Groups > comp.os.msdos.programmer > #1407

Re: detecting emulation or console windows

From	"Rod Pemberton" <dont_use_email@xnothavet.cqm>
Newsgroups	alt.lang.asm, alt.os.development, comp.os.msdos.programmer
Subject	Re: detecting emulation or console windows
Date	2014-06-10 17:37 -0400
Organization	Aioe.org NNTP Server
Message-ID	<op.xg9cz8fm6zenlw@localhost> (permalink)
References	<op.xgqwuvss6zenlw@localhost> <Yenjv.83978$Mk4.8955@fx12.iad>

Cross-posted to 3 groups.

Show all headers | View raw

On Tue, 03 Jun 2014 13:04:56 -0400, Wildman <best_lay@yahoo.com> wrote:

> I'm not sure how far you want to take this but something else
> occurred to me that might be of interest.  That is checking
> for a shelled process, i.e., command.com running within
> command.com.  This code will check for that.  All numbers
> are hex.
>
> Start:
>          push  ds           ; Save data pointer
>          xor   ax,ax        ; Get segment pointer to COMMAND.COM from
>          mov   ds,ax        ;   interrupt vector table and save it on
>          mov   ax,[0ba]     ;   the stack
>          push  ax
>          mov   ah,51        ; Get pointer to PSP of this process
>          int   21
>          mov   ds,bx        ; Get pointer to parent
>          mov   ax,[16]
>          pop   bx           ; Get COMMAND.COM's segment pointer
>          cmp   ax,bx        ; Should be the same as the parent
>          je    NotShelled   ; Jump if a shelled process
> Shelled:
>          pop   ds           ; Restore data pointer
>           .
>           .
>           .
> NotShelled:
>          pop   ds           ; Restore data pointer
>           .

Hey, are you still around?

First, I'm trying to make sense of the "0ba".  If "0ba" is a specific
value, what is it, or what was it supposed to be? ...

My personal notes indicate that MS-DOS v7.10 doesn't hook vectors 0bh
or 0ah.  They also indicate that 0bah is in a reserved region of the
IVT.  Also, I don't see any others which are hooked by DOS that have
an 'a' or 'b' in the interrupt vector.  I.e., any of the reasonable,
potential vectors I can think up, that would be indicated by "0ba",
seem to be unlikely to contain a segment for COMMAND.COM ...

 From what I can find, DOS supposedly returns the segment of
COMMAND.COM for interrupt vectors when returned by the Int 21h,
AH=35h function call.  This is apparently an undocumented feature.
I've not found anything indicating a direct read of a segment from
the IVT returns the segment of COMMAND.COM.

Which version and make of DOS?

 From RBIL Table 01378:

...
PSP+16h "segment of parent PSP"
...
PSP+2Ch "DOS 2+ segment of environment for process"
...

Is Int 21h, AH=51h, return value BX "segment of the PSP for current
process" any different from the value at PSP+2Ch?  Supposedly, the
segment of the current process' PSP is also passed in DS when the
DOS program starts.

Am I getting different segments mixed up here?

Do you need to compare the segment for COMMAND.COM with the segment
for the parent?  If the process is only a parent, won't the segment
of the parent be identical to the segment for the process?

Rod Pemberton

Thread

detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-05-31 18:31 -0400
  Re: detecting emulation or console windows Ross Ridge <rridge@csclub.uwaterloo.ca> - 2014-05-31 19:59 -0400
    Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-05-31 20:54 -0400
      Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-05-31 21:43 -0400
        Re: detecting emulation or console windows "James Harris" <james.harris.1@gmail.com> - 2014-06-01 22:48 +0100
          Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-02 00:46 -0400
            Re: detecting emulation or console windows "James Harris" <james.harris.1@gmail.com> - 2014-06-02 06:15 +0100
              Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-02 03:21 -0400
                Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-02 03:32 -0400
                Re: detecting emulation or console windows "James Harris" <james.harris.1@gmail.com> - 2014-06-02 09:51 +0100
                Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-02 09:27 -0400
                Re: detecting emulation or console windows "James Harris" <james.harris.1@gmail.com> - 2014-06-02 17:05 +0100
                Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-02 19:25 -0400
                Re: detecting emulation or console windows "James Harris" <james.harris.1@gmail.com> - 2014-06-04 07:55 +0100
                Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-04 03:20 -0400
      Re: detecting emulation or console windows Ross Ridge <rridge@csclub.uwaterloo.ca> - 2014-06-01 14:03 -0400
        Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-02 00:53 -0400
          Re: detecting emulation or console windows Ross Ridge <rridge@csclub.uwaterloo.ca> - 2014-06-02 15:55 -0400
            Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-02 19:27 -0400
              Re: detecting emulation or console windows Ross Ridge <rridge@csclub.uwaterloo.ca> - 2014-06-03 17:00 -0400
  Re: detecting emulation or console windows Sjouke Burry <burrynulnulfour@ppllaanneett.nnll> - 2014-06-01 06:25 +0200
    Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-01 02:50 -0400
  Re: detecting emulation or console windows "James Harris" <james.harris.1@gmail.com> - 2014-06-01 07:53 +0100
    Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-01 04:53 -0400
      Re: detecting emulation or console windows "James Harris" <james.harris.1@gmail.com> - 2014-06-01 20:57 +0100
        Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-02 00:48 -0400
      Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-02 03:20 -0400
  Re: detecting emulation or console windows JJ <duh@nah.meh> - 2014-06-02 03:43 +0700
    Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-02 00:34 -0400
    Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-03 07:06 -0400
      Re: detecting emulation or console windows JJ <duh@nah.meh> - 2014-06-03 20:25 +0700
  Re: detecting emulation or console windows "wolfgang kern" <nowhere@never.at> - 2014-06-03 20:52 +0200
  Re: detecting emulation or console windows "James Harris" <james.harris.1@gmail.com> - 2014-06-03 22:59 +0100
    Re: detecting emulation or console windows CN <qmbmnp3799@pacbell.net> - 2014-06-03 18:39 -0700
      Re: detecting emulation or console windows "James Harris" <james.harris.1@gmail.com> - 2014-06-04 07:06 +0100
        Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-04 03:07 -0400
          Re: detecting emulation or console windows "James Harris" <james.harris.1@gmail.com> - 2014-06-04 09:16 +0100
  Re: detecting emulation or console windows "James Harris" <james.harris.1@gmail.com> - 2014-06-03 23:00 +0100
  Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-06-10 17:37 -0400
    Re: detecting emulation or console windows Wildman <best_lay@yahoo.com> - 2014-06-11 00:37 +0000
      Re: detecting emulation or console windows "Rod Pemberton" <dont_use_email@xnothavet.cqm> - 2014-07-27 12:11 -0400

csiph-web