How can a program reboot my PC

 Subject: <Q:08.01> - How can a program reboot my PC?
Date: 8 Feb 2002 20:16:09 -0400

You can generate a "cold" boot or a "warm" boot. A cold boot is the same
as turning the power off and on; a warm boot is the same as Ctrl-Alt-Del
and skips the power-on self 'test.

For a warm boot, store the hex value 1234 in the word at 0040:0072. For
a cold boot, store 0 in that word. Then, if you want to live
dangerously, jump to address FFFF:0000. Here's C code to do it:

/* WARNING: data loss possible */
void bootme(int want_warm) /* arg 0 = cold boot, 1 = warm */
{
void (far* boot)(void) = (void (far*)(void))0xFFFF0000UL;

unsigned far* type = (unsigned far*)0x00400072UL;
*type = (want_warm ? 0x1234 : 0);
(*boot)( );
}

What's wrong with that method? It will boot right away, without closing
files, flushing disk caches, etc. If you boot without flushing a
write-behind disk cache (if one is running), you could lose data or
trash the file allocation table in your hard drive.

There are two methods of signaling the cache to flush its buffers:

(1) Simulate a keyboard Ctrl-Alt-Del in the keystroke translation
function of the BIOS (INT 15 AH=4F; but see notes below)

(2) Issue a disk reset (DOS function 0D). Most disk-cache programs hook
one or both of those interrupts, so if you use both methods you'll
probably be safe.

When user code simulates a Ctrl-Alt-Del, one or more of the programs
that have hooked INT 15 AH=4F can ask that the key be ignored by
clearing the carry flag. For example, HyperDisk does this when it has
started but not finished a cache flush. So if the carry flag comes back
cleared, the boot code has to wait a couple of clock ticks and then try
again. (None of this matters on older machines whose BIOS can't support
101- or 102-key keyboards; see the discussion of INT 21 AH=4F in
<Q:04.07> [What is the SysRq key for?])

C code that tries to signal the disk cache (if any) to flush is given
below. Turbo Pascal code by Timo Salmi that does more or less the same
job may be found at question 49 (as of this writing) in the Turbo Pascal
FAQ in comp.lang.pascal, and is downloadable as file FAQPAS2.TXT, which
is part of: <ftp://garbo.uwasa.fi/pc/link/>

Here's C code that reboots after trying to signal the disk cache:

#include <dos.h>

void bootme(int want_warm) /* arg 0 = cold boot, 1 = warm */
{
union REGS reg;

void (far* boot)(void) = (void (far*)(void))0xFFFF0000UL;
unsigned far* boottype = (unsigned far*)0x00400072UL;
char far* shiftstate = (char far*)0x00400017UL;
unsigned ticks;
int time_to_waste;

/* Simulate reception of Ctrl-Alt-Del: */
for (;;)
{
*shiftstate |= 0x0C; /* turn on Ctrl & Alt */
reg.h.ah = 0x4F; /* see notes below */
reg.h.al = 0x53; /* 0x53 = Del's scan code */
reg.x.cflag = 1; /* sentinel for ignoring key */
int86(0x15, &reg, &reg);

/* If carry flag is still set, we've finished. */
if(reg.x.cflag)
break;

/* Else waste some time before trying again: */
reg.h.ah = 0;
int86(0x1A, &reg, &reg); /* system time into CX:DX */

ticks = reg.x.dx;
for (time_to_waste = 3; time_to_waste > 0; )
{
reg.h.ah = 0;
int86(0x1A, &reg, &reg);
if (ticks != reg.x.dx)
ticks = reg.x.dx , --time_to_waste;
}
}

/* Issue a DOS disk reset request: */
reg.h.ah = 0x0D;
int86(0x21, &reg, &reg);

/* Set boot type and boot: */
*boottype = (want_warm ? 0x1234 : 0);
(*boot)( );
}

Reader Timo Salmi reported (26 July 1993) that the INT 15 AH=4F call may
not work on older PCs (below AT, XT2, XT286), according to Ralf Brown's
interrupt list (<Q:02.03> [What and where is Ralf Brown's interrupt
list?]).

Reader Roger Fulton reported (1 July 1993) that INT 15 AH=4F hangs even
a modern PC "ONLY when ANSI.SYS [is] loaded high using EMM386.EXE.
(Other things loaded high with EMM386.EXE were OK; ANSI.SYS loaded high
with QEMM386.SYS was OK; ANSI.SYS loaded low with EMM386.EXE installed
was OK.)" His solution was to use only the disk reset, INT 21 AH=0D,
which does flush SMARTDRV, then wait five seconds in hopes that any
other disk-caching software would have time to flush its queue.

Reader Per Bergland reported (10 Sep 1993) that the jump to FFFF:0000
will not work in Windows or other protected-mode programs. (For example,
when the above reboot code ran in a DOS session under Windows, a box
with "waiting for system shutdown" appeared. The PC hung and had to be
reset by cycling power.) His solution, which does a cold boot not a warm
boot, is to pulse pin 0 of the 8042 keyboard controller, which is
connected to the CPU's "reset" line.

He has tested the following code on various Compaqs, and expects it will
work for any AT-class machine; he cautions that you must first flush the
disk cache as indicated above.

cli
(AT) (AT) WaitOutReady: ; Busy-wait until 8042 ready for new command
in al,64h ; read 8042 status byte
test al,00000010b ; this bit indicates input buffer full
jnz (AT) (AT) WaitOutReady
mov al,0FEh ; Pulse "reset" = 8042 pin 0
out 64h,al ; The PC will reboot now