Back to home page

DOS ain't dead

Forum index page

Log in | Register

Back to the forum
Board view  Mix view

the DOS code segment hunt, results/questions (Miscellaneous)

posted by cm(R) Homepage E-mail, Düsseldorf, Germany, 14.12.2009, 23:30

> 2: :-| DOSDATA:90h. There are 15 far pointers who seem to point to
> DOSCODE always. I could use that, the infortune is I cannot find reference
> data about them. They don't seem to appear in Ralf's list. Geoff probably
> knows better, are you listening Geoff ?

Look for SHARE.EXE hooks; they're listed in the Int21.52 (DOS data) description. These hooks are either addressed with fixed offsets or by finding the first SFT container (segment must be the DOS data segment). The latter's offset is 0CCh, and just in front of it are the SHARE.EXE hooks.

Installing SHARE.EXE is legitimate under MS-DOS 7.00 and might work with a specially written FAT32 SHARE.EXE under MS-DOS 7.10+. (Microsoft simply omitted SHARE.EXE from MS-DOS 7.10 and never provided a FAT32 version.) Therefore, all of these pointers could be hooked by SHARE.EXE pointing to its segment instead of the DOS code segment.

> 3: WRING! see update below : DOS CS is kept near the start of IO.SYS
> data area @ 0070:0003. This location is apparently properly updated by DOS
> each time it moves its code during initialisation. It works also in DOS 8
> (CS=FFFF)
>
> [update] Is was too good to be true. I had yet to check DOS 7.0/Win 95
> A... Ooops! Method 3 fails there...
>
> OK, that leaves us with method 2. I have not seen a configuration of
> 95/95B/98SE where the fifteen FAR pointers starting @offset (90h) in DOS
> data segment did not point to the DOS CODE. Please speak up, whoever finds
> otherwise!

I'd say you should try working with method 3; MS-DOS 7.00 probably stores the code segment somewhere around there as did earlier and later versions. Method 2 might not be reliable especially with MS-DOS 7.00 due to SHARE.EXE being provided by Microsoft there.

---
l

 

Complete thread:

Back to the forum
Board view  Mix view
15116 Postings in 1359 Threads, 249 registered users, 14 users online (1 registered, 13 guests)
DOS ain't dead | Admin contact
RSS Feed
powered by my little forum