1r






SPYDOS
Software Interrupt Analyser Program
for
DOS and WINDOWS

Unregistered
Shareware
Manual






Revision 1.20.00
May, 1995







Wolfgang Heck
[email protected]
Notice:

AUTHOR makes no warranty of any kind with regard to this material, including, but not
limited to, the implied warranties of merchantability and fitness for a particular
purpose. AUTHOR shall not be liable for errors contained herein or for incidental
consequential damages in connection with the furnishing, performance, or use of this material and the enclosed program.

AUTHOR reserves the right to change, without notification, the specifications contained in this manual.

(C)1995 W. Heck. No part of this publication may be reproduced or translated into any language in any form without the written permission of AUTHOR.

IBM, PC/AT and PC/XT are registered trademarks of International Business Machines Corporation.
MS-DOS, WINDOWS, WINDOWS-NT are registered trademarks of Microsoft Corporation



Table of Contents

1.0Scope of Manual

2.0License Agreement
2.1General Terms
2.2Software Contents
2.3Registration Fee

3.0Key Features

4.0Specification Summary

4.1Software Versions
4.1.1Unregistered Sharware
4.1.2Registered Full Version

4.2Program Installation
4.2.1Environment Varaibles
4.2.2AUTOEXEC.BAT

4.3Performance and Stack usage

5.0Example Printouts


1.0Scope of Manual

This manual describes the license aggreement, key features, functional description, recommended configuration, command description, operations description, and error reporting for the SPYDOS and READSPY program.

2.0License aggreement

NOTICE: Notice to users ("USER") of the computer programs ("SOFTWARE") contained in this package: Carefully read the following legal aggreement. The author ("AUTHOR") grants to USER the right to use SOFTWARE on one single computer ("CPU") at the same time if USER complies with the General Terms of this agreement. SOFTWARE may be evaluated for a period of seven days on a royalty free basis. Continued use after evaluation is conditioned upon payment of a license fee by USER to AUTHOR. After receive of payment of the license fee AUTHOR will submit the information to unlock the features of the full version of SOFTWARE.

2.1General Terms.

COPYRIGHT. SOFTWARE is protected by United States copyright laws and international treaty provisions. USER acknowledges that no title to the intellectual property in SOFTWARE is transferred to USER. USER further acknowledges that full ownership rights to SOFTWARE will remain the exclusive property of AUTHOR and USER will not acquire any rights to SOFTWARE except as expressly set forth in this license. USER agrees that any copies of SOFTWARE made by USER will contain the same proprietary notices which appear on and in SOFTWARE.

REVERSE ENGINEERING. USER agrees that USER will not attempt, and will use its best efforts to prevent anyone else from attempting to reverse compile, modify, translate or disassemble SOFTWARE in whole or in part.

LIMITED WARRANTY. AUTHOR warrants that SOFTWARE will perform substantially in accordance with the accompanying documentation for a period of ninety (90) days from the date AUTHOR receives and accepted payment of license fee.

COMPANY REMEDIES. If SOFTWARE does not conform to the limited warranty above ("Limited Warranty"), AUTHOR's entire liability and USER's sole and exclusive remedy shall be, at
AUTHOR's option, either to (1) correct the error, (2) help USER work around or avoid the error or (3) authorize a refund of license fee, so long as SOFTWARE is destroyed by USER. The Limited
Warranty is void if failure of SOFTWARE has resulted from accident, abuse, or misapplication. Any replacement SOFTWARE will be warranted for the remainder of the original Limited
Warranty period.

NO OTHER WARRANTIES. AUTHOR does not warrant that the software is errorfree, identifies all known function calls, or reports all software interrupt calls.
Except for the express limited warranty above, AUTHOR disclaims all other warranties with respect to SOFTWARE, either express or implied, including but not limited to implied warranties of merchantability, fitness for a particular purpose and noninfringement of third party rights.

DATA BACKUP. Before SOFTWARE is used the first time by USER, USER agrees to backup the complete Harddisk of the computersystem SOFTWARE will run on, to avoid any loss of data.

NO LIABILITY FOR CONSEQUENTIAL DAMAGES. In no event shall AUTHOR be liable for consequential, incidental or indirect damages of any kind arising out of the delivery, performance, or use of the SOFTWARE, even if AUTHOR has been advised of the possibility of such damages. In no event will AUTHOR's liability for any claim, whether in contract, tort or any other theory of liability, exceed the license fee paid by USER.

SHAREWARE DISTRIBUTION LICENSE. AUTHOR grants to shareware distributors ("DISTRIBUTOR") a nonexclusive, worldwide right to distribute the object code version of SOFTWARE as shareware. This license to distribute the Software is conditioned upon DISTRIBUTOR's compliance with the terms of this Agreement. DISTRIBUTOR will not copy the Software except as necessary to use it in accordance with this license, and DISTRIBUTOR is granted no right to modify or sublicense the Software. DISTRIBUTOR may request an upload by AUTHOR via COMPUSERV or INTERNET for a nominal fee. All files of SOFTWARE must be distributed bundled together. All SOFTWARE distribution must be via diskettes ( which are either write-protected or notchless ) or electronic transmission ( in which case the original archive file from AUTHOR must be used ). DISTRIBUTOR is prohibited from installing copies of SOFTWARE on hard drives and distributing such hard drives. DISTRIBUTOR may not charge its customers for SOFTWARE other than a nominal fee for the diskette.

DISTRIBUTION: Please feel free to:

-Upload this software to any electronic Bulletin Board
-Demonstrate the software
-Give copies of the software to potential users

so that others may have the opportunity to get a copy for use in accordance with the license terms contained in this document, provided, that you distribute SOFTWARE in its original form.

Should you have any questions concerning this license agreement, or if you desire to contact AUTHOR for any reason please leave an INTERNET mail at [email protected] or a COMPUSERV mail at 71730,2657.


2.2Registration Fee

Registration fee for SOFTWARE is:

$9.95 for non comercial private usage (Private User License).
$199.95 for comercial single user (Company or Business Single User License).
$295.95 for Company site license (Company Site License).
$995.95 for Company wide license (Company License)

To register SOFTWARE send an Internet e-mail to AUTHOR at [email protected] or Compuserv mail to AUTHOR at 71730,2657.

Upon receive of payment AUTHOR will e-mail the latest full release of SOFTWARE (SPYDOS.EXE) and the full WINWORD 6.0 version of this manual to USER.


2.3Contents

You should have received the following modules:

SPYDOS.ZIP-ZIP file with the following modules:

SPYDOSS.WRI-This manual (Windows WRITE format)
SPYDOS.EXE-TSR Program
READSPY.EXE-User Interface to read the SPYDOS arrays
SPYBAT.BAT-Batch File to configure the environment, load and initialize SPYDOS

SPYTST.EXE-Test Program to test the SPYDOS Interface and environment
SPYSRV.EXE-TSR Program to emulate Interrupt Service Routines
SPYTEST.BAT-Batch FIle to run the Test programs


3.0 Key Features

The SPYDOS program is a high performance int86x software interrupt analyser program, that hooks into up to 3 user selectable Software Interrupts and tracks all (real mode) CPU registers used with the int86x function call.
The use of this program is useful to debug the different behaviour of the different versions of DOS, WINDOWS and WINDOWS-NT. It also proved useful to debug wrong compiler switches and settings used for the application program.

The contents of the CPU registers is stored in internal arrays for later analysis, minimizing the time overhead used during the interrupt call. A second program (READSPY) is used to read out the contents of these arrays and print them on stdio.

Careful attention was given to test this application under different operating system platforms:

- MS-DOS V6.22 (US)
- WINDOWS for Workgroups 3.11 (US) using the DOS box
- WINDOWS-NT 3.5 (US) and NT3.51(Beta) using the DOS box

Limitations:
The unregistered shareware version supports the analysis of 9 Interrupt calls. The internal Buffer is not reset after printout.
The registered version supports the analysis of 1600 Interrupt calls. The internal Buffer is reset after printout.
Both versions have a known problem if DOS Interrupt 2Fh is monitored:
If a Disk command failed (For example DIR, FORMAT, .... ), the system does not accept Keyboard data for the (R)etry, (A)bort, (F)ail command. You have either to correct the error or to reboot the system.


4.0Specification Summary

The SPYDOS program should run on all INTEL x86 based IBM-AT compatible PC's with the MS-DOS operating system (V5.00 or higher). The Author supports only MS-DOS platforms.

The current versions of SPYDOS V1.1x.xx do not run under DR-DOS and are not tested under OS/2. The environment variable DRDOSCOMP should allow to run the program under DR-DOS, however this configuration is not yet tested with version V1.20.00.

Intensive testing which included the behavior of copy protected software (Floppy Disk based, Harddisk based, and Dongles using the parallel port) were passed succesfully, indicating a high degree of compatibility, however due to the varity of different hardware platforms and the nature of this program it was not possible for the author to test all configurations on the market.

Hardware platform used for testing was an i486DX/33 with AMI BIOS and an ET4000 based SVGA card running MS-DOS V6.22, WfW3.11, and WINDOWS-NT 3.51. The printer was connected to the LPT1 port.

Memory requirements of SPYDOS.EXE are appr. 150KB of real memory (below 1MB).

No third party components (memory managers, disk doublers, ...) were used during the tests.


4.1.Software Versions

V1.10.00- first released version (February 95)

V1.10.00a- Corrections and enhancements User Manual:
Description for the environment variable corrected.
Batch File added to ZIP file.

V1.10.02- Version update (March 95)
- BIOS MPX call decoding added
- monitoring more CPU registers

V1.10.03- Version update
- Hooking of MS-DOS Interrupt Tables disabled

V1.10.04- Version update
- new environment variable DRDOSCOMP

V1.20.00- Version update (May 95)
- Limited monitoring for the unregistered version.
- Updated User Manual

4.1.1Unregistered Shareware

Same as the full version, except that only the first 9 int86x calls are analysed. Readspy is not able to reset the internal buffer.


4.1.2Full Version

Analysis of the first 1599 int86x calls with all CPU registers used as actual parameters in the int86x call and all CPU registers returned to the int86x function call. Headline with description of the Function Call. The Headline messages are based on the IBM-AT BIOS specification. Some function calls (like DISK-I/O) are partially decoded to allow easier interpretation of the Interrupt call.

Limitations V1.10.00:
All Headline messages are based on the original IBM-AT specification. Not all Function Calls are currently fully implemented. Not all Function calls are fully decoded.
If a Disk command failed (For example DIR, FORMAT, .... ), and MS-DOS Interrupt 2fH is monitored, the system does not accept Keyboard data for the (R)etry, (A)bort, (F)ail command. You have either to correct the error or to reboot the system.

Limitations V1.10.02:
All Headline messages are based on the original IBM-AT specification. Not all Function Calls are currently fully implemented. Not all Function calls are fully decoded.
If a Disk command failed (For example DIR, FORMAT, .... ), and MS-DOS Interrupt 2fH is monitored, the system does not accept Keyboard data for the (R)etry, (A)bort, (F)ail command. SP and SS register monitoring not fully supported for return values (SS, SP point to SPYDOS internal Stackarea).

Limitations V1.10.03:
All Headline messages are based on the original IBM-AT specification. Not all Function Calls are currently fully implemented. Not all Function calls are fully decoded.
If a Disk command failed (For example DIR, FORMAT, .... ), and MS-DOS Interrupt 2fH is monitored, the system does not accept Keyboard data for the (R)etry, (A)bort, (F)ail command. SP and SS register monitoring not fully supported for return values (SS, SP point to SPYDOS internal Stackarea).

Limitations V1.10.04:
All Headline messages are based on the original IBM-AT specification. Not all Function Calls are currently fully implemented. Not all Function calls are fully decoded.
If a Disk command failed (For example DIR, FORMAT, .... ), and MS-DOS Interrupt 2fH is monitored, the system does not accept Keyboard data for the (R)etry, (A)bort, (F)ail command. SP and SS register monitoring not fully supported for return values (SS, SP point to SPYDOS internal Stackarea).

Limitations V1.20.00:
All Headline messages are based on the original IBM-AT specification. Not all Function Calls are currently fully implemented. Not all Function calls are fully decoded.
If a Disk command failed (For example DIR, FORMAT, .... ), and MS-DOS Interrupt 2fH is monitored, the system does not accept Keyboard data for the (R)etry, (A)bort, (F)ail command. SP and SS register monitoring not fully supported for return values (SS, SP point to SPYDOS internal Stackarea).

Other program files:

SPYSRV.EXE

SPYSRV emulates or replaces the Interrupt Service Routines as defined by the environment variables for all 3 Interrupt vectors. SPYSRV is loaded after the environment variables are defined and before SPYDOS is loaded. SPYSRV increments all Registers by a predefined value.

Example:

C:\> C:\SPYDOS\SPYSRV.EXE

SPYTST.EXE

SPYTST is a testprogram to call the SPYSRV Interrupt service routines as defined by the environment variables.

Example:

C:\> C:\SPYDOS\SPYTST.EXE

4.2Program installation

Before installation please read this chapter. It contains important information and limitations of the SPYDOS program.

The SPYDOS program runs as a TSR module in Real memory (below 1MB) under MS-DOS. It can be loaded from the DOS prompt.

Unique signatures are used to avoid that more then one instance of SPYDOS is loaded in memory.

Example:

C:\> C:\SPYDOS\SPYDOS.EXE

To initialize the SPYDOS program you must start the READSPY program. READSPY initializes the SPYDOS program and sets SPYDOS internal counters. READSPY is the command utility for SPYDOS and does not remain in memory.

Example:

C:\> C:\SPYDOS\READSPY.EXE


4.2.1Environment variables

The following environment variables are used to configure the unregistered version of SPYDOS:

- DOSINTA
- DOSINTB
- DOSINTC
- DOSINTI
- DRDOSCOMP

DOSINTA, DOSINTB, DOSINTC define the Software Interrupt vectors to be hooked. All Interrupt vectors (00h-FFh) can be used, however be extremly cautious if you use any BIOS Interrupt vectors.

To hook interrupt 21h and 80h use the following command:

Example:

C:\> SET DOSINTA=80
C:\> SET DOSINTB=21

DOSINTI is used to control the printout of the internal array. Valid values are:

7Fh- Monitor Register values (Interrupt Call)
7Eh- Monitor Register values (Interrupt Call and Return)
7Dh- as 7Eh plus functional description

Example:

C:\> SET DOSINTI=7D


DRDOSCOMP is used to disable internal parameter checking under DR-DOS, so that SPYDOS will run under Multiuser DR-DOS. This Feature is implemented however not yet tested.

Example:

C:\> SET DRDOSCOMP=00


Please note:
Write the parameter for the SET command without any spaces ! The Interrupt notation is in Hexadecimal. Above example for DOSINTA specifies Interrupt 80h or 128 decimal.

IMPORTANT:

SPYDOS and READSPY do not work correctly, if the hooked Interrupt is pointing to an UNDEFINED interrupt service routine (This is normally the case for all interrupts above 0x7F).


4.2.2AUTOEXEC.BAT

You can load SPYDOS with the following command sequence in your AUTOEXEC.BAT file:

rem
rem
rem
mode con: lines=50
rem
rem CONFIGURE THE SPYDOS INTERRUPT ROUTINE
rem
SET DOSINTA=80
SET DOSINTB=21
SET DOSINTI=7D
rem
rem Load SPYDOS
rem
SPYDOS.EXE
rem
rem Initialize SPYDOS
rem
READSPY.EXE


Please note:
You can not unload SPYDOS once it is loaded. You must reboot the machine. The unregistered SPYDOS version will only work the first time after it was loaded, however it supports now all functions of the full version.


4.3Performance and stack usage

Due to its design, SPYDOS adds only approximately 1000-2000 CPU cycles to each hooked Interrupt call. Even time critical software (like some copy protection algorithms, or DOS Timer interrupts) will normally work under SPYDOS.

SPYDOS saves all used registers on the users stack. Stack usage is appr. 72 Bytes. Although SPYDOS is not 100% reentrant (pointers to SPYDOS internal arrays are stored in SPYDOS global memory) no problems are known so far. Due to these features SPYDOS is nearly invisible for the application program.

SPYDOS analyses all CPU registers of the int86x call before and after execution of the INT call and saves them in an internal array.

To avoid cascading events, SPYDOS is disabled during readout of this internal array.

Please note:
If you hook Interrupts like 15h, 21h and 2fh you are (or to be more acurate: MS-DOS is) calling SPYDOS several times. This might cause a stack overflow condition which is (normally) not detected and can overwrite Heap, Data, or Code areas.



5.0Program messages

The following sections explain the messages SPYDOS prints to the screen.

5.1SPYDOS

Start SPYDOS from the DOS prompt:
G:\inter>SPYDOS

SPYDOS Startup message:
SPYDOS: DOS INTERRUPT Analyser V1.20.00 loading...
SPYDOS: Unregistered Shareware Version.
SPYDOS: Use of this version within a company is prohibited.
SPYDOS: (C)1995, W. Heck All Rights reserved.

ATTENTION: You are monitoring either:
DOS System Calls or HARDWARE Interrupts.
------------------------------------------------------------
ATTENTION: You are monitoring INT 2Fh. There is a known
problem with SPYDOS monitoring this Interrupt:
If a Disk Command fails - like DIR, FORMAT, ...
the (A)bort, (R)etry, (F)ail command will not
respond correctly. If this happens you must
either correct the problem or reboot the computer
------------------------------------------------------------
No other problems are known so far that monitoring
these Interrupts causes MS-DOS to fail however
this might not be true on all computer systems
and might cause your Operating System to fail.
This failure might corrupt your filesystem and
DESTROY DATA ON YOUR HARDDISK !

Even no problems are known so far it is a good
idea to backup the Harddisk now before you
continue testing.
Reboot your system without SPYDOS before you
start backing up your Harddisk(s).

You agree that you will NOT held the author of
this program liable for ANY damages
resulting out of the use of this program.

If you do not agree: REBOOT YOUR SYSTEM NOW and
remove SPYDOS as well as all related utilities
from your system.

Test of interrupt vector SPYDOS will use:
SPYDOS: Testing interrupt vector 0x80
SPYDOS: Testing interrupt vector 0x21
Please note:
If the environment variable DOSINTA is not set, SPYDOS defaults to 80h.

After SPYDOS is loaded and the interrupt vector is initialized, SPYDOS releases all unused memory to DOS. The progress of this procedure is printed on the screen:
SPYDOS: Releasing unused Heap Space to DOS.
SPYDOS: Unused Heap Space released.
SPYDOS: PSP Segment : 0x13d7
SPYDOS: Stackpointer : 0x36A2:0x14E6
SPYDOS: Heap Analysis started.
SPYDOS: USED block at 46A3:0016 of size 0224
SPYDOS: USED block at 46A3:023C of size 0068
SPYDOS: USED block at 46A3:02A6 of size 0200
SPYDOS: FREE block at 46A3:04A8 of size 0006
SPYDOS: OK - End of heap reached at: 46A3:04A7.

Before SPYDOS terminates and remains inactive in memory, it prints additional information about the program size and the interrupt vector(s) it is using:
SPYDOS: Interrupt hooked: 0x80, Paragraphs needed: 9273
SPYDOS: Interrupt hooked: 0x21, Paragraphs needed: 9273
SPYDOS: Program Size 0x 24390 (148368) Bytes.

SPYDOS is installed in memory:
SPYDOS: Installation successful.
G:\INTER>


The following messages are printed, if SPYDOS detects another copy of the program in memory:

G:\INTER>SPYDOS

Interrupt vector is already hooked by another version of the SPYDOS program:
SPYDOS: Interrupt 0x80 test result: Interrupt already hooked!
SPYDOS: Error: Program is already loaded.

SPYDOS is not installed in memory:
SPYDOS-I: Program installation aborted.

If SPYDOS was called from a Batch file, the Errorlevel value is set to 1:
SPYDOS: Errorlevel set to 1

G:\INTER>



5.1READSPY

The following sections explain the messages READSPY prints to the screen. All messages are printed to stdio. The pipe redirector can be used to redirect the messages to a diskfile.

5.1.1Printout on screen, if the TSR program SPYDOS is not loaded:

Start READSPY from the DOS prompt:
G:\inter>READSPY

READSPY Startup message:
READSPY U T I L I T Y V1.10.04: Activate/Read SPYDOS Data
(C)1995 W. Heck ALL RIGHTS RESERVED

READSPY tries to call SPYDOS:
Activating Data collection function of SPYDOS now...

READSPY received a wrong return parameter from SPYDOS:
READSPY: The function call failed:
Check that the TSR program SPYDOS is loaded.
Check your manual for the right settings of the environment varible
Example:
SET DOSINTA=13
With this setting SPYDOS will monitor SW-INT 013h calls.
Please note:
You can not change the hooked interrupts after SPYDOS is loaded.


Please note: Above error condition happens, if either:

1) SPYDOS is not loaded or

2) The environment variable DOSINTA does not point to the SPYDOS TSR program.

3) You tried to run READSPY under multiuser DR-DOS and the environment
variable DRDOSCOMP is undefined.

READSPY terminates:
READSPY: Program Stop.


5.1.2Printout on screen, if the TSR program SPYDOS is loaded and SPYDOS has no data available:

G:\INTER>READSPY

READSPY U T I L I T Y V1.120.00: Activate/Read SPYDOS Data
(C)1995 W. Heck ALL RIGHTS RESERVED

READSPY tries to call SPYDOS:
Activating Data collection function of SPYDOS now...

READSPY received the following status information from SPYDOS:
Amount of calls saved is zero. This is always true if either no Interrupts were detected or if READSPY has called SPYDOS for the first time.

----- Number of internal calls saved: 0 -------


READSPY received an end of data return parameter from SPYDOS and terminates:
READSPY: Program Stop.

G:\INTER>

5.1.3Printout on screen

G:\INTER>READSPY

READSPY U T I L I T Y V1.20.00: Activate/Read SPYDOS Data
(C)1995 W. Heck ALL RIGHTS RESERVED

READSPY tries to call SPYDOS:
Activating Data collection function of SPYDOS now...

READSPY received the following status information from SPYDOS:
Amount of calls saved is three.
----- Number of internal calls saved: 3 -------

READSPY prints the internal sequence number (C#), the Interrupt # and the CPU registers:
----- Number of internal calls saved: 3 -------

C#: 1 Int: 0x80
Call al: 4C ah: 4 bl: 4D bh: 4 cl: 4E ch: 4 dl: 4F dh: 4 cf:3A16
cs:3D77 ip:1D14 ss: 0 sp: 0 bp:1D1E ds: 453 es: 452 si: 450 di: 451
C#: 2 Int: 0x80
Call al: 4C ah: 4 bl: 4D bh: 4 cl: 4E ch: 4 dl: 4F dh: 4 cf:3A16
cs:3D77 ip:1D14 ss: 0 sp: 0 bp:1D1E ds: 453 es: 452 si: 450 di: 451
C#: 3 Int: 0x80
Call al: 4C ah: 4 bl: 4D bh: 4 cl: 4E ch: 4 dl: 4F dh: 4 cf:3A16
cs:3D77 ip:1D14 ss: 0 sp: 0 bp:1D1E ds: 453 es: 452 si: 450 di: 451
READSPY: Program Stop.

D:\USER\INTER>
READSPY received an end of data return parameter from SPYDOS and terminates:
READSPY: Program Stop.

G:\INTER>


5.2Printout INITDOSI:

The full version of SPYDOS stores more detailled information, analyses the return parameters and detects, if an interrupt routine does not return to the caller directly. The full version can hook up to 3 Interrupts simultaneously.

READSPY uses the environment variable DOSINTI to control the printout format.

READSPY U T I L I T Y V1.20.00: Activate/Read SPYDOS Data
(C)1995 W. Heck ALL RIGHTS RESERVED

READSPY received the following status information from SPYDOS:
Amount of calls saved is 185.
----- Number of internal calls saved: 185 -------

READSPY prints more detailled information for the INT 21h call.
C#: 1 Int: 0x21 Write to device or file (handle)
READSPY has detected, that the interrupts were either nested or the interrupt routine did not return to the caller.
*** Attention nested interrupts detected***
READSPY prints the actual values of the CPU registers.
IN: 1 al: 33 ah: 40 bl: 1 bh: 0 cl: 1a ch: 0 dl: 9a dh: 1a
si: 2af di:1ab4 cf:3212 es:364a cs:34c8 ss: 21 ds:364a
READSPY prints the return values of the CPU registers (if there was an IRET).
RT: 0 al: 0 ah: 0 bl: 0 bh: 0 cl: 0 ch: 0 dl: 0 dh: 0
si: 0 di: 0 cf: 0 es: 0 cs: 0 ss: 0 ds: 0

READSPY prints more detailled information for the INT 10h call.
C#: 2 Int: 0x10 EGA/VGA BIOS: Position cursor
READSPY prints the actual values of the CPU registers.
Call : al: d ah: 2 bl: 0 bh: 0 cl: 4 ch: 0 dl: 0 dh: 31
si: 1a9 di: 24 cf:3246 es:37f3 cs: 322 ss: 10 ds: 322
READSPY prints the return values of the CPU registers.
Return: al: d ah: 2 bl: 0 bh: 0 cl: 4 ch: 0 dl: 0 dh: 31
si: 1a9 di: 24 cf:3246 es:37f3 cs: 322 ss: 10 ds: 322

READSPY prints more detailled information for the INT 10h call.
C#: 3 Int: 0x10 EGA/VGA BIOS: Read character / color
READSPY prints the actual values of the CPU registers.
Call : al: 3 ah: 8 bl: 0 bh: 0 cl: 4 ch: 0 dl: b dh: 0
si: 1a9 di: 24 cf:3297 es:37f3 cs: 322 ss: 10 ds: 322
READSPY prints the return values of the CPU registers.
Return: al: 20 ah: 7 bl: 0 bh: 0 cl: 4 ch: 0 dl: b dh: 0
si: 1a9 di: 24 cf:3297 es:37f3 cs: 322 ss: 10 ds: 322

READSPY prints more detailled information for the INT 10h call.
C#: 4 Int: 0x10 EGA/VGA BIOS: Write character / color
Call : al: 20 ah: 9 bl: 7 bh: 0 cl: 1 ch: 0 dl: b dh: 0
si: 1a9 di: 24 cf:3297 es:37f3 cs: 322 ss: 10 ds: 322
Return: al: 20 ah: 9 bl: 7 bh: 0 cl: 1 ch: 0 dl: b dh: 0
si: 1a9 di: 24 cf:3297 es:37f3 cs: 322 ss: 10 ds: 322

...............

C#: 124 Int: 0x10 EGA/VGA BIOS: Position cursor
Call : al: 52 ah: 2 bl: 7 bh: 0 cl: 1 ch: 0 dl: 0 dh: 31
si: 1a9 di: c cf:3206 es:37f4 cs: 322 ss: 10 ds: 322
Return: al: 1a ah: 0 bl: 1 bh: 0 cl: 1a ch: 0 dl: aa dh: 1a
si: 2ae di:1ac4 cf:3212 es:364a cs:34c8 ss: 10 ds:364a

C#: 125 Int: 0x21 Set interrupt vector: Int: 0x 0 Adr.: 0x a7:6810
Call : al: 0 ah: 25 bl: 30 bh: 0 cl: 0 ch: 0 dl: 68 dh: 10
si: 7f6 di: 7f6 cf:3246 es:364a cs:34c8 ss: 21 ds: a7
Return: al: 0 ah: 25 bl: 30 bh: 0 cl: 0 ch: 0 dl: 68 dh: 10
si: 7f6 di: 7f6 cf:3246 es:364a cs:34c8 ss: 21 ds: a7

C#: 126 Int: 0x21 Terminate with return code
*** Attention nested interrupts detected***
IN: 126 al: 18 ah: 4c bl: 30 bh: 0 cl: 0 ch: 0 dl: 68 dh: 10
si: 7f6 di: 7f6 cf:3246 es:364a cs:34c8 ss: 21 ds:364a
RT: 0 al: 0 ah: 0 bl: 0 bh: 0 cl: 0 ch: 0 dl: 0 dh: 0
si: 0 di: 0 cf: 0 es: 0 cs: 0 ss: 0 ds: 0

C#: 127 Int: 0x2F DOS MPX-INT: AH:0x11 AL:0x22 DH:0x10 DL:0x68 BH:0x 0 BL:0x30
Call : al: 22 ah: 11 bl: 30 bh: 0 cl: 0 ch: 0 dl: 68 dh: 10
si: 16 di: 94 cf:3246 es: 0 cs:fe2e ss: 2f ds:3483
Return: al: 22 ah: 11 bl: 30 bh: 0 cl: 0 ch: 0 dl: 68 dh: 10
si: 16 di: 94 cf:3246 es: 0 cs:fe2e ss: 2f ds:3483
routine does not return to the callerw t)ph.d`\
X
T&PQ>M>I>>v>r>m?i?e?a?\?X?T@P@L@H@@v@r@[email protected]]BYBUCQCLDHDEwEsFoFkGgHcH_H[HWIS
IO0IK0IBIwDIs]IoPk
Pg8PcP_P[PWQS1SO3SK3SSwrTstToTkTgTcT_T[%UW'US(UO;UK;UUwUsVoEVkVgVcV_V[VWWSWOWKWWwXs
Xo$XkXgXcX_Y[ZW[S[O[K[@\wB\s\o\k]g]c^_f^[^W^S^O^K^ _w?_su_o_k`ge`cb_c[CcWGcS_cOdKddw]eseoekfgfcf_f[ggWgS:hO{hK{hhwhsfioik"jgcjcj_j[UkWkSlORlKRlrwhsfioik"jgcjcj_j[UkWkSlORlK xExJx[x]xkxwxxxxxxxpr<3Por.0!





.TO<[v
$&`}"$ac}><}>>>??O??????@@@@@@@@xAzAGGGGGGHHHHHHHHI
I0IBIDI]I<]IIII*J,JTJJJK?K|KKK/LnLLL'McMMNBNaNNNNO:OqOsOOOP
P8P`PPPX$X`XXXXXXY:Y<:YqYYYY.ZEZZZZZZZZ=[@[[[[[[<[[[@\B\T\V\\\\\]]R]]]^^^f^~^<~^^^^^^^^^_ _?_u_w___``e```<```Ha[aaa
bXbbbbbbc6c8cCcEcGc_c<_cacIdKdddddd?e_eeeeffff.ggggmVmmmmmmnWnnnn oiooo0Courier New


.TO<