Thread: Dumping Interrupt Vector Table

  1. #1
    Registered User
    Join Date
    Aug 2011
    Posts
    385

    Dumping Interrupt Vector Table

    I am trying to dump the contents of Interrupt Vector Table on 32 bit Widows 7 machine using the following code excerpt.

    Code:
    #include <stdio.h>
    #define WORD unsigned short
    #define IDT_001_ADDR 0         // start address of the first IVT vector
    #define IDT_255_ADDR 1020     // start address of the last IVT vector
    #define IDT_VECTOR_SZ 4    // size of the each IVT vector
    
    int main(int argc, char **argv) {
            WORD csAddr;            // code segment of given interrupt
            WORD ipAddr;            // starting IP for given interrupt
            short address;            // address in memory (0-1020)
            WORD vector ;            // IVT entry ID (0..255)
    
            vector = 0x0;
            printf("n-- -Dumping IVT from bottom up ---n");
            printf("Vector\tAddress\n");
    
            for(address=IDT_001_ADDR; address<=IDT_255_ADDR; address=address+IDT_VECTOR_SZ,vector++) {
                printf("%03d\t%08d\t", vector , address);
                // IVT starts at bottom of memory, so CS is always 0x0
                __asm {
                        PUSH ES
                        mov AX, 0
                        mov ES,AX
                        mov BX, address
                        mov AX, ES:[BX]
                        mov ipAddr ,AX
                        inc BX
                        inc BX
                        mov AX, ES:[BX]
                        mov csAddr, AX
                        pop ES
                };
                printf("[CS:IP] = [%04X,%04X]n" ,csAddr, ipAddr);
        }
    }
    It does not compile with Visual Studio as Visual Studio has probably withdrawn support for 16 Bit compilation. I built it in Pelles C, however the executable would crash when I try to run it. The problem, as I figured from some research over the internet, has to do with the 16 bit register reference (to ES). I do not however clearly understand the issue. I would really appreciate if someone could help me out with getting this to work on win32

  2. #2
    and the hat of int overfl Salem's Avatar
    Join Date
    Aug 2001
    Location
    The edge of the known universe
    Posts
    39,661
    Regardless of anything else, all you're going to get is the bottom of the virtual memory the process is running in.
    If you dance barefoot on the broken glass of undefined behaviour, you've got to expect the occasional cut.
    If at first you don't succeed, try writing your phone number on the exam paper.

  3. #3
    Registered User
    Join Date
    Oct 2006
    Posts
    3,445
    Quote Originally Posted by juice View Post
    if someone could help me out with getting this to work on win32
    We had a thread similar to this a few weeks ago, when a user wanted to access the ES register directly. Windows will not allow you to do this. You will need to run on an older operating system like DOS, if you expect to get this info, and have it be meaningful. Windows and most modern operating systems do not use the IVT. They immediately switch to protected mode, and use the Interrupt Descriptor Table (IDT), which you cannot access, due to its protection level. The only reason that I can conceive for why you would want to get the contents of the interrupt table(s) on Windows is to circumvent it somehow, for your own, possibly malicious, purposes.
    What can this strange device be?
    When I touch it, it gives forth a sound
    It's got wires that vibrate and give music
    What can this thing be that I found?

Popular pages Recent additions subscribe to a feed

Similar Threads

  1. Replies: 9
    Last Post: 09-22-2013, 07:00 AM
  2. Enable core dumping
    By steve1_rm in forum C Programming
    Replies: 3
    Last Post: 01-21-2009, 10:41 AM
  3. program segfaults without dumping a core
    By ladar in forum C Programming
    Replies: 4
    Last Post: 04-04-2005, 11:21 AM
  4. Dumping fields into variables
    By nizbit in forum C Programming
    Replies: 7
    Last Post: 02-21-2005, 12:11 PM
  5. Creating a folder then dumping files into it!
    By ChrisMUK in forum A Brief History of Cprogramming.com
    Replies: 13
    Last Post: 08-13-2002, 03:20 PM