IBMMuseum
Veteran Member
- Joined
- Aug 28, 2006
- Messages
- 1,488
I'll have to dig some of my old code I wrote to see the order I made these calls to go through the different Windows versions (but versions like 9x would use them to block Windows 3.x & earlier from running in a DOS box). And rather than for DOS program usage they were probably design for preventing early Windows from being run recursively. Tested up through about W98SE, because that is all I had at the time, and definately not tested under any form of a VM designed to let things like this work.
Let's just toss the stuff out for comment:
INT 2F Function 1600h
"Windows Enhanced Mode Installation Check"
Registers at call:
AX = 1600h
Return Registers:
AL = Status:
00h: Neither Windows 3.x Enhanced Mode nor Windows/386 2.x running
01h: Windows/386 2.x running
80h: XMS version 1 driver installed (marked as obsolete, further details on request)
FFh: Windows/386 2.x running (see notes)
AL = anything else
AL = Windows major version >= 3
AH = Windows minor version number
Notes: I don't know why there is a duplicate entry for Windows/386 2.x running
INT 2F Function 1605h
"Windows Enhanced Mode & 286 DOSX INIT Broadcast"
Registers at call:
AX = 1605h
ES:BX = 0000:0000h
DS:SI = 0000:0000h
CX = 0000h
DX = bit flag used:
Bit 0 = 0 if Windows Enhanced Mode initialization (which is what we would use)
Bit 0 = 1 if Microsoft 286 DOS Extender initialization
DI = version number (major in upper byte, minor in lower)
Return Registers:
CX = 0000h if okay for Windows to load
CX = non-zero if Windows should not load
ES:BX -> startup info structure (more details if needed)
DS:SI -> virtual86 mode enable/disable callback or 0000:0000h
Notes: Even though this is for a TSR program to hook into (there is also an exit call), I remember the Windows hooked this itself. Can't remember if I used it (or some of the values I used), but we would look for the CX = 0 return value as evidence that Windows was not running.
INT 2Fh Function 160Ah
"Identify Windows Version and Type"
Registers at call:
AX = 1605h
BX = 0000h
CX = 0000h
Return Registers:
AX = 0000h if call supported
Then BH = major version
BL = minor version
CX = mode:
0002h = Standard Mode
0003h = Enhanced Mode
Notes: If at least Windows 3.1 (lowest version supporting the call) or higher needs to be checked, this is the call to use.
There is also DOS interrupts for VM IDs within Windows & switching VMs. Most other detection (like for OS/2) is done by getting DOS version calls, with TRUEVER & DR-DOS methods (listed later). I suppose a table could be generated for the different Windows/DOS OSes/interfaces, including whether the OS can deceive the calls, deliberately or otherwise.
Let's just toss the stuff out for comment:
INT 2F Function 1600h
"Windows Enhanced Mode Installation Check"
Registers at call:
AX = 1600h
Return Registers:
AL = Status:
00h: Neither Windows 3.x Enhanced Mode nor Windows/386 2.x running
01h: Windows/386 2.x running
80h: XMS version 1 driver installed (marked as obsolete, further details on request)
FFh: Windows/386 2.x running (see notes)
AL = anything else
AL = Windows major version >= 3
AH = Windows minor version number
Notes: I don't know why there is a duplicate entry for Windows/386 2.x running
INT 2F Function 1605h
"Windows Enhanced Mode & 286 DOSX INIT Broadcast"
Registers at call:
AX = 1605h
ES:BX = 0000:0000h
DS:SI = 0000:0000h
CX = 0000h
DX = bit flag used:
Bit 0 = 0 if Windows Enhanced Mode initialization (which is what we would use)
Bit 0 = 1 if Microsoft 286 DOS Extender initialization
DI = version number (major in upper byte, minor in lower)
Return Registers:
CX = 0000h if okay for Windows to load
CX = non-zero if Windows should not load
ES:BX -> startup info structure (more details if needed)
DS:SI -> virtual86 mode enable/disable callback or 0000:0000h
Notes: Even though this is for a TSR program to hook into (there is also an exit call), I remember the Windows hooked this itself. Can't remember if I used it (or some of the values I used), but we would look for the CX = 0 return value as evidence that Windows was not running.
INT 2Fh Function 160Ah
"Identify Windows Version and Type"
Registers at call:
AX = 1605h
BX = 0000h
CX = 0000h
Return Registers:
AX = 0000h if call supported
Then BH = major version
BL = minor version
CX = mode:
0002h = Standard Mode
0003h = Enhanced Mode
Notes: If at least Windows 3.1 (lowest version supporting the call) or higher needs to be checked, this is the call to use.
There is also DOS interrupts for VM IDs within Windows & switching VMs. Most other detection (like for OS/2) is done by getting DOS version calls, with TRUEVER & DR-DOS methods (listed later). I suppose a table could be generated for the different Windows/DOS OSes/interfaces, including whether the OS can deceive the calls, deliberately or otherwise.