asm, Make a TSR don't detected by DOS

ALUMN
#1 / 5

Make a TSR don't detected by DOS

Can someone tell me how can I (if it's posible) to make a TSR program
that stays in memory but when you type: mem in DOS you can't see it.
I'm thicking this must be made with out the DOS, no?. Please send source
too.

Thanks

Fri, 19 Feb 1999 03:00:00 GMT

Bernardo Rein
#2 / 5

Make a TSR don't detected by DOS

Quote:

> Can someone tell me how can I (if it's posible) to make a TSR program
> that stays in memory but when you type: mem in DOS you can't see it.
> I'm thicking this must be made with out the DOS, no?. Please send source
> too.

> Thanks

That can easily be done. If you have (like I do) 639Kb available
to DOS, then the last Kb is probably used by the BIOS, but it only uses a few
bytes there, so you have almost 1Kb to store anything you want, and
nobody (DOS) will know about it.

Also you could search for the environment segment of some TSR
that didn't free it, and fit your TSR in it. I haven't tried this, but I
guess it'd work. I would also fill the holes in memory that stupid TSR's
leave when they don't free their env segment.

Another way would be to change the MCB previous to yours,
modifying the size of the block, so that your code becomes part of
someone else's code, so your program will be hidden...

Hope it helps,

Sat, 20 Feb 1999 03:00:00 GMT

Sam Vilai
#3 / 5

Make a TSR don't detected by DOS

Quote:

> Can someone tell me how can I (if it's posible) to make a TSR program
> that stays in memory but when you type: mem in DOS you can't see it.
> I'm thicking this must be made with out the DOS, no?. Please send source
> too.

Just make your TSR resident in memory in an area not touched by an MCB;
egs are: in the upper half of the interrupt table, in the BDA (both of
these are quite iffy). Or, you could resize another MCB's size and tap on
the end of that... there are lots of possibilities.

Quote:

>:-P

...And on the seventh day, He connected to the WWW and did nothing...

Mon, 22 Feb 1999 03:00:00 GMT

Stewart McDonal
#4 / 5

Make a TSR don't detected by DOS

Quote:

> Can someone tell me how can I (if it's posible) to make a TSR program
> that stays in memory but when you type: mem in DOS you can't see it.
> I'm thicking this must be made with out the DOS, no?. Please send source
> too.

This is very hard, and not a good idea. It can be done, but it is usually
needed only for virii, and a virus detector (a very good one) will catch
your program and spit it out.

Tell me what you're going to use it for, and I'll give you some infos on
how to do it (from virus texts ;-) ).

Cia0, Joker/JAM Australia

Wed, 24 Feb 1999 03:00:00 GMT

Michael Tippac
#5 / 5

Make a TSR don't detected by DOS

Quote:

> > Can someone tell me how can I (if it's posible) to make a TSR program
> > that stays in memory but when you type: mem in DOS you can't see it.
> > I'm thicking this must be made with out the DOS, no?. Please send source
> > too.
> This is very hard, and not a good idea. It can be done, but it is usually
> needed only for virii, and a virus detector (a very good one) will catch
> your program and spit it out.

Any semi decent virus scanner is able to tell a virus from a program
simply doing something with the MCB chain without causing any harm.

Quote:

> Tell me what you're going to use it for, and I'll give you some infos on
> how to do it (from virus texts ;-) ).

You're soo cool, aren't you? Anyway, the difference is, that you never
would start a program "virus.exe" so DOS would not report the name
of your virus as the MCB owner would it?

A TSR usually is launched as it is, not as a fake part of another
program.

later

Wuschel

Wed, 24 Feb 1999 03:00:00 GMT