Page 1 of 2
Hook ctrl+alt+del
Posted: Sun Mar 30, 2008 2:20 am
by Pitchu
Hi
how could i hook ctrl+alt+del?
Any connection with int19h?
Re: Hook ctrl+alt+del
Posted: Sun Mar 30, 2008 2:29 am
by cyr1x
Pitchu wrote:
how could i hook ctrl+alt+del?
Just check in the KBC if the keys are pressed.
Any connection with int19h?
Erm .. no? Int19h is invoked by pressing ctrl+alt+del at _early_ bootup.
Posted: Sun Mar 30, 2008 5:11 am
by Pitchu
KBC?
Is it KeyBoardController?
Please elobrate what it means.
Also, if int 19h invoked by ctrl+alt+del at early bootup, what it does invoke later to reboot?
I hav a boot loader installed on hard disk that is in infinite loop asking to load my OS or other OS on the like XP. but if i press ctrl+alt+del instead of arrow keys and enter key to select and confirm my choice it reboots.
Posted: Sun Mar 30, 2008 5:47 am
by cyr1x
Pitchu wrote:KBC?
Is it KeyBoardController?
Please elobrate what it means.
Yes.
Also, if int 19h invoked by ctrl+alt+del at early bootup, what it does invoke later to reboot?
It just does a far jmp 0xffff:0000 IIRC
Posted: Sun Mar 30, 2008 6:11 am
by Pitchu
cyr1x wrote:Pitchu wrote:Also, if int 19h invoked by ctrl+alt+del at early bootup, what it does invoke later to reboot?
It just does a far jmp 0xffff:0000 IIRC
Is this mechanism of jumping to 0xffff:0000 hardcored in keyboard controller like i8042 on sensing ctrl+alt+del, i mean doesnot it invoke any ISR?
What is IIRC?
Posted: Sun Mar 30, 2008 6:53 am
by Combuster
Pitchu wrote:Is this mechanism of jumping to 0xffff:0000 hardcored in keyboard controller like i8042 on sensing ctrl+alt+del, i mean doesnot it invoke any ISR?
Stupid question. How can one behaviour be hardcoded when it also shows another behaviour.
What is IIRC?
Even more stupid question. STFW
Posted: Sun Mar 30, 2008 7:12 am
by Pitchu
Combuster wrote:Pitchu wrote:Is this mechanism of jumping to 0xffff:0000 hardcored in keyboard controller like i8042 on sensing ctrl+alt+del, i mean doesnot it invoke any ISR?
Stupid question. How can one behaviour be hardcoded when it also shows another behaviour.
What is IIRC?
Even more stupid question. STFW
If u think it is a stupid question then u should have elobrated the actual fact of which i am unaware so that i wont ask such question to anybody else.I think yours comment was STUPID one.
Rather than proving to be ocean of knowledge try to a spring, atleast people can fulfill their thirst.
Posted: Sun Mar 30, 2008 7:21 am
by JamesM
Yeah well, do me a favour and press "ctrl-alt-del" right now.
assuming windows Do you see that box which comes up? Do you see how the computer hasn't reset itself? This gives you one very simple hint that the behaviour isn't hardcoded into the keyboard controller. Besides the fact that having a "Push here to destroy" button combo is asking for disaster in a secure OS...
Combuster told you to STFW because you should have -
My first result on google for 'IIRC' tells me all about it. We don't like people here who are too lazy to find obvious answers.
Posted: Sun Mar 30, 2008 7:25 am
by t6q4
Welll, you should do as he says to stop further flames.
STFW - Search The F***ing Web.
RTFM - Read The F***ing Manual.
And IIRC was on google - it was in the 3rd site down, in the description!
If you don't know what Google is, go to
http://www.google.co.uk or
http://www.google.co.in in your case.
And if you still CBA (GOOGLE!!!)
IIRC - If I Remember correctly
EDIT :: JamesM replied just before me
On Google, it's the 3rd and 2nd for me, IIRC brings up Interactive Illinois Report Card for my first result...
Posted: Sun Mar 30, 2008 9:19 am
by Pitchu
Yeah!
I pressed ctrl+alt+del and 2 my surprise it didnt reboot. This means "No hardcore jmp", great.
Yep i am lazy coz i am using cellphone 4 web surfing most often and i cant minimise a window 2 launch another say GOOGLE.CO.IN in my case. Worse my keyboard is tetley.
Yep my question was a stupid one coz i was not able 2 undestand that if that key combination executes a jmp instruction 'where is that instruction' in memory so that i will overwrite that instruction by mine.
Oh! Stupid question. Why should i care, just check 4 that key combination at Port 60h-64h.
Posted: Sun Mar 30, 2008 9:48 am
by JamesM
Then I suggest you invest in a computer, so that we don't have to live through all your SMS shortcuts.
Posted: Sun Mar 30, 2008 10:07 am
by lukem95
a "good" (i.e. correct) way of doing it would be to write an ISR routine that fires on INT 0x9.
Then check for the scancodes for Alt+Ctrl+Del (making sure than at every interrupt none of those keys have been released). You can check the scancode for keys that have just been released by ANDing the scancode with 0x80.
Pseudocode:
Code: Select all
int9(reg* r)
{
scancode = inb(0x60);
if(scancode & 80)
{
tmp = scancode - 0x80;
if(tmp == ALT)
alt_pressed = false;
if(tmp == CTRL)
ctrl_pressed = false;
if(tmp == DEL)
del_pressed = false;
} else {
if(scancode == ALT)
alt_pressed = true;
//ETC
}
if(alt_pressed && ctrl_pressed && del_pressed)
//Do code here
//Like reboot if thats what you want
outb (0x64, 0xFE);
}
Posted: Sun Mar 30, 2008 10:49 am
by piranha
I pressed ctrl+alt+del and 2 my surprise it didnt reboot. This means "No hardcore jmp", great.
Yeah.....
thats what we've been telling you!
-JL
Posted: Mon Mar 31, 2008 12:55 am
by Pitchu
Wow! It was 2 hard 2 get there i.e. Ctrl+alt+del doesnt reboot....
Amazing i made a discovery by asking a stupid question.
My thanks only goes to 'LukeM' 4 clear answer. So dear, that jmp instruction is part of int 09h isr?
Posted: Mon Mar 31, 2008 1:43 am
by AJ
The gist of it is - the ISR is installed by the operating system. If you want ctrl-alt-del to reboot the computer, you need to code it that way. If you want ctrl-alt-del to launch a new web browser instance - well, you can do that too. It is not part of any ISR until you write the ISR.
The exact ISR number will vary depending on what processor mode you are in. In protected mode, Int 0x09 is something like a "Coprocessor Segment Overrun" exception. Not having used a coprocessor, I've no idea what that is for, but you can't use interrupt numbers 0-0x1F. You will need to use your IRQ 0x01 handler. In real mode, it may well be Int 0x09.
Cheers,
Adam