(x)1996 by MeteO

                               
                               v1.3.019 omega

 設⢮ pp p   室 ⥪⮢ pᮢ,
 p , p  ᭮  pp ᯥ祭
壠p᪨ pp.

  饥 p ᮢp 堪p ᯮ p p㬥p.
  p   ᭮ p㯯: ⫠稪 p쭮
p, ⫠稪 V86, p, ⮬᪨ pᯠ騪,
ᥬp  immortal-player'.  ᢮ p p  p㯯 
p  ᯮ騥 ⥪ ⫠ pp  ᯮ騥
. H  ᫥騥 ⫠稪:

                                 p㯯 I
                        ⫠稪 p쭮 p

1) Turbo Debugger by Borland International
   1988   pﬨ Chris'  Rich' Williams'
p ⢮ 訡, ⨢ ᯮ㥬 ⠬, ⠪ :
  a) ᯮ짮 ⥪ ⫠ pp
  b) ᯮ짮 int 1, int 3  pp
  c) p墠 pp뢠 int 0, int 1, int 3  FP p権.
  d) pp⭠ p  p
  e) pp⭮ ⠢ 砫 祭 pp
  f) p쭮 ᥬp p権  JMP $+1
API .

  p砩 p  p䥩ᮬ, p⠢
  pᬮp   室 ⥪ pp,
⭠p筮 , p (p 稨 ⫠筮 p樨),
ᮧ pᮢ, ⫨砥  ⥫쭮, 易 
窮 p.

2) CodeView by Microsoft
  ᢮ 訡 祬  ⫨砥  TurboDebugger'a. p
ᮡ⢥ p ⫠筮 p樨.  ᨫ p⢠ ᠬ p
⫠稪  pᯮᮡ  ⢥ p  .

3) AFD
   1988  H.Puttkamer' ⫠稪 p⠢ ᫥騥
: 蠣 p ᯮ p権, 蠣 ᯮ
pp, p 祪 ⠭  짮⥫᪮ 䠩, 
  , ᮧ pᮢ     䠩.  ᯮ짮 
⢥ p    p祭.

4) Debug

   ᠬ p ⫠稪, ⢮  IBM PC, 
⫠稪 DEBUG, ⠢塞  p樮 ⥬ MsDos. p 
訡 ⫠稪 p쭮 p.  饥 p  
ᯮ.

   pᬠp ᪨ ⫠稪 p쭮 p ⨯ Watcom
Debugger, Quaid Analyzer, Quaid Analyzer/386  Periscope  ᨫ  
ppp.

5) GameTools 3.00 -
 p: RealMode  V86, XMS  pᨨ 3.00x
 ⮨⢠:   p RM386 p, ᯮ짮 386DR, ᫮
p  pp뢠, p  離  譨 p, 让
쥬  ,  ᪮p ⠩p ( ⠭),
 ᢮        DosShell, p㧪
      ᫥饣 p  ⥪饩,
⠭ ⠭  .

 H⪨: p ⠭ p p, 
p  Novell Netware Dos Client - ᯮ짮  API  
pp뢠, p p㧪  p  XMS  墠뢠.
p祭:    pp, p RealMode  p,
 p  , 㭨  etc.


                                 p㯯 II
                       ⫠稪 饭 p

1) Turbo Debugger/386 by Borland International
 Hp  TD, p⠢ device-driver TDH386.Sys (p
p䥩 pp)  ᪠ pp TD386,  pp 
p V86.  p 訡 ᢮ p⢥.
p⠢  ⠭ p 祪 ⠭:  p饭
 ⥭/   , pp⨥ p饭  p⠬ ( ᥣ
pp⭮ p뢥).

2) Soft-Ice by Nu-Mega Techologies
 H  ⫠稪. p VCPI.
p ⠪ p 訡:
  a) H   stealth-⫠稪, ⠪  ⠢ ᮪
᢮   conventional memory V86 設.
  b)  API  pp  ⫠稪
  c) S-Ice  p㦨  p SOFTICE1
  d) p稪 LDR p쭮 ⠢ 祭 SP
  e) pp⭮ ⠢ 砫 祭 pp
  f)  裡  p㠫樥 p⮢ 横  p樨
       $1:      in      al, 60h         ; Read kbd port
                dec     al
                jnz     $1

p⠢ API p int 3, 㭪樨 09-13h. p ⫠
p Microsoft ('NB'  砫 ⫠筮 p樨), Borland (db
0FB52h)

3) Soft-Ice/W by Nu-Mega Techologies
 ⫠稪  Windows 3.xx.
p㦨  p⢨ VxD p⢠ WINICE. ᫥
p樨  cs:pushf.
 室  S-Iice/W   p 맮 int 2Fh  pp
AX = 1648h
BX = 0202h (WINICE VXD ID)
ES:DI = 0
᫥ 맮  ES:DI p頥 WINICE API entry point.


4) Deglucker by S.Gorokhov & A.Ilyushin
  訡:
  a) p祭  ⠭p p
  b) H p墠 p⮢ /뢮
  c) p p p i/o p⮢ 60h/64h
p⠢ API p int 15h 㭪樨 0FFxxh. pp pp p
DRx (p pp ⠭).


                                p㯯 III
                                 p

1) EDB by Serge Pachkovsky
 p 80286 pp. p 㡮 p䥩,  p DEBUG.
  pᬮp/ , ᪮쪮 p 樨.
 ppp.

2) Soft Debugger
 業 p 80386,  p 㭪権 饭 p.
p ⫠ p p Borland International.
᫥  ⮢  p,  ᪮쪮 p
樨:  맮 ᮡ⢥ int 1/int 3, p Full Tracing, Auto
Tracing  p㣨.
 ppp.

3) SD 2.33 by Dmitry Groshev

 祭 㤮   p. 祭    p 
ᠬ묨 pp묨 pp .

⥫ p:
- p p p p ⫠  p⬮
- p  y樨 pp  y᫮ ⨢樥 ⫠稪
- ﭭ p墠  14 pp뢠  y᫮ ⨢樥 ⫠稪
- p 15 pp  4 p p
- p  Pentium p  p /뢮
- ᯫ뢠   VGA/SVGA p  p p 
-      ᪥
-     ⥭  ᪠  
- ᮫⭮ ypᠫ  ᠭ y᫮ ⨢樨 ⫠稪
- p饭  HMA  Shadow RAM
- pp  25 K

p⥫ p:

-  ⢥ EMS-pp  ᯮ짮 ⮫쪮 Shadow-yp EMS
- "몮 ᠭ..."  設  (py COM-䠩)
-  p   ⥬ 
- yp ⫠ - 祢묨 蠬, p  50 権

 p   ᮡ: SD  py p y,
p⠢  p䥩  y    p ᯥ樠 y権
 饭  ᠬ ⫠稪.  ⠪ y  yp y᫮
⨢樥  "ppp pᬮp".  p 
p訩 p     y ᠭ  py ᯮ짮.


                                 p㯯 IV
                        ⮬᪨ pᯠ騪

  ⮬᪨ pᯠ騪 ⭮ pp, ᪠騥 
⮬᪮  㠢⮬᪮ p 頥 pp 
᫥騥 ⨯ ⪨ startup-  ᮮ⢥⢥ p騥
relocations.

 㭪 ⮬᪨ pᯠ騪 - ᤨp   䠩  祭
pᯮᮡ EXE 䠩.   p ⠪: p墠뢠
p pp pp뢠, 맢 pp ᫥ p⪨ ,
pᯠ騪 ᭨    㦥 pp  饭
pp. p ⠯ p   - 宦 ⮣ ᠬ p
pp뢠.   p   ⫠稪.   㤥  
p ⫮ p pp뢠,    -  pp
ᠭ  C/C++  ⪮p p  p  
p  pp p DOS :

        B4 30           mov     ah, 30h
        CD 21           int     21h

  pp, ᠭ  ᪠  p墠 p 00  p
p㣨:

        B4 35           mov     ah, 35h
        CD 21           int     21h

 ᫨ ᬮp 뫪   ,   㢨,   p
뢠 ᫥  far call-:

        call    far     Initturbo
        call    far     SwapVectors

  p   ⨭  室  ᪠ pp.

1) Autohack 4.1 by BCP group
 p⠢ p p ᪠:

 1. ᯠ pp.   p p  
pᯠ騪 pp.   p  pᯠ pp, 
饭  pp.  p⠥ ᫥騬 p: pp
p㦠  , p墠뢠 p pp뢠,  䫠
蠣 pp (⮬ pᯠ  ⮬ p ⭮⥫쭮
 p⠥), p p p㦥 pp, 
p稪 p pp뢠 p ᥣ  pp㥬
pp   ᬥ pp CS (᫮ ᬥ pp CS p訢 
p ᪠   "㡨 pp"). ᫥ ⮣ p뢠
 ,  p p  p㧪 pp  p㣮
砫쭮 p.

 2. ⠭p p .  p pp ᭮  p
p墠 p ⮢ ᫥ p⪨ 堭  
p  .

 3.    p ⠡ p. 祭 p
p,  楫  p p, ⮬ 뢠 
pp⭮.  ᫨ 뢠 pp ⪮p 
AutoHack- p,  p  뢠 pp 
᫥騬 .

3) Intruder 1.30 by Creat0r
 ᫥ startup-. p p:
 - Turbo/Borland Pascal 7.0 ( p p!)
 - Borland C++ (    ).
 - Turbo  C  (pp    p 筮)
 - Microsoft C
 - CLIPPER

4) SnapShot 3.0 by Dale Co.

  ⥬ 뫠 p  p  ᥬ 㯭묨 
騩  ⥬   p p몮筮 ⨯, 
⮬ ᫥   pﬨ (p묨) :

 - Super Guard
 - Hota
 - Shield
 - Convoy
 - Cerberus
 - AntyCop
 - CopyLock II (& p)

  ᥬ ⨬ ⠬    㤮⢮p⥫ p,
  p  pᯮᮡ  㭨pᠫ쭮 
⠫ ⥬  p.

4) CUP 1.1 by Cyberware products
 pp pp. p ⠡ p.

5) UNP by B.Castricum
 p  ᥡ ⠡ ⠭p 騪, p⠢
  pp.

6) Tron
 pp pp. p ⠡ ⠭p 騪.

7) TSUP
 pp pp  稥 start-up , p int 1. ᫥
start-up .

                                  p㯯 V
                             Immortal Player'

   Immortal Player'a ⭮ p筮 p pp


                       ⮤ 㡨 ⫠稪

 p p뢠 ᯮᮡ p㦥  㡨 ⫠稪,
᭮  ᯮ짮 ⥩ p,   ⥪
p ᥬ⢠ pp Intel (P5, P5 Pro) ⨥ p
.

1. ᯮ짮 p権  mov sp, 1 p  p樨 int 06
(invalid opcode)

⫠稪:       䥪⨢
TD                  GPF#13
TD386               GPF#13
Soft-Ice            -
Soft-Ice/W          -
Deglucker           -


2. p⭮ p饭 pp뢠
p饭 pp뢠  p p  ᠭ ⫠稪
p쭮 p.

        CS:0100 E421    in      al,21h
        CS:0102 0C02    or      al,00000010b    ;IRQ 1 keyboard irq
        CS:0104 E621    out     21h,al


        CS:0100 E461    in      al,61
        CS:0102 0C80    or      al,10000000b    ; bit 7 - disable kbd
        CS:0104 E661    out     61h,al


        CS:0100 B4AD    mov     al, 0ADh        ; disable keyboard
        CS:0102 E664    out     64h,al

3. ᯮ짮 p  pp筮 pp뢠 p  ⨯
mov Seg, r/m  pop Seg (⮫쪮 seg SS  ppp 80386+).

4. ᯮ짮 ⥩ ⠭ p䨪 ᥣ⭮ pp 
 pushf. ⭮,  ⫠稪 p ⥪ ᯮ塞
  pushf (opcode 9Ch)  p뢠 p ⮬  TF 
pp饭  pp pp.

        CS:0100 2E      cs:
        CS:0101 9C      pushf
        CS:0102 58      pop     ax
        CS:0103 9C      pushf
        CS:0104 5B      pop     bx
        CS:0105 33C3    xor     ax,bx
        CS:0107 50      push    ax
        CS:0108 C3      retn                    ; ret ->100h under TD

 ᯮᮡ  p⠥  Deglucker'e  WinIce 1.3+. Soft-Ice  ⠪
p   ⠢  ⥪ ⨭ 祭 䫠.

5. ᯮ짮 訡 Soft-Ice  ⠭ DRx

        Start:
                        mov     eax, dr7
                        or      eax, 2000h
                        mov     dr7, eax

                        ; pp ᫥ p 
                        ; pp Soft-Ice  ᠭ p
                        ; 蠣 pp  ᪥ pp

;                       nop                     ; ⥫ 

                        mov     eax, dr7
                        mov     dx, offset Msg
                        test    eax, 02000h
                        jnz     Done
                        mov     dx, offset BadMSG
        Done:
                        mov     ah, 09
                        int     21h
                        mov     ax, 4C00h
                        int     21h

Msg     db      'Program is running fine.',13,10,'$'
BADMsg  db      'Program has crashed ;).',13,10,'$'

⫠稪:       䥪⨢
TD                  -
TD386               -
Soft-Ice            GPF#13
Soft-Ice/W          -
Deglucker           GPF#13

7. ᯮ짮 p  pp筮 pp뢠 p ⠭ DRx
. pp, p  6  5

8. ᯮ짮 DIV-bug

 ⫠稪 Turbo Debugger p墠뢠 pp뢠 00 (Divide overflow) 
p p   p稪 int 00 p ⫠稪.

        Start:
                        mov     ax, offset Continue
                        mov     dx, cs

                        xor     bx, bx
                        mov     es, bx
                        cli
                        xchg    ax, es:[bx]
                        xchg    dx, es:[bx+2]
                        sti

                        div     bx
        Done:
                        mov     ax, 4C00h
                        int     21h
        Continue:
                        cli
                        xchg    ax, es:[bx]
                        xchg    dx, es:[bx+2]
                        sti

                        mov     ah, 9
                        mov     dx, offset Msg
                        int     21h
                        jmp     Done

Msg     db      'Program is running fine.',13,10,'$'

⫠稪:       䥪⨢
TD           Divide by Zero/Stop
TD386        Divide by Zero/Stop
Soft-Ice            -
Soft-Ice/W          -
Deglucker           -

9.  pp ⥪

Start:
                xor     ax,ax
                mov     es,ax
                mov     [save_ss], ss
                mov     [save_sp], sp
                mov     ss, ax                          ; !!!!!
                mov     sp, 0ah
                mov     ss, [save_ss]
                mov     sp, [save_sp]
                mov     ah, 9
                mov     dx, offset Msg
                int     21h
                ret

Msg     db      'Program is running fine.',13,10,'$'


TD              ᠭ
TD386           ᠭ
Soft-Ice            -
Soft-Ice/W          -
Deglucker           -

                p㤭 ⫠ (p稭 pp)

10. ᯮ짮 p祭 pp뢠:  ᮤp p
int 21h  int 10h.

11. p稢 饭 pp p int 08h/int 1Ch

12. H ISA-設 p I/O p p 10 ,  ⮬ 
p饭  p pp, 378h p p 8378h

13. ᯮ짮 pp⭮ p樨 NDP p権
 p, 堪p  ᮡ ᢥ  ⢨, p NDP.

14. pppp p (p饭 뢮 int 10h,
ax=1201h bl=32h) p  pᯮᮡ  ⫠稪.

15.  DRx pp p  砫 p⠬ 
⫠稪 Soft-ICE, DeGlucker.

16. ᯮ짮 pp⭮ p Borland DPMI-extender' (16rtm.exe,
32rtm.exe) p   ⫠/ pp  Soft-ICE.
ᯮ짮 Soft-ICE/W  祭 VxD WinDPMI.386 ᯥ譮 p蠥 
p.

Windows

 1. p ᯥ樠쭮 ᠭ VxD  p墠 p饭  p⠬:
pp pp p頥  p 3378h  pp  맮 
p 378h.

 2. p self-loading modules

 饥 p ⢥묨 ᠬp㦠騬 pp 
Microsoft Word 1.x, Microsoft Fortran, p pᨨ Microsoft Excel, 
⠪ pp 㯠   WinLite by Rosenthal Engineering 
OPTloader by OPTlink software.
⫨⥫ p ᠬp㦠饣 p  ⠢
 1 11  䫠 ( ᪥ 800h). p ⮣  ᠬp㦠饬 䠩
  pᬮp 㭪樨 BootApp(), ExitApp(), LoadAppSeg(). p
맮 BootApp() p   p ᥫp  
ᥣ, ᮤp  NE-䠩  ᠬ p ⠡ ᥣ⮢.
   㭪権   KERNEL ᮮ⢥ : BootAppl(),
ExitAppl(), LoadApplSeg().

BootAppl()

㭪 pp ᮮ⢥  p p ᥣ ⥬ p⠬,
p    ᠬp㦠饬 p. ⥬ BootAppl()
p㦠 p ᥣ NE,  p ⮬ 믮 p  p
ᥣ. ⥬ ᮧ ᥫp ᥣ , p 
p⨢  ⮫쪮  p㦥 ᥣ .  
㭪樨 BootAppl()  p 㭪権, p⠢塞 㫥 KERNEL,
  訡    p ⪥   ᥣ
. ᫥ pp ᨣp "A0"  ᬥ饭 0  p㦥 ᥣ
BootAppl() 뢠 ᯥ祭 짮⥫ 㭪 BootApp(), ᯮ
 㪠⥫, 室騩  ⠡  p稪.

LoadApplSegment()

砫 㭪 LoadApplSeg() 뢠 ᯥ祭 짮⥫ 㭪
LoadApplSeg(), p  㪠⥫, p  ⠡ 
p稪. p p 맮 㭪樨 LoadApplSeg p ᪨ p
䠩, p  p   pp. ᫨  - p稭
㭪 LoadAppSeg p訫 㤠筮, LoadApplSeg() ᠬ ⠥
p EXE-䠩  ᭮ 뢠 LoadAppSeg(), p  ᪨
p ⮫쪮  p⮣ 䠩. p p⮬ LoadApplSeg() pp,
p뢠   䠩. ᫨  ⠪,    p뢠.

ExitAppl()
H祣  ,  짮⥫᪠ 㭪 ExitApp()  
뢠.

 3) 祭 PL0
 . pp.

 4) 蠭 Hook  p 㭪樨 Windows

  㫥 user.exe p 㭪 SetWindowsHook (int nFilterType,
FARPROC lpFilterFunc), p ⠭ -㭪 (㭪
p墠)  頥 㪠⥫    ᯨ᮪ -p楤p.

pp       ᠭ

nFilterType     p ⨯ 㪠,   p ᫥騥
                祭: WH_CALLWNDPROC, WH_GETMESSAGE, WH_JOURNALPLAYBACK,
                WH_JOURNALRECORD, WH_KEYBOARD, WH_MSGFILTER,
                WH_SYSMSGFILTER
lpFilterFunc    ⥫  -㭪

p頥 ⮩ 㭪樥 祭  㪠⥫  p 㭪
ᯨ᪠.  p NULL, ᫨ ᯨ᮪  .

 p
  㪨, p WH_MSGFILTER,   p ᥩ ⥬.  ⨯
WH_MSGFILTER  ⮫쪮  p ⠭襩  pp. 
⠭ 㪠 SetWindowsHook   p 窨 맮 㭪樨.
 㭪 ᯮpp pp  ⥪.  祭 窨
맮 p楤p pp 室 ᯮ짮 㭪
MakeProcInstance,  DLL - 㭪 GetProcAddress.

  㪮:

 WH_CALLWNDPROC

 Windows 뢠   p  p饭  㭪樨 SendMessage. p
p饭  㭪樨 PostMessage ⮣  p室.

    ᫥騩 p⨯

 void FAR PASCAL HookFunc(int nCode, WORD wParam, DWORD lParam)

pp       ᠭ
nCode           p    p뢠 ᮮ饭 
                p p  DefHookProc. ᫨ pp nCode
                 ,    p ᮮ饭 DefHookProc
                 쭥襩 p⪨.
wParam          p, ᫠  ᮮ饭 ⥪饩 祩. ᫨ ,
                 wParam ⫨祭  ,  p⨢ 砥  p 0
lParam          ⥫  pp , ᮤp p
                p, p p뢠  㭪樥.
                 pp:
                        hlParam         WORD, ᮤp p襥 祭
                                        ᫮ pp lParam 祭
                                        ᮮ饭
                        llParam         WORD, ᮤp 襥 祭
                                        ᫮ pp lParam 祭
                                        ᮮ饭
                        wParam          WORD, ᮤp pp 祭
                                        ᮮ饭
                        wMsg            WORD, ᮤp ⨯ ᮮ饭
                        hWnd            WORD, ᮤp pp ,
                                        p   ᮮ饭.

  p, 㭪 WH_CALLWNDPROC   㣮  ᮡ饭.
 ⮫쪮  p頥 p Windows, ᮮ饭 p 㭪樨
.

 WH_GETMESSAGE

 Windows 뢠  WH_GETMESSAGE p  맮 㭪樨 GetMessage.
Windows 뢠  p ,  㭪 GetMessage 砥 ᮮ饭 
p.   WH_GETMESSAGE   㣮  ᮮ饭. 
⮫쪮  p頥 p Windows, 㭪 GetMessage
p ᮮ饭 맢襩  pp.

 WH_JOURNALPLAYBACK

 Windows 뢠  WH_JOURNALPLAYBACK p  p  ᮮ饭 
ᮡ⨨, ..    譨 p   ⠩p. 
WH_JOURNALPLAYBACK  p ᮮ饭  ᮡ⨨  p lParam.
 ᮮ饭 pp⥫쭮 ᠭ 㪮  WH_JOURNALRECORD.  
  ᮮ饭. p頥 祭 p p ( 
⠩p), p Windows  , p 祬 p㯨 
p⪥ ⮣ ᮮ饭.  p   ⠭  p
 p p室 ⥪饣  p饣 ᮮ饭. ᫨ 㭪
p頥 , ᮮ饭 p뢠  㤥. p p p
Windows p p⪠ ᮮ饭. ᫨ 祭 nCode p
HC_SKIP,   ⮢  ⮣, ⮡ p ᫥饬 맮
p ᫥饥 ᮮ饭.
 p p 㪠 WH_JOURNALPLAYBACK Windows pp   
p   ""

 WH_JOURNALRECORD

 Windows 뢠  WH_JOURNALRECORD p  p⪥ ᮮ饭 
p ᮡ⨩.    ᯮ짮   ᮮ饭  ᮡ⨨
 쭥襩 p⪨.  WH_JOURNALRECORD  p ᮮ饭 
ᮡ⨨  쭥襩 p⪨. p p饭 p Windows
p p⪠ ᮮ饭.

 WH_KEYBOARD

 Windows 뢠  WH_KEYBOARD p  맮 㭪樨 GetMessgae 
PeekMessage  砥, ᫨ 祭 ᮮ饭  p (WM_KEYUP 
WM_KEYDOWN). p頥 祭 p , ᫨ ᮮ饭 
p뢠 Windows,  p 1, ᫨ ᮮ饭   ⫮.

 WH_MSGFILTER

 Windows 뢠  WH_MSGFILTER,  ⮫쪮 ,  ᮮ饭 
  ᮮ饭  p,   ⮣,    
p뢠. p頥 祭 ⫨筮  , ᫨ 㭪
p⠫ ᮮ饭,  p⨢ 砥 - 0.

 WH_SYSMSGFILTER

 Windows 뢠  WH_SYSMSGFILTER  ⮫쪮 ,  ᮮ饭 
  ᮮ饭. p頥 祭 ⫨筮  , ᫨
㭪 p⠫ ᮮ饭,  p⨢ 砥 - 0.

 㪨   ᯮ짮  pp  pp, ⢫ on
the fly p .  ⠪ 砥 室 ⠢  
㭪 LOPEN.


 ᯮ짮 p:

1.  p, "p p Windows", Diasoft,  1995
2. "⫠稪 pp  MS-DOS", . p᪨  p.,
   p-p 10'91
3. "p Windows", Vitas Ramanauskas, Fidonet, 1995
4. "p筨 Windows 3.0", H p, 1991

23.02.96 10:38
15.03.96 00:26
24.03.96 23:55
16.04.96 00:13
21.06.96 14:52 p⨢⢨ Win-ICE

     ;)   [T.Xm] //FotD//UCL (Leningrad)
