中断程序设计（国外英文资料）.doc

中断程序设计（国外英文资料） Interrupt programming Interrupts are an efficient way to output \ input from the CPU and external devices. Interrupts are operations that allow the CPU to suspend execution and program to handle special events, which are called interrupt sources. The interruption caused by an external controller or coprocessor (8087\80287) is generally called an external interrupt. An interrupt caused by an interrupt command in the program, or an interruption caused by some error resulting from the CPU, is called an internal interrupt. External interrupts: masking interrupts INTR Unmasking interrupt NMI Internal interrupt: division error interrupt, overflow interrupt, soft interrupt, single step interrupt, etc Interrupt to scale After the virus program resides in memory, the commonly invoked system program is usually called a virus host such as INT13H, INT21H, INT8, etc. The virus modifies the entry address of the interrupt service to form similar to: The int13h- virus program entrances - virus - virus export - INT13H interrupt service entry. Extract interrupt to scale The DEBUG - M0000:0000 Copy interrupt to scale - RCX CX0000 : 0400 - NINT. TAB - W. Their 0400 bytes - Q Restore the interrupt to scale DEBUGINT. TAB - M01000000 - Q A batch virus program Features: simple, undisguised, and typical of viruses. The file name: AUTOEXEC. BAT ECHO VIRUS get DEMOSTRATION PROGRAM IF EXIST A: \ AUTOEXEC. BAT GOTO VIRUS GOTO NO_VIRUS VIRUS get: A: RENAME AUTOEXEC. BAT AUTO. BAT COPY C: ECHO I AM VIRUS get! NO_VIRUS: C: \ AUTO PAUSE Its the equivalent of an embedded virus program in the original program Each interrupt has an interrupt type number with 256 types. The type Numbers 0-0ffh interrupt to the scale is the entry address of the handler for the interrupt type. 256 interrupts, each containing four bytes, two bytes for the segment address of the interrupt handler, and two bytes for the offset address. From 0 to 5FFH in computer main memory, you hold t