May BIOS calls be intercepted?

[wilsonsamm]

Hello everyone, this is my first post on this board

Tell me, on the x86 architecture, can a program (operating system kernel, application, machine virtualiser, whatever else...) keep a another piece of code from calling the BIOS and deal with this attempted call and call some other function instead?

for example, a virtual machine runs a program which wants to find out how much memory is available. It calls INT 12 which puts this info into AX. But the virtualiser doesn't want to devote all the RAM to this vm, so how can it prevent this from happening?

[Brendan]

Hi,

for example, a virtual machine runs a program which wants to find out how much memory is available. It calls INT 12 which puts this info into AX. But the virtualiser doesn't want to devote all the RAM to this vm, so how can it prevent this from happening?

This is fairly simple - you replace the BIOS's IVT vector (for which-ever interrupts matter to you) with your own IVT vector, and then you can handle the interrupt/s yourself or jmp to the original interrupt handler (or both, e.g. depending on the value in AX).

Typically you'd do the same to reserve yourself some memory - for e.g. replace the BIOS's "get memory size" functions with your own functions that only report what you don't use.

However, for a true virtualiser you'd use virtual8086 mode and virtualise everything, so that you can have 2 or more virtual programs running at the same time without stuffing each other up. This could/would include your own virtual BIOS running inside the virtual machine.


Cheers,

Brendan

[wilsonsamm]

And by this you mean the area of memory between absolute zero and 0x03FF?
That's simpler than I thôt. I'm guessing each entry here contains a 32-bit absolute address pointer to a handler?

[Ninjarider]

havnt delt with virtual enough yet to really know
dont be suprised if there 16 bit seg:offset

[JAAman]

And by this you mean the area of memory between absolute zero and 0x03FF?
That's simpler than I thôt. I'm guessing each entry here contains a 32-bit absolute address pointer to a handler?

in RMode, on bootup it is located at that address, yes (though it can be moved), but it doesnt use 32 bit addresses, its a 16:16 segment:offset pair, as is customary in RMode


but as brendan said, its even better (though slightly more complicated) to use VMode

this is, of course, assuming your talking about compatibility with older RMode programs
if your talking about new programs written for your OS, PMode is the way to go, and that automatically restricts the user applications in more ways than just that