Text 17127, 72 rader
Skriven 2006-04-03 21:01:46 av mark lewis (1:3634/12)
  Kommentar till text 17120 av Russell Tiedt (5:7105/1)
Ärende: What Is This???
=======================
 EV>> I've had this tagline for a long time but I don't know what it does.

 EV>> Could You or anyone else enlighten me?

 EV>> I know it must be something dangerous.

 EV>>  * SLMR 2.1a #T348 * It's scary when you see B8 00 4C CD 21 and
 EV>> understand

 RT> Memory says it is a debug script, that maybe formats your HDD
 RT> or ovewrites you MBR or some such ....

i dunno about script but you can do it in debug... i've done them in debug so
as to be able to save them as a .COM file and then simply run them... i haven't
sat down and actually keyed in the above to see what it is doing but i wouldn't
go any higher than 286 opcodes... possibly 486 but it is doubtful...

my first impression was, with that 21 up there, that it was an INT21 call but
my mind's eye tells me that INT21 calls would represent "21" in HEX instead of
decimal O:)

[minutes pass]

however, it seems that my first impression is spot on ;)

===== quote =====

C:\>debug
-e 100
0AD3:0100  00.B8   00.00   00.4C   00.CD   00.21
-u
0AD3:0100 B8004C        MOV     AX,4C00
0AD3:0103 CD21          INT     21

===== quote =====

it =IS= an INT21 call... now to dig in ralf brown's Interrupt List...

[minutes pass]

ahh! it is the "old" terminate process / end program code ;) O:)

===== quote =====

INT 21 - DOS 2+ - "EXIT" - TERMINATE WITH RETURN CODE
        AH = 4Ch
        AL = return code
Return: never returns
Notes:  unless the process is its own parent
        (see #1032 [offset 16h] at AH=26h), all open files are
        closed and all memory belonging to the process is freed
        all network file locks should be removed before calling
        this function
SeeAlso: AH=00h,AH=26h,AH=4Bh,AH=4Dh,INT 15/AH=12h/BH=02h,INT 20,INT 22
SeeAlso: INT 60/DI=0601h

===== quote =====

i knew i recognised it but it has been a very long time since i played with
that ASM level style code :)

FWIW: when i _first_ saw the above tagline and comments, i actually thought it
was one of the reboot calls... somewhere around here, i have a few 4byte (or
so) .COM files that reboot the system... one does a "cold" reboot while another
does a "warm" reboot... another that i remember having did a reboot that
stopped/froze at some point before the actual OS loader code was read from the
bootdrive... that one took me forever to figure out the problem and where the
stoppage was occuring O:)

)\/(ark

 * Origin: (1:3634/12)