Hi.
Is it possible to assign same interrupt routine to many IVT entries and then inside it find out where did the interrupt come from (its IVT number)?
If it is, which instruction (in Intel architecture) does the job?
I think you can modify the IVT as you see fit. In other words, you can create your own interrupt routine(s) but you must be careful that you need to also handle the original interrupt in case it is called from somewhere else. Given your question, yes, you can place the same pointer in many IVT entries. As far a finding out from where the interrupt originated you will probably have to trace the return path back to the source of the interrupt. I used to do this while ecperimenting around with DOS. But be careful, you can easly crash your system if you fail to take care of the original interrupt. FYI: I think there are also empty IVTs available if you want to create your own interrupt routine with an unused IVT number. At least there was under DOS 6.0.
Short answer - no.
You can get the right effect by doing the following:
@int22:
mov eax,22
jmp @the_int
@int23:
mov eax,23
jmp @the_int
@int24:
mov eax,24
jmp @the_int
.
.
@the_int:
;do your stuff here ;)
;eax is the int number
But don't forget that you should be saving the registers, so you should save eax before you modify it.
And for any interrupt that was not pointed at an IRET when you hooked it, you must at some point in your handler chain to the previous handler.
If it's a hardware interrupt you can query the PIC to find out what interrupt is in service. For a software interrupt, if you wanted to be tricky, you could technically get the return address off the stack. And then go to that cs:ip and see which interrupt they were trying to call. You'll probably have to back up a few bytes from the cs:ip to find the actual INT instruction.