How do memory resident viruses work?

Question

Two part question:

1-How do memory resident viruses stay in memory after the program which loaded them is finalized? If all memory is automatically deallocated by the OS once a program is finished, how could then the malicious code survive? Does it instead create a separate executable file which then runs in background then starts it? Or it corrupts the OS in some way?

2- How does the virus captures traps and interrupts or modifies the OS RAM bitmap? Shouldn't the OS forbid this?

From Tanembaums OS book:

"So far we have assumed that when an infected program is executed, the virus runs, passes control to the real program, and exits. In contrast, a memory-resident virus stays in memory all the time, either hiding at the very top of memory or perhaps down in the grass among the interrupt vectors, the last few hundred bytes of which are generally unused. A very smart virus can even modify the operating system's RAM bitmap to make the system think the virus' memory is occupied, to avoid the embarrassment of being overwritten.

A typical memory-resident virus captures one of the trap or interrupt vectors by copying the contents to a scratch variable and putting its own address there, thus directing that trap or interrupt to it. The best choice is the system call trap. In that way, the virus gets to run (in kernel mode) on every system call. When it is done, it just invokes the real system call by jumping to the saved trap address."

Answer 1

Two part question:

1-How do memory resident viruses stay in memory after the program which loaded them is finalized? If all memory is automatically deallocated by the OS once a program is finished, how could then the malicious code survive?

Here, you seem to imply that the virus is injected into the memory of some user-mode process that was created and managed by the operating system. I don't think this is the case that is being contemplated in Tannenbaum.

However, in this case, indeed, the virus may not survive when the program is terminated. Note also that there are some user-mode processes that do not terminate (e.g., certain services) so a virus could survive in such a process until reboot. Also, if the virus was injected by some watchdog program, the watchdog could re-inject after the program starts up again, or re-inject into some other program.

Does it instead create a separate executable file which then runs in background then starts it? Or it corrupts the OS in some way?

Yes, using a watchdog program that injects and monitors is one way to do it. Another method on Windows could be to use the Registry "Run" keys to launch the malware on boot. There are a variety methods to achieve persistence.

2- How does the virus captures traps and interrupts or modifies the OS RAM bitmap? Shouldn't the OS forbid this?

A user-mode virus would not be able to do this. But if the virus is operating in kernel-mode then in many systems it will be operating with all the same abilities as the kernel itself. Therefore, nothing is off limits and it can modify memory at will--including traps and interrupt vector tables, etc.