From the analysis of this boot process, it can be known that after IO.SYS takes over control, the entry point is at the beginning of the second sector.
IO.SYS is loaded into 4 sectors by the boot sector, and the loaded address is 0000:0700, and the control transfer CS:IP=0070:0200, which is the beginning of the second sector of IO.SYS. In addition, BP, SP, SI, DI, SS, DS, ES and the stack contents are all meaningful, and detailed explanations are made in the following comments.
2181:7C00 EB 3C 90 4D-53 57 49 4E-34 2E 31 00-02 04 04 00 .<.MSWIN4.1.....
2181:7C10 02 00 02 00-00 F8 F8 00-20 00 40 00-20 00 00 00 ........ .@. ...
2181:7C20 E0 DF 03 00-80 00 29 FA-6F 0B 00 55-53 42 5A 49 ......).o..USBZI
2181:7C30 50 2D 42 4F-4F 54 46 41-54 31 36 00-00 00 P-BOOTFAT16...
2181:7C3E 33 C9 xor cx,cx ;CX=0
2181:7C40 8E D1 mov ss,cx ;SS=0
2181:7C42 BC FC 7B mov sp,7BFC ;SP=7BFC
2181:7C45 16 push ss
2181:7C46 07 pop es ;ES=0
2181:7C47 BD 78 00 mov bp,0078 ;BP=78
2181:7C4A C5 76 00 lds si, ;DS:SI->floppy param
2181:7C4D 1E push ds
2181:7C4E 56 push si ;Save floppy param
2181:7C4F 16 push ss
2181:7C50 55 push bp ;Save 0000:0078
2181:7C51 BF 22 05 mov di,0522 ;DI=0522
2181:7C54 89 7E 00 mov ,di ;Set 0000:0522 as...
2181:7C57 89 4E 02 mov ,cx ;...new floppy param
2181:7C5A B1 0B mov cl,000B ;CX=000B
2181:7C5C FC cld
2181:7C5D F3 A4 repz movsb ;copy old param to new
2181:7C5F 06 push es
2181:7C60 1F pop ds ;DS=0
2181:7C61 BD 00 7C mov bp,7C00 ;BP=7C00
2181:7C64 C6 45 FE 0F mov byte ,000F ;modify floppy param
2181:7C68 38 4E 24 cmp ,cl ;drive is floppy?
2181:7C6B 7D 20 jge 7C8D ;yes. jump.
hard drive: check partition table for EBIOS indicator
2181:7C6D 8B C1 mov ax,cx ;AX=CX=0
2181:7C6F 99 cwd ;DX=0
2181:7C70 E8 7E 01 call 7DF1 ;read the MBR sector
2181:7C73 83 EB 3A sub bx,003A ;startLBA of entry 0
2181:7C76 66 A1 1C 7C mov eax, ;EAX=hidden sectors
2181:7C7A 66 3B 07 cmp eax, ;match?
2181:7C7D 8A 57 FC mov dl, ;DL=partition type
2181:7C80 75 06 jnz 7C88 ;not match, skip
2181:7C82 80 CA 02 or dl,0002 ;if the type is 0C
;let it be 0E
2181:7C85 88 56 02 mov ,dl ;set EBIOS flag in 7C02
2181:7C88 80 C3 10 add bl,0010 ;next entry
2181:7C8B 73 ED jnb 7C7A ;carry set if done
the real deal begins here
2181:7C8D 33 C9 xor cx,cx ;CX=0
2181:7C8F FE 06 D8 7D inc byte ;Change IO to JO
2181:7C93 8A 46 10 mov al, ;AL=number of FATs
2181:7C96 98 cbw ;AX=number of FATs
2181:7C97 F7 66 16 mul word ;sectors per FAT
;DX:AX=sectors in FATs
2181:7C9A 03 46 1C add ax,
2181:7C9D 13 56 1E adc dx, ;Add hidden sectors
2181:7CA0 03 46 0E add ax, ;Add reserved sectors
2181:7CA3 13 D1 adc dx,cx ;DX:AX->root dir
2181:7CA5 8B 76 11 mov si, ;SI=root dir entries
2181:7CA8 60 pushaw
2181:7CA9 89 46 FC mov ,ax ;
2181:7CAC 89 56 FE mov ,dx ;save DX:AX on stack
2181:7CAF B8 20 00 mov ax,0020 ;AX=dir entry length
2181:7CB2 F7 E6 mul si ;DX:AX=root dir size
2181:7CB4 8B 5E 0B mov bx, ;BX=sector size
2181:7CB7 03 C3 add ax,bx
2181:7CB9 48 dec ax
2181:7CBA F7 F3 div bx ;AX=root dir sectors
2181:7CBC 01 46 FC add ,ax
2181:7CBF 11 4E FE adc ,cx ;stack->Data area
2181:7CC2 61 popaw
2181:7CC3 BF 00 07 mov di,0700 ;DI=0700
2181:7CC6 E8 28 01 call 7DF1 ;read root dir
2181:7CC9 72 3E jb 7D09
2181:7CCB 38 2D cmp ,ch
2181:7CCD 74 17 jz 7CE6 ;failure find file
2181:7CCF 60 pushaw
2181:7CD0 B1 0B mov cl,000B ;find kernel filename
2181:7CD2 BE D8 7D mov si,7DD8
2181:7CD5 F3 A6 repz cmpsb
2181:7CD7 61 popaw
2181:7CD8 74 3D jz 7D17 ;found, jump
2181:7CDA 4E dec si ;SI=rest entries
2181:7CDB 74 09 jz 7CE6 ;not found, failure
2181:7CDD 83 C7 20 add di,0020 ;next entry
2181:7CE0 3B FB cmp di,bx ;end?
2181:7CE2 72 E7 jb 7CCB ;no, check the entry
2181:7CE4 EB DD jmp 7CC3 ;yes, load 1 sector
2181:7CE6 FE 0E D8 7D dec byte ;Change JO to IO
2181:7CEA 7B A7 jnp 7C93 ;find again
2181:7CEC BE 7F 7D mov si,7D7F ;not found
print error message:
SI=7D7F "invalid system disk"
SI=7D80 "Disk I/O error"
SI=7D82 "Replace the disk, and then press any key..."
2181:7CEF AC lodsb
2181:7CF0 98 cbw
2181:7CF1 03 F0 add si,ax
display string DS:SI, if encountered FF, then
display "Replace the disk, and then press any key..."
if encountered 00, wait for a key press and reboot.
2181:7CF3 AC lodsb
2181:7CF4 98 cbw
2181:7CF5 40 inc ax
2181:7CF6 74 0C jz 7D04
2181:7CF8 48 dec ax
2181:7CF9 74 13 jz 7D0E
display char in AL
2181:7CFB B4 0E mov ah,000E
2181:7CFD BB 07 00 mov bx,0007
2181:7D00 CD 10 int 10
2181:7D02 EB EF jmp 7CF3
display "Replace the disk, and then press any key..."
2181:7D04 BE 82 7D mov si,7D82
2181:7D07 EB E6 jmp 7CEF
display "Disk I/O error"
2181:7D09 BE 80 7D mov si,7D80
2181:7D0C EB E1 jmp 7CEF
2181:7D0E CD 16 int 16
2181:7D10 5E pop si
2181:7D11 1F pop ds ;DS:SI=0000:0078
2181:7D12 66 8F 04 pop dword ;restore original...
;...floppy params
2181:7D15 CD 19 int 19
the kernel file was found
2181:7D17 BE 81 7D mov si,7D81 ;error message
2181:7D1A 8B 7D 1A mov di, ;start cluster
2181:7D1D 8D 45 FE lea ax,
2181:7D20 8A 4E 0D mov cl, ;sectors per cluster
2181:7D23 F7 E1 mul cx ;DX:AX=sectors
2181:7D25 03 46 FC add ax,
2181:7D28 13 56 FE adc dx, ;DX:AX=LBA
2181:7D2B B1 04 mov cl,0004 ;read 4 sectors
2181:7D2D E8 C2 00 call 7DF2 ;... to 0000:0700
2181:7D30 72 D7 jb 7D09
Transfer control to the second sector of IO.SYS, with
SS=DS=ES=0000
SP=7BF4
BP=7C00
SI=error message "invalid system disk"
DI=start cluster number of IO.SYS
==0078
==0000
==OFFSET of FLOPPY PARAMS
==SEGMENT of FLOPPY PARAMS
===LBA of data area
2181:7D32 EA 00 02 70 00 jmp 0070:0200 ;CS:IP=0070:0200
2181:7D37 52 push dx ;DX:AX=LBA lo 32 bits
2181:7D38 50 push ax
2181:7D39 06 push es ;ES:BX=buffer
2181:7D3A 53 push bx
2181:7D3B 6A 01 push 0001 ;read 1 sector
2181:7D3D 6A 10 push 0010 ;EBIOS packet size
begin geometry translation: LBA to CHS
2181:7D3F 91 xchg ax,cx ;save AX to CX
2181:7D40 8B 46 18 mov ax, ;AX=sectors per track
2181:7D43 A2 26 05 mov ,al ;modify floppy param
2181:7D46 96 xchg ax,si ;SI=sectors per track
2181:7D47 92 xchg ax,dx ;AX=DX
2181:7D48 33 D2 xor dx,dx
2181:7D4A F7 F6 div si ;AX=quo, DX=res
2181:7D4C 91 xchg ax,cx ;restore AX from CX
;CX=quo
;DX:AX=the rest sectors
2181:7D4D F7 F6 div si ;AX=quo, DX=res
2181:7D4F 42 inc dx ;DX=sector
2181:7D50 87 CA xchg cx,dx ;CX=sector, DX=old quo
;DX:AX=quo
2181:7D52 F7 76 1A div word ;heads
;AX=cyl, DX=head
2181:7D55 8A F2 mov dh,dl ;DH=head
2181:7D57 8A E8 mov ch,al ;CH=cyl. lo 8 bits
2181:7D59 C0 CC 02 ror ah,02 ;AH=cyl. hi 2 bits
2181:7D5C 0A CC or cl,ah ;put into CL
end geometry translation: LBA to CHS
2181:7D5E B8 01 02 mov ax,0201 ;read 1 sector
2181:7D61 80 7E 02 0E cmp byte ,000E ;USE EBIOS?
2181:7D65 75 04 jnz 7D6B ;no, skip
2181:7D67 B4 42 mov ah,0042 ;yes, set AH=42
2181:7D69 8B F4 mov si,sp ;DS:SI->packet
2181:7D6B 8A 56 24 mov dl, ;drive number
2181:7D6E CD 13 int 13 ;BIOS disk call
2181:7D70 61 popaw ;discard packet
2181:7D71 61 popaw ;restore regs
2181:7D72 72 0A jb 7D7E ;failure jump
2181:7D74 40 inc ax ;next sector
2181:7D75 75 01 jnz 7D78
2181:7D77 42 inc dx
2181:7D78 03 5E 0B add bx, ;buffer
2181:7D7B 49 dec cx
2181:7D7C 75 77 jnz 7DF5 ;continue to read
;until done
2181:7D7E C3 ret
2181:7D7F 03 .
2181:7D80 18 01 27 0D-0A 49 6E 76-61 6C 69 64-20 73 79 73 ..'..Invalid sys
2181:7D90 74 65 6D 20-64 69 73 6B-FF 0D 0A 44-69 73 6B 20 tem disk...Disk
2181:7DA0 49 2F 4F 20-65 72 72 6F-72 FF 0D 0A-52 65 70 6C I/O error...Repl
2181:7DB0 61 63 65 20-74 68 65 20-64 69 73 6B-2C 20 61 6E ace the disk, an
2181:7DC0 64 20 74 68-65 6E 20 70-72 65 73 73-20 61 6E 79 d then press any
2181:7DD0 20 6B 65 79-0D 0A 00 00-49 4F 20 20-20 20 20 20 key....IO
2181:7DE0 53 59 53 4D-53 44 4F 53-20 20 20 53-59 53 7F 01 SYSMSDOS SYS.
2181:7DF0 00 .
subroutine: read sectors
2181:7DF1 41 inc cx ;CX=1
CX=sectors to read
2181:7DF2 BB 00 07 mov bx, 0700 ;ES:BX=0000:0700
BX=buffer
2181:7DF5 60 pushaw
2181:7DF6 66 6A 00 push 00000000
2181:7DF9 E9 3B FF jmp 7D37
2181:7DFC 00 00 55 AA ..U.
StickyI
