Spy 1.3
(Backdoor.Win32.Spy.13)

by Edwin T. Floyd


SPY is a "remote control" program for NetBios compatible networks.
The current version of SPY is intended as a demonstration of a network
client-server application implemented in Pascal.
Description
-----------
SPY is a "remote control" program for NetBios compatible networks.  The
current version of SPY is intended as a demonstration of a network
client-server application implemented in Pascal.  We have found it somewhat
useful for lending remote assistance to our network users.

SPY and its accompanying documentation and source files are:

Copyright (c) 1989 by Edwin T. Floyd
All rights reserved

SPY and its accompanying documentation is not "shareware" and I do not request
payment for it.  You may distribute and use it without restriction as long as
you don't sell it and don't hold me liable for any errors or consequential
damages.  If you wish to include this software as part of a commercial
package offered for sale, you must obtain written permission from me, the
author:

Edwin T. Floyd [76067,747]
#9 Adams Park Court
Columbus, GA 31909
404-322-0076 (home)
404-576-3305 (work)

Release History
---------------
11-17-89 1.3 - Corrected missed EGA/VGA mode changes, documentation
11-15-89 1.2 - Internal version, corrected EGA/VGA/MCGA program hang bugs
10-04-89 1.1 - Common functions separated to SPYSUP, recovery improved.
               First public release.
09-30-89 1.0 - Internal version, never released

Operation
---------
SPY is in two parts: SPY.EXE and SPYTSR.EXE.

SPYTSR is a "Terminate and Stay Resident" program that must be running on the
machine to be controlled.  Run like this:

  SPYTSR name [adapter]

..where "name" is the network name by which this invocation of SPYTSR is to
be known, and (optional) "adapter" is a numeric network adapter number.  If
adapter is omitted, SPYTSR uses adapter zero.  The network name may be up
to fifteen characters long.  All alphabetic characters in the name are shifted
to upper case.  The name may not contain spaces.  The actual network name that
SPYTSR adds to the adapter is the name specified padded to the right with
spaces to fifteen characters and terminated with 0EFh as the sixteenth
character.

SPYTSR occupies about 36k (large for a TSR, but not too bad for one written in
a high-level language), and does very little except listen until it receives a
request from SPY.  SPYTSR handles these types of requests:

  SendScreen     - Reads the contents of the video buffer and cursor position
                   into an internal buffer and transmits it to the client.

  StuffKeyboard  - Copies Key and Scan Codes from the client's message to an
                   internal table where they are inserted into the keyboard
                   stream by the Int 16h intercept.  To the user, keystrokes
                   simply appear out of nowhere.  It's really spooky.

  Boot           - Reboots the system running SPYTSR as if the user had
                   performed a "three finger salute" (Ctrl-Alt-Del).

  DieQuietly     - SPYTSR cancels all its sessions and commands, deletes its
                   network name and removes itself from memory.

  SendScreenInfo - SPYTSR returns information about it's video screen,
                   including the adapter type, video mode, number of rows
                   and columns, and the maximum size of the buffer that
                   SendScreen may transmit.


MegaSecurity