Memory Snooping

June 3, 2004 11:46 PM
Long ago, when Turbo C++ 3.1 used to consume much of my time, I wondered how to check the status of insert, scroll lock, caps lock, control key etc. After some time spent digging around in books, I figured out how to do it. Please note that this discussion is valid only for a Intel 8088 and above microprocessor.

The memory address 0x417 points to the status of all these keys. In TC, a pointer declared pointing to this address will do our job. If you try to access this address in Linux directly, you will get a segmentation fault because Linux is a true protected mode operating system and does not allow snooping into addresses like that.

Bit number 2 in the address 0x417 stores the status of the Control key. Here's the full map.

The following function can be used to check if a particular bit is set or not:

int checkbit(char far data,int n)
{
return ((data >> n)&0x1);
}

The following program demonstrates the above function and usage of 0x417 address:

int main()
{
  char far *addr=(char far *)0x417;
  printf("Press Control to Quit\n");
  while (1)
    {
      if (checkbit(*addr,2))
	{
	  printf("Control key is being pressed.\n");
	  break;
	}     
    }
  return 0;
}

Another interesting address is 0x413 which points to the base memory size of the system.

The famous 0xB8000000 which points to the video memory refresh buffer. More about this later.

0FFFF:0005 stores the BIOS revision date.

0FFF:0 if loaded into CS:IP and executed, will cause all IBM compatible PC's to do a cold boot (as if you pressed reset) if you are running under DOS. In Win 9x, this will most probably close your DOS window. Nothing much happens in NT though.

CategoryC