How did we make the DOS redirector take up only 256 bytes of memory?
blogs.msdn.com
blogs.msdn.com
Myself and another school boy wrote enough of a connection based networking system that we could reliably send about 100 bytes of data into that receive buffer. By having our 'protocol stack' then CALL the buffer itself we would execute the code that we had just sent (i.e. the machine code).
Building up from 100 byte chunks we built a network monitoring and management system which allowed things like screen mirroring, chat programs, taking control of the keyboard and broadcast functionality. The entire thing was written in assembly language.
The actual protocol stack was loaded into a part of the BIOS of the machine that was unused and we just grabbed a bunch of NOPs and over wrote them. In the end Research Machines were kind enough to send us the spec. of Z-Net (which they considered somewhat secret) as we'd already reverse engineered the entire thing by disassembling the operating system.
Put your lenses on for jump-offs produced by Google on keywords TSR and LIM EMS for further mind-bending fun.
And quit laughing at HIMEM.SYS
for the new folk exploring TASM == http://en.wikipedia.org/wiki/Turbo_Assembler :-).
wow, this whole thread coupled with the recent one on PE format has resulted in a serious trip down the memory lane for me personally.
I also tied into the keyboard hooks so that I could build an entire decoy base with a single key press (just some simple buffer stuffing) along with a cool little "death blossom" attack.
Ahhh, those were the days ;)
I'm visiting from the world of Ruby too, yet I was deep in masm/tasm, 386 dos extenders back then :)
Without the pain of INT13 behind me, I doubt I'd have gotten so far.
The thing is, with 20 bits you can address one megabyte, but without a 21st line, any calculated offset (be it indirect addressing or, more commonly, segments) will roll over.
For compatibility with some ancient programs that exploited the rollover (access 0xfffff+0x400 -> 0x3ff), 80286+ gained the "A20 Gate", which allows to simulate the rollover effect (by always forcing A20, the 21st line, to 0) or not (in which case you can go above 1MB using offsets).
Note that the A20 Gate is only active in 16bit modes, otherwise even more fun trickery becomes possible (since half the 32bit accesses with A20 pulled low would change, too)
This was a fun read, and what is scary is how much of this memory is fresh as newly plucked fruits with uncounted boxes full of APIs that have long gone to dust sitting besides it.
Maybe one day it will come in handy again.
In case you don't know what djgpp is: http://www.delorie.com/
Also found this quote on the History of DJGPP page: DJGPP was born around 1989 (originally called djgcc), when Richard Stallman spoke at a meeting of the Northern New England Unix Users Group (NNEUUG) at Data General, where I then worked. I asked if the FSF ever planned on porting gcc to MS-DOS (I wanted to use it to write a 32-bit operating system for PCs), and he said it couldn't be done because gcc was too big and MS-DOS was a 16-bit operating system. Challenge in hand, I began.
I like his moxie.
(or: the fun stuff that you never get to see anymore.)
Check it, it's really enjoyable (even for a rabid Unixoid GPL lover like yours truly).