Re: Found, a new rootkit

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Tim wrote:
Tim:

Are you saying that unexpected data coming through your COM port
wouldn't generate IRQ messages (COM ports have an IRQ), which would be
kicking the CPU quite hard?  That's not exactly a trivial thing to
ignore.


Mike McCarty:

The BIOS and MSDOS do not enable interrupts on the UART devices,
hence the CPU doesn't see any requests.

Please don't lecture me about MSDOS systems programming. I wrote my
first interrupt driven serial comm package for MSDOS in 1985.


Actually, I was asking a question, not giving a lecture, but since

Sorry. I'm getting hit by others, so I guess I got my hackles up
a little bit. I apologize.

you've taken that attitude, answer this:

In the BIOS you get to set the address and IRQ that a serial port will
use.  You can also set power wake up options that wake up the PC if a
particular IRQ is activated.  If you set it to wake up when the IRQ used

Some things are getting conflated. First, none of the serial cards I use
with MSDOS can be configured this way. They all use jumpers. What you
are talking about is which IRQ will be used *if* an interrupt occurs.

by the serial port is activated (i.e. an external modem wake-on-ring
type of function), the PC will wake up (serial port activity causing an
IRQ signal, waking up the system).

None of my systems supports any sort of sleep mode, except for a laptop
which has been retired. So I'm not quite aware of where that boundary
occurs. I'd think it is in the OS, not the BIOS, for a few reasons.
Primarily, the OS is what knows what really needs to be saved/restored
after a sleep mode shutdown.

Now, *that* seems to refute your first assertion.  (The serial port
generated an IRQ signal, and the BIOS played a part in it.)

As I said, I'm not expert in how this type of function works, nor
how much is done in the OS and how much in the BIOS. My GUESS is
that these are a function of the OS, not the BIOS. If you boot
your "sleepy" system under pure MSDOS, will the sleep function
still work? I trow not. Are you willing to give that a try? If you
have such a system, I could easily arrange to send you a bootable
floppy image which would look for whatever interrupt you have
configured, and we could check for that. You'd need to be able
to allow it to go to "sleep", and then generate activity on the
COM port. Or even if it won't go to sleep, just let it run for
a 1/2 hour and try sending it a character.

Mike
--
p="p=%c%s%c;main(){printf(p,34,p,34);}";main(){printf(p,34,p,34);}
This message made from 100% recycled bits.
You have found the bank of Larn.
I can explain it for you, but I can't understand it for you.
I speak only for myself, and I am unanimous in that!


[Index of Archives]     [Current Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Yosemite News]     [Yosemite Photos]     [KDE Users]     [Fedora Tools]     [Fedora Docs]

  Powered by Linux