IOS Sample

Hooking Disk Access

This sample is a set of source files (and the built executables) supplied at present with no comment other than what you see here and in the source code. The sources build four test rigs. These are:

  1. A Windows 95 VSD, called DISKHOOK.VXD and loaded automatically if placed in the SYSTEM\IOSUBSYS subdirectory of the Windows installation.
  2. A Windows for Workgroups 3.11 VSD, called DISKHOOK.D32 and loaded automatically if placed in the SYSTEM subdirectory of the Windows installation.
  3. A VxD, called DISKHOOK.386, that hooks disk access between the BlockDev or IOS VxDs and the FastDisk driver (typically WDCTRL). This VxD is to be loaded with a device statement in SYSTEM.INI.
  4. A DOS program, called DISKHOOK.EXE, that hooks int 13h and then runs a command processor. Running the disk hooking program before running Windows gives you a global int 13h hook. Running the disk hooking program from a DOS Prompt inside Windows gives you a local int 13h hook.

The action of all test rigs to modify the appearance of the first sector on cylinder 0 head 1 of the first physical hard disk, a preset location having been chosen so that the sample can concentrate mostly on the mechanics of intercepting disk access. The particular location chosen for the sample usually stores a DOS boot sector. If this is not true for your machine, do not run these test rigs. The specific change to the appearance is to find the first occurrence of the word “disk” in the sector (this word being very likely to appear in an error message somewhere in the sector) and to toggle the case of some of the letters. The DOS test rig toggles the case of the first two letters. The VxD test rigs toggle the case of the last two letters.

Some points to note about the source code are:

All VxD source code is written in assembly language using include files from the Windows 95 DDK.

The Windows 95 and Windows for Workgroups 3.11 VSDs have the same source code (although they must be compiled with different include files). Two of the source files involve small amounts of conditional assembly. One reason is trivial, namely that the different VSD versions have to check for their respective versions of the IOS. Another reason is that only the Windows 95 VSD needs to support the AEP_BOOT_COMPLETE function.

Although the VSD source code is presented separately from the source code for the DISKHOOK.386 version that works for Windows 3.10, it should be noted that there is a strong correspondence between source files and procedures. Indeed, the two versions of the PLAY.ASM source file can be matched very nearly line by line. Port drivers supersede FastDisk drivers. The IOS supersedes BlockDev. VSDs, which sit between the IOS and a port driver are a very natural development of the sort of VxD that sits between BlockDev and a FastDisk driver.

For distribution, the source files and executables are packaged into a cabinet file.

Copyright © 1997. Geoff Chappell. All rights reserved.

[Home][Programming Samples][Application Notes][Security Notes][Editorial][Consultation][Contacts]