[Chapter Eighteen][Previous]
[Art of Assembly][Randall
Hyde]
Art of Assembly: Chapter Eighteen
- 18.9 - Semiresident Programs
18.9 Semiresident Programs
A semiresident program is one that temporarily loads itself into memory,
executes another program (a child process), and then removes itself from
memory after the child process terminates. Semiresident programs behave
like resident programs while the child executes, but they do not stay in
memory once the child terminates.
The main use for semiresident programs is to extend an existing application
or patch an application (the child process). The nice thing about a semiresident
program patch is that it does not have to modify the application's ".EXE"
file directly on the disk. If for some reason the patch fails, you haven't
destroyed the '.EXE" file, you've only wiped out the object code in
memory.
A semiresident application, like a TSR, has a transient and a resident part.
The resident part remains in memory while the child process executes. The
transient part initializes the program and then transfers control to the
resident part that loads the child application over the resident portion.
The transient code patches the interrupt vectors and does all the things
a TSR does except it doesn't issue the TSR command. Instead, the resident
program loads the application into memory and transfers control to that
program. When the application returns control to the resident program, it
exits to DOS using the standard ExitPgm call (ah=4Ch).
While the application is running, the resident code behaves like any other
TSR. Unless the child process is aware of the semiresident program, or the
semiresident program patches interrupt vectors the application normally
uses, the semiresident program will probably be an active resident program,
patching into one or more of the hardware interrupts. Of course, all the
rules that apply to active TSRs also apply to active semiresident programs.
The following is a very generic example of s semiresident program. This
program, "RUN.ASM", runs the application whose name and command
line parameters appear as command line parameters to run. In other words:
c:> run pgm.exe parm1 parm2 etc.
is equivalent to
pgm parm1 parm2 etc.
Note that you must supply the ".EXE" or ".COM" extension
to the program's filename. This code begins by extracting the program's
filename and command line parameters from run's command line. Run builds
an exec structure and then calls DOS to execute the program. On return,
run fixes up the stack and returns to DOS.
; RUN.ASM - The barebones semiresident program.
;
; Usage:
; RUN <program.exe> <program's command line>
; or RUN <program.com> <program's command line>
;
; RUN executes the specified program with the supplied command line parameters.
; At first, this may seem like a stupid program. After all, why not just run
; the program directly from DOS and skip the RUN altogether? Actually, there
; is a good reason for RUN-- It lets you (by modifying the RUN source file)
; set up some environment prior to running the program and clean up that
; environment after the program terminates ("environment" in this sense does
; not necessarily refer to the MS-DOS ENVIRONMENT area).
;
; For example, I have used this program to switch the mode of a TSR prior to
; executing an EXE file and then I restored the operating mode of that TSR
; after the program terminated.
;
; In general, you should create a new version of RUN.EXE (and, presumbably,
; give it a unique name) for each application you want to use this program
; with.
;
;
;----------------------------------------------------------------------------
;
;
; Put these segment definitions 1st because we want the Standard Library
; routines to load last in memory, so they wind up in the transient portion.
CSEG segment para public 'CODE'
CSEG ends
SSEG segment para stack 'stack'
SSEG ends
ZZZZZZSEG segment para public 'zzzzzzseg'
ZZZZZZSEG ends
; Includes for UCR Standard Library macros.
include consts.a
include stdin.a
include stdout.a
include misc.a
include memory.a
include strings.a
includelib stdlib.lib
CSEG segment para public 'CODE'
assume cs:cseg, ds:cseg
; Variables used by this program.
; MS-DOS EXEC structure.
ExecStruct dw 0 ;Use parent's Environment blk.
dd CmdLine ;For the cmd ln parms.
dd DfltFCB
dd DfltFCB
DfltFCB db 3," ",0,0,0,0,0
CmdLine db 0, 0dh, 126 dup (" ") ;Cmd line for program.
PgmName dd ? ;Points at pgm name.
Main proc
mov ax, cseg ;Get ptr to vars segment
mov ds, ax
MemInit ;Start the memory mgr.
; If you want to do something before the execution of the command-line
; specified program, here is a good place to do it:
; -------------------------------------
; Now let's fetch the program name, etc., from the command line and execute
; it.
argc ;See how many cmd ln parms
or cx, cx ; we have.
jz Quit ;Just quit if no parameters.
mov ax, 1 ;Get the first parm (pgm name)
argv
mov word ptr PgmName, di ;Save ptr to name
mov word ptr PgmName+2, es
; Okay, for each word on the command line after the filename, copy
; that word to CmdLine buffer and separate each word with a space,
; just like COMMAND.COM does with command line parameters it processes.
lea si, CmdLine+1 ;Index into cmdline.
ParmLoop: dec cx
jz ExecutePgm
inc ax ;Point at next parm.
argv ;Get the next parm.
push ax
mov byte ptr [si], ' ' ;1st item and separator on ln.
inc CmdLine
inc si
CpyLp: mov al, es:[di]
cmp al, 0
je StrDone
inc CmdLine ;Increment byte cnt
mov ds:[si], al
inc si
inc di
jmp CpyLp
StrDone: mov byte ptr ds:[si], cr ;In case this is the end.
pop ax ;Get current parm #
jmp ParmLoop
; Okay, we've built the MS-DOS execute structure and the necessary
; command line, now let's see about running the program.
; The first step is to free up all the memory that this program
; isn't using. That would be everything from zzzzzzseg on.
ExecutePgm: mov ah, 62h ;Get our PSP value
int 21h
mov es, bx
mov ax, zzzzzzseg ;Compute size of
sub ax, bx ; resident run code.
mov bx, ax
mov ah, 4ah ;Release unused memory.
int 21h
; Warning! No Standard Library calls after this point. We've just
; released the memory that they're sitting in. So the program load
; we're about to do will wipe out the Standard Library code.
mov bx, seg ExecStruct
mov es, bx
mov bx, offset ExecStruct ;Ptr to program record.
lds dx, PgmName
mov ax, 4b00h ;Exec pgm
int 21h
; When we get back, we can't count on *anything* being correct. First, fix
; the stack pointer and then we can finish up anything else that needs to
; be done.
mov ax, sseg
mov ss, ax
mov sp, offset EndStk
mov ax, seg cseg
mov ds, ax
; Okay, if you have any great deeds to do after the program, this is a
; good place to put such stuff.
; -------------------------------------
; Return control to MS-DOS
Quit: ExitPgm
Main endp
cseg ends
sseg segment para stack 'stack'
dw 128 dup (0)
endstk dw ?
sseg ends
; Set aside some room for the heap.
zzzzzzseg segment para public 'zzzzzzseg'
Heap db 200h dup (?)
zzzzzzseg ends
end Main
Since RUN.ASM is rather simple perhaps a more complex example is in order.
The following is a fully functional patch for the Lucasart's game XWING'.
The motivation for this patch can about because of the annoyance of having
to look up a password everytime you play the game. This little patch searches
for the code that calls the password routine and stores NOPs over that code
in memory.
The operation of this code is a little different than that of RUN.ASM. The
RUN program sends an execute command to DOS that runs the desired program.
All system changes RUN needs to make must be made before or after the application
executes. XWPATCH operates a little differently. It loads the XWING.EXE
program into memory and searches for some specific code (the call to the
password routine). Once it finds this code, it stores NOP instructions over
the top of the call.
Unfortunately, life isn't quite that simple. When XWING.EXE loads, the password
code isn't yet present in memory. XWING loads that code as an overlay later
on. So the XWPATCH program finds something that XWING.EXE does load into
memory right away - the joystick code. XWPATCH patches the joystick code
so that any call to the joystick routine (when detecting or calibrating
the joystick) produces a call to XWPATCH's code that searches for the password
code. Once XWPATCH locates and NOPs out the call to the password routine,
it restores the code in the joystick routine. From that point forward, XWPATCH
is simply taking up memory space; XWING will never call it again until XWING
terminates.
; XWPATCH.ASM
;
; Usage:
; XWPATCH - must be in same directory as XWING.EXE
;
; This program executes the XWING.EXE program and patches it to avoid
; having to enter the password every time you run it.
;
; This program is intended for educational purposes only.
; It is a demonstration of how to write a semiresident program.
; It is not intended as a device to allow the piracy of commercial software.
; Such use is illegal and is punishable by law.
;
; This software is offered without warranty or any expectation of
; correctness. Due to the dynamic nature of software design, programs
; that patch other programs may not work with slight changes in the
; patched program (XWING.EXE). USE THIS CODE AT YOUR OWN RISK.
;
;----------------------------------------------------------------------------
byp textequ <byte ptr>
wp textequ <word ptr>
; Put these segment definitions here so the UCR Standard Library will
; load after zzzzzzseg (in the transient section).
cseg segment para public 'CODE'
cseg ends
sseg segment para stack 'STACK'
sseg ends
zzzzzzseg segment para public 'zzzzzzseg'
zzzzzzseg ends
.286
include stdlib.a
includelib stdlib.lib
CSEG segment para public 'CODE'
assume cs:cseg, ds:nothing
; CountJSCalls- Number of times xwing calls the Joystick code before
; we patch out the password call.
CountJSCalls dw 250
; PSP- Program Segment Prefix. Needed to free up memory before running
; the real application program.
PSP dw 0
; Program Loading data structures (for DOS).
ExecStruct dw 0 ;Use parent's Environment blk.
dd CmdLine ;For the cmd ln parms.
dd DfltFCB
dd DfltFCB
LoadSSSP dd ?
LoadCSIP dd ?
PgmName dd Pgm
DfltFCB db 3," ",0,0,0,0,0
CmdLine db 2, " ", 0dh, 16 dup (" ") ;Cmd line for program
Pgm db "XWING.EXE",0
;****************************************************************************
; XWPATCH begins here. This is the memory resident part. Only put code
; which which has to be present at run-time or needs to be resident after
; freeing up memory.
;****************************************************************************
Main proc
mov cs:PSP, ds
mov ax, cseg ;Get ptr to vars segment
mov ds, ax
mov ax, zzzzzzseg
mov es, ax
mov cx, 1024/16
meminit2
; Now, free up memory from ZZZZZZSEG on to make room for XWING.
; Note: Absolutely no calls to UCR Standard Library routines from
; this point forward! (ExitPgm is okay, it's just a macro which calls DOS.)
; Note that after the execution of this code, none of the code & data
; from zzzzzzseg on is valid.
mov bx, zzzzzzseg
sub bx, PSP
inc bx
mov es, PSP
mov ah, 4ah
int 21h
jnc GoodRealloc
; Okay, I lied. Here's a StdLib call, but it's okay because we failed
; to load the application over the top of the standard library code.
; But from this point on, absolutely no more calls!
print
byte "Memory allocation error."
byte cr,lf,0
jmp Quit
GoodRealloc:
; Now load the XWING program into memory:
mov bx, seg ExecStruct
mov es, bx
mov bx, offset ExecStruct ;Ptr to program record.
lds dx, PgmName
mov ax, 4b01h ;Load, do not exec, pgm
int 21h
jc Quit ;If error loading file.
; Unfortunately, the password code gets loaded dynamically later on.
; So it's not anywhere in memory where we can search for it. But we
; do know that the joystick code is in memory, so we'll search for
; that code. Once we find it, we'll patch it so it calls our SearchPW
; routine. Note that you must use a joystick (and have one installed)
; for this patch to work properly.
mov si, zzzzzzseg
mov ds, si
xor si, si
mov di, cs
mov es, di
mov di, offset JoyStickCode
mov cx, JoyLength
call FindCode
jc Quit ;If didn't find joystick code.
; Patch the XWING joystick code here
mov byp ds:[si], 09ah ;Far call
mov wp ds:[si+1], offset SearchPW
mov wp ds:[si+3], cs
; Okay, start the XWING.EXE program running
mov ah, 62h ;Get PSP
int 21h
mov ds, bx
mov es, bx
mov wp ds:[10], offset Quit
mov wp ds:[12], cs
mov ss, wp cseg:LoadSSSP+2
mov sp, wp cseg:LoadSSSP
jmp dword ptr cseg:LoadCSIP
Quit: ExitPgm
Main endp
; SearchPW gets call from XWING when it attempts to calibrate the joystick.
; We'll let XWING call the joystick several hundred times before we
; actually search for the password code. The reason we do this is because
; XWING calls the joystick code early on to test for the presence of a
; joystick. Once we get into the calibration code, however, it calls
; the joystick code repetitively, so a few hundred calls doesn't take
; very long to expire. Once we're in the calibration code, the password
; code has been loaded into memory, so we can search for it then.
SearchPW proc far
cmp cs:CountJSCalls, 0
je DoSearch
dec cs:CountJSCalls
sti ;Code we stole from xwing for
neg bx ; the patch.
neg di
ret
; Okay, search for the password code.
DoSearch: push bp
mov bp, sp
push ds
push es
pusha
; Search for the password code in memory:
mov si, zzzzzzseg
mov ds, si
xor si, si
mov di, cs
mov es, di
mov di, offset PasswordCode
mov cx, PWLength
call FindCode
jc NotThere ;If didn't find pw code.
; Patch the XWING password code here. Just store NOPs over the five
; bytes of the far call to the password routine.
mov byp ds:[si+11], 090h ;NOP out a far call
mov byp ds:[si+12], 090h
mov byp ds:[si+13], 090h
mov byp ds:[si+14], 090h
mov byp ds:[si+15], 090h
; Adjust the return address and restore the patched joystick code so
; that it doesn't bother jumping to us anymore.
NotThere: sub word ptr [bp+2], 5 ;Back up return address.
les bx, [bp+2] ;Fetch return address.
; Store the original joystick code over the call we patched to this
; routine.
mov ax, word ptr JoyStickCode
mov es:[bx], ax
mov ax, word ptr JoyStickCode+2
mov es:[bx+2], ax
mov al, byte ptr JoyStickCode+4
mov es:[bx+4], al
popa
pop es
pop ds
pop bp
ret
SearchPW endp
;****************************************************************************
;
; FindCode: On entry, ES:DI points at some code in *this* program which
; appears in the XWING game. DS:SI points at a block of memory
; in the XWING game. FindCode searches through memory to find the
; suspect piece of code and returns DS:SI pointing at the start of
; that code. This code assumes that it *will* find the code!
; It returns the carry clear if it finds it, set if it doesn't.
FindCode proc near
push ax
push bx
push dx
DoCmp: mov dx, 1000h ;Search in 4K blocks.
CmpLoop: push di ;Save ptr to compare code.
push si ;Save ptr to start of string.
push cx ;Save count.
repe cmpsb
pop cx
pop si
pop di
je FoundCode
inc si
dec dx
jne CmpLoop
sub si, 1000h
mov ax, ds
inc ah
mov ds, ax
cmp ax, 9000h ;Stop at address 9000:0
jb DoCmp ; and fail if not found.
pop dx
pop bx
pop ax
stc
ret
FoundCode: pop dx
pop bx
pop ax
clc
ret
FindCode endp
;****************************************************************************
;
; Call to password code that appears in the XWING game. This is actually
; data that we're going to search for in the XWING object code.
PasswordCode proc near
call $+47h
mov [bp-4], ax
mov [bp-2], dx
push dx
push ax
byte 9ah, 04h, 00
PasswordCode endp
EndPW:
PWLength = EndPW-PasswordCode
; The following is the joystick code we're going to search for.
JoyStickCode proc near
sti
neg bx
neg di
pop bp
pop dx
pop cx
ret
mov bp, bx
in al, dx
mov bl, al
not al
and al, ah
jnz $+11h
in al, dx
JoyStickCode endp
EndJSC:
JoyLength = EndJSC-JoyStickCode
cseg ends
sseg segment para stack 'STACK'
dw 256 dup (0)
endstk dw ?
sseg ends
zzzzzzseg segment para public 'zzzzzzseg'
Heap db 1024 dup (0)
zzzzzzseg ends
end Main
- 18.9 - Semiresident Programs
Art of Assembly: Chapter Eighteen - 29 SEP 1996
[Chapter Eighteen][Previous]
[Art of Assembly][Randall
Hyde]