From:	MERC::"uunet!CRVAX.SRI.COM!RELAY-INFO-VAX"  2-FEB-1993 01:02:29.85
To:	uunet!"info-vax@crvax.sri.com"
CC:	
Subj:	Interesting hack

 Thanks to those who replied about stealing RMS entries. While
the hack I wanted to do is infeasible for other reasons, a bit
of light did occur to me. I suspect that this would let me
implement "catch tasks" in DCL, just like my old favorite ones
in RSX11M. I'd appreciate any comments anyone has about feasibility,
sensibleness, and so on; the technique looks useful. If anyone
implements the mail filter, maybe Ray can use it to just filter
the info-vax group himself, without manual intervention. (Curses
should at least be imaginative, as should abuse, if it is going
to be other than just in email, IMO.)
  Here's the goodie:
 It occurs to me that you can tack arbitrary process
code in ahead of about any point in VMS rather simply thus:
1. Bash the desired entry point. Lots of examples exist on sig tapes
and elsewhere.
2. In your code, first do sanity checks...don't interfere with calls
to system functions BY the process you're using to intercept them
for instance. Also whatever other selection you can make in priv'd
modes.
3. Do a cmkrnl call if you need to.
4. In the kernel mode code, pack up and send data to your drone
process that is to be stuck into the loop. Include any info you
like, PLUS where to send a special kernel AST when done. (Fill
in a data block & point ACB param at it, use exe$writembx,...).
5. Now set a flag someplace that says to wait and go into a loop
calling sch$rwait to rwast the process. Keep looping till
the flag gets set to continue.
6. When the process gets done, it should send a special knl ast to
the desired location (or even a regular ast) in your code which
will then set the flag to let the sch$rwait call loop end.
7. Once the sch$rwait loop ends, restore regs, etc., and return to
let things go on as before.

voila! Now you have added your own random process code into wherever
you pleasse. (You need to rwast the process so it doesn't mess up
its args...the code will do well to disable some AST modes as well
to ensure the process can't do anything during its enforced waiting.)

One example app might be to implement the famous "SPW" (spacewar)
instruction from the old PDP1X as a system service. Another, to
steal the $put entry and if a user is in MAIL and uses any 4 letter
swear words, have your daemon process grab the terminal, clobber
mail, and put 'em in a loop to issue dirty limericks whatever command
they issue, until they give a command like "I'M SORRY". Could teach
'em to be at least more imaginative in their swearing & abuse. :-)
Glenn Everhart
Everhart@raxco.com