i'm doing some experiments with interrupt hooking in MS-DOS 16 bit .COM file, and there is a unexpected behaviour i cannot explain. My code is, more or less:

; get the current address of int 21h
mov ax, 0x3521
int 0x21

; store it
mov , bx ; offset of int 21h in ms-dos
mov , es ; segment

; simulate an interrupt call using a far call: exit to dos
mov ax, 0x4C00
call far dword ; di holds _start location, since it is not at first location but could vary
INT21 dd 0

well, it assembles properly but when i run it, it crashes. debugging it i can see a strange "CS: DB 66" after the pushf: the program hangs exactly at that point. In more details:

2048:011D 9C pushf
2048:011E 2E CS:
2048:011F 66 DB 66

it crashes at 2048:011E

where is my mistake?  :shock:

on NASM manual i can read:

"When NASM is in BITS 16 mode, instructions which use 32-bit data are prefixed with an 0x66 byte, and those referring to 32-bit addresses have an 0x67 prefix. In BITS 32 mode, the reverse is true: 32-bit instructions require no prefixes, whereas instructions using 16-bit data need an 0x66 and those working on 16-bit addresses need an 0x67."

but i still have no ide on how it crashes

PS this is apparently useless code, i know, but im trying to call interrupt without using an 'int' instruction, so when i'll be replace the standard handler with my own one, i will be able to use standard dos services within my hook (eventually calling default ones when all my stuff is done)
Posted on 2008-03-13 19:22:04 by TheClue
try just "call far " withouth the "cs:di+"

also you might consider double checking that you set ds to cs after looking up the offset of int 21h
Posted on 2008-03-15 23:08:07 by jakor