Normally Interrupt Vector Table has the address of Interrupt Service Routine which is nothing but the routine that should be handled in case of an interrupt. So in a normal process when an interrupt occurs the interrupt number is multiplied by four and this result is searched in Interrupt Vector Table and the contents of this result in Interrupt Vector Table gives the address of interrupt service routine. After getting the routine’s address the control passes to the routine and the action as specified in routine gets executed. This is normal process that takes place.

 

But now interesting fact to know is how TSR gets activated here on event of pressing a key that is in case of an interrupt. This is done by TSR as follows. When a normal interrupt occur the address of Interrupt Service Routine is replaced with address from TSR routines. So after this the process continues as before. That is the routine checks to find if the interrupt has any association with TSR keys if it is then the corresponding routine gets executed. Otherwise the control returns to Interrupt service Routine which is the original process.

 

Suppose if we have number of TSR loaded as stack the process is same except that check is made to find if the interrupt has association with TSR key sequence that is in top of stack in other words with the TSR that was loaded the latest. If it is it executes the process associated with that TSR otherwise control passes to the next TSR in stack to perform the check whether it has association with the interrupt and this process goes on. After all TSR is checked and processed the control gets back to the original Interrupt Service Routine and the process continues as usual.

 

 

One more interesting fact to know about is about the similarities between virus and TSR. All viruses are TSR’s but none of the TSR’s is virus. This fact is because TSR are Terminate-Stay-Resident programs which will get loaded in memory and stay there permanently until explicitly removed. Similarly viruses also get loaded and stay in memory. But the main difference is virus gets into memory without users knowledge but TSR gets into memory in the control of user since it is written by users only.

 

So having known about TSR and its working terminology one may get an idea that we can remove virus by changing the contents of Interrupt vector table into original state. We can do that but the greatest risk associated here is while changing the contents of Interrupt vector table there is a possibility that some Terminate Stay Resident Programs which are already written and which exists in memory previously may have associated interrupts placed in Interrupt Vector Table.

 

While changing the Interrupt Vector Table for virus cleaning if we write on any of these TSR associated interrupt by mistake then the interrupts associated with existing TSR gets damaged . As a result of this activity the TSR will exist but without any use that is in other words the associated interrupt will not be called. These effects cause the TSR to stay in memory without having any effect.  So users have to take care while doing this process and it is better to avoid this activity.

TrackBack URI for this entry