Media Share 9/MEDIASHARE_09.ISO/utility/dint_sw1.zip/DINT.DOC

Text File | 1993-07-13 | 32KB | 564 lines

         ╔═══════════════════════════════════════╗
         ║       DOS INterrupt Toolkit           ║
         ║       (c) 1992, 1993  Zen Works       ║
         ╚═══════════════════════════════════════╝


A long while ago, I realized that my aging brain could not possibly
retain all the DOS Interrupt 21h sub-function information that I
needed from time to time.

While I have a reasonably decent programmer's library, at least as
far as assembly language is concerned (never mind the wisecracks -
everything around here is done Quick-and-Dirty and I happen to LOVE
pasta, particularly spaghetti!), but the needed data is spread over
a variety of printed volumes as well as binary files such as Ralf
Brown's excellent Interrupt List, various virus disassemblies, and
the collected Virus-L Digests.

I needed one single reference that would provide the necessary
information to use and/or translate all of the Interrupt 21h
sub-functions, particularly those that are rarely used in the course
of my normal programming and virus disassembly.

About a year ago, I put everything on hold and went through every
bit of source material at my disposal, accumulating a collection of
the essential reference material on the INT 21h sub-functions.

Since there are definite limits to the amount of time available for
such a project, all INT 21h sub-functions utilized by Novell, and
any other network, were omitted.  Sorry, folks, maybe one of these
days, if there happens to be enough demand, but not now.

The result of my data collecting was DINT - a [D]os [IN]terrupt 21h
[T]oolkit, although I'm not certain whether the name `DINT' was
originally inspired by "what does that [D]amn [INT]errupt do?" or
by the "[DINT]y Moore" brand of Irish stew, given that DINT is also
a collection of odd ingredients from strange sources... <grin>

DINT exists in two parts, and is simple to use (remember, I wrote
it for my own use...  ,-> )  Type "dint" and press <Enter>.  Barring
a power failure or a lightning strike, you'll be presented with a
screen (Surprise!  You were expecting pizza, maybe?):-


╔══════════════════════════════════════════════════════════════════════════╗


              ╔═══════════════════════════════════════════════════╗
              ║       DOS INterrupt Toolkit  -  v.n.nn            ║
              ║       (c) 1992, 1993  Zen Works                   ║
              ╚═══════════════════════════════════════════════════╝

                 Quick reference for INT 21h sub-function calls.

                 [If registered copy, your name appears here]





Display an INT 21h sub-function   [D]
Scroll Virus Installation Checks  [V]
Test an INT 21h function          [T]
Quit program                      [Q]

╚══════════════════════════════════════════════════════════════════════════╝

where v.n.nn is the current version number.

Selecting the `D' option (yeah, you press `d' or `D' - DINT is dumb and
DINT don't care...) clears the screen and presents a single line:-

╔══════════════════════════════════════════════════════════════════════════╗




Enter sub-function in 4-digit hex mode:





╚══════════════════════════════════════════════════════════════════════════╝


which means just what it says.  If hexadecimal is a stranger to you,
what are you doing here?

For instance, if you want to see what the program termination function,
4C00h needs for calling parameters, enter `4C00'.  And here, a small
note of apology is in order.

I set DINT up to accept a 4-character hex input with the idea that one
of these days I might enhance the program to allow the user to input
sub-function requests down to the AL level, for example, 5801 - Set
memory allocation strategy.  You will discover, if you try it, that I
never did hone DINT down that fine, and it will default to AL being
equal to 00.  Put up with it.  Suffering builds character.

So assume we enter 7400:-
╔══════════════════════════════════════════════════════════════════════════╗


Enter sub-function in 4-digit hex mode:  7400


╚══════════════════════════════════════════════════════════════════════════╝


DINT will display the available information on that sub-function call:-

╔══════════════════════════════════════════════════════════════════════════╗


INT 21h Function 74h - Undocumented











Display an INT 21h sub-function   [D]
Scroll Virus Installation Checks  [V]
Test an INT 21h function          [T]
Quit program                      [Q]

╚══════════════════════════════════════════════════════════════════════════╝


Surprise!  In spite of the work of Ralf Brown and others, there are
still many functions whose purpose is unknown.  Microsoft may know
what some of these do, but Microsoft wasn't a major contributor to
this product.

And of course, DINT, being well behaved, returns the menu for your
further selection.

Repeating the `D' option, and this time choosing sub-function
4B00h produces a bit more information:-

╔══════════════════════════════════════════════════════════════════════════╗

INT 21h Function 4Bh - "EXEC" - LOAD AND/OR EXECUTE PROGRAM
    Call with AL = 00h "Load and Execute Program"
                   03h "Load Overlay:"
              ES:BX = seg:offset of parameter block
              DS:DX = seg:offset of program specifications
    Returns:  AX = error code if CF set

INT 21h Function 4B04h  VIRUS - "MG", "699"/"Thirteen Minutes"
                              - INSTALLATION CHECK
    Returns:  CF clear if MG resident
              AX = 044Bh if 699/Thirteen Minutes resident

INT 21h Function 4B05h - DOS 5.0 - SET EXECUTION STATE
    Call with DS:DX -> execution state structure
    Returns:  AX = 0000h
              AX = error code if CF set


Function has more screens.  Display them? [Y/N]

╚══════════════════════════════════════════════════════════════════════════╝

Pressing a `Y' or `y' will hopefully produce Yet Another Screen of
invaluable data for your perusal:-

╔══════════════════════════════════════════════════════════════════════════╗


INT 21h Function 4B25h  VIRUS - "1063"/"Mono" - INSTALLATION CHECK
    Returns:  DI = 1234h if resident

INT 21h Function 4B40h  VIRUS - "Plastique"/"AntiCad"
                              - INSTALLATION CHECK
    Returns:  AX = 5678h if resident

INT 21h Function 4B41h  VIRUS - "Plastique"/"AntiCad" - UNKNOWN
    Call with AL = 41h
    Returns:  ???

INT 21h Function 4B4Ah  VIRUS - "Jabberwocky" - INSTALLATION CHECK
    Returns:  AL = 57h if resident

INT 21h Function 4B4Bh  VIRUS - "Horse-2" - INSTALLATION CHECK
    Call with AL = 4Bh
    Returns:  CF clear if resident

Function has more screens.  Display them? [Y/N]

╚══════════════════════════════════════════════════════════════════════════╝


Any function that has more than a single screen of information
available will display the "Function has more screens" line,
leaving it up to you whether they are to be displayed or not.

Time for one other little quirk.  At the risk of sounding like
an echo in the Alps, DINT insists on a 4-character input.  So,
if you want to see the accumulated wisdom concerning sub-function
0F, `Open File', you must enter 0F00.

On the other hand, particularly for programmer types who know that
hexadecimal numbers must be input in odd ways, FORGET IT.  Here,
for example, if you want to explore sub-function FF, you merely
enter `FF00'.  FOUR characters only;  got it?


DINT includes references to INT 21h sub-functions used by assorted
DOS viruses.  Staale Fagerland suggested that it would be quite
convenient if one were able to scroll through those selected
sub-functions.  Since I've wished for the same feature many times
since DINT was originally written, I'm more than happy to comply
with his request.

Staale, this is for you:-

Select [V] from the menu, and you get:-

╔══════════════════════════════════════════════════════════════════════════╗

INT 21h Function 0B56h  VIRUS - "Perfume" - Installation Check
    Returns:  AX = 4952h if resident

INT 21h Function 0D20h  VIRUS - "Crazy Imp" - Installation Check
    Returns:  AX = 1971h if resident

INT 21h Function 30h  VIRUS - "Possessed" - Installation Check
    Call with DX = ABCDh
    Returns:  DX = DCBAh if installed

INT 21h Function 30F1h  VIRUS - "Dutch-555"/"Quit 1992" - Installation Check
    Returns:  AL = 00h if resident



Function has more screens.  Display them? [Y/N]

╚══════════════════════════════════════════════════════════════════════════╝

so you can at least scroll forward through the collected information
pertaining to DOS computer viruses.  Backward scrolling is NOT
available.  Don't ask.  Forget it.  Unless I get absolutely overwhelmed
with registrations and multiple requests for a backward scroll feature,
both of which are highly unlikely.


The [T] option, wherein the user can `test' an INT 21h sub-function is
only available in the registered version, and I'm not at all certain
it's a good idea, even then.



      WARNING!!!     WARNING!!!     WARNING!!!     WARNING!!!
      ~~~~~~~~~~     ~~~~~~~~~~     ~~~~~~~~~~     ~~~~~~~~~~

Use it entirely at your own risk.  Neither I nor Zen Works will accept
ANY responsibility for anything you manage to do to yourself, your
computer, some one else's computer, your neighbour's lawn, pet dog,
pet iguana, pet wife, antique auto, house plants, or innocent
bystanders.  If you choose to use this feature, you are absolutely on
your own.  We refuse to even send flowers.

After all that, if you do select the [T] option, you'll be presented
with a further warning screen:

╔══════════════════════════════════════════════════════════════════════════╗


                  WARNING!!  Selected functions are executed!


               This is NOT a simulation.  Use at your own risk!







[C]ontinue or [A]bort:


╚══════════════════════════════════════════════════════════════════════════╝

Means just what it says.  The sub-function you plug in here WILL be
executed on your machine.  You can create or delete a directory, a
file, or do anything of which the various sub-functions of DOS
Interrupt 21h are capable.

Entering an `A' (yes, evan an `a') will get you back to the menu.
Press `C' and there's no turning back.  Well, there are a couple of
ways.... which is why God gave us the Reset button and the 3-finger
salute....

The next screen to appear:-

╔══════════════════════════════════════════════════════════════════════════╗




    Enter Function number (hex) in AX
    Preloading other registers is optional - default values
    are 0000h with Carry Flag clear

Enter Function (4-digit hex mode) :





╚══════════════════════════════════════════════════════════════════════════╝

Again, the program wants input in four hexadecimal characters,
but here you can make use of the AL register by entering values
other than 0 as the last two hex characters.

At this point, there is one more way to get out.  Enter 4C00, the
DOS Interrupt 21h "Terminate" function, and you're back to the
DOS prompt.

Let us assume you want to see what, if anything, the undocumented
sub-function 9A00h actually does return:-


Enter Function (4-digit hex mode) : 9a00


DINT will then give you the option of preloading any value you like
in the other registers (all but CS, of course!).

╔══════════════════════════════════════════════════════════════════════════╗

    Enter Function number (hex) in AX
    Preloading other registers is optional - default values
    are 0000h with Carry Flag clear

Enter Function (4-digit hex mode) : 9a00

Preload any other registers? [Y/N]:




╚══════════════════════════════════════════════════════════════════════════╝

Press `N' at this point and DINT will execute an INT 21h, sub-function
9Ah, with the AX, BX, CX, and DX registers set to zero and the Carry
Flag clear.


Press `Y' and DINT will cycle through the registers, giving you the
opportunity to load any hex value you like into each of them:-

╔══════════════════════════════════════════════════════════════════════════╗


    Enter Function number (hex) in AX
    Preloading other registers is optional - default values
    are 0000h with Carry Flag clear

Enter Function (4-digit hex mode) : 9a00

Preload any other registers? [Y/N]:y

Preload BX register?  [Y/N] :


╚══════════════════════════════════════════════════════════════════════════╝

If you choose to load a value in a particular register, press `Y'
and you will then be prompted for the value:-

╔══════════════════════════════════════════════════════════════════════════╗

    Enter Function number (hex) in AX
    Preloading other registers is optional - default values
    are 0000h with Carry Flag clear

Enter Function (4-digit hex mode) : 9a00

Preload any other registers? [Y/N]:y

Preload BX register?  [Y/N] : y   Enter hex value:



╚══════════════════════════════════════════════════════════════════════════╝


If you attempt to preload the CS register, you will get a short
message telling you that sins of that magnitude are not allowed
in polite society.  ;-)


╔══════════════════════════════════════════════════════════════════════════╗


    Enter Function number (hex) in AX
    Preloading other registers is optional - default values
    are 0000h with Carry Flag clear

Enter Function (4-digit hex mode) : 9a00

Preload any other registers? [Y/N]:y

Preload CS register?  [Y/N] : y   Enter hex value: 0010
Set Carry Flag?       [Y/N] :
Sorry, CS manipulation will hang your system!



╚══════════════════════════════════════════════════════════════════════════╝

Note that subsequent Preload queries all utilize the same line,
overwriting the previously displayed line.  Pay attention!

And finally, you can choose whether to set the Carry flag or not.

Immediately that your choice of the carry flag setting is entered,
DINT will execute the requested INT 21h sub-function.  If your
selection wasn't entirely bizarre, and your system didn't hang as
a result, you should get a response screen:-


╔══════════════════════════════════════════════════════════════════════════╗


    Enter Function number (hex) in AX
    Preloading other registers is optional - default values
    are 0000h with Carry Flag clear

Enter Function (4-digit hex mode) : 9a00

Preload any other registers? [Y/N]:y

Preload CS register?  [Y/N] : y   Enter hex value: 0010
Set Carry Flag?       [Y/N] : n

    AX is now 9A00 hex                  BP is now   0000 hex
    BX is now 0010 hex                  CS is still 3D14 hex
    CX is now 0000 hex                  DS is now   3D14 hex
    DX is now 0000 hex                  ES is now   27C4 hex
    SI is now 0000 hex                  SS is now   27D4 hex
    DI is now 0000 hex

    Carry Flag is clear.

    Test again?  [Y/N]

╚══════════════════════════════════════════════════════════════════════════╝


There, wasn't that totally enlightening?  The value preloaded in
BX didn't change, the carry flag is still clear, and the values
of the CS, DS, ES and SS registers are simply the values that
DINT happens to be currently using.

A real Zen experience, huh?

Since the distribution copy of DINT is a compilation, amalgamation,
and accumulation of information from a wide variety of sources, some
copyrighted and some not, I can't ask for money.  Use it as you will,
distribute it as you wish.  Call my BBS and bitch, gripe, moan in
ecstasy, writhe, grovel, or leave comments.  Love to hear them.

If you're overburdened with the world's riches, donations are always
welcome.  How welcome?  Well, I wrote DINT on an XT-class machine,
and the BBS runs on a 12MHz 80286, if that gives you the picture...

However, the Test feature is only available in a registered version,
and for that I expect to be paid.  $20.00 gets you a 3.5" diskette
sent via ordinary mail anywhere.  Of that fee, $2.00 cover the code
and the balance is a meagre payment for writing the doc file.  The
family philosophy (yes, there's more of us!) is that it's enough for
a programmer to write and debug the code;  users shouldn't expect
documentation.  But they do.  $25.00 buys the same diskette via
registered mail.  The additional $5.00 also covers the aggravation
of my having to be awake in the daytime to go to the post office.

If you're bordering on the suicidal and have a compelling desire to
spend your hard earned money just to be able to do arcane and absurd
things to your system, make cheques (Yes, I'll accept personal
cheques - I've been stiffed for greater sums than twenty bucks and
managed to survive), money orders, cashier's cheques, or bank
drafts payable to R. W. Hale (that being the way I sign my name,
simply because it's shorter and quicker), and mail it, along with
your name spelled the way you want it to appear on the opening
screen, and your complete mailing address.

Mail to me at:-

        R. Wallace Hale
        P. O. Box 528
        Houlton, Maine
        04730-0528
        U.S.A.

Messages to me on Driftnet (my BBS) telling me "the cheque is in
the mail" will be ignored.  At least until the mail is delivered.


If any Canadian has read this far, and still has money left after
taxes, the price is the same in Canadian dollars.  But if you do
send Canadian money, you'd better have a Canadian mailing address!
<grin>

To answer a few questions that some one, somewhere, may be asking:-

NO!  I don not plan to create a TSR version.

No, I'm not aware of any conflicts between DINT and any TSRs, but
I don't use many TSRs, so I don't speak from any position of great
authority.

Upgrades?  Possibly, depends on my life span and what new data
becomes available.

Will upgrades be free to registered users?  I doubt it.  If enough
additional data becomes available to justify updating DINT, and if
more than two people have registered the program, I probably won't
be able to afford the distribution costs.  However, I will keep
the cost of updates to the absolute minimum.

Bug fixes?  Serious ones will be fixed on my nickel, but you may
have to call Driftnet to get the patched version.  Minor ones?
Depends on my workload.

Windows compatability?  I sincerely hope not!

An OS/2 version?  Why would you want it?

Network compatibility?  Perhaps by accident, but not by design.


- R. Wallace Hale

  13 July 1993




▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
█ ╔═══════════════════╦═════════════════════════════════════════════════╗ █
█ ║   Driftnet  BBS   ║   Free access at all levels.                    ║ █
█ ║ Woodstock,  N. B. ║   Download on first call, no ratios.            ║ █
█ ║  [phone]   ║   Extensive collection of the latest virus      ║ █
█ ║  Intel 14.4 v32   ║   information and anti-viral tools.             ║ █
█ ║     24 hours      ║   The virus research section is absolutely      ║ █
█ ║   Wallace Hale    ║   restricted to recognized members of the       ║ █
█ ║      Sysop        ║   AV community.                                 ║ █
█ ╠═══════════════════╩═════════════════════════════════════════════════╣ █
█ ║                           -= Zen Works =-                           ║ █
█ ╚═════════════════════════════════════════════════════════════════════╝ █
▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀