Shareware Overload/ShartewareOverload.cdr/progm/funkybox.zip/DISKMOD.DOC

Text File | 1983-05-02 | 7KB | 133 lines

***************************************************************

    WELCOME TO DISK MODIFICATION WITH DEBUG -- A TUTORIAL
               -- UNERASING A SMALL FILE --

***************************************************************

               PEOPLE SYSTEMS,LTD. (C) 1983

IF YOU'VE GOT THE TIME ---- WE'VE GOT DE-BUG --- or so the jingle goes.
The whole subject of DEBUG could fill a full disk and then some. Some
folks have gotten into dumping the contents of memory, (even the ROM)
and probably have tried to make a fix or two on their programs. But the
subject is complex and the more you do the better you get.

In SAVEDLIN.TBX we discuss running EDLIN in the DEBUG environment to
keep from losing our files IF we get a DISK FULL report. There is
also another technique which is worth getting familiar with and that is
recovering a small file (<512 bytes) which was just erased in error.

The disk must not have been tampered with or SAVEd over since the
erasure. In fact, this technique should be practised so that you will
be able to perform it correctly the  first time you need it.

To play it safe, any DEBUG operations should be performed on a tempo-
rary disk, just in case the directory gets all screwed up. So pull out
the disk with the erased file and DISKCOPY it onto another disk, first.
Mark the original erased disk and put it away. We will show you how to
recover the erased file and then you can copy it back onto the original
disk after you are satisfied that it is correct.

When a file is erased, DOS makes one directory change -- it changes the
first letter of the name to a &H E5 which is a greek symbol σ (small
sigma) but DEBUG helps by printing a small  e  in its ASCII translation
or  CHR$(101) + 128 = &HE5 or 229. DOS also releases the clusters after
the starting one that is shown in Directory. We will not try to unerase
anything but the starting sector in this program. But if you are inter-
ested in further exploration, take a formatted/s disk and SAVE an
ASCII text file onto it which uses several sectors ( each 512 Bytes ).
Go DEBUG and print out the FAT and the Directory sectors with DEBUG.

Now erase the file and go into DEBUG again and compare your print-out
with the new conditions in FAT and Directory. Try it with and without
doing a CHKDSK after erasing. Each FAT entry is 12 chars in HEX. The
last cluster used ( in our case the first cluster) times 1.5 produces
an offset into FAT using the whole number result of the multiplication.

Did you find out if there was any information remaining in FAT that
could be reconstructed for the erased file? The only alternative left
is to take the next logical choice and try the next sectors in orderly
sequence. It is a monumental task if they are scattered through the
disk, but it might be worth your trouble if the file is that important.

With DEBUG you can load 80 sectors from the disk and view them with
a dump command noting the addresses of those that belong to the file
and then rebuild the file a sector or two  at a time, using write
commands when you find the correct sectors. Peter Norton's UNERASE
makes this much easier to do.

See the IBM DOS manual for instructions for computing the next cluster
number. Appendix C pages 6-9.

If you don't have a specific file already erased to practise on -- just
erase one on the DISKCOPY to experiment with. If you have a NORTON
DISKLOOK utility you can verify these operations and check your work
by an independent means. (In fact, if you have a NORTON UNERASE you
probably have done this operation without knowing what had happened.)

Use your DOS disk to load DEBUG without any parameters. When you get
the DEBUG prompt (a hyphen) put your DISKCOPY into Dr A: and type
this command exactly as shown here   -L  04B5:0100  0    3   4  <ENTER>

The command above means  L (load)  04B5:0100 (hex addr)  0 (Dr A:)
sector 3 (start) sectors 4 (load 4 sectors from disk). Remember the
address and the sectors must be in HEXadecimal. The S.S. directory is
contained in absolute sectors 3,4,5,6. So the HEX is the same as
decimal. You will find this all explained in your DOS manual.

Meanwhile back at the range -- we can now safely Dump the memory sector
that we loaded from the directory with the  command  -D 04B5:0100 in
DOS 1.1 and subsequent  -D  <ENTER> will move us through the directory
until we find our file with the missing first letter and a little  e
in place of the letter that belongs there.

Check for a corresponding  E5  in the  bytes to the left of the ASCII.
Now note the correct address of byte you want to change. The address
shown in the offset (to right of the colon) starts at the first byte
to the right of  offset. Count them across in HEX 0 1 2 3 4 5 6 7 8 9
A B C D E F and you should be to the end of the row. Notice the hyphen
in between the first 8 bytes and the last 8 bytes. (Each line is a HEX
paragraph (16 bytes) and is identified by the last 0 in the offset,
which is generally omitted in IBM-PC addressing of 1 Mbyte with FFFF.)

Write down the address 04B5:HHHH of the E5 that must be changed to lets
say an  "F" . Now check it for accuracy one more time. We are ready.

At the DEBUG prompt hyphen type in this command   -E 04B5:HHHH "F"
and enter it. It says E(nter) at HEXaddr 04B5:HHHH "F" the HEXcode for
"F".   Study the DEBUG commands we are using if you are not familiar
with them in detail.

Now lets see what we did. Type at next hyphen prompt -D 04B5:HHHH and
enter it and you should see a dump beginning with the line you changed.
Check it carefully. Is everything just the way it was except for the
change from  E5 to  46  (in HEX) if so, you are ready to close, Doctor.

The process of writing the sectors back to the disk is just the same
as loading them into DEBUG. Compare the format of the WRITE command
with the LOAD command in DEBUG and you will find OPTION 1 (which we
used) identical. Type at the hyphen  -W 04B5:0100 0 3 4  and enter.
The disk will whir and the light will light and we will now QUIT
DEBUG with  -Q and try  A>DIR to see what IBM-PC hath wrought.

YUP -- There it is -- isn't it? That was easy enough to do over again.
Pick another file and try the same procedure, but this time monitor it
with Peter Norton's DISKLOOK to see how you are progressing.
Remember you are probably only saving the starting sector (up to 512
bytes).

DOS 2.0 may produce a segment address that is different from 04B5:0100
please, get familiar with it so that when you need it you will be
prepared.

You can print out a copy of the D(ump) before and after modification
simply by pressing Shift and pressing PrtSc at the same time. Keep it
for your records. Save it with a hard copy of this program. Of course,
to print-out this in DOS enter   A>type  DISKMOD.DBG <Ctrl-PrtSc>

Happy DEBUGGING !