🚀 go-pugleaf

jesse@gumby.Altos.COM (Jesse Chisholm AAC-RjesseD) writes:
>| >How can it prevent itself from being re-installed?  I know programs such as
>| >NORTON SI will show you who "owns" an interrupt, and my program comes up 
>| >as the owner.  If there was a way to see if the owner was NOT DOS (i.e. another

>Many TSRs chain their interrupt and so it might be installed but no longer
>be the first in the chain.  A way of checking for the signature you mention
>that gets around this is to check at that offset for ALL segments from 0000
>up to your current CS.  when you find the signature if the segment is not
>equal to the current CS, then your TSR has been installed before and is still
>in memory.  If the first time you find the signature is in your current
>CS segment, then your TSR has not yet been installed.  Go for it.

One problem with this solution: you can find the signature in your disk
buffers or disk cache. To avoid this you must look for a garbled signature.
So, say the ID string is "clock tsr v1.1", then you can change this
at run-time in "CLOCK TSR V1.1" and look for this string when your TSR is
started.
This solution works flawlessly (although the whole concept is ugly, due
to the lack of standardisation in the TSR world) and has been used by
many programmers (professionels too).


Richard.

-- 
Richard Kooijman                 |           (__)
Delft University of Technology   |           (oo)   -------------------------
Dept. Electrical Engineering     |    /-------\/ - | Don't have a Bart, man! |
Section Computerarchitecture     |   / |     ||     -------------------------
Neural Network Group             |  *  ||----||
Room 10.04                       |     ^^    ^^
kooijman@duteca.et.tudelft.nl    | The Simpsons' cow