Comment by SystemOut | Hacker News Reader

Comment by SystemOut | Hacker News Reader

This reminded me of the old days working in Windows 3.1 and my first professional project was to write a SOCKS client that could be loaded up and intercept all calls to Winsock's connect() function. It needed to do this without modifying the other programs and it had to happen at the DLL level and not the VxD layer where our IP stack ran.

Turns out there was an undocumented Windows API function along the lines of "AliasCsToDsRegister" or something like that - I've tried to find a reference to it but I can't find it. It allowed me write into the code segment (the CS was global and read only - as it was shared among all processes) and replace the first few bytes of the connect function call with a jump to my code which would then put it back, make the call to the socks server, do some other magic, put my jump hook back in and the return to the caller. Good times!

Kind of surprised I remember this and more so that it actually worked.

Yeah win16 had AllocCStoDS and AllocDStoCS, one was documented the other wasn't. They also had the fabulously named PrestoChangoSelector which toggled the code/data bit in the descriptor table

Cool. I did some Google searching about PrestoChangoSelector and I found this:

KnowledgeBase Archive

An Archive of Early Microsoft KnowledgeBase Articles

Q89560: Creating Dynamic Code Segments Using PrestoChangoSelector

https://jeffpar.github.io/kbarchive/kb/089/Q89560/

IIRC there was a documented ChangeSelector function that was actually not implemented, so you had to use the undocumented PrestoChangoSelector instead. Visual Basic used it to implement a direct threaded code interpreter.

Some other functions had similarly great names:

>>Anyway, I am not sure what type of person writes a function called "BozosLiveHere" and puts it into USER.EXE

>This started out life with a non-bozo name as an undocumented function in Windows 3.0.

>Windows 3.1 removed the undocumented function, but we found that some programs were using the undocumented function and started crashing.

>So we reluctantly put the function back, but changed its name to "BozosLiveHere" so that nobody else would use it in the future.

>A similar story exists for "TabTheTextOutForWimps".

https://www.microsoft.com/en-us/research/project/detours/

It's AllocDStoCSAlias.

Thank you! I thought the word Alloc was in there but couldn't remember the right combination of Alias/Alloc/etc.

Reply on news.ycombinator.com