大型机汇编HLASM - HOOK ISPF命令START(一)

说明

通过本文可以学的一些HLASM编程的高级知识点，适合HLASM编程初学者及有一定基础的人阅读。

以下知识点在本文中有所涉及：

LPA load module (ISPSTRT)所在内存地址的获得 - 通过调用宏CSVQUERY。
Subpool=241下分配内存，得到的内存属于共享内存。
反内存保护，之后修改ISPSTRT指令 - PGSER。
ISPSTRT的运行环境保存（主要是R1-R15）。
异常处理 - ESTAEX。
动态分配DD。

本文写了一个小程序，出发点是经常使用START命令开启一个新session，但有时忘了某个application的menu numbers(比如3.4到dataset list, D.DB到Db2 admin), 所以想到建立一个MAP或者表记录这种关系，以后START后面跟名字而不是menu numbers就可以了，其实相当于call某个人不是通过他的电话号码而是通过名字一样。正好也通过这个小练习总结实践大型机系统的一些底层知识点。

本文分两个Member，一个叫HOOKINST负责安装hook程序（就是装载BADGUY），一个叫BADGUY用来完成从名字到menu number的转换，名字与menu number的对应关系从userid.STARTMAP中读取，如没有默认为TSMXZ.STARTMAP。下面是程序。原理在最后面。

Source is also uploaded here .

HOOKINST

**********************************************************************
*                       HOOKINST                                     *
*--------------------------------------------------------------------*
* FUNCTION   : INTERCEPT START TO BADGUY                             *
*--------------------------------------------------------------------*
*DESCRIPTION:                                                        *
*--------------------------------------------------------------------*
* AUTHOR     : MIN ZHAI                                              *
* PROGRAM    : TSMXZ.ASM.TEST(HOOKINST)                              *
*--------------------------------------------------------------------*
* HISTORY    :                                                       *
*---VER-----DATE-------DESCRIPTION-----------------------------------*
**********************************************************************MACRO
&LABEL   $HEX2CH &IN=,&OUT=,&HEXTAB=LA    R0,8LA    R1,&OUTICM   R15,B'1111',&IN
.*
A&SYSNDX DS    0HSLR   R14,R14SLDL  R14,4IC    R14,&HEXTAB.(R14)STC   R14,0(,R1)LA    R1,1(,R1)BCT   R0,A&SYSNDXMEND
*
HOOKINST CSECT
HOOKINST RMODE 31
HOOKINST AMODE 31YREGS
*
*        *****************************************************
*        *  Init                                             *
*        *****************************************************LR    R12,R15USING HOOKINST,R12BAKR  R14,0STORAGE OBTAIN,LENGTH=STORLEN,ADDR=(R13),SP=0USING STORAGE,R13MVC   EYE_CATCHER,=CL8'HOOKINST'STORAGE OBTAIN,SP=0,COND=NO,LENGTH=STORLEN24,LOC=BELOWLR    R11,R1ST    R11,STORAGE24_ADDRESSUSING STORAGE24,R11MVC   STORAGE24_EYE_CATCHER,=CL8'HOOKIN24'
*
*        *****************************************************
*        *  SRCH ISPSTRT                                     *
*        *****************************************************CSVQUERY INEPNAME==CL8'ISPSTRT',SEARCH=LPA,                   XOUTLENGTH=STARTLEN,OUTLOADPT=STARTADDR,                 XPLISTVER=6,MF=(E,CSVQUERY_LIST)LTR   R15,R15BNZ   MAINEXIT
*        WTO ADDRESS OF ISPSTRTMVC   WTO_X,WTO_CLA    R15,28STH   R15,WTO_XLENMVC   WTO_XTEXT(20),=CL20'ADDR OF ISPSTRT :'$HEX2CH IN=STARTADDR,OUT=WTO_XTEXT+20,HEXTAB=HEXTB1WTO   TEXT=WTO_XLEN,MF=(E,WTO_X)
*
*        *****************************************************
*        *  LOAD BADGUY                                      *
*        *****************************************************LOAD EP=BADGUYN     R1,=X'00FFFFFF'                 CLEAR LOADER FLAGSSLL   R1,3                            MULTIPLY LENGTH BY 8LR    R3,R1MODESET MODE=SUPSTORAGE  OBTAIN,SP=241,COND=NO,LENGTH=(R3),KEY=0LR    R2,R1ST    R2,BADGUYADDR                   R2:  ADDRESSST    R3,BADGUYLENMODESET MODE=PROBMVC   OPENLIST,OPEN_CMVC   STEPLIB_DCB,STEPLIB_CLA    R5,STEPLIB_DCBOPEN  ((R5)),MODE=31,MF=(E,OPENLIST)XC    $LOAD,$LOADLOAD  EP=BADGUY,ADDR=(R2),DCB=(R5),SF=(E,$LOAD)LA    R5,STEPLIB_DCBMVC   CLOSLIST,CLOSE_CCLOSE ((R5)),MODE=31,MF=(E,CLOSLIST)
*        MVC   BADGUYADDR,=X'2F91C8A8'
**       WTO ADDRESS OF BADGUYMVC   WTO_X,WTO_CLA    R15,28STH   R15,WTO_XLENMVC   WTO_XTEXT(20),=CL20'ADDR OF BADGUY  :'$HEX2CH IN=BADGUYADDR,OUT=WTO_XTEXT+20,HEXTAB=HEXTB1WTO   TEXT=WTO_XLEN,MF=(E,WTO_X)
*
*        *****************************************************
*        *  Calculate the difference between ISPSTRT and BADGUY
*        *****************************************************LLGT R0,STARTADDRAHI  R0,X'1E'LLGT R1,BADGUYADDRSR   R1,R0SRA  R1,1SLDL R0,16ICM  R0,B'1100',=XL2'C0F4'ICM  R1,B'0011',=XL2'0700'STM  R0,R1,JLU_INSTRLLGT R0,BADGUYADDRAHI  R0,X'98'LLGT R1,STARTADDRAHI  R1,X'26'SR   R1,R0SRA  R1,1SLDL R0,16ICM  R0,B'1100',=XL2'C0F4'ICM  R1,B'0011',=XL2'0700'STM  R0,R1,JLU_INSTR_RETLLGT R4,BADGUYADDRLG   R0,JLU_INSTR_RETMODESET KEY=ZEROSTG  R0,X'98'(R4)MODESET KEY=NZERO
*
*        *****************************************************
*        *  install intercept                                *
*        *****************************************************MODESET KEY=ZEROLLGT  R4,STARTADDRLR    R5,R4AHI   R5,X'1E'N     R5,=XL4'FFFFF000'LA    R6,4095(,R5)
*        LG    R9,=XL8'90ECD00C58901000'LG    R9,JLU_INSTRPGSER R,UNPROTECT,A=(R5),EA=(R6)STG   R9,X'1E'(,R4)PGSER R,PROTECT,A=(R5),EA=(R6)MODESET KEY=NZERO
*        WTOMVC   WTO_X,WTO_CLA    R15,30STH   R15,WTO_XLENMVC   WTO_XTEXT(30),=CL30'INSTALL INTERCEPT, COMPLETED!'WTO   TEXT=WTO_XLEN,MF=(E,WTO_X)
*
*        *****************************************************
*        *  Exit                                             *
*        *****************************************************
MAINEXIT EQU   *L     R3,STORAGE24_ADDRESSSTORAGE RELEASE,LENGTH=STORLEN24,ADDR=(R3)STORAGE RELEASE,LENGTH=STORLEN,ADDR=(R13)PR
*
*
**********************************************************************
* DATA DEFINE AREA                                                   *
**********************************************************************
OPEN_C    OPEN  STEPLIB_C,MF=L,MODE=31
OPEN_L    EQU   *-OPEN_C
CLOSE_C   CLOSE STEPLIB_C,MF=L,MODE=31
CLOSE_L   EQU   *-CLOSE_C
STEPLIB_C DCB DDNAME=STEPLIB,DSORG=PO,MACRF=(R)
*
HEXTB1    DC    CL16'0123456789ABCDEF'
*
WTO_C     WTO   TEXT=,ROUTCDE=(11),MF=L     MACRO WTO LISTFORM
WTO_L     EQU   *-WTO_C                 MACRO WTO LENGTH
*
*------------------------------------------------------------*
* DSECT for other data that must be allocated dynamically    *
*------------------------------------------------------------*
STORAGE  DSECT
EYE_CATCHER    DS  CL8
STORAGE24_ADDRESS DS A
STARTLEN       DS  F
STARTADDR      DS  A
BADGUYLEN      DS  F
BADGUYADDR     DS  A
JLU_INSTR      DS  D
JLU_INSTR_RET  DS  D
$LOAD          DS  XL32CSVQUERY  MF=(L,CSVQUERY_LIST),PLISTVER=MAX
OPENLIST       DS  XL(OPEN_L)
CLOSLIST       DS  XL(CLOSE_L)
WTO_X          DS  CL(WTO_L)               MACRO WTO's storage area
WTO_XLEN       DS  AL2
WTO_XTEXT      DS  CL80
STORLEN  EQU   *-STORAGE
*
STORAGE24             DSECT
STORAGE24_EYE_CATCHER DS CL8
STEPLIB_DCB           DS XL(DCBLNGQS)  ACTUAL QSAM DCB
STORLEN24             EQU *-STORAGE24DCBD  DSORG=PS,DEVD=DA
*END

BADGUY

**********************************************************************
*                            BADGUY                                  *
*--------------------------------------------------------------------*
* DESCRIPTION: Inject this guy into ISPSTRT - START PROCESSOR.       *
*              This version has no support for 'START ?'             *
*--------------------------------------------------------------------*
* AUTHOR     : MIN ZHAI                                              *
*--------------------------------------------------------------------*
* HISTORY    :                                                       *
*---VER-----DATE-------DESCRIPTION-----------------------------------*
**********************************************************************
BADGUY   CSECT
BADGUY   RMODE 31
BADGUY   AMODE 31YREGSJ     STARTDC    CL8'BADGUY'DC    CL8'&SYSDATE'DC    CL6'&SYSTIME'DC   (X'98'-(*-BADGUY))C' '
JLU_RETURN  DC  2A(0)                    RETURN TO ISPSTRT
JLU_RETURN2 LM  R14,R12,X'00C'(R13)      RESTORE ORIGINAL REGSL   R9,X'000'(,R1)           INSTRUCTION JLU REPLACESJ   JLU_RETURN
START    DS    0HSTM   R14,R12,X'00C'(R13)       INSTRUCTION JLU REPLACESLR    R3,R1*        ALLOCATE STORAGELARL  R12,BADGUYUSING BADGUY,R12USING STORAGE,R13LARL  R15,INITBASR  R14,R15LR    R13,R1*        STORE ISPSTRT'S R1ST    R3,PARM_ADR               SAVE PARM*        ESTABLISH ESTAE ROUTINE, like try/catchMVC   ESTAEXL,ESTAEX_CST    R13,ESTAE_PARML     R9,=A(RECOVER)LA    R15,RETRY1ST    R15,RETRY_ADDRESSSTM   R0,R15,RUBAREA+2MVC   RUBAREA(2),=XL2'FFFF'ESTAEX (R9),CT,TERM=NO,PARAM=ESTAE_PARM,PURGE=NONE,           XASYNCH=YES,MF=(E,ESTAEXL)*        GET USERID - who are using SELECT commandLARL  R15,GET_USERIDBASR  R14,R15LARL  R15,=CL8'TS5487'CLC   USERID,0(R15)JE    ALLOCLARL  R15,=CL8'TS5487A'CLC   USERID,0(R15)JE    ALLOCLARL  R15,=CL8'TSMXZ'CLC   USERID,0(R15)JNE   END*        Do conversion according to the map in dataset USERID.STARTMAP
ALLOC    DS    0HLARL  R15,ALLOCATE_DATASETBASR  R14,R15LTR   R15,R15JNZ   ENDLARL  R15,PROCESS_CONVERTBASR  R14,R15LARL  R15,FREE_DATASETBASR  R14,R15
*
*        LARL  R15,=A(500)
*        STIMER WAIT,BINTVL=(R15)        HAVE A REST.
*
*        THE END - release storage and prepare to jump to ISPSTRT.
RETRY1   DS    0H
END      DS    0HESTAEX 0LARL  R15,TERMBASR  R14,R15LR    R13,R1J     JLU_RETURN2PR
ESTAEX_C  ESTAEX MF=L
ESTAEX_L  EQU *-ESTAEX_CLTORG ,
*
*------------------------------------------------------------*
* ESTAE RECOVERY ROUTINE                                     *
*------------------------------------------------------------*PUSH  USING
RECOVER  DS    0HLR    R12,R15USING RECOVER,R12CHI   R0,12                     RC=12, THEN EXITJNZ   RECOVER_SDWALA    R15,0BR    R14
RECOVER_SDWA  DS 0HUSING SDWA,R1                   ADDRESSING TO SDWAICM   R2,15,SDWAPARM            LOAD ESTAE PARML     R2,0(,R2)L     R13,0(,R2)                LOAD POINTER TO STORAGELR    R7,R14L     R4,RETRY_ADDRESSLA    R9,RUBAREASETRP RETREGS=YES,FRESDWA=YES,RETADDR=(R4),RC=4,DUMP=NO,      XRUB=(R9)LR    R14,R7BR    R14
*LTORGDROP R12,R1POP USING
*
*------------------------------------------------------------*
* INIT                                                       *
*------------------------------------------------------------*
INIT     DS    0HBAKR  R14,0LR    R12,R15USING INIT,R12STORAGE OBTAIN,LENGTH=STORAGE_SIZE,LOC=31LR    R9,R1                     OBTAIN STORAGELR    R0,R1L     R1,=A(STORAGE_SIZE)SLR   R14,R14SLR   R15,R15MVCL  R0,R14STORAGE OBTAIN,LENGTH=STORAGE24_SIZE,LOC=24LR    R10,R1                    OBTAIN STORAGELR    R0,R1L     R1,=A(STORAGE24_SIZE)SLR   R14,R14SLR   R15,R15MVCL  R0,R14ST    R9,8(R13)ST    R13,4(R9)LR    R13,R9MVC   STORAGE_EYE_CATCHER,=CL8'BADGUYST'MVC   STORAGE24_EYE_CATCHER-STORAGE24(8,R10),=CL8'BADGUY24'ST    R10,STORAGE24_ADDRESSLR    R1,R9                     PASS BACK STORAGE ADDRESSPRDROP  R12LTORG ,
*
*------------------------------------------------------------*
* TERM                                                       *
*------------------------------------------------------------*
TERM     DS    0HBAKR  R14,0LR    R12,R15USING TERM,R12L     R8,4(R13)L     R10,STORAGE24_ADDRESSSTORAGE RELEASE,LENGTH=STORAGE24_SIZE,ADDR=(R10),COND=NOSTORAGE RELEASE,LENGTH=STORAGE_SIZE,ADDR=(R13),COND=NOLR    R1,R8PRDROP  R12LTORG ,
*
*------------------------------------------------------------*
* GET USERID                                                 *
*------------------------------------------------------------*
GET_USERID DS  0HBAKR  R14,0LR    R12,R15USING GET_USERID,R12L     R1,X'224'                 R1->ASCBL     R1,X'6C'(,R1)             R1->ASXBICM   R1,15,X'C8'(R1)           Have ACEE?BNZ   HAVEACEE                  Yes, use itB     NOACEE                    No, don't have one
HAVEACEE DS    0HMVC   USERID,X'15'(R1)          Get UserID
NOACEE   DS    0HPRDROP  R12LTORG ,
*
*------------------------------------------------------------*
* DYNAMICALLY ALLOCATE DATASET (SHARED)                      *
*------------------------------------------------------------*
ALLOCATE_DATASET  DS 0HBAKR  R14,0LR    R12,R15USING ALLOCATE_DATASET,R12L     R10,STORAGE24_ADDRESSUSING STORAGE24,R10LA    R9,SVC99_RBXUSING S99RBX,R9MVI   S99EOPTS,X'00'LA    R7,SVC99_AREAUSING S99RBP,R7LA    R8,4(,R7)USING S99RB,R8ST    R8,S99RBPTRLA    R9,SVC99_RBXST    R9,S99S99XUSING S99RBX,R9MVC   S99EID,=CL6'S99RBX'MVI   S99EVER,S99RBXVRDROP  R9OI    S99RBPTR,S99RBPNDMVC   S99RBLN,=AL1(S99RBEND-S99RB)MVI   S99VERB,S99VRBALLA    R9,S99RBEND-S99RB(,R8)ST    R9,S99TXTPPUSING S99TUPL,R9MVC   TARGET_DSNAME,=CL44' 'MVC   TARGET_DSNAME(8),USERIDLA    R4,TARGET_DSNAMELA    R5,8
BLANKOFF C     R5,=F'0'JE    MKDSCLI   0(R4),X'40'JE    MKDSCLI   0(R4),X'00'JE    MKDSLA    R4,1(R4)BCTR  R5,0J     BLANKOFF
MKDS     MVC   0(9,R4),=CL9'.STARTMAP'L     R1,=A(DSNAME)MVC   SVC99_DSNAME(50),0(R1)MVC   SVC99_DSNAME+6(44),TARGET_DSNAMELA    R1,SVC99_DSNAMEST    R1,S99TUPTRLA    R9,4(,R9)L     R1,=A(RET_DDNAME)MVC   SVC99_RET_DDNAME,0(R1)LA    R1,SVC99_RET_DDNAMEST    R1,S99TUPTRLA    R9,4(,R9)L     R1,=A(STATSHR)ST    R1,S99TUPTROI    S99TUPTR,S99TUPLNLR    R1,R7DYNALLOC ,L     R9,S99S99XUSING S99RBX,R9L     R6,S99ERSNLTR   R15,R15BNZ   EXIT_ALLCMVC   TARGET_DDNAME,SVC99_RET_DDNAME+6
EXIT_ALLC DS 0HPR
*
RET_DDNAME DS  0FDC    AL2(DALRTDDN)DC    X'0001'DC    X'0008'DC    CL8' '
RET_DDNAME_LEN EQU *-RET_DDNAMEDDNAME   DS    0FDC    AL2(DALDDNAM)DC    X'0001'DC    X'0008'DC    CL8' 'DSNAME   DS    0FDC    AL2(DALDSNAM)DC    X'0001'DC    X'002C'DC    CL44' 'STATSHR  DS    0FDC    AL2(DALSTATS)DC    X'0001'DC    X'0001'DC    X'08'STATNEW  DS    0FDC    AL2(DALSTATS)DC    X'0001'DC    X'0001'DC    X'04'STANCAT  DS    0FDC    AL2(DALNDISP)DC    X'0001'DC    X'0001'DC    X'02'DDNAME2  DS    0FDC    AL2(DALDDNAM)DC    X'0001'DC    X'0008'DC    CL8' 'LTORG ,DROP  R7,R8,R9,R10,R12
*
*------------------------------------------------------------*
* DYNAMICALLY DEALLOCATE DATASET                             *
*------------------------------------------------------------*
FREE_DATASET  DS 0HBAKR  R14,0LR    R12,R15USING FREE_DATASET,R12L     R10,STORAGE24_ADDRESSUSING STORAGE24,R10CLC   TARGET_DDNAME,=8XL1'00'BZ    EXIT_FREELA    R7,SVC99_AREAUSING S99RBP,R7LA    R8,4(,R7)USING S99RB,R8ST    R8,S99RBPTRXR    R9,R9ST    R9,S99S99XOI    S99RBPTR,S99RBPNDMVC   S99RBLN,=AL1(S99RBEND-S99RB)MVI   S99VERB,S99VRBUNLA    R9,S99RBEND-S99RB(,R8)ST    R9,S99TXTPPUSING S99TUPL,R9L     R1,=A(DDNAME2)MVC   SVC99_DDNAME(14),0(R1)MVC   SVC99_DDNAME+6(8),TARGET_DDNAMELA    R1,SVC99_DDNAMEST    R1,S99TUPTROI    S99TUPTR,S99TUPLNLR    R1,R7DYNALLOC ,
EXIT_FREE DS 0HPRDROP  R12,10,R9,R8,R7LTORG ,
*
*------------------------------------------------------------*
* PROCESS REWRITE COMMAND                                    *
*------------------------------------------------------------*
PROCESS_CONVERT DS 0HBAKR  R14,0LR    R12,R15USING PROCESS_CONVERT,R12L     R10,STORAGE24_ADDRESSUSING STORAGE24,R10MVC   FILE_DCB,INDCB_CMVC   OPENLIST,OPEN_CLA    R3,FILE_DCBUSING IHADCB,R3MVC   DCBDDNAM,TARGET_DDNAMEL     R15,=A(EODAD_CODE)MVC   EODAD_ROUTINE,0(R15)LA    R1,EODAD_ROUTINESTCM  R1,7,DCBEODAD+1OPEN  ((R3),INPUT),MF=(E,OPENLIST),MODE=31TM    DCBOFLGS,DCBOFOPNBZ    EXIT_PROCXR    R5,R5L     R1,PARM_ADRL     R6,4(R1)LOOP     DS    0HGET   FILE_DCB,RECORD_TMPTM    EOF,L'EOFBC    B'0011',ENDDATAL     R15,=A(UPCASE)TR    RECORD_TMP,0(R15)TR    0(20,R6),0(R15)CLC   0(20,R6),RECORD_TMPJZ    CONVERTLA    R5,1(R5)B     LOOPCONVERT  DS    0HMVC   0(20,R6),RECORD_TMP+20AHI   R6,-4MVHI  0(R6),20ENDDATA  DS    0HMVC   CLOSLIST,CLOSE_CCLOSE ((R3)),MF=(E,CLOSLIST),MODE=31
EXIT_PROC  DS  0HPRDROP  R3,R10,R12LTORG ,
*
OPEN_C   OPEN    0,MODE=31,MF=L
OPEN_L   EQU     *-OPEN_C
CLOSE_C  CLOSE   0,MODE=31,MF=L
CLOSE_L  EQU     *-CLOSE_C
INDCB_C  DCB   DSORG=PS,DDNAME=INDD1,RECFM=FB,LRECL=40,MACRF=GM
EODAD_CODE DS 0HOI    EOF,L'EOFBR    R14
EODAD_CODE_LENGTH EQU *-EODAD_CODE
UPCASE   DC    256AL1(*-UPCASE) tab to translate all chars to uppercaseORG   UPCASE+C'a'DC    C'ABCDEFGHI'ORG   UPCASE+C'j'DC    C'JKLMNOPQR'ORG   UPCASE+C's'DC    C'STUVWXYZ'ORG   ,
*
*------------------------------------------------------------*
* DSECT for other data that must be allocated dynamically    *
*------------------------------------------------------------*
*
STORAGE    DSECT
SAVEREA                  DS  CL(18*4)
STORAGE_EYE_CATCHER      DS  CL8
STORAGE24_ADDRESS        DS  F
TARGET_DSNAME            DS  CL44
TARGET_DDNAME            DS  CL8
PARM_ADR                 DS  A
USERID                   DS  CL8
RECORD_TMP               DS  CL40
OPENLIST                 DS  XL(OPEN_L)
CLOSLIST                 DS  XL(CLOSE_L)
EOF                      DS  0XL(X'80')DC  XL(X'01')'00'
ESTAEXL                  DS  XL(ESTAEX_L)
ESTAE_PARM               DS  A
RETRY_ADDRESS            DS  A
RUBAREA_17               DS  17FORG RUBAREA_17+2
RUBAREA                  DS  HDS  16FORG
STORAGE_SIZE             EQU *-STORAGE
*
STORAGE24  DSECT
STORAGE24_EYE_CATCHER    DS  CL8
SVC99_AREA               DS  XL256
SVC99_DSNAME             DS  CL50
SVC99_DDNAME             DS  CL14
SVC99_RBX                DS  XL36
SVC99_RET_DDNAME         DS  XL(RET_DDNAME_LEN)DS  0F
FILE_DCB                 DS  XL(DCBLNGQS)DS  0F
EODAD_ROUTINE            DS  XL(EODAD_CODE_LENGTH)
STORAGE24_SIZE           EQU *-STORAGE24
*DCBD  DSORG=PS,DEVD=DAIEFZB4D0IEFZB4D2IHASDWAEND

之后就可以START new session by name了，例如START SPUFI， START DB2ADMIN。

Mechanism

ISPSTRT: DM start screen processor.

一句话：我们将会HOOK ISPSTRT，强制控制从ISPSTRT转到BADGUY，之后再回来。

HOOK the START processor - ISPSTRT 之前：

VS 之后：