Back to home page

DOS ain't dead

Forum index page

Log in | Register

Back to the forum
Board view  Mix view

Aha! Share was a *red herring* ! Hunt over !!! (Miscellaneous)

posted by ecm Homepage E-mail, Düsseldorf, Germany, 15.12.2009, 23:05

> > This either points directly to the DOS code segment
> > or to one of the stubs in the DOS data segment. You can identify the
> stub
> > and if it's one, you have to retrieve the address that it jumps to in
> its
> > last instruction; this address points to the DOS code segment.
>
> Those stubs are NOT used and the segment therein is bogus whenever DOS=LOW
> and no XMS is loaded.

Yes. In this case, the jump at 0:C0 doesn't point to the stub. It points directly into the code segment, as I said above.

> And what if the motherf^cker of a user you have in
> mind (the one who devloads FIXWRAP) also messes with int 30 ?

No one messes with Int30.

> I chose int 27 because it leads us almost right to the point of interest

Yes it does. But if you were to use the CALL 5 entry pointer anyway it would be more convenient to use it for this purpose as well instead of tracking down the (used or unused) Int27 stub in the DOS data segment.

---
l

 

Complete thread:

Back to the forum
Board view  Mix view
22049 Postings in 2034 Threads, 396 registered users, 311 users online (1 registered, 310 guests)
DOS ain't dead | Admin contact
RSS Feed
powered by my little forum