2

I'm currently reading 40hex magazine regarding virus writing in the early 90's. They talk a lot there about interrupt intercepting Which is something security guys from anti viruses company will try to do, and should be prevented (from virus writing point of view)

What is exactly interrupt intercepting ?

4

By intercepting or hooking interrupts in DOS you can make the system behave differently whenever an interrupt is triggered. And there are many interrupts used in x86 architecture, some are triggered by hardware (such as clock, keyboard, divide overflow/divide by zero), some are BIOS services that can be called from software and some are OS services or other services that can also be called from software. All interrupts are equally easy to hook. All you need is cli, replace the interrupt vector with your own one, sti, or use some BIOS or DOS service.

By hooking an interrupt you can first do your thing in your own interrupt handler and then forward the original parameters to the original interrupt handler, but you can also replace entire interrupts or specific services of chosen interrupts (without forwarding). TSRs (terminate & stay resident) programs are all based on hooking interrupts (with or without interrupt forwarding). For example many DOS debuggers are TSRs, and probably many viruses too.

For example it's possible to write an interrupt handler for interrupt 0x13 that disables all hard drive formatting functions of BIOS interrupt 0x13, by first checking the parameters for int 0x13, and if the function (in ah) is 5, 6, 7, 0x1a ... then set the desired return values in registers and flags as you like , then iret, otherwise jmp to the original interrupt handler. You can write a TSR debugger that hooks the chosen interrupts and presents the debugger screen whenever a chosen interrupt is triggered. You can adjust the system timer interrupt frequency and then hook the timer interrupt to use it to play music eg. with AdLib or SoundBlaster. You can write a TSR keylogger, a TSR virus scanner or a TSR hard drive defragmenter. You can make the computer play "Jingle Bells" through PC speaker or sound card whenever the user presses Enter and it's December. The possibilities are limited only by the hardware available and the skill of the programmer.

3

What is exactly interrupt intercepting ?

Install your own interrupt vector. When somebody triggers it, you do whatever you want, and then forward the original call to the original interrupt handler.

  • Can you elaborate why one would want to intercept the interrupts ? – Mellowcandle Dec 15 '13 at 16:18
  • To replace a call with your own version. If you look at Ralph Browns Interrupt List you can see a lot of interrupts which replace original functions. For a virus, obviously this might be some hostile functionality, but of course this doesn't need to be thae case. – Devolus Dec 15 '13 at 16:32
-3

If you wish to see an interrupt intercepting download kgb.zip. This was authored by:

Petr Horak Technical University of Prague Faculty of Nuclear Science and Physical Engineering Prague Czechoslovakia BITNET: HORAC@CSEARN

It intercepts only a FEW interrupts. BUT, a very important but, IT COMES WITH SOURCE CODE OF HOW TO INTERCEPT THE INTERRUPTS!!

Should you decide to work on 'older' programs, this is a tool worthwhile studying. And working on. And expanding.

-- somewhere in time ---

  • 2
    You should use less capslock and more links instead. – jvoisin Dec 15 '13 at 18:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.