From:	MERC::"uunet!CRVAX.SRI.COM!RELAY-INFO-VAX"  1-FEB-1993 00:44:38.49
To:	info-vax@kl.sri.com
CC:	
Subj:	Re: Stealing RMS entries?

gleeve@galaxy.dnet writes:
> Anyone have any info on techniques for stealing RMS entry points
> and inserting your own code ahead of them? I've been thinking
> about an application that would be handy if I could readily find
> out when certain things are done to a file. I have (and will examine)
> a copy of FTS...just wondering if anyone cares to shed any light
> on this...seems that examples of stealing P1 system service entries
> would be applicable, as would Ehud's "check_grant_license" or similar
> examples. Maybe I can catch file mods, record-oriented, in realtime...

I've intercepted system service calls by using the same technique as DEBUG
uses.  What you do is:

	First, install a routine somewhere in P1 pool (using EXE$ALOP1PROC)
	Copy the 8 bytes of vector code (at SYS$xxx) to the routine in 
		P1 pool.  This will be an entry mask an CHME #x for an RMS
		call, but copy the whole vector, just to be safe.  The
		routine just JMPs or CALLSs to the copied vector when it
		needs to hit the real service.
	Copy the page that the vector lives in to a scratch buffer.
	Use $CRETVA to create some writable address space over that page
	Copy your scratch buffer back onto the (now zeroed) page.
	Use $SETPRT to set it to URKW
	Change the vector to be a JMP <routine-in-P1-pool>

(Actually, I set the page protection to UW, diddle the page from user mode,
and set it to $URKW when I've finished.  Call me paranoid.) 

There are some extra hassles if the vector for $CRETVA or $SETPRT live in
the same page as you're diddling, in which case you have to copy the 
vectors for those routines and call via the copied vectors.  (You can use
the vectors in the copied block of course.)

Obviously, much of this needs to be done in kernel mode....

This technique works well if you want to intercept within your process only.
Ehud's trick is better if you want to diddle things on a systemwide basis.

--
Don Stokes, ZL2TNM (DS555)                        don@zl2tnm.gen.nz (home)
Network Manager, Computing Services Centre            don@vuw.ac.nz (work)
Victoria University of Wellington, New Zealand              +64-4-495-5052