What fun hacks did you pull off in the days of yore?
Perhaps my favorite was discovering where the BIOS implementation of the keyboard ring buffer stores its data. (Segment 0x40, bytes 0x1A and 0x1C, iirc) The two values are 16-bit pointers to the head and tail pointers of the keyboard buffer. The keyboard interrupt handler routine did only one two range checks on these pointers, and that was to wrap them to the beginning when they hit the end of the buffer, and beep at you when the two pointers were one apart (indicating the buffer was full)
This meant any system bundled with QBasic let you twiddle with these values, with a trivial program like:
DEF SEG &H40
POKE &H1A, 1
POKE &H1C, 1
Would point the buffer to an address before the pointers to the buffer themself.
This meant that you had 25 keystrokes before the keyboard input buffer would overwrite the head pointer. After that happened, all hell broke loose, as your computer would attempt to iterate through the input buffer, but since the head pointer is corrupt it simply bounces around segment 0x40 pulling in garbage data as if it were keyboard input.
This meant you could run the program and get it back to some sort of "normal" state as long as it took under 25 keystrokes. After that, everything would be fine for a few keystrokes, then the computer would go completely nuts.
Perhaps my favorite was discovering where the BIOS implementation of the keyboard ring buffer stores its data. (Segment 0x40, bytes 0x1A and 0x1C, iirc) The two values are 16-bit pointers to the head and tail pointers of the keyboard buffer. The keyboard interrupt handler routine did only one two range checks on these pointers, and that was to wrap them to the beginning when they hit the end of the buffer, and beep at you when the two pointers were one apart (indicating the buffer was full)
This meant any system bundled with QBasic let you twiddle with these values, with a trivial program like:
DEF SEG &H40
POKE &H1A, 1
POKE &H1C, 1
Would point the buffer to an address before the pointers to the buffer themself.
This meant that you had 25 keystrokes before the keyboard input buffer would overwrite the head pointer. After that happened, all hell broke loose, as your computer would attempt to iterate through the input buffer, but since the head pointer is corrupt it simply bounces around segment 0x40 pulling in garbage data as if it were keyboard input.
This meant you could run the program and get it back to some sort of "normal" state as long as it took under 25 keystrokes. After that, everything would be fine for a few keystrokes, then the computer would go completely nuts.
Comment