Jan 162018
 
Monitors a programs BIOS and DOS calls. Great for determining how a program operates, and what files it opens, etc. A must for debugging.
File INTERCE.ZIP from The Programmer’s Corner in
Category System Diagnostics
Monitors a programs BIOS and DOS calls. Great for determining how a program operates, and what files it opens, etc. A must for debugging.
File Name File Size Zip Size Zip Type
INTERCEP.C 11418 4177 deflated
INTERCEP.DOC 6896 2723 deflated
INTERCEP.EXE 21282 12789 deflated
INTERCEP.H 1295 600 deflated
INTERCEP.TXT 2254 1091 deflated
INTERPRE.C 6291 2193 deflated
INTERPRE.DAT 7892 2768 deflated
INTERPRE.EXE 32464 6864 deflated

Download File INTERCE.ZIP Here

Contents of the INTERCEP.DOC file


INTERCEPT/INTERPRET -- monitor DOS and BIOS calls. By:

Ned Konz
210 Oleeta St.
Ormond Bch, FL 32074
BIX:nkonz CIS:76046,223 (904)672-2431
08/02/1987

============================================================
Program description:
============================================================
INTERCEPT (intercep.exe) and INTERPRET (interpre.exe)
were written so I could monitor the interaction between
unknown programs and MS-DOS (and the BIOS). I've used them
to help disassemble and patch programs, as well as to
debug my own programs.

I'll give a short example of how you run INTERCEPT here.
I'm not going to explain what the DOS or BIOS are, or why
anyone should care what a program does with them. If you
don't know, you probably don't need this program. But if
you want to learn about the IBM-PC or MS-DOS, INTERCEPT
makes a good learning tool along with a good book on DOS
(like Peter Norton's "Programmer's Guide to the IBM PC".)

Suppose you were curious about what the DOS utility
"LABEL.COM" does. Run INTERCEPT like this (assuming you've
installed it properly; see a later section of this file):

intercept label

You'll see a logo from INTERCEPT appear, followed by
the normal operation of LABEL. Answer its question, and
it ends. At this point, INTERCEPT runs INTERPRET and
a file called "intercep.out" is produced in the current
directory.

INTERCEP.OUT looks like this:

INTERCEPT/INTERPRET by Ned Konz 08/02/87
dump of DOS/BIOS calls from program "label"
595A:0597 2130 Get DOS version number
595A:05BD 2119 Report current drive
595A:05CC 21 4409 0003 0000 595a 595a 595a 0100 fffe 0882
595A:05E8 211a Set DTA to 595A:0316
595A:05EF 2111 Search for first file matching FCB at 595A:0316
595A:09F5 2140 Write 0014 bytes from 595A:07E0 to file #0002
595A:09F5 2140 Write 0010 bytes from 595A:07E0 to file #0002
595A:09F5 2140 Write 0014 bytes from 595A:07E0 to file #0002
595A:09F5 2140 Write 0014 bytes from 595A:07E0 to file #0002
595A:09F5 2140 Write 0008 bytes from 595A:07E0 to file #0002
595A:0714 213f Read 007F bytes from file #0000 to 595A:0081
595A:09F5 2140 Write 0002 bytes from 595A:07E0 to file #0002
595A:0778 2113 Delete file using FCB at 595A:0343
595A:078A 215b Create new file (name at 595A:0304, attr. 08)
595A:0792 213e Close file handle #0006
595A:0592 214c Terminate process (return code 00)

What the lines mean is this:

* The first field (like "595A:0597") is the program counter address
from which the DOS or BIOS interrupts were called.

* The second field (like "2130") is the interrupt (here 21h, the
DOS catchall interrupt) and (possibly) the AH or AX values
(the 30 here means that AH equaled 30h -- the function code
for "get DOS version number", and AL (the other half of the
A register called AX) was unimportant.

* The rest of the line is a description of what that INTerrupt
call means in the context of MS-DOS or the IBM-PC BIOS, as defined
in the INTERPRE.DAT file. You can change this file if you need to,
to correct it or add other definitions.

In other words, if you used DEBUG to look at LABEL.COM around offset 0597,
you'd see:

3F24:058E B44C MOVAH,4C
3F24:0590 B000 MOVAL,00
3F24:0592 CD21 INT21
3F24:0594 50 PUSHAX
3F24:0595 B430 MOVAH,30
3F24:0597 CD21 INT21
3F24:0599 3D0314 CMPAX,1403
3F24:059C 740A JZ05A8

Note that there are two INT 21 instructions in this short segment.
The one at offset 0592 corresponds to the last line in INTERCEP.OUT:
595A:0592 214c Terminate process (return code 00)
and the one at offset 0597 corresponds to the first line:
595A:0597 2130 Get DOS version number
Note also that the segment values here (3F24:) are different
than in INTERCEP.OUT. This is because both DEBUG and INTERCEPT
ran LABEL.COM as a "child process", and they're different
sizes.

What about the line that reads:
595A:05CC 21 4409 0003 0000 595a 595a 595a 0100 fffe 0882
Well, that's one of those "RESERVED", undocumented DOS calls
which is used frequently by the DOS utilities. I've documented
some of these, like INT 21h, function 37h, sub-functions 01 and 02,
which get and set the DOS parameter switch character (and
are called by the undocumented Turbo C routines getswitchar() and
setswitchar().)

You can run INTERCEPT as "intercep -L" and get a long-form
output, with the values of all the registers at each call.

============================================================
INSTALLING INTERCEPT:
============================================================
INTERCEPT is supplied as an ARC file. If you're reading
this, you've figured out how to take apart an ARC file.
Just move the following files to a directory that's
somewhere on your PATH:
INTERCEP.EXE-- The INTERCEPT program itself
INTERPRE.EXE-- The INTERPRET program
INTERPRE.DAT-- The definition of all the interrupts
The rest of the files here are either documentation
or C source text, and aren't necessary to operation of the
program. If you run INTERCEPT without any command-line
arguments, you can get a usage prompt. (see below)

============================================================
Contents of ARC file:
============================================================
Filename Length Method Size Ratio Date Time
-------- ------ ------ ------ ----- ---- ----
INTERCEP.C 11197 Crunched 5798 49% 08-02-87 18:35:42
INTERCEP.DOC 6896 Crunched 3731 46% 08-02-87 19:32:38
INTERCEP.EXE 16400 Crunched 12612 24% 08-02-87 18:41:20
INTERCEP.H 1232 Crunched 802 35% 08-02-87 15:03:42
INTERPRE.C 6291 Crunched 3315 48% 08-02-87 18:37:52
INTERPRE.DAT 7435 Crunched 3960 47% 08-02-87 18:50:22
INTERPRE.EXE 32464 Crunched 8704 74% 08-02-87 18:41:22
---- ------ ------ -----
0007 81915 38922 53%

============================================================
INTERCEPT: Usage:
============================================================
intercept [-l] [-T tmpdir] [-s maxcalls] [-o outfile] program [args[...]]
-lsets long format output: explanation AND register values
-Tsets temporary directory for intermediate file to "tmpdir"
(will use TMP or TMPDIR environment vars. if found otherwise)
-ssets the maximum number of SWI records to "maxcalls"
-onames the output filename to "outfile" rather than
the default name ("intercep.out")
programis the name of the program to monitor
argsare any command-line arguments to be passed
to the monitored program.
============================================================


 January 16, 2018  Add comments

Leave a Reply