In article <1165427824.464910.256120@[EMAIL PROTECTED]
>,
g*****ca <pg*****ca@[EMAIL PROTECTED]
> wrote:
>Ok. I need to know when a program reachs certain location in its code.
>I dont have the source of it, so my idea:
>This is a piece of the code. I need to know when the program reachs
>address 071a:0d3c.
>I wrote a tsr with a int60h handler, and change address 071a:0d3c to
>call int 60h. (cd 60).
>
>071A:00000D37 50 PUSH AX
>071A:00000D38 51 PUSH CX
>071A:00000D39 52 PUSH DX
>071A:00000D3A 56 PUSH SI
>071A:00000D3B 57 PUSH DI
>071A:00000D3C 33 DB XOR BX,BX (Change this
>to CD 60) <<<<<<<<<<<<<<
>071A:00000D3E B9 F0 03 MOV CX,03F0
>071A:00000D41 BA 83 07 MOV DX,0783
>071A:00000D44 B3 03 MOV BL,03
>071A:00000D46 E8 E7 00 CALL (+00E7)
>071A:00000D49 8A 1C MOV BL,[SI]
>071A:00000D4B E8 E2 00 CALL (+00E2)
>071A:00000D4E 02 FB ADD BH,BL
>071A:00000D50 46 INC SI
>071A:00000D51 E2 EE LOOP (-12)
>071A:00000D53 5F POP DI
>071A:00000D54 5E POP SI
>071A:00000D55 5A POP DX
>071A:00000D56 59 POP CX
>071A:00000D57 58 POP AX
>071A:00000D58 C3 RET
>
>Good, now i can do anything when the program gets there. Then, at the
>end of my int, i do the xor bx,bx and push it to the stack, so the
>program can continue with its bx =3D 0. Int handler is written in c++,
>doing those regular pushes and pops.
>
>void interrupt int61(void)
> {
> a++;
> asm pop bx;
> asm xor bx,bx;
> asm push bx;
> }
>
>Not working. I disassembled my int handler and it looks fine, the
>assembly flow is ok.
Show us the assembly code for int61() (you said int60() above??).
Without the actual assembly code, we'd only be guessing.
>My question is what could go wrong here? Could my int be changing flags
>or any other things? Also, could I use dos ints from my int in that
>case? (Like fopen, fwrite...) I know this procedure isn=B4t called from
>any other int.
If this program is running as a normal DOS app at the time your hook gets
control, you can do pretty much anything that app could do (if not
everything).
========= For LAN/WAN Protocol Analysis, check out PacketView Pro!
=========
Patrick Klos Email: patrick@[EMAIL PROTECTED]
Klos Technologies, Inc. Web: http://www.klos.com/
============================================================================
|
