Category : Recently Uploaded Files
Archive   : INTER48B.ZIP
Filename : INTERRUP.E

Interrupt List, part 5 of 14
This compilation is Copyright (c) 1989,1990,1991,1992,1993,1994,1995 Ralf Brown
--------D-213F-------------------------------
INT 21 - DOS 2+ - "READ" - READ FROM FILE OR DEVICE
AH = 3Fh
BX = file handle
CX = number of bytes to read
DS:DX -> buffer for data
Return: CF clear if successful
AX = number of bytes actually read (0 if at EOF before call)
CF set on error
AX = error code (05h,06h) (see #0960 at AH=59h)
Notes: data is read beginning at current file position, and the file position
is updated after a successful read
the returned AX may be smaller than the request in CX if a partial
read occurred
if reading from CON, read stops at first CR
under the FlashTek X-32 DOS extender, the pointer is in DS:EDX
BUG: Novell NETX.EXE v3.26 and 3.31 do not set CF if the read fails due to
a record lock (see AH=5Ch), though it does return AX=0005h; this
has been documented by Novell
SeeAlso: AH=27h,AH=40h,AH=93h,INT 2F/AX=1108h,INT 2F/AX=1229h
--------G-213F-------------------------------
INT 21 - Turbo Debug HARDWARE BREAKPOINTS - READ STATUS BLOCK
AH = 3Fh
BX = handle for character device "TDHDEBUG"
CX = number of bytes to read
DS:DX -> buffer for status block (see #0704)
Return: CF clear if successful
AX = number of bytes actually read
CF set on error
AX = error code (05h,06h) (see #0960 at AH=59h)
SeeAlso: AH=40h"Turbo Debug"

(Table 0703)
Values for status of Turbo Debugger command:
00h successful
01h invalid handle
02h no more breakpoints available
03h hardware does not support specified breakpoint type
04h previous command prevents execution
05h debugger hardware not found
06h hardware failure
07h invalid command
08h driver not initialized yet
FEh recursive entry (hardware breakpoint inside hw bp handler)

Format of Turbo Debugger status block:
Offset Size Description (Table 0704)
00h BYTE status of command (see #0703)
---status for command 01h---
01h WORD device driver interface version number (currently 1)
03h WORD device driver software version
05h BYTE maximum simultaneous hardware breakpoints
06h BYTE configuration bits (see #0705)
07h BYTE supported breakpoint types (see #0706)
08h WORD supported addressing match modes (see #0707)
0Ah WORD supported data matches (see #0708)
0Ch BYTE maximum data match length (01h, 02h, or 04h)
0Dh WORD size of onboard memory (in KB)
0Fh WORD maximum number of trace-back events
11h WORD hardware breakpoint enable byte address segment (0000h if not
supported)
---status for command 04h---
01h BYTE handle to use when referring to the just-set breakpoint

Bitfields for Turbo Debugger configuration bits:
Bit(s) Description (Table 0705)
0 CPU and DMA accesses are distinct
1 can detect DMA transfers
2 supports data mask
3 hardware pass counter on breakpoints
4 can match on data as well as addresses

Bitfields for Turbo Debugger supported breakpoint types:
Bit(s) Description (Table 0706)
0 memory read
1 memory write
2 memory read/write
3 I/O read
4 I/O write
5 I/O read/write
6 instruction fetch

Bitfields for Turbo Debugger supported addressing match modes:
Bit(s) Description (Table 0707)
0 any address
1 equal to test value
2 not equal
3 above test value
4 below test value
5 below or equal
6 above or equal
7 within range
8 outside range

Bitfields for Turbo Debugger supported data matches:
Bit(s) Description (Table 0708)
0 any data
1 equal to test value
2 not equal
3 above test value
4 below test value
5 below or equal
6 above or equal
7 within range
8 outside range
--------N-213F-------------------------------
INT 21 - PC/TCP IPCUST.SYS - READ CONFIGURATION DATA
AH = 3Fh
BX = handle for character device "$IPCUST"
CX = number of bytes to read
DS:DX -> buffer for configuration data (see #0709)
Return: CF clear if successful
AX = number of bytes actually read
CF set on error
AX = error code (05h,06h) (see #0960 at AH=59h)
Notes: if less than the entire data is read or written, the next read/write
continues where the previous one ended; IOCTL calls AX=4402h and
AX=4403h both reset the location at which the next operation starts
to zero
the data pointer is also reset to zero if the previous read or write
reached or exceeded the end of the data, when the current function
is read and the previous was write, or vice versa
v2.1+ uses a new configuration method, but allows the installation
of IPCUST.SYS for backward compatibility with other software which
must read the PC/TCP configuration
SeeAlso: AH=40h"IPCUST",AX=4402h"IPCUST",AX=4402h"FTPSOFT"

Format of PC/TCP configuration data:
Offset Size Description (Table 0709)
00h 12 BYTEs IPCUST.SYS device driver header
12h BYTE ???
13h BYTE ???
14h WORD ???
16h BYTE bit flags
bit 0: send BS rather than DEL for BackSpace key
bit 1: wrap long lines
17h BYTE ???
18h 64 BYTEs ASCIZ hostname
58h 64 BYTEs ASCIZ domain name
(fully qualified domain name is hostname.domain-name)
98h 16 BYTEs ASCIZ username
A8h 64 BYTEs ASCIZ full name
E8h 64 BYTEs ASCIZ office address
128h 32 BYTEs ASCIZ phone number
148h WORD offset from GMT in minutes
14Ah 4 BYTEs ASCIZ timezone name
14Eh WORD number of time servers
150h ? DWORDs (big-endian) IP addresses for time servers
???
164h WORD number of old-style name servers
166h 3 DWORDs (big-endian) IP addresses for name servers
172h WORD number of domain name servers
174h 3 DWORDs (big-endian) IP addresses for domain name servers
180h DWORD (big-endian) IP address of default gateway
184h DWORD (big-endian) IP address of log server
188h DWORD (big-endian) IP address of cookie server
18Ch DWORD (big-endian) IP address of lpr server
190h DWORD (big-endian) IP address of imagen print server
194h 54 BYTEs ???
1E8h WORD TCP default window size in bytes
1EAh WORD TCP low window size
1ECh 64 BYTEs ASCIZ host tabel filename
22Ch 2 BYTEs ???
22Eh 80 BYTEs ASCIZ mail relay host name
27Eh BYTE ???
27Fh BYTE ??? bit flags
280h 44 BYTEs ???
2ACh WORD ???
2AEh 202 BYTEs ???
--------N-213F-------------------------------
INT 21 - WORKGRP.SYS - GET ENTRY POINT
AH = 3Fh
BX = file handle for device "NET$HLP$"
CX = 0008h
DS:DX -> buffer for entry point record (see #0779)
Return: CF clear if successful
AX = number of bytes actually read (0 if at EOF before call)
CF set on error
AX = error code (05h,06h) (see #0960 at AH=59h)
Program: WORKGRP.SYS is the portion of Microsoft's Workgroup Connection which
permits communication with PCs running Windows for Workgroups or
LAN Manager
SeeAlso: AX=4402h"WORKGRP.SYS",INT 2F/AX=9400h
--------N-213F-------------------------------
INT 21 - BW-TCP - GET DRIVER INFO
AH = 3Fh
BX = file handle for device "ETHDEV27"
CX = 002Bh
DS:DX -> buffer for driver info (see #0710)
Return: CF clear if successful
AX = number of bytes actually read (0 if at EOF before call)
CF set on error
AX = error code (05h,06h) (see #0960 at AH=59h)
Program: BW-TCP is a TCP/IP protocol stack by Beame & Whiteside Software
Notes: the B&W socket library performs an INT 21/AX=4401h with DX=0060h before
making this call to retrieve the driver information; one should also
call the private API interrupt with AH=15h
the installation check for the TCP/IP stack is to test for the
existence of the character device UDP-IP10
SeeAlso: INT 14/AH=56h,INT 62/AH=00h"ETHDEV",INT 63/AH=03h,INT 64/AH=00h
Index: installation check;BW-TCP hardware driver
Index: installation check;BW-TCP TCPIP.SYS

Format of BW-TCP driver info:
Offset Size Description (Table 0710)
00h WORD I/O base address
02h BYTE shared memory page (01h = segment 0100h, etc.)
03h BYTE interrupt vector for private API
04h BYTE IRQ used by board
05h WORD size of data buffer
07h WORD maximum transfer window
09h WORD time zone
0Bh BYTE address type (01h user, 04h RARP, 05h BOOTP)
0Ch DWORD internet address
10h WORD "value" ???
12h BYTE subnet mask
13h WORD "ether_pointer" ???
15h WORD offset in device driver of log server records (see #0711)
17h WORD offset in device driver of name server records (see #0711)
19h WORD offset in device driver of print server records (see #0711)
1Bh WORD offset in device driver of time server records (see #0711)
1Dh WORD offset in device driver of gateway records (see #0711)
1Fh WORD segment address of device driver
21h BYTE transfer size
22h 9 BYTEs network adapter board name
---11/21/91+ ---
23h BYTE ETHDEV version (major in high nybble, minor in low nybble)
24h BYTE ETHDEV revision
25h BYTE TCPIP version (major in high nybble, minor in low nybble)
26h BYTE TCPIP revision
27h BYTE BWRPC version (major in high nybble, minor in low nybble)
28h BYTE BWRPC revision
29h BYTE BWNFS version (major in high nybble, minor in low nybble)
2Ah BYTE BWNFS revision
2Bh BYTE Telnet version (major in high nybble, minor in low nybble)
2Ch BYTE Telnet revision
2Dh BYTE NETBIOS version (major in high nybble, minor in low nybble)
2Eh BYTE NETBIOS revision
Note: for each driver, if version=0, the driver is not installed or does
not support the version check

Format of BW-TCP server records:
Offset Size Description (Table 0711)
00h BYTE number of server records following
01h N DWORDs internet addresses of servers
--------y-213F-------------------------------
INT 21 - Trusted Access - NB.SYS - GET STATE
AH = 3Fh
BX = file handle for device "$$NB$$NB"
CX = 0002h (size of state)
DS:DX -> buffer for state record (see #0712)
Return: CF clear if successful
AX = number of bytes actually read (0 if at EOF before call)
CF set on error
AX = error code (05h,06h) (see #0960 at AH=59h)
Program: Trusted Access is a security and access-control package by Lassen
Software, Inc.; NB.SYS is a device driver to prevent the user from
terminating CONFIG.SYS or AUTOEXEC.BAT with Ctrl-Break
SeeAlso: AH=40h"NB.SYS",AX=4101h

Format of Trusted Access state record:
Offset Size Description (Table 0712)
00h BYTE 00h off, 01h on
01h BYTE keys being disabled
bit 0: Ctrl-Break
bit 1: SysReq
bit 2: Ctrl and Alt
bit 3: Ctrl-Alt-Del
bit 7: all keys (overrides other bits)
----------213F-------------------------------
INT 21 U - IFSHLP.SYS - GET ENTRY POINT
AH = 3Fh
BX = file handle for device "IFS$HLP$"
CX = 0008h (size of buffer in bytes)
DS:DX -> buffer for entry point record (see #0713)
Return: CF clear if successful
AX = number of bytes actually read (0 if at EOF before call)
CF set on error
AX = error code (05h,06h) (see #0960 at AH=59h)
Program: IFSHLP.SYS is a support driver for Microsoft Windows for Workgroups
SeeAlso: AX=4402h"IFSHLP"

Format of IFSHLP.SYS entry point record:
Offset Size Description (Table 0713)
00h 4 BYTEs (call) signature 70h E9h 34h 37h
signature must be 34h 37h 70h EFh if called via IOCTL
04h DWORD (ret) pointer to FAR call entry point (see #0714)

(Table 0714)
Call IFSHLP.SYS entry point with:
STACK: WORD function number (00h-0Ch)
00h ???
01h set ??? intercept
02h remove ??? intercept
03h ??? LPT2
04h ??? LPT1
05h ??? and remove ??? intercept
06h set ??? flag
07h clear ??? flag
08h get ??? flag word
09h ???
0Ah ???
0Bh ???
0Ch get ???
---if function 00h---
Return: AX = ??? (0024h seen)
DX = resident code segment
---if function 01h---
STACK: DWORD new intercept address
Return: AX = status
0000h successful
0001h failed (already set)
DX = 0000h
---if function 02h---
Return: AX = status
0000h successful
0001h failed (not set)
DX = 0000h
---if function 03h,04h---
STACK: WORD ???
Return: AX = 0000h
DX = 0000h
---if function 05h---
???
---if function 06h---
Return: AX = 0001h and DX = 0000h if already set
AX,DX unchanged if successful
---if function 07h---
Return: AX = 0001h and DX = 0000h if not set
AX,DX unchanged if successful
---if function 08h---
Return: DX = 0000h
AX = flags (bit 0 set/cleared by functions 06h and 07h)
---if function 09h---
Return: AX = status
0000h successful
0001h failed (already called)
---if function 0Ah---
STACK: WORD ???
???
---if function 0Bh---
Return: AX = status
0000h successful
0001h failed (not set)
---if function 0Ch---
Return: AX = 0000h
ES:BX -> ??? data
---if function > 0Ch---
Return: AX = 0001h
DX = 0000h
--------D-2140-------------------------------
INT 21 - DOS 2+ - "WRITE" - WRITE TO FILE OR DEVICE
AH = 40h
BX = file handle
CX = number of bytes to write
DS:DX -> data to write
Return: CF clear if successful
AX = number of bytes actually written
CF set on error
AX = error code (05h,06h) (see #0960 at AH=59h)
Notes: if CX is zero, no data is written, and the file is truncated or
extended to the current position
data is written beginning at the current file position, and the file
position is updated after a successful write
the usual cause for AX < CX on return is a full disk
BUG: a write of zero bytes will appear to succeed when it actually failed
if the write is extending the file and there is not enough disk
space for the expanded file (DOS 5.0-6.0); one should therefore check
whether the file was in fact extended by seeking to 0 bytes from
the end of the file (INT 21/AX=4202h/CX=0/DX=0)
under the FlashTek X-32 DOS extender, the pointer is in DS:EDX
SeeAlso: AH=28h,AH=3Fh,AH=93h,INT 2F/AX=1109h
--------G-2140-------------------------------
INT 21 - Turbo Debug HARDWARE BREAKPOINTS - SEND CMD TO HARDWARE BRKPNT DRIVER
AH = 40h
BX = handle for character device "TDHDEBUG"
CX = number of bytes to write
DS:DX -> hardware breakpoint command (see #0715)
Return: CF clear if successful
AX = number of bytes actually written
CF set on error
AX = error code (05h,06h) (see #0960 at AH=59h)
Note: results are retrieved by reading from the device
SeeAlso: AH=3Fh"Turbo Debug"

Format of Turbo Debugger hardware breakpoint commands:
Offset Size Description (Table 0715)
00h BYTE command code
00h install interrupt vectors
01h get hardware capabilities
02h enable hardware breakpoints
03h disable hardware breakpoints
04h set hardware breakpoint
05h clear hardware breakpoint
06h set I/O base address and reset hardware
07h restore interrupt vectors
---command code 00h---
01h DWORD pointer to Turbo Debugger entry point to be jumped to on
hardware breakpoint; call with CPU state the same as on
the breakpoint except for pushing AX and placing an entry
code (FFh if breakout button or breakpoint handle) in AH
---command code 04h---
01h BYTE breakpoint type
00h memory read
01h memory write
02h memory read/write
03h I/O read
04h I/O write
05h I/O read/write
06h instruction fetch
02h BYTE address matching mode (see #0716)
03h DWORD 32-bit linear low address
07h DWORD 32-bit linear high address
0Bh WORD pass count
0Dh BYTE data size (01h, 02h, or 04h)
0Eh BYTE source of matched bus cycle (01h CPU, 02h DMA, 03h either)
0Fh BYTE data-matching mode (see #0716)
10h DWORD low data value
14h DWORD high data value
18h DWORD data mask specifying which bits of the data are tested
---command code 05h---
01h BYTE handle of breakpoint to clear (breakpoint returned from command
04h)
---command code 06h---
01h WORD base address of hardware debugger board

(Table 0716)
Values for Turbo Debugger address/data matching mode:
00h match any
01h equal to test value
02h different from test value
03h above test value
04h below test value
05h below or equal to test value
06h above or equal to test value
07h within inclusive range
08h outside specified range
--------N-2140-------------------------------
INT 21 - PC/TCP IPCUST.SYS - WRITE CONFIGURATION DATA
AH = 40h
BX = handle for character device "$IPCUST"
CX = number of bytes to write
DS:DX -> buffer for configuration data (AH=3Fh"IPCUST")
Return: CF clear if successful
AX = number of bytes actually written
CF set on error
AX = error code (05h,06h) (see #0960 at AH=59h)
Notes: if less than the entire data is read or written, the next read/write
continues where the previous one ended; IOCTL calls AX=4402h and
AX=4403h both reset the location at which the next operation starts
to zero
the data pointer is also reset to zero if the previous read or write
reached or exceeded the end of the data, when the current function
is read and the previous was write, or vice versa
v2.1+ uses a new configuration method, but allows the installation
of IPCUST.SYS for backward compatibility with other software which
must read the PC/TCP configuration
SeeAlso: AH=3Fh"IPCUST",AX=4402h"IPCUST"
--------y-2140-------------------------------
INT 21 U - Trusted Access - NB.SYS - SET STATE
AH = 40h
BX = handle for character device "$$NB$$NB"
DS:DX -> state record (see #0712)
CX ignored
Return: CF clear if successful
AX = number of bytes actually written
CF set on error
AX = error code (05h,06h) (see #0960 at AH=59h)
Program: Trusted Access is a security and access-control package by Lassen
Software, Inc.; NB.SYS is a device driver to prevent the user from
terminating CONFIG.SYS or AUTOEXEC.BAT with Ctrl-Break
SeeAlso: AH=3Fh"NB.SYS"
--------j-214000BX0002-----------------------
INT 21 - FARTBELL.EXE - INSTALLATION CHECK
AX = 4000h
BX = 0002h
CX = 0000h
DS:DX = 0000h:0000h
Return: CF clear if installed
AX = CS of resident code
Program: FARTBELL is a joke program by Guenther Thiele which makes various
noises when programs output a bell
SeeAlso: AX=4001h
--------j-214001BX0002-----------------------
INT 21 - FARTBELL.EXE - FORCE NOISE
AX = 4001h
BX = 0002h
CX = 0000h
DS:DX = 0000h:0000h
Program: FARTBELL is a joke program by Guenther Thiele which makes various
noises when programs output a bell
SeeAlso: AX=4000h
--------D-2141-------------------------------
INT 21 - DOS 2+ - "UNLINK" - DELETE FILE
AH = 41h
DS:DX -> ASCIZ filename (no wildcards, but see notes)
CL = attribute mask for deletion (server call only, see notes)
Return: CF clear if successful
AX destroyed (DOS 3.3) AL seems to be drive of deleted file
CF set on error
AX = error code (02h,03h,05h) (see #0960 at AH=59h)
Notes: (DOS 3.1+) wildcards are allowed if invoked via AX=5D00h, in which case
the filespec must be canonical (as returned by AH=60h), and only
files matching the attribute mask in CL are deleted
DR-DOS 5.0-6.0 returns error code 03h if invoked via AX=5D00h
DOS does not erase the file's data; it merely becomes inaccessible
because the FAT chain for the file is cleared
deleting a file which is currently open may lead to filesystem
corruption. Unless SHARE is loaded, DOS does not close the handles
referencing the deleted file, thus allowing writes to a nonexistant
file.
under DRDOS and DR Multiuser DOS, this function will fail if the file
is currently open
under the FlashTek X-32 DOS extender, the pointer is in DS:EDX
BUG: DR-DOS 3.41 crashes if called via AX=5D00h
SeeAlso: AH=13h,AX=4301h,AX=4380h,AX=5D00h,AH=60h,AH=71h,AX=F244h
SeeAlso: INT 2F/AX=1113h
--------y-214101DXFFFE-----------------------
INT 21 - SoftLogic Data Guardian - ???
AX = 4101h
DX = FFFEh
Return: AX = 0000h if installed
Note: resident code sets several internal variables on this call
SeeAlso: AH=3Fh"NB.SYS",INT 16/AX=FFA3h/BX=0000h
--------D-2142-------------------------------
INT 21 - DOS 2+ - "LSEEK" - SET CURRENT FILE POSITION
AH = 42h
AL = origin of move
00h start of file
01h current file position
02h end of file
BX = file handle
CX:DX = offset from origin of new file position
Return: CF clear if successful
DX:AX = new file position in bytes from start of file
CF set on error
AX = error code (01h,06h) (see #0960 at AH=59h)
Notes: for origins 01h and 02h, the pointer may be positioned before the
start of the file; no error is returned in that case, but subsequent
attempts at I/O will produce errors
if the new position is beyond the current end of file, the file will
be extended by the next write (see AH=40h)
BUG: using this method to grow a file from zero bytes to a very large size
can corrupt the FAT in some versions of DOS; the file should first
be grown from zero to one byte and then to the desired large size
SeeAlso: AH=24h,INT 2F/AX=1228h
--------v-214203-----------------------------
INT 21 - VIRUS - "Shake" - INSTALLATION CHECK
AX = 4203h
Return: AX = 1234h if resident
SeeAlso: AX=3DFFh,AX=4243h
--------v-214243-----------------------------
INT 21 - VIRUS - "Invader" - INSTALLATION CHECK
AX = 4243h
Return: AX = 5678h if resident
SeeAlso: AX=4203h,AX=4B04h
--------D-214300-----------------------------
INT 21 - DOS 2+ - GET FILE ATTRIBUTES
AX = 4300h
DS:DX -> ASCIZ filename
Return: CF clear if successful
CX = file attributes (see #0717)
AX = CX (DR-DOS 5.0)
CF set on error
AX = error code (01h,02h,03h,05h) (see #0960 at AH=59h)
Notes: under the FlashTek X-32 DOS extender, the filename pointer is in DS:EDX
under DR-DOS 3.41 and 5.0, attempts to change the subdirectory bit are
simply ignored without an error
BUG: Windows for Workgroups returns error code 05h (access denied) instead
of error code 02h (file not found) when attempting to get the
attributes of a nonexistent file. This causes open() with O_CREAT
and fopen() with the "w" mode to fail in Borland C++.
SeeAlso: AX=4301h,AX=4310h,AH=71h,AH=B6h,INT 2F/AX=110Fh,INT 60/DI=0517h
--------D-214301-----------------------------
INT 21 - DOS 2+ - "CHMOD" - SET FILE ATTRIBUTES
AX = 4301h
CX = new file attributes (see #0717)
DS:DX -> ASCIZ filename
Return: CF clear if successful
AX destroyed
CF set on error
AX = error code (01h,02h,03h,05h) (see #0960 at AH=59h)
Notes: will not change volume label or directory attribute bits, but will
change the other attribute bits of a directory (the directory
bit must be cleared to successfully change the other attributes of a
directory, but the directory will not be changed to a normal file as
a result)
MS-DOS 4.01 reportedly closes the file if it is currently open
for security reasons, the Novell NetWare execute-only bit can never
be cleared; the file must be deleted and recreated
under the FlashTek X-32 DOS extender, the filename pointer is in DS:EDX
DOS 5.0 SHARE will close the file if it is currently open in sharing-
compatibility mode, otherwise a sharing violation critical error is
generated if the file is currently open
SeeAlso: AX=4300h,AX=4311h,AH=71h,INT 2F/AX=110Eh

Bitfields for file attributes:
Bit(s) Description (Table 0717)
7 shareable (Novell NetWare)
6 unused
5 archive
4 directory
3 volume label
execute-only (Novell NetWare)
2 system
1 hidden
0 read-only
--------D-214302-----------------------------
INT 21 - DOS 7 (Chicago) - GET VOLUME INFORMATION
AX = 4302h
details not yet available
SeeAlso: AH=71h,AH=72h
--------O-214302-----------------------------
INT 21 - DR-DOS 3.41+ internal - GET ACCESS RIGHTS
AX = 4302h
DS:DX -> ASCIZ pathname
Return: CF clear if successful
CX = access rights (see #0718)
AX = CX (DR-DOS 5.0)
CF set on error
AX = error code
Desc: Determine which operations the calling program may perform on a
specified file without being required to provide a password.
Notes: this protection scheme has been coordinated on all current Digital
Research/Novell operating systems (DR-DOS 3.41+, DRMDOS 5.x, and
FlexOS 2+)
this function is documented in DR-DOS 6.0 and corresponds to the
"Get/Set File Attributes" function, subfunction 2, documented in
Concurrent DOS.
only FlexOS actually uses the "execution" bits; DR-DOS 3.41+ treats
them as "read" bits.
DR-DOS 3.41-5.x only use bits 0-3. Only DR-DOS 6.0 using a
DRMDOS 5.x security system allowing for users and groups uses bits
4-11.
SeeAlso: AX=4303h

Bitfields for DR-DOS file access rights:
Bit(s) Description (Table 0718)
0 owner delete requires password
1 owner execution requires password (FlexOS)
2 owner write requires password
3 owner read requires password
4 group delete requires password
5 group execution requires password (FlexOS)
6 group write requires password
7 group read requires password
8 world delete requires password
9 world execution requires password (FlexOS)
10 world write requires password
11 world read requires password
--------O-214303-----------------------------
INT 21 - DR-DOS 3.41+ internal - SET ACCESS RIGHTS AND PASSWORD
AX = 4303h
CX = access rights
bits 11-0: access rights (see #0718)
bit 15: new password is to be set
DS:DX -> ASCIZ pathname
[DTA] = new password if CX bit 15 is set (blank-padded to 8 characters)
Return: CF clear if successful
CF set on error
AX = error code
Notes: if the file is already protected, the old password must be added after
the pathname, separated by a ";"
this function is documented in DR-DOS 6.0 and corresponds to the

"Get/Set File Attributes" function, subfunction 3, documented in
Concurrent DOS.
SeeAlso: AH=0Fh,AH=17h,AX=4302h"DR-DOS",AX=4305h,AX=4454h
--------O-214304-----------------------------
INT 21 U - DR-DOS 5.0-6.0 internal - GET ENCRYPTED PASSWORD
AX = 4304h
DS:DX -> ASCIZ filename
???
Return: CF clear if successful
CX = AX = 0000h if no password assigned to file
CF set on error
AX = error code (see #0960 at AH=59h)
Note: this function is only supported by DR-DOS 5.0 and 6.0 and DRMDOS 5.1
SeeAlso: AX=4303h,AX=4305h
--------O-214305-----------------------------
INT 21 U - DR-DOS 5.0-6.0 internal - SET EXTENDED FILE ATTRIBUTES
AX = 4305h
DS:DX -> ASCIZ filename
???
Return: CF clear if successful
CF set on error
AX = error code (see #0960 at AH=59h)
Desc: this function allows the extended attributes, and optionally the
encrypted password, of a file to be set.
Note: this function is only supported by DR-DOS 5.0 and 6.0 and DRMDOS 5.1
SeeAlso: AX=4304h,AX=4311h
--------O-214306-----------------------------
INT 21 - DR-DOS 6.0 - GET FILE OWNER
AX = 4306h
DS:DX -> ASCIZ filename
Return: CF clear if successful
AX = CX = value set with AX=4307h
CF set on error
AX = error code (see #0960 at AH=59h)
SeeAlso: AX=4307h
--------O-214307-----------------------------
INT 21 - DR-DOS 6.0 - SET FILE OWNER
AX = 4307h
CX = ??? (owner identification number?)
DS:DX -> ASCIZ filename
Return: CF clear if successful
CF set on error
AX = error code (see #0960 at AH=59h)
SeeAlso: AX=4306h
--------N-214310-----------------------------
INT 21 - Banyan VINES 2.1+ - GET EXTENDED FILE ATTRIBUTES
AX = 4310h
DS:DX -> ASCIZ filename
Return: CF clear if successful
CH = attributes (see #0719)
CF set on error
AX = error code (01h,02h,03h,05h) (see #0960 at AH=59h)
Note: the filename may be a directory but must be on a VINES file service
SeeAlso: AX=4300h,AX=4311h,AH=B6h,INT 2F/AX=110Fh
--------N-214311-----------------------------
INT 21 - Banyan VINES 2.1+ - SET EXTENDED FILE ATTRIBUTES
AX = 4311h
CH = new attributes (see #0719)
DS:DX -> ASCIZ filename
Return: CF clear if successful
CF set on error
AX = error code (01h,02h,03h,05h) (see #0960 at AH=59h)
Note: the filename may be a directory but must be on a VINES file service
SeeAlso: AX=4301h,AX=4305h,AX=4310h,INT 2F/AX=110Eh

Bitfields for VINES extended file attributes:
Bit(s) Description (Table 0719)
7 unused
6 shareable
5 execute-only
4-0 unused
--------u-214321BX0000-----------------------
INT 21 R - Q87, Q387 - INSTALLATION CHECK
AX = 4321h
BX = 0000h
EAX = 87654321h (entire EAX value is required, not just AX)
Return: EAX = 12345678h if installed
Program: Q387 (renamed to Q87 as of v3.7) is a math coprocessor emulator from
Quickware
Note: this function is available only in virtual-86 mode
SeeAlso: AX=4321h/BX=0001h,AX=4321h/BX=0002h
--------u-214321BX0001-----------------------
INT 21 R - Q87, Q387 - ENABLE EMULATOR
AX = 4321h
BX = 0001h
EAX = 87654321h (entire EAX value is required, not just AX)
Desc: enable the emulator by setting the CPU MSW's EM bit and updating
the BIOS equipment list
Note: this function is available only in virtual-86 mode
SeeAlso: AX=4321h/BX=0000h,AX=4321h/BX=0002h
--------u-214321BX0002-----------------------
INT 21 R - Q87, Q387 - DISABLE EMULATOR
AX = 4321h
BX = 0002h
EAX = 87654321h (entire EAX value is required, not just AX)
Desc: disable the emulator by clearing the CPU MSW's EM bit and updating
the BIOS equipment list
Note: this function is available only in virtual-86 mode
SeeAlso: AX=4321h/BX=0000h,AX=4321h/BX=0001h
--------O-214380-----------------------------
INT 21 - Novell DOS 7 - UNDELETE PENDING DELETE FILE
AX = 4380h
???
Return: ???
SeeAlso: AH=41h,AX=4381h
--------O-214381-----------------------------
INT 21 - Novell DOS 7 - PURGE PENDING DELETE FILE
AX = 4381h
???
Return: ???
SeeAlso: AH=41h,AX=4380h
--------D-214400-----------------------------
INT 21 - DOS 2+ - IOCTL - GET DEVICE INFORMATION
AX = 4400h
BX = handle
Return: CF clear if successful
DX = device information word (see #0720)
AX destroyed
CF set on error
AX = error code (01h,05h,06h) (see #0960 at AH=59h)
Notes: value in DH corresponds to high byte of device driver's attribute word
if handle refers to a character device
Novell NetWare reportedly does not return a drive number in bits 5-0
for a disk file
SeeAlso: AX=4401h,INT 2F/AX=122Bh

Bitfields for device information word:
Bit(s) Description (Table 0720)
character device
14 device driver can process IOCTL requests (see AX=4402h)
13 output until busy supported
11 driver supports OPEN/CLOSE calls
7 set (indicates device)
6 EOF on input
5 raw (binary) mode
4 device is special (uses INT 29)
3 clock device
2 NUL device
1 standard output
0 standard input
disk file
15 file is remote (DOS 3.0+)
14 don't set file date/time on closing (DOS 3.0+)
11 media not removable
8 (DOS 4 only) generate INT 24 if no disk space on write or read past
end of file
7 clear (indicates file)
6 file has not been written
5-0 drive number (0 = A:)
--------D-214401-----------------------------
INT 21 - DOS 2+ - IOCTL - SET DEVICE INFORMATION
AX = 4401h
BX = handle (must refer to character device)
DX = device information word (see #0720)
(DH must be zero)
Return: CF clear if successful
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
SeeAlso: AX=4400h,INT 2F/AX=122Bh
--------D-214402-----------------------------
INT 21 - DOS 2+ - IOCTL - READ FROM CHARACTER DEVICE CONTROL CHANNEL
AX = 4402h
BX = file handle referencing character device
CX = number of bytes to read
DS:DX -> buffer
Return: CF clear if successful
AX = number of bytes actually read
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
Note: format of data is driver-specific (see below for some specific cases)
SeeAlso: AX=4400h,AX=4403h,AX=4404h,INT 2F/AX=122Bh
--------N-214402-----------------------------
INT 21 - Network Driver Interface Specification (NDIS) 2.0.1 - PROTOCOL MANAGER
AX = 4402h
BX = file handle for device "PROTMAN$"
CX = 000Eh (size of request block)
DS:DX -> request block (see #0721,#0722,#0723,#0724,#0725,#0729,#0730)
Return: CF clear if successful
AX = number of bytes actually read
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
SeeAlso: AX=4402h"FTPSOFT"

Format of NDIS request block for GetProtocolManagerInfo:
Offset Size Description (Table 0721)
00h WORD 01h
02h WORD returned status (see #0731)
04h DWORD returned pointer to structure representing parsed user config
08h DWORD unused
0Ch WORD returned BCD version of NDIS on which Protocol Manager is based
SeeAlso: #0722,#0723,#0724,#0725,#0726,#0727,#0728,#0729,#0730

Format of NDIS request block for RegisterModule:
Offset Size Description (Table 0722)
00h WORD 02h
02h WORD returned status (see #0731)
04h DWORD pointer to module's common characteristics table (see #0732)
08h DWORD pointer to list of modules to which the module is to be bound
0Ch WORD unused
SeeAlso: #0721,#0723,#0724,#0725,#0726,#0727,#0728,#0729,#0730

Format of NDIS request block for BindAndStart:
Offset Size Description (Table 0723)
00h WORD 03h
02h WORD returned status (see #0731)
04h DWORD caller's virtual address in FailingModules structure
08h DWORD unused
0Ch WORD unused
SeeAlso: #0721,#0722,#0724,#0725,#0726,#0727,#0728,#0729,#0730

Format of NDIS request block for GetProtocolManagerLinkage:
Offset Size Description (Table 0724)
00h WORD 04h
02h WORD returned status (see #0731)
04h DWORD returned dispatch point
08h DWORD unused
0Ch WORD returned protocol manager DS
Note: the dispatch point may be called as follows instead of using this IOCTL
STACK: WORD protocol manager DS
DWORD pointer to request block
Return: AX = returned status
STACK popped
SeeAlso: #0721,#0722,#0723,#0725,#0726,#0727,#0728,#0729,#0730

Format of NDIS request block for GetProtocolIniPath:
Offset Size Description (Table 0725)
00h WORD 05h
02h WORD returned status (see #0731)
04h DWORD pointer to a buffer for the ASCIZ pathname of PROTOCOL.INI
08h DWORD unused
0Ch WORD buffer length
SeeAlso: #0721,#0722,#0723,#0724,#0726,#0727,#0728,#0729,#0730

Format of NDIS request block for RegisterProtocolManagerInfo:
Offset Size Description (Table 0726)
00h WORD 06h
02h WORD returned status (see #0731)
04h DWORD pointer to structure containing parsed user config file
08h DWORD unused
0Ch WORD length of structure
SeeAlso: #0721,#0722,#0723,#0724,#0725,#0727,#0728,#0729,#0730

Format of NDIS request block for InitAndRegister:
Offset Size Description (Table 0727)
00h WORD 07h
02h WORD returned status (see #0731)
04h DWORD unused
08h DWORD poitner to ASCIZ name of the module to be prebind initialized
0Ch WORD unused
SeeAlso: #0721,#0722,#0723,#0724,#0725,#0726,#0728,#0729,#0730

Format of NDIS request block for UnbindAndStop:
Offset Size Description (Table 0728)
00h WORD 08h
02h WORD returned status (see #0731)
04h DWORD failing modules as for BindAndStart
08h DWORD if not 0000h:0000h, pointer to ASCIZ name of module to unbind
if 0000h:0000h, terminate a set of previously dynamically
bound protocol modules
0Ch WORD unused
SeeAlso: #0721,#0722,#0723,#0724,#0725,#0726,#0727,#0729,#0730

Format of NDIS request block for BindStatus:
Offset Size Description (Table 0729)
00h WORD 09h
02h WORD returned status (see #0731)
04h DWORD must be 0000h:0000h
on return, points to root tree
08h DWORD 0000h:0000h
0Ch WORD unused under DOS
SeeAlso: #0721,#0722,#0723,#0724,#0725,#0726,#0727,#0728,#0730

Format of NDIS request block for RegisterStatus:
Offset Size Description (Table 0730)
00h WORD 0Ah
02h WORD returned status (0000h, 0008h, 002Ch) (see #0731)
04h DWORD 0000h:0000h
08h DWORD pointer to 16-byte ASCIZ module name
0Ch WORD 0000h
Note: not supported by the 10NET v5.0 PROTMAN$ driver
SeeAlso: #0721,#0722,#0723,#0724,#0725,#0726,#0727,#0728,#0729

(Table 0731)
Values for NDIS status code:
0000h success
0001h wait for release--protocol has retained control of the data buffer
0002h request queued
0003h frame not recognized
0004h frame rejected
0005h frame should be forwarded
0006h out of resource
0007h invalid parameter
0008h invalid function
0009h not supported
000Ah hardware error
000Bh transmit error
000Ch unrecognized destination
000Dh buffer too small
0020h already started
0021h binding incomplete
0022h driver not initialized
0023h hardware not found
0024h hardware failure
0025h configuration failure
0026h interrupt conflict
0027h MAC incompatible
0028h initialization failed
0029h no binding
002Ah network may be disconnected
002Bh incompatible OS version
002Ch already registered
002Dh path not found
002Eh insufficient memory
002Fh info not found
00FFh general failure
F000h-FFFFh reserved for vendor-specific codes, treated as general failure

Format of NDIS common characteristics table:
Offset Size Description (Table 0732)
00h WORD size of table in bytes
02h BYTE NDIS major version
03h BYTE NDIS minor version
04h WORD reserved
06h BYTE module major version
07h BYTE module minor version
08h DWORD module function flag bits
bit 0: binding at upper boundary supported
bit 1: binding at lower boundary supported
bit 2: dynamically bound
bits 3-31 reserved, must be 0
0Ch 16 BYTEs ASCIZ module name
1Ch BYTE upper boundary protocol level (see #0733)
1Dh BYTE upper boundary interface type
for MACs: 1 = MAC
for data links and transports: to be defined
for session: 1 = NCB
any level: 0 = private (ISV-defined)
1Eh BYTE lower boundary protocol level (see #0733)
1Fh BYTE lower boundary interface type
same as offset 1Dh
20h WORD module ID filled in by protocol manager
22h WORD module DS
24h DWORD system request entry point
28h DWORD pointer to service-specific characteristics (see #0735,#0737)
0000h:0000h if none
2Ch DWORD pointer to service-specific status, or 0000h:0000h if none
(see #0738)
30h DWORD pointer to upper dispatch table (see #0734)
0000h:0000h if none
34h DWORD pointer to lower dispatch table (see #0734)
0000h:0000h if none
38h 2 DWORDs reserved, must be 0
Note: for compatibility with NDIS 1.x.x, a major version of 00h is
interpreted as 01h

(Table 0733)
Values for NDIS boundary protocol level:
00h physical
01h Media Access Control
02h Data link
03h network
04h transport
05h session
FFh not specified

Format of NDIS dispatch table:
Offset Size Description (Table 0734)
00h DWORD -> common characteristics table (see #0732)
04h 4 BYTEs ???
08h DWORD -> ??? function (called with 12 bytes of stack arguments)
0Ch DWORD -> ??? function (called with 10 bytes of stack arguments)
10h DWORD -> ??? function (called with 16 bytes of stack arguments)
14h DWORD -> ??? function (called with 4 bytes of stack arguments)
18h DWORD -> ??? function (called with 18 bytes of stack arguments)
1Ch DWORD -> ??? function (called with 12 bytes of stack arguments)

Format of MAC Service-Specific Characteristics Table:
Offset Size Description (Table 0735)
00h WORD length of table in bytes
02h 16 BYTEs ASCIZ MAC type name, "802.3", "802.4", "802.5", "802.6", "DIX",
"DIX+802.3", "APPLETALK", "ARCNET", "FDDI", "SDLC", "BSC",
"HDLC", or "ISDN"
12h WORD length of station addresses in bytes
14h 16 BYTEs permanent station address
24h 16 BYTEs current station address
34h DWORD current functional adapter address (00000000h if none)
38h DWORD pointer to multicast address list
3Ch DWORD link speed in bits/sec
40h DWORD service flags (see #0736)
44h WORD maximum frame size which may be both sent and received
46h DWORD total transmit buffer capacity in bytes
4Ah WORD transmit buffer allocation block size in bytes
4Ch DWORD total receive buffer capacity in bytes
50h WORD receive buffer allocation block size in bytes
52h 3 BYTEs IEEE vendor code
55h BYTE vendor adapter code
56h DWORD pointer to ASCIZ vendor adapter description
5Ah WORD IRQ used by adapter
5Ch WORD transmit queue depth
5Eh WORD maximum supported number of data blocks in buffer descriptors
60h N BYTEs vendor-specific info
SeeAlso: #0737

Bitfields for service flags:
Bit(s) Description (Table 0736)
0 supports broadcast
1 supports multicast
2 supports functional/group addressing
3 supports promiscuous mode
4 station address software settable
5 statistics always current
6 supports InitiateDiagnostics
7 supports loopback
8 MAC does primarily ReceiveChain indications instead of ReceiveLookahead
indications
9 supports IBM source routing
10 supports MAC reset
11 supports Open/Close adapter
12 supports interrupt request
13 supports source routing bridge
14 supports GDT virtual addresses (OS/2 version)
15 multiple TransferDatas allowed durign a single indication
16 MAC normally sets FrameSize = 0 in ReceiveLookahead
17-31 reserved, must be 0

Format of NetBIOS Service-Specific Characteristics Table:
Offset Size Description (Table 0737)
00h WORD length of table in bytes
02h 16 BYTEs ASCIZ type name of NetBIOS module
12h WORD NetBIOS module code
14h N BYTEs vendor-specific info
SeeAlso: #0735

Format of MAC Service-Specific Status Table:
Offset Size Description (Table 0738)
00h WORD length of table in bytes
02h DWORD seconds since 0:00 1/1/70 when diagnostics last run
(FFFFFFFFh = never)
06h DWORD MAC status bits (see #0739)
0Ah WORD current packet filter flags (see #0740)
0Ch DWORD pointer to media-specific status table or 0000h:0000h
10h DWORD seconds past 0:00 1/1/70 of last ClearStatistics
14h DWORD total frames received (FFFFFFFFh = not counted)
18h DWORD frames with CRC error (FFFFFFFFh = not counted)
1Ch DWORD total bytes received (FFFFFFFFh = not counted)
20h DWORD frames discarded--no buffer space (FFFFFFFFh = not counted)
24h DWORD multicast frames received (FFFFFFFFh = not counted)
28h DWORD broadcast frames received (FFFFFFFFh = not counted)
2Ch DWORD frames with errors (FFFFFFFFh = not counted)
30h DWORD overly large frames (FFFFFFFFh = not counted)
34h DWORD frames less than minimum size (FFFFFFFFh = not counted)
38h DWORD multicast bytes received (FFFFFFFFh = not counted)
3Ch DWORD broadcast bytes received (FFFFFFFFh = not counted)
40h DWORD frames discarded--hardware error (FFFFFFFFh = not counted)
44h DWORD total frames transmitted (FFFFFFFFh = not counted)
48h DWORD total bytes transmitted (FFFFFFFFh = not counted)
4Ch DWORD multicast frames transmitted (FFFFFFFFh = not counted)
50h DWORD broadcast frames transmitted (FFFFFFFFh = not counted)
54h DWORD broadcast bytes transmitted (FFFFFFFFh = not counted)
58h DWORD multicast bytes transmitted (FFFFFFFFh = not counted)
5Ch DWORD frames not transmitted--timeout (FFFFFFFFh = not counted)
60h DWORD frames not transmitted--hardware error (FFFFFFFFh = not countd)
64h N BYTEs vendor-specific info

Bitfields for MAC status bits:
Bit(s) Description (Table 0739)
0-2 operational status
000 hardware not installed
001 hardware failed startup diagnostics
010 hardware configuration problem
011 hardware fault
100 operating marginally due to soft faults
101 reserved
110 reserved
111 hardware fully operational
3 MAC bound
4 MAC open
5 diagnostics in progress
6-31 reserved

Bitfields for packet filter flags:
Bit(s) Description (Table 0740)
0 directed/multicast or group/functional
1 broadcast
2 promiscuous
3 all source routing
4-15 reserved, must be zero
--------I-214402-----------------------------
INT 21 U - IBM SYSTEM 36/38 WORKSTATION EMULATION - VDI.SYS - GET ???
AX = 4402h
BX = handle for character device "GDMS"
CX = number of bytes to read (>= 4)
DS:DX -> buffer (see #0741)
Return: CF set on error
AX = error code (see #0960 at AH=59h)
CF clear if successful
AX = number of bytes read

Format of System 36/38 emulator returned data:
Offset Size Description (Table 0741)
00h 4 BYTEs ???
04h DWORD pointer to ???
08h 4 BYTEs ???
--------m-214402-----------------------------
INT 21 U - LASTBYTE.SYS v1.19 - IOCTL - GET ??? TABLE
AX = 4402h
BX = handle for device "LA$TBYTE"
CX = 0004h
DS:DX -> DWORD to hold address of 39-byte table of ???
Return: CF set on error
AX = error code (see #0960 at AH=59h)
CF clear if successful
AX = number of bytes read
Program: LASTBYTE.SYS is part of the shareware "The Last Byte" memory
management package by Key Software Products
SeeAlso: AX=4402h"HIGHUMM"
--------m-214402-----------------------------
INT 21 - HIGHUMM.SYS v1.17+ - IOCTL - GET API ADDRESS
AX = 4402h
BX = handle for device "KSP$UMM"
CX = 0004h
DS:DX -> DWORD to hold entry point (see #0742)
Return: CF set on error
AX = error code (see #0960 at AH=59h)
CF clear if successful
AX = number of bytes read
Program: HIGHUMM.SYS is part of the shareware "The Last Byte" memory management
package by Key Software Products
SeeAlso: AX=4402h"LASTBYTE"

(Table 0742)
Call HIGHUMM.SYS entry point with:
AH = 00h allocate UMB (same as XMS function 10h) (see INT 2F/AX=4310h)
DX = size in paragraphs
Return: BX = segment number (if successful)
DX = size of requested block/size of largest block
AH = 01h deallocate UMB (same as XMS func 11h) (see INT 2F/AX=4310h)
DX = segment number of UMB
AH = 02h request a bank-switched memory block
DX = size in paragraphs
Return: BX = segment number (if successful)
DX = size of requested block/size of largest block
AH = 03h release a bank-switched memory block
DX = segment number
AH = 04h transfer data to/from high memory
DS:SI -> source
ES:DI -> destination
CX = length in bytes
Note: enables bank-switched memory, does the copy, then disables
bank-switched memory
AH = 05h get a word from bank-switched memory
ES:DI -> word to read
Return: DX = word
AH = 06h put a word to bank-switched memory
ES:DI -> word to write
DX = word
AH = 07h put a byte to bank-switched memory
ES:DI -> byte to write
DL = byte
AH = 08h enable bank-switched memory
DS:SI -> 6-byte status save area
AH = 09h disable bank-switched memory
DS:SI -> 6-byte save area from enable call (AH=08h)
AH = 0Ah assign name to UMB or high bank-switched block
DX = segment number
DS:SI -> 8-byte blank-padded name
AH = 0Bh locate UMB block by name
DS:SI -> 8-byte blank-padded name
Return: BX = segment number (if successful)
DX = size of block
AH = 0Ch locate bank-switched block by name
DS:SI -> 8-byte blank-padded name
Return: BX = segment number (if successful)
DX = size of block
Return: AX = status code
0001h successful
0000h failed
BL = error code
80h not implemented
B0h insufficient memory, smaller block available
B1h insufficient memory, no blocks available
B2h invalid segment number
Note: only functions 00h and 01h are always available; the remaining
functions are only enabled if the proper commandline switch is given
--------c-214402-----------------------------
INT 21 - SMARTDRV.SYS v3.x only - IOCTL - GET CACHE STATUS
AX = 4402h
BX = file handle for device "SMARTAAR"
CX = number of bytes to read (min 28h)
DS:DX -> buffer for status record (see #0743)
Return: CF clear if successful
AX = number of bytes actually read
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
Note: NCache2 (from the Norton Utilities v8.0) attempts to support this
interface, but does not do so correctly, often hanging the system;
one should use the SmartDrive v4.x or NCache private interfaces
(see INT 2F/AX=4A10h/BX=0000h,INT 2F/AX=FE00h/DI=4E55h)
SeeAlso: AX=4403h"SMARTDRV",INT 2F/AX=4A10h/BX=0000h

Format of SMARTDRV status record:
Offset Size Description (Table 0743)
00h BYTE write-through flag (always 01h)
01h BYTE writes should be buffered (always 00h)
02h BYTE cache enabled if 01h
03h BYTE driver type (01h extended memory, 02h expanded)
04h WORD clock ticks between cache flushes (currently unused)
06h BYTE cache contains locked tracks if nonzero
07h BYTE flush cache on INT 19 reboot if nonzero
08h BYTE cache full track writes if nonzero
09h BYTE double buffering (for VDS) state (00h off, 01h on, 02h dynamic)
0Ah DWORD original INT 13 vector
0Eh BYTE minor version number
0Fh BYTE major version number
10h WORD unused
12h WORD sectors read \
14h WORD sectors already in cache > may be scaled rather than
16h WORD sectors already in track buffer / absolute counts
18h BYTE cache hit rate in percent
19h BYTE track buffer hit rate in percent
1Ah WORD total tracks in cache
1Ch WORD number of tracks in use
1Eh WORD number of locked tracks
20h WORD number of dirty tracks
22h WORD current cache size in 16K pages
24h WORD original (maximum) cache size in 16K pages
26h WORD minimum cache size in 16K pages
28h DWORD pointer to byte flag to increment for locking cache contents
--------d-214402-----------------------------
INT 21 - CD-ROM device driver - IOCTL INPUT
AX = 4402h
BX = file handle referencing character device for CD-ROM driver
CX = number of bytes to read
DS:DX -> control block (see #0745)
Return: CF clear if successful
AX = number of bytes actually read
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
Note: the data returned depends on the first byte of the control block; the
remainder of the control block is filled by the driver
SeeAlso: AX=4403h"CD-ROM",INT 2F/AX=0802h

(Table 0744)
Values for CD-ROM data being requested:
00h device driver header address
01h drive head location
02h reserved
03h error statistics
04h audio channel info
05h raw drive bytes (uninterpreted and device-specific)
06h device status
07h sector size
08h volume size
09h media change status
0Ah audio disk info
0Bh audio track info
0Ch audio Q-Channel info
0Dh audio sub-channel info
0Eh UPC code
0Fh audio status info

Format of CD-ROM control block:
Offset Size Description (Table 0745)
00h BYTE data being requested (see #0744)
---function 00h---
01h DWORD device driver header address (see also AH=52h)
---function 01h---
01h BYTE addressing mode
00h HSG
01h Red Book
02h DWORD current location of drive's head
logical sector number in HSG mode
frame/second/minute/unused in Red Book mode
(HSG sector = minute * 4500 + second * 75 + frame - 150)
---function 03h---
01h N BYTEs undefined as of 5 Aug 88 specification
---function 04h---
01h BYTE input channel (0-3) for output channel 0
02h BYTE volume for output channel 0
03h BYTE input channel (0-3) for output channel 1
04h BYTE volume for output channel 1
05h BYTE input channel (0-3) for output channel 2
06h BYTE volume for output channel 2
07h BYTE input channel (0-3) for output channel 3
08h BYTE volume for output channel 3
Notes: output channels 0 and 1 are left and right, 2 and 3 are left prime and
right prime; a volume of 00h is off
the default setting is for each input channel to be assigned to the
same-numbered output channel at full (FFh) volume
---function 05h---
01h BYTE number of bytes read
02h 128 BYTEs buffer for drive bytes
---function 06h---
01h DWORD device parameters (see #0746)
---function 07h---
01h BYTE read mode
00h cooked
01h raw
02h WORD sector size in bytes
---function 08h---
01h DWORD volume size in sectors
---function 09h---
01h BYTE media change status
00h don't know
01h media unchanged
FFh media has been changed
---function 0Ah---
01h BYTE lowest audio track number
02h BYTE highest audio track number
03h DWORD start address of lead-out track (Red Book format)
--function 0Bh---
01h BYTE track number (set by caller)
02h DWORD starting point of track (Red Book format)
06h BYTE track control info
bits 15,14,12: track type (notice: bits not contiguous!)
000 two audio channels, no pre-emphasis
001 two audio channels with pre-emphasis
010 data track
100 four audio channels, no pre-emphasis
101 four audio channels with pre-emphasis
other reserved
bit 13: digital copy permitted
---function 0Ch---
01h BYTE CONTROL and ADR byte (as received from drive)
02h BYTE track number
03h BYTE point or index
04h BYTE minute \
05h BYTE second > running time within track
06h BYTE frame /
07h BYTE zero
08h BYTE "AMIN" or "PMIN" \
09h BYTE "ASEC" or "PSEC" > running time on disk
0Ah BYTE "AFRAME" or "PFRAME" /
---function 0Dh---
01h DWORD starting frame address (Red Book format)
05h DWORD transfer address
09h DWORD number of sectors to read
Note: copies 96 bytes of sub-channel info per sector into buffer
---function 0Eh---
01h BYTE CONTROL and ADR byte
02h 7 BYTEs UPC/EAN code (13 BCD digits,low-order nybble of last byte is 0)
09h BYTE zero
0Ah BYTE "AFRAME"
---function 0Fh---
??? documentation not yet available
01h WORD pause status (0000h not paused, 0001h paused)
03h DWORD audio play start address
07h DWORD ??? audio play length or end address

Bitfields for CD-ROM device parameters:
Bit(s) Description (Table 0746)
0 door open
1 door unlocked
2 supports raw reading in addition to cooked
3 writable
4 can play audio/video tracks
5 supports interleaving
6 reserved
7 supports prefetch requests
8 supports audio channel control
9 supports Red Book addressing in addition to HSG
10 audio is playing
11 no disk in drive
12 supports R-W subchannels
--------m-214402-----------------------------
INT 21 - Quarterdeck - QEMM-386 v5+ - GET API ENTRY POINT
AX = 4402h
BX = file handle for device "QEMM386$"
CX = 0004h
DS:DX -> DWORD buffer for API entry point
Return: CF clear if successful
buffer filled (see INT 67/AH=3Fh for entry point parameters)
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
Note: Quarterdeck recently (June 1993) documented this function, but the
documentation incorrectly states that it is only available for
QEMM 6+
SeeAlso: AX=4402h"HOOKROM",INT 2F/AX=D201h/BX=5145h,INT 67/AH=3Fh
--------Q-214402-----------------------------
INT 21 U - Quarterdeck - HOOKROM.SYS - GET HOOKED VECTOR TABLE
AX = 4402h
BX = file handle for device "HOOKROM$"
CX = 0004h
DS:DX -> DWORD buffer for address of hooked vector table (see #0747)
Return: CF clear if successful
DS:DX buffer filled
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
SeeAlso: AX=4402h/SF=01h

Format of HOOKROM.SYS hooked vector table entry:
Offset Size Description (Table 0747)
00h 5 BYTEs FAR jump to actual interrupt handler
(end of table if first byte is not EAh)
05h BYTE interrupt vector number
--------d-214402-----------------------------
INT 21 - Advanced SCSI Programming Interface (ASPI) - INTERFACE
AX = 4402h
BX = file handle for device "SCSIMGR$"
CX = 0004h or 0005h (see notes)
DS:DX -> buffer for result (see #0748), set to zeros before call
Return: CF clear if successful
AX = 0004h or 0005h (see notes)
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
Note: the variant of the call requesting five bytes is an UNDOCUMENTED
extension supported by Adaptec's ASPI2DOS.SYS, ASPI4DOS.SYS, and
ASPI7DOS.SYS; if made of a host manager which does not support the
variant, only four bytes will be returned. If the variant is
supported, Adaptec's WINASPI.DLL assumes that the host manager is
an "advanced" one which operates in either real or protected mode
(and thus does not require a DPMI INT 31/AX=0301h call to be invoked
from protected mode). Support of the five-byte variant also appears
to imply that an advanced ASPI host manager uses no temporary
storage space except the SRB (see #0750) and the stack, and that it
is fully reentrant.
if called with a standard request for four bytes, even Adaptec's
advanced drivers return only the requested four bytes containing the
ASPI entry point address
the function address is called with the address of a SCSI Request
Block (see #0750) on the stack and the caller must clean up the
stack
SeeAlso: AX=440Ch"ASPITAPE",INT 11/AH=FFh"WD7000"

Format of ASPI IOCTL result:
Offset Size Description (Table 0748)
00h DWORD function address
04h BYTE number of SCSI host adapters supported by host manager

(Table 0749)
Values for ASPI request number:
00h "HA_INQ" host adapter inquiry
01h "GET_TYPE" get device type
02h "EXEC_SIO" execute SCSI I/O
03h "ABORT_SRB" abort SRB
04h "RESET_DEV" reset SCSI device
05h "SET_HAPRMS" set host adapter parameters
06h get disk drive information

Format of SCSI Request Block (64 bytes):
Offset Size Description (Table 0750)
00h BYTE request number (see #0749)
01h BYTE request status (see #0751)
02h BYTE host adapter ID
03h BYTE request flags (see #0752)
04h DWORD reserved
---request 00h---
08h BYTE (ret) number of host adapters
09h BYTE (ret) target adapter ID
0Ah 16 BYTEs (ret) SCSI manager ID
1Ah 16 BYTEs (ret) host adapter ID
2Ah 16 BYTEs (ret) host adapter-unique parameters
---request 01h---
08h BYTE target ID
09h BYTE logical unit number
0Ah BYTE (ret) device type (see #0755)
---request 02h---
08h BYTE target ID
09h BYTE logical unit number
0Ah DWORD data allocation length
0Eh BYTE sense allocation length
0Fh DWORD data buffer pointer
13h DWORD next request pointer (for linking)
17h BYTE CDB length
18h BYTE (ret) host adapter status (see #0750)
19h BYTE (ret) target status (see #0754)
1Ah DWORD post routine address
1Eh WORD real mode Post DS
20h DWORD SRB pointer
24h WORD reserved
26h DWORD SRB physical address
2Ah 22 BYTEs SCSIMGR$ workspace
40h N BYTEs CCB, including sense data (20-24 bytes)
---request 03h---
08h DWORD address of SRB to abort
---request 04h---
08h BYTE target ID
09h BYTE logical unit number
0Ah 14 BYTEs reserved
18h BYTE (ret) host adapter status (see #0753)
19h BYTE (ret) target status (see #0754)
1Ah DWORD post routine address
1Eh 34 BYTEs workspace
---request 05h---
08h 16 BYTEs host adapter-unique parameters
---request 06h---
08h BYTE target ID
09h BYTE logical unit number
0Ah BYTE disk drive flags (see #0756)
0Bh BYTE INT 13h drive number
0Ch BYTE preferred head number translation
0Dh BYTE preferred sector size translation
0Eh 10 BYTEs reserved
SeeAlso: #0757

(Table 0751)
Values for ASPI request status:
00h not done yet
01h completed successfully
02h aborted by host
04h SCSI I/O error
80h invalid
81h no adapter
82h no device attached
else status

Bitfields for ASPI request flags:
Bit(s) Description (Table 0752)
0 posting enabled
1 linking enabled
2 direction
3 transfer from SCSI target to host
4 transfer from host to SCSI target
Note: no data is transferred if both bits 3 and 4 are set

(Table 0753)
Values for host adapter status:
00h no error detected
11h select timeout
12h data overrun
13h bus error
14h bus failure

(Table 0754)
Values for target status:
00h no status
02h sense data stored in SRB
08h target busy
18h reservation error

(Table 0755)
Values for device type:
00h disk drive
01h tape drive (streamer)
02h printer
03h processor
04h WORM drive
05h CD-ROM drive
06h scanner
07h optical drive
08h autochanger
09h communications device

(Table 0756)
Values for disk drive flags:
00h no INT 13 access
01h INT 13 with DOS access
02h INT 13 without DOS access
03h invalid flags

Format of CCB:
Offset Size Description (Table 0757)
00h BYTE command code (see #0758)
01h BYTE flags
bits 4-0: vary by function
bits 7-5: logical unit number
02h BYTE "adr_1"
03h BYTE "adr_0"
04h BYTE length
05h BYTE control
...
06h/0Ah 14 BYTEs buffer for sense data (see #0759)
SeeAlso: #0750

(Table 0758)
Values for CCB command code:
00h test unit ready
01h rewind
03h request sense data
05h get block size limits
08h Group 0 read
0Ah Group 0 write
10h write file marks
11h SCSI Space (set position?)
12h SCSI Inquire
15h set mode information
16h reserve SCSI device
17h release SCSI device
19h erase
1Ah request mode information
1Bh load/unload media
1Dh request target self-check
24h set window parameters
25h get window parameters
28h Group 1 read
2Ah Group 1 write
31h document feeder control
34h get scan data status
---vendor-specific commands---
D3h get document feeder status
D4h set document feeder mode

Format of sense data:
Offset Size Description (Table 0759)
00h BYTE error code (bit 7 set if valid)
01h BYTE segment number
02h BYTE sense key
bit 6: EOM
bit 5: ILI
bits 0-3: sense key (see #0760)
03h 4 BYTEs information bytes
07h BYTE additional sense length (0Ah)
08h 4 BYTEs command-specific information
0Ch BYTE additional sense code
0Dh BYTE additional sense code qualifier
0Eh BYTE field replaceable unit code
0Fh 3 BYTEs sense key specific bytes

(Table 0760)
Values for sense key:
00h no sense data
02h SCSI unit not ready
03h media error
04h unrecoverable hardware error
05h illegal parameter in CDB
06h target has been reset
0Bh target aborted command
--------m-214402-----------------------------
INT 21 U - Qualitas 386MAX v6.00+ - IOCTL INPUT - GET STATE
AX = 4402h
BX = file handle for device "386MAX$$"
CX = number of bytes to read
DS:DX -> BYTE 03h followed by 386MAX state buffer (see #0761)
Return: CF clear if successful
buffer at DS:DX+1 filled
AX = number of bytes actually copied
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
Notes: if the value given in CX is less than the size of the state record
(5Ah for v6.01, 66h for v7.00), only a partial state record will be
returned
the state is 40h bytes for 386MAX (actually ASTEMM) v2.20 ("386MAX$$"
did not exist yet, use "QMMXXXX0" and then "EMMXXXX0" instead) and
56h bytes for v5.11.
to invoke 386MAX API functions, push DX onto the stack, load DX with
the word at offset 25h in the returned state, load all other
registers as needed for the desired function, and execute an
OUT DX,AL or OUT DX,AX; DX will be set to the pushed value on return
if it is not otherwise modified by the API function. For safety,
in case a function is not supported or 386MAX is not present, SP
should be saved and restored around the API call.
Windows 3.1 Standard mode, LAN Manager, and Windows for Workgroups all
use the 386MAX API; LAN Manager and Windows for Workgroups reportedly
make some calls incorrectly
SeeAlso: AX=4403h/SF=03h"386MAX",INT 67/AH=3Fh

Format of 386MAX v6.01+ state:
Offset Size Description (Table 0761)
-1 BYTE (call) 03h
00h 6 BYTEs signature "386MAX"
06h 4 BYTEs version string "N;NN" or "N.NN" (i.e. "6;01" for v6.01)
(';' by default; apparently changed to a period when 386MAX
has linked high RAM into DOS's memory chain)
0Ah WORD segment of low-memory portion of 386MAX.SYS
0Ch 2 BYTEs ???
0Eh WORD segment of ??? memory block or 0000h
10h WORD bit flags 1 (see #0762)
12h WORD starting address of video memory in KB
14h 2 BYTEs ???
16h WORD total high DOS memory in KB
18h 2 BYTEs ???
1Ah WORD available shared memory in KB
1Ch WORD KBytes extended memory used by 386MAX
1Eh 2 BYTEs ???
20h WORD total extended memory in KB
22h WORD IO port to write (OUT DX,AL) to invoke 386MAX INT 15 functions
24h WORD IO port to write (OUT DX,AL) to invoke 386MAX API functions
(see #0775)
26h WORD ??? (depends on DOS version)
28h WORD size of ??? in paragraphs
2Ah DWORD machine type (see #0770)
2Eh DWORD -> first DOS memory control block
32h WORD system configuration flags (see #0763)
34h WORD debugging flags 1 (see #0764)
36h WORD debugging flags 2 (see #0765)
38h 2 BYTEs ???
3Ah WORD segment of first MCB in high memory chain
3Ch WORD feature flags 1 (see #0767)
3Eh WORD feature flags 2 (see #0768)
40h WORD feature flags 3 (see #0769)
42h WORD segment of first 386MAX control block??? (see #0771)
44h WORD amount of memory to report available on INT 15/AH=88h
46h 4 BYTEs ???
4Ah WORD number of K at start of address space swapped with fast
extended memory (SWAP= parameter)
4Ch 2 BYTEs ???
4Eh WORD segment address of ???
50h WORD debugging flags 3 (see #0766)
52h DWORD old INT 21h
56h DWORD pointer to 386MAX's EMS (INT 67h) handler
---386MAX v7.00---
5Ah DWORD KB of extended memory managed by 386MAX
5Eh DWORD bytes of extended memory (EXT= parameter)
62h 4 BYTEs ???

Bitfields for 386MAX bit flags 1:
Bit(s) Description (Table 0762)
1 ???
2 allow A20 to be enabled/disabled???
3 ??? (cleared by calling INT 67 functions or starting MSWindows)
4 high RAM present???
5 386MAX in AUTO mode
6 386MAX enabled
7 386MAX is providing EMS services
8 ??? (affects API function 08h)
9 A20 gate closed (A20 disabled) (see INT 15/AX=2402h)
10 Weitek support enabled
11 ???
12 ROMs not shadowed???
13 QPMS has been used
14 ???
15 ???

Bitfields for 386MAX system configuration flags:
Bit(s) Description (Table 0763)
1 ROM compressed???
3 ???
5 386MAX loaded into high memory
6 Microchannel bus
7 Weitek math coprocessor detected
9 ??? (also generates INT 01 on ??? and INT 03 on ???)
11 PC/XT (thus only single 8259 interrupt controller present, DMA only
in 1st megabyte, etc)
13 LMLTOP= specified
14 enable A20 control???
15 ???

Bitfields for 386MAX debugging flags 1:
Bit(s) Description (Table 0764)
0 DEBUG=LED
1 DEBUG=X67
2 DEBUG=INV
3 DEBUG=EMSPTED
4 DEBUG=JMP
5 DEBUG=CALL
6 DEBUG=HLT
7 DEBUG=PMR
8 DEBUG=CR3
9 DEBUG=CAPS or DEBUG=INT
10 DEBUG=RC
11 DEBUG=ROM
12 DEBUG=XM
13 DEBUG=SOR
14 DEBUG=XR
15 DEBUG=EMSERR (generate INT 01 on returning error from EMS call)

Bitfields for 386MAX debugging flags 2:
Bit(s) Description (Table 0765)
0 DEBUG=ROMSWAP
1 DEBUG=UNSHADOWROM
2 DEBUG=COMPROM
3 DEBUG=DPMIPHYS
4 DEBUG=ALLROM
5 DEBUG=VMS
6 DEBUG=XMS (generate INT 01 on XMS calls)
7 DEBUG=I06
8 DEBUG=VCPI
9 DEBUG=XDMA
10 DEBUG=X09
13 DEBUG=I67 (generate INT 01 on every INT 67 call)
14 DEBUG=EVM (generate INT 01 on entering V86 mode)
15 DEBUG=EMSSAVE or DEBUG=VDS

Bitfields for 386MAX debugging flags 3:
Bit(s) Description (Table 0766)
10 DEBUG=EPM
12 DEBUG=ABIOS
13 DEBUG=XMSPTED
14 DEBUG=TIME
15 DEBUG=SCRUB

Bitfields for 386MAX feature flags 1:
Bit(s) Description (Table 0767)
1 Weitek present
2 no DPMI services
3 NODMA
4 TERSE
5 NOROM
6 NOPARITY
8 NOFLEX (IGNOREFLEXFRAME)
11 don't create UMBs
12 don't backfill below video memory (NOLOW)
13 FRAME= specified
14 EXT= specified
15 NOEMS, allow prior expanded memory manager to provide EMS

Bitfields for 386MAX feature flags 2:
Bit(s) Description (Table 0768)
0 UNSHIFT specified (FORCEA20 disabled)
1 NOXRAM
2 NOSCSI specified
3 SCREEN specified
4 enabled EISADMA
5 slow DMA
6 RESETKEYB specified
7 ???
9 TOP384
10 ???
11 NOWARMBOOT
12 USE= specified
13 ROM= specified

Bitfields for 386MAX feature flags 3:
Bit(s) Description (Table 0769)
0 Windows3 support enabled
1 SHADOWROM
2 don't compress ROM (NOCOMPROM)
3 ??? (related to PRGREG=)
4 ??? (related to PRGREG=)
5 SHADOWRAM
6 DOS4 specified
7 NOLOADHIGH
8 NOPULSE
11 FORCEA20
12 DMA buffer enabled
13 NOSCRUB
15 NOFRAME

Bitfields for 386MAX machine type:
Bit(s) Description (Table 0770)
12 Amstrad
13 Epson
14 Zenith Data Systems
15 "ASEM"
16 NEC
17 "HPRS" model codes 69h and 6Ah
18 Dell
19 "CA"
20 ITT (Xtra Business Systems/Alcatel)
21 Toshiba 5100
22 Olivetti
23 Quadram Quad386 (BIOS model FEh, submodel A6h)
24 Tandy???
25 AST 386
26 INBOARD, ??? version
27 INBOARD, ??? version
28 INBOARD, ??? version
29 "HPRS"
30 Compaq 386
31 JET386

Format of 386MAX control block:
Offset Size Description (Table 0771)
00h WORD segment of next block (FFFFh if last)
02h WORD segment of previous block (FFFFh if first)
04h 12 BYTEs filename
10h WORD resident size in paragraphs
12h WORD environment size???
14h WORD real prsent environment size + 1 (0000h if ENVSAVE used)
16h 2 BYTEs ???
18h DWORD initial size or SIZE=n in 386LOAD commandline
1Ch DWORD SIZE=-1 ???
20h DWORD SIZE= ???
24h BYTE PRGREG= if specified, else FFh
25h BYTE ENVREG= if specified, else FFh
26h BYTE FlexFrame (00h not present, 01h present)
27h 3 BYTEs ???
2Ah BYTE GROUP= or 00h if not present
2Bh BYTE ???
2Ch WORD PSP

Format of 386MAX high memory info record:
Offset Size Description (Table 0772)
00h WORD segment address of memory region
02h WORD size of memory region in paragraphs
04h BYTE type or flags???
00h if locked out
02h if EMS page frame
04h if high RAM
42h if ROM
05h BYTE ???

Format of 386MAX ROM shadowing record:
Offset Size Description (Table 0773)
00h WORD logical start segment of ROM??? (may be used by BlueMAX when it
squeezes together the ROMs to make room)
02h WORD physical start segment of ROM
04h 2 BYTEs ???
06h WORD size of shadowed ROM in paragraphs
08h 2 BYTEs ???
0Ah WORD flags
bit 15: shadowing enabled for this ROM???
bit 14: ???
bit 13: ???
bit 12: ???
bit 10: ???

(Table 0774)
Values for 386MAX memory type:
00h unused by EMS
01h DOS
04h page frame overlapping ROM???
80h high memory
84h page frame???
87h video ROM???
Note: the type may be 00h (unused) if the 16K page is split among different
uses (such as ROM and high RAM)

(Table 0775)
Call 386MAX API (via OUT DX,AL) with:
STACK: WORD value for DX
AH = 00h unused
Return: AH = 84h (unsupported function)
AH = 01h get high memory information
ES:DI -> buffer for array of high memory info records
(see #0772)
Return: CX = number of records placed in buffer
AH = 02h get shadowed ROM info
ES:DI -> buffer for array of ROM shadowing records (see #0773)
Return: CX = number of records placed in buffer
AH = 03h get 386MAX state
ES:DI -> 90-byte buffer for state (see #0761)
Return: AH = 00h (successful)
buffer filled
AH = 04h get memory types???
ES:DI -> buffer for memory type info (array of bytes, one per
16K page) (see #0774)
Return: CX = number of bytes placed in buffer
AH = 05h get page table entries
AL = A20 control (00h enable A20 first, 01h leave unchanged)
CX = buffer size in bytes (0000h = enough for all memory from
given start to end of memory managed by 386MAX)
SI = first K to report (rounded down to 4K page)
ES:DI -> buffer for returned page table entries
Return: CX = number of bytes returned (four per 4K page)
ES:DI buffer filled
AH = 06h get memory speed info
ES:DI -> buffer for memory speed records (see #0776)
Return: AH = 00h (successful)
CX = number of bytes placed in buffer
Note: this function can take over a second to execute
AH = 07h map/unmap multiple handle pages
DX = EMS handle (on stack)
STACK: DWORD -> EMS mapping record
Return: AH = status (00h,80h,83h,8Ah,8Bh)
Format of EMS mapping record:
Offset Size Description
00h WORD function
0000h use physical page numbers
0001h use segment addresses
02h WORD EMS handle
04h WORD number of mapping entries following
06h 2N WORDs logical page number and physical page/segment
logical page FFFFh means unmap physical page
SeeAlso: INT 67/AH=50h
AH = 08h "EMM2_GOREAL" check whether possible to disable 386MAX
AL = ??? (00h or nonzero)
Return: AH = status (00h OK, A4h not possible at this time)
Note: if AL=00h, this function always returns success
AH = 09h toggle Bit Flags 1 flags
BX = bitmask of bit flags 1's flags to toggle (see #0762)
Return: AH = 00h (successful)
Note: enables A20 first
AH = 0Ah toggle Debugging Flags 1 flags
BX = bitmask of Debugging Flags 1's bits to toggle (see #0764)
Return: AH = 00h (successful)
Notes: enables A20 first
does ??? if bit 3 on after specified bits are toggled
AH = 0Bh toggle Debugging Flags 2 flags
BX = bitmask of Debugging Flags 2's bits to toggle (see #0765)
Return: AH = 00h (successful)
Note: enables A20 first
AH = 0Ch toggle feature flags 3
BX = bitmask of feature flags 3's bits to toggle (see #0769)
Return: AH = 00h (successful)
Note: enables A20 first
AH = 0Dh specify 386MAX high-memory location
BX = segment address of high-memory real-mode portion of 386MAX
CX = current segment of real-mode stub???
Return: AH = status (00h successful)
???
AH = 0Eh CRT controller register virtualization
AL = subfunction
00h allow access to CRTC I/O ports 03B4h/03B5h, 03D4h/03D5h
01h trap accesses to CRTC I/O ports
AH = 0Fh reboot system
Return: never
AH = 10h unused
Return: AH = 84h (unsupported function)
AH = 11h get high memory information
ES:DI -> 96-byte buffer for high memory info
Return: AH = 00h (successful)
ES:DI buffer filled
Notes: each byte in buffer contains bit flags for a 4K page in
the A000h-FFFFh region
bit 0: page is writeable
bit 1: physical address same as linear address
bit 2: EMS page frame
bit 6: page is part of the QPMS window
this function can take over a second to execute,
because it does a 128K read for each page in an
attempt to flush any RAM cache the system may have
AH = 12h shadow RAM mapping
AL = subfunction
00h unshadow ROMs (except page FFh if NOWARMBOOT set)
01h map shadow RAM into ROM regions???
Return: AH = 00h (successful) if AL=00h or 01h
AH = 8Fh otherwise
AH = 13h shadow RAM page protection
AL = subfunction
00h set all shadowed ROM 4K pages to read-only
01h set all shadowed ROM 4K pages to read-write
Return: AH = 00h (successful) if AL=00h or 01h
AH = 8Fh otherwise
AH = 14h get Programmable Option Select info???
ES:DI -> 54-byte buffer for POS data???
Return: AH = 00h if successful
AH = A4h on error
Note: the buffer consists of nine 6-byte fields; the first
eight for slots 1-8, the last for the system board
AH = 15h ???
???
Return: ???
AH = 16h get 386MAX memory usage screen
ES:DI -> buffer for memory info display
CX = size of buffer in bytes
Return: ES:DI buffer filled with '$'-terminated string (if
large enough to hold entire usage screen)
Note: the screen is 0303h bytes in v7.00
AH = 17h Windows 3 startup/termination
AL = subfunction
00h Windows3 initializing
DX (on stack) = Windows startup flags
DI = Windows version number (major in upper byte)
ES:BX = 0000h:0000h
DS:SI = 0000h:0000h
Return: CX = 0000h if OK for Windows to load
<> 0 if Windows should not load
ES:BX -> startup info structure
DS:SI -> Virtual86 mode enable/disable callback
01h Windows3 terminating
ES:BX -> ???
DX (on stack) = Windows exit flags
Return: ???
AH = 18h QPMS (Qualitas Protected Memory Services)
AL = subfunction
00h get QPMS configuration
Return: BX = starting segment of QPMS memory window
CX = number of 4K pages reserved for QPMS???
DX = number of 4K pages in QPMS window???
01h map QPMS memory page???
BX = 4K page number within memory reserved for QPMS???
CL = 4K page number within QPMS memory window???
02h mark all QPMS memory read-only
03h mark all QPMS memory read-write
Return: AH = status (00h,8Ah,8Bh,8Fh)
AH = 19h get linear address for physical address
EDX = physical address (low word on stack)
Return: AH = status
00h successful
EDX = linear address at which physical address
may be accessed
8Bh physical address currently not addressable
Note: enables A20 first
AH = 1Ah set page table entry
EDX = new page table entry (low word on stack)
ESI = linear address of page to map (bits 0-11 clear)
Return: AH = status (00h,8Bh)
Note: enables A20 first
AH = 1Bh get ???
Return: AH = status
BX = ???
CX = number of ???
EDX = physical address of ???
AH = 1Ch get original interrupt vector
AL = interrupt vector (00h-7Fh)
Return: AH = 00h (successful)
EDX = original vector before 386MAX loaded (segment in
high word, offset in low word)
Note: no range checking is performed; requests for INTs 80h-
FFh will return random values
AH = 1Dh display string???
SI = ???
Return: AH = 00h (successful)
???
Note: this function appears to be broken in v7.00
AH = 1Eh get memory info
ES:DI -> memory info (see #0777)
Return: ???
AH = 1Fh get DPMI host information
Return: AX = 0000h if successful
BX = DPMI flags (see #2302 at INT 31/AX=0400h)
CL = CPU type (02h = 80286, 03h = 80386, etc.)
DX = DPMI ver supported (DH=major, DL=2-digit minor)
SI = ???
ES???:DI -> ???
Note: NOP if NODPMI switch specified
AH = 20h (v7.00) get ???
AL = index of ???
Return: EDX = ??? for specified ???
AH = 21h (v7.00) STACKS support
AL = 00h get STACKS parameters
Return: BX = ??? (0060h for v7.00)
CX = number of stacks for hardware interrupts
DX = size of each stack in bytes
SI = ??? (low and high bytes are separate values)
DI = ??? (low and high bytes are separate values)
low byte = logical page number set by subfn 02h
ES = ???
AL = 01h set ??? "EMM2_DSTKS"
EBX = ???
ECX = ???
AL = 02h set ???
BL = logical page number for ??? (00h-03h)
Return: AH = status (00h,8Ah)
AH = 22h (v7.00) call ??? for every load module
AL = which function to call
00h call ???
else call ????
Return: AH = 00h
Note: if AL=00h, calls the protected-mode function pointed at by
the DWORD at offset 22h from the start of each module installed
by a LOAD= directive; if AL<>00h, it calls the function
pointed at by the DWORD at offset 28h of the load module
AH = 23h (v7.00) ???
AL = 00h set ???
BL = ???
Return: AH = 00h or unchanged (depending on ???)
AL = 01h set ???
BL = ???
BH = ???
CX = ???
DX = ??? (on top of stack)
Return: AH = status (00h if successful, 8Fh once table full)
Note: this call adds one entry to an internal table on each
call, until the table is full
AL = 02h get ???
CX = size of buffer
ES:DI -> buffer for ??? (60 bytes total data)
Return: CX = number of bytes actually returned
Note: returns the array storing the values set with AX=2301h
Format of one entry in array:
Offset Size Description
00h BYTE ??? (BL from subfn 01h)
01h WORD ??? (CX from subfn 01h)
03h BYTE ??? (BH from subfn 01h)
04h WORD ??? (DX from subfn 01h)
AL = 03h set ??? name/path
ES:DI -> buffer containing ASCIZ ???
AL = 04h get ???
ES:DI -> buffer for ASCIZ ???
Note: the ASCIZ string for subfunctions 03h and 04h does not appear
to be used by 386MAX, and may serve merely for communication
between two other Qualitas programs
AH = 24h (v7.00) high memory control
AL = 00h get high memory state
Return: BX = current state
00h high memory removed from DOS memory chain
01h high memory included in DOS memory chain
AL = 01h set high memory state
BX = new state
00h high memory removed from DOS memory chain
01h high memory included in DOS memory chain
else
Return: ??? (error, but return varies according to ???)
AH = 25h (v7.00) remove high RAM from DOS memory chain
AH = 26h (v7.00) ???
BX = ???
CX = ???
SI = ???
DI = ???
Return: AH = status
BX = ???
CX = ???
AH = 27h (v7.00) ???
AL = 00h get ???
Return: BX = number of paragraphs for ???
AL = 01h ???
BX = ???
ES??? = ???
AL = 02h ???
???
AL = 03h ???
CX = ???
DX = ???
ES??? = ???
Return: ???
AH = 28h (v7.00) get ???
Return: AH = status (00h,8Fh) (see #2778 at INT 67/AH=40h)
if AH=00h,
CX = ???
DX = ???
AH = 29h (v7.00) get ???
Return: AX = ???
AH = 40h-5Dh EMS services (see INT 67/AH=40h etc)
AH = DEh VCPI services (see INT 67/AX=DE00h etc)
Return: AH = status (as for EMS INT 67 calls)
00h successful
80h internal error
81h hardware malfunction
83h invalid handle
84h undefined function
8Ah invalid logical page nuber
8Bh illegal physical page number
8Fh undefined subfunction
A4h access denied
etc.
STACK popped (value placed in DX if no specific return value for DX)

Format of 386MAX memory speed record:
Offset Size Description (Table 0776)
00h DWORD page table entry for 4K page
04h WORD number of microticks (840ns units) required for REP LODSD of
entire 4K page

Format of 386MAX memory info [array]:
Offset Size Description (Table 0777)
00h DWORD linear start address
04h DWORD size in bytes
08h WORD XMS handle (if next byte = 04h)
??? (if next byte = 05h)
??? (if next byte = 06h)
??? (if next byte = 13h)
??? (if next byte = 14h)
??? (if next byte = 15h)
??? (if next byte = 23h)
??? (if next byte = 24h)
??? (if next byte = 26h)
else unused
0Ah BYTE type
00h = ???, 01h = VDISK,
02h = INT 15h extended memory, 03h = ??? extended,
04h = XMS handle's memory, 05h = ???, 06h = ???, 07h = ???,
08h = ???, 09h = ???, 0Ah = ???, 0Bh = ???,
11h = ???, 12h = ???, 14h = ???, 15h = ???,
19h = ???, 1Ah = ???, 1Bh = ???,
1Ch = ???, 1Dh = ???, 1Eh = ???, 1Fh = ???,
20h = ???, 21h = ???, 23h = ???, 24h = ???,
26h = ???
0Bh BYTE ??? (00h for types 00h-03h, 07h-0Bh, 19h-21h;
80h for types 04h/13h-15h/23h-26h;
??? for type 05h)
--------V-214402-----------------------------
INT 21 - PGS1600.DEV - IOCTL - GET CONFIGURATION INFO
AX = 4402h
BX = file handle for device "PGS1600$"
CX = 0018h (size of buffer)
DS:DX -> configuration buffer (see #0778)
Return: CF clear if successful
buffer filled
AX = number of bytes actually copied
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
Program: PGS1600.DEV is a device driver for the Cornerstone Technology PG1600
display adapter, which provides a 1600x1200 monochrome display as
well as one of two emulations, MDA or CGA.
SeeAlso: AX=4403h"PGS1600"

Format of PGS1600.DEV configuration information:
Offset Size Description (Table 0778)
00h WORD version (high byte = major, low byte = minor)
02h WORD board initialisation mode
04h WORD board I/O address
03D0h CGA emulation
03B0h MDA emulation
0390h no emulation
0350h no emulation, alternate
06h WORD emulation buffer segment
B800h CGA emulation
B000h MDA emulation
0000h no emulation
08h WORD PG1600 graphics buffer segment
0Ah WORD number of bytes between consecutive graphic rows
0Ch WORD horizontal pixel size
0Eh WORD vertical pixel size
10h WORD horizontal dots per inch
12h WORD vertical dots per inch
14h WORD graphics buffer bits per pixel
16h WORD monitor bits per pixel
--------N-214402-----------------------------
INT 21 - PC/TCP IPCUST.SYS - RESET CONFIGURATION DATA READ POINTER
AX = 4402h
BX = file handle referencing device "$IPCUST"
CX, DS:DX ignored
Return: CF clear if successful
AX destroyed
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
Notes: there are a total of 378h bytes of configuration data for IPCUST.SYS
version 2.05. If less than the entire data is read or written,
the next read/write continues where the previous one ended; this
call and AX=4403h both reset the location at which the next
operation starts to zero
v2.1+ uses a new configuration method, but allows the installation
of IPCUST.SYS for backward compatibility with other software which
must read the PC/TCP configuration
SeeAlso: AH=3Fh"IPCUST",AH=40h"IPCUST",AX=4403h"IPCUST"
--------N-214402-----------------------------
INT 21 - WORKGRP.SYS - GET API ENTRY POINT
AX = 4402h
BX = file handle for device "NET$HLP$"
CX = 0008h
DS:DX -> buffer for entry point record (see #0779)
Return: CF clear if successful
AX = number of bytes actually read
CF set on error
AX = error code
Program: WORKGRP.SYS is the portion of Microsoft's Workgroup Connection which
permits communication with PCs running Windows for Workgroups or
LAN Manager
SeeAlso: AH=3Fh"WORKGRP.SYS"

Format of WORKGRP.SYS entry point record:
Offset Size Description (Table 0779)
00h WORD 3633h \ signature???
02h WORD EF6Fh /
04h DWORD address of entry point (see #0780)
Note: first four bytes of buffer must be 6Fh E9h 33h 36h on entry when using
IOCTL rather than READ to get the entry point record

(Table 0780)
Call WORKGRP entry point with:
STACK: WORD function number (0000h-0009h)
Return: STACK unchanged
SeeAlso: #0781,#0782,#0783,#0784,#0785,#0786,#0787,#0788

(Table 0781)
Call WORKGRP function 00h with:
STACK: WORD 0000h (function "get ???")
Return: DX:AX -> data table

(Table 0782)
Call WORKGRP function 01h with:
STACK: WORD 0001h (function "hook ???")
Return: STACK: DWORD pointer to ???
WORD 0001h (function number)

(Table 0783)
Call WORKGRP function 02h with:
STACK: WORD 0002h (function "unhook ???")
???
Return: ???

(Table 0784)
Call WORKGRP function 03h with:
STACK: WORD 0003h (function "reenable printer port")
WORD LPT port number
Return: ???

(Table 0785)
Call WORKGRP function 04h with:
STACK: WORD 0004h (function "disable printer port")
WORD LPT port number
Return: ???

(Table 0786)
Call WORKGRP function 05h with:
STACK: WORD 0005h (function "???")
???
Return: ???

(Table 0787)
Call WORKGRP function 06h with:
STACK: WORD 0006h (function "???")
Return: STACK unchanged
AX = 0000h
DX = 0000h

(Table 0788)
Call WORKGRP functions 07h-09h with:
STACK: WORD 0007h-0009h (NOP functions)
Return: STACK unchanged
AX = 0001h
DX = 0000h
--------N-214402-----------------------------
INT 21 - 10NET v5.0 - 10BEUI.DOS - API
AX = 4402h
BX = file handle referencing device "10BEUI$"
DS:DX -> parameter record (see #0789)
CX ignored
Return: CF clear if successful
AX destroyed
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
SeeAlso: AX=4402h"10MEMMGR",INT 6F/AH=00h"10NET"

Format of 10NET 10BEUI.DOS parameter record:
Offset Size Description (Table 0789)
00h WORD 000Ah (function number???)
02h WORD ???
04h DWORD pointer to buffer for ???
08h 4 BYTEs ???
0Ch WORD transfer size
--------N-214402-----------------------------
INT 21 - 10NET v5.0 - 10MEMMGR.SYS - API
AX = 4402h
BX = file handle referencing device "MEMMGR0$"
DS:DX -> 6-byte buffer for interface info (see #0790)
CX ignored
Return: CF clear if successful
AX destroyed
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
SeeAlso: AX=4402h"10BEUI",INT 6F/AH=00h"10NET"

Format of 10NET 10MEMMGR.SYS interface info:
Offset Size Description (Table 0790)
00h DWORD address of entry point (see #0791)
04h WORD version (0500h for v5.00)

(Table 0791)
Call 10NET 10MEMMGR.SYS entry point with:
AL = 01h ???
BX = ???
Return: CF clear if successful
CF set on error
AX = error code
AL = 02h ???
???
AL = 03h ???
???
AL = 04h set/restore memory allocation strategy
BX = subfunction
0000h set strategy
0001h restore strategy
Return: CF clear if successful
CF set on error (if function disabled)
various registers destroyed
AL = other
Return: CF set
AX = 0000h
BL = 01h
--------V-214402-----------------------------
INT 21 - Compaq AG1024.SYS - RGDI - GET DRIVER LOCATION
AX = 4402h
BX = file handle for device "$$$$RGDI"
CX = 0006h (size of returned data)
DS:DX -> location record (see #0792)
Return: CF clear if successful
buffer filled
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
Program: AG1024.SYS is a device driver for the Advanced Graphics 1024 adapter
SeeAlso: AX=4403h"RGDI"

Format of Compaq AG1024.SYS location record:
Offset Size Description (Table 0792)
00h WORD signature 55AAh
02h WORD segment of ???
04h WORD segment of device driver's code
--------N-214402-----------------------------
INT 21 - FTPSOFT.DOS v3.1 - GET ???
AX = 4402h
BX = file handle for device "FTPSOFT$"
CX = size of buffer
DS:DX -> buffer for data (see #0793)
Return: CF clear if successful
buffer filled
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
Program: FTPSOFT.DOS is a device driver for Protocol Manager support from
FTP Software, Inc.
SeeAlso: AH=3Fh"PC/TCP",AX=4402h"NDIS"

Format of FTPSOFT.DOS data:
Offset Size Description (Table 0793)
00h WORD (call) BA98h (if different, no data returned)
02h DWORD -> NDIS common characteristics table
(see #0732 at AX=4402h"NDIS")
06h DWORD (call) -> new dispatch table (see #0734 at AX=4402h"NDIS")
0Ah DWORD -> 28-byte buffer for ??? data
0Eh DWORD ???
12h DWORD -> FAR function to reset dispatch jump table to defaults
16h BYTE ???
Note: the addresses in the new dispatch table are copied into an internal
jump table which may be reset by calling the function pointed at by
offset 12h
--------n-214402-----------------------------
INT 21 U - PenDOS PENDEV.SYS - GET ENTRY POINTS
AX = 4402h
BX = file handle for device "$$PENDOS" or "$$PD_REG"
CX = size of buffer (4 for $$PENDOS and a 4,8,12, or 16 for $$PD_REG)
DS:DX -> buffer for entry point record (see #0794)
Return: CF clear if successful
buffer filled
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
Program: A limited version of PenDOS by Communication Intelligence Corporation,
which provides pen capability to keyboard-based programs, is bundled
with IBM DOS 6.1
SeeAlso: AX=4403h"PENDEV.SYS"

Format of PENDEV.SYS entry point record:
Offset Size Description (Table 0794)
00h DWORD -> array of jumps
04h WORD offset of function to retrieve entry point (see #0795)
06h 2 BYTEs signature "Pe"
08h WORD offset of function to set entry point (see #0796)
0Ah 2 BYTEs signature "nD"
0Ch WORD offset of function to clear entry point (see #0797)
0Eh WORD signature "OS"

(Table 0795)
Call PENDEV.SYS function to retrieve entry point with:
AX = index of entry point (0-9)
Return: CF clear if successful
DX:AX -> desired entry point
CF set on error (AX out of range)

(Table 0796)
Call PENDEV.SYS function to set entry point with:
AX = index of entry point (0-9)
DX:SI -> new handler
Return: CF clear if successful
CF set on error (AX out of range)

(Table 0797)
Call PENDEV.SYS function to clear entry point with:
AX = index of entry point (0-9)
Return: CF clear if successful
CF set on error (AX out of range)
Note: resets the jump at the specified entry point to its default target,
which simply returns
--------N-214402-----------------------------
INT 21 U - LAN Manager - TCPDRV.DOS - API
AX = 4402h
BX = file handle referencing device "TCPDRV$"
CX = 0019h
DS:DX -> buffer containing request block (see #0798)
Return: CF clear if successful
buffer filled
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
Program: TCPDRV.DOS is the low-level device driver supporting LAN Manager's
TCP/IP protocol stack

Format of TCPDRV.DOS request block:
Offset Size Description (Table 0798)
00h BYTE (call) function number
00h initialize ???
06h get ???
07h get ???
01h BYTE (call) 00h
(ret) error code if error, unchanged if successful
02h WORD signature 4354h ('CT')
---function 00h---
04h DWORD (call) pointer to ??? FAR function
function is called with ES:BX -> device driver request used to
invoke this function
08h 4 BYTEs ???
0Ch DWORD (call) pointer to ??? record, WORD at offset 22h is read
10h DWORD (ret) -> ??? buffer if 0000h:0000h on call
---function 06h---
04h 4 BYTEs ???
08h DWORD (ret) pointer to ???
---function 07h---
04h DWORD (ret) pointer to ??? record
--------y-214402-----------------------------
INT 21 U - PC Tools 9 CPRLOW.EXE - GET CODE AND DATA ADDRESSES
AX = 4402h
BX = file handle referencing device "RECLOWLD"
DS:DX -> buffer for address list (see #0799)
CX ignored
Return: CF clear if successful
buffer filled
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)

Format of CPRLOW address list:
Offset Size Description (Table 0799)
00h WORD segment of CPRLOW code
02h WORD offset in code segment of ??? entry point
(switches into protected mode)
04h WORD offset in code segment of jump array (see #0800)
06h WORD segment of copy of interrupt vector table at CPRLOW load time
Note: neither the entry point nor the jump array is valid until after a
CPR /LOAD, because CPR.EXE installs the code into CPRLOW at runtime.

Format of CPRLOW jump array:
Offset Size Description (Table 0800)
00h 3 BYTEs initialize CPRLOW interrupt hooks
03h 3 BYTEs reset timers and enable CPR (hotkey enable)
06h 3 BYTEs disable CPR (hotkey disable)
09h 3 BYTEs clear ??? flag, hotkey disable, and ???
0Ch 3 BYTEs initialize delay loop counter (destroys AX,BX,CX,DX)
0Fh 3 BYTEs disable CPR completely (commandline /DISABLE)
12h 3 BYTEs enable ??? if CPR enabled by both cmdline and hotkey
15h 3 BYTEs enable CPR (commandline /ENABLE)
--------s-214402-----------------------------
INT 21 U - Creative Technology CTMMSYS.SYS v1.00.01 - API
AX = 4402h
BX = file handle for device "CTMMSYS$"
CX = 0004h (size of data)
DS:DX -> buffer for entry point (see #0801)
Return: CF clear if successful
buffer updated
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
Program: CTMMSYS.SYS is the Creative DOS Multimedia Architecture Integration
driver
SeeAlso: AX=4402h"CTSB2",INT 80/BX=0000h"SBFM"

Format of CTMMSYS.SYS entry point record:
Offset Size Description (Table 0801)
00h DWORD (call) signature 4D6D7443h (ASCII "CtmM")
(ret) pointer to CTMMSYS entry point (see #0802)
SeeAlso: #0803

(Table 0802)
Call CTMMSYS.SYS entry point with:
AX = ???
STACK: WORD ???
WORD ???
WORD ??? (0001h,0002h,0005h,0006h)
WORD ???
DWORD -> ???
WORD ???
WORD ???
Return: DX:AX = ??? or error code
0000h:000Bh invalid value for ???
0000h:000Fh API call already in progress
SeeAlso: #0801
--------s-214402-----------------------------
INT 21 U - Creative Technology CTSB2.SYS v1.01.01 - API
AX = 4402h
BX = file handle for device "CTSOUND0"
CX = 0004h (size of data)
DS:DX -> buffer for entry point (see #0803)
Return: CF clear if successful
buffer updated
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
Program: CTMMSYS.SYS is the Creative DOS Multimedia Architecture Integration
driver
SeeAlso: AX=4402h"CTMMSYS",INT 80/BX=0000h"SBFM"

Format of CTSB2.SYS entry point record:
Offset Size Description (Table 0803)
00h DWORD (call) signature 4D6D7443h (ASCII "CtmM")
(ret) pointer to CTSB2 entry point (see #0804)
SeeAlso: #0801

(Table 0804)
Call CTSB2.SYS entry point with:
AX = ???
STACK: DWORD -> ???
WORD function number
(0100h,0200h,0300h,0400h,0500h,0600h,0701h)
DWORD -> ???
WORD ???
WORD ???
Return: DX:AX = ??? or error code
0000h:0004h invalid subfunction???
0000h:000Bh invalid value for ???
0000h:000Fh API call already in progress
SeeAlso: #0803
--------m-214402-----------------------------
INT 21 U - Novell DOS 7 EMM386.EXE - GET STATE RECORD???
AX = 4402h
BX = file handle for device "EMMXXXX0"
CX = 003Eh (size of state record)
DS:DX -> buffer for state record (see #0805)
Return: CF clear if successful
buffer filled (see #2733 at INT 67/AH=3Fh)
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)

Format of Novell DOS 7 EMM386.EXE state record:
Offset Size Description (Table 0805)
00h WORD signature EDC0h
02h 60 BYTEs ???
--------m-214402SF00-------------------------
INT 21 U - Memory Managers - GET API ENTRY POINT
AX = 4402h subfn 00h
BX = file handle for device "EMMXXXX0"
CX = 0006h (size of buffer in bytes)
DS:DX -> buffer for API entry point record (see #0806)
first byte must be 00h on entry
Return: CF clear if successful
buffer filled (see #2733 at INT 67/AH=3Fh)
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
Notes: this function is supported by Microsoft EMM386.EXE v4.45+ and
CEMM v5.10+, and is intended for use by MS Windows as it starts up
if no other program has hooked INT 67, an alternate installation
check for CEMM is testing for the string
"COMPAQ EXPANDED MEMORY MANAGER 386" at offset 14h in the INT 67
handler's segment; if present, the word at offset 12h contains the
offset of the API entry point
SeeAlso: AX=4402h/SF=01h,AX=4402h/SF=02h,AX=4402h"EMM386",INT 67/AH=3Fh

Format of memory manager API entry point record:
Offset Size Description (Table 0806)
00h WORD ??? (0022h for CEMM 5.11, 0025h for MS EMM386 v4.45)
02h DWORD manager's private API entry point
(see #0807,#2796 at INT 67/AX=FFA5h)

(Table 0807)
Call CEMM v5.10+ entry point with:
AH = 00h get memory manager's state
Return: AH = state
bit 0: turned OFF
bit 1: AUTO mode enabled
AH = 01h set memory manager's state
AL = new state (00h ON, 01h OFF, 02h AUTO)
Return: CF clear if successful
CF set on error
AH = 02h Weitek coprocessor support
AL = subfunction
00h get Weitek support state
Return: AL = status
bit 0: Weitek coprocessor is present
bit 1: Weitek support is enabled
01h turn on Weitek support
02h turn off Weitek support
Return: CF clear if successful
CF set on error
AH = error code (01h invalid subfunc, 02h no Weitek)
AH = 05h get statistics
???
AH > 06h
Return: CF set
AH = 01h (invalid function)
Notes: AH=03h,04h,06h are NOPs which return CF clear, presumably for backwards
compatibility with earlier versions of CEMM
in v5.11, AH=05h merely prints an error message (using INT 21/AH=09h)
stating that a different version of CEMM is installed and it is
therefore not possible to display the statistics
--------m-214402SF01-------------------------
INT 21 U - Memory Managers - GET EMM IMPORT STRUCTURE ADDRESS
AX = 4402h subfn 01h
BX = file handle for device "EMMXXXX0"
CX = 0006h (size of buffer in bytes)
DS:DX -> buffer for EMM import structure record (see #0808)
first byte must be 01h on entry
Return: CF clear if successful
buffer filled (see also #2733 at INT 67/AH=3Fh)
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
Notes: this function is supported by Microsoft EMM386.EXE v4.45+,
QEMM-386 v6+, and CEMM v5.10+, and is intended for use by MS Windows
as it starts up
for QEMM-386, this call always returns an error if Windows3 support
has been disabled with the NW3 switch
SeeAlso: AX=4402h/SF=00h,AX=4402h"EMM386",INT 2F/AX=D201h/BX=5145h
SeeAlso: INT 67/AH=3Fh

Format of EMM import structure record:
Offset Size Description (Table 0808)
00h DWORD physical address of EMM import structure (see #0809)
04h BYTE EMM import structure major version
05h BYTE EMM import structure minor version
Note: version 1.00 contains only EMS information (Windows 3.0+)
version 1.10 contains UMB/XMS/HMA/EMS information (Windows 3.1)
version 1.11 is version 1.10 plus memory manager maker/product name
SeeAlso: #2773

Format of Global EMM Import record:
Offset Size Description (Table 0809)
00h BYTE bit flags
bit 2: ???
bit 3: free EMM386 virtual HMA only if hma_page_table_paddr!=0
bit 4: no UMB???
01h BYTE reserved (0)
02h WORD size of structure in bytes
04h WORD structure version
06h DWORD reserved
0Ah 384 BYTEs 64 EMS frame status records (see #0810), one per 16K of
real-mode 1M address space
18Ah BYTE ??? (must be at least 3*number_of_EMS_frames+4)
18Bh BYTE number of UMB frame descriptors following
18Ch 4N DWORDs UMB frame descriptors
each is 4 DWORDs giving physical page numbers for the four
4K pages of a 16K EMS frame (00000000h if non-UMB page)
var BYTE number of EMS handle info records following
16N BYTEs EMS handle info records (see #0812)
---version 1.10+ ---
DWORD realmode INT 67 vector (used by Windows to set breakpoints)
DWORD physical address of HMA page table values
BYTE number of free page entries following
2N DWORDs free page entries
each is:
DWORD physical page number
DWORD number of consecutive physical pages
BYTE number of XMS handle info records following
00h if memory manager does not emulate XMS or has real mode
XMS code which can execute in the Windows environment
12N BYTEs XMS handle info records (see #0813)
BYTE number of free UMB info records following
2N WORDs free UMB info records
each is:
WORD real mode start segment
WORD size in paragraphs
---version 1.11---
20 BYTEs blank-padded maker name
20 BYTEs blank-padded product name

Format of EMS frame status record:
Offset Size Description (Table 0810)
00h BYTE frame type (see #0811)
01h BYTE owner handle (00h/FFh = none) from frame including UMB
index to UMB frame descriptors
02h WORD logical page for frame, 7FFFh if none, FFFFh if non-EMS frame
04h BYTE EMS physical page number (FFh for non-EMS = don't care???)
05h BYTE flags for non-EMS frames (00h for EMS frame)
bits 0,1 for first 4K, bits 2,3 for second 4K, etc:
10: direct mapping (linear address = physical address)
01: UMB mapping

Bitfields for EMS frame type:
Bit(s) Description (Table 0811)
0 EMS frame
1 (if EMS frame) in standard 64K page frame
2 first 4K of frame is UMB
3 second 4K of frame is UMB
4 third 4K of frame is UMB
5 last 4K of frame is UMB

Format of EMS handle info record:
Offset Size Description (Table 0812)
00h BYTE handle number (00h = system handle)
01h BYTE flags
bit 0: normal handle rather than system handle
bit 2: ??? (set by some EMS managers)
02h 8 BYTEs EMS handle's name
0Ah WORD number of 16K pages for handle
0Ch DWORD physical address of page table entries forming page map
Note: all values should be zero for the system handle if no large frame
support is present

Format of XMS handle info record:
Offset Size Description (Table 0813)
00h WORD handle
02h WORD flags
bit 0: handle usable by Windows
(already in use when Windows started if clear)
bit 1: reserved (0)
04h DWORD size in KB (may be zero, used only if flags bit 0 set)
08h DWORD physical address (only if flags bit 0 set)
--------m-214402SF02-------------------------
INT 21 U - Memory Managers - GET MEMORY MANAGER VERSION
AX = 4402h subfn 02h
BX = file handle for device "EMMXXXX0"
CX = 0002h (size of buffer in bytes)
DS:DX -> buffer for memory manager version (see #0814)
first byte must be 02h on entry
Return: CF clear if successful
buffer filled
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
Note: this function is supported by Microsoft EMM386.EXE v4.45+ and
CEMM v5.10+, and is intended for use by MS Windows as it starts up
SeeAlso: AX=4402h/SF=00h,AX=4402h"EMM386",INT 67/AH=3Fh

Format of memory manager version:
Offset Size Description (Table 0814)
00h BYTE major version
01h BYTE minor version (binary)
--------m-214402-----------------------------
INT 21 U - Microsoft EMM386.EXE v4.45 - GET MEMORY MANAGER INFORMATION
AX = 4402h
BX = file handle for device "EMMXXXX0"
CX = size of buffer in bytes (varies, see #0815)
DS:DX -> buffer for returned data (see #0815)
first byte must be set on entry to indicate desired data
Return: CF clear if successful
buffer filled
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
Notes: an error is returned if the number of bytes to be read does not match
the number of bytes returned for the specified data item
this function is part of the interface which allows MS Windows to
cooperate with memory managers
SeeAlso: AX=4402h/SF=00h,AX=4402h/SF=01h,AX=4402h/SF=02h,INT 67/AX=FFA5h

Format of EMM386.EXE data buffer:
Offset Size Description (Table 0815)
00h BYTE (call) function
03h get ???
04h get ???
---function 03h---
00h WORD ???
02h WORD ???
---function 04h---
00h WORD segment of UMB containing EMM386 code/data
02h WORD number of paragraphs of EMM386 code/data in UMB
04h WORD ???
----------214402-----------------------------
INT 21 U - IFSHLP.SYS - GET ENTRY POINT
AX = 4402h
BX = file handle for device "IFS$HLP$"
CX = 0008h (size of buffer in bytes)
DS:DX -> buffer for entry point record (see #0713 at AH=3Fh"IFSHLP")
Return: CF clear if successful
buffer filled
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
SeeAlso: AH=3Fh"IFSHLP"
--------D-214403-----------------------------
INT 21 - DOS 2+ - IOCTL - WRITE TO CHARACTER DEVICE CONTROL CHANNEL
AX = 4403h
BX = file handle referencing character device
CX = number of bytes to write
DS:DX -> data to write
Return: CF clear if successful
AX = number of bytes actually written
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
Notes: format of data is driver-specific (see below for some specific cases)
if the file handle refers to "4DOSSTAK", the 4DOS (v2.x-3.03)
KEYSTACK.SYS driver will push the specified characters on the
keyboard stack; similarly for "NDOSSTAK", the NDOS KEYSTACK.SYS
driver will push the characters onto the keyboard stack
SeeAlso: AX=4400h,AX=4402h,AX=4405h,INT 2F/AX=122Bh,INT 2F/AX=D44Dh
SeeAlso: INT 2F/AX=D44Fh
--------c-214403-----------------------------
INT 21 - SMARTDRV.SYS v3.x only - IOCTL - CACHE CONTROL
AX = 4403h
BX = handle for device "SMARTAAR"
CX = number of bytes to write
DS:DX -> SMARTDRV control block (see #0817)
Return: CF clear if successful
AX = number of bytes actually written
0000h if control block too small for given command
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
Note: NCache2 (from the Norton Utilities v8.0) attempts to support this
interface, but does not do so correctly, often hanging the system;
one should use the SmartDrive v4.x or NCache private interfaces
(see INT 2F/AX=4A10h/BX=0000h,INT 2F/AX=FE00h/DI=4E55h)
SeeAlso: AX=4402h"SMARTDRV",INT 2F/AX=4A10h/BX=0000h

(Table 0816)
Values for SMARTDRV function code:
00h flush cache
01h flush and discard cache
02h disable caching (flushes and discards cache first)
03h enable caching
04h control write caching
05h set flushing tick count
06h lock cache contents
07h unlock cache contents
08h set flush-on-reboot flag
09h unused
0Ah control full-track caching
0Bh reduce cache size
0Ch increase cache size
0Dh set INT 13 chain address

Format of SMARTDRV control block:
Offset Size Description (Table 0817)
00h BYTE function code (see #0816)
---functions 00h-03h,06h,07h---
no additional fields
---function 04h---
01h BYTE write caching control action
00h turn off write-through
01h turn on write-through
02h turn off write buffering (also flushes cache)
03h turn on write buffering (also flushes cache)
---function 05h---
01h WORD number of timer ticks between cache flushes
---function 08h---
01h BYTE new flush-on-reboot flag (00h off, 01h on)
---function 0Ah---
01h BYTE full-track writes are
00h not cached
01h cached
---functions 0Bh,0Ch---
01h WORD number of 16K pages by which to increase/reduce cache size
---function 0Dh---
01h DWORD new address to which to chain on INT 13
Note: the previous address is not preserved
--------d-214403-----------------------------
INT 21 - CD-ROM device driver - IOCTL OUTPUT
AX = 4403h
BX = file handle referencing character device for CD-ROM driver
CX = number of bytes to write
DS:DX -> control block (see #0818)
Return: CF clear if successful
AX = number of bytes actually written
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
SeeAlso: AX=4402h"CD-ROM",INT 2F/AX=0802h

Format of CR-ROM control block:
Offset Size Description (Table 0818)
00h BYTE function code
00h eject disk
01h lock/unlock door
02h reset drive
03h control audio channel
04h write device control string
05h close tray
---functions 00h,02h,05h---
no further fields
---function 01h---
01h BYTE lock function
00h unlock door
01h lock door
---function 03h---
01h BYTE input channel (0-3) for output channel 0
02h BYTE volume for output channel 0
03h BYTE input channel (0-3) for output channel 1
04h BYTE volume for output channel 1
05h BYTE input channel (0-3) for output channel 2
06h BYTE volume for output channel 2
07h BYTE input channel (0-3) for output channel 3
08h BYTE volume for output channel 3
Note: output channels 0 and 1 are left and right, 2 and 3 are left prime and
right prime; a volume of 00h is off
---function 04h---
01h N BYTEs bytes to send directly to the CD-ROM drive without
interpretation
--------d-214403-----------------------------
INT 21 - Brian Antoine Seagate ST-01 SCSI.SYS - IOCTL - EXECUTE COMMANDS
AX = 4403h
BX = handle for device "SCSITAPE"
CX = number of bytes to write
DS:DX -> SCSITAPE control block (see #0819)
Return: CF clear if successful
AX = number of bytes actually written
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
SeeAlso: AX=4405h"ST-01",INT 78/AH=10h

Format of SCSITAPE control block:
Offset Size Description (Table 0819)
00h WORD command type
'F' Format (argument 1 = interleave, argument 2 = format type)
'E' Erase
'R' Rewind
'L' Load
'N' No Load
'S' Space (argument 1 = count, argument 2 = type)
'M' File Mark (argument 1 = count)
'A' Reassign
02h WORD argument 1
04h WORD argument 2
06h WORD segment of command buffer
08h WORD offset of command buffer
0Ah WORD length of command buffer
--------E-214403-----------------------------
INT 21 U - AI Architects - OS/x86??? - API
AX = 4403h
BX = handle for device "AIA_OS"
CX = number of bytes to write (ignored)
DS:DX -> 12-byte buffer (see #0820), first byte is command:
81h installation check
82h get API entry point
84h uninstall
Return: CF clear if successful
AX = number of bytes actually written
DS:DX buffer filled
CF set on error
AX = error code (01h,05h,06h,0Ch,0Dh) (see #0960 at AH=59h)
Notes: these functions are only available if the DOS extender was loaded as a
device driver in CONFIG.SYS
called by TKERNEL (a licensed version of AI Architects/Ergo OS/x86)
SeeAlso: INT 2F/AX=FBA1h/BX=0081h,INT 2F/AX=FBA1h/BX=0082h
Index: installation check;OS/x86|entry point;OS/x86|uninstall;OS/x86

Format of buffer on return:
Offset Size Description (Table 0820)
00h 4 BYTEs signature "IABH"
---if function 81h---
(no additional fields)
---if function 82h---
04h DWORD pointer to API entry point (see INT 2F/AX=FBA1h/BX=0082h)
---if function 84h---
04h WORD success indicator
06h WORD segment of ???
08h WORD segment of ??? memory block to free if nonzero
0Ah WORD segment of ??? memory block to free if nonzero
--------V-214403-----------------------------
INT 21 - PGS1600.DEV - IOCTL - SET CONFIGURATION???
AX = 4403h
BX = file handle for device "PGS1600$"
CX = 0018h (size of buffer)
DS:DX -> configuration buffer (see #0778 at AX=4402h"PGS1600")
Return: CF clear if successful
AX = number of bytes actually written
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
Program: PGS1600.DEV is a device driver for the Cornerstone Technology PG1600
display adapter, which provides a 1600x1200 monochrome display as
well as one of two emulations, MDA or CGA.
SeeAlso: AX=4402h"PGS1600"
--------N-214403-----------------------------
INT 21 - PC/TCP IPCUST.SYS - RESET CONFIGURATION DATA READ POINTER
AX = 4403h
BX = file handle referencing device "$IPCUST"
CX, DS:DX ignored
Return: CF clear if successful
AX destroyed
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
Notes: there are a total of 378h bytes of configuration data for IPCUST.SYS
version 2.05. If less than the entire data is read or written,
the next read/write continues where the previous one ended; this
call and AX=4402h both reset the location at which the next
operation starts to zero
v2.1+ uses a new configuration method, but allows the installation
of IPCUST.SYS for backward compatibility with other software which
must read the PC/TCP configuration
SeeAlso: AH=3Fh"IPCUST",AH=40h"IPCUST",AX=4402h"IPCUST"
--------V-214403-----------------------------
INT 21 - Compaq AG1024.SYS - CPQ_MGES - IOCTL OUTPUT
AX = 4403h
BX = file handle referencing device "CPQ_MGES"
DS:DX -> request packet (see #0821)
CX ignored
Return: CF clear if successful
AX destroyed
data buffer filled (if applicable)
first word of request packet set to number of bytes of data
available (amount returned is smaller of this and requested
amount)
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
Program: AG1024.SYS is a device driver for the Advanced Graphics 1024 adapter
SeeAlso: AX=4403h"RGDI"

Format of Compaq AG1024.SYS request packet:
Offset Size Description (Table 0821)
00h WORD function
0000h get ??? (26h bytes)
0001h get ??? (36h bytes)
0002h set ??? (same as returned by function 0001h)
0003h get ??? (6 bytes)
0004h get ???
0005h get ???
0006h get ??? (10h bytes)
0007h set ??? (same as returned by function 0006h)
---functions 00h-03h,06h,07h---
02h WORD size of data buffer
04h DWORD -> buffer for function's data
---functions 04h,05h---
02h WORD ???
04h WORD size of data buffer
06h DWORD -> buffer to receive data
--------V-214403-----------------------------
INT 21 - Compaq AG1024.SYS - RGDI - IOCTL OUTPUT
AX = 4403h
BX = file handle referencing device "$$$$RGDI"
DS:DX -> request packet (see #0822)
CX ignored
Return: CF clear if successful
AX destroyed
data buffer filled (if applicable)
first word of request packet set to number of bytes of data
available (amount returned is smaller of this and requested
amount)
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
Program: AG1024.SYS is a device driver for the Advanced Graphics 1024 adapter
SeeAlso: AX=4402h"RGDI",AX=4403h"CPQ_MGES"

Format of Compaq AG1024.SYS request packet:
Offset Size Description (Table 0822)
00h WORD function
0000h get entry points
0001h get ???
02h DWORD address of buffer for returned data
--------m-214403SF01-------------------------
INT 21 U - Qualitas 386MAX v6.01+ - TURN 386MAX OFF
AX = 4403h subfn 01h
BX = handle for device "386MAX$$"
DS:DX -> BYTE 01h
CX ignored
Return: DS:DX -> BYTE status (00h = successful)
CF clear if successful
AX destroyed
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
Note: this function will fail if any EMS or UMBs are in use
SeeAlso: AX=4403h/SF=02h,AX=4403h/SF=03h,AX=4403h/SF=05h
--------m-214403SF02-------------------------
INT 21 U - Qualitas 386MAX v6.01+ - TURN 386MAX ON
AX = 4403h subfn 02h
BX = handle for device "386MAX$$"
DS:DX -> BYTE 02h
CX ignored
Return: DS:DX -> BYTE status (00h = successful)
CF clear if successful
AX destroyed
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
SeeAlso: AX=4403h/SF=01h,AX=4403h/SF=03h,AX=4403h/SF=05h
--------m-214403SF03-------------------------
INT 21 U - Qualitas 386MAX v6.01+ - SET STATE
AX = 4403h subfn 03h
BX = handle for device "386MAX$$"
CX = number of bytes to copy (up to size of state buffer)
DS:DX -> BYTE 03h followed by state buffer
(see #0761 at AX=4402h"386MAX")
Return: CF clear if successful
AX = number of bytes actually written
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
Note: the first byte of the buffer must be either 01h, 02h, or 03h
(specifying the version of the state record) and the buffer must
contain CX bytes AFTER the initial byte
SeeAlso: AX=4402h"386MAX"
--------m-214403SF05-------------------------
INT 21 U - Qualitas 386MAX v7.00+ - LIMIT AUTOMATIC ACTIVATION TO STD EMS CALLS
AX = 4403h subfn 05h
BX = handle for device "386MAX$$"
DS:DX -> BYTE 05h
CX ignored
Return: CF clear if successful
AX destroyed
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
Desc: specifies that 386MAX will only shift from AUTO to ON mode on standard
EMS calls INT 67/AH=40h-5Dh
SeeAlso: AX=4403h/SF=02h,AX=4403h/SF=03h,AX=4403h/SF=06h
--------m-214403SF06-------------------------
INT 21 U - Qualitas 386MAX v7.00+ - ALLOW AUTOMATIC ACTIVATION ON ANY INT 67
AX = 4403h subfn 06h
BX = handle for device "386MAX$$"
DS:DX -> BYTE 06h
CX ignored
Return: CF clear if successful
AX destroyed
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
Desc: specified that 386MAX should shift from AUTO to ON mode on any INT 67
call other than INT 67/AH=3Fh
SeeAlso: AX=4403h/SF=01h,AX=4403h/SF=03h,AX=4403h/SF=05h
--------n-214403-----------------------------
INT 21 U - PenDOS PENDEV.SYS - ???
AX = 4403h
BX = file handle for device "$$PENDOS" or "$$PD_REG"
CX = size of buffer
DS:DX -> buffer containing ???
Return: CF clear if successful
buffer filled
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
Program: A limited version of PenDOS by Communication Intelligence Corporation,
which provides pen capability to keyboard-based programs, is bundled
with IBM DOS 6.1
Note: this call sets the WORD at offset 1Ah into the device driver request
header used to call the driver to 0000h.
SeeAlso: AX=4402h"PENDEV.SYS"
--------D-214404-----------------------------
INT 21 - DOS 2+ - IOCTL - READ FROM BLOCK DEVICE CONTROL CHANNEL
AX = 4404h
BL = drive number (00h = default, 01h = A:, etc.)
CX = number of bytes to read
DS:DX -> buffer
Return: CF clear if successful
AX = number of bytes actually read
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
Note: format of data is driver-specific
SeeAlso: AX=4402h,AX=4405h,INT 2F/AX=122Bh
--------k-214404-----------------------------
INT 21 - Stacker - GET DEVICE DRIVER ADDRESS AND SET VOLUME NUMBER
AX = 4404h
BL = drive number (00h = default, 01h = A:, etc.)
CX = 0004h
DS:DX -> DWORD buffer to receive device driver address
Return: buffer filled with pointer into Stacker device driver (see #1803):
driver + 19h if Stacker Anywhere controls this drive
driver + 1Ah if Stacker controls this drive
unchanged else
Notes: in addition to returning the address of the Stacker device driver,
this call also sets the volume number at offset 58h in the device
driver (see #1803 at INT 25/AX=CDCDh)
Stacker Anywhere does not link its built-in device driver into
the standard device driver chain, but it can be found via CDS/DPB
this call can be used as an installation check for all versions of
Stacker and Stacker Anywhere to avoid the INT 25 call
SeeAlso: AX=4408h,AX=440Eh,AH=52h,INT 25/AX=CDCDh
--------k-214404-----------------------------
INT 21 - Stacker - GET STACVOL FILE SECTORS
AX = 4404h
BL = drive number (0 is current drive)
CX = byte count (i.e., 200h = 1 sector)
DS:DX -> buffer (see #0823)
Return: Data Buffer contains the number of sectors requested from the
STACVOL physical file for the drive specified.

Format of Stacker buffer:
Offset Size Description (Table 0823)
00h WORD 01CDh
02h WORD sector count
04h DWORD number of starting sector
08h DWORD far pointer to Data Buffer
--------k-214404-----------------------------
INT 21 - DUBLDISK.SYS v2.6 - GET INFO
AX = 4404h
BL = drive number of DoubleDisk drive (00h = default, 01h = A:, etc.)
CX = number of bytes (000Ah-0014h, call ignored otherwise)
DS:DX -> data record (see #0824)
Return: CF clear if successful
AX = number of bytes read
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
Program: DUBLDISK.SYS is the device driver portion of DoubleDisk, a disk
expander by Vertisoft Systems, Inc.
Note: the installation check for v2.6 consists of scanning memory for the
signature "FAT 2.6 byte:", which is immediately followed by a data
table (see #0825)
BUG: VOPT (a disk optimizer by Golden Bow Software) assumes that any driver
which returns the "correct" number of bytes when the first word of
the buffer for the data record contains the signature value 4444h is
DoubleDisk; a workaround is for the non-DoubleDisk driver to return
no data if the signature is present
SeeAlso: AX=440Dh
Index: installation check;DUBLDISK.SYS

Format of DUBLDISK data record:
Offset Size Description (Table 0824)
00h WORD (call) signature 4444h
02h BYTE (call) function
00h ???
01h ???
---function 00h---
02h BYTE (ret) ???
03h BYTE (ret) ???
---function 01h---
02h WORD (ret) 4444h
04h WORD allocation unit size???
06h WORD ???
08h WORD ???
0Ah BYTE ???

Format of DUBLDISK signature data table:
Offset Size Description (Table 0825)
00h 5 BYTEs ???
05h BYTE first drive number
06h BYTE number of drives
07h ???
--------k-214404-----------------------------
INT 21 - DBLSPACE.BIN - IOCTL - FLUSH OR INVALIDATE INTERNAL CACHES
AX = 4404h
BL = drive number (00h = default, 01h = A:, etc)
CX = 000Ah (size of DSPACKET structure)
DS:DX -> DSPACKET structure (see #0826)
Return: CF clear if IOCTL successful -- check DSPACKET for actual status
AX = number of bytes actually transferred
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
SeeAlso: AX=4405h"DBLSPACE",INT 2F/AX=4A11h/BX=0000h

Format of DoubleSpace DSPACKET structure:
Offset Size Description (Table 0826)
00h WORD signature 444Dh ("DM")
02h BYTE command code
46h ('F') flush internal caches
49h ('I') flush and invalidate internal caches
03h WORD result code
(ret) 4F4Bh ("OK") if successful, else unchanged
05h 5 BYTEs padding
--------k-214404-----------------------------
INT 21 - DBLSPACE.BIN v6.2 - IOCTL - GET ??? FOR SPECIFIED DRIVE
AX = 4404h
BL = drive number (00h = default, 01h = A:, etc)
CX = size of DSPACKET structure (ignored in DOS 6.2)
DS:DX -> DSPACKET structure (see #0827)
Return: CF clear if IOCTL successful -- check DSPACKET for actual status
AX = number of bytes actually transferred
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
SeeAlso: AX=4405h"DBLSPACE",INT 2F/AX=4A11h/BX=0000h

Format of DoubleSpace DSPACKET structure:
Offset Size Description (Table 0827)
00h WORD signature 444Dh ("DM")
02h BYTE command code
53h ('S') get ??? for specified drive
03h WORD result code
(ret) 4F4Bh ("OK") if successful, else unchanged
05h DWORD (ret) pointer to 96-byte ??? data
09h DWORD (ret) pointer to ??? data
0Dh 3 BYTEs reserved
--------k-214404-----------------------------
INT 21 U - DoubleTools v1.0 - GET ???
AX = 4404h
BL = drive number (00h = default, 01h = A:, etc)
CX = 0006h
DS:DX -> DoubleTools structure (see #0828)
Return: CF clear if IOCTL successful -- check DSPACKET for actual status
AX = number of bytes actually transferred
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
Note: the Transporter device driver has the signature 55h 61h 50h 74h
("DaPt") twelve bytes after it beginning

Format of DoubleTools structure:
Offset Size Description (Table 0828)
00h WORD (call) signature 55h AAh
(ret) signature 78h 70h ("xp")
02h WORD (call) signature 52h 16h
(ret) ???
04h WORD (ret) segment of driver's DS (same as its PSP)
--------d-214404-----------------------------
INT 21 U - xDISK v3.31 - CONFIGURE
AX = 4404h
BL = drive number (00h = default, 01h = A:, etc)
CX = 0047h (length of version string)
DS:DX -> 79-byte buffer for version string and ???
DS:0081h = commandline containing new switches for driver
Return: CF clear if successful
AX = number of bytes actually transferred
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
Program: xDISK is a shareware resizeable EMS RAMdisk by FM de Monasterio
SeeAlso: AX=4405h"xDISK",INT 2F/AH=DDh/BX=7844h"xDISK"
--------c-214404-----------------------------
INT 21 - COMBI-disk v1.13 - GET DATA RECORD
AX = 4404h
BL = drive number (00h = default, 01h = A:, etc)
CX = 0032h (length of data packet)
DS:DX -> buffer for data packet (see #0829)
Return: CF clear if successful
AX = number of bytes actually transferred
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
Program: COMBI-disk is a shareware combination cache and RAMdisk sharing a
single pool of memory by Vadim V. Vlasov
Note: the installation check consists of scanning the valid drives for one
which returns a correctly-sized data packet with the proper
signature in the first field
SeeAlso: AX=4405h"COMBI"
Index: installation check;COMBI-disk

Format of COMBI-disk data packet:
Offset Size Description (Table 0829)
00h 6 BYTEs ASCIZ signature "COMBI"
06h WORD version (high byte = major, low = decimal minor version)
08h BYTE current options (see below)
09h BYTE sectors per allocation block
0Ah WORD maximum buffer in KB
0Ch WORD current buffer in KB (less than max if XMS memory being lent)
0Eh WORD total number of allocation blocks
10h WORD current number of allocation blocks
12h WORD number of blocks being used by RAM disk
14h WORD number of blocks being used by cache or unused
16h WORD number of dirty cache blocks
18h WORD number of blocks which could not be written out due to errors
1Ah WORD total number of read requests
1Ch WORD total number of sectors read
1Eh WORD number of BIOS read requests (cache misses)
20h WORD number of sectors read via BIOS (cache misses)
22h WORD total number of write requests
24h WORD total number of sectors written
26h WORD number of BIOS write requests
28h WORD number of sectors written via BIOS
2Ah WORD number of RAM disk read requests
2Ch WORD number of sectors read from RAM disk
2Eh WORD number of RAM disk write requests
30h WORD number of sectors written to RAM disk
--------d-214404-----------------------------
INT 21 - SFS v1.00 - GET CONFIGURATION INFORMATION
AX = 4404h
BL = drive number (00h = default, 01h = A:, etc)
CX = 001Ah (length of data packet)
DS:DX -> buffer for data packet (see #0830)
Return: CF clear if successful
AX = number of bytes actually transferred
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
Program: SFS (Secure FileSystem) is a shareware encrypting disk driver by
Peter C. Gutmann
SeeAlso: AX=4405h"SFS"

Format of SFS data packet:
Offset Size Description (Table 0830)
00h 4 BYTEs signature string "SFS1"
04h WORD SFS unit number (0-based)
06h WORD drive on which the SFS volume is mounted
08h DWORD sector offset of logical volume from start of physical volume
0 if logical volume = physical volume
0Ch WORD flag: 00h = no disk mounted, 01h = disk mounted
0Eh WORD flag: 00h read/write, 01h read-only
10h WORD quick-unmount hotkey (high byte = shift state, low = scan code)
12h WORD auto-unmount time in minutes, or 0000h if already expired, or
FFFFh if not set
14h WORD time in minutes remaining before auto-unmount
16h WORD internal driver check code
0000h no error
0001h driver consistency check failed
0002h unit consistency check failed
18h WORD disk access mode
0000h BIOS
0001h IDE direct access
0002h SCSI direct access
--------D-214405-----------------------------
INT 21 - DOS 2+ - IOCTL - WRITE TO BLOCK DEVICE CONTROL CHANNEL
AX = 4405h
BL = drive number (00h = default, 01h = A:, etc)
CX = number of bytes to write
DS:DX -> data to write
Return: CF clear if successful
AX = number of bytes actually written
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
Note: format of data is driver-specific
SeeAlso: AX=4403h,AX=4404h,INT 2F/AX=122Bh
--------d-214405-----------------------------
INT 21 - Brian Antoine Seagate ST-01 SCSI.SYS - IOCTL - EXECUTE COMMANDS
AX = 4405h
BX = drive number (00h = default, 01h = A:, etc)
CX = number of bytes to write
DS:DX -> SCSIDISK control block (see also #0819 at AX=4403h"ST-01")
Return: CF clear if successful
AX = number of bytes actually written
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
SeeAlso: AX=4403h"ST-01"
--------k-214405-----------------------------
INT 21 U - DBLSPACE.BIN - IOCTL - FLUSH OR INVALIDATE INTERNAL CACHES
AX = 4405h
BL = drive number (00h = default, 01h = A:, etc)
CX = 000Ah (size of DSPACKET structure)
DS:DX -> DSPACKET structure (see #0831)
Return: CF clear if IOCTL successful -- check DSPACKET for actual status
AX = number of bytes actually transferred
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
Note: this call is identical to the documented AX=4404h
SeeAlso: AX=4404h"DBLSPACE",INT 2F/AX=4A11h/BX=0000h

Format of DoubleSpace DSPACKET structure:
Offset Size Description (Table 0831)
00h WORD signature 444Dh ("DM")
02h BYTE command code
46h ('F') flush internal caches
49h ('I') flush and invalidate internal caches
03h WORD result code
(ret) 4F4Bh ("OK") if successful, else unchanged
05h 5 BYTEs padding
--------d-214405-----------------------------
INT 21 U - xDISK v3.31 - ???
AX = 4405h
BL = drive number (00h = default, 01h = A:, etc)
CX = number of bytes to write
DS:DX -> buffer containing version string
???
Return: CF clear if successful
AX = number of bytes actually transferred
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
Program: xDISK is a shareware resizeable EMS RAMdisk by FM de Monasterio
SeeAlso: AX=4404h"xDISK",INT 2F/AH=DDh/BX=7844h"xDISK"
--------d-214405-----------------------------
INT 21 - COMBI-disk v1.13 - CONTROL COMBI-disk
AX = 4405h
BL = drive number (00h = default, 01h = A:, etc) for RAM disk
CX = number of bytes to write
DS:DX -> buffer containing command packet (see #0833)
Return: CF clear if successful
AX = number of bytes actually transferred
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
SeeAlso: AX=4404h"COMBI"

(Table 0832)
Values for COMBI-disk command code:
80h flush cache
81h change options byte
82h shrink memory
83h expand memory
84h get dirty block information
85h reset write errors
86h reset counters

Format of COMBI-disk command packet:
Offset Size Description (Table 0833)
00h WORD version
02h BYTE command code (see #0832)
---command code 80h---
no additional fields
---command code 81h---
03h BYTE new options byte (see #0834)
---command code 82h---
03h WORD number of KB to release
---command code 83h---
03h WORD number of KB to expand
---command code 84h---
03h DWORD -> buffer for block info (see #0835)
---command code 85h---
03h DWORD block ID
---command code 86h---
03h BYTE which counters to reset
bit 0: hard disk read counts
bit 1: hard disk write counts
bit 2: RAM disk read/write counts
Note: multiple commands may be placed in a single packet by stringing
together as many command/argument pairs as desired

Bitfields for COMBI-disk options byte:
Bit(s) Description (Table 0834)
0 cache off
1 cache frozen
2 write caching enabled
3 delayed writing disabled
5 fix memory allocation (no XMS lending)
6 no 'sector not found' error

Format of COMBI-disk block info:
Offset Size Description (Table 0835)
00h DWORD block ID
04h BYTE bitmask of valid sectors in block
05h BYTE bitmask of dirty sectors in block
06h BYTE last error returned by BIOS
07h BYTE number of errors
--------D-214405-----------------------------
INT 21 - SFS v1.00 - DRIVER CONTROL
AX = 4405h
BL = drive number (00h = default, 01h = A:, etc)
CX = number of bytes to write
DS:DX -> data to write (see #0837)
Return: CF clear if successful
AX = number of bytes actually written
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
Program: SFS (Secure FileSystem) is a shareware encrypting disk driver by
Peter C. Gutmann
SeeAlso: AX=4404h"SFS"

(Table 0836)
Values for SFS control function:
00h "PACKET_SET_DISKINFO" set disk parameters
01h "PACKET_SET_KEYINFO" set keying information
02h "PACKET_SET_READONLY" select read/write or read-only
03h "PACKET_SET_DRIVENO" set drive number to mount
04h "PACKET_SET_MOUNTSTATUS" set mount status
05h "PACKET_SET_UNMOUNT" set/clear quick-unmount hotkey
06h "PACKET_SET_TIMEOUT" set/clear auto-unmount timeout

Format of SFS control data packet:
Offset Size Description (Table 0837)
00h WORD signature 4330h ('C0')
02h WORD function (see #0836)
---function 00h---
04h WORD sector size in bytes
06h BYTE sectors per cluster
07h WORD number of boot sectors
09h BYTE number of copies of FAT
0Ah WORD size of root directory in entries
0Ch WORD number of sectors on disk, 16-bit
0Eh BYTE media descriptor byte
0Fh WORD sectors per FAT
11h WORD sectors per track
13h WORD number of heads
15h DWORD number of hidden sectors
19h DWORD number of sectors on disk, 32-bit
---function 01h---
04h 20 BYTEs master IV for encrypted disk
18h 64 BYTEs NDC/SHS keying information
---function 02h---
04h WORD read-only state: 00h read-only, 01h read/write
---function 03h---
04h WORD drive number (see #0838)
06h DWORD sector offset of logical volume from start of physical volume
0 if logical volume = physical volume
---function 04h---
04h WORD mount status (00h unmounted, 01h mounted)
---function 05h---
04h WORD hotkey (high byte = shift state, low byte = scan code or 00h)
0000h to disable hotkey
---function 06h---
04h WORD timeout in minutes before automatic unmount
0000h to disable auto-unmount
Notes: the data for function 00h corresponds to a DOS BPB (see AH=53h)
functions 00h, 01h, and 03h automatically unmount the encrypted drive
unmounting a drive with function 04h also destroys the encryption
information in the driver and forces all dirty buffers to be flushed

Bitfields for SFS drive number:
Bit(s) Description (Table 0838)
15-12 drive access mode
0000 BIOS access
0001 direct IDE access
0010 direct SCSI access
---if BIOS access---
11-8 unused (0)
7-0 BIOS drive number
---if IDE access---
11-8 unused (0)
7-0 IDE drive number
---if SCSI access---
11-8 SCSI host number
7-4 SCSI target ID
3-0 SCSI logical unit number
--------D-214406-----------------------------
INT 21 - DOS 2+ - IOCTL - GET INPUT STATUS
AX = 4406h
BX = file handle
Return: CF clear if successful
AL = input status
00h not ready (device) or at EOF (file)
FFh ready
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
Note: files may not register as being at EOF if positioned there by AH=42h
SeeAlso: AX=4407h,INT 2F/AX=122Bh
--------D-214407-----------------------------
INT 21 - DOS 2+ - IOCTL - GET OUTPUT STATUS
AX = 4407h
BX = file handle
Return: CF clear if successful
AL = input status
00h not ready
FFh ready
CF set on error
AX = error code (01h,05h,06h,0Dh) (see #0960 at AH=59h)
Note: for DOS 2+, files are always ready for output, even if the disk is
full or no media is in the drive
SeeAlso: AX=4406h,INT 2F/AX=122Bh
--------D-214408-----------------------------
INT 21 - DOS 3.0+ - IOCTL - CHECK IF BLOCK DEVICE REMOVABLE
AX = 4408h
BL = drive number (00h = default, 01h = A:, etc)
Return: CF clear if successful
AX = media type (0000h removable, 0001h fixed)
CF set on error
AX = error code (01h,0Fh) (see #0960 at AH=59h)
Note: in addition to the normal operation, if Stacker is installed, this
call also sets the volume number at offset 58h in the Stacker
device driver (except under DR-DOS 3.41-5.0, which do not pass
through this call to the driver; use AX=440Eh instead)
(see AX=4404h"Stacker",AX=440Eh,INT 25/AX=CDCDh)
SeeAlso: AX=4400h,AX=4404h"Stacker",AX=4409h,INT 2F/AX=122Bh
--------D-214409-----------------------------
INT 21 - DOS 3.1+ - IOCTL - CHECK IF BLOCK DEVICE REMOTE
AX = 4409h
BL = drive number (00h = default, 01h = A:, etc)
Return: CF clear if successful
DX = device attribute word
bit 15: drive is SUBSTituted
bit 12: drive is remote
bit 9: direct I/O not allowed
CF set on error
AX = error code (01h,0Fh) (see #0960 at AH=59h)
Note: on local drives, DX bits not listed above are the attribute word from
the device driver header (see #0933 at AH=52h); for remote drives,
the other bits appear to be undefined for DOS versions prior to 5.0
(they are all cleared in DOS 5+)
checking whether DX=0800h on return appears to be a fairly reliable
method for detecting Microsoft's RAMDRIVE, though not for other
ramdisks (there appears to be no simple yet foolproof method for
detecting ramdisks, although the presence of only a single copy of
the FAT and only a single head on non-removable devices is a fairly
good indicator)
SeeAlso: AX=4400h,AX=4408h,AX=440Ah,INT 2F/AX=122Bh
--------D-21440A-----------------------------
INT 21 - DOS 3.1+ - IOCTL - CHECK IF HANDLE IS REMOTE
AX = 440Ah
BX = handle
Return: CF clear if successful
DX = attribute word (as stored in SFT)
bit 15: set if remote
bit 14: date/time not set on close
CF set on error
AX = error code (01h,06h) (see #0960 at AH=59h)
Notes: if file is remote, Novell Advanced NetWare 2.0 returns the number of
the file server on which the handle is located in CX
DR-DOS 3.41 and 5.0 clear all bits of DX except bit 15
SeeAlso: AX=4400h,AX=4409h,AH=52h,INT 2F/AX=122Bh
--------D-21440B-----------------------------
INT 21 - DOS 3.1+ - IOCTL - SET SHARING RETRY COUNT
AX = 440Bh
CX = pause between retries (default 1)
DX = number of retries (default 3)
Return: CF clear if successful
CF set on error
AX = error code (01h) (see #0960 at AH=59h)
Notes: delay is dependent on processor speed (value in CX specifies number of
64K-iteration empty loops to execute)
if DX=0000h on entry, the retry count is left unchanged
SeeAlso: AH=52h,INT 2F/AX=1224h,INT 2F/AX=122Bh
--------D-21440C-----------------------------
INT 21 - DOS 3.2+ - IOCTL - GENERIC CHARACTER DEVICE REQUEST
AX = 440Ch
BX = device handle
CH = category code (see #0839)
CL = function number (see #0840)
DS:DX -> parameter block (see #0841,#0842,#0843,#0844,#0845,#0846)
SI = parameter to pass to driver (European MS-DOS 4.0, OS/2 comp box)
DI = parameter to pass to driver (European MS-DOS 4.0, OS/2 comp box)
Return: CF set on error
AX = error code (see #0960 at AH=59h)
CF clear if successful
DS:DX -> iteration count if CL=65h
SI = returned value (European MS-DOS 4.0, OS/2 comp box)
DI = returned value (European MS-DOS 4.0, OS/2 comp box)
Note: DR-DOS 3.41 and 5.0 return error code 16h on CL=45h,65h if the device
does not support a retry counter
SeeAlso: AX=440Dh,INT 2F/AX=0802h,INT 2F/AX=122Bh,INT 2F/AX=14FFh
SeeAlso: INT 2F/AX=1A01h

(Table 0839)
Values for IOCTL category code:
00h unknown (DOS 3.3+)
01h COMn: (DOS 3.3+)
03h CON (DOS 3.3+)
05h LPTn:
9Eh Media Access Control driver (STARLITE)

00h-7Fh reserved for Microsoft
80h-FFh reserved for OEM/user-defined

(Table 0840)
Values for generic character IOCTL function:
00h MAC driver Bind (STARLITE) (see #0841)
45h set iteration (retry) count (see #0842)
4Ah select code page (see #0843)
4Ch start code-page preparation (see #0844)
4Dh end code-page preparation (see #0845)
5Fh set display information (DOS 4.0+) (see #0846)
65h get iteration (retry) count
6Ah query selected code page (see #0843)
6Bh query prepare list (see #0847)
7Fh get display information (DOS 4.0+) (see #0846)
Note: bit assignments for function code:
bit 7: set to ignore if unsupported, clear to return error
bit 6: set if passed to driver, clear if intercepted by DOS
bit 5: set if queries data from device, clear if sends command
bits 4-0: subfunction

Format of parameter block for function 00h:
Offset Size Description (Table 0841)
00h 8 BYTEs ASCIZ signature "STARMAC"
08h WORD version
0Ah WORD flags
bit 0: media requires connect or listen request before use
bit 1: network is a LAN (broadcast/multicast supported)
bit 2: point-to-point network
0Ch WORD handle for use with MAC driver's private interface (filled in
by MAC driver)
0Eh WORD context
10h WORD approximate speed in KB/sec (filled in by MAC driver)
12h WORD approximate cost in cents per hour (filled in by MAC driver)
14h WORD maximum packet size in bytes (filled in by MAC driver)
16h WORD addressing format (filled in by MAC driver)
0000h general addressing
0001h Ethernet addressing
0002h Token Ring addressing
0003h Token Bus addressing
18h DWORD Send entry point (filled in by MAC driver)
1Ch DWORD RegisterEventHandler entry point (filled in by MAC driver)
20h DWORD SetPacketFilter entry point (filled in by MAC driver)
24h DWORD UnBind entry point (filled in by MAC driver)

Format of parameter block for function 45h:
Offset Size Description (Table 0842)
00h WORD number of times output is attempted before driver assumes
device is busy

Format of parameter block for functions 4Ah and 6Ah:
Offset Size Description (Table 0843)
00h WORD length of data
02h WORD code page ID (see #1040 at INT 21/AX=6602h)
04h 2N BYTEs DCBS (double byte character set) lead byte range
start/end for each of N ranges (DOS 4.0)
WORD 0000h end of data (DOS 4.0)

Format of parameter block for function 4Ch:
Offset Size Description (Table 0844)
00h WORD flags
DISPLAY.SYS = 0000h
PRINTER.SYS bit 0 clear to prepare downloaded font, set to
prepare cartridge selection
02h WORD length of remainder of parameter block
04h WORD number of code pages following
06h N WORDs code page 1,...,N

Format of parameter block for function 4Dh:
Offset Size Description (Table 0845)
00h WORD length of data
02h WORD code page ID (see #1040 at INT 21/AX=6602h)

Format of parameter block for functions 5Fh and 7Fh:
Offset Size Description (Table 0846)
00h BYTE level (0 for DOS 4.x-6.0)
01h BYTE reserved (0)
02h WORD length of following data (14)
04h WORD control flags
bit 0 set for blink, clear for intensity
bits 1-15 reserved
06h BYTE mode type (1=text, 2=graphics)
07h BYTE reserved (0)
08h WORD colors
0000h = monochrome
else N bits per pixel
0Ah WORD pixel columns
0Ch WORD pixel rows
0Eh WORD character columns
10h WORD character rows

Format of parameter block for function 6Bh:
Offset Size Description (Table 0847)
00h WORD length of following data
02h WORD number of hardware code pages
04h N WORDs hardware code pages 1,...,N
WORD number of prepared code pages
N WORDs prepared code pages 1,...,N
--------d-21440C-----------------------------
INT 21 - Greg Shenaut ASPITAPE.SYS - INTERFACE
AX = 440Ch
BX = device handle
CH = category code
07h tape (ASPITAPE.SYS)
CL = function
01h "mtop" - perform tape operation
02h "mtget" - get tape status
03h ignore end-of-tape errors
04h enable end-of-tape errors
DS:DX -> parameter block (see #0848,#0849)
Return: CF set on error
AX = error code (see #0960 at AH=59h)
CF clear if successful
DS:DX -> data block
Notes: This device driver is a simple DOS interface to the Adaptec Advanced
SCSI Programming Interface (ASPI). It provides the following device
names as access to the SCSI tape, 'RMTx' (rewind on close) and
'NRMTx' (NO rewind on close) where x can go from 0 to 3. There may
also be the following names 'MTx' and 'NMTx' which default to 1024
byte blocks. The names may also have a '$' appended to try and make
them unique from file names of 'RMT0' etc.
once opend these devices must be put into RAW mode
SeeAlso: AX=4402h"ASPI"

Format of ASPITAPE.SYS mtop parameter block:
Offset Size Description (Table 0848)
00h WORD operation code
00h "MTWEOF" - write an end-of-file record
01h "MTFSF" - forward space file
02h "MTBSF" - backward space file
03h "MTFSR" - forward space record
04h "MTBSR" - backward space record
05h "MTREW" - rewind
06h "MTOFFL" - rewind and unload
07h "MTNOP" - perform TEST UNIT READY
02h DWORD repetition count

Format of ASPITAPE.SYS mtget parameter block:
Offset Size Description (Table 0849)
00h BYTE ASPI host ID
01h BYTE SCSI target ID
02h BYTE SCSI logical unit number
03h BYTE device parameters
bit 0: drive must use fixed-block read and write
bit 7: drive is an ASPI device
04h BYTE current device state (see #0850)
05h BYTE unit number within driver
06h WORD fixed block blocksize
08h BYTE last SCSI status
09h BYTE last SCSI sense key
0Ah WORD last SCSI opcode (packed) (see #0851)
0Ch WORD residual bytes from SCSI opcode

Bitfields for ASPITAPE.SYS current device state:
Bit(s) Description (Table 0850)
0 device currently opened in buffered mode
1 drive currently opened in nonbuffered mode
2 rewind drive on last close
3 drive has been written on
4 drive has been read from
5 next read will return 0 bytes
6 EOM will resemble EOF
7 drive may be busy rewinding

Bitfields for SCSI opcode:
Bit(s) Description (Table 0851)
0-7 SCSI operation (SCSI packet byte 0)
8-10 SCSI flags (SCSI packet byte 1)
11-12 ASPI "Direction Bits" (ASPI SRB byte 3)
--------D-21440D-----------------------------
INT 21 - DOS 3.2+ - IOCTL - GENERIC BLOCK DEVICE REQUEST
AX = 440Dh
BL = drive number (00h=default,01h=A:,etc)
CH = category code (see #0852)
CL = minor code (function) (see #0853)
DS:DX -> (DOS) parameter block (see #0854,#0856,#0857,#0858,#0859)
SI:DI -> (OS/2 comp box) parameter block (see #0860,#0862,#0863,#0864)
Return: CF set on error
AX = error code (01h,02h) (see #0960 at AH=59h)
CF clear if successful
DS:DX -> data block if CL=60h or CL=61h
Notes: DOS 4.01 seems to ignore the high byte of the number of directory
entries in the BPB for diskettes.
functions 46h and 66h undocumented in DOS 4.x, documented for DOS 5+
the DUBLDISK.SYS v2.6 driver only supports minor codes 60h and 67h
DR-DOS 3.41-6.0 only support minor codes 40h-42h and 60h-62h; all
other minor codes return error code 16h
some PCMCIA calls reportedly appear to be dangerous for MS-DOS versions
prior to 5.0
minor code 60h normally produces no I/O except with AutoMount=1 for
DBLSPACE/DRVSPACE
SeeAlso: AX=440Ch,AH=69h,INT 2F/AX=0802h,INT 2F/AX=122Bh

(Table 0852)
Values for block device IOCTL category code:
08h disk drive
00h-7Fh reserved for Microsoft
80h-FFh reserved for OEM/user-defined

(Table 0853)
Values for generic block IOCTL minor code:
00h (OS/2) \ used to lock/unlock a drive
01h (OS/2) /
40h set device parameters (see #0854)
41h write logical device track (see #0856)
42h format and verify logical device track (see #0857)
46h (DOS 4.0+) set volume serial number (see #0859,AH=69h)
47h (DOS 4.0+) set access flag (see #0860)
48h (Enh. Disk Drive Spec) set media lock state (see #0861,INT 13/AH=45h)
49h (Enh. Disk Drive Spec) eject media in drive (see INT 13/AH=49h)
4Ah (MS-DOS 7.0) lock drive (allow direct write access)
50h (PCMCIA) attribute memory write
51h (PCMCIA) common memory write
52h (PCMCIA) force media change (DOS 5+ ???) (see #0862)
53h (PCMCIA) erase drive
54h (PCMCIA) erase media
56h (PCMCIA) set erase status callback
57h (PCMCIA) append Card Information Structure (CIS) tuple
58h (PCMCIA) erase CIS tuples
60h get device parameters (see #0854)
61h read logical device track (see #0856)
62h verify logical device track (see #0858)
66h (DOS 4.0+) get volume serial number (see #0859,AH=69h)
67h (DOS 4.0+) get access flag (see #0860)
68h (DOS 5.0+) sense media type (see #0863)
6Ah (MS-DOS 7.0) unlock drive (disable direct write access)
70h (PCMCIA) attribute memory read
73h (PCMCIA) get memory media information (DOS 5+ ???) (see #0864)
76h (PCMCIA) get erase status callback
77h (PCMCIA) get first Card Information Structure (CIS) tuple
78h (PCMCIA) get next CIS tuple
7Fh (PCMCIA) get ??? information (see #0865,#0866)

Format of parameter block for functions 40h, 60h:
Offset Size Description (Table 0854)
00h BYTE special functions
bit 0 set if function to use current BPB, clear if Device
BIOS Parameter Block field contains new default BPB
bit 1 set if function to use track layout fields only
must be clear if CL=60h
bit 2 set if all sectors in track same size (should be set)
bits 3-7 reserved (MS-DOS, Novell DOS 7)
bit 5: skip head settling time (WinDOS 2.11)
bit 6: format access flag (WinDOS 2.11)
01h BYTE device type (see #0855)
02h WORD device attributes
bit 0 set if nonremovable medium
bit 1 set if door lock ("changeline") supported
bits 2-15 reserved
04h WORD number of cylinders
06h BYTE media type
for 1.2M drive
00h 1.2M disk (default)
01h 320K/360K disk
F8h for DUBLDISK.SYS v2.6 expanded drives
always 00h for other drive types
07h 31 BYTEs device BPB (see #0950 at AH=53h), bytes after BPB offset 1Eh
omitted
---function 40h only---
26h WORD number of sectors per track (start of track layout field)
(maximum 63)
28h N word pairs: number,size of each sector in track

(Table 0855)
Values for device type:
00h 320K/360K disk
01h 1.2M disk
02h 720K disk
03h single-density 8-inch disk
04h double-density 8-inch disk
05h fixed disk
06h tape drive
07h (DOS 3.3+) other type of block device, normally 1.44M floppy
08h read/write optical disk
09h (DOS 5+) 2.88M floppy

Format of parameter block for functions 41h, 61h:
Offset Size Description (Table 0856)
00h BYTE special functions (reserved, must be zero)
01h WORD number of disk head
03h WORD number of disk cylinder
05h WORD number of first sector to read/write
07h WORD number of sectors
09h DWORD transfer address

Format of parameter block for function 42h:
Offset Size Description (Table 0857)
00h BYTE reserved, must be zero (DOS <3.2)
bit 0=0: format/verify track
1: format status call (DOS 3.2+), don't actually format
bits 1-7 reserved, must be zero
value on return (DOS 3.3+):
00h specified tracks, sectors/track supported by BIOS
01h function not supported by BIOS
02h specified tracks, sectors/track not allowed for drive
03h no disk in drive
01h WORD number of disk head
03h WORD number of disk cylinder

Format of parameter block for function 62h:
Offset Size Description (Table 0858)
00h BYTE reserved, must be zero (DOS <3.2)
bit 0=0: verify single track
1: verify multiple tracks
bits 1-7 reserved, must be zero
value on return (DOS 3.3+):
00h specified tracks, sectors/track supported by BIOS
01h function not supported by BIOS
02h specified tracks, sectors/track not allowed for drive
03h no disk in drive
01h WORD number of disk head
03h WORD number of disk cylinder
05h WORD number of tracks to verify (equivalent to 255 or fewer sectors)

Format of parameter block for functions 46h, 66h:
Offset Size Description (Table 0859)
00h WORD (call) info level (should be 0000h)
02h DWORD disk serial number (binary)
06h 11 BYTEs volume label or "NO NAME "
11h 8 BYTEs filesystem type "FAT12 " or "FAT16 " (CL=66h only)

Format of parameter block for functions 47h, 67h:
Offset Size Description (Table 0860)
00h BYTE special-function field (must be zero)
01h BYTE disk-access flag, nonzero if access allowed by driver

Format of parameter block for function 48h:
Offset Size Description (Table 0861)
00h BYTE (call) locking operation
00h lock media in drive
01h unlock media
02h get locking status
01h BYTE (ret) drive's lock status

Format of parameter block for function 52h:
00h BYTE (call) unused??? (Table 0862)
(ret) 00h if flash/ATA drive but no card inserted
unchanged otherwise
Notes: the absense of a flash card should be tested by checking the DOS error
code rather than the returned byte
the parameter byte is cleared to 00h erroneously by the Award
PCDISK.EXE v1.02c PCMCIA/ATA driver if no ATA card is inserted
(bug corrected in PCDISK.EXE v1.02h and later)
not supported by the SystemSoft ATADRV.EXE and the Phoenix PCMATA.SYS
PCMCIA/ATA drivers

Format of parameter block for function 68h:
Offset Size Description (Table 0863)
00h BYTE 01h for default media type, 00h for any other media type
(see also INT 13/AH=20h"Compaq")
01h BYTE 02h for 720K, 07h for 1.44M, 09h for 2.88M

Format of parameter block for function 73h:
Offset Size Description (Table 0864)
00h BYTE ???
00h ATA card inserted ???
80h ATA card not inserted ???
01h BYTE length of parameter block ???
apparently always 40h
02h BYTE ???
00h ATA card not inserted ???
0Dh ATA card inserted ???
03h 2 BYTEs ??? (apparently always 00h)
05h BYTE drive number (0=first) ???
06h BYTE total number of drives ???
07h BYTE ???
00h ATA card not inserted ???
01h ATA card inserted ???
08h 17 BYTEs ???
19h BYTE ???
00h ATA card not inserted ???
01h ATA card inserted ???
1Ah BYTE ??? (apparently always 01h)
1Bh BYTE ???
00h ATA card not inserted ???
01h ATA card inserted ???
1Ch 2 BYTEs ??? (apparently always 0015h)
1Eh 2 BYTEs ???
20h 2 BYTEs ??? (apparently always 0110h)
22h 15 BYTEs ???
31h 2 BYTEs ??? (apparently always 7000h)
33h 11 BYTEs driver signature
"AWARD PDISK" for Award PCDISK.EXE PCMCIA/ATA driver
"MS-BIOS " for HP 200LX generic ATA driver
3Eh 2 BYTEs ???
Notes: parameter structure possibly depends on driver
this function is not supported by the SystemSoft ATADRV.EXE and the
Phoenix PCMATA.SYS PCMCIA/ATA drivers

Format of parameter block for function 7Fh for SystemSoft ATADRV.EXE:
Offset Size Description (Table 0865)
00h DWORD -> unknown location within driver
Note: function supported by the SystemSoft ATADRV.EXE PCMCIA/ATA driver
but not by the Award PCDISK.EXE PCMCIA/ATA driver
SeeAlso: #0866

Format of parameter block for function 7Fh for Phoenix PCMATA.SYS:
Offset Size Description (Table 0866)
00h 8 BYTEs ???
Note: this function supported by the Phoenix PCMATA.SYS PCMCIA/ATA driver
but not by the Award PCDISK.EXE PCMCIA/ATA driver
SeeAlso: #0865
--------D-21440E-----------------------------
INT 21 - DOS 3.2+ - IOCTL - GET LOGICAL DRIVE MAP
AX = 440Eh
BL = drive number (00h=default,01h=A:,etc)
Return: CF set on error
AX = error code (01h,0Fh) (see #0960 at AH=59h)
CF clear if successful
AL = 00h block device has only one logical drive assigned
1..26 the last letter used to reference the drive (1=A:,etc)
Notes: DR-DOS 3.41-5.0 DRIVER.SYS does not support drive mapping and thus
always returns AL=00h
in addition to the normal operation, if Stacker is installed, this
call also sets the volume number at offset 58h in the Stacker
device driver (DR-DOS 3.41-5.0 only; use AX=4408h otherwise)
(see AX=4404h"Stacker",INT 25/AX=CDCDh)
SeeAlso: AX=4408h,AX=440Fh,INT 2F/AX=122Bh
--------D-21440F-----------------------------
INT 21 - DOS 3.2+ - IOCTL - SET LOGICAL DRIVE MAP
AX = 440Fh
BL = physical drive number (00h=default,01h=A:,etc))
Return: CF set on error
AX = error code (01h,0Fh) (see #0960 at AH=59h)
CF clear if successful
drive now responds to next logical drive number
Notes: maps logical drives to physical drives, similar to DOS's treatment of
a single physical floppy drive as both A: and B:
DR-DOS 3.41-5.0 DRIVER.SYS does not support drive mapping and thus
always returns an error on this function
SeeAlso: AX=440Eh,INT 2F/AX=122Bh
--------D-214410-----------------------------
INT 21 - DOS 5+ - IOCTL - QUERY GENERIC IOCTL CAPABILITY (HANDLE)
AX = 4410h
BX = handle for device
CH = category code (see #0839)
CL = function code (see #0840)
Return: CF clear if successful
AX = 0000h specified IOCTL function is supported
CF set on error
AL = 01h IOCTL capability not available
Note: a program which wishes to use Generic IOCTL calls beyond those in the
standard DOS 3.2 set may use this call first to see whether a
particular call is supported
SeeAlso: AX=440Ch,AX=440Dh,AX=4411h
--------d-214410BXFFFF-----------------------
INT 21 U - NewSpace - ENABLE DRIVER
AX = 4410h
BX = FFFFh
Program: NewSpace is a TSR by Isogon Corporation which automatically compresses
all files as they are written and decompresses them as they are read
Note: compressed files are not accessible unless the driver is enabled
SeeAlso: AX=4411h/BX=FFFFh
--------D-214411-----------------------------
INT 21 - DOS 5+ - IOCTL - QUERY GENERIC IOCTL CAPABILITY (DRIVE)
AX = 4411h
BL = drive number
CH = category code (see #0852)
CL = function code (see #0853)
Return: CF clear if successful
AX = 0000h specified IOCTL function is supported
CF set on error
AL = 01h IOCTL capability not available
Note: a program which wishes to use Generic IOCTL calls beyond those in the
standard DOS 3.2 set may use this call first to see whether a
particular call is supported
SeeAlso: AX=440Ch,AX=440Dh,AX=4410h
--------d-214411BXFFFF-----------------------
INT 21 U - NewSpace - DISABLE DRIVER
AX = 4411h
BX = FFFFh
Program: NewSpace is a TSR by Isogon Corporation which automatically compresses
all files as they are written and decompresses them as they are read
Note: compressed files are not accessible unless the driver is enabled
SeeAlso: AX=4410h/BX=FFFFh
--------O-214412-----------------------------
INT 21 O - DR-DOS 5.0-6.0 - DETERMINE DOS TYPE
AX = 4412h
CF set
Return: CF set if not DR-DOS
AX = error code (see #0960 at AH=59h)
CF clear if DR-DOS
DX = AX = version code (see #0868)
Note: this obsolete call, which is no longer supported in Novell DOS 7, is
identical to AX=4452h
SeeAlso: AX=4452h
--------d-214412BXFFFF-----------------------
INT 21 U - NewSpace - INSTALLATION CHECK???
AX = 4412h
BX = FFFFh
Return: AX = PSP segment of NewRes (resident driver for NewSpace)
BX:DX -> ???
CX = ???
SeeAlso: AX=4411h/BX=FFFFh
--------d-214413BXFFFF-----------------------
INT 21 U - NewSpace - GET ???
AX = 4413h
BX = FFFFh
Return: AX = code segment of NewRes (resident driver for NewSpace)
BX = offset of ???
SeeAlso: AX=4412h/BX=FFFFh
--------O-214414-----------------------------
INT 21 OU - DR-DOS 5.0-6.0 - SET GLOBAL PASSWORD
AX = 4414h
DS:DX -> password string (blank-padded to 8 characters)
Desc: Specify the master password for accessing files.
Note: this obsolete call, which is no longer supported in Novell DOS 7, is
identical to AX=4454h
SeeAlso: AX=4454h
--------d-214414BXFFFF-----------------------
INT 21 U - NewSpace - DEBUGGING DUMP
AX = 4414h
BX = FFFFh
Return: debugging dump written to X:\NEWSPACE.SMP
SeeAlso: AX=4413h/BX=FFFFh,AX=44FFh/BX=FFFFh
--------O-2144-------------------------------
INT 21 OU - DR-DOS 5.0-6.0 - HISTORY BUFFER, SHARE, AND HILOAD CONTROL
AH = 44h
AL = 16h to 18h
Note: these obsolete subfunctions (which are no longer supported in Novell
DOS 7) are identical to AX=4456h through 4458h
SeeAlso: AX=4456h,AX=4457h,AX=4458h
--------O-214451-----------------------------
INT 21 - Concurrent DOS v3.2+ - INSTALLATION CHECK
AX = 4451h
Return: CF set if not Concurrent DOS
AX = error code (see #0960 at AH=59h)
CF clear if successful
AH = single-user/multiuser nature
10h single-user
AL = operating system version ID (see #0868)
14h multiuser
AL = operating system version ID (see #0867)
Notes: as of Concurrent DOS/XM 5.0 (possibly earlier), the version is stored
in the environment variable VER
use this function if you are looking for multiuser capabilities,
AX=4452h for single-user
this function should never return the single-user values
SeeAlso: AX=4452h,AX=4459h

(Table 0867)
Values for Digital Research operating system version ID:
32h Concurrent PC DOS 3.2
41h Concurrent DOS 4.1
50h Concurrent DOS/XM 5.0 or Concurrent DOS/386 1.1
60h Concurrent DOS/XM 6.0 or Concurrent DOS/386 2.0
62h Concurrent DOS/XM 6.2 or Concurrent DOS/386 3.0
66h DR Multiuser DOS 5.1
67h Concurrent DOS 5.1
--------O-214452-----------------------------
INT 21 - DR-DOS 3.41+ - DETERMINE DOS TYPE/GET DR-DOS VERSION
AX = 4452h ("DR")
CF set
Return: CF set if not DR-DOS
AX = error code (see #0960 at AH=59h)
CF clear if DR-DOS
AX = version code
AH = single-user/multiuser nature
10h single-user
AL = operating system version ID (see #0868)
14h multiuser
AL = operating system version ID (see #0867)
DX modified (see note)
Notes: the DR-DOS version is stored in the environment variable VER
use this function if looking for single-user capabilities, AX=4451h
if looking for multiuser; this call should never return multiuser
values
in DR-DOS 3.41-6.0, DX=AX on return; for Novell DOS 7, DH=AH but DL=00h
(reportedly, DH=00h when booting NWDOS7 from installation disks)
Novell DOS 7 returns error code 0001h if SETVER 255.x is in effect for
the calling program
SeeAlso: AX=4412h,AX=4451h,AX=4459h

(Table 0868)
Values for Digital Research operating system version ID:
60h DOS Plus
63h DR-DOS 3.41
64h DR-DOS 3.42
65h DR-DOS 5.00
67h DR-DOS 6.00
70h PalmDOS
71h DR-DOS 6.0 March 1993 "business update"
72h Novell DOS 7.0
--------O-214454-----------------------------
INT 21 U - DR-DOS 3.41+ - SET GLOBAL PASSWORD
AX = 4454h
DS:DX -> password string (blank-padded to 8 characters)
Desc: Specify the master password for accessing files.
SeeAlso: AX=4303h,AX=4414h
--------O-214456-----------------------------
INT 21 U - DR-DOS 5.0+ - HISTORY BUFFER CONTROL
AX = 4456h
DL = control flags (see #0869)
Return: AL = previous value of state flags (see #0870)
Note: DR-DOS 6.0 only checks bit 0 and ignores the rest of DL
SeeAlso: #0871

Bitfields for control flags:
Bit(s) Description (Table 0869)
0 whose buffer: 0=application, 1=COMMAND.COM
---Novell DOS 7---
1 toggle HISTORY usage
2 toggle INSERT state
Note: only one bit at a time may be used

Bitfields for state flags:
Bit(s) Description (Table 0870)
0 HISTORY buffer enabled
1 INSERT enabled
2-5 unused
7 whose buffer: 0=application, 1=COMMAND.COM
--------O-214457-----------------------------
INT 21 U - DR-DOS 5.0+ - SHARE/HILOAD CONTROL
AX = 4457h
DH = subfunction
00h enable/disable SHARE
DL = 00h disable
= 01h enable
else Return: AX = ???
01h get HILOAD status
Return: AX = status
0000h off
0001h on
02h set HILOAD status
DL = new state (00h off, 01h on)
Return: AX = ???
other
Return: AX = ???
Note: This was seen called by COMMAND.COM of DR-DOS 6.0; it does not seem
to be supported by Novell DOS 7
SeeAlso: AX=4457h/DX=FFFFh
--------O-214457DXFFFF-----------------------
INT 21 U - DR-DOS 6.0 - GET SHARE STATUS
AX = 4457h
DX = FFFFh
Return: AX = SHARE status
SeeAlso: INT 2F/AX=1000h
--------O-214458-----------------------------
INT 21 U - DR-DOS 5.0+ internal - GET POINTER TO INTERNAL VARIABLE TABLE
AX = 4458h
Return: ES:BX -> internal variable table (see #0871,#0872)
AX = ??? (0B50h for DR-DOS 5.0, 0A56h for DR-DOS 6.0, 0FE4h for
Novell DOS 7)
SeeAlso: AX=4452h

Format of DR-DOS 5.0-6.0 internal variable table:
Offset Size Description (Table 0871)
00h WORD ???
02h WORD segment of ???
04h WORD offset within DOS data segment of history control structure
for COMMAND.COM history buffer (see #0873)
06h WORD offset within DOS data segment of history control structure
for application history buffer (see #0873)
08h BYTE initial history state flags (see #0870)
09h 2 BYTEs ???
0Bh WORD KB of extended memory at startup
0Dh BYTE number of far jump entry points
0Eh WORD segment containing far jumps to DR-DOS entry points (see #0874)
10h WORD (only if kernel loaded in HMA) offset in HMA of first free HMA
memory block (see #0875) or 0000h if none; segment is FFFFh
12h WORD pointer to segment of environment variables set in CONFIG,
or 0000h if already used
---DR-DOS 6.0---
14h WORD (only if kernel loaded in HMA) offset in HMA of first used HMA
memory block (see #0875) or 0000h if none; segment is FFFFh
16h 8 BYTEs ???
1Eh WORD offset in DOS data segment of full COUNTRY.SYS filename
20h 8 BYTEs ???
28h WORD offset in DOS data segment of SHARE hook table
2Ah 2 BYTEs ???
2Ch WORD offset in DOS data segment of far pointer to INT 2F/AX=1000h
handler
Note: the segment used for the DR-DOS 6.0 CONFIG environment variables
(excluding COMSPEC, VER and OS) is only useful for programs/drivers
called from CONFIG.SYS. The word is set to zero later when the area
is copied to the COMMAND.COM environment space. This allows
CONFIG.SYS to pass information to AUTOEXEC.BAT.

Format of Novell DOS 7 internal variable table:
Offset Size Description (Table 0872)
00h ???
1Eh WORD offset of COUNTRY.SYS filename
42h 16 DWORDs pointers to ??? entry points
???

Format of history control structure:
Offset Size Description (Table 0873)
00h WORD segment of buffer
02h WORD size of buffer in bytes
04h WORD ???

Format of kernel entry jump table for DR-DOS 5.0-6.0:
Offset Size Description (Table 0874)
00h 5 BYTEs far jump to kernel entry point for CP/M CALL 5
05h 5 BYTEs far jump to kernel entry point for INT 20
0Ah 5 BYTEs far jump to kernel entry point for INT 21
0Fh 5 BYTEs far jump to kernel entry point for INT 22 (RETF)
14h 5 BYTEs far jump to kernel entry point for INT 23 (RETF)
19h 5 BYTEs far jump to kernel entry point for INT 24
1Eh 5 BYTEs far jump to kernel entry point for INT 25
23h 5 BYTEs far jump to kernel entry point for INT 26
28h 5 BYTEs far jump to kernel entry point for INT 27
2Dh 5 BYTEs far jump to kernel entry point for INT 28
32h 5 BYTEs far jump to kernel entry point for INT 2A (IRET)
37h 5 BYTEs far jump to kernel entry point for INT 2B (IRET)
3Ch 5 BYTEs far jump to kernel entry point for INT 2C (IRET)
41h 5 BYTEs far jump to kernel entry point for INT 2D (IRET)
46h 5 BYTEs far jump to kernel entry point for INT 2E (IRET)
4Bh 5 BYTEs far jump to kernel entry point for INT 2F
Notes: all of these entry points are indirected through this jump table
to allow the kernel to be relocated into high memory while leaving
the actual entry addresses in low memory for maximum compatibility
some of these entry points (22h,23h,24h,2Eh,2Fh) are replaced as soon
as COMMAND.COM is loaded, and return immediately to the caller, some
returning an error code (the original handler for INT 2F returns
AL=03h [fail]).

Format of HMA Memory Block (DR-DOS 6.0 kernel loaded in HMA):
Offset Size Description (Table 0875)
00h WORD offset of next HMA Memory Block (0000h if last block)
02h WORD size of this block in bytes (at least 10h)
04h BYTE type of HMA Memory Block (interpreted by MEM)
00h system
01h KEYB
02h NLSFUNC
03h SHARE
04h TaskMAX
05h COMMAND
05h var TSR (or system) code and data. DR-DOS TSR's, such as KEYB,
hooks interrupts using segment FFFEh instead FFFFh.
--------O-214459-----------------------------
INT 21 - DR MultiUser DOS 5.0 - API
AX = 4459h
CL = function (see #3145 at INT E0"CP/M")
DS,DX = parameters
Notes: DR-DOS 5.0 and Novell DOS 7 return CF set and AX=0001h
this API is also available on INT E0
SeeAlso: AX=4452h,INT E0"CP/M"
--------N-2144E0-----------------------------
INT 21 U - Sun PC-NFS - API???
AX = 44E0h
DS:DX -> ???
SS:BP -> stack frame (see #0876)
Return: ???
Note: this function is also supported by Beame&Whiteside's BWPCNFS shim; the
description presented here was derived from that shim

Format of PC-NFS stack frame:
Offset Size Description (Table 0876)
00h WORD -> previous stack frame
02h DWORD return address
--------d-2144FFBXFFFF-----------------------
INT 21 U - NewSpace - ???
AX = 44FFh
BX = FFFFh
DX = ???
Program: NewSpace is a TSR by Isogon Corporation which automatically compresses
all files as they are written and decompresses them as they are read
SeeAlso: AX=4414h/BX=FFFFh
--------D-2145-------------------------------
INT 21 - DOS 2+ - "DUP" - DUPLICATE FILE HANDLE
AH = 45h
BX = file handle
Return: CF clear if successful
AX = new handle
CF set on error
AX = error code (04h,06h) (see #0960 at AH=59h)
Notes: moving file pointer for either handle will also move it for the other,
because both will refer to the same system file table
for DOS versions prior to 3.3, file writes may be forced to disk by
duplicating the file handle and closing the duplicate
SeeAlso: AH=3Dh,AH=46h
--------D-2146-------------------------------
INT 21 - DOS 2+ - "DUP2", "FORCEDUP" - FORCE DUPLICATE FILE HANDLE
AH = 46h
BX = file handle
CX = file handle to become duplicate of first handle
Return: CF clear if successful
CF set on error
AX = error code (04h,06h) (see #0960 at AH=59h)
Notes: closes file with handle CX if it is still open
DOS 3.30 hangs if BX=CX on entry
moving file pointer for either handle will also move it for the other,
because both will refer to the same system file table
SeeAlso: AH=3Dh,AH=45h
--------D-2147-------------------------------
INT 21 - DOS 2+ - "CWD" - GET CURRENT DIRECTORY
AH = 47h
DL = drive number (00h = default, 01h = A:, etc)
DS:SI -> 64-byte buffer for ASCIZ pathname
Return: CF clear if successful
AX = 0100h (undocumented)
CF set on error
AX = error code (0Fh) (see #0960 at AH=59h)
Notes: the returned path does not include a drive or the initial backslash
many Microsoft products for Windows rely on AX being 0100h on success
under the FlashTek X-32 DOS extender, the buffer pointer is in DS:ESI
SeeAlso: AH=19h,AH=3Bh,AH=71h,INT 15/AX=DE25h
--------D-2148-------------------------------
INT 21 - DOS 2+ - ALLOCATE MEMORY
AH = 48h
BX = number of paragraphs to allocate
Return: CF clear if successful
AX = segment of allocated block
CF set on error
AX = error code (07h,08h) (see #0960 at AH=59h)
BX = size of largest available block
Notes: DOS 2.1-6.0 coalesces free blocks while scanning for a block to
allocate
.COM programs are initially allocated the largest available memory
block, and should free some memory with AH=49h before attempting any
allocations
under the FlashTek X-32 DOS extender, EBX contains a protected-mode
near pointer to the allocated block on a successful return
SeeAlso: AH=49h,AH=4Ah,AH=58h,AH=83h
--------D-2149-------------------------------
INT 21 - DOS 2+ - FREE MEMORY
AH = 49h
ES = segment of block to free
Return: CF clear if successful
CF set on error
AX = error code (07h,09h) (see #0960 at AH=59h)
Notes: apparently never returns an error 07h, despite official docs; DOS 2.1+
code contains only an error 09h exit
DOS 2.1-6.0 does not coalesce adjacent free blocks when a block is
freed, only when a block is allocated or resized
the code for this function is identical in DOS 2.1-6.0 except for
calls to start/end a critical section in DOS 3.0+
SeeAlso: AH=48h,AH=4Ah
--------D-214A-------------------------------
INT 21 - DOS 2+ - RESIZE MEMORY BLOCK
AH = 4Ah
BX = new size in paragraphs
ES = segment of block to resize
Return: CF clear if successful
CF set on error
AX = error code (07h,08h,09h) (see #0960 at AH=59h)
BX = maximum paragraphs available for specified memory block
Notes: under DOS 2.1-6.0, if there is insufficient memory to expand the block
as much as requested, the block will be made as large as possible
DOS 2.1-6.0 coalesces any free blocks immediately following the block
to be resized
SeeAlso: AH=48h,AH=49h,AH=83h
--------v-214A--BX00B6-----------------------
INT 21 - VIRUS???
AH = 4Ah
BX = 00B6h
ES = CX
Return: ???
Note: this call is intercepted by the Search&Destroy SDRes v27.03 bundled
with Novell DOS 7, and is presumably some virus's installation check
SeeAlso: AH=0Eh/DL=ADh,AH=4Ah/BX=FFFFh,AH=D2h"VIRUS"
--------v-214A--BXFFFF-----------------------
INT 21 - VIRUS???
AH = 4Ah
BX = FFFFh
CX = 0568h
SI = 0129h
DI = 0000h
ES = BP
Return: ???
Note: this call is intercepted by the Search&Destroy SDRes v27.03 bundled
with Novell DOS 7, and is presumably some virus's installation check
SeeAlso: AH=0Eh/DL=ADh,AH=4Ah/BX=00B6h
--------D-214B-------------------------------
INT 21 - DOS 2+ - "EXEC" - LOAD AND/OR EXECUTE PROGRAM
AH = 4Bh
AL = type of load
00h load and execute
01h load but do not execute
03h load overlay (see #0878)
04h load and execute in background (European MS-DOS 4.0 only)
"Exec & Go" (see also AH=80h)
DS:DX -> ASCIZ program name (must include extension)
ES:BX -> parameter block (see #0877,#0878,#0879)
CX = mode (subfunction 04h only)
0000h child placed in zombie mode after termination
0001h child's return code discarded on termination
Return: CF clear if successful
BX,DX destroyed
if subfunction 01h, process ID set to new program's PSP; get with
INT 21/AH=62h
CF set on error
AX = error code (01h,02h,05h,08h,0Ah,0Bh) (see #0960 at AH=59h)
Notes: DOS 2.x destroys all registers, including SS:SP
under ROM-based DOS, if no disk path characters (colons or slashes)
are included in the program name, the name is searched for in the
ROM module headers (see #0882) before searching on disk
for functions 00h and 01h, the calling process must ensure that there
is enough unallocated memory available; if necessary, by releasing
memory with AH=49h or AH=4Ah
for function 01h, the AX value to be passed to the child program is put
on top of the child's stack
for function 03h, DOS assumes that the overlay is being loaded into
memory allocated by the caller
function 01h was undocumented prior to the release of DOS 5.0
some versions (such as DR-DOS 6.0) check the parameters and parameter
block and return an error if an invalid value (such as an offset of
FFFFh) is found
background programs under European MS-DOS 4.0 must use the new
executable format
this function ignores the filename extension, instead checking the
first two bytes of the file to determine whether there is a valid
.EXE header (see #0881); if not, the file is assumed to be in .COM
format. If present, the file may be in any of several formats which
are extensions of the original .EXE format (see #0880)
.COM-format executables begin running with the following register
values:
AL = 00h if first FCB has valid drive letter, FFh if not
AH = 00h if second FCB has valid drive letter, FFh if not
CS,DS,ES,SS = PSP segment
SP = offset of last word available in first 64K segment
(note: AX is always 0000h under DESQview)
old-format executables begin running with the following register
values:
AL = 00h if first FCB has valid drive letter, FFh if not
AH = 00h if second FCB has valid drive letter, FFh if not
DS,ES = PSP segment
SS:SP as defined in .EXE header
(note: AX is always 0000h under DESQview)
new executables begin running with the following register values
AX = environment segment
BX = offset of command tail in environment segment
CX = size of automatic data segment (0000h = 64K)
ES,BP = 0000h
DS = automatic data segment
SS:SP = initial stack
the command tail corresponds to an old executable's PSP:0081h and
following, except that the 0Dh is turned into a NUL (00h); new
format executables have no PSP
under the FlashTek X-32 DOS extender, only function 00h is supported
and the pointers are passed in DS:EDX and ES:EBX
DR-DOS 6 always loads .EXE-format programs with no fixups and
.COM-format programs starting with 9Ch 55h (PUSHF/PUSH BP) above the
64K mark to avoid the EXEPACK bug, by extending the memory block
containing the program's environment; this code is disabled if the
name of the parent program as stored in the MCB is 'WIN'.
BUGS: DOS 2.00 assumes that DS points at the current program's PSP
Load Overlay (subfunction 03h) loads up to 512 bytes too many if the
file contains additional data after the actual overlay
SeeAlso: AX=4B05h,AH=4Ch,AH=4Dh,AH=64h"OS/2",AH=8Ah,INT 2E,INT 60/DI=0604h

Format of EXEC parameter block for AL=00h,01h,04h:
Offset Size Description (Table 0877)
00h WORD segment of environment to copy for child process (copy caller's
environment if 0000h)
02h DWORD pointer to command tail to be copied into child's PSP
06h DWORD pointer to first FCB to be copied into child's PSP
0Ah DWORD pointer to second FCB to be copied into child's PSP
0Eh DWORD (AL=01h) will hold subprogram's initial SS:SP on return
12h DWORD (AL=01h) will hold entry point (CS:IP) on return
SeeAlso: #0878,#0879

Format of EXEC parameter block for AL=03h:
Offset Size Description (Table 0878)
00h WORD segment at which to load overlay
02h WORD relocation factor to apply to overlay if in .EXE format
SeeAlso: #0877,#0879

Format of EXEC parameter block for FlashTek X-32:
Offset Size Description (Table 0879)
00h PWORD 48-bit far pointer to environment string
06h PWORD 48-bit far pointer to command tail string
SeeAlso: #0877,#0878

(Table 0880)
Values for the executable types understood by various environments:
MZ old-style DOS executable (see #0881)
NE Windows or OS/2 1.x segmented ("new") executable (see #0883)
LE Windows virtual device driver (VxD) linear executable (see #0896)
LX variant of LE used in OS/2 2.x (see #0896)
W3 Windows WIN386.EXE file; a collection of LE files
PE Win32 (Windows NT and Win32s) portable executable based on Unix COFF
DL HP 100LX/200LX system manager compliant executable (.EXM)
MP old PharLap .EXP (see #0906)
P2 PharLap 286 .EXP (see #0907)
P3 PharLap 386 .EXP (see #0907)

Format of .EXE file header:
Offset Size Description (Table 0881)
00h 2 BYTEs .EXE signature, either "MZ" or "ZM" (5A4Dh or 4D5Ah)
(see also #0880)
02h WORD number of bytes in last 512-byte page of executable
04h WORD total number of 512-byte pages in executable (includes any
partial last page)
06h WORD number of relocation entries
08h WORD header size in paragraphs
0Ah WORD minimum paragraphs of memory to allocation in addition to
executable's size
0Ch WORD maximum paragraphs to allocate in addition to executable's size
0Eh WORD initial SS relative to start of executable
10h WORD initial SP

12h WORD checksum (one's complement of sum of all words in executable)
14h DWORD initial CS:IP relative to start of executable
18h WORD offset within header of relocation table
40h or greater for new-format (NE,LE,LX,W3,PE,etc.) executable
1Ah WORD overlay number (normally 0000h = main program)
---new executable---
1Ch 4 BYTEs ???
20h WORD behavior bits
22h 26 BYTEs reserved for additional behavior info
3Ch DWORD offset of new executable (NE,LE,etc) header within disk file,
or 00000000h if plain MZ executable
---Borland TLINK---
1Ch 2 BYTEs ??? (apparently always 01h 00h)
1Eh BYTE signature FBh
1Fh BYTE TLINK version (major in high nybble, minor in low nybble)
20h 2 BYTEs ??? (v2.0 apparently always 72h 6Ah, v3.0+ seems always 6Ah 72h)
---ARJ self-extracting archive---
1Ch 4 BYTEs signature "RJSX" (older versions, new signature is "aRJsfX" in
the first 1000 bytes of the file)
---LZEXE 0.90 compressed executable---
1Ch 4 BYTEs signature "LZ09"
---LZEXE 0.91 compressed executable---
1Ch 4 BYTEs signature "LZ91"
---PKLITE compressed executable---
1Ch BYTE minor version number
1Dh BYTE bits 0-3: major version
bit 4: extra compression
bit 5: huge (multi-segment) file
1Eh 6 BYTEs signature "PKLITE" (followed by copyright message)
---LHarc 1.x self-extracting archive---
1Ch 4 BYTEs unused???
20h 3 BYTEs jump to start of extraction code
23h 2 BYTEs ???
25h 12 BYTEs signature "LHarc's SFX "
---LHA 2.x self-extracting archive---
1Ch 8 BYTEs ???
24h 10 BYTEs signature "LHa's SFX " (v2.10) or "LHA's SFX " (v2.13)
---TopSpeed C 3.0 CRUNCH compressed file---
1Ch DWORD 018A0001h
20h WORD 1565h
---PKARCK 3.5 self-extracting archive---
1Ch DWORD 00020001h
20h WORD 0700h
---BSA (Soviet archiver) self-extracting archive---
1Ch WORD 000Fh
1Eh BYTE A7h
---LARC self-extracting archive---
1Ch 4 BYTEs ???
20h 11 BYTEs "SFX by LARC "
---LH self-extracting archive---
1Ch 8 BYTEs ???
24h 8 BYTEs "LH's SFX "
---other linkers---
1Ch var optional information
---
N N DWORDs relocation items
Notes: if word at offset 02h is 4, it should be treated as 00h, since pre-1.10
versions of the MS linker set it that way
if both minimum and maximum allocation (offset 0Ah/0Ch) are zero, the
program is loaded as high in memory as possible (DOS only checks
the maximum allocation, however)
the maximum allocation is set to FFFFh by default
additional data may be contained in the file beyond the end of the
load image described by the .EXE header; this data may be overlays,
the actual executable for newer-format executables, or debugging
information (see #0887,#0911)

Format of ROM Module Header:
Offset Size Description (Table 0882)
00h 2 BYTEs ROM signature 55h, AAh
02h BYTE size of ROM in 512-byte blocks
03h 3 BYTEs POST initialization entry point (near JMP instruction)
06h ROM Program Name List [array]
Offset Size Description
00h BYTE length of ROM program's name (00h if end of name list)
01h N BYTEs program name
N+1 3 BYTEs program entry point (near JMP instruction)

Format of new executable header:
Offset Size Description (Table 0883)
00h 2 BYTEs "NE" (4Eh 45h) signature
02h 2 BYTEs linker version (major, then minor)
04h WORD offset from start of this header to entry table (see #0890)
06h WORD length of entry table in bytes
08h DWORD file load CRC (0 in Borland's TPW)
0Ch BYTE program flags (see #0884)
0Dh BYTE application flags (see #0885)
0Eh WORD auto data segment index
10h WORD initial local heap size
12h WORD initial stack size (added to data seg, 0000h if SS <> DS)
14h DWORD program entry point (CS:IP), "CS" is index into segment table
18h DWORD initial stack pointer (SS:SP), "SS" is segment index
if SS=automatic data segment and SP=0000h, the stack pointer is
set to the top of the automatic data segment, just below the
local heap
1Ch WORD segment count
1Eh WORD module reference count
20h WORD length of nonresident names table in bytes
22h WORD offset from start of this header to segment table (see #0888)
24h WORD offset from start of this header to resource table
26h WORD offset from start of this header to resident names table
28h WORD offset from start of this header to module reference table
2Ah WORD offset from start of this header to imported names table
(array of counted strings, terminated with a string of length
00h)
2Ch DWORD offset from start of file to nonresident names table
30h WORD count of moveable entry point listed in entry table
32h WORD file alignment size shift count
0 is equivalent to 9 (default 512-byte pages)
34h WORD number of resource table entries
36h BYTE target operating system
00h unknown
01h OS/2
02h Windows
03h European MS-DOS 4.x
04h Windows 386
05h BOSS (Borland Operating System Services)
81h PharLap 286|DOS-Extender, OS/2
82h PharLap 286|DOS-Extender, Windows
37h BYTE other EXE flags (see #0886)
38h WORD offset to return thunks or start of gangload area
3Ah WORD offset to segment reference thunks or length of gangload area
3Ch WORD minimum code swap area size
3Eh 2 BYTEs expected Windows version (minor version first)
Note: this header is documented in detail in the Windows 3.1 SDK Programmer's
Reference, Vol 4.

Bitfields for new executable program flags:
Bit(s) Description (Table 0884)
0-1 DGROUP type
0 = none
1 = single shared
2 = multiple (unshared)
3 = (null)
2 global initialization
3 protected mode only
4 8086 instructions
5 80286 instructions
6 80386 instructions
7 80x87 instructions

Bitfields for new executable application flags:
Bit(s) Description (Table 0885)
0-2 application type
001 full screen (not aware of Windows/P.M. API)
010 compatible with Windows/P.M. API
011 uses Windows/P.M. API
3 is a Family Application (OS/2)
5 0=executable, 1=errors in image
6 non-conforming program (valid stack is not maintained)
7 DLL or driver rather than application
(SS:SP info invalid, CS:IP points at FAR init routine called with
AX=module handle which returns AX=0000h on failure, AX nonzero on
successful initialization)

Bitfields for other new .EXE flags:
Bit(s) Description (Table 0886)
0 supports long filenames
1 2.X protected mode
2 2.X proportional font
3 gangload area

Format of Codeview trailer (at end of executable):
Offset Size Description (Table 0887)
00h WORD signature 4E42h ('NB')
02h WORD Microsoft debug info version number
04h DWORD Codeview header offset
SeeAlso: #0911

Format of new executable segment table record:
Offset Size Description (Table 0888)
00h WORD offset in file (shift left by alignment shift to get byte offs)
02h WORD length of image in file (0000h = 64K)
04h WORD segment attributes (see #0889)
06h WORD number of bytes to allocate for segment (0000h = 64K)
Note: the first segment table entry is entry number 1
SeeAlso: #0891

Bitfields for segment attributes:
Bit(s) Description (Table 0889)
0 data segment rather than code segment
1 unused???
2 real mode
3 iterated
4 movable
5 sharable
6 preloaded rather than demand-loaded
7 execute-only (code) or read-only (data)
8 relocations (directly following code for this segment)
9 debug info present
10,11 80286 DPL bits
12 discardable
13-15 discard priority

Format of new executable entry table item (list):
Offset Size Description (Table 0890)
00h BYTE number of entry points (00h if end of entry table list)
01h BYTE segment number (00h if end of entry table list)
02h 3N BYTEs entry records
Offset Size Description
00h BYTE flags
bit 0: exported
bit 1: single data
bits 2-7: unused???
01h WORD offset within segment

Format of new executable relocation data (immediately follows segment image):
Offset Size Description (Table 0891)
00h WORD number of relocation items
02h 8N BYTEs relocation items
Offset Size Description
00h BYTE relocation type
00h LOBYTE
02h BASE
03h PTR
05h OFFS
0Bh PTR48
0Dh OFFS32
01h BYTE flags
bit 2: additive
02h WORD offset within segment
04h WORD target address segment
06h WORD target address offset
SeeAlso: #0888,#0892

Format of new executable resource data:
Offset Size Description (Table 0892)
00h WORD alignment shift count for resource data
02h N RECORDs resources
Format of resource record:
Offset Size Description
00h WORD type ID
0000h if end of resource records
>= 8000h if integer type
else offset from start of resource table to type string
02h WORD number of resources of this type
04h DWORD reserved for runtime use
08h N Resources (see #0893)
Note: resource type and name strings are stored immediately following the
resource table, and are not null-terminated
SeeAlso: #0893

Format of new executable resource entry:
Offset Size Description (Table 0893)
00h WORD offset in alignment units from start of file to contents of
the resource data
02h WORD length of resource image in bytes
04h WORD flags
bit 4: moveable
bit 5: shareable
bit 6: preloaded
06h WORD resource ID
>= 8000h if integer resource
else offset from start of resource table to resource string
08h DWORD reserved for runtime use
Notes: resource type and name strings are stored immediately following the
resource table, and are not null-terminated
strings are counted strings, with a string of length 0 indicating the
end of the resource table
SeeAlso: #0892,#0894

Format of new executable module reference table [one bundle of entries]:
Offset Size Description (Table 0894)
00h BYTE number of records in this bundle (00h if end of table)
01h BYTE segment indicator
00h unused
FFh movable segment, segment number is in entry
else segment number of fixed segment
02h N RECORDs
Format of segment record
Offset Size Description
00h BYTE flags
bit 0: entry is exported
bit 1: entry uses global (shared) data
bits 7-3: number of parameter words
---fixed segment---
01h WORD offset
---moveable segment---
01h 2 BYTEs INT 3F instruction (CDh 3Fh)
03h BYTE segment number
05h WORD offset
Note: table entries are numbered starting from 1
SeeAlso: #0895

Format of new executable resident/nonresident name table entry:
Offset Size Description (Table 0895)
00h BYTE length of string (00h if end of table)
01h N BYTEs ASCII text of string
N+1 WORD ordinal number (index into entry table)
Notes: the first string in the resident name table is the module name; the
first entry in the nonresident name table is the module description
the strings are case-sensitive; if the executable was linked with
/IGNORECASE, all strings are in uppercase
SeeAlso: #0894

Format of Linear Executable (enhanced mode executable) header:
Offset Size Description (Table 0896)
00h 2 BYTEs "LE" (4Ch 45h) signature (Windows)
"LX" (4Ch 58h) signature (OS/2)
02h BYTE byte order (00h = little-endian, nonzero = big-endian)
03h BYTE word order (00h = little-endian, nonzero = big-endian)
04h DWORD executable format level
08h WORD CPU type (see also INT 15/AH=C9h)
01h Intel 80286 or upwardly compatible
02h Intel 80386 or upwardly compatible
03h Intel 80486 or upwardly compatible
04h Intel Pentium (80586) or upwardly compatible
20h Intel i860 (N10) or compatible
21h Intel "N11" or compatible
40h MIPS Mark I (R2000, R3000) or compatible
41h MIPS Mark II (R6000) or compatible
42h MIPS Mark III (R4000) or compatible
0Ah WORD target operating system
01h OS/2
02h Windows
03h European DOS 4.0
04h Windows 386
0Ch DWORD module version
10h DWORD module type (see #0897)
14h DWORD number of memory pages
18h Initial CS:EIP
DWORD object number
DWORD offset
20h Initial SS:ESP
DWORD object number
DWORD offset
28h DWORD memory page size
2Ch DWORD (Windows LE) bytes on last page
(OS/2 LX) page offset shift count
30h DWORD fixup section size
34h DWORD fixup section checksum
38h DWORD loader section size
3Ch DWORD loader section checksum
40h DWORD offset of object table (see #0898)
44h DWORD object table entries
48h DWORD object page map table offset (see #0900)
4Ch DWORD object iterate data map offset
50h DWORD resource table offset
54h DWORD resource table entries
58h DWORD resident names table offset (see #0901)
5Ch DWORD entry table offset (see #0902,#0903)
60h DWORD module directives table offset
64h DWORD Module Directives entries
68h DWORD Fixup page table offset
6Ch DWORD Fixup record table offset (see #0905)
70h DWORD imported modules name table offset
74h DWORD imported modules count
78h DWORD imported procedures name table offset
7Ch DWORD per-page checksum table offset
80h DWORD data pages offset
84h DWORD preload page count
88h DWORD non-resident names table offset
8Ch DWORD non-resident names table length
90h DWORD non-resident names checksum
94h DWORD automatic data object
98h DWORD debug information offset
9Ch DWORD debug information length
A0h DWORD preload instance pages number
A4h DWORD demand instance pages number
A8h DWORD extra heap allocation
ACh 12 BYTEs reserved
B8h DWORD offset of VERSIONINFO resource (MS-Windows VxD only)
BCh DWORD pointer to ??? (dynamically-loadable VxDs only???)
C0h WORD device ID (MS-Windows VxD only)
C2h WORD DDK version (MS-Windows VxD only)
Note: used by EMM386.EXE, QEMM, and Windows 3.0 Enhanced Mode drivers

Bitfields for Linear Executable module type:
Bit(s) Description (Table 0897)
2 initialization (only for DLLs) 0 = global, 1 = per-process
4 no internal fixups in executable image
5 no external fixups in executable image
8-10 API compatibility
0 = unknown
1 = incompatible with PM windowing \
2 = compatible with PM windowing > (only for
3 = uses PM windowing API / programs)
13 module not loadable (only for programs)
15-17 module type
000 program
001 library (DLL)
011 protected memory library module
100 physical device driver
110 virtual device driver
30 per-process library termination
(requires valid CS:EIP, can't be set for .EXE)

Format of object table entry:
Offset Size Description (Table 0898)
00h DWORD virtual size in bytes
04h DWORD relocation base address
08h DWORD object flags (see #0899)
0Ch DWORD page map index
10h DWORD page map entries (see #0900)
14h 4 BYTEs reserved??? (apparently always zeros)

Bitfields for object flags:
Bit(s) Description (Table 0899)
0 readable
1 writable
2 executable
3 resource
4 discardable
5 shared
6 preloaded
7 invalid
8-9 type
00 normal
01 zero-filled
10 resident
11 resident and contiguous
10 resident and long-lockable
11 reserved
12 16:16 alias required
13 "BIG" (Huge: 32-bit)
14 conforming
15 "OBJECT_I/O_PRIVILEGE_LEVEL"
16-31 reserved

Format of object page map table entry:
Offset Size Description (Table 0900)
00h BYTE ??? (usually 00h)
01h WORD (big-endian) index to fixup table
0000h if no relocation info
03h BYTE type (00h hard copy in file, 03h some relocation needed)

Format of resident names table entry:
Offset Size Description (Table 0901)
00h BYTE length of name
01h N BYTEs name
N+1 3 BYTEs ???

Format of LE linear executable entry table:
Offset Size Description (Table 0902)
00h BYTE number of entries in table
01h 10 BYTEs per entry
Offset Size Description
00h BYTE bit flags
bit 0: non-empty bundle
bit 1: 32-bit entry
01h WORD object number
03h BYTE entry type flags
bit 0: exported
bit 1: uses single data rather than instance
bit 2: reserved
bits 3-7: number of stack parameters
04h DWORD offset of entry point
08h 2 BYTEs ???
Note: empty bundles (bit flags at 00h = 00h) are used to skip unused indices,
and do not contain the remaining nine bytes

Format of LX linear executable entry table [array]:
Offset Size Description (Table 0903)
00h BYTE number of bundles following (00h = end of entry table)
01h BYTE bundle type
00h empty
01h 16-bit entry
02h 286 callgate entry
03h 32-bit entry
04h forwarder entry
bit 7 set if additional parameter typing information is present
---bundle type 00h---
no additional fields
---bundle type 01h---
02h WORD object number
04h BYTE entry flags
bit 0: exported
bits 7-3: number of stack parameters
05h WORD offset of entry point in object (shifted by page size shift)
---bundle type 02h---
02h WORD object number
04h BYTE entry flags
bit 0: exported
bits 7-3: number of stack parameters
05h WORD offset of entry point in object
07h WORD reserved for callgate selector (used by loader)
---bundle type 03h---
02h WORD object number
04h BYTE entry flags
bit 0: exported
bits 7-3: number of stack parameters
05h DWORD offset of entry point in object
---bundle type 04h---
02h WORD reserved
04h BYTE forwarder flags
bit 0: import by ordinal
bits 7-1 reserved
05h WORD module ordinal
(forwarder's index into Import Module Name table)
07h DWORD procedure name offset or import ordinal number
Note: all fields after the first two bytes are repeated N times

Bitfields for linear executable fixup type:
Bit(s) Description (Table 0904)
7 ordinal is BYTE rather than WORD
6 16-rather than 8-object number/module ordinal
5 addition with DWORD rather than WORD
4 relocation info has size with new two bytes at end
3 reserved (0)
2 set if add to destination, clear to replace destination
1-0 type
00 internal fixup
01 external fixup, imported by ordinal
10 external fixup, imported by name
11 internal fixup via entry table

Format of linear executable fixup record:
Offset Size Description (Table 0905)
00h BYTE type
bits 7-4: modifier (0001 single, 0011 multiple)
bits 3-0: type
0000 byte offset
0010 word segment
0011 16-bit far pointer (DWORD)
0101 16-bit offset
0110 32-bit far pointer (PWORD)
0111 32-bit offset
1000 near call or jump, WORD/DWORD based on seg attrib
01h BYTE linear executable fixup type (see #0904)
---if single type---
02h WORD offset within page
04h relocation information
---internal fixup---
BYTE object number
---external,ordinal---
BYTE one-based module number in Import Module table
BYTE/WORD ordinal number
WORD/DWORD value to add (only present if modifier bit 4 set)
---external,name---
BYTE one-based module number in Import Module table
WORD offset in Import Procedure names
WORD/DWORD value to add (only present if modifier bit 4 set)
---if multiple type---
02h BYTE number of items
03h var relocation info as for "single" type (see above)
N WORDs offsets of items to relocate

Format of old Phar Lap .EXP file header:
Offset Size Description (Table 0906)
00h 2 BYTEs "MP" (4Dh 50h) signature
02h WORD remainder of image size / page size (page size = 512h)
04h WORD size of image in pages
06h WORD number of relocation items
08h WORD header size in paragraphs
0Ah WORD minimum number of extra 4K pages to be allocated at the end
of program, when it is loaded
0Ch WORD maximum number of extra 4K pages to be allocated at the end
of program, when it is loaded
0Eh DWORD initial ESP
12h WORD word checksum of file
14h DWORD initial EIP
18h WORD offset of first relocation item
1Ah WORD overlay number
1Ch WORD ??? (wants to be 1)
SeeAlso: #0907

Format of new Phar Lap .EXP file header:
Offset Size Description (Table 0907)
00h 2 BYTEs signature ("P2" for 286 .EXP executable, "P3" for 386 .EXP)
02h WORD level (01h flat-model file, 02h multisegmented file)
04h WORD header size
06h DWORD file size in bytes
0Ah WORD checksum
0Ch DWORD offset of run-time parameters within file (see #0909)
10h DWORD size of run-time parameters in bytes
14h DWORD offset of relocation table within file
18h DWORD size of relocation table in bytes
1Ch DWORD offset of segment information table within file (see #0908)
20h DWORD size of segment information table in bytes
24h WORD size of segment information table entry in bytes
26h DWORD offset of load image within file
2Ah DWORD size of load image on disk
2Eh DWORD offset of symbol table within file or 00000000h
32h DWORD size of symbol table in bytes
36h DWORD offset of GDT within load image
3Ah DWORD size of GDT in bytes
3Eh DWORD offset of LDT within load image
42h DWORD size of LDT in bytes
46h DWORD offset of IDT within load image
4Ah DWORD size of IDT in bytes
4Eh DWORD offset of TSS within load image
52h DWORD size of TSS in bytes
56h DWORD minimum number of extra bytes to be allocated at end of program
(level 1 executables only)
5Ah DWORD maximum number of extra bytes to be allocated at end of program
(level 1 executables only)
5Eh DWORD base load offset (level 1 executables only)
62h DWORD initial ESP
66h WORD initial SS
68h DWORD initial EIP
6Ch WORD initial CS
6Eh WORD initial LDT
70h WORD initial TSS
72h WORD flags
bit 0: load image is packed
bit 1: 32-bit checksum is present
bits 4-2: type of relocation table
74h DWORD memory requirements for load image
78h DWORD 32-bit checksum (optional)
7Ch DWORD size of stack segment in bytes
80h 256 BYTEs reserved (0)
SeeAlso: #0906,#0910

Format of Phar Lap segment information table entry:
Offset Size Description (Table 0908)
00h WORD selector number
02h WORD flags
04h DWORD base offset of selector
08h DWORD minimum number of extra bytes to be allocated to the segment

Format of 386|DOS-Extender run-time parameters:
Offset Size Description (Table 0909)
00h 2 BYTEs signature "DX" (44h 58h)
02h WORD minimum number of real-mode params to leave free at run time
04h WORD maximum number of real-mode params to leave free at run time
06h WORD minimum interrupt buffer size in KB
08h WORD maximum interrupt buffer size in KB
0Ah WORD number of interrupt stacks
0Ch WORD size in KB of each interrupt stack
0Eh DWORD offset of byte past end of real-mode code and data
12h WORD size in KB of call buffers
14h WORD flags
bit 0: file is virtual memory manager
bit 1: file is a debugger
16h WORD unprivileged flag (if nonzero, executes at ring 1, 2, or 3)
18h 104 BYTEs reserved (0)

Format of Phar Lap repeat block header:
Offset Size Description (Table 0910)
00h WORD byte count
02h BYTE repeat string length

Format of Borland debugging information header (following load image):
Offset Size Description (Table 0911)
00h WORD signature 52FBh
02h WORD version ID
04h DWORD size of name pool in bytes
08h WORD number of names in name pool
0Ah WORD number of type entries
0Ch WORD number of structure members
0Eh WORD number of symbols
10h WORD number of global symbols
12h WORD number of modules
14h WORD number of locals (optional)
16h WORD number of scopes in table
18h WORD number of line-number entries
1Ah WORD number of include files
1Ch WORD number of segment records
1Eh WORD number of segment/file correlations
20h DWORD size of load image after removing uninitialized data and debug
information
24h DWORD debugger hook; pointer into debugged program whose meaning
depends on program flags
28h BYTE program flags
bit 0: case-sensitive link
bit 1: pascal overlay program
29h WORD no longer used
2Bh WORD size of data pool in bytes
2Dh BYTE padding
2Eh WORD size of following header extension (currently 00h, 10h, or 20h)
30h WORD number of classes
32h WORD number of parents
34h WORD number of global classes (currently unused)
36h WORD number of overloads (currently unused)
38h WORD number of scope classes
3Ah WORD number of module classes
3Ch WORD number of coverage offsets
3Eh DWORD offset relative to symbol base of name pool
42h WORD number of browser information records
44h WORD number of optimized symbol records
46h WORD debugging flags
48h 8 BYTEs padding
Note: additional information on the Borland debugging info may be found in
Borland's Open Architecture Handbook
SeeAlso: #0887
--------U-214B-------------------------------
INT 21 - ELRES v1.0 only - INSTALLATION CHECK
AH = 4Bh
DS:DX = 0000h:0000h
Return: ES:BX -> ELRES history structure (see #0680 at AH=2Bh/CX=454Ch)
DX = DABEh (signature, DAve BEnnett)
Program: ELRES is an MS-DOS return code (errorlevel) recorder by David H.
Bennett
SeeAlso: AH=2Bh/CX=454Ch
--------v-214B04-----------------------------
INT 21 - VIRUS - "MG", "699"/"Thirteen Minutes" - INSTALLATION CHECK
AX = 4B04h
Return: CF clear if "MG" resident
AX = 044Bh if "699"/"Thirteen Minutes" resident
SeeAlso: AX=4243h,AH=4Ah/BX=FFFFh,AX=4B21h
--------D-214B05-----------------------------
INT 21 - DOS 5+ - SET EXECUTION STATE
AX = 4B05h
DS:DX -> execution state structure (see #0912)
Return: CF clear if successful
AX = 0000h
CF set on error
AX = error code (see #0960 at AH=59h)
Note: used by programs which intercept AX=4B00h to prepare new programs for
execution (including setting the DOS version number). No DOS, BIOS
or other software interrupt may be called after return from this call
before commencement of the child process. If DOS is running in the
HMA, A20 is turned off on return from this call.
SeeAlso: AH=4Bh

Format of execution state structure:
Offset Size Description (Table 0912)
00h WORD reserved (00h)
02h WORD type flags
bit 0: program is an .EXE
bit 1: program is an overlay
04h DWORD pointer to ASCIZ name of program file
08h WORD PSP segment of new program
0Ah DWORD starting CS:IP of new program
0Eh DWORD program size including PSP
--------v-214B20-----------------------------
INT 21 - VIRUS - "Holocaust"/"Telefonica" - ???
AX = 4B20h
SeeAlso: AX=4B04h,AX=4B21h
--------v-214B21-----------------------------
INT 21 C - VIRUS - "Holocaust"/"Telefonica" - ???
AX = 4B21h
Note: called at completion of virus installation
SeeAlso: AX=4B04h,AX=4B20h,AX=4B25h
--------v-214B25-----------------------------
INT 21 - VIRUS - "1063"/"Mono" - INSTALLATION CHECK
AX = 4B25h
Return: DI = 1234h if resident
SeeAlso: AX=4B21h,AX=4B40h
--------v-214B40-----------------------------
INT 21 - VIRUS - "Plastique"/"AntiCad" - INSTALLATION CHECK
AX = 4B40h
Return: AX = 5678h if resident
SeeAlso: AX=4B25h,AX=4B41h,AX=4B4Ah
--------v-214B41-----------------------------
INT 21 - VIRUS - "Plastique"/"AntiCad" - ???
AX = 4B41h
???
Return: ???
SeeAlso: AX=4B40h
--------v-214B4A-----------------------------
INT 21 - VIRUS - "Jabberwocky" - INSTALLATION CHECK
AX = 4B4Ah
Return: AL = 57h if resident
SeeAlso: AX=4B40h,AX=4B4Bh
--------v-214B4B-----------------------------
INT 21 - VIRUS - "Horse-2" - INSTALLATION CHECK
AX = 4B4Bh
Return: CF clear if resident
SeeAlso: AX=4B4Ah,AX=4B4Dh
--------v-214B4D-----------------------------
INT 21 - VIRUS - "Murphy-2", "Patricia"/"Smack" - INSTALLATION CHECK
AX = 4B4Dh
Return: CF clear if resident
SeeAlso: AX=4B4Ah,AX=4B50h
--------v-214B50-----------------------------
INT 21 - VIRUS - "Plastique-2576"/"AntiCad-2576" - INSTALLATION CHECK
AX = 4B50h
Return: AX = 1234h if resident
SeeAlso: AX=4B4Dh,AX=4B53h,AX=4B60h
--------v-214B53-----------------------------
INT 21 - VIRUS - "Horse" - INSTALLATION CHECK
AX = 4B53h
Return: CF clear if resident
SeeAlso: AX=4B50h,AX=4B53h/BX=2121h,AX=4B55h
--------v-214B53BX2121-----------------------
INT 21 - VIRUS - "One Half" - INSTALLATION CHECK
AX = 4B53h
BX = 2121h
CX = 1212h
DX = 0236h
Return: AX = 454Bh if installed
SeeAlso: AX=4B50h,AX=4B53h,AX=4B55h
--------v-214B55-----------------------------
INT 21 - VIRUS - "Sparse" - INSTALLATION CHECK
AX = 4B55h
Return: AX = 1231h if resident
SeeAlso: AX=4B53h,AX=4B59h
--------v-214B59-----------------------------
INT 21 - VIRUS - "Murphy-1", "Murphy-4" - INSTALLATION CHECK
AX = 4B59h
Return: CF clear if resident
SeeAlso: AX=4B50h,AX=4B5Eh
--------v-214B5E-----------------------------
INT 21 - VIRUS - "Brothers" - INSTALLATION CHECK
AX = 4B5Eh
Return: CF clear if resident
SeeAlso: AX=4B59h,AX=4B87h
--------v-214B60-----------------------------
INT 21 - VIRUS - "Plastique-2576"/"AntiCad-2576" - ???
AX = 4B60h
???
Return: ???
SeeAlso: AX=4B50h
--------v-214B87-----------------------------
INT 21 - VIRUS - "Shirley" - INSTALLATION CHECK
AX = 4B87h
Return: AX = 6663h if resident
SeeAlso: AX=4B5Eh,AX=4B95h
--------v-214B95-----------------------------
INT 21 - VIRUS - "Zherkov-1882" - INSTALLATION CHECK
AX = 4B95h
Return: AX = 1973h if resident
SeeAlso: AX=4B87h,AX=4BA7h
--------v-214BA7-----------------------------
INT 21 - VIRUS - "1876"/"Dash-em" - INSTALLATION CHECK
AX = 4BA7h
Return: AX = B459h if resident
SeeAlso: AX=4B95h,AX=4BAAh
--------v-214BAA-----------------------------
INT 21 - VIRUS - "Nomenklatura" - INSTALLATION CHECK
AX = 4BAAh
Return: CF clear if resident
SeeAlso: AX=4BA7h,AX=4BAFh
--------v-214BAF-----------------------------
INT 21 - VIRUS - "948"/"Screenplus1", "Magnitogorsk" - INSTALLATION CHECK
AX = 4BAFh
Return: AL = AFh if "Magnitogorsk" resident
AL = FAh if "948"/"Screenplus1" resident
SeeAlso: AX=4BAAh,AX=4BDDh
--------v-214BDD-----------------------------
INT 21 - VIRUS - "Lozinsky"/"Zherkov" - INSTALLATION CHECK
AX = 4BDDh
Return: AX = 1234h
SeeAlso: AX=4BAFh,AX=4BFEh
--------v-214BEE-----------------------------
INT 21 - F-DRIVER.SYS v1.14+ - GRAB INT 21
AX = 4BEEh
Return: AX = status
1234h grab was successful
2345h failed (INT 21 grabbed previously)
Program: F-DRIVER.SYS is part of the shareware F-PROT virus/trojan protection
package by Fridrik Skulason
Note: when called the first time, this function moves the INT 21 monitoring
code from its original location in the INT 21 chain to be the first
thing called by INT 21. This is the mechanism used by F-NET.
SeeAlso: INT 2F/AX=4653h
--------k-214BF0-----------------------------
INT 21 - DIET v1.10+ (Overlay Mode) - INSTALLATION CHECK
AX = 4BF0h
Return: CF clear if installed
AX = 899Dh
Program: DIET is an executable-compression program by Teddy Matsumoto
SeeAlso: AX=37D0h,AX=4BF1h
--------k-214BF1-----------------------------
INT 21 - DIET v1.10+ (Overlay Mode) - EXPAND PROGRAM???
AX = 4BF1h
Return: ???
SeeAlso: AX=37D0h,AX=4BF0h
--------v-214BFE-----------------------------
INT 21 - VIRUS - "Hitchcock", "Dark Avenger-1028", "1193" - INSTALLATION CHECK
AX = 4BFEh
Return: AX = 1234h if "Hitchcock" resident
AX = ABCDh if "1193"/"Copyright" resident
DI = 55BBh if "Dark Avenger-1028" resident
SeeAlso: AX=4BDDh,AX=4BFFh"Justice"
--------v-214BFF-----------------------------
INT 21 - VIRUS - "USSR-707", "Justice", "Europe 92" - INSTALLATION CHECK
AX = 4BFFh
Return: BL = FFh if "USSR-707" resident
DI = 55AAh if "Justice" resident
CF clear if "Europe 92" resident
SeeAlso: AX=4BFEh,AX=4BFFh"Cascade",AX=5252h
--------v-214BFFSI0000-----------------------
INT 21 - VIRUS - "Cascade" - INSTALLATION CHECK
AX = 4BFFh
SI = 0000h
DI = 0000h
Return: DI = 55AAh if installed
SeeAlso: AX=4BFFh"Justice",AX=5252h
--------D-214C-------------------------------
INT 21 - DOS 2+ - "EXIT" - TERMINATE WITH RETURN CODE
AH = 4Ch
AL = return code
Return: never returns
Notes: unless the process is its own parent (see #0677 at AH=26h, offset 16h
in PSP), all open files are closed and all memory belonging to the
process is freed
all network file locks should be removed before calling this function
SeeAlso: AH=00h,AH=26h,AH=4Bh,AH=4Dh,INT 15/AH=12h/BH=02h,INT 20,INT 22
SeeAlso: INT 60/DI=0601h
--------m-214C57-----------------------------
INT 21 - Headroom - ???
AX = 4C57h
DS:DX -> target address
Note: jumps to target address instead of terminating program
SeeAlso: AX=5758h
--------D-214D-------------------------------
INT 21 - DOS 2+ - GET RETURN CODE (ERRORLEVEL)
AH = 4Dh
Return: AH = termination type
00h normal (INT 20,INT 21/AH=00h, or INT 21/AH=4Ch)
01h control-C abort
02h critical error abort
03h terminate and stay resident (INT 21/AH=31h or INT 27)
AL = return code
Notes: the word in which DOS stores the return code is cleared after being
read by this function, so the return code can only be retrieved once
COMMAND.COM stores the return code of the last external command it
executed as ERRORLEVEL
this call should not be used if the child was started with AX=4B04h;
use AH=8Ah instead
the following sequence will close a Virtual DOS Machine under OS/2 2.0:
MOV AH,4Dh
INT 21h
HLT
DB 02h,0FDh
This sequence is the only way to close a specific VDM which was
booted from floppy or a disk image.
SeeAlso: AH=4Bh,AH=4Ch,AH=8Ah
--------D-214E-------------------------------
INT 21 - DOS 2+ - "FINDFIRST" - FIND FIRST MATCHING FILE
AH = 4Eh
AL = special flag for use by APPEND (see note below)
CX = file attribute mask (see #0717 at AX=4301h) (bits 0 and 5 ignored)
0088h (Novell DOS 7) find first deleted file
DS:DX -> ASCIZ file specification (may include path and wildcards)
Return: CF clear if successful
[DTA] = FindFirst data block (see #0913)
CF set on error
AX = error code (02h,03h,12h) (see #0960 at AH=59h)
Notes: for search attributes other than 08h, all files with at MOST the
specified combination of hidden, system, and directory attributes
will be returned. Under DOS 2.x, searching for attribute 08h
(volume label) will also return normal files, while under DOS 3.0+
only the volume label (if any) will be returned.
this call also returns successfully if given the name of a character
device without wildcards. DOS 2.x returns attribute 00h, size 0,
and the current date and time. DOS 3.0+ returns attribute 40h and
the current date and time.
immediately after an INT 2F/AX=B711h (APPEND return found name), the
name at DS:DX will be overwritten; if AL=00h on entry, the actual
found pathname will be stored, otherwise, the actual found path
will be prepended to the original filespec without a path.
under LANtastic, this call may be used to obtain a list of a server's
shared resources by searching for "\\SERVER\*.*"; a list of printer
resources may be obtained by searching for "\\SERVER\@*.*"
under the FlashTek X-32 DOS extender, the filespec pointer is in DS:EDX
BUGS: under DOS 3.x and 4.x, the second and subsequent calls to this function
with a character device name (no wildcards) and search attributes
which include the volume-label bit (08h) will fail unless there is
an intervening DOS call which implicitly or explicity performs a
directory search without the volume-label bit. Such implicit
searches are performed by CREATE (AH=3Ch), OPEN (AH=3Dh), UNLINK
(AH=41h), and RENAME (AH=56h)
DR-DOS 3.41 and 5.0 return the Directory attribute for the volume label
SeeAlso: AH=11h,AH=4Fh,AX=4301h,AX=714Eh,AX=71A1h,AX=F257h/SF=02h
SeeAlso: INT 2F/AX=111Bh,INT 2F/AX=B711h

Format of FindFirst data block:
Offset Size Description (Table 0913)
---PC-DOS 3.10, PC-DOS 4.01, MS-DOS 3.2/3.3/5.0---
00h BYTE drive letter (bits 0-6), remote if bit 7 set
01h 11 BYTEs search template
0Ch BYTE search attributes
---DOS 2.x (and some DOS 3.x???)---
00h BYTE search attributes
01h BYTE drive letter
02h 11 BYTEs search template
---WILDUNIX.COM---
00h 12 BYTEs 15-character wildcard search pattern and drive letter (packed)
0Ch BYTE search attributes
---DOS 2.x and most 3.x---
0Dh WORD entry count within directory
0Fh DWORD pointer to DTA???
13h WORD cluster number of start of parent directory
---PC-DOS 4.01, MS-DOS 3.2/3.3/5.0---
0Dh WORD entry count within directory
0Fh WORD cluster number of start of parent directory
11h 4 BYTEs reserved
---all versions, documented fields---
15h BYTE attribute of file found
16h WORD file time (see #0951 at AX=5700h)
18h WORD file date (see #0952 at AX=5700h)
1Ah DWORD file size
1Eh 13 BYTEs ASCIZ filename+extension
--------f-214E-------------------------------
INT 21 - WILDUNIX.COM internal - INSTALLATION CHECK
AH = 4Eh
DS:DX = 0000h:0000h
Return: AH = 99h if installed
Program: WILDUNIX.COM is a resident Unix-style wildcard expander by Steve
Hosgood and Terry Barnaby
--------D-214F-------------------------------
INT 21 - DOS 2+ - "FINDNEXT" - FIND NEXT MATCHING FILE
AH = 4Fh
[DTA] = data block from previous FindFirst or FindNext call
Return: CF clear if successful
CF set on error
AX = error code (12h) (see #0960 at AH=59h)
Note: under Novell DOS 7, if the FindFirst call (AH=4Eh) had CX=0088h, then
the next matching deleted file will be returned
BUG: DR-DOS 3.41 and 5.0 return the Directory attribute for the volume label
SeeAlso: AH=12h,AH=4Eh,AX=714Fh,AX=71A1h
--------D-2150-------------------------------
INT 21 - DOS 2+ internal - SET CURRENT PROCESS ID (SET PSP ADDRESS)
AH = 50h
BX = segment of PSP for new process
Notes: DOS uses the current PSP address to determine which processes own files
and memory; it corresponds to process identifiers used by other OSs
under DOS 2.x, this function cannot be invoked inside an INT 28h
handler without setting the Critical Error flag
under MS-DOS 3.0+ and DR-DOS 3.41+, this function does not use any of
the DOS-internal stacks and may thus be called at any time, even
during another INT 21h call
some Microsoft applications such as Quick C 2.51 use segments of 0000h
and FFFFh and direct access to the SDA (see #0967 at AX=5D06h) to
test whether they are running under MS-DOS rather than a compatible
OS; although one should only call this function with valid PSP
addresses, any program hooking it should be prepared to handle
invalid addresses
this function is supported by the OS/2 compatibility box
this call was undocumented prior to the release of DOS 5.0
SeeAlso: AH=26h,AH=51h,AH=62h
--------D-2151-------------------------------
INT 21 - DOS 2+ internal - GET CURRENT PROCESS ID (GET PSP ADDRESS)
AH = 51h
Return: BX = segment of PSP for current process
Notes: DOS uses the current PSP address to determine which processes own files
and memory; it corresponds to process identifiers used by other OSs
under DOS 2.x, this function cannot be invoked inside an INT 28h
handler without setting the Critical Error flag
under DOS 3.0+, this function does not use any of the DOS-internal
stacks and may thus be called at any time, even during another
INT 21h call
supported by OS/2 compatibility box
identical to the documented AH=62h
this call was undocumented prior to the release of DOS 5.0
SeeAlso: AH=26h,AH=50h,AH=62h
--------D-2152-------------------------------
INT 21 U - DOS 2+ internal - "SYSVARS" - GET LIST OF LISTS
AH = 52h
Return: ES:BX -> DOS list of lists (see #0914)
Notes: partially supported by OS/2 v1.1 compatibility box (however, most
pointers are FFFFh:FFFFh, LASTDRIVE is FFh, and the NUL header "next"
pointer is FFFFh:FFFFh).
partially supported by the Windows NT DOS box; contains only a
rudimentary Current Directory Structure (see #0932)
on return, ES points at the DOS data segment (see also INT 2F/AX=1203h)
Quarterdeck's suggested check for the use of its DOSDATA.SYS or
DOS-UP.SYS is to test whether the list-of-lists segment is greater
than the segment of the first memory block; a better check for
DOS-UP.SYS is INT 21/AX=2B01h/CX=444Dh
SeeAlso: INT 2F/AX=1203h

Format of List of Lists:
Offset Size Description (Table 0914)
-24 WORD (DOS 3.1+) contents of CX from INT 21/AX=5E01h
-22 WORD (DOS ???+) LRU counter for FCB caching
-20 WORD (DOS ???+) LRU counter for FCB opens
-18 DWORD (DOS ???+) address of OEM function handler (see INT 21/AH=F8h)
FFFFh:FFFFh if not installed or not available
-14 WORD (DOS ???+) offset in DOS CS of code to return from INT 21 call
-12 WORD (DOS 3.1+) sharing retry count (see AX=440Bh)
-10 WORD (DOS 3.1+) sharing retry delay (see AX=440Bh)
-8 DWORD (DOS 3.0+) pointer to current disk buffer
-4 WORD (DOS 3.0+) pointer in DOS data segment of unread CON input
when CON is read via a handle, DOS reads an entire line,
and returns the requested portion, buffering the rest
for the next read. 0000h indicates no unread input
-2 WORD segment of first memory control block (see #0915)
00h DWORD pointer to first Drive Parameter Block (see #0694 at AH=32h)
04h DWORD -> first System File Table (see #0926,#0927,#0928,#0929)
08h DWORD pointer to active CLOCK$ device's header (most recently loaded
driver with CLOCK bit set)
0Ch DWORD pointer to active CON device's header (most recently loaded
driver with STDIN bit set)
---DOS 2.x---
10h BYTE number of logical drives in system
11h WORD maximum bytes/block of any block device
13h DWORD pointer to first disk buffer (see #0936,#0937)
17h 18 BYTEs actual NUL device driver header (not a pointer!)
NUL is always the first device on DOS's linked list of device
drivers. (see #0933)
---DOS 3.0---
10h BYTE number of block devices
11h WORD maximum bytes/block of any block device
13h DWORD pointer to first disk buffer (see #0937,#0939)
17h DWORD pointer to array of current directory structures (see #0930)
1Bh BYTE value of LASTDRIVE command in CONFIG.SYS (default 5)
1Ch DWORD pointer to STRING= workspace area
20h WORD size of STRING area (the x in STRING=x from CONFIG.SYS)
22h DWORD pointer to FCB table
26h WORD the y in FCBS=x,y from CONFIG.SYS
28h 18 BYTEs actual NUL device driver header (not a pointer!)
NUL is always the first device on DOS's linked list of device
drivers. (see #0933)
---DOS 3.1-3.3---
10h WORD maximum bytes per sector of any block device
12h DWORD pointer to first disk buffer in buffer chain (see #0937)
16h DWORD pointer to array of current directory structures (see #0930)
1Ah DWORD pointer to system FCB tables (see #0927,#0928,#0929)
1Eh WORD number of protected FCBs (the y in the CONFIG.SYS FCBS=x,y)
20h BYTE number of block devices installed
21h BYTE number of available drive letters (largest of 5, installed
block devices, and CONFIG.SYS LASTDRIVE=). Also size of
current directory structure array.
22h 18 BYTEs actual NUL device driver header (not a pointer!)
NUL is always the first device on DOS's linked list of device
drivers. (see #0933)
34h BYTE number of JOIN'ed drives
---DOS 4.x---
10h WORD maximum bytes per sector of any block device
12h DWORD pointer to disk buffer info record (see #0939,#0940)
Note: although the initialization code in IO.SYS uses this
pointer, MSDOS.SYS does not, instead using the hardcoded
address of the info record
16h DWORD pointer to array of current directory structures
(see #0930,#0931)
1Ah DWORD pointer to system FCB tables (see #0927,#0928,#0929)
1Eh WORD number of protected FCBs (the y in the CONFIG.SYS FCBS=x,y)
(always 00h for DOS 5.0)
20h BYTE number of block devices installed
21h BYTE number of available drive letters (largest of 5, installed
block devices, and CONFIG.SYS LASTDRIVE=). Also size of
current directory structure array.
22h 18 BYTEs actual NUL device driver header (not a pointer!)
NUL is always the first device on DOS's linked list of device
drivers. (see #0933)
34h BYTE number of JOIN'ed drives
35h WORD pointer within IBMDOS code segment to list of special program
names (see #0949)
(always 0000h for DOS 5.0)
37h DWORD pointer to FAR routine for resident IFS utility functions
(see #0945)
may be called by any IFS driver which does not wish to
service functions 20h or 24h-28h itself
3Bh DWORD pointer to chain of IFS (installable file system) drivers
3Fh WORD the x in BUFFERS x,y (rounded up to multiple of 30 if in EMS)
41h WORD number of lookahead buffers (the y in BUFFERS x,y)
43h BYTE boot drive (1=A:)
44h BYTE flag: 01h to use DWORD moves (80386+), 00h otherwise
45h WORD extended memory size in KB
---DOS 5.0-6.0---
10h 39 BYTEs as for DOS 4.x (see above)
37h DWORD pointer to SETVER program list or 0000h:0000h
3Bh WORD (DOS=HIGH) offset in DOS CS of function to fix A20 control
when executing special .COM format
3Dh WORD PSP of most-recently EXECed program if DOS in HMA, 0000h if low
used for maintaining count of INT 21 calls which disable A20
on return
3Fh 8 BYTEs as for DOS 4.x (see above)
---Windows NT DOS Box---
10h 6 BYTEs ???
16h DWORD pointer to array of current directory structures (see #0932)
1Ah 6 BYTEs ???
20h BYTE number of block devices installed
21h BYTE number of local drive letters (= installed block devices)
Also size of current directory structure array.
22h 18 BYTEs actual NUL device driver header (not a pointer!)
NUL is always the first device on DOS's linked list of device
drivers. (see #0933)

Format of DOS memory control block:
Offset Size Description (Table 0915)
00h BYTE block type: 5Ah if last block in chain, otherwise 4Dh
01h WORD PSP segment of owner or special flag value (see #0916)
03h WORD size of memory block in paragraphs
05h 3 BYTEs unused by MS-DOS
(386MAX) if locked-out block, region start/prev region end
---DOS 2.x,3.x---
08h 8 BYTEs unused
---DOS 4.0+ ---
08h 8 BYTEs ASCII program name if PSP memory block or DR-DOS UMB,
else garbage
null-terminated if less than 8 characters
Notes: the next MCB is at segment (current + size + 1)
under DOS 3.1+, the first memory block is the DOS data segment,
containing installable drivers, buffers, etc. Under DOS 4.0+ it is
divided into subsegments, each with its own memory control block
(see #0920), the first of which is at offset 0000h.
for DOS 5+, blocks owned by DOS may have either "SC" or "SD" in bytes
08h and 09h. "SC" is system code or locked-out inter-UMB memory,
"SD" is system data, device drivers, etc.
Some versions of DR-DOS use only seven characters of the program name,
placing a NUL in the eighth byte.
SeeAlso: #0917,#0919,#0920

(Table 0916)
Values for special flag PSP segments:
0000h free
0006h DR-DOS XMS UMB
0007h DR-DOS excluded upper memory ("hole")
0008h belongs to DOS
FFF7h 386MAX v6.01+ ???
FFFAh 386MAX UMB control block (see #0771 at AX=4402h"386MAX")
FFFDh 386MAX locked-out memory
FFFEh 386MAX UMB (normally immediately follows its control block)
FFFFh 386MAX v6.01+ device driver

Format of MS-DOS 5+ UMB control block:
Offset Size Description (Table 0917)
00h BYTE type: 5Ah if last block in chain, 4Dh otherwise
01h WORD first available paragraph in UMB if control block at start
of UMB, 000Ah if control block at end of UMB
03h WORD length in paragraphs of following UMB or locked-out region
05h 3 BYTEs unused
08h 8 BYTEs block type name: "UMB" if start block, "SM" if end block in UMB
SeeAlso: #0915,#0918

Format of MS-DOS 7.0 HMA memory control block:
Offset Size Description (Table 0918)
00h WORD signature "MS" (4Dh 53h)
02h WORD usage flag???
0000h free
else ???
04h WORD size of memory block in bytes (not counting MCB)
06h WORD offset of next memory block in HMA or 0000h
08h 8 BYTEs unused (0)
SeeAlso: #0915,#0917,#0919

Format of STARLITE (General Software's Embedded DOS) memory control block:
Offset Size Description (Table 0919)
00h BYTE block type: 5Ah if last block in chain, otherwise 4Dh
01h WORD PSP segment of owner, 0000h if free, 0008h if belongs to DOS
03h WORD size of memory block in paragraphs
05h BYTE unused
06h WORD segment address of next memory control block (0000h if last)
08h WORD segment address of previous memory control block or 0000h
0Ah 6 BYTEs reserved

Format of DOS 4.0+ data segment subsegment control blocks:
Offset Size Description (Table 0920)
00h BYTE subsegment type (blocks typically appear in this order)
"D" device driver
"E" device driver appendage
"I" IFS (Installable File System) driver
"F" FILES= control block storage area (for FILES>5)
"X" FCBS= control block storage area, if present
"C" BUFFERS EMS workspace area (if BUFFERS /X option used)
"B" BUFFERS= storage area
"L" LASTDRIVE= current directory structure array storage area
"S" STACKS= code and data area, if present (see #0921,#0922)
"T" INSTALL= transient code
01h WORD paragraph of subsegment start (usually the next paragraph)
03h WORD size of subsegment in paragraphs
05h 3 BYTEs unused
08h 8 BYTEs for types "D" and "I", base name of file from which the driver
was loaded (unused for other types)

Format of data at start of STACKS code segment (if present):
Offset Size Description (Table 0921)
00h WORD ???
02h WORD number of stacks (the x in STACKS=x,y)
04h WORD size of stack control block array (should be 8*x)
06h WORD size of each stack (the y in STACKS=x,y)
08h DWORD pointer to STACKS data segment
0Ch WORD offset in STACKS data segment of stack control block array
0Eh WORD offset in STACKS data segment of last element of that array
10h WORD offset in STACKS data segment of the entry in that array for
the next stack to be allocated (initially same as value in
0Eh and works its way down in steps of 8 to the value in
0Ch as hardware interrupts pre-empt each other)
Note: the STACKS code segment data may, if present, be located as follows:
DOS 3.2: The code segment data is at a paragraph boundary fairly early
in the IBMBIO segment (seen at 0070:0190h)
DOS 3.3: The code segment is at a paragraph boundary in the DOS data
segment, which may be determined by inspecting the segment
pointers of the vectors for those of interrupts 02h, 08h-0Eh,
70h, 72-77h which have not been redirected by device drivers
or TSRs.
DOS 4.0+ Identified by sub-segment control block type "S" within the DOS
data segment.
SeeAlso: #0923,INT B4"STACKMAN"

Format of array elements in STACKS data segment:
Offset Size Description (Table 0922)
00h BYTE status: 00h=free, 01h=in use, 03h=corrupted by overflow of
higher stack.
01h BYTE not used
02h WORD previous SP
04h WORD previous SS
06h WORD ptr to word at top of stack (new value for SP). The word at the
top of the stack is preset to point back to this control
block.

Format of SHARE.EXE hooks (DOS 3.1-6.00):
Offset Size Description (Table 0923)
(offsets from first system file table--pointed at by ListOfLists+04h)
-3Ch DWORD pointer to FAR routine for ???
Note: not called by MS-DOS 3.3, set to 0000h:0000h by
SHARE 3.3+
-38h DWORD pointer to FAR routine called on opening file
on call, internal DOS location points at filename
(see #0967 at AX=5D06h)
Return: CF clear if successful
CF set on error
AX = DOS error code (24h) (see #0960 at AH=59h)
Note: SHARE directly accesses DOS-internal data to get name of
file just opened
-34h DWORD pointer to FAR routine called on closing file
ES:DI -> system file table
Note: does something to every Record Lock Record for file
-30h DWORD pointer to FAR routine to close all files for given computer
(called by AX=5D03h)
-2Ch DWORD pointer to FAR routine to close all files for given process
(called by AX=5D04h)
-28h DWORD pointer to FAR routine to close file by name
(called by AX=5D02h)
DS:SI -> DOS parameter list (see #0966 at AX=5D00h)
DPL's DS:DX -> name of file to close
Return: CF clear if successful
CF set on error
AX = DOS error code (03h) (see #0960 at AH=59h)
-24h DWORD pointer to FAR routine to lock region of file
call with BX = file handle
---DOS 3.x---
CX:DX = starting offset
SI:AX = size
---DOS 4.0+ ---
DS:DX -> lock range
DWORD start offset
DWORD size in bytes
Return: CF set on error
AL = DOS error code (21h) (see #0960 at AH=59h)
Note: not called if file is marked as remote
-20h DWORD pointer to FAR routine to unlock region of file
call with BX = file handle
---DOS 3.x---
CX:DX = starting offset
SI:AX = size
---DOS 4.0+ ---
DS:DX -> lock range
DWORD start offset
DWORD size in bytes
Return: CF set on error
AL = DOS error code (21h) (see #0960 at AH=59h)
Note: not called if file is marked as remote
-1Ch DWORD pointer to FAR routine to check if file region is locked
call with ES:DI -> system file table entry for file
CX = length of region from current position in file
Return: CF set if any portion of region locked
AX = 0021h
-18h DWORD pointer to FAR routine to get open file list entry
(called by AX=5D05h)
call with DS:SI -> DOS parameter list (see #0966 at AX=5D00h)
DPL's BX = index of sharing record
DPL's CX = index of SFT in SFT chain of sharing rec
Return: CF set on error or not loaded
AX = DOS error code (12h) (see #0960 at AH=59h)
CF clear if successful
ES:DI -> filename
CX = number of locks owned by specified SFT
BX = network machine number
DX destroyed
-14h DWORD pointer to FAR routine for updating FCB from SFT???
call with DS:SI -> unopened FCB
ES:DI -> system file table entry
Return: BL = C0h???
Note: copies following fields from SFT to FCB:
starting cluster of file 0Bh 1Ah
sharing record offset 33h 1Ch
file attribute 04h 1Eh
-10h DWORD pointer to FAR routine to get first cluster of FCB file ???
call with ES:DI -> system file table entry
DS:SI -> FCB
Return: CF set if SFT closed or sharing record offsets
mismatched
CF clear if successful
BX = starting cluster number from FCB
-0Ch DWORD pointer to FAR routine to close file if duplicate for process
DS:SI -> system file table
Return: AX = number of handle in JFT which already uses SFT
Note: called during open/create of a file
Note: if SFT was opened with inheritance enabled and sharing
mode 111, does something to all other SFTs owned by
same process which have the same file open mode and
sharing record
-08h DWORD pointer to FAR routine for closing file
Note: closes various handles referring to file most-recently
opened
-04h DWORD pointer to FAR routine to update directory info in related SFT
entries
call with ES:DI -> system file table entry for file (see #0928)
AX = subfunction (apply to each related SFT)
00h: update time stamp (offset 0Dh) and date
stamp (offset 0Fh)
01h: update file size (offset 11h) and starting
cluster (offset 0Bh). Sets last-accessed
cluster fields to start of file if file
never accessed
02h: as function 01h, but last-accessed fields
always changed
03h: do both functions 00h and 02h
Note: follows ptr at offset 2Bh in system file table entries
Note: NOP if opened with no-inherit or via FCB
Notes: most of the above hooks (except -04h, -14h, -18h, and -3Ch) assume
either that SS=DOS DS or SS=DS=DOS DS and directly access
DOS-internal data
sharing hooks are not supported by DR-DOS 5-6; they appear to be
supported by Novell DOS 7, with a segment of 0000h indicating the
DOS data segment
SeeAlso: #0924,#0925

Format of sharing record:
Offset Size Description (Table 0924)
00h BYTE flag
00h free block
01h allocated block
FFh end marker
01h WORD size of block
03h BYTE checksum of pathname (including NUL)
if sum of ASCII values is N, checksum is (N/256 + N%256)
04h WORD offset in SHARE's DS of first Record Lock Record (see #0925)
06h DWORD pointer to start of system file table chain for file
0Ah WORD unique sequence number
0Ch var ASCIZ full pathname
Note: not supported by DR-DOS SHARE 1.1 and 2.0; will reportedly be
supported by Novell DOS 7
SeeAlso: #0923,#0925

Format of SHARE.EXE Record Lock Record:
Offset Size Description (Table 0925)
00h WORD offset in SHARE's DS of next lock table in list or 0000h
02h DWORD offset in file of start of locked region
06h DWORD offset in file of end of locked region
0Ah DWORD pointer to System File Table entry for this file
0Eh WORD PSP segment of lock's owner
---DOS 5+ ---
10h WORD lock type: (00h lock all, 01h lock writes only)
SeeAlso: #0923,#0924,#0926,#0929

Format of DOS 2.x system file tables:
Offset Size Description (Table 0926)
00h DWORD pointer to next file table (offset FFFFh if last)
04h WORD number of files in this table
06h 28h bytes per file
Offset Size Description
00h BYTE number of file handles referring to this file
01h BYTE file open mode (see #0701 at AH=3Dh)
02h BYTE file attribute
03h BYTE drive (0 = character device, 1 = A, 2 = B, etc)
04h 11 BYTEs filename in FCB format (no path,no period,blank-padded)
0Fh WORD ???
11h WORD ???
13h DWORD file size???
17h WORD file date in packed format (see #0952 at AX=5700h)
19h WORD file time in packed format (see #0951 at AX=5700h)
1Bh BYTE device attribute (see #0720 at AX=4400h)
---character device---
1Ch DWORD pointer to device driver
---block device---
1Ch WORD starting cluster of file
1Eh WORD relative cluster in file of last cluster accessed
------
20h WORD absolute cluster number of current cluster
22h WORD ???
24h DWORD current file position???
SeeAlso: #0927,#0928,#0929

Format of DOS 3.0 system file tables and FCB tables:
Offset Size Description (Table 0927)
00h DWORD pointer to next file table (offset FFFFh if last)
04h WORD number of files in this table
06h 38h bytes per file
Offset Size Description
00h-1Eh as for DOS 3.1+ (see #0928)
1Fh WORD byte offset of directory entry within sector
21h 11 BYTEs filename in FCB format (no path/period, blank-padded)
2Ch DWORD (SHARE.EXE) pointer to previous SFT sharing same file
30h WORD (SHARE.EXE) network machine number which opened file
(Windows Enhanced mode DOSMGR uses the virtual machine
ID as the machine number; see INT 2F/AX=1683h)
32h WORD PSP segment of file's owner (first three entries for
AUX/CON/PRN contain segment of IO.SYS startup code)
34h WORD (SHARE.EXE) offset in SHARE code seg of share record
36h WORD ??? apparently always 0000h
SeeAlso: #0926,#0928,#0929

Format of DOS 3.1-3.3x, DR-DOS 5.0-6.0 system file tables and FCB tables:
Offset Size Description (Table 0928)
00h DWORD pointer to next file table (offset FFFFh if last)
04h WORD number of files in this table
06h 35h bytes per file
Offset Size Description
00h WORD number of file handles referring to this file
02h WORD file open mode (see AX=6C00h, #0701 at AH=3Dh)
bit 15 set if this file opened via FCB
04h BYTE file attribute (see #0717 at AX=4301h)
05h WORD device info word (see #0720 at AX=4400h)
bit 15 set if remote file
bit 14 set means do not set file date/time on closing
bit 12 set means don't inherit on EXEC
bits 5-0 drive number for disk files
07h DWORD pointer to device driver header if character device
else pointer to DOS Drive Parameter Block
(see #0694 at AH=32h)
0Bh WORD starting cluster of file
0Dh WORD file time in packed format (see #0951 at AX=5700h)
not used for character devices in DR-DOS
0Fh WORD file date in packed format (see #0952 at AX=5700h)
not used for character devices in DR-DOS
11h DWORD file size
---system file table---
15h DWORD current offset in file (may be larger than size of
file; INT 21/AH=42h does not check new position)
---FCB table---
15h WORD counter for last I/O to FCB
17h WORD counter for last open of FCB
(these are separate to determine the times of the
latest I/O and open)
---
19h WORD relative cluster within file of last cluster accessed
1Bh WORD absolute cluster number of last cluster accessed
0000h if file never read or written???
1Dh WORD number of sector containing directory entry
1Fh BYTE number of dir entry within sector (byte offset/32)
20h 11 BYTEs filename in FCB format (no path/period, blank-padded)
2Bh DWORD (SHARE.EXE) pointer to previous SFT sharing same file
2Fh WORD (SHARE.EXE) network machine number which opened file
(Windows Enhanced mode DOSMGR uses the virtual machine
ID as the machine number; see INT 2F/AX=1683h)
31h WORD PSP segment of file's owner (see #0677 at AH=26h)
(first three entries for AUX/CON/PRN contain segment
of IO.SYS startup code)
33h WORD offset within SHARE.EXE code segment of
sharing record (see #0924) 0000h = none
SeeAlso: #0926,#0927,#0929

Format of DOS 4.0-6.0 system file tables and FCB tables:
Offset Size Description (Table 0929)
00h DWORD pointer to next file table (offset FFFFh if last)
04h WORD number of files in this table
06h 3Bh bytes per file
Offset Size Description
00h WORD number of file handles referring to this file
FFFFh if in use but not referenced
02h WORD file open mode (see AX=6C00h,#0701 at AH=3Dh)
bit 15 set if this file opened via FCB
04h BYTE file attribute (see #0717 at AX=4301h)
05h WORD device info word (see also #0720 at AX=4400h)
bit 15 set if remote file
bit 14 set means do not set file date/time on closing
bit 13 set if named pipe
bit 12 set if no inherit
bit 11 set if network spooler
bit 7 set if device, clear if file (only if local)
bits 6-0 as for AX=4400h
07h DWORD pointer to device driver header if character device
else pointer to DOS Drive Parameter Block
(see #0694 at AH=32h) or REDIR data
0Bh WORD starting cluster of file (local files only)
0Dh WORD file time in packed format (see #0951)
0Fh WORD file date in packed format (see #0952)
11h DWORD file size
15h DWORD current offset in file (SFT)
LRU counters (FCB table, two WORDs)
---local file---
19h WORD relative cluster within file of last cluster accessed
1Bh DWORD number of sector containing directory entry
1Fh BYTE number of dir entry within sector (byte offset/32)
---network redirector---
19h DWORD pointer to REDIRIFS record
1Dh 3 BYTEs ???
------
20h 11 BYTEs filename in FCB format (no path/period, blank-padded)
2Bh DWORD (SHARE.EXE) pointer to previous SFT sharing same file
2Fh WORD (SHARE.EXE) network machine number which opened file
(Windows Enhanced mode DOSMGR uses the virtual machine
ID as the machine number; see INT 2F/AX=1683h)
31h WORD PSP segment of file's owner (see #0677 at AH=26h)
(first three entries for AUX/CON/PRN contain segment
of IO.SYS startup code)
33h WORD offset within SHARE.EXE code segment of
sharing record (see #0882) 0000h = none
35h WORD (local) absolute cluster number of last clustr accessed
(redirector) ???
37h DWORD pointer to IFS driver for file, 0000000h if native DOS
Note: the OS/2 2.0 DOS Boot Session does not properly fill in the filename
field due to incomplete support for SFTs; the OS/2 2.0 DOS Window
does not appear to support SFTs at all
SeeAlso: #0926,#0927,#0928

Format of current directory structure (CDS) (array, LASTDRIVE entries):
Offset Size Description (Table 0930)
00h 67 BYTEs ASCIZ path in form X:\PATH (local) or UNC form
\\SERVER\PATH (network, see notes below)
43h WORD drive attributes (see also note below and AX=5F07h)
bit 15: uses network redirector \ invalid if 00, installable
bit 14: physical drive / file system if 11
bit 13: JOIN'ed \ path above is true path that would be
bit 12: SUBST'ed / needed if not under SUBST or JOIN
bit 7: remote drive hidden from redirector's assign-list and
exempt from network connection make/break commands;
set for CD-ROM drives
45h DWORD pointer to Drive Parameter Block for drive
(see #0694 at AH=32h)
---local drives---
49h WORD starting cluster of current directory
0000h = root, FFFFh = never accessed
4Bh WORD ??? seems to be FFFFh always
4Dh WORD ??? seems to be FFFFh always
---network drives---
49h DWORD pointer to redirector or REDIRIFS record, or FFFFh:FFFFh
(DOS 4 only) available for use by IFS driver
4Dh WORD stored user data from INT 21/AX=5F03h
------
4Fh WORD offset in current directory path of backslash corresponding to
root directory for drive
this value specifies how many characters to hide from the
"CHDIR" and "GETDIR" calls; normally set to 2 to hide the
drive letter and colon, SUBST, JOIN, and networks change it
so that only the appropriate portion of the true path is
visible to the user
---DOS 4.0+ ---
51h BYTE (DOS 4 only, remote drives) device type
04h network drive
52h DWORD pointer to IFS driver (DOS 4) or redirector block (DOS 5+) for
this drive, 00000000h if native DOS
56h WORD available for use by IFS driver
Notes: the path for invalid drives is normally set to X:\, but may be empty
after JOIN x: /D in DR-DOS 5.0 or NET USE x: /D in older LAN versions
normally, only one of bits 13&12 may be set together with bit 14, but
DR-DOS 5.0 uses other combinations for bits 15-12: 0111 JOIN,
0001 SUBST, 0101 ASSIGN (see #0931)
Windows for Workgroups 3.11 network sets the path to the local
drive and directory even for network drives; in that case the
UNC form \\SERVER\SHARE can be obtained with INT 21/AX=5F02h
or INT 21/AX=5F46h. LapLink RemoteAccess does the same even for
INT 21/AX=5F02h
SoftWindows on the Macintosh PowerPC sets \\E for the host drive
SeeAlso: #0931

Format of DR-DOS 5.0-6.0 current directory structure entry (array):
Offset Size Description (Table 0931)
00h 67 BYTEs ASCIZ pathname of actual root directory for this logical drive
43h WORD drive attributes
1000h SUBSTed drive
3000h??? JOINed drive
4000h physical drive
5000h ASSIGNed drive
7000h JOINed drive
8000h network drive
45h BYTE physical drive number (0=A:) if this logical drive is valid
46h BYTE ??? apparently flags for JOIN and ASSIGN
47h WORD cluster number of start of parent directory (0000h = root)
49h WORD entry number of current directory in parent directory
4Bh WORD cluster number of start of current directory
4Dh WORD used for media change detection (details not available)
4Fh WORD cluster number of SUBST/JOIN "root" directory
0000h if physical root directory
SeeAlso: #0930

Format of Windows NT Current Directory Structure (CDS) (array):
Offset Size Description (Table 0932)
00h 67 BYTEs ASCIZ path in form X:\ (does not show either current directory
or network path)
43h 4 BYTEs ???
Note: the WinNT CDS contains only as many entries as there are local drives,
not LASTDRIVE entries.

Format of DOS device driver header:
Offset Size Description (Table 0933)
00h DWORD pointer to next driver, offset=FFFFh if last driver
04h WORD device attributes (see #0934,#0935)
06h WORD device strategy entry point
call with ES:BX -> request header
(see #1845 at INT 2F/AX=0802h)
08h WORD device interrupt entry point
---character device---
0Ah 8 BYTEs blank-padded character device name
---block device---
0Ah BYTE number of subunits (drives) supported by driver
0Bh 7 BYTEs normally unused; sometimes contains signature to indicate
specific drivers:
"GFS " LapLink III device driver DD.BIN
"STAC-CD" Stacker/Stacker Anywhere (see AX=4404h"Stacker")
"SIDExxx" PCMCIA driver ATADRV.EXE (see AX=440Dh)
"$PCMATA" PCMCIA driver PCMATA.SYS (see AX=440Dh)
"DSKREET" NortonUtils v5+ Diskreet (see INT 2F/AX=FE00h)
"DBLSPAC" MS DoubleSpace or DriveSpace
---DoubleSpace/DriveSpace---
12h 2 BYTEs signature ",." (2Ch 2Eh)
14h var preloading API entry point
---CD-ROM---
12h WORD reserved, must be 0000h
appears to be another device chain
14h BYTE drive letter (must initially be 00h; this byte is set by
MSCDEX when it loads)
15h BYTE number of units
16h 6 BYTEs signature 'MSCDnn' where 'nn' is version (currently '00')
SeeAlso: #1803 at INT 25/AX=CDCDh,#2030 at INT 2F/AX=5600h

Bitfields for device attributes (character device):
Bit(s) Description (Table 0934)
15 set (indicates character device)
14 IOCTL supported (see AH=44h)
13 (DOS 3.0+) output until busy supported
12 reserved
11 (DOS 3.0+) OPEN/CLOSE/RemMedia calls supported
10-8 reserved
7 (DOS 5.0+) Generic IOCTL check call supported (driver command 19h)
(see AX=4410h,AX=4411h)
6 (DOS 3.2+) Generic IOCTL call supported (driver command 13h)
(see AX=440Ch,AX=440Dh)
5 reserved
4 device is special (use INT 29 "fast console output")
3 device is CLOCK$ (all reads/writes use transfer record described
below)
2 device is NUL
1 device is standard output
0 device is standard input
Note: for European MS-DOS 4.0, bit 11 also indicates that bits 8-6 contain a
version code (000 = DOS 3.0,3.1; 001 = DOS 3.2;
010 = European DOS 4.0)
SeeAlso: #0935,#0933

Bitfields for device attributes (block device):
Bit(s) Description (Table 0935)
15 clear (indicates block device)
14 IOCTL supported
13 non-IBM format
12 network device (device is remote)
11 (DOS 3.0+) OPEN/CLOSE/RemMedia calls supported
10 reserved
9 direct I/O not allowed??? (set by DOS 3.3 DRIVER.SYS for "new" drives)
8 ??? set by DOS 3.3 DRIVER.SYS for "new" drives
7 (DOS 5.0+) Generic IOCTL check call supported (driver command 19h)
(see AX=4410h,AX=4411h)
6 (DOS 3.2+) Generic IOCTL call supported (driver command 13h)
implies support for commands 17h and 18h
(see AX=440Ch,AX=440Dh,AX=440Eh,AX=440Fh)
5-2 reserved
1 driver supports 32-bit sector addressing (DOS 3.31+)
0 reserved
Note: for European MS-DOS 4.0, bit 11 also indicates that bits 8-6 contain a
version code (000 = DOS 3.0,3.1; 001 = DOS 3.2;
010 = European DOS 4.0)
SeeAlso: #0934,#0933

Format of DOS 2.x disk buffer:
Offset Size Description (Table 0936)
00h DWORD pointer to next disk buffer, offset = FFFFh if last
least-recently used buffer is first in chain
04h BYTE drive (0=A, 1=B, etc), FFh if not in use
05h 3 BYTEs unused??? (seems always to be 00h 00h 01h)
08h WORD logical sector number
0Ah BYTE number of copies to write (1 for non-FAT sectors)
0Bh BYTE sector offset between copies if multiple copies to be written
0Ch DWORD pointer to DOS Drive Parameter Block (see #0694 at AH=32h)
10h buffered data
SeeAlso: #0937,#0939,#0940,#0942

Format of DOS 3.x disk buffer:
Offset Size Description (Table 0937)
00h DWORD pointer to next disk buffer, offset = FFFFh if last
least-recently used buffer is first in chain
04h BYTE drive (0=A,1=B, etc), FFh if not in use
05h BYTE buffer flags (see #0938)
06h WORD logical sector number
08h BYTE number of copies to write (1 for non-FAT sectors)
09h BYTE sector offset between copies if multiple copies to be written
0Ah DWORD pointer to DOS Drive Parameter Block (see #0694 at AH=32h)
0Eh WORD unused??? (almost always 0)
10h buffered data
SeeAlso: #0936,#0939,#0940,#0942

Bitfields for DOS 3.x disk buffer flags:
Bit(s) Description (Table 0938)
7 ???
6 buffer dirty
5 buffer has been referenced
4 ???
3 sector in data area
2 sector in a directory, either root or subdirectory
1 sector in FAT
0 boot sector??? (guess)
SeeAlso: #0943

Format of DOS 4.00 (pre UR 25066) disk buffer info:
Offset Size Description (Table 0939)
00h DWORD pointer to array of disk buffer hash chain heads (see #0941)
04h WORD number of disk buffer hash chains (referred to as NDBCH below)
06h DWORD pointer to lookahead buffer, zero if not present
0Ah WORD number of lookahead sectors, else zero (the y in BUFFERS=x,y)
0Ch BYTE 00h if buffers in EMS (/X), FFh if not
0Dh WORD EMS handle for buffers, zero if not in EMS
0Fh WORD EMS physical page number used for buffers (usually 255)
11h WORD ??? seems always to be 0001h
13h WORD segment of EMS physical page frame
15h WORD ??? seems always to be zero
17h 4 WORDs EMS partial page mapping information???
SeeAlso: #0936,#0937,#0940,#0944

Format of DOS 4.01 (from UR 25066 Corrctive Services Disk on) disk buffer info:
Offset Size Description (Table 0940)
00h DWORD pointer to array of disk buffer hash chain heads (see #0941)
04h WORD number of disk buffer hash chains (referred to as NDBCH below)
06h DWORD pointer to lookahead buffer, zero if not present
0Ah WORD number of lookahead sectors, else zero (the y in BUFFERS=x,y)
0Ch BYTE 01h, possibly to distinguish from pre-UR 25066 format
0Dh WORD ??? EMS segment for BUFFERS (only with /XD)
0Fh WORD ??? EMS physical page number of EMS seg above (only with /XD)
11h WORD ??? EMS segment for ??? (only with /XD)
13h WORD ??? EMS physical page number of above (only with /XD)
15h BYTE ??? number of EMS page frames present (only with /XD)
16h WORD segment of one-sector workspace buffer allocated in main memory
if BUFFERS/XS or /XD options in effect, possibly to avoid DMA
into EMS
18h WORD EMS handle for buffers, zero if not in EMS
1Ah WORD EMS physical page number used for buffers (usually 255)
1Ch WORD ??? appears always to be 0001h
1Eh WORD segment of EMS physical page frame
20h WORD ??? appears always to be zero
22h BYTE 00h if /XS, 01h if /XD, FFh if BUFFERS not in EMS
SeeAlso: #0936,#0937,#0939,#0944

Format of DOS 4.x disk buffer hash chain head (array, one entry per chain):
Offset Size Description (Table 0941)
00h WORD EMS logical page number in which chain is resident, -1 if not
in EMS
02h DWORD pointer to least recently used buffer header. All buffers on
this chain are in the same segment.
06h BYTE number of dirty buffers on this chain
07h BYTE reserved (00h)
Notes: buffered disk sectors are assigned to chain N where N is the sector's
address modulo NDBCH, 0 <= N <= NDBCH-1
each chain resides completely within one EMS page
this structure is in main memory even if buffers are in EMS

Format of DOS 4.0-6.0 disk buffer:
Offset Size Description (Table 0942)
00h WORD forward ptr, offset only, to next least recently used buffer
02h WORD backward pointer, offset only
04h BYTE drive (0=A,1=B, etc) if bit 7 clear
SFT index if bit 7 set
FFh if not in use
05h BYTE buffer flags (see #0943)
06h DWORD logical sector number (local buffers only)
0Ah BYTE number of copies to write
for FAT sectors, same as number of FATs
for data and directory sectors, usually 1
0Bh WORD offset in sectors between copies to write for FAT sectors
0Dh DWORD pointer to DOS Drive Parameter Block (see #0694 at AH=32h)
11h WORD size of data in buffer if remote buffer (see flags above)
13h BYTE reserved (padding)
14h buffered data
Note: for DOS 4.x, all buffered sectors which have the same hash value
(computed as the sum of high and low words of the logical sector
number divided by the number of disk buffer chains) are on the same
doubly-linked circular chain; for DOS 5+, only a single circular
chain exists.
the links consist of offset addresses only, the segment being the same
for all buffers in the chain.
SeeAlso: #0936,#0937,#0939

Bitfields for DOS 4.0-6.0 disk buffer flags:
Bit(s) Description (Table 0943)
7 remote buffer
6 buffer dirty
5 buffer has been referenced (reserved in DOS 5+)
4 search data buffer (only valid if remote buffer)
3 sector in data area
2 sector in a directory, either root or subdirectory
1 sector in FAT
0 reserved
SeeAlso: #0938

Format of DOS 5.0-6.0 disk buffer info:
Offset Size Description (Table 0944)
00h DWORD pointer to least-recently-used buffer header (may be in HMA)
(see #0942)
04h WORD number of dirty disk buffers
06h DWORD pointer to lookahead buffer, zero if not present
0Ah WORD number of lookahead sectors, else zero (the y in BUFFERS=x,y)
0Ch BYTE buffer location
00h base memory, no workspace buffer
01h HMA, workspace buffer in base memory
0Dh DWORD pointer to one-segment workspace buffer in base memory
11h 3 BYTEs unused
14h WORD ???
16h BYTE flag: INT 24 fail while making an I/O status call
17h BYTE temp storage for user memory allocation strategy during EXEC
18h BYTE counter: number of INT 21 calls for which A20 is off
19h BYTE bit flags
bit 0: ???
bit 1: SWITCHES=/W specified in CONFIG.SYS (don't load
WINA20.SYS when MS Windows 3.0 starts)
bit 2: in EXEC state (INT 21/AX=4B05h)
1Ah WORD offset of unpack code start (used only during INT 21/AX=4B05h)
1Ch BYTE bit 0 set iff UMB MCB chain linked to normal MCB chain
1Dh WORD minimum paragraphs of memory required by program being EXECed
1Fh WORD segment of first MCB in upper memory blocks or FFFFh if DOS
memory chain in base 640K only (first UMB MCB usually at
9FFFh, locking out video memory with a DOS-owned memory
block)
the MCB this word points at contains a valid link into high
memory even if it is marked with a 'Z' indicating the last
memory block
21h WORD paragraph from which to start scanning during memory allocation
SeeAlso: #0939,#0940

(Table 0945)
Call IFS utility function entry point with:
AH = 20h miscellaneous functions
AL = 00h get date
Return: CX = year
DH = month
DL = day
AL = 01h get process ID and computer ID
Return: BX = current PSP segment
DX = active network machine number
AL = 05h get file system info
ES:DI -> 16-byte info buffer
Return: buffer filled
Offset Size Description
00h 2 BYTEs unused
02h WORD number of SFTs (actually counts only
the first two file table arrays)
04h WORD number of FCB table entries
06h WORD number of proctected FCBs
08h 6 BYTEs unused
0Eh WORD largest sector size supported
AL = 06h get machine name
ES:DI -> 18-byte buffer for name
Return: buffer filled with name starting at offset 02h
AL = 08h get sharing retry count
Return: BX = sharing retry count
AL = other
Return: CF set
AH = 21h get redirection state
BH = type (03h disk, 04h printer)
Return: BH = state (00h off, 01h on)
AH = 22h ??? some sort of time calculation
AL = 00h ???
nonzero ???
AH = 23h ??? some sort of time calculation
AH = 24h compare filenames
DS:SI -> first ASCIZ filename
ES:DI -> second ASCIZ filename
Return: ZF set if files are same ignoring case and / vs \
AH = 25h normalize filename
DS:SI -> ASCIZ filename
ES:DI -> buffer for result
Return: filename uppercased, forward slashes changed to backslashes
AH = 26h get DOS stack
Return: DS:SI -> top of stack
CX = size of stack in bytes
AH = 27h increment InDOS flag
AH = 28h decrement InDOS flag
Note: IFS drivers which do not wish to implement functions 20h or 24h-28h may
pass them on to the default handler pointed at by [LoL+37h]
SeeAlso: #0946,#0947

Format of IFS driver list:
Offset Size Description (Table 0946)
00h DWORD pointer to next driver header
04h 8 BYTEs IFS driver name (blank padded), as used by FILESYS command
0Ch 4 BYTEs ???
10h DWORD pointer to IFS utility function entry point (see #0945)
call with ES:BX -> IFS request (see #0947)
14h WORD offset in header's segment of driver entry point
???
SeeAlso: #0945,#0947

Format of IFS request block:
Offset Size Description (Table 0947)
00h WORD total size in bytes of request
02h BYTE class of request
02h ???
03h redirection
04h ???
05h file access
06h convert error code to string
07h ???
03h WORD returned DOS error code
05h BYTE IFS driver exit status
00h success
01h ???
02h ???
03h ???
04h ???
FFh internal failure
06h 16 BYTEs ???
---request class 02h---
16h BYTE function code
04h ???
17h BYTE unused???
18h DWORD pointer to ???
1Ch DWORD pointer to ???
20h 2 BYTEs ???
---request class 03h---
16h BYTE function code
17h BYTE ???
18h DWORD pointer to ???
1Ch DWORD pointer to ???
22h WORD returned ???
24h WORD returned ???
26h WORD returned ???
28h BYTE returned ???
29h BYTE unused???
---request class 04h---
16h DWORD pointer to ???
1Ah DWORD pointer to ???
---request class 05h---
16h BYTE function code
01h flush disk buffers
02h get disk space
03h MKDIR
04h RMDIR
05h CHDIR
06h delete file
07h rename file
08h search directory
09h file open/create
0Ah LSEEK
0Bh read from file
0Ch write to file
0Dh lock region of file
0Eh commit/close file
0Fh get/set file attributes
10h printer control
11h ???
12h process termination
13h ???
---class 05h function 01h---
17h 7 BYTEs ???
1Eh DWORD pointer to ???
22h 4 BYTEs ???
26h BYTE ???
27h BYTE ???
---class 05h function 02h---
17h 7 BYTEs ???
1Eh DWORD pointer to ???
22h 4 BYTEs ???
26h WORD returned total clusters
28h WORD returned sectors per cluster
2Ah WORD returned bytes per sector
2Ch WORD returned available clusters
2Eh BYTE returned ???
2Fh BYTE ???
---class 05h functions 03h,04h,05h---
17h 7 BYTEs ???
1Eh DWORD pointer to ???
22h 4 BYTEs ???
26h DWORD pointer to directory name
---class 05h function 06h---
17h 7 BYTEs ???
1Eh DWORD pointer to ???
22h 4 BYTEs ???
26h WORD attribute mask
28h DWORD pointer to filename
---class 05h function 07h---
17h 7 BYTEs ???
1Eh DWORD pointer to ???
22h 4 BYTEs ???
26h WORD attribute mask
28h DWORD pointer to source filespec
2Ch DWORD pointer to destination filespec
---class 05h function 08h---
17h 7 BYTEs ???
1Eh DWORD pointer to ???
22h 4 BYTEs ???
26h BYTE 00h FINDFIRST
01h FINDNEXT
28h DWORD pointer to FindFirst search data + 01h if FINDNEXT
2Ch WORD search attribute if FINDFIRST
2Eh DWORD pointer to filespec if FINDFIRST
---class 05h function 09h---
17h 7 BYTEs ???
1Eh DWORD pointer to ???
22h DWORD pointer to IFS open file structure (see #0948)
26h WORD ??? \ together, specify open vs. create, whether or
28h WORD ??? / not to truncate
2Ah 4 BYTEs ???
2Eh DWORD pointer to filename
32h 4 BYTEs ???
36h WORD file attributes on call
returned ???
38h WORD returned ???
---class 05h function 0Ah---

17h 7 BYTEs ???
1Eh DWORD pointer to ???
22h DWORD pointer to IFS open file structure (see #0948)
26h BYTE seek type (02h = from end)
28h DWORD offset on call
returned new absolute position
---class 05h functions 0Bh,0Ch---
17h 7 BYTEs ???
1Eh DWORD pointer to ???
22h DWORD pointer to IFS open file structure (see #0948)
28h WORD number of bytes to transfer
returned bytes actually transferred
2Ah DWORD transfer address
---class 05h function 0Dh---
17h 7 BYTEs ???
1Eh DWORD pointer to ???
22h DWORD pointer to IFS open file structure (see #0948)
26h BYTE file handle???
27h BYTE unused???
28h WORD ???
2Ah WORD ???
2Ch WORD ???
2Eh WORD ???
---class 05h function 0Eh---
17h 7 BYTEs ???
1Eh DWORD pointer to ???
22h DWORD pointer to IFS open file structure (see #0948)
26h BYTE 00h commit file
01h close file
27h BYTE unused???
---class 05h function 0Fh---
17h 7 BYTEs ???
1Eh DWORD pointer to ???
22h 4 BYTEs ???
26h BYTE 02h GET attributes
03h PUT attributes
27h BYTE unused???
28h 12 BYTEs ???
34h WORD search attributes???
36h DWORD pointer to filename
3Ah WORD (GET) returned ???
3Ch WORD (GET) returned ???
3Eh WORD (GET) returned ???
40h WORD (GET) returned ???
42h WORD (PUT) new attributes
(GET) returned attributes
---class 05h function 10h---
17h 7 BYTEs ???
1Eh DWORD pointer to ???
22h DWORD pointer to IFS open file structure (see #0948)
26h WORD ???
28h DWORD pointer to ???
2Ch WORD ???
2Eh BYTE ???
2Fh BYTE subfunction
01h get printer setup
03h ???
04h ???
05h ???
06h ???
07h ???
21h set printer setup
---class 05h function 11h---
17h 7 BYTEs ???
1Eh DWORD pointer to ???
22h DWORD pointer to IFS open file structure (see #0948)
26h BYTE subfunction
27h BYTE unused???
28h WORD ???
2Ah WORD ???
2Ch WORD ???
2Eh BYTE ???
2Fh BYTE ???
---class 05h function 12h---
17h 15 BYTEs unused???
26h WORD PSP segment
28h BYTE type of process termination
29h BYTE unused???
---class 05h function 13h---
17h 15 BYTEs unused???
26h WORD PSP segment
---request class 06h---
16h DWORD returned pointer to string corresponding to error code at 03h
1Ah BYTE returned ???
1Bh BYTE unused
---request class 07h---
16h DWORD pointer to IFS open file structure (see #0948)
1Ah BYTE ???
1Bh BYTE unused???
SeeAlso: #0946,#0945,#0948

Format of IFS open file structure:
Offset Size Description (Table 0948)
00h WORD ???
02h WORD device info word
04h WORD file open mode
06h WORD ???
08h WORD file attributes
0Ah WORD owner's network machine number
0Ch WORD owner's PSP segment
0Eh DWORD file size
12h DWORD current offset in file
16h WORD file time
18h WORD file date
1Ah 11 BYTEs filename in FCB format
25h WORD ???
27h WORD hash value of SFT address
(low word of linear address + segment&F000h)
29h 3 WORDs network info from SFT
2Fh WORD ???

Format of one item in DOS 4.0+ list of special program names:
Offset Size Description (Table 0949)
00h BYTE length of name (00h = end of list)
01h N BYTEs name in format name.ext
N 2 BYTEs DOS version to return for program (major,minor)
(see AH=30h,INT 2F/AX=122Fh)
---DOS 4 only---
N+2 BYTE number of times to return fake version number (FFh = always)
Note: if the name of the executable for the program making the DOS "get
version" call matches one of the names in this list, DOS returns the
specified version rather than the true version number
--------v-215252-----------------------------
INT 21 - VIRUS - "516"/"Leapfrog" - INSTALLATION CHECK
AX = 5252h
Return: BX = FFEEh if resident
SeeAlso: AX=4BFFh"Cascade",AX=58CCh
--------D-2153-------------------------------
INT 21 - DOS 2+ internal - TRANSLATE BIOS PARAMETER BLOCK TO DRIVE PARAM BLOCK
AH = 53h
DS:SI -> BIOS Parameter Block (see #0950)
ES:BP -> buffer for Drive Parameter Block (see #0694 at AH=32h)
Return: ES:BP buffer filled
Notes: for DOS 3.0+, the cluster at which to start searching is set to 0000h
and the number of free clusters is set to FFFFh (unknown)
if the number of sectors per cluster is set to zero, MS-DOS will hang
at startup because it computes the internally-used shift count by
shifting this value right until the carry flag is set; since this
will never happen when the field is zero, MS-DOS hangs

Format of BIOS Parameter Block:
Offset Size Description (Table 0950)
00h WORD number of bytes per sector
02h BYTE number of sectors per cluster
03h WORD number of reserved sectors at start of disk
05h BYTE number of FATs
06h WORD number of entries in root directory
08h WORD total number of sectors
for DOS 4.0+, set to zero if partition >32M, then set DWORD at
15h to actual number of sectors
0Ah BYTE media ID byte (see #0655)
0Bh WORD number of sectors per FAT
---DOS 2.13---
0Dh WORD number of sectors per track
0Fh WORD number of heads
11h WORD number of hidden sectors
---DOS 3.0+ ---
0Dh WORD number of sectors per track
0Fh WORD number of heads
11h DWORD number of hidden sectors
15h 11 BYTEs reserved
---DOS 4.0+ ---
15h DWORD total number of sectors if word at 08h contains zero
19h 6 BYTEs ???
1Fh WORD number of cylinders
21h BYTE device type
22h WORD device attributes (removable or not, etc)
---DR-DOS 5+ ---
15h DWORD total number of sectors if word at 08h contains zero
19h 6 BYTEs reserved
---European MS-DOS 4.00---
15h DWORD total number of sectors if word at 08h contains zero
(however, this DOS does not actually implement >32M partitions)
SeeAlso: #0694
--------D-2154-------------------------------
INT 21 - DOS 2+ - GET VERIFY FLAG
AH = 54h
Return: AL = verify flag
00h off
01h on (all disk writes verified after writing)
SeeAlso: AH=2Eh
--------D-2155-------------------------------
INT 21 - DOS 2+ internal - CREATE CHILD PSP
AH = 55h
DX = segment at which to create new PSP
SI = (DOS 3.0+) value to place in memory size field at DX:[0002h]
Return: CF clear if successful
Notes: creates a "child" PSP rather than making an exact copy of the current
PSP; the new PSP's parent pointer is set to the current PSP and the
reference count for each inherited file is incremented
(DOS 2.0+) sets current PSP to DX
(DOS 3.0+) marks "no inherit" file handles as closed in child PSP
BUG: OS/2 Warp's DOS box does not clear CF on success, instead leaving it
in its former state; to work around this, ensure that CF is clear
before calling
SeeAlso: AH=26h,AH=50h
--------D-2156-------------------------------
INT 21 - DOS 2+ - "RENAME" - RENAME FILE
AH = 56h
DS:DX -> ASCIZ filename of existing file (no wildcards, but see below)
ES:DI -> ASCIZ new filename (no wildcards)
CL = attribute mask (server call only, see below)
Return: CF clear if successful
CF set on error
AX = error code (02h,03h,05h,11h) (see #0960)
Notes: allows move between directories on same logical volume
this function does not set the archive attribute
(see #0717 at AX=4301h), which results in incremental backups not
backing up the file under its new name
open files should not be renamed
(DOS 3.0+) allows renaming of directories
(DOS 3.1+) wildcards are allowed if invoked via AX=5D00h, in which case
error 12h (no more files) is returned on success, and both source and
destination specs must be canonical (as returned by AH=60h).
Wildcards in the destination are replaced by the corresponding char
of each source file being renamed. Under DOS 3.x, the call will fail
if the destination wildcard is *.* or equivalent; under DR-DOS 5.0,
the call will fail if any wildcards are used. When invoked via
AX=5D00h, only those files matching the attribute mask in CL are
renamed.
under the FlashTek X-32 DOS extender, the old-name pointer is in DS:EDX
and the new-name pointer is in ES:EDI (DS must equal ES)
(DOS 2.x only) this function renames file by creating a new directory
entry with the new name,then marking the old entry deleted
BUG: under DR-DOS 3.41, this function will generate a new directory entry
with the new name (including any wildcards) which can only be removed
with a sector editor when invoked via AX=5D00h
SeeAlso: AH=17h,AX=4301h,AX=5D00h,AH=60h,AH=71h,AX=F257h/SF=04h
--------v-215643------------------------
INT 21 - VIRUS - "PS-MPC.Gold" - INSTALLATION CHECK
AX = 5643h ('VC')
Return: AX = 5053h ('PS') if resident
SeeAlso: AX=33E0h"VIRUS",AX=6303h"VIRUS"
--------D-215700-----------------------------
INT 21 - DOS 2+ - GET FILE'S DATE AND TIME
AX = 5700h
BX = file handle
Return: CF clear if successful
CX = file's time (see #0951)
DX = file's date (see #0952)
CF set on error
AX = error code (01h,06h) (see #0960)
Note: under DR-DOS 3.41 and 5.0, this function returns 0 (no date/time) for
character devices; MS-DOS returns date and time of opening
SeeAlso: AX=5701h

Bitfields for file time:
Bit(s) Description (Table 0951)
15-11 hours (0-23)
10-5 minutes
4-0 seconds/2

Bitfields for file date:
Bit(s) Description (Table 0952)
15-9 year - 1980
8-5 month
4-0 day
--------D-215701-----------------------------
INT 21 - DOS 2+ - SET FILE'S DATE AND TIME
AX = 5701h
BX = file handle
CX = new time (see #0951)
DX = new date (see #0952)
Return: CF clear if successful
CF set on error
AX = error code (01h,06h) (see #0960)
SeeAlso: AX=5700h
--------D-215702-----------------------------
INT 21 - DOS 4.x only - GET EXTENDED ATTRIBUTES FOR FILE
AX = 5702h
BX = file handle
CX = size of result buffer or 0000h
DS:SI -> EAP list (see #0953)
ES:DI -> buffer for returned EAV list (see #0956)
Return: CF clear if successful
CX = size of returned data
CF set on error
AX = error code (see #0960)
Desc: get the current value of one or more extended attributes
Notes: if CX=0000h on entry, ES:DI is ignored and no data is actually
returned, only the amount of data which is available
the default DOS 4 behavior is to return a single word of 0000h (no
structures) in the result buffer if CX>=0002h on entry
SeeAlso: AX=5703h,AX=5704h,AH=6Eh,INT 2F/AX=112Dh

Format of EAP (extended attribute properties) list:
Offset Size Description (Table 0953)
00h WORD number of EAP structures following
02h var array of EAP structures (see #0954)
SeeAlso: #0956

Format of EAP (extended attribute property) structure:
Offset Size Description (Table 0954)
00h BYTE attribute type
01h boolean (either 00h or 01h)
02h number (BYTE, WORD, or DWORD)
03h string
04h date stamp
05h time stamp
01h WORD EAP flags (see #0955)
03h BYTE size of reference string (name)
04h N BYTEs reference string

Bitfields for EAP flags:
Bit(s) Description (Table 0955)
12 unchangeable
13 ignore
14 unchangeable
15 used by COMMAND.COM for code page, but not understood by ATTRIB

Format of EAV (extended attribute value) list:
Offset Size Description (Table 0956)
00h WORD number of EAV structures following
02h var array of Extended Attribute Value structures (see #0957)
SeeAlso: #0953

Format of Extended Attribute Value structures:
Offset Size Description (Table 0957)
00h 4 BYTEs ???
04h BYTE size of reference string
05h WORD size of value
07h var reference string
var value
--------O-215702-----------------------------
INT 21 - OS/2 v1.1+ Family API - DosQFileInfo
AX = 5702h
BX = file handle
CX = size of buffer for information
DX = level of information
ES:DI -> buffer for information
Return: CF clear if successful
CF set on error
AX = error code
SeeAlso: AX=5702h/BX=FFFFh,AX=5703h"OS/2"
--------O-215702BXFFFF-----------------------
INT 21 - OS/2 v1.1+ Compatibility Box Family API - DosQPathInfo
AX = 5702h
BX = FFFFh
CX = size of buffer for information
DX = level of information (0002h)
DS:SI -> filename
ES:DI -> buffer for FAPI path information (see #0958)
Return: CF clear if successful
AL = 00h
CF set on error
AX = error code
SeeAlso: AX=5702h"OS/2",AX=5703h/BX=FFFFh

Format of FAPI path information:
Offset Size Description (Table 0958)
00h 22 BYTEs ???
16h DWORD extended attribute size (none present if less than 5)
--------D-215703-----------------------------
INT 21 - DOS 4.x only - GET EXTENDED ATTRIBUTE PROPERTIES
AX = 5703h
BX = file handle
CX = size of result buffer or 0000h
ES:DI -> result buffer
Return: CF clear if successful
CX = size of returned data
CF set on error
AX = error code (see #0960)
ES:DI -> zero word (DOS 4.0) if CX >= 2 on entry
Desc: get a list of the extended attributes which are defined for the
specified file
Notes: if CX=0000h on entry, ES:DI is ignored and no data is actually
returned, only the amount of data which is available
the default DOS 4 behavior is to return a trivial EAP list consisting
of the single word 0000h (no EAP structures) if CX>=0002h on entry
SeeAlso: AX=5702h,AX=5704h,AH=6Eh,INT 2F/AX=112Dh
--------O-215703-----------------------------
INT 21 - OS/2 v1.1+ Family API - DosSetFileInfo
AX = 5703h
BX = file handle
CX = size of information buffer
DX = level of information
ES:DI -> information buffer
Return: CF clear if successful
CF set on error
AX = error code
SeeAlso: AX=5702h"OS/2",AX=5703h/BX=FFFFh
--------O-215703BXFFFF-----------------------
INT 21 - OS/2 v1.1+ Family API - DosSetPathInfo
AX = 5703h
BX = FFFFh
CX = size of information buffer
DX = level of information
DS:SI -> filename
ES:DI -> information buffer
Return: CF clear if successful
CF set on error
AX = error code
SeeAlso: AX=5702h/BX=FFFFh,AX=5703h"OS/2"
--------D-215704-----------------------------
INT 21 - DOS 4.x only - SET EXTENDED ATTRIBUTES
AX = 5704h
BX = file handle
ES:DI -> EAV list (see #0956)
Return: CF clear if successful
CF set on error
AX = error code (see #0960)
Note: the default DOS 4 behavior is to do nothing and return successfully
SeeAlso: AX=5702h,AX=5703h,INT 2F/AX=112Dh
--------U-215757BX5757-----------------------
INT 21 U - IBM Genie - Resident Manager - INSTALLATION CHECK
AX = 5757h
BX = 5757h
Return: AX = 0000h if installed
BX = ???
DX = ???
DS:SI -> list of 27 DWORD entry point addresses
Program: IBM Genie is a set of utility TSRs by Helix Software
Note: other functions possible if BX <> 5757h, but details not yet available
----------215758-----------------------------
INT 21 U - Headroom - API
AX = 5758h
BL = function
00h ???
01h get Headroom location
Return: CF clear if installed
AX = PSP segment of Headroom TSR
BX = paragraphs of memory used by Headroom
CF set if not (normal DOS return)
Note: this function is also used as an installation check
02h get INT 21 handler
Return: CF clear
ES:BX -> Headroom's INT 21 handler
Note: also sets unknown flag
03h launch application???
DS:SI -> 233-byte application record
Return: ???
04h ???
???
Return: CF clear
05h get swap directory
Return: CF clear
DX:AX -> ASCIZ swap directory name
06h ???
DX = ???
Return: CF clear
07h ???
08h ???
09h get current application
Return: BX = application number
0Ah ???
DX = application number
DS:SI = ???
Return: ???
0Bh ???
0Ch ???
DX = application number
???
Return: ???
0Dh ???
DX = application number
???
Return: ???
0Eh get ???
Return: CF clear
AX = ???
0Fh set ??? flag
10h clear ??? flag
11h find application by name
DS:SI -> ASCIZ application name
Return: CF clear
AX = application number or FFFFh if not loaded
12h ???
DX = application number
Return: CF clear
???
13h ???
Return: CF clear
14h ???
same as function 13h
15h set ???
DX = ???
16h get ???
Return: AX = ??? set by function 15h
17h get ???
Return: BX = ???
CX = ??? (may be pointer in BX:CX)
18h BUG: branches incorrectly due to fencepost error
Program: Headroom is a TSR/task switcher by Helix Software
SeeAlso: AX=4C57h,AX=5757h,INT 2F/AX=5758h
--------D-2158-------------------------------
INT 21 - DOS 2.11+ - GET OR SET MEMORY ALLOCATION STRATEGY
AH = 58h
AL = subfunction
00h get allocation strategy
Return: AX = current strategy (see #0959)
01h set allocation strategy
BL = new allocation strategy (see #0959)
BH = 00h (DOS 5+)
Return: CF clear if successful
CF set on error
AX = error code (01h) (see #0960)
Notes: the Set subfunction accepts any value in BL for DOS 3.x and 4.x;
2 or greater means last fit
the Get subfunction returns the last value set
setting an allocation strategy involving high memory does not
automatically link in the UMB memory chain; this must be done
explicitly with AX=5803h in order to actually allocate high memory
a program which changes the allocation strategy should restore it
before terminating
Toshiba MS-DOS v2.11 supports subfunctions 00h and 01h, as does the
TI Professional MS-DOS v2.13
DR-DOS 3.41 reportedly reverses subfunctions 00h and 01h
SeeAlso: AH=48h,AH=49h,AH=4Ah,INT 2F/AX=4310h,INT 67/AH=3Fh

(Table 0959)
Values for DOS memory allocation strategy:
00h low memory first fit
01h low memory best fit
02h low memory last fit
---DOS 5+ ---
40h high memory first fit
41h high memory best fit
42h high memory last fit
80h first fit, try high then low memory
81h best fit, try high then low memory
82h last fit, try high then low memory
--------D-2158-------------------------------
INT 21 - DOS 5+ - GET OR SET UMB LINK STATE
AH = 58h
AL = subfunction
02h get UMB link state
Return: AL = current link state
00h UMBs not part of DOS memory chain
01h UMBs in DOS memory chain
03h set UMB link state
BX = new link state
0000h remove UMBs from DOS memory chain
0001h add UMBs to DOS memory chain
Return: CF clear if successful
CF set on error
AX = error code (01h) (see #0960)
Notes: a program which changes the UMB link state should restore it before
terminating
UMBs will only be available if CONFIG.SYS contains the line DOS=UMB,
the UMBs have been linked into the memory chain with AX=5803h, and
the allocation strategy has been set to include high memory with
AX=5801h
SeeAlso: #0967,#1955 at INT 2F/AX=4310h
--------v-2158CC-----------------------------
INT 21 - VIRUS - "1067"/"Headcrash" - INSTALLATION CHECK
AX = 58CCh
Return: CF clear if resident
SeeAlso: AX=5643h,AX=5252h,AX=58DDh,AX=6303h"VIRUS",AX=6969h
--------v-2158DD-----------------------------
INT 21 - VIRUS - "1067"/"Headcrash" - GET ORIGINAL INT 21h VECTOR
AX = 58DDh
Return: CX = code segment of virus
ES:BX = old INT 21h vector
SeeAlso: AX=5252h,AX=58CCh,AX=6969h
--------D-2159--BX0000-----------------------
INT 21 - DOS 3.0+ - GET EXTENDED ERROR INFORMATION
AH = 59h
BX = 0000h
Return: AX = extended error code (see #0960)
BH = error class (see #0962)
BL = recommended action (see #0963)
CH = error locus (see #0964)
ES:DI may be pointer (see #0961, error code list below)
CL, DX, SI, BP, and DS destroyed
Notes: functions available under DOS 2.x map the true DOS 3.0+ error code into
one supported under DOS 2.x
you should call this function to retrieve the true error code when an
FCB or DOS 2.x call returns an error
under DR-DOS 5.0, this function does not use any of the DOS-internal
stacks and may thus be called at any time
SeeAlso: AH=59h/BX=0001h,AX=5D0Ah,INT 2F/AX=122Dh

(Table 0960)
Values for DOS extended error code:
00h (0) no error
01h (1) function number invalid
02h (2) file not found
03h (3) path not found
04h (4) too many open files (no handles available)
05h (5) access denied
06h (6) invalid handle
07h (7) memory control block destroyed
08h (8) insufficient memory
09h (9) memory block address invalid
0Ah (10) environment invalid (usually >32K in length)
0Bh (11) format invalid
0Ch (12) access code invalid
0Dh (13) data invalid
0Eh (14) reserved
0Fh (15) invalid drive
10h (16) attempted to remove current directory
11h (17) not same device
12h (18) no more files
---DOS 3.0+ ---
13h (19) disk write-protected
14h (20) unknown unit
15h (21) drive not ready
16h (22) unknown command
17h (23) data error (CRC)
18h (24) bad request structure length
19h (25) seek error
1Ah (26) unknown media type (non-DOS disk)
1Bh (27) sector not found
1Ch (28) printer out of paper
1Dh (29) write fault
1Eh (30) read fault
1Fh (31) general failure
20h (32) sharing violation
21h (33) lock violation
22h (34) disk change invalid (ES:DI -> media ID structure)(see #0961)
23h (35) FCB unavailable
24h (36) sharing buffer overflow
25h (37) (DOS 4.0+) code page mismatch
26h (38) (DOS 4.0+) cannot complete file operation (out of input)
27h (39) (DOS 4.0+) insufficient disk space
28h-31h reserved
32h (50) network request not supported
33h (51) remote computer not listening
34h (52) duplicate name on network
35h (53) network name not found
36h (54) network busy
37h (55) network device no longer exists
38h (56) network BIOS command limit exceeded
39h (57) network adapter hardware error
3Ah (58) incorrect response from network
3Bh (59) unexpected network error
3Ch (60) incompatible remote adapter
3Dh (61) print queue full
3Eh (62) queue not full
3Fh (63) not enough space to print file
40h (64) network name was deleted
41h (65) network: Access denied
42h (66) network device type incorrect
43h (67) network name not found
44h (68) network name limit exceeded
45h (69) network BIOS session limit exceeded
46h (70) temporarily paused
47h (71) network request not accepted
48h (72) network print/disk redirection paused
49h (73) network software not installed
(LANtastic) invalid network version
4Ah (74) unexpected adapter close
(LANtastic) account expired
4Bh (75) (LANtastic) password expired
4Ch (76) (LANtastic) login attempt invalid at this time
4Dh (77) (LANtastic v3+) disk limit exceeded on network node
4Eh (78) (LANtastic v3+) not logged in to network node
4Fh (79) reserved
50h (80) file exists
51h (81) reserved
52h (82) cannot make directory
53h (83) fail on INT 24h
54h (84) (DOS 3.3+) too many redirections
55h (85) (DOS 3.3+) duplicate redirection
56h (86) (DOS 3.3+) invalid password
57h (87) (DOS 3.3+) invalid parameter
58h (88) (DOS 3.3+) network write fault
59h (89) (DOS 4.0+) function not supported on network
5Ah (90) (DOS 4.0+) required system component not installed
64h (100) (MSCDEX) unknown error
65h (101) (MSCDEX) not ready
66h (102) (MSCDEX) EMS memory no longer valid
67h (103) (MSCDEX) not High Sierra or ISO-9660 format
68h (104) (MSCDEX) door open
SeeAlso: #0962,#0963,#0964

Format of media ID structure:
Offset Size Description (Table 0961)
00h 12 BYTEs ASCIZ volume label of required disk
0Ch DWORD serial number (DOS 4.0+)

(Table 0962)
Values for DOS Error Class:
01h out of resource (storage space or I/O channels)
02h temporary situation (file or record lock)
03h authorization (denied access)
04h internal (system software bug)
05h hardware failure
06h system failure (configuration file missing or incorrect)
07h application program error
08h not found
09h bad format
0Ah locked
0Bh media error
0Ch already exists
0Dh unknown
SeeAlso: #0960,#0963,#0964

(Table 0963)
Values for DOS Suggested Action:
01h retry
02h delayed retry
03h prompt user to reenter input
04h abort after cleanup
05h immediate abort
06h ignore
07h retry after user intervention
SeeAlso: #0960,#0962,#0964

(Table 0964)
Values for DOS Error Locus:
01h unknown or not appropriate
02h block device (disk error)
03h network related
04h serial device (timeout)
05h memory related
SeeAlso: #0960,#0962,#0963
--------D-2159--BX0001-----------------------
INT 21 - European MS-DOS 4.0 - GET HARD ERROR INFORMATION
AH = 59h
BX = 0001h
Return: ES:DI -> hard error information packet (see #0965) for most recent
hard (critical) error
SeeAlso: AH=59h/BX=0000h,AH=95h,INT 24

Format of European MS-DOS 4.0 hard error information packet:
Offset Size Description (Table 0965)
00h WORD contents of AX at system entry
02h WORD Process ID which encountered error
04h WORD contents of AX at time of error
06h BYTE error type
00h physical I/O error
01h disk change request
02h file sharing violation
03h FCB problem
04h file locking violation
05h bad FAT
06h network detected error
07h BYTE INT 24 error code
08h WORD extended error code (see #0960)
0Ah DWORD pointer to associated device
--------D-215A-------------------------------
INT 21 - DOS 3.0+ - CREATE TEMPORARY FILE
AH = 5Ah
CX = file attribute (see #0717 at AX=4301h)
DS:DX -> ASCIZ path ending with a '\' + 13 zero bytes to receive the
generated filename
Return: CF clear if successful
AX = file handle opened for read/write in compatibility mode
DS:DX pathname extended with generated name for temporary file
CF set on error
AX = error code (03h,04h,05h) (see #0960)
Desc: creates a file with a unique name which must be explicitly deleted
BUGS: COMPAQ DOS 3.31 hangs if the pathname is at XXXXh:0000h; it apparently
wraps around to the end of the segment
MS-DOS 5.00 revisions A and B and PC-DOS 5.00 revision A reportedly
hang the system if the specified path is the root directory and the
root directory is full (no free directory entries)
Note: under the FlashTek X-32 DOS extender, the path pointer is in DS:EDX
SeeAlso: AH=3Ch,AH=5Bh
!!! hang if two consecutive path separators (C:\\ ) in DOS 6.2x
!!! (from Mark Incley )
--------D-215B-------------------------------
INT 21 - DOS 3.0+ - CREATE NEW FILE
AH = 5Bh
CX = file attribute (see #0717 at AX=4301h)
DS:DX -> ASCIZ filename
Return: CF clear if successful
AX = file handle opened for read/write in compatibility mode
CF set on error
AX = error code (03h,04h,05h,50h) (see #0960)
Notes: unlike AH=3Ch, this function will fail if the specified file exists
rather than truncating it; this permits its use in creating semaphore
files because it is an atomic "test and set" operation
under the FlashTek X-32 DOS extender, the filename pointer is in DS:EDX
SeeAlso: AH=3Ch,AH=5Ah
--------D-215C-------------------------------
INT 21 - DOS 3.0+ - "FLOCK" - RECORD LOCKING
AH = 5Ch
AL = subfunction
00h lock region of file
01h unlock region of file
BX = file handle
CX:DX = start offset of region within file
SI:DI = length of region in bytes
Return: CF clear if successful
CF set on error
AX = error code (01h,06h,21h,24h) (see #0960)
Notes: error returned unless SHARE or network installed
an unlock call must specify the same region as some prior lock call
locked regions become entirely inaccessible to other processes
duplicate handles created with AH=45h or AH=46h inherit locks, but
handles inherited by child processes (see AH=4Bh) do not
under DR-DOS 3.41 and 5.0, if a process opens a file without the no-
inherit flag and then starts a child, any locks set by the parent
are ignored, and the child will only get an error if it tries to
lock an area previously locked by the parent process
SeeAlso: AX=440Bh,AH=BCh,AH=BEh,INT 2F/AX=110Ah,INT 2F/AX=110Bh
--------D-215D00-----------------------------
INT 21 U - DOS 3.1+ internal - SERVER FUNCTION CALL
AX = 5D00h
DS:DX -> DOS parameter list (see #0966)
DPL contains all register values for a call to INT 21h
Return: as appropriate for function being called
Notes: does not check AH. Out of range values will crash the system
executes using specified computer ID and process ID
sharing delay loops skipped
a special sharing mode is enabled to handle FCBs opened across network
wildcards are enabled for DELETE (AH=41h) and RENAME (AH=56h) under
MS-DOS; under DR-DOS 3.41, wildcards corrupt the filesystem; and
under DR-DOS 5.0-6.0, the call returns error code 03h due to improper
support for the server function call (see below)
an extra file attribute parameter is enabled for OPEN (AH=3Dh),
DELETE (AH=41h), and RENAME (AH=56h)
functions which take filenames require canonical names (as returned
by AH=60h); this is apparently to prevent multi-hop file forwarding
BUGS: the OS/2 2.0 DOS Boot Session incorrectly maps DOS drive letters,
seemingly ignoring HPFS drives
DR-DOS 5.0-6.0 merely recursively call INT 21 after loading the
registers from the DPL, leading to problems for peer-to-peer
networks
SeeAlso: AH=3Dh,AH=41h,AH=56h,AH=60h

Format of DOS parameter list:
Offset Size Description (Table 0966)
00h WORD AX
02h WORD BX
04h WORD CX
06h WORD DX
08h WORD SI
0Ah WORD DI
0Ch WORD DS
0Eh WORD ES
10h WORD reserved (0)
12h WORD computer ID (0 = current system)
14h WORD process ID (PSP segment on specified computer)
Note: under Windows Enhanced mode, the computer ID is normally the virtual
machine ID (see INT 2F/AX=1683h), though this can reportedly be
changed by setting UniqueDOSPSP= in SYSTEM.INI
--------D-215D01-----------------------------
INT 21 U - DOS 3.1+ internal - COMMIT ALL FILES FOR SPECIFIED COMPUTER/PROCESS
AX = 5D01h
DS:DX -> DOS parameter list (see #0966), only computer ID and
process ID fields used
Return: CF set on error
AX = error code (see #0960)
CF clear if successful
Notes: flushes buffers and updates directory entries for each file which has
been written to; if remote file, calls INT 2F/AX=1107h
the computer ID and process ID are stored but ignored under DOS 3.3
not supported by DR-DOS 3.41 and 5.0; returns error code 01h
SeeAlso: AH=0Dh,AH=68h,INT 2F/AX=1107h
--------D-215D02-----------------------------
INT 21 U - DOS 3.1+ internal - SHARE.EXE - CLOSE FILE BY NAME
AX = 5D02h
DS:DX -> DOS parameter list (see #0966), only fields DX, DS,
computer ID, and process ID used
DPL's DS:DX -> ASCIZ name of file to close
Return: CF set on error
AX = error code (see #0960)
CF clear if successful
Notes: error unless SHARE is loaded (calls [SysFileTable-28h])
(see #0923 at AH=52h)
name must be canonical fully-qualified, such as returned by AH=60h
not supported by DR-DOS 3.41 and 5.0; returns error code 01h
not supported by Novell DOS 7
SeeAlso: AX=5D03h,AX=5D04h,AH=3Eh,AH=60h
--------D-215D03-----------------------------
INT 21 U - DOS 3.1+ internal - SHARE.EXE - CLOSE ALL FILES FOR GIVEN COMPUTER
AX = 5D03h
DS:DX -> DOS parameter list (see #0966), only computer ID used
Return: CF set on error
AX = error code (see #0960)
CF clear if successful
Notes: error unless SHARE is loaded (calls [SysFileTable-30h])
(see #0923 at AH=52h)
not supported by DR-DOS 3.41 and 5.0; returns error code 01h
not supported by Novell DOS 7
SeeAlso: AX=5D02h,AX=5D04h
--------D-215D04-----------------------------
INT 21 U - DOS 3.1+ internal - SHARE.EXE - CLOSE ALL FILES FOR GIVEN PROCESS
AX = 5D04h
DS:DX -> DOS parameter list (see #0966), only computer ID and
process ID fields used
Return: CF set on error
AX = error code (see #0960)
CF clear if successful
Notes: error unless SHARE is loaded (calls [SysFileTable-2Ch])
(see #0923 at AH=52h)
not supported by DR-DOS 3.41 and 5.0; returns error code 01h
not supported by Novell DOS 7
SeeAlso: AX=5D02h,AX=5D03h,INT 2F/AX=111Dh
--------D-215D05-----------------------------
INT 21 U - DOS 3.1+ internal - SHARE.EXE - GET OPEN FILE LIST ENTRY
AX = 5D05h
DS:DX -> DOS parameter list (see #0966)
DPL's BX = index of sharing record (see #0924 at AH=52h)
DPL's CX = index of SFT in sharing record's SFT list
Return: CF clear if successful
ES:DI -> ASCIZ filename
BX = network machine number of SFT's owner
CX = number of locks held by SFT's owner
CF set if either index out of range
AX = 0012h (no more files)
Notes: error unless SHARE is loaded (calls [SysFileTable-18h])
(see #0923 at AH=52h)
names are always canonical fully-qualified, such as returned by AH=60h
not supported by DR-DOS 3.41 and 5.0 and Novell DOS 7, but does not
return an error, instead destroying AX
SeeAlso: AH=5Ch,AH=60h
--------D-215D06-----------------------------
INT 21 U - DOS 3.0+ internal - GET ADDRESS OF DOS SWAPPABLE DATA AREA
AX = 5D06h
Return: CF set on error
AX = error code (see #0960)
CF clear if successful
DS:SI -> nonreentrant data area (includes all three DOS stacks)
(critical error flag is first byte) (see #0967)
CX = size in bytes of area which must be swapped while in DOS
DX = size in bytes of area which must always be swapped
Notes: the Critical Error flag is used in conjunction with the InDOS flag
(see AH=34h) to determine when it is safe to enter DOS from a TSR
setting CritErr flag allows use of functions 50h/51h from INT 28h under
DOS 2.x by forcing use of correct stack
swapping the data area allows reentering DOS unless DOS is in a
critical section delimited by INT 2A/AH=80h and INT 2A/AH=81h,82h
under DOS 4.0, AX=5D0Bh should be used instead of this function
SHARE and other DOS utilities consult the byte at offset 04h in the
DOS data segment (see INT 2F/AX=1203h) to determine the SDA format
in use: 00h = DOS 3.x, 01h = DOS 4.0-6.0, other = error.
DR-DOS 3.41+ supports this function, but the SDA format beyond the
first 18h bytes is completely different from MS-DOS
SeeAlso: AX=5D0Bh,INT 2A/AH=80h,INT 2A/AH=81h,INT 2A/AH=82h

Format of DOS 3.10-3.30 Swappable Data Area:
Offset Size Description (Table 0967)
-34 BYTE (DOS 3.10+) printer echo flag (00h off, FFh active)
-31 BYTE (DOS 3.30) current switch character
-30 BYTE current memory allocation strategy (see AH=58h)
-28 BYTE (DOS 3.30) incremented on each INT 21/AX=5E01h call
-27 16 BYTEs (DOS 3.30) machine name set by INT 21/AX=5E01h
-11 5 WORDs zero-terminated list of offsets which need to be patched to
enable critical-section calls (see INT 2A/AH=80h)
-1 BYTE unused padding
---start of actual SDA---
00h BYTE critical error flag ("ErrorMode")
01h BYTE InDOS flag (count of active INT 21 calls)
02h BYTE drive on which current critical error occurred, or FFh
(DR-DOS sets to drive number during INT 24, 00h otherwise)
03h BYTE locus of last error
04h WORD extended error code of last error
06h BYTE suggested action for last error
07h BYTE class of last error
08h DWORD ES:DI pointer for last error
0Ch DWORD current DTA (Disk Transfer Address)
note: may point into SDA during the DOS EXEC function
(see AH=4Bh), so programs which swap the SDA must be
prepared to move the DTA to a private buffer if they
might be invoked during an EXEC
10h WORD current PSP
12h WORD stores SP across an INT 23
14h WORD return code from last process termination (zerod after reading
with AH=4Dh)
16h BYTE current drive
17h BYTE extended break flag
---remainder need only be swapped if in DOS---
18h WORD value of AX on call to INT 21
1Ah WORD PSP segment for sharing/network
1Ch WORD network machine number for sharing/network (0000h = us)
1Eh WORD first usable memory block found when allocating memory
20h WORD best usable memory block found when allocating memory
22h WORD last usable memory block found when allocating memory
24h WORD memory size in paragraphs (used only during initialization)
26h WORD last entry checked during directory search
28h BYTE flag: INT 24 returned Fail
29h BYTE flags: allowable INT 24 actions (passed to INT 24 in AH)
2Ah BYTE directory flag (00h directory, 01h file)
2Bh BYTE flag: FFh if Ctrl-Break termination, 00h otherwise
2Ch BYTE flag: allow embedded blanks in FCB
2Dh BYTE padding (unused)
2Eh BYTE day of month
2Fh BYTE month
30h WORD year - 1980
32h WORD number of days since 1-1-1980
34h BYTE day of week (0 = Sunday)
35h BYTE flag: console swapped during read from device
36h BYTE flag: safe to call INT 28 if nonzero
37h BYTE flag: if nonzero, INT 24 Abort turned into INT 24 Fail
(set only during process termination)
38h 26 BYTEs device driver request header (see #1845 at INT 2F/AX=0802h)
52h DWORD pointer to device driver entry point (used in calling driver)
56h 22 BYTEs device driver request header for I/O calls
6Ch 14 BYTEs device driver request header for disk status check
7Ah DWORD pointer to device I/O buffer???
7Eh WORD ???
80h WORD ???
82h BYTE type of PSP copy (00h=simple for INT 21/AH=26h, FFh=make child)
83h BYTE padding (unused)
84h 3 BYTEs 24-bit user number (see AH=30h)
87h BYTE OEM number (see #0693 at AH=30h)
88h WORD offset to error code conversion table for INT 25/INT 26
8Ah 6 BYTEs CLOCK$ transfer record (see #0968)
90h BYTE device I/O buffer for single-byte I/O functions
91h BYTE padding??? (unused)
92h 128 BYTEs buffer for filename
112h 128 BYTEs buffer for filename
192h 21 BYTEs findfirst/findnext search data block (see #0913 at AH=4Eh)
1A7h 32 BYTEs directory entry for found file (see #0654 at AH=11h)
1C7h 81 BYTEs copy of current directory structure for drive being accessed
218h 11 BYTEs FCB-format filename for device name comparison
223h BYTE terminating NUL for above filename
224h 11 BYTEs wildcard destination specification for rename (FCB format)
22Fh BYTE terminating NUL for above spec
230h BYTE ???
231h WORD destination file/directory starting sector
233h 5 BYTEs ???
238h BYTE extended FCB file attribute
239h BYTE type of FCB (00h regular, FFh extended)
23Ah BYTE directory search attributes
23Bh BYTE file open/access mode
23Ch BYTE file found/delete flag
bit 0: file found
bit 4: file deleted
23Dh BYTE flag: device name found on rename, or file not found
23Eh BYTE splice flag (file name and directory name together)
23Fh BYTE flag indicating how DOS function was invoked
(00h = direct INT 20/INT 21, FFh = server call AX=5D00h)
240h BYTE sector position within cluster
241h BYTE flag: translate sector/cluster (00h no, 01h yes)
242h BYTE flag: 00h if read, 01h if write
243h BYTE current working drive number
244h BYTE cluster factor
245h BYTE flag: cluster split mode
246h BYTE line edit (AH=0Ah) insert mode flag (nonzero = on)
247h BYTE canonicalized filename referred to existing file/dir if FFh
248h BYTE volume ID flag
249h BYTE type of process termination (00h-03h) (see AH=4Dh)
24Ah BYTE file create flag (00h = no, search only)
24Bh BYTE value with which to replace first byte of deleted file's name
(normally E5h, but 00h as described under INT 21/AH=13h)
24Ch DWORD pointer to Drive Parameter Block for critical error invocation
temp: used during process termination
250h DWORD pointer to stack frame containing user registers on INT 21
254h WORD stores SP across INT 24
256h DWORD pointer to DOS Drive Parameter Block for ???
25Ah WORD saving partial cluster number
25Ch WORD temp: sector of work current cluster
25Eh WORD high part of cluster number (only low byte referenced)
260h WORD ??? temp
262h BYTE Media ID byte returned by AH=1Bh,1Ch
263h BYTE padding (unused)
264h DWORD pointer to device header when filename is character device
268h DWORD pointer to current SFT
26Ch DWORD pointer to current directory structure for drive being accessed
270h DWORD pointer to caller's FCB
274h WORD number of SFT to which file being opened will refer
276h WORD temporary storage for file handle
278h DWORD pointer to a JFT entry in process handle table
(see #0677 at AH=26h)
27Ch WORD offset in DOS DS of first filename argument
27Eh WORD offset in DOS DS of second filename argument
280h WORD offset of last component in pathname or FFFFh
282h WORD offset of transfer address to add
284h WORD last relative cluster within file being accessed
286h WORD temp: absolute cluster number being accessed
288h WORD directory sector number
28Ah WORD ??? current cluster number
28Ch WORD current relative sector number within file
28Eh WORD current sector number
290h WORD current byte offset within sector
292h DWORD current offset in file
296h DWORD temp: file byte count
29Ah WORD temp: file byte count
29Ch WORD free file cluster entry
29Eh WORD last file cluster entry
2A0h WORD next file cluster number
2A2h DWORD number of bytes appended to file
2A6h DWORD pointer to current work disk buffer
2AAh DWORD pointer to working SFT
2AEh WORD used by INT 21 dispatcher to store caller's BX
2B0h WORD used by INT 21 dispatcher to store caller's DS
2B2h WORD temporary storage while saving/restoring caller's registers
2B4h DWORD pointer to prev call frame (offset 250h) if INT 21 reentered
also switched to for duration of INT 24
2B8h 21 BYTEs FindFirst search data for source file(s) of a rename operation
(see #0913 at AH=4Eh)
2CDh 32 BYTEs directory entry for file being renamed (see #0654 at AH=11h)
2EDh 331 BYTEs critical error stack
403h 35 BYTEs scratch SFT
438h 384 BYTEs disk stack (functions greater than 0Ch, INT 25,INT 26)
5B8h 384 BYTEs character I/O stack (functions 01h through 0Ch)
---DOS 3.2,3.3x only---
738h BYTE device driver lookahead flag (usually printer) (see AH=64h)
739h BYTE volume change flag
73Ah BYTE flag: virtual open
73Bh BYTE ???
SeeAlso: #0970

Format of CLOCK$ transfer record:
Offset Size Description (Table 0968)
00h WORD number of days since 1-Jan-1980
02h BYTE minutes
03h BYTE hours
04h BYTE hundredths of second
05h BYTE seconds
--------D-215D07-----------------------------
INT 21 U - DOS 3.1+ network - GET REDIRECTED PRINTER MODE
AX = 5D07h
Return: DL = mode
00h redirected output is combined
01h redirected output in separate print jobs
SeeAlso: AX=5D08h,AX=5D09h,INT 2F/AX=1125h
--------D-215D08-----------------------------
INT 21 U - DOS 3.1+ network - SET REDIRECTED PRINTER MODE
AX = 5D08h
DL = mode
00h redirected output is combined
01h redirected output placed in separate jobs, start new print job
now
SeeAlso: AX=5D07h,AX=5D09h,INT 2F/AX=1125h
--------D-215D09-----------------------------
INT 21 U - DOS 3.1+ network - FLUSH REDIRECTED PRINTER OUTPUT
AX = 5D09h
Notes: forces redirected printer output to be printed, and starts a new print
job
this function is also supported by 10Net, which calls it Terminate All
Spool Jobs, and does not flush if in "combine" mode
SeeAlso: AX=5D07h,AX=5D08h,INT 2F/AX=1125h
--------D-215D0A-----------------------------
INT 21 - DOS 3.1+ - SET EXTENDED ERROR INFORMATION
AX = 5D0Ah
DS:DX -> 11-word DOS parameter list (see #0966)
Return: nothing. next call to AH=59h will return values from fields AX,BX,CX,
DX,DI, and ES in corresponding registers
Notes: documented for DOS 5+, but undocumented in earlier versions
the MS-DOS Programmer's Reference incorrectly states that this call was
introduced in DOS 4, and fails to mention that the ERROR structure
passed to this function is a DOS parameter list.
BUGS: DR-DOS 3.41 and 5.0 read the value for ES from the DS field of the
DPL; fortunately, MS-DOS ignores the DS field, allowing a generic
routine which sets both DS and ES fields to the same value
Novell DOS 7 does not save the pointer, which is always reported as
0000h:0000h by AH=59h
SeeAlso: AH=59h/BX=0000h
--------D-215D0B-----------------------------
INT 21 OU - DOS 4.x only internal - GET DOS SWAPPABLE DATA AREAS
AX = 5D0Bh
Return: CF set on error
AX = error code (see #0960)
CF clear if successful
DS:SI -> swappable data area list (see #0969)
Notes: copying and restoring the swappable data areas allows DOS to be
reentered unless it is in a critical section delimited by calls to
INT 2A/AH=80h and INT 2A/AH=81h,82h
SHARE and other DOS utilities consult the byte at offset 04h in the
DOS data segment (see INT 2F/AX=1203h) to determine the SDA format
in use: 00h = DOS 3.x, 01h = DOS 4.0-6.0, other = error.
DOS 5+ use the SDA format listed below, but revert back to the DOS 3.x
call for finding the SDA (see #0967)
SeeAlso: AX=5D06h,INT 2A/AH=80h,INT 2A/AH=81h,INT 2A/AH=82h,INT 2F/AX=1203h

Format of DOS 4.x swappable data area list:
Offset Size Description (Table 0969)
00h WORD count of data areas
02h N BYTEs "count" copies of data area record
Offset Size Description
00h DWORD address
04h WORD length and type
bit 15 set if swap always, clear if swap in DOS
bits 14-0: length in bytes
SeeAlso: #0970

Format of DOS 4.0-6.0 swappable data area:
Offset Size Description (Table 0970)
-34 BYTE printer echo flag (00h off, FFh active)
-31 BYTE current switch character (ignored by DOS 5+)
-30 BYTE current memory allocation strategy (see AH=58h)
-28 BYTE incremented on each INT 21/AX=5E01h call
-27 16 BYTEs machine name set by INT 21/AX=5E01h
-11 5 WORDs zero-terminated list of offsets which need to be patched to
enable critical-section calls (see INT 2A/AH=80h)
(all offsets are 0D0Ch, but this list is still present for
DOS 3.x compatibility)
-1 BYTE unused padding
---start of actual SDA---
00h BYTE critical error flag ("ErrorMode")
01h BYTE InDOS flag (count of active INT 21 calls)
02h BYTE drive on which current critical error occurred or FFh
03h BYTE locus of last error
04h WORD extended error code of last error
06h BYTE suggested action for last error
07h BYTE class of last error
08h DWORD ES:DI pointer for last error
0Ch DWORD current DTA (Disk Transfer Address)
note: may point into SDA during the DOS EXEC function
(see AH=4Bh), so programs which swap the SDA must be
prepared to move the DTA to a private buffer if they
might be invoked during an EXEC
10h WORD current PSP
12h WORD stores SP across an INT 23
14h WORD return code from last process termination (zerod after reading
with AH=4Dh)
16h BYTE current drive
17h BYTE extended break flag
18h BYTE flag: code page switching
19h BYTE flag: copy of previous byte in case of INT 24 Abort
---remainder need only be swapped if in DOS---
1Ah WORD value of AX on call to INT 21
1Ch WORD PSP segment for sharing/network
1Eh WORD network machine number for sharing/network (0000h = us)
20h WORD first usable memory block found when allocating memory
22h WORD best usable memory block found when allocating memory
24h WORD last usable memory block found when allocating memory
26h WORD memory size in paragraphs (used only during initialization)
28h WORD last entry checked during directory search
2Ah BYTE flag: nonzero if INT 24 Fail
2Bh BYTE flags: allowable INT 24 responses (passed to INT 24 in AH)
2Ch BYTE flag: do not set directory if nonzero
2Dh BYTE flag: program aborted by ^C
2Eh BYTE flag: allow embedded blanks in FCB
may also allow use of "*" wildcard in FCBs
2Fh BYTE padding (unused)
30h BYTE day of month
31h BYTE month
32h WORD year - 1980
34h WORD number of days since 1-1-1980
36h BYTE day of week (0 = Sunday)
37h BYTE flag: console swapped during read from device
38h BYTE flag: safe to call INT 28 if nonzero
39h BYTE flag: abort currently in progress, turn INT 24 Abort into Fail
3Ah 30 BYTEs device driver request header (see #1845 at INT 2F/AX=0802h) for
device calls
58h DWORD pointer to device driver entry point (used in calling driver)
5Ch 22 BYTEs device driver request header for I/O calls
72h 14 BYTEs device driver request header for disk status check
80h DWORD pointer to device I/O buffer
84h WORD ???
86h WORD ??? (0)
88h BYTE type of PSP copy (00h=simple for INT 21/AH=26h, FFh=make child)
89h DWORD start offset of file region to lock/unlock
8Dh DWORD length of file region to lock/unlock
91h BYTE padding (unused)
92h 3 BYTEs 24-bit user number (see AH=30h)
95h BYTE OEM number (see #0693 at AH=30h)
96h 6 BYTEs CLOCK$ transfer record (see #0968 at AX=5D06h)
9Ch BYTE device I/O buffer for single-byte I/O functions
9Dh BYTE padding???
9Eh 128 BYTEs buffer for filename
11Eh 128 BYTEs buffer for filename
19Eh 21 BYTEs findfirst/findnext search data block (see #0913 at AH=4Eh)
1B3h 32 BYTEs directory entry for found file (see #0693 at AH=11h)
1D3h 88 BYTEs copy of current directory structure for drive being accessed
22Bh 11 BYTEs FCB-format filename for device name comparison
236h BYTE terminating NUL for above filename
237h 11 BYTEs wildcard destination specification for rename (FCB format)
242h BYTE terminating NUL for above filespec
243h BYTE ???
244h WORD ???
246h 5 BYTEs ???
24Bh BYTE extended FCB file attributes
24Ch BYTE type of FCB (00h regular, FFh extended)
24Dh BYTE directory search attributes
24Eh BYTE file open/access mode
24Fh BYTE ??? flag bits
reportedly 00h when deleting a file under MSDOS 5.0
250h BYTE flag: device name found on rename, or file not found
251h BYTE splice flag??? (file name and directory name together)
252h BYTE flag indicating how DOS function was invoked
(00h = direct INT 20/INT 21, FFh = server call AX=5D00h)
253h BYTE sector position within cluster
254h BYTE ??? (flag: translate sector/cluster)
255h BYTE ??? (flag: 00h if read, 01h if write)
256h BYTE current working drive number
257h BYTE cluster factor
258h BYTE ???
259h BYTE line edit (AH=0Ah) insert mode flag (nonzero = on)
25Ah BYTE canonicalized filename referred to existing file/dir if FFh
25Bh BYTE volume ID flag
25Ch BYTE type of process termination (00h-03h) (see AH=4Dh)
25Dh BYTE ???
25Eh BYTE ??? file create flag (00h = no, search only)
25Fh BYTE ??? (value for deleted file's first byte)
260h DWORD pointer to Drive Parameter Block for critical error invocation
264h DWORD pointer to stack frame containing user registers on INT 21
268h WORD stores SP across INT 24
26Ah DWORD pointer to DOS Drive Parameter Block for ???
26Eh WORD segment of disk buffer
270h WORD ??? (saving partial cluster number)
272h WORD ??? (temp: sector of work current cluster)
274h WORD ??? (high part of cluster number)
276h WORD ??? (temp)
278h BYTE Media ID byte returned by AH=1Bh,1Ch
279h BYTE ??? (doesn't seem to be referenced)
27Ah DWORD pointer to device header if filename is character device
27Eh DWORD pointer to current SFT
282h DWORD pointer to current directory structure for drive being accessed
286h DWORD pointer to caller's FCB
28Ah WORD SFT index to which file being opened will refer
28Ch WORD temporary storage for file handle
28Eh DWORD pointer to a JFT entry in process handle table
(see #0677 at AH=26h)
292h WORD offset in DOS DS of first filename argument
294h WORD offset in DOS DS of second filename argument
296h WORD ??? (offset of last component in pathname or FFFFh)
298h WORD offset of transfer address to add
29Ah WORD last relative cluster within file being accessed
29Ch WORD temp: absolute cluster number being accessed
29Eh WORD directory sector number
2A0h WORD ???
2A2h WORD ??? directory cluster number
2A4h DWORD current relative sector number within file
2A8h DWORD ??? (current sector number)
2ACh WORD ??? (current byte offset within sector)
2AEh DWORD current offset in file
2B2h WORD ???
2B4h WORD bytes in partial sector
2B6h WORD number of sectors
2B8h WORD ??? (free file cluster entry)
2BAh WORD ??? (last file cluster entry)
2BCh WORD ??? (next file cluster number)
2BEh DWORD number of bytes appended to file
2C2h DWORD pointer to current work disk buffer
2C6h DWORD pointer to working SFT
2CAh WORD used by INT 21 dispatcher to store caller's BX
2CCh WORD used by INT 21 dispatcher to store caller's DS
2CEh WORD temporary storage while saving/restoring caller's registers
2D0h DWORD pointer to prev call frame (offset 264h) if INT 21 reentered
also switched to for duration of INT 24
2D4h WORD open mode/action for INT 21/AX=6C00h
2D6h BYTE ??? (set to 00h by INT 21h dispatcher, 02h when a read is
performed, and 01h or 03h by INT 21/AX=6C00h)
2D7h WORD ??? apparently unused
2D9h DWORD stored ES:DI for AX=6C00h
2DDh WORD extended file open action code (see #1044 at AX=6C00h)
2DFh WORD extended file open attributes (see #1043 at AX=6C00h)
2E1h WORD extended file open file mode (see AX=6C00h)
2E3h DWORD pointer to filename to open (see AX=6C00h)
2E7h WORD ??? temp DX storage or 0000h or temp data buffer size from
disk buffer
2E9h WORD ???
2EBh BYTE ???
2ECh WORD stores DS during call to [List-of-Lists + 37h]
2EEh WORD ???
2F0h BYTE ???
2F1h WORD ??? bit flags
2F3h DWORD pointer to user-supplied filename
2F7h DWORD pointer to ???
2FBh WORD stores SS during call to [List-of-Lists + 37h]
2FDh WORD stores SP during call to [List-of-Lists + 37h]
2FFh BYTE flag, nonzero if stack switched in calling [List-of-Lists+37h]
300h 21 BYTEs FindFirst search data for source file(s) of a rename operation
(see #0913 at AH=4Eh)
315h 32 BYTEs directory entry for file being renamed (see #0654 at AH=11h)
335h 331 BYTEs critical error stack
480h 384 BYTEs disk stack (functions greater than 0Ch, INT 25,INT 26)
600h 384 BYTEs character I/O stack (functions 01h through 0Ch)
780h BYTE device driver lookahead flag (usually printer) (see AH=64h)
781h BYTE volume change flag
782h BYTE flag: virtual open
783h BYTE ???
784h WORD ???
786h WORD ???
788h WORD ???
78Ah WORD ???
SeeAlso: #0967,#0969
--------D-215E00-----------------------------
INT 21 - DOS 3.1+ network - GET MACHINE NAME
AX = 5E00h
DS:DX -> 16-byte buffer for ASCII machine name
Return: CF clear if successful
CH = validity
00h name invalid
nonzero valid
CL = NetBIOS number for machine name
DS:DX buffer filled with blank-paded name
CF set on error
AX = error code (01h) (see #0960 at AH=59h)
Note: supported by OS/2 v1.3+ compatibility box, PC-NFS
SeeAlso: AX=5E01h
--------N-215E00-----------------------------
INT 21 - 10NET v5.0 - GET MACHINE NAME
AX = 5E00h
Return: CL = redirector's NetBIOS name number
ES:DI -> network node ID
SeeAlso: AX=5E01h"10NET"
--------D-215E01CH00-------------------------
INT 21 - DOS 3.1+ network - SET MACHINE NAME
AX = 5E01h
CH = 00h undefine name (make it invalid)
<> 0 define name
CL = name number
DS:DX -> 15-character blank-padded ASCIZ name
SeeAlso: AX=5E00h
--------N-215E01-----------------------------
INT 21 - 10NET v5.0 - GET LOCAL 10NET CONFIGURATION TABLE
AX = 5E01h
CX = length of buffer
DS:DX -> buffer for 10Net configuration table (see #821)
SeeAlso: AX=5E00h"10NET",INT 6F/AH=02h,INT 6F/AH=03h

Format of 10Net Configuration Table:
Offset Size Description (Table 0971)
00h 8 BYTEs user name
08h 15 BYTEs node ID
17h 3 BYTEs unique portion of Ethernet address
1Ah BYTE Who group number
1Bh WORD services mask (see #0973)
1Dh DWORD serial number
21h BYTE maximum concurrent users with same serial number allowed on net
22h BYTE chat mask (see #0974)
23h BYTE internal system bits (see #0975)
24h 9 BYTEs version number in format MM.mm.xxx
2Dh BYTE flag: 01h if machine is a PS/2
2Eh BYTE flag: 03h if 80386
2Fh BYTE spool termination mode: 01h concatenate, 02h truncate
(see AX=5D09h)
30h WORD autospool timeout in clock ticks
32h WORD monitor timeout in clock ticks
34h WORD unused
36h WORD chat timeout in clock ticks
38h WORD netBIOS session timeout in half-seconds
3Ah WORD datagram send timeout in seconds
3Ch WORD keyboard value for initiating chat mode
3Eh WORD Who timeout in clock ticks
40h BYTE flag: 01h if server should process rom NetBIOS Post return
41h BYTE flag: 01h if FCBs should be recycled
42h 3 BYTEs signature "DBG"
45h BYTE last interrupt (21h or 6Fh)
46h BYTE last INT 21 AH value
47h BYTE last INT 6F AH value
48h WORD last item posted
4Ah WORD last item free-posted
4Ch WORD last item handled by server
4Eh WORD last redirector send NCB
50h WORD last redirector receive NCB
52h 4 BYTEs signature "TABL"
56h WORD offset of datagram buffer table header (see #0972)
58h WORD offset of chat buffer table header (see #0972)
5Ah WORD offset of Raw buffer table header (see #0972)
5Ch WORD offset of Workstation buffer table header (see #0972)
5Eh WORD offset of server receive-any table header (see #0972)
60h WORD offset of Tiny buffer table header (see #0972)
62h WORD offset of zero-length buffer table (NCBs) (see #0972)
64h WORD offset of Rdr (Redirector Mount) table header (see #0972)
66h WORD offset of Ntab (Redirector Session) table header (see #0972)
68h WORD offset of FCB table header (see #0972)
6Ah WORD offset of user file handle table header (see #0972)
6Ch WORD offset of workstation printer RDR extension table header
6Eh WORD offset of server shared device table header (see #0972)
70h WORD offset of server connection table header (see #0972)
72h WORD offset of server login table header (see #0972)
74h WORD offset of server file table header (see #0972)
76h WORD offset of server shared file table header (see #0972)
78h WORD offset of server record lock table header (see #0972)
7Ah WORD offset of remote printer claim table header (see #0972)
7Ch WORD offset of remote printer device table header (see #0972)
7Eh WORD offset of print server mount table header (see #0972)
80h WORD offset of print server sessions table header (see #0972)
82h WORD offset of print server print job structure table header
84h WORD offset of print server pooled device table header (see #0972)
86h WORD size of workstation buffer
88h WORD size of server receive-any buffer
8Ah WORD size of server raw I/O buffer
8Ch 6 BYTEs reserved
92h DWORD pointer to profile pathname
96h BYTE datagram retry count
97h BYTE NetBIOS LAN adapter number
98h 6 BYTEs physical Ethernet address
9Eh BYTE NetBIOS server name number
9Fh BYTE NetBIOS redirector name number
A0h BYTE 10Net interrupt number
A1h BYTE flag: chat is loaded
A2h BYTE flag: INT 6F APIs permanently loaded
A3h BYTE flag: file security present
A4h WORD reserved
A6h BYTE fixed mount bitmask for drives A:-H:
A7h BYTE reserved
A8h WORD 10Net system flags (see #0976)
AAh BYTE monitor flags (see #0977)
ABh 5 BYTEs reserved
B0h WORD offset of monitor timer block
B2h WORD offset of server timer block
B4h WORD offset of chat timer block
B6h WORD timer chain
B8h 4 BYTEs signature "TALS"
BCh WORD number of 10Net sends
BEh WORD number of 10Net receives
C0h WORD number of no-buffer conditions
C2h WORD number of dropped posted messages
C4h WORD number of server NCB errors
C6h WORD number of redirector NCB errors
C8h WORD number of datagram send/receive errors
CAh WORD number of dropped Whos
CCh WORD number of dropped submits
CEh WORD number of session aborts
D0h BYTE number of NetBIOS interface-busy errors
D1h BYTE last NetBIOS bad post command
D2h BYTE last NetBIOS bad redirector command
D3h BYTE do send datagram send/receive error command
D4h DWORD -> DOS system parameter table
D8h WORD number of DOS physical drives
DAh WORD offset of DOS PSP field in DOS data segment
DCh WORD offset of in-DOS flag in DOS data segment
DEh WORD DOS data segment
E0h WORD offset of DOS SFT in DOS data segment
E2h WORD offset of number-of-physical-units field in DOS data segment
E4h WORD 10Net code segment
E6h WORD 10Net data segment
E8h WORD 10Net common server segment
EAh WORD 10Net file server segment
ECh WORD 10Net print server segment
EEh WORD 10Net remote printer segment
Note: documentation lists field at offset D0h as a WORD, but all following
offsets are as though it were a BYTE; if it is indeed a WORD, all
offsets after D0h must be increased by one byte

Format of 10Net Table Header:
Offset Size Description (Table 0972)
-16 4 BYTEs table identifier
-12 WORD peak number of tables allocated
-10 WORD number of tables currently in use
-8 WORD total number of tables
-6 WORD size of each table
-4 WORD offset of first allocated table
-2 WORD offset of first free table

Bitfields for 10NET services mask:
Bit(s) Description (Table 0973)
0 workstation
1 file server
2 print queue server
3 de-spool server

Bitfields for 10NET chat mask:
Bit(s) Description (Table 0974)
0 chat permitted
1 bell enabled
2 chat keyboard initiated
3 in INT 16 handler
4 in Get Input
5 display has timed out
6 chat is idle

Bitfields for 10NET internal system bits:
Bit(s) Description (Table 0975)
0 submit permitted
1 submit initiated
2 submit executing
3 internal client call/chat/spool/autospool
4 in spool termination
5 print permitted
6 waiting for keyboard input

Bitfields for 10NET System Flags:
Bit(s) Description (Table 0976)
0 in NetBIOS
1 processing INT 28
2 is server
3 in net user-DOS function
4 in DOS user-DOS function
5 in net for user non-DOS function
6 in server DOS function
7 in server non-DOS function
8 in terminate
10 in user on server request
13 in DOS for user on server
14 disable critical error handler

Bitfields for Monitor Flags:
Bit(s) Description (Table 0977)
0 waiting for monitor response
4 in monitor get-input routine
5 monitor display timeout
6 sensing for escape key
--------D-215E02-----------------------------
INT 21 - DOS 3.1+ network - SET NETWORK PRINTER SETUP STRING
AX = 5E02h
BX = redirection list index (see AX=5F02h)
CX = length of setup string
DS:SI -> setup string
Return: CF clear if successful
CF set on error
AX = error code (01h) (see #0960 at AH=59h)
Note: also supported by 10NET v5.0
SeeAlso: AX=5E03h,INT 2F/AX=111Fh
--------D-215E03-----------------------------
INT 21 - DOS 3.1+ network - GET NETWORK PRINTER SETUP STRING
AX = 5E03h
BX = redirection list index (see AX=5F02h)
ES:DI -> 64-byte buffer for setup string
Return: CF clear if successful
CX = length of setup string
ES:DI buffer filled
CF set on error
AX = error code (01h) (see #0960 at AH=59h)
Note: also supported by 10NET v5.0, but 10NET is documented as using DS:SI
instead of ES:DI
SeeAlso: AX=5E02h,INT 2F/AX=111Fh
--------D-215E04-----------------------------
INT 21 - DOS 3.1+ network - SET PRINTER MODE
AX = 5E04h
BX = redirection list index (see AX=5F02h)
DX = mode
bit 0: set if binary, clear if text (tabs expanded to blanks)
Return: CF set on error
AX = error code (see #0960 at AH=59h)
CF clear if successful
Note: calls INT 2F/AX=111Fh with 5E04h on stack
SeeAlso: AX=5E05h"DOS",INT 2F/AX=111Fh
--------N-215E04-----------------------------
INT 21 - 10NET v5.0 - INITIATE PRINT JOB
AX = 5E04h
BX = zero-based redirection list index (see AX=5F02h)
DS:DX -> extended workstation printer setup structure (see #0978)
Return: CF clear if successful
CF set on error
AX = error code (see #0960 at AH=59h)
SeeAlso: AX=5E05h"10NET",AX=5E06h"10NET"

Format of 10NET extended workstation printer setup structure:
Offset Size Description (Table 0978)
00h BYTE notification flags (see #0979)
01h BYTE job control mask (see #0980)
02h WORD days to retain file
04h WORD test print length
06h BYTE number of copies to print
07h BYTE compression algorithm
08h BYTE tab width (00h = don't expand)
09h BYTE initiation type (00h normal, 01h non-spooled)
0Ah 38 BYTEs job start operation notification instructions
30h 32 BYTEs comment for job
50h 64 BYTEs output filename or non-spooled file

Bitfields for 10NET notification flags:
Bit(s) Description (Table 0979)
0 user at print start
1 operator at start, with reply
2 user at print completion
3 operator at completion, with reply
4 user on queue switch
5 operator on queue switch, with reply
6 user on print error

Bitfields for 10NET job control mask:
Bit(s) Description (Table 0980)
0 print banner page
1 eject page at end of job
2 mark as "held" (queue but don't print)
3 rush job (queue at top)
4 overwrite file with zeros before deletion
5 hyperspool if possible
--------D-215E05-----------------------------
INT 21 - DOS 3.1+ network - GET PRINTER MODE
AX = 5E05h
BX = redirection list index (see AX=5F02h)
Return: CF set on error
AX = error code (see #0960 at AH=59h)
CF clear if successful
DX = printer mode (see AX=5E04h)
Note: calls INT 2F/AX=111Fh with 5E05h on stack
SeeAlso: AX=5E04h"DOS",INT 2F/AX=111Fh
--------N-215E05-----------------------------
INT 21 - 10NET v5.0 - TERMINATE PRINT JOB
AX = 5E05h
BX = zero-based redirection list index (see AX=5F02h)
Return: CF clear if successful
CF set on error
AX = error code (see #0960 at AH=59h)
Note: this call resets the spool termination mode to "truncate"
(see AX=5D08h)
SeeAlso: AX=5E04h"10NET",AX=5E06h
--------N-215E06-----------------------------
INT 21 - 10NET v5.0 - GET/SET 10NET WORKSTATION PRINTER SETUP STRUCTURE
AX = 5E06h
BX = zero-based redirection list index (see AX=5F02h)
CX = operation (06h set, 07h get)
DS:DX -> buffer for setup structure (same as first nine bytes of
workstation printer setup) (see #0978)
Return: CF clear if successful
DS:DX buffer updated on get
CF set on error
AX = error code (see #0960 at AH=59h)
SeeAlso: AX=5E04h"10NET",AX=5E05h"10NET"
--------!---Section--------------------------