For Beginners & Professional Hackers

home *** CD-ROM | disk | FTP | other *** search

/ For Beginners & Professional Hackers / cd.iso / software / debug / qa90 / qa.doc next >

Wrap

Text File | 1990-03-18 | 37.7 KB | 757 lines

Quaid Analyzer May 1988 This progran allows diagnosis of programs for IBM computers, especially programs for which the source is unavailable, or which contain countermeasures to thwart tracing of their functions. You can single step thru a program and follow the processor instructions and registers. Virtually all areas of memory are available for your inspection. Common Keys These keys are effective everywhere. ESC This will get you out of an area and eventually bring you back to the Main Menu. F1 Help key F2 Brings up Instruction Display F3 Vector Display F4 Trace Display F5 ACSII Table F6 Users Screen. This is what was interrupted. F7 Exit. This is the same as selecting EXIT TO USER at the Main Menu when QA has intervened, or the same as EXIT TO DOS when QA is in temporary memory. PGUP Up one line PGDN down one line HOME Cursor to top or back one screen END Cursor to bottom or foward one screen. Invoking Quaid Analyzer You have to pay attention to where Quaid Analyzer is located in memory, since it must not interfere with the software being diagnosed. The command QA at the DOS prompt puts Quaid into temporary memory. You will see the Main Menu. Temporary memory is relinquished when you select EXIT TO DOS. The command QA followed by a hexadecimal interrupt number (5 is most common) puts Quaid into permanent memory with the specified interrupt patched. You will see the DOS prompt almost immeadiatly. Therafter, Quaid Analyzer will intervene whenever the patched interrupt occures. Quaid will remain memory resident until you reboot or you select EXIT TO DOS on the Main Menu. When running QA from permanent memory, interrupt 5 is the most convient patch. Then you can press PRTSC to bring up Quade Analyzer. Main Menu The Main Menu lets you select one of the functions of the Quaid Analyzer. Continued pressing of ESC will bring up the Main Menu from anywhere in Quaid Analyzer. DESCRIPTION The Main Menu has a column of functions, and for most of the functions, one or more options to the right. Some fixed information appears to the left of a vertical bar. Some of the functions, such as BREAKPOINT, appear only when they are allowed. MENU KEYBOARD CONTROL Quaid uses a Main Menu, and several other screens where you have the option of moving a cursor and selecting functions. You may find the method of control to be unfamiliar, but when you learn it you can operate it quickly. In general, you press the four cursor arrows to get to a function or an option, press + and - to the right of the numeric keypad to change an option, and press ENTER to carry out a function after you have set its options. You can control lots of options without a cluttered screen. UP & DOWN KEYS Use these keys to choose a function. LEFT & RIGHT KEYS For the functions that have more than one option, use these keys to highlight one of the options. + - Use these keys to change an option after you have reached it. Be sure to use the + and - to the right of the numeric keypad, not the typewriter keys with the same symbols. ENTER Use ENTER to carry out a function after you have set its options. ESC Get directly to the EXIT function. 0 to F When a number appears in an option, you can change it with these keys. The key you press is appended to the end of the number. BACK When the cursor is on a number or the File Name, this key erases the last character. MENU FUNCTIONS EXIT Select this function to get out of Quaid Analyzer. The options are: - TO USER. When QA intervenes in a user program, EXIT TO USER resumes execution of the interrupted program as if QA had not intervened. - RESIDENT. Select this option to get QA to use the terminate process and remain resident function, putting it in permanent memory. Thereafter, QA will intervene any time one of the patched interrupts occurs. - TO DOS. This option relinquishes the permanent or temporary memory occupied by QA. BREAKPOINT When you have set permanent breakpoints, you can choose any breakpoint by pressing + . ENTER shows you the chosen breakpoint on the Instruction Display. AUXILIARY Using the options, then ENTER, you can get reports showing the state of your computer. - MAP. Shows the DOS memory allocation. - UART. Shows the registers in the two serial ports. Reading the IIR, interrupt identification register, clears any interrupts pending, so the state of the serial port may change as a result of the display. This is usually not serious. - DISKETTE. Interprets the contents of the diskette parameter area, pointed to by vector 1E hex. - DRIVERS. Displays a list of device drivers known to DOS. - CMOS. Shows your computer from ROM identification byte. - SCREEN. Displays screen mode from BIOS info. PORT At this line you may read, change, or monitor the contents of any i/o port. The first option may be: - OFF. Does nothing - READ. ENTER reads the port, displaying it's contents. - WRITE. ENTER writes the data value to the port. - TRACE. ENTER runs the user program until the user refers to the port. The Trace option does not appear in temporary. The trace will not stop when the port reference occurs in a lower level of interrupt service, or if it occurs after an event that ends single stepping. You should get near the your problem using other methods before using TRACE. The second option is the data value to be sent to the port, or the value read in from the port in hex. The third option is the port number in hex. To the right of this field is the name of the device on the port. FILE Use this function to read and write DOS files. The first option may be: - ENABLE. Quaid can intervene while DOS is in operation, and at such times it is impossible to read or write files. When you select ENABLE, Quaid exits to the user until DOS reaches a point where it can be called. Quaid patches interrupt 28 hex DOC scheduler, to find out when it is safe to call DOS. - OFF. This function does nothing. - READ. Read an entire file into memory. You can also read part of a file. - CREATE. Create a new file. The actions above take place when you press ENTER. The second option, File Origin, is the memory address corresponding to the beginning of the file. Use H to change between decimal and hexadecimal. The P key puts the data point (from the Program Display) into the File Origin. The third option is the length of the transfer. For READ, this is normally TO END,meaning that the whole file is to be read. To read only part of it, put the cursor on the length field and press W, then edit in the length. To reduce interference with the program being traced, we do not use the interrupts for getting control of DOS errors. Consequently, you may see the message Abort,Retry,Fail? on the screen. A will abort the program being traced. To avoid problems, you should make sure the file you want to use will not cause errors before using the file facilities. FILE NAME This appears only when the first File option is READ or CREATE. Key in the file name here. Be sure to include the drive and directory path as part of the name, because you have no control of what the current DOS defaults are. Use the BACK key to correct mistakes in the name. HELP This is just a license screen. The LIGHT BULB option sets the entire screen to its brightest value, to help you read your notes when you work past sundown. SCREEN The first option is FAST or SLOW. On the IBM CGA Fast will produce snow. Use RIGHT ARROW to get samples of the colors used for Quaid displays. You can change the colors with + and - or ENTER. Program Display The Program Display shows the processor registers, and lets you see memory as text or instructions. you can change the contents of memory or the registers. The F2key brings you to the Program Display. The display is subdivided into a register area, always visable, and the Instruction Display, Memory Display and Reference Display, which overlay each other. REGISTER AREA Press ESC from the Memory Display or the Instruction Display The left side of the screen shows the names and values of the processor registers and a few other fields. The lines marked DATA and CODE are called the data point and the code point. (These fields are used to move to other memory locations) Below cs:ip is the sixteen bit flags register, with the bit names above each. You can change these bits the same way you change the other registers. Below the flags is a search field. + changes this between hex and text format. To key in a search field in either format, press INS, then type in your search string. Do not press ENTER after the search string. The hex string is in Arabic form, right to left. Search for occurences starting from the data point by pressing L . When you search for a string that does not occur in the remainderof the data segment, nothing changes. The register values that you work with on this screen will be restored to the procesor registers when you select EXIT TO USER. When running from tempory memory, the registers are meaningless and will never be used. You can change the registers in these ways: -With the cursor on a register (the code and data points are the safest ones), press INS. The word EDIT flashes on the right. Key in a new hexidecimal value. Move the cursor away and the flashing EDIT disappears. -Move the cursor to any register(except flags or search). + moves the register and the segment to the data point (for the registers above DATA) or or the code point (for the ones below CODE on the display). + can also copy between the code and data points. -When you leave the Vector Display, the interrupt on the cursor line replaces the code point. REGISTER KEYBOARD CONTROL Arrow Keys Move cursor. When you move the cursor right from the data point, you get the Memory Display on the right (ECS gets you back). when you move the cursor right from the code point, you get the Instruction Display on the right. INS Start (or stop) Editing. Use this when you want to change a register.The word 'edit' flashes on the screen. 0 to E Use these keys to edit the new hex value of a register. The new digit goes on the low order end or the value + Move the register to the code point or the data point. For most of the data registers, the segment register on the same line comes to the code or data point along with the data register. When the cursor is already in the code point, the + key copies it to the other. + At the search field, change between text and arabic form L Find the next occurance of the search string (locate). The search begins at the data point, and continuesuntil the end of the segment. When there are no occurrences, the data point remains unchanged. R Produce the REFERENCE DISPLAY. INSTRUCTION DISPLAY You get here by pressing RIGHT ARROW from the code point or F2. Sometimes Quaid reverts directly to this display upon intervention. DESCRIPTION The INSTRUCTION DISPLAY shows the instructions in memory in a form resembling the Intel assembly language. DETAIL: We have modified the instruction mnemonics where necessary. Where Intel uses WORD PTR or BYTE PTR to specify operand length, we put .w or ,b after the opcode, for example Intel MOVE BYTE PTR[17],45 becomes move,b[17],45. We show the rep prefix as a separate instruction. The segment prefixes are combined with the following instruction,for example, move ax,[cs:bx+12]. Intel uses JUMP , CALL and RET for several different instructions. We use JUMP , CALL and RET for the near versions, within the same segment, and JUMPF , CALLF and RETF for the far versions, to another segment. The forms of RET and RETF that add a constant to the stack are distinguished by showing the value of the constant as the operand. When Quaid displays instructions starting from the wrong address, edit a correct starting address at the code point and press RIGHT ARROW. INSTRUCTION KEYBOARD CONTROL UP and DOWN ARROWS Use these keys to move to neighboring instructions. When you move the cursor off either end of the screen, the screen scrolls. ESC and L ARROW Either of these keys moves the cursor back into the register area. ENTER Set a permanent breakpoint. Later when the user program resumes, you will get a report when the user reaches the breakpoint. DEL Remove a permanent breakpoint. S Run one instruction of the user program, but stay in this screen. The code point must be the same as cs:ip to use this key. I Give control back to the user, but intervene after the next IRET instruction. This is usefull when invoking Quaid with PRTSC. Pressing F2 and I will get you out of the BIOS, to the point where the keyboard interrupt intervened. DOS 3.3 replaces the vector for interrupt 9 with its own procedure, so you have to press I twice to get to the true point. G Give control back to the user, but intervene when he reaches the instruction at the cursor. R Produce the Reference Display. MEMORY DISPLAY To see the Memory Display, press the RIGHT ARROW at the data point. DESCRIPTION: Memory appears in one of three forms: -Text, left to right. -Arabic form, showing hexadecimal characters left to right. The letters a to f are in lower case. -Roman form, showing hexadecimal characters left to right. To help you distinguish Arabic and Roman, the letters A to F of the Roman form are in upper case. MEMORY KEYBOARD CONTROL ESC Move the cursor to the register area. + - Switch the display form. Pressing + repeatedly will cycle thru the three forms. ARROW KEYS Move cursor. INS Start editing. After you press INS the word EDIT flashes on the screen to warn you of danger. Your next keystrokes will go directly into memory. If you mistakenly type into a sensitive area, your computer will stop immeadiatly. In Arabic and Roman form, any of the hex digits 0 to F go into memory. In text form any of the typewriter keys go into memory. Press ESC to end editing. L Find the next occurence (locate) of the search string. The search begins at the cursor, and continues untilthe end of the segment. When there are no occurences,the cursor does not move. G Run the user (the program being analysed) until a given memory byte changes. Just point to a byte and press G. You will see the Memory Display just mafter the byte changes. Note: This facility uses the single step. You should get close to the problem area with other methods before using G. REFERENCE DISPLAY The Reference Display shows all mof the places in memory that refer to the code point. Press R in the Register Area or Instruction Display to get the Reference Display. DETAIL: References include short jumps within 128 bytes, near jumps and calls in the current segment, interrupt vectors, and complete segment:offset pairs anywhere in memory. It is possible for a jump or a double word pointer to reach the code point using a different segment. These references are not shown. TRACE DISPLAY Each time Quade intervenes in an interrupt, it adds to the report on the Trace Display. The screen shows a history of up to 25 lines of interrupts. After you have traced at least one interrupt, F4 gets to this display. DESCRIPTION: Here is the meaning of the fields on the trace display, left to right: - A line number - The interrupt number, sometimes preceded by asterisks, showing you the nesting level. Precisely, the asterisks show the number of return proxies active. - An interpretation of the meaning of the interrupt. This display is extensive for interrupt 21 hex, DOS call, and brief for the interrupts without assigned functions. - When you used the proxy type IN/OUT or SILENT, Quaid will, when possible, put the result on the same line with the interrupt entry. When not possible, the result goes on a line of it's own, right justified. A few of the interrupts create special displays, as mentioned below. Keyboard Interrupt 9 For this interrupt, we list the contents of the keyboard buffer, in hex, at the completion of the interrupt. Asynchronous Interrupts For these interrupts, except the keyboard, we display the cs:ip value of the interrupted program. Watching the timer interrupt with the SILENT proxy will show you where your computer is spending most of it's time. Diskette The Trace Display line for the diskette interrupts, 13 and 40 hex, looks like this: 13 BIOS disk read a:0.0.1.2 9.27.255 0070:0281 meaning: operation drive C H R N EOT.GPL.DTL data buffer The fields from operation to DTL will be presented to the Floppy Disk Controller in the order we show them. They mean Cylinder (Track), Head, Record (Sector number), N (length), EOT (highest sector number on track), GPL (gap length) and DTL (must be 255, according to Intel). On the newer editions of the ROM BIOS, the GPL field in the diskette parameters is ignored except for formatting. The information reported comes from the register arguments to the diskette interrupt, except for N, EOT, GPL and DTL, which come from the diskette parameters pointed to by interrupt vector 1E. Some copy protection systems use deceptive values in the arguments to the diskette interrupt. TRACE KEYBORD CONTROL ENTER This is the same as selecting EXIT TO USER at the Main Menu, that is, continue doing what would have happened if Quaid had not intervened. - After your are familiar with Quaid, you may spend a lot of time at the Trace Display pressing ENTER. You can get an accelerated trace by pressing -. You will be asked for a number, which you can put in with the digits 0 to 9, or modify with + and - or BACK. ENTER produces that many lines on the Trace Display before giving you another report. Use ESC to get out after pressing - by mistake. VECTOR DISPLAY This display shows you the interrupt vectors and Quaid Analyzer internal records called proxies. The F3 key gets to the Vector Display. This section is difficult. In Quaid, when you patch an interrupt, you attach a proxy to it. The proxy type determines what action Quaid will take when the user invokes the interrupt. We suggest you preview the section on Patch Proxies before trying to understand the screen or keystrokes. DESCRIPTION For each of the interrupt vectors or proxies, we show: -The interrupt number or proxy number in hex. Proxies are preceded by an x. - The companion interrupt or proxy. When you patch an interrupt, you associate it with a proxy. This field shows the other. - The type. This is active when you have patched interrupts. We say more about this later. - The vector contents. For interrupts, it is the value that would be in the vector without any patching. For proxies, this is the location that control would pass to if the proxy had not intervened. - The original vector contents, if different from the current value. When Quaid starts, it records each vector for this comparison. - For interrupts 8 to F only, the IMR, IRR and ISR bits. - The name of the interrupt. These names come from diverse sources, and include specialized interrupts used only on certain members of the IBM family, such as the PCjr or the PC AT. When you leave the Vector Display, the contents of the interrupt at the cursor replaces the code point of the Program Display. VECTOR KEYBOARD CONTROL UP & DOWN ARROWS Use these keys to move the cursor to a new interrupt or proxy.You can continue to scroll off the end of the screen. ENTER When used on an interrupt without a patch, ENTER patches the interrupt,changing it's type to PATCHED, attaches a companion proxy, and moves the cursor to the proxy. ENTER When used on the interrupt or proxy for a patched interrupt, ENTER moves the cursor to the other, the companion. + - Use these keys to change a proxy type. DEL Use this key to quash a proxy, or a patched interrupt. INTERRUPT VECTORS There are two interrupt types, in addition to blank (quashed): PATCHED This means you have asked for tracing. The companion proxy determines what kind of tracing you get. Quashing a patched interrupt is never dangerous. KEY This is the interrupt used for breakpoints. There is only one interrupt of this type. To move it, highlight it with ENTER,move it elsewhere with UP or DOWN , and deposit it with ENTER. When you press G at the Instruction Display, or use permanent breakpoints, Quaid temporarily inserts an instruction generating the KEY interrupt into the user program, removing it at the next intervention. For benign programs, interrupt 3 is the best KEY interrupt, because the instruction to invoke it is only one byte long. As a countermeasure, some programs frequently change the contents of vectors 1 and 3. You can change the KEY interrupt to something else to trace these programs. PROXIES Each proxie represents an address that can be placed in an interrupt vector, or can replace a return address on the stack. When the event occurs that would normally transfer control to the address in an interrupt vector or to a return address,the proxy will get controll instead. You will note that some of the functions below depend on fine details of the BIOS. If you have a compatable computer, you may find other problems with the most difficult interrupts. PATCH PROXIES These proxy types determine what action Quaid will take when a patched interrupt occurs. The proxy types are: IN/OUT Quaid reports just before, and just after, running the interrupt service. After the report of entry, Quaid runs the interrupt service just as it would run otherwise, except that the return address on the stack points to a RETURN proxy. IN Quaid reports just before entry into the interrupt service. After the report of entry, it gives control to the interrupt service with the stack exactly as it would have been without intervention. This is the most faithful emulation of the interrupt, and in difficult cases, it is the only kind possible. OUT Quaid reports upon completion of the interrupt service. Quaid runs the interrupt service with a proxy address substituted for the return address on the stack, so you can get a report on the interrupt return. Some programs treat the cs:ip value on the stack as a pointer to data. These programs cannot be traced with the OUT or IN/OUT proxies. RUN This applies only to the DOS call, interrupt 21 hex. Quaid will report on .com and .exe programs just before executing the first instruction. TROJAN This applies only to the BIOS disk interrupt, 13 hex. Quaid reports any attempt to alter the hard disk. If you want to go ahead with the alteration, press ENTER at the Trace Display when you get the report. If not, your safest course is to press CTRL-ALT-DEL to boot load your computer. Quaid examines the register contents at every occurance of the interrupt. An attempt to change a hard disk has dl>=128 and ah=3 (write), ah=5 (format) or ah=11 (write long). Service calls that don't change the hard disk run without intervention. We have been criticized for not patching interrupt 26 hex, but such a patch is unnecessary. The interrupt service for 26 must eventually call interrupt 13 to wite to the hard disk. SYSREQ This applies only to interrupt 15 hex. Quaid will give you a report when the SysRq key of the Personal Computer AT or PS/2 is pressed. This function does not work on the COMPAQ 286, because it issues the SYSREQ interrupt before sending the EOI to the interrupt controller. SILENT Quaid produces an entry line in the Trace Display before and after execution of the interrupt service, but does not give a report. The Trace Display can only be seen when another kind of report occurs. The SILENT proxy is usefull for interrupts (such as the keyboard) that are used by Quaid itself. The intervention is done in the same way as for the IN/OUT proxy, except that the REVERT proxy is used in place of RETURN. PASS Quaid executes the interrupt without any reports. When a program such as SideKick changes a patched interrupt, it saves a proxy, and will issue calls to the proxy indefinately. Setting the proxy type to PASS is the only way to turn off the reports. When the interrupt occurs, Quaid invokes the interrupt servive exactly as it would have been without intervention. STOP Quaid reports the interrupt, but does not invoke the interrupt service. The next EXIT TO USER resumes at the instruction following the interrupt call. This proxy is most commonly attached to the print screen interrupt. Thereafter, you can press PrtSc to invoke Quaid, without disturbing your printer. Since the interrupt service is never called, STOP will cause system failure when used at the wrong place. When the user program changes a patched interrupt, Quaid generates a new patch proxy, with the value in the new interrupt vector. If the action of the user was to insert a new value destroying the old one, it is safe to quash the old patch proxy. If the action of the user was to save the old value, and replace it with the new one, he will probably call the old proxy (which he thinks was the old interrupt vector contents) every time the interrupt occurs. In this case, it is not safe to quash the old proxy. Change it's type to PASS when you don't want to see any more tracing. You will see examples of this if you patch interrupts during the boot load. PENDING ACTION PROXIES There is another kind of proxy representing pending action. These are not companions of interrupts, but records of other kinds of things to be done. The pending action proxies are: CALL Quaid creates this on entry into an interrupt patched with proxy type IN/OUT. At EXIT TO USER, Quaid quashes the call and simulates entry into the interrupt service, but with the address of a RETURN proxy as the return address. ENTER Quaid creates this on entry into an interrupt patched with proxy type IN. At EXIT TO USER, Quaid simulates entry into the interrupt service and quashes the proxy. During a report you can change your mind and manually change between types CALL and ENTER, or quash either one, creating the effect of the STOP proxy. RETURN Quaid creates this when giving control to an interrupt service in cases where you want a report after the interrupt; you used proxy types OUT or IN/OUT. The proxy address substitutes for the return address on the stack. When the interrupt service returns, Quaid restores cs:ip and quashes the RETURN proxy. The stack with a RETURN proxy differs from the stack without intervention, so proxies OUT, IN/OUT and SILENT cannot be used on interrupts that use the cs:ip value on the stack as a data pointer. Sometimes the return never occurs, and the RETURN proxy remains in existence indefinitely. In that case you may quash it by hand. Be careful, because if the user later returns, you will have to boot load your computer. REVERT This is simular to RETURN, but since it is on behalf of the SILENT proxy, no report occurs. LOAD Quaid uses this as its internal record of a program load when you used the RUN proxy. You can only produce errors by quashing it. ASCII TABLE This display shows the graphic symbols for all 256 ASCII characters. You can also can see the character codes and scan code returned for any keystroke. Any ASCII character or keystroke can be sent to the user program. The F5 key brings up the ASCII TABLE. DESCRIPTION The main body of the display shows all 256 ASCII characters, arranged in a rectangle. Above is the character value in decimal and hex. TABLE KEYBOARD CONTROL ARROW KEYS Moves the cursor to any of the characters in the table. HOME Moves the cursor to the top. The scan code and character code of the keystroke will appear at the top of the screen. Use this to find out what your keyboard really generates. K Resume the user program, giving the character at the top of the screen as input. The scan code and character code go into the keyboard buffer, provided it is not full. If the last character was pointed to with the cursor keys, not proceded by HOME, it is the same as holding down the Alt key and keying in the character code, since the scan code is zero. DIAGNOSTIC EXAMPLE We will show here how to find a problem in a program, and correct it to your liking. For our example, we will use the COMP command of DOS. This example comes from DOS 3.30; for other systems, details such as instruction addresses may differ. When you finish a compare, DOS asks you whether you want to compare more files, making it easier to use a diskette system. On hard disk systems, the prompt is a nuisance, so we will go through the steps in finding and eliminating it. We show only the successful route to the solution, avoiding the unsuccessful efforts that are a part of any real diagnosis.With each step in our example, we show the keystrokes and explain what is being done. We need a simple way to get to the undesired prompt. COMP without parameters is not helpful, but COMP A A gets directly to the prompt 'Compare more files (Y/N)?' C>QA 5 Implant Quaid Analyzer in memory. PrtSc Bring up Quaid F3 Get to the Vector Display DOWN Hold this key until reaching interrupt 21 hex, DOS call. ENTER + Patch interrupt 21 with a RUN proxy. This tells Quaid to stop at the first instruction of the next user program. F7 Getout of Quaid, and return to the DOS prompt. C>COMP A A Start the compare program. Quaid will give you a report almost immeadiately, just before running the first instruction of COMP. F3 Get to the Vector Display. HOME Get to the line with the RUN proxy. - Change the proxy type of the patch on interrupt 21 to IN/OUT. From now on, Quaid will report before and after the COMP program does each DOS call. F4 Get back to the Trace Display. ENTER Press this several times, watching the Trace Display. Eventually, you will see some processing related to the desired prompt: 3b chdir 40 write handle 2 (20) crlf Compare more files (20) 40 write handle 2 (8) (Y/N)? (8) 0c clear buffer and keyin 01 ENTER The next depression of ENTER will bring you back to the user screen Control is in the keyboard processor of DOS, waiting for the response to the prompt. X Give an invalid response to the prompt. ENTER Continue pressing ENTER several more times. The Trace Display will continue with: 0c clear buffer and keyin 01 X 58 40 write handle 1 (2) crlf (2) 40 write handle 2 (20) crlf compare more files (20) 40 write handle 2 (8) (Y/N)? (8) 0c clear buffer and keyin 01 X 58 Ordinarily, you would run this again, and start to look at the code where it calls for the first write handle 2, but the write comes from a subroutine, and the following method is simpler. F2 Display instructions just after the X response. By looking up function 0C in the 'DOS Technical Reference', we find that the key you press in response to the prompt is in register al. You will see that the program is about to call a subroutine, and following that it converts the value in al to upper case with an AND instruction, and goes to one of three different places depending on the value in al: -a jump to 07BE, probably a large, outer, loop. -a jump to 0B2E, a small inner loop. -DOS terminate (int 20 hex) The values used to compare against al are not visible, because the program compares al to two memory locations. By looking in the memory locations, or by common sense inference, we see that the program does the big loop when you type Y, does the DOS terminate when you type N, and does the small loop when you type anything else. It looks like the way to eliminate the undesired prompt is to do the DOS terminate at the beginning of the small loop. By looking at the object program, we see that the hex coding for the DOS terminate is 20CD (with 20 at the higher address), and starting address of the small loop is cs:0B2E. F3 Get to the Vector Display. DOWN Hold this until reaching interrupt 21. DEL Quash the patch. Quaid will no longer intervene. F7 Get back to the COMP program. N Terminate COMP. If you are cautious, you will run the COMP again, but patch the first instruction of the short loop to 20CD when the program is loaded. We have done so, and found that the COMP exits without the undesired prompt. All that remains is to patch the com file with the DOS terminate instruction. When a com file is loaded into memory, it starts at address cs:0100. This means that the patch instruction, 20CD, goes in the file at hex address 0A2E, or 2606 decimal, that is, hex CD goes at 2606, and hex 20 goes at 2607. You can make the patch with the File menu function of Quaid Analyzer, or with a file utility such as Disk Explorer, Disk Mechanic or the Norton Utilities. The new program will compare files without giving a prompt. This typing project has been a long time coming and I just hope it is put to some good use. Beamer ______ ^ ^