Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 10-28-2006, 12:15
Zest
 
Posts: n/a
How to use EXECUTE interrupt?

Hi,
This is the interrupt I want to use.
But I don't know what DS: DX should point to.

What's "DS: DX = pointer to an ASCIIZ filename" ?
Is there anybody who can explain and let me know what ASCIIZ filename is?


Quote:
*************************************
INT 21,4B - EXEC/Load and Execute Program

AH = 4B
AL = 00 to load and execute program
= 01 (Undocumented) create program segment prefix and load
program, but don't execute. The CS:IP and SS:SP of the
program is placed in parameter block. Used by debuggers
= 03 load program only
= 04 called by MSC spawn() when P_NOWAIT is specified
DS: DX = pointer to an ASCIIZ filename
ES:BX = pointer to a parameter block

*************************************
Also here is another code.


Code:
pushad
mov     eax, cr0
push    eax
and     eax, 0FFFEFFFFh
mov     cr0, eax

;/////PUT PATCH CODE HERE/////

pop     eax
mov     cr0, eax
popad
Usng this code cause an exception in the program.
How can I apply this code withput getting any exception?
Also does changing the behaviour of CR0 register cause any problem for other programs or not?
I mean is this register global for all processes or is it just for the process that I'm running and changing CR0 in it?


Thanks in advance.
Regards,
Zest.
Reply With Quote
  #2  
Old 10-28-2006, 18:00
MarkusO
 
Posts: n/a
An "ASCIIZ" String means nothing more than an ASCII String terminated by a "zero". It works just like normal C strings or like the "PCHAR" type in Pascal.

The "MOV" instruction with control registers can be only executed at a privilege level 0 or it will cause an general protection error. If you are trying to execute it at Ring-0, it may still crash with invalid bit combinations in CR0.

But honestly I think you have no idea what you're doing and just found a few pieces of code which looked "cool" to you.
Reply With Quote
  #3  
Old 10-29-2006, 02:30
Zest
 
Posts: n/a
Hi Markus,
Thanks for explanation.
In fact,you are really frank.(That's what I appreciate indeed).
The piece of code you see is not written by me.
The coder of this snippet of code had claimed that
every one could use this code to patch a program which is running.
So I decided to use this method and see if it's possible and doable.
Now,you say that I should run this code in Ring0.
So I just don't know how to switch to Ring0 when I'm in Ring3 executing and
running my program in which this snippet of code is implemented.
I hope there is a way to switch to Ring0 and apply the patch to the running program
and then come back to Ring3.
If so,let me know how.

As for the first part,I want to ,make a file with Overlay.
That's why I asked about EXECUTION INTERRUPT.
What I understood from your post is that something like the following code should do the task.

Code:
.DATA

FileName BYTE    'a.txt',0
Ptrfn      DWORD FileName

.CODE

lds dx,Ptrfn
Let me know if I have made a mistake.

Best Regards,
Zest.
Reply With Quote
  #4  
Old 10-29-2006, 02:48
deroko's Avatar
deroko deroko is offline
cr4zyserb
 
Join Date: Nov 2005
Posts: 217
Rept. Given: 13
Rept. Rcvd 30 Times in 14 Posts
Thanks Given: 7
Thanks Rcvd at 33 Times in 16 Posts
deroko Reputation: 30
why don't you use CreateProcessA/W apis to execute program instead??
cr0 - write protection bit is used when you need to patch in r0 memory instead of changing protection in pde/pte... if you wanna patch in r3 then simple use WriteProcessMemory and VirtualProtectEx... of course, if you wanna make your patch "sticky" then you might wanna check anti-bpm by yates or this article from codeproject : http://www.codeproject.com/system/NoDeleteDelay.asp
__________________
http://accessroot.com

Last edited by deroko; 10-29-2006 at 03:11.
Reply With Quote
  #5  
Old 10-29-2006, 07:01
Human
 
Posts: n/a
int 21 is from dos and you dont use it anymore in windows, dos is dead.
there isnt any way to switch to ring0 in xp, 9x is very easy.
only way to use ring0 is code your own ring0 driver aka .sys
but deroko already told you best way from ring3.
ds is data segment used in dos. now they all point into same segment.
in 64bit env they are dead due amd and intel used cs ds es fs gs segment bits for memory range. to not change gdt table item size, so we saved 3 bits and can page 8x more memory. dont waste time for old and useless things
Reply With Quote
  #6  
Old 10-29-2006, 12:46
Zest
 
Posts: n/a
Hi,
Thanks for your explanation.
The code I use is for DOS and I just want to learn how we can implement Overlays.
That's why I asked for help and ofcourse I can't use CreateProcessA/W apis.
The purpose is just learning and understanding the idea of overlays in DOS.
Also thanks for explanation of 64bit environments.

Regards,
Zest.
Reply With Quote
  #7  
Old 10-29-2006, 20:33
Human
 
Posts: n/a
and where you use it? i think vista will not even have dos
Reply With Quote
Reply


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Load and Execute unsigned code into kernel in Windows 10x64 TechLord General Discussion 1 03-12-2017 16:30
How to execute a snippet of code before the main execution! Android General Discussion 8 10-04-2006 01:22


All times are GMT +8. The time now is 22:46.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( 1998 - 2024 )