6 ms·

For me my reversing started and ending with discovering and documenting the List of Lists: https://fd.lod.bz/rbil/interrup/dos_kernel/2152.html https://fd.lod.

For me my reversing started and ending with discovering and documenting the List of Lists: https://fd.lod.bz/rbil/interrup/dos_kernel/2152.html https://fd.lod.bz/rbil/interrup/dos_kernel/2152.html That allowed TSRs to do clever things. I didn't use CP/M before DOS, but these days I know all about the PSP via writing code for CP/M, in Z80. Kinda impressive how long all these backwards compatibility things last.

mickeyp 4y ago
One of the first things I looked up, as a budding Turbo C developer in the DOS era, as it held all manner of secrets. I seem to recall 'one guy' had this hand-curated master list of interrupts. Might've been this list; perhaps another. I was obsessed with TSR programs back then. The notion that you can run a background process (in exchange for gobbling up all-valuable conventional memory) thanks to clever hacking really captured my eye back then.
- mrlonglong 4y ago
  Chap you're referring to is Ralf Brown, he published a list of all known interrupts. It is on the web https://www.cs.cmu.edu/~ralf/files.html https://www.cs.cmu.edu/~ralf/files.html
  - ksaj 4y ago
    There was a pair of books that were instrumental to me: Undocumented PC and Undocumented DOS. Those books taught me so many tricks! I still remember the DWIM (Do what I mean) interrupt they used as the demonstration of how each interrupt was documented.
    - rasz 4y ago
      The Undocumented PC, A Programmer's Guide to I/O, CPUs, and Fixed Memory Areas by Frank van Gilluwe is great. Frank van Gilluwe is the author of Sourcer disassembler https://corexor.wordpress.com/2015/12/09/sourcer-and-windows-source/ https://corexor.wordpress.com/2015/12/09/sourcer-and-windows...
pizza234 4y ago
> the List of Lists: > https://fd.lod.bz/rbil/interrup/dos_kernel/2152.html https://fd.lod.bz/rbil/interrup/dos_kernel/2152.html > That allowed TSRs to do clever things. I think they were also used (=manipulated manually) by viruses, in order to prevent DOS from reporting the reduction in memory, and the user from noticing the virus.
- ksaj 4y ago
  Yes, stealth viruses did report memory without their space, by monitoring the read, and returning the "clean" value instead. Boot sector viruses couldn't do anything like that because they load and run before DOS enters the picture. So that was one of the things my boot sector looked for. File infectors had a number of tricks at their disposal, one of which you just mentioned. Other methods are still similar, just different means to that end.

mickeyp 4y ago

One of the first things I looked up, as a budding Turbo C developer in the DOS era, as it held all manner of secrets. I seem to recall 'one guy' had this hand-curated master list of interrupts. Might've been this list; perhaps another. I was obsessed with TSR programs back then. The notion that you can run a background process (in exchange for gobbling up all-valuable conventional memory) thanks to clever hacking really captured my eye back then.

mrlonglong 4y ago
Chap you're referring to is Ralf Brown, he published a list of all known interrupts. It is on the web https://www.cs.cmu.edu/~ralf/files.html https://www.cs.cmu.edu/~ralf/files.html
- ksaj 4y ago
  There was a pair of books that were instrumental to me: Undocumented PC and Undocumented DOS. Those books taught me so many tricks! I still remember the DWIM (Do what I mean) interrupt they used as the demonstration of how each interrupt was documented.
  - rasz 4y ago
    The Undocumented PC, A Programmer's Guide to I/O, CPUs, and Fixed Memory Areas by Frank van Gilluwe is great. Frank van Gilluwe is the author of Sourcer disassembler https://corexor.wordpress.com/2015/12/09/sourcer-and-windows-source/ https://corexor.wordpress.com/2015/12/09/sourcer-and-windows...

pizza234 4y ago

> the List of Lists: > https://fd.lod.bz/rbil/interrup/dos_kernel/2152.html https://fd.lod.bz/rbil/interrup/dos_kernel/2152.html > That allowed TSRs to do clever things. I think they were also used (=manipulated manually) by viruses, in order to prevent DOS from reporting the reduction in memory, and the user from noticing the virus.

ksaj 4y ago
Yes, stealth viruses did report memory without their space, by monitoring the read, and returning the "clean" value instead. Boot sector viruses couldn't do anything like that because they load and run before DOS enters the picture. So that was one of the things my boot sector looked for. File infectors had a number of tricks at their disposal, one of which you just mentioned. Other methods are still similar, just different means to that end.