :-)" As the Autumn weather swept in, more members of Microsoft became convinced of this direction,   and an email was sent from Microsoft's Head of Development, David Cole; "We should surely crash the system... the approach we will take is to   detect DR DOS 6 and refuse to load. 

The error message should be something like   'Invalid device driver interface'. Maybe there are several very sophisticated checks   so competitors get put on a treadmill...Aaron R had some pretty wild ideas after three or so   beers. Earle H has some too.... the less people know about exactly what gets done, the better". This seemed to suggest, that if a user happened to be running DR-DOS, a error message   should appear on screen to stop the software from operating. // Over the next two months, somewhat thanks to those in disagreement in Microsoft,   the plan changed to make the error simply a visual one. 

  A fabrication that did nothing more than appear and then disappear. Microsoft's Vice President sent out an email advising the assigned developers   [the code detecting DR-DOS]"better be perfect. Otherwise you could be in a heap of trouble" The aforementioned Aaron Reynolds set to work implementing it... and as requested,   it was cleverly hidden and thoroughly encrypted. 

This DR-DOS bomb was included   in the Christmas beta version of Windows 3.1. Here then, was a GUI designed to completely elevate itself from what had gone before.   Truetype fonts were added, 386 Enhanced mode was added, up to 4GB of memory could be utilised,   file manager was overhauled, icons could be dragged and dropped for the first time   and importantly, stability was far superior to that of Windows 3. Of course, that is, unless you were running DR-DOS, just like those PC vendors,   journalists and prominent PC advisors who thought that DR-DOS was the way forward.   

Until they loaded their beta copies of Windows 3.1,   and received an error message that Microsoft DOS users just weren't getting. Did DR-DOS have some serious problems running Windows? Of course it didn't. DR-DOS was perfectly compatible with Windows   3.1, and the stability was as good under DR-DOS as it was under MS-DOS. The message would   appear and then vanish. But the misinformation spread through the tech industry regardless. AS you might expect, Digital Research and Novell were completely denied access   to beta copies of Windows 3.1, but were simply able to circumnavigate the issue   by working with DR-DOS users who WERE Windows 3.1 beta testers.

 Through this   means, they quickly rolled out, what they called, a Windows 3.1-compatible "business update",   which bypassed the issue, and prevented the error from displaying. This wasn't the days of on demand internet access though. Updates weren't simply pushed out on the   fly. Users could download the update from the DR forum on Compuserve if they had access and indeed,   wanted to, but the damage was done. All this roll-out seemingly achieved, was   to compound the fact that it was a Digital Research problem, not a Microsoft one. In February 1992, Senior VP, Brad Silverberg sent out an email to the highest ranks   of Microsoft confirming the strategy;"What the guy is supposed to do is feel   uncomfortable, and when he has bugs, suspect the problem is DR-DOS and then go out to buy MS-DOS,   or decide not to take the risk for the other machines he has to buy in the office".

 and indeed, it was working. By the fourth quarter of 1992, many manufacturers has erred on the side   of caution and decided to bundle MS-DOS. sales of DR-DOS had dropped from $15 million to only $1.4   million. Users were switching back to MS-DOS 5, or simply waiting for the newly announced   MS-DOS 6.0, due in the first quarter of 1993, disk compression included. Now of course, some people got wise to this situation pretty quick,   and in fact, by April 1992, people outside of Microsoft were starting to document the code   and its workings. Geoff Chappell was one of those people,   

and if you visit his website geoffchappell.com, he documents the discovery process in some detail. In April 1992 Geoff was emailing back and forth with Andrew Schulman, regarding some   new updates included with Windows 3.1. Namely the Himem.sys driver, which replaces the current DOS   version on installation and allows programs to store data in Extended memory. This information   was for their respective books, Undocumented Windows, by Andrew and DOS Internals by Geoff. On the morning of the 17th April Geoff fired off an email regarding "a large amount   of really stupid code (lots wasted, some encrypted with XOR)" in Himem 3.03. By the evening,   he had written a procedure to activate this obfuscated code. Following this, on 8th June 1992, Geoff would publish a message on the CIX conferencing system,   this time regarding the Windows 3.1 exectuable itself, Win.com. 

It details how the code checks   for readings on various input devices, and that if they all return values that   agree with a standard MS-DOS install, then no error is activated. However, some non Microsoft   versions of DOS (including DR) would return different values, thereby activating the error. Geoff writes how the code is littered with red herrings - long and convoluted operations   whose results are discarded, and how there is XOR encryption in place, seemingly designed   entirely to obscure this part of code. The only non encrypted part being the word AARD. AARD being the signature Microsoft developer Aaron Reynolds used to sign off his code. 

Geoff also notes that the Win.com he was inspecting would execute but not actually   act upon the code, and that's because, the code in the actual retail version of Windows 3.1   was deactivated. Of course, the damage had already been done in the beta, and so Microsoft tried to   cover their tracks and forget about the whole thing. But, significantly, if Microsoft felt   threated, it could be reactivated any time, by any update they wished to distribute. Writing in the Dr. Dobbs Journal, Andrew Schulman would expand on this investigation and   Geoff's work and define a crucial part of the AARD test which first checks whether a   network redirector is running, if so, then it checks the DOS default upper case map   is located in the DOS data segment.

 If it's not running, it checks that the pointer to the first   simulated file control block has a 0 offset. The crucial part here is that all versions of MS-DOS   pass this test, every time, whereas no version of DR-DOS does, simply due to the way its written. This code was built into other executables, such as the Windows setup program,   the disk caching utility Smartdrv.exe and even MSD.EXE, Microsoft diagnostics, all packaged   with Windows beta build 61 and the pre-release build 3.10.068, rolled out in January 1992.   All the errors are pretty similar and vague, but with different error numbers. // TECHIE QUESTION // THIS is NOT how to run a business. Come on you need to secure what's important.  

 Customers, brand, and your assets. Whether you're doing video production or cat grooming, every business needs a name,   A DOMAIN. Get your brand, it's important. Fasthosts makes it incredibly easy to find   and register your brand name with their domain names. Then backup your data. Don't keep all your videos on one crappy drive.   Use Fasthosts Cloud backup and get 5GB absolutely free. Now about that question I mentioned earlier; "According to, perhaps, urban legend, how much memory did Bill Gates claim   'ought to be enough for anyone'?" Answer that and you could win your dream PC. 

Come to think of it, I need a new editing PC. [Spooky sound] Enter at fasthosts.co.uk/nostalgianerd, where you'll also find all the terms. The link is below. // TECHIE QUESTION // So Microsoft had done it, they had won the battle, but maybe not quite the war. In 1995, several former employees of Novell setup Caldera inc. The objective of this   company was to create network utilities with a focus on the Linux operating system.   But seeking a DOS operating system to bundle with their OpenLinux distribution they would acquire   Novell DOS and the Digital Research on 23rd July 1996. This deal consisted of a direct payment of   $400,000 as well as percentage of DR-DOS royalties.

 But, on the same day of acquisition,   having acquired the rights, Caldera would launch an antitrust lawsuit against Microsoft. This was not just in relation to their AARD code, but also that Microsoft had combined MS-DOS 7.0   with Windows 95 to prevent DR-DOS substituting for MS-DOS. Caldera argued that "To create this illusion, Microsoft simply hid MS-DOS 7 behind the screen   of blue sky and white clouds displayed during the now-familiar Windows 95 startup process.",   and even went further to demonstrate that DR-DOS could be substituted   for MS-DOS using a tool they developed called WinGlue. Even though Microsoft claimed that Windows 95 was it's own, stand-alone operating system,   Caldera exposed the plethora of calls that were going on behind the scenes between   DOS and 7.0 and what was effectively, Windows 4.0.   Really, anyone who used Windows 95 will be aware of how important DOS still was in the process,  

 and how much Windows 95 actually got in the way of running anything particularly resource intensive. Of course Microsoft would dispute all of this, but it was perhaps Microsoft's own internal   communication that was most damming. In fact, as far back as 1992, Microsoft were talking about completely eliminating the rival   DOS problem. In June 1992, Brad Silverberg had distributed the "Chicago Strategy Document"; "Novell is after the desktop . . . . This is perhaps our biggest threat. We must respond in   a strong way by making Chicago a complete Windows operating system, from boot-up   to shut-down. There will be no place or need on a Chicago machine for DR DOS (or any DOS)." It was those same internal communications which bolstered Caldera's claims around the AARD code,   and their claims of Microsoft's illegal tying, monopolisation,   

exclusive dealing and tortious interference. The original case had been built on Geoff's and Andrew's analysis of the camouflaged code, but it   was these emails, exposed through a court request which really put the nails in Microsoft's coffin. The case rattled on until the 7th January 2000, with a trial penned in for the 1st   of February. However, with Microsoft also involved in other antitrust legal cases   (namely Netscape), they decided to settle with Caldera costing some $280million dollars. Bryan Sparks, CEO of Caldera commented; "We are pleased with the result of this lawsuit.   

We now look forward to vigorous competition in the marketplace   with our Linux products and strategies both from Caldera Systems Inc. and Lineo Inc.". Shortly after Caldera would spin out into various other companies, but would ultimately fizzle out. The DR-DOS assets fell to the Canopy group, and were aquired by DeviceLogics,   who shortly after incorporated as DRDOS inc. But, like so many cases involving Microsoft, the giant would rattle on,   and the subsequent companies around it would disappear. It's a sad end really. But hey, many of us are still here,   using Windows 10, and that's just the way the cookie crumbles. As or me, I'm about to install DR-DOS on some old computers. 

Thanks for watching. Have a great evening.