硬盘主引导程序剖析 - DOS开发编程 & 发展交流（开发室） - 中国DOS联盟论坛

发信人: Netguy (造梦人), 信区: DOS 标题: 硬盘主引导程序剖析发信站: BBS 水木清华站 (Wed Aug 27 13:32:41 1997) 如果是从硬盘起动,则开机起动时,ROM BIOS程序把硬盘上0面0道1扇区的主引导程序加载到内存0000:7C00处,并开始执行它.因此,下面的第一条指令CLI的绝对地址是0000:7C00H 通过修改主引导扇区,可以实现一定的加密效果,若被病毒利用... 偏移机器码符号指令说明 ============================================================================== 0000 FA CLI ;屏蔽中断 0001 33C0 XOR AX,AX 0003 8ED0 MOV SS,AX ;(SS)=0000H 0005 BC007C MOV SP,7C00 ;(SP)=7C00H 0008 8BF4 MOV SI,SP ;(SI)=7C00H 000A 50 PUSH AX 000B 07 POP ES ;(ES)=0000H 000C 50 PUSH AX 000D 1F POP DS ;(DS)=0000H 000E FB STI 000F FC CLD 0010 BF0006 MOV DI,0600 0013 B90001 MOV CX,0100 ;共512字节 0016 F2 REPNZ 0017 A5 MOVSW ;主引导程序把自己从0000:7C00处搬到 ;0000:0600处,为Dos分区的引导程序腾 ;出空间 0018 EA1D060000 JMP 0000:061D ;跳到0000:061D处继续执行,实际上就是 ;执行下面的MOV指令(001D偏移处) 001D BEBE07 MOV SI,07BE ;07BE-0600=01BE,01BE是分区表的首址 0020 B304 MOV BL,04 ;分区表最多4项,即最多4个分区 0022 803C80 CMP BYTE PTR [SI],80 ;80H表示活动分区 0025 740E JZ 0035 ;找到活动分区则跳走 0027 803C00 CMP BYTE PTR [SI],00 ;00H为有效分区的标志 002A 751C JNZ 0048 ;既非80H亦非00H则分区表无效 002C 83C610 ADD SI,+10 ;下一个分区表项,每项16字节 002F FECB DEC BL ;循环计数减一 0031 75EF JNZ 0022 ;检查下一个分区表项 0033 CD18 INT 18 ;4个都不能引导则进入ROM Basic 0035 8B14 MOV DX,[SI] 0037 8B4C02 MOV CX,[SI+02] ;取活动分区的引导扇区的面,柱面,扇区 003A 8BEE MOV BP,SI ;然后继续检查后面的分区表项 003C 83C610 ADD SI,+10 003F FECB DEC BL 0041 741A JZ 005D ;4个都查完则去引导活动分区 0043 803C00 CMP BYTE PTR [SI],00 ;00H为分区有效标志 0046 74F4 JZ 003C ;此分区表项有效则继续查下一个 0048 BE8B06 MOV SI,068B ;068B-0600=018B,取"无效分区"字符串 004B AC LODSB ;从字符串中取一字符 004C 3C00 CMP AL,00 ;00H表示串尾 004E 740B JZ 005B ;串显示完了则进入死循环 0050 56 PUSH SI 0051 BB0700 MOV BX,0007 0054 B40E MOV AH,0E 0056 CD10 INT 10 ;显示一个字符 0058 5E POP SI 0059 EBF0 JMP 004B ;循环显示下一个字符 005B EBFE JMP 005B ;此处为死循环 005D BF0500 MOV DI,0005 ;读入活动分区的引导扇,最多试读5次 0060 BB007C MOV BX,7C00 0063 B80102 MOV AX,0201 0066 57 PUSH DI 0067 CD13 INT 13 ;读 0069 5F POP DI 006A 730C JNB 0078 ;读盘成功则跳走 006C 33C0 XOR AX,AX 006E CD13 INT 13 ;读失败则复位磁盘 0070 4F DEC DI 0071 75ED JNZ 0060 ;不到5次则再试读 0073 BEA306 MOV SI,06A3 ;06A3-0600=00A3,即"Error loading"串 0076 EBD3 JMP 004B ;去显示字符串,然后进入死循环 0078 BEC206 MOV SI,06C2 ;06C2-0600=00C2,即"Missing.."串 0076 EBD3 JMP 004B ;去显示字符串,然后进入死循环 0078 BEC206 MOV SI,06C2 ;06C2-0600=00C2,即"Missing.."串 007B BFFE7D MOV DI,7DFE ;7DFE-7C00=01FE,即活动分区的引导扇 ;区的最后两字节的首址 007E 813D55AA CMP WORD PTR [DI],AA55;最后两字节为AA55H则有效 0082 75C7 JNZ 004B ;无效则显示字符串并进入死循环 0084 8BF5 MOV SI,BP 0086 EA007C0000 JMP 0000:7C00 ;有效则跳去引导该分区 0080 49 6E 76 61 6C Inval 0090 69 64 20 70 61 72 74 69-74 69 6F 6E 20 74 61 62 id partition tab 00A0 6C 65 00 45 72 72 6F 72-20 6C 6F 61 64 69 6E 67 le.Error loading 00B0 20 6F 70 65 72 61 74 69-6E 67 20 73 79 73 74 65 operating syste 00C0 6D 00 4D 69 73 73 69 6E-67 20 6F 70 65 72 61 74 m.Missing operat 00D0 69 6E 67 20 73 79 73 74-65 6D 00 00 FB 4C 38 1D ing system...L8. 00E0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 00F0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 0100 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 0110 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 0130 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 0140 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 0150 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 0160 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 0170 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 0180 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 0190 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 01A0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 01B0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 80 01 ................;分区表 01C0 01 00 06 0F 7F 9C 3F 00-00 00 F1 59 06 00 00 00 ......?....Y.... 01D0 41 9D 05 0F FF 38 30 5A-06 00 40 56 06 00 00 00 A....80Z..@V.... 01E0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 01F0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 55 AA ..............U. Dos的引导程序我还要查些资料,下次吧. -------------------------------------------------------------------------- 人生是一场梦,又何必太认真 ? 何不游戏人间,管它风风波波多少年. ------------------------------------------------------------------------- ※ 来源:·BBS 水木清华站 bbs.net.tsinghua.edu.cn·[FROM: 202.38.198.197] (本文采用S-Term文章拷贝脚本拷贝) ==================================================