By intercepting or hooking interrupts in DOS you can make the system behave differently whenever an interrupt is triggered. And there are many interrupts used in x86 architecture, some are triggered by hardware (such as clock, keyboard, divide overflow/divide by zero), some are BIOS services that can be called from software and some are OS services or other services that can also be called from software. All interrupts are equally easy to hook. All you need is cli
, replace the interrupt vector with your own one, sti
, or use some BIOS or DOS service.
By hooking an interrupt you can first do your thing in your own interrupt handler and then forward the original parameters to the original interrupt handler, but you can also replace entire interrupts or specific services of chosen interrupts (without forwarding). TSRs (terminate & stay resident) programs are all based on hooking interrupts (with or without interrupt forwarding). For example many DOS debuggers are TSRs, and probably many viruses too.
For example it's possible to write an interrupt handler for interrupt 0x13 that disables all hard drive formatting functions of BIOS interrupt 0x13, by first checking the parameters for int 0x13
, and if the function (in ah
) is 5, 6, 7, 0x1a ... then set the desired return values in registers and flags as you like , then iret
, otherwise jmp
to the original interrupt handler. You can write a TSR debugger that hooks the chosen interrupts and presents the debugger screen whenever a chosen interrupt is triggered. You can adjust the system timer interrupt frequency and then hook the timer interrupt to use it to play music eg. with AdLib or SoundBlaster. You can write a TSR keylogger, a TSR virus scanner or a TSR hard drive defragmenter. You can make the computer play "Jingle Bells" through PC speaker or sound card whenever the user presses Enter and it's December. The possibilities are limited only by the hardware available and the skill of the programmer.