🚀 go-pugleaf

On Sun, 07 Feb 1999 18:57:17 GMT, "Jon"
<newsmail@localSPAMFREE.clara.co.uk> wrote:

> Please note - Newsgroup distribution updated.
> 
[snip]
> Normally I can type PRINT anything.txt and after being asked where to print
> to, the file would print.
> 
> However, it is possible that the configuration has been altered by somebody
> to redirect print commands destined for LPT1 to a COM port using MODE for
> example. (no reasons why, they just might!!)
> At this stage I wouldn't know that it's been done.
[...] 
> What could I enter in DOS to override *all* preceeding DOS redirects,
> configurations etc to ensure that my PRINT command will print the file
> anything.txt on LPT1??

When you ask DOS to print anything, or when a program calls DOS to
print anything, one or more DOS routines are called via a vector (an
address) stored in low memory (RAM, not ROM). These routines, in turn,
call the BIOS to send the data out of the printer port. (I'm going to
simplify this description a little).

Normally, using a command like "type anything.txt >lpt1:" would send
the file directly to the printer port, thus by-passing any redirection
set up using the mode command (which, I believe, simply re-directs
anything sent to the prn: device).

However, if the address(es) in low memory have been replaced by
another address that vectors to, say, a TSR (terminate and stay
resident) program that might, say, sneakily upload your text file via
the net to a remote location (as per the BO virus), or send it via a
LAN or WAN to another computer), then a) as you said, you probably
wouldn't know about it, and b) as you also said, your printer wouldn't
work.

AFAIK, the only way to reliably detect whether this is the case is to
find where the character printing routines have been vectored to (if
indeed they have), and disassemble whatever you find there. As to
finding out how it got there, you'd need to check your config.sys and
autoexec.bat files to see what TSRs, drivers, etc. get loaded and see
if anything's been piggy-backed onto them.

Of course, if someone has re-vectored the print routines, they're not
too clever if they're not sending the text to the printer as well as
whatever they're doing with it. Had they done that, you might never
detect it.

And, off the top of my head (at 4:18 am), if the print routines have
been re-vectored, the only way I can think of to get round this is to
set the addresses back to what they should be (which is dependent on
the BIOS version). A relatively easy job if you have a decent
disassembler.

I should think that if anything like this has happened, you'd have
good reason to call on the services of the law. However, I am not a
lawyer. Nor am I a hacker, so some of what I've said is based on
limited knowledge. You might get a better answer in one of the hacking
(*not* cracking - there's a huge difference) newsgroups.

-- 
Garry Knight
garry@garryknight.freeserve.co.uk