China DOS Union
-- Unite DOS · Advance DOS · Grow DOS --Union site: www.cn-dos.net Forum site: www.cn-dos.net/forum
|
China DOS Union-- Unite DOS · Advance DOS · Grow DOS --Union site: www.cn-dos.net Forum site: www.cn-dos.net/forum |
| Guest | Log in | Register | Members | Search | China DOS Union |
|
中国DOS联盟论坛 The time now is 2026-09-15 01:48 |
47,812 topics / 349,917 posts / today 0 new / 48,268 members |
| DOS开发编程 & 发展交流 （开发室） » Analysis of the Hard Disk Master Boot Program |
| Printable Version 1,108 / 1 |
| Floor1 ko20010214 | Posted 2003-06-01 00:00 |
| 版主 Posts 1,628 Credits 7,296 | |
|
Sender: Netguy (Dream Maker), Board: DOS
Title: Analysis of the Hard Disk Master Boot Program Posted from: Shuimu Tsinghua BBS (Wed Aug 27 13:32:41 1997) If booting from the hard disk, then when the machine starts, the ROM BIOS program loads the master boot program from cylinder 0, head 0, sector 1 of the hard disk into memory at 0000:7C00, and begins executing it. Therefore, the absolute address of the first instruction CLI below is 0000:7C00H. By modifying the master boot sector, a certain encryption effect can be achieved; if used by a virus... Offset Machine code Symbolic instruction Explanation ============================================================================== 0000 FA CLI ;disable interrupts 0001 33C0 XOR AX,AX 0003 8ED0 MOV SS,AX ;(SS)=0000H 0005 BC007C MOV SP,7C00 ;(SP)=7C00H 0008 8BF4 MOV SI,SP ;(SI)=7C00H 000A 50 PUSH AX 000B 07 POP ES ;(ES)=0000H 000C 50 PUSH AX 000D 1F POP DS ;(DS)=0000H 000E FB STI 000F FC CLD 0010 BF0006 MOV DI,0600 0013 B90001 MOV CX,0100 ;512 bytes total 0016 F2 REPNZ 0017 A5 MOVSW ;the master boot program moves itself from 0000:7C00 ;to 0000:0600, making room for the DOS partition's boot ;program 0018 EA1D060000 JMP 0000:061D ;jump to 0000:061D to continue execution, actually ;executing the MOV instruction below (at offset 001D) 001D BEBE07 MOV SI,07BE ;07BE-0600=01BE, 01BE is the starting address of the partition table 0020 B304 MOV BL,04 ;the partition table has at most 4 entries, i.e. at most 4 partitions 0022 803C80 CMP BYTE PTR ,80 ;80H indicates the active partition 0025 740E JZ 0035 ;if the active partition is found, jump away 0027 803C00 CMP BYTE PTR ,00 ;00H is the marker for a valid partition 002A 751C JNZ 0048 ;if it is neither 80H nor 00H, then the partition table is invalid 002C 83C610 ADD SI,+10 ;next partition table entry, 16 bytes per entry 002F FECB DEC BL ;decrement loop counter 0031 75EF JNZ 0022 ;check the next partition table entry 0033 CD18 INT 18 ;if none of the 4 can boot, enter ROM Basic 0035 8B14 MOV DX, 0037 8B4C02 MOV CX, ;get the head, cylinder, and sector of the active partition's boot sector 003A 8BEE MOV BP,SI ;then continue checking the remaining partition table entries 003C 83C610 ADD SI,+10 003F FECB DEC BL 0041 741A JZ 005D ;if all 4 have been checked, go boot the active partition 0043 803C00 CMP BYTE PTR ,00 ;00H is the valid-partition marker 0046 74F4 JZ 003C ;if this partition table entry is valid, continue checking the next one 0048 BE8B06 MOV SI,068B ;068B-0600=018B, fetch the "invalid partition" string 004B AC LODSB ;fetch one character from the string 004C 3C00 CMP AL,00 ;00H indicates end of string 004E 740B JZ 005B ;if the string has been fully displayed, enter an infinite loop 0050 56 PUSH SI 0051 BB0700 MOV BX,0007 0054 B40E MOV AH,0E 0056 CD10 INT 10 ;display one character 0058 5E POP SI 0059 EBF0 JMP 004B ;loop to display the next character 005B EBFE JMP 005B ;infinite loop here 005D BF0500 MOV DI,0005 ;read the active partition's boot sector, try at most 5 times 0060 BB007C MOV BX,7C00 0063 B80102 MOV AX,0201 0066 57 PUSH DI 0067 CD13 INT 13 ;read 0069 5F POP DI 006A 730C JNB 0078 ;if disk read succeeds, jump away 006C 33C0 XOR AX,AX 006E CD13 INT 13 ;if read fails, reset the disk 0070 4F DEC DI 0071 75ED JNZ 0060 ;if fewer than 5 times, try reading again 0073 BEA306 MOV SI,06A3 ;06A3-0600=00A3, i.e. the "Error loading" string 0076 EBD3 JMP 004B ;go display the string, then enter an infinite loop 0078 BEC206 MOV SI,06C2 ;06C2-0600=00C2, i.e. the "Missing.." string 0076 EBD3 JMP 004B ;go display the string, then enter an infinite loop 0078 BEC206 MOV SI,06C2 ;06C2-0600=00C2, i.e. the "Missing.." string 007B BFFE7D MOV DI,7DFE ;7DFE-7C00=01FE, i.e. the starting address of the last ;two bytes of the active partition's boot sector 007E 813D55AA CMP WORD PTR ,AA55;the last two bytes are valid if they are AA55H 0082 75C7 JNZ 004B ;if invalid, display the string and enter an infinite loop 0084 8BF5 MOV SI,BP 0086 EA007C0000 JMP 0000:7C00 ;if valid, jump to boot that partition 0080 49 6E 76 61 6C Inval 0090 69 64 20 70 61 72 74 69-74 69 6F 6E 20 74 61 62 id partition tab 00A0 6C 65 00 45 72 72 6F 72-20 6C 6F 61 64 69 6E 67 le.Error loading 00B0 20 6F 70 65 72 61 74 69-6E 67 20 73 79 73 74 65 operating syste 00C0 6D 00 4D 69 73 73 69 6E-67 20 6F 70 65 72 61 74 m.Missing operat 00D0 69 6E 67 20 73 79 73 74-65 6D 00 00 FB 4C 38 1D ing system...L8. 00E0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 00F0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 0100 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 0110 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 0130 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 0140 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 0150 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 0160 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 0170 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 0180 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 0190 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 01A0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 01B0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 80 01 ................;partition table 01C0 01 00 06 0F 7F 9C 3F 00-00 00 F1 59 06 00 00 00 ......?....Y.... 01D0 41 9D 05 0F FF 38 30 5A-06 00 40 56 06 00 00 00 A....80Z..@V.... 01E0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 01F0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 55 AA ..............U. I still need to look up some materials on the DOS boot program, maybe next time. -------------------------------------------------------------------------- Life is but a dream, so why take it too seriously? Why not just play through this world, no matter how many years of storms and waves there are. ------------------------------------------------------------------------- ※ Source:·Shuimu Tsinghua BBS bbs.net.tsinghua.edu.cn· (This article was copied using the S-Term article-copying script) ================================================== |
|
| Floor2 maple | Posted 2003-07-24 00:00 |
| 中级用户 Posts 137 Credits 417 | |
|
[ Contact the Union admin team -
中国DOS联盟 -
Standard version ] Sponsored by ifanr Inc | © 2001–2023 |