<--- Turn the page
   
(contents page)
   
Turn the page ---> Terminate and Stay Resident No MoreUnload your TSR's |
There has been a lot of questions asked about how one can unload a TSR. Well before I answer this, let us take a closer look at how to make a TSR and how they work. A short look. To make a valid TSR, not counting all the checks you should take, you need to hook in to the current loop of things. The 256 interrupt vectors are all located at the very first of the memory, or at the top of the memory. Since each interrupt vector is a far address, each address is four bytes in length. If you wanted to hook in to interrupt 21h, you would need to find the correct address in this table. 21h times 4 bytes each, or 0000:0084h. Now you can create your TSR and put a new address at this location. I am assuming that you know how to create a TSR. Knowing that you should save the current interrupt vector before you replace it with your own, is a must for removing your TSR later. Also, let us save the address of our interrupt handler. Create your TSR to check for parameters on the command line. If your TSR doesn't see a special UNLOAD parameter, then it checks to see if the TSR is already loaded. If so, just exit. If not, load TSR. If this parameter is found, then we need to see if the TSR is already loaded. If so, we need to find the original address of the our interrupt handler. This address will be stored in the TSR that you created and previously loaded. Where is up to you, but you must know where. For instance, let us say that in our TSR, the first three bytes is a long jump to the initialization code, the next four bytes is the original interrupt vector value, while the next four bytes is the our interrupt handler address. All we need to do, is look at the address pointed to be the interrupt vector address at offset 0084h (int 21h), and then add seven bytes to this address. |
If the four byte value at this address is equal to the address currently in the interrupt vector table for this interrupt, that means no one has a TSR on top of ours and we can unload ours. If these two address values don't match, some one has loaded a TSR on top of ours and
we can not fully unload. In a little more easier terms, if the address value in the interrupt vector table, still equals the value that we put there when we loaded our TSR, then we can safely and completely unload our TSR. If the address value does not equal the same value we placed there previously, then we can only unload all but a few bytes. If we find that it is safe to unload, all we have to do is replace the interrupt vector table value with the previous value when we loaded it and release the memory. If we find that it is not safe to unload, then we can release all the memory except a few bytes. These bytes depend on if you jumped to the next TSR address, or had a IRET. All you have to do is put the same exiting instruction at the beginning of your TSR, and release the rest of the code. If you used IRET, then you can release all but 16 bytes. 16 bytes, because you can not release any less than a 16 byte part, or a paragraph. This technique is not a great technique, but most of the time, it works. Also, please note, that if the two address don't match, then that means you are probably not looking in your TSR but someone else's, because they have replaced the address with theirs and this technique no longer returns the address to your TSR, but theirs. Like I said, this isn't a great technique, but most of the time it works. ¥ |
<--- Turn the page
   
(contents page)
   
Turn the page ---> Page 3