安装grub后的mbr导出反汇编：
0x1BE地址开始处为 分区表
分区表结构体定义：
00000000 patation struc ; (sizeof=0x10)
00000000 State db ? ; state
00000001 StartHead db ?
00000002 StartSC dw ?
00000004 Type db ?
00000005 EndHead db ?
00000006 EndSC dw ?
00000008 Relative dd ?
0000000C Sectors dd ?
00000010 patation ends
反汇编具体内容加注释：
seg000:0000 ; File Name : E:/grubmbr
seg000:0000 ; Format : Binary file
seg000:0000 ; Base Address: 0000h Range: 0000h - 0200h Loaded length: 0200h
seg000:0000
seg000:0000 .686p
seg000:0000 .mmx
seg000:0000 .model flat
seg000:0000
seg000:0000 ; ===========================================================================
seg000:0000
seg000:0000 ; Segment type: Pure code
seg000:0000 seg000 segment byte public 'CODE' use16
seg000:0000 assume cs:seg000
seg000:0000 assume es:nothing, ss:nothing, ds:nothing, fs:nothing, gs:nothing
seg000:0000
seg000:0000 ; =============== S U B R O U T I N E =======================================
seg000:0000
seg000:0000 ; Attributes: noreturn
seg000:0000
seg000:0000 sub_0 proc near
seg000:0000 jmp short loc_4A
seg000:0002 ; ---------------------------------------------------------------------------
seg000:0002 nop
seg000:0003 mov ss, ax
seg000:0005 mov sp, 7C00h
seg000:0008 mov si, sp
seg000:000A mov es, ax
seg000:000C mov ds, ax
seg000:000E sti
seg000:000F cld
seg000:0010 mov di, 600h
seg000:0013 mov cx, 100h
seg000:0016 repne movsw
seg000:0018 jmp far ptr 0:61Dh
seg000:001D ; ---------------------------------------------------------------------------
seg000:001D mov si, 7BEh
seg000:0020 mov bl, 4
seg000:0022
seg000:0022 loc_22: ; CODE XREF: sub_0+33j
seg000:0022 cmp byte ptr [si+0], 80h ; '€'
seg000:0026 jz short loc_37
seg000:0028 cmp byte ptr [si+0], 0
seg000:002C jnz short loc_4C
seg000:002E add si, 10h
seg000:0031 dec bl
seg000:0033 jnz short loc_22
seg000:0035 int 18h ; TRANSFER TO ROM BASIC
seg000:0035 ; causes transfer to ROM-based BASIC (IBM-PC)
seg000:0035 ; often reboots a compatible; often has no effect at all
seg000:0037
seg000:0037 loc_37: ; CODE XREF: sub_0+26j
seg000:0037 mov dx, [si+0]
seg000:003A mov cx, [si+2]
seg000:003D mov ax, [bp+di]
seg000:003F add bh, bh ; DATA XREF: puts-2r
seg000:003F ; ---------------------------------------------------------------------------
seg000:0041 db 0
seg000:0042 dw 2000h ; 代码地址
seg000:0044 dw 1 ; mbr需加载的引导程序所在绝对扇区数
seg000:0046 db 0
seg000:0047 db 0
seg000:0048 dw 200h ; 相当于代码段基址
seg000:004A ; ---------------------------------------------------------------------------
seg000:004A
seg000:004A loc_4A: ; CODE XREF: sub_0j
seg000:004A cli
seg000:004B nop
seg000:004C
seg000:004C loc_4C: ; CODE XREF: sub_0+2Cj
seg000:004C ; DATA XREF: sub_59+24r ...
seg000:004C nop
seg000:004D test dl, 80h
seg000:0050 jnz short loc_54
seg000:0052 mov dl, 80h ; '€'
seg000:0054
seg000:0054 loc_54: ; CODE XREF: sub_0+50j
seg000:0054 jmp far ptr 0:7C59h
seg000:0054 sub_0 endp ; sp-analysis failed
seg000:0054
seg000:0059
seg000:0059 ; =============== S U B R O U T I N E =======================================
seg000:0059
seg000:0059
seg000:0059 sub_59 proc near
seg000:0059 xor ax, ax
seg000:005B mov ds, ax
seg000:005D mov ss, ax
seg000:005F mov sp, 2000h ; DATA XREF: sub_0+35r
seg000:0062 sti
seg000:0063 mov al, ds:7C40h
seg000:0066 cmp al, 0FFh
seg000:0068 jz short loc_6C
seg000:006A mov dl, al
seg000:006C
seg000:006C loc_6C: ; CODE XREF: sub_59+Fj
seg000:006C push dx
seg000:006D mov si, 7D7Fh
seg000:0070 call puts ; 显示GRUB(GRUB Loading stage...中的GRUB)
seg000:0073 test dl, 80h
seg000:0076 jz short loc_CC
seg000:0078 mov ah, 41h ; 'A'
seg000:007A mov bx, 55AAh
seg000:007D int 13h ; 1) 检验扩展功能是否存在
seg000:007D ; 入口:
seg000:007D ; AH = 41h
seg000:007D ; BX = 55AAh
seg000:007D ; DL = 驱动器号
seg000:007D ; 返回:
seg000:007D ; CF = 0
seg000:007D ; AH = 扩展功能的主版本号
seg000:007D ; AL = 内部使用
seg000:007D ; BX = AA55h
seg000:007D ; CX = API 子集支持位图
seg000:007D ; CF = 1
seg000:007D ; AH = 错误码 01h，无效命令
seg000:007D ;
seg000:007D ; 这个调用检验对特定的驱动器是否存在扩展功能。如果进位标志置 1则此驱动器不支持扩展功能。如果进位标志为 0，同时 BX = AA55h，则存在扩展功能。此时 CX 的 0 位表示是否支持第一个子集，1位表示是否支持第二个子集.
seg000:007D ; 对于 1.x 版的扩展 Int13H 来说，主版本号 AH = 1。AL 是副版本号，但这仅限于 BIOS 内部使用，任何软件不得检查 AL 的值。
seg000:007D ;
seg000:007F pop dx
seg000:0080 push dx
seg000:0081 jb short loc_CC ; 不支持则跳转loc_CC处,cf标志为1，jb 跳转成立
seg000:0081 ;
seg000:0083 cmp bx, 0AA55h
seg000:0087 jnz short loc_CC ; 不支持则跳转loc_CC处
seg000:0089 mov al, ds:7C41h
seg000:008C test al, al
seg000:008E jnz short loc_95 ; 该参数标志不为0，则不需检查CX中存储的API子集支持位图
seg000:0090 and cx, 1
seg000:0093 jz short loc_CC ; 如果子集位图为0，则跳转LOC_CC
seg000:0095
seg000:0095 loc_95: ; CODE XREF: sub_59+35j
seg000:0095 mov ecx, [si+10h] ; 194处数据
seg000:0099 mov si, 7C05h
seg000:009C mov byte ptr [si-1], 1 ; 0x7c04字节标记内存是否已加载第二个扇区数据。为1表示已加载，为0表示加载失败。
seg000:009C ; 此标记会在后续第二个扇区的程序中使用到
seg000:00A0 mov ebx, ds:7C44h
seg000:00A5 mov word ptr [si], 10h
seg000:00A9 mov word ptr [si+2], 1
seg000:00AE mov [si+8], ebx
seg000:00B2 mov word ptr [si+6], 7000h
seg000:00B7 xor eax, eax
seg000:00BA mov [si+4], ax
seg000:00BD mov [si+0Ch], eax ; -1 1
seg000:00BD ; 00 10h 地址7c05 si指向此地址
seg000:00BD ; 02 1
seg000:00BD ; 04 0
seg000:00BD ; 06 7000h
seg000:00BD ; 08 1
seg000:00BD ; 0a 0
seg000:00BD ; 0c 0
seg000:00C1 mov ah, 42h ; 'B'
seg000:00C3 int 13h ; 将第二扇区的内容读到内存0地址处
seg000:00C3 ; INT 13 - IBM/MS INT 13 Extensions - EXTENDED READ
seg000:00C3 ; AH = 42h
seg000:00C3 ; DL = drive number
seg000:00C3 ; DS:SI -> disk address packet (see #0204)
seg000:00C3 ; Return: CF clear if successful
seg000:00C3 ; AH = 00h
seg000:00C3 ; CF set on error
seg000:00C3 ; AH = error code (see #0166)
seg000:00C3 ; disk address packet's block count field set to number of blocks
seg000:00C3 ; successfully transferred
seg000:00C3 ; SeeAlso: AH=02h,AH=41h"INT 13 Ext",AH=43h"INT 13 Ext"
seg000:00C3 ;
seg000:00C3 ; Format of disk address packet:
seg000:00C3 ; Offset Size Description (Table 0204)
seg000:00C3 ; 00h BYTE 10h (size of packet)
seg000:00C3 ; 01h BYTE reserved (0)
seg000:00C3 ; 02h WORD number of blocks to transfer (max 007Fh for Phoenix EDD)
seg000:00C3 ; 04h DWORD -> transfer buffer
seg000:00C3 ; 08h QWORD starting absolute block number
seg000:00C3 ; (for non-LBA devices, compute as
seg000:00C3 ; (Cylinder*NumHeads + SelectedHead) * SectorPerTrack +
seg000:00C3 ; SelectedSector - 1
seg000:00C5 jb short loc_CC ; 如果读取失败则跳转loc_CC处
seg000:00C7 mov bx, 7000h
seg000:00CA jmp short loc_149
seg000:00CC ; ---------------------------------------------------------------------------
seg000:00CC
seg000:00CC loc_CC: ; CODE XREF: sub_59+1Dj
seg000:00CC ; sub_59+28j ...
seg000:00CC mov ah, 8
seg000:00CE int 13h ; DISK - DISK - GET CURRENT DRIVE PARAMETERS (XT,AT,XT286,CONV,PS)
seg000:00CE ; DL = drive number
seg000:00CE ; Return: CF set on error, AH = status code, BL = drive type
seg000:00CE ; DL = number of consecutive drives
seg000:00CE ; DH = maximum value for head number, ES:DI -> drive parameter
seg000:00D0 jnb short loc_DC
seg000:00D2 test dl, 80h
seg000:00D5 jz near ptr stru_1BE.EndHead
seg000:00D9 jmp loc_169 ; 'Hard Disk'
seg000:00DC ; ---------------------------------------------------------------------------
seg000:00DC
seg000:00DC loc_DC: ; CODE XREF: sub_59+77j
seg000:00DC mov si, 7C05h
seg000:00DF mov byte ptr [si-1], 0 ; 将扇区2已读入标志置为0
seg000:00E3 xor eax, eax
seg000:00E6 mov al, dh
seg000:00E8 inc ax
seg000:00E9 mov [si+4], eax
seg000:00ED xor dx, dx
seg000:00EF mov dl, cl
seg000:00F1 shl dx, 2
seg000:00F4 mov al, ch
seg000:00F6 mov ah, dh
seg000:00F8 inc ax
seg000:00F9 mov [si+8], ax
seg000:00FC xor ax, ax
seg000:00FE mov al, dl
seg000:0100 shr al, 2
seg000:0103 mov [si], eax
seg000:0106 mov eax, ds:7C44h
seg000:010A xor edx, edx
seg000:010D div dword ptr [si]
seg000:0110 mov [si+0Ah], dl
seg000:0113 xor edx, edx
seg000:0116 div dword ptr [si+4]
seg000:011A mov [si+0Bh], dl
seg000:011D mov [si+0Ch], ax
seg000:0120 cmp ax, [si+8]
seg000:0123 jge short loc_161
seg000:0125 mov dl, [si+0Dh]
seg000:0128 shl dl, 6
seg000:012B mov cl, [si+0Ah]
seg000:012E inc cl
seg000:0130 or cl, dl
seg000:0132 mov ch, [si+0Ch]
seg000:0135 pop dx
seg000:0136 mov dh, [si+0Bh]
seg000:0139 mov bx, 7000h
seg000:013C mov es, bx
seg000:013E assume es:nothing
seg000:013E xor bx, bx
seg000:0140 mov ax, 201h
seg000:0143 int 13h ; DISK - READ SECTORS INTO MEMORY
seg000:0143 ; AL = number of sectors to read, CH = track, CL = sector
seg000:0143 ; DH = head, DL = drive, ES:BX -> buffer to fill
seg000:0143 ; Return: CF set on error, AH = status, AL = number of sectors read
seg000:0145 jb short loc_171 ; 'Read'
seg000:0147 mov bx, es
seg000:0149
seg000:0149 loc_149: ; CODE XREF: sub_59+71j
seg000:0149 mov es, word ptr ds:7C48h
seg000:014D assume es:nothing
seg000:014D pusha
seg000:014E push ds
seg000:014F mov cx, 100h
seg000:0152 mov ds, bx
seg000:0154 assume ds:nothing
seg000:0154 xor si, si
seg000:0156 xor di, di
seg000:0158 cld
seg000:0159 rep movsw ; 将7000:0处的0x200字节内容复制到0x200:0地址处
seg000:015B pop ds
seg000:015C assume ds:nothing
seg000:015C popa
seg000:015D jmp word ptr ds:7C42h ; 跳转到0x2000地址处执行
seg000:0161 ; ---------------------------------------------------------------------------
seg000:0161
seg000:0161 loc_161: ; CODE XREF: sub_59+CAj
seg000:0161 mov si, 7D85h
seg000:0164 call puts ; 输出‘Geom’
seg000:0167 jmp short loc_177 ; ' Error'
seg000:0169 ; ---------------------------------------------------------------------------
seg000:0169
seg000:0169 loc_169: ; CODE XREF: sub_59+80j
seg000:0169 mov si, 7D8Ah ; 'Hard Disk'
seg000:016C call puts
seg000:016F jmp short loc_177 ; ' Error'
seg000:0171 ; ---------------------------------------------------------------------------
seg000:0171
seg000:0171 loc_171: ; CODE XREF: sub_59+ECj
seg000:0171 mov si, 7D94h ; 'Read'
seg000:0174 call puts
seg000:0177
seg000:0177 loc_177: ; CODE XREF: sub_59+10Ej
seg000:0177 ; sub_59+116j
seg000:0177 mov si, 7D99h ; ' Error'
seg000:017A call puts
seg000:017D
seg000:017D loc_17D: ; CODE XREF: sub_59:loc_17Dj
seg000:017D jmp short loc_17D
seg000:017D sub_59 endp ; sp-analysis failed
seg000:017D
seg000:017D ; ---------------------------------------------------------------------------
seg000:017F aGrub db 'GRUB ',0
seg000:0185 aGeom db 'Geom',0
seg000:018A aHardDisk db 'Hard Disk',0
seg000:0194 aRead db 'Read',0
seg000:0199 aError db ' Error',0
seg000:01A0 ; ---------------------------------------------------------------------------
seg000:01A0 ; START OF FUNCTION CHUNK FOR puts
seg000:01A0
seg000:01A0 loc_1A0: ; CODE XREF: puts+3j
seg000:01A0 mov bx, 1
seg000:01A3 mov ah, 0Eh
seg000:01A5 int 10h ; - VIDEO - WRITE CHARACTER AND ADVANCE CURSOR (TTY WRITE)
seg000:01A5 ; END OF FUNCTION CHUNK FOR puts ; AL = character, BH = display page (alpha modes)
seg000:01A5 ; BL = foreground color (graphics modes)
seg000:01A7
seg000:01A7 ; =============== S U B R O U T I N E =======================================
seg000:01A7
seg000:01A7
seg000:01A7 puts proc near ; CODE XREF: sub_59+17p
seg000:01A7 ; sub_59+10Bp ...
seg000:01A7
seg000:01A7 ; FUNCTION CHUNK AT seg000:01A0 SIZE 00000007 BYTES
seg000:01A7
seg000:01A7 lodsb
seg000:01A8 cmp al, 0
seg000:01AA jnz short loc_1A0
seg000:01AC retn
seg000:01AC puts endp ; sp-analysis failed
seg000:01AC
seg000:01AC ; ---------------------------------------------------------------------------
seg000:01AD db 0
seg000:01AE db 0
seg000:01AF db 0
seg000:01B0 db 0
seg000:01B1 db 0
seg000:01B2 db 0
seg000:01B3 db 0
seg000:01B4 db 0
seg000:01B5 db 0
seg000:01B6 db 0
seg000:01B7 db 0
seg000:01B8 db 0
seg000:01B9 db 0
seg000:01BA db 0
seg000:01BB db 0
seg000:01BC db 0
seg000:01BD db 0
seg000:01BE stru_1BE patation <80h, 1, 1, 4Dh, 7Fh, 813Fh, 3Fh, 0FFEC1h>; 0
seg000:01BE ; CODE XREF: sub_59+7Cj
seg000:01BE patation <0, 0, 8641h, 4Eh, 7Fh, 6BFh, 2FFD00h, 0FDF80h>; 1
seg000:01BE patation <0, 0, 441h, 4Fh, 7Fh, 857Fh, 1FFE00h, 0FFF00h>; 2
seg000:01BE patation <0, 0, 8201h, 83h, 7Fh, 37Fh, 0FFF00h, 0FFF00h>; 3
seg000:01FE db 55h ; U
seg000:01FF db 0AAh ; ?
seg000:01FF seg000 ends
seg000:01FF
seg000:01FF
seg000:01FF end
扫一扫
327
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
