HD MBR 简易分析

seg000:0000 ; Format      : Binary file
seg000:0000 ; Base Address: 0000h Range: 0000h - 0200h Loaded length: 00000200h
seg000:0000
seg000:0000                 .686p
seg000:0000                 .mmx
seg000:0000                 .model flat
seg000:0000
seg000:0000 ; ===========================================================================
seg000:0000
seg000:0000 ; Segment type: Pure code
seg000:0000 seg000          segment byte public 'CODE' use16
seg000:0000                 assume cs:seg000
seg000:0000                 assume es:nothing, ss:nothing, ds:nothing, fs:nothing, gs:nothing
seg000:0000                 xor     ax, ax
seg000:0002                 mov     ss, ax
seg000:0004                 mov     sp, 7C00h
seg000:0007                 mov     es, ax
seg000:0009                 mov     ds, ax
seg000:000B                 mov     si, 7C00h
seg000:000E                 mov     di, 600h
seg000:0011                 mov     cx, 200h
seg000:0014                 cld
seg000:0015                 rep movsb               ; 复制mbr到600h
seg000:0017                 push    ax
seg000:0018                 push    61Ch
seg000:001B                 retf                    ; 跳转61c
seg000:001C ; ---------------------------------------------------------------------------
seg000:001C                 sti
seg000:001D                 mov     cx, 4
seg000:0020                 mov     bp, 7BEh
seg000:0023
seg000:0023 LoopCheckActiveSector:                  ; CODE XREF: seg000:0030j
seg000:0023                 cmp     byte ptr [bp+0], 0 ; 是否为活动扇区
seg000:0027                 jl      short TryReadActiveSector
seg000:0029                 jnz     InvaildPartitionTable
seg000:002D                 add     bp, 10h
seg000:0030                 loop    LoopCheckActiveSector
seg000:0032                 int     18h             ; TRANSFER TO ROM BASIC
seg000:0032                                         ; causes transfer to ROM-based BASIC (IBM-PC)
seg000:0032                                         ; often reboots a compatible; often has no effect at all
seg000:0034
seg000:0034 TryReadActiveSector:                    ; CODE XREF: seg000:0027j
seg000:0034                                         ; seg000:00AEj
seg000:0034                 mov     [bp+0], dl
seg000:0037                 push    bp
seg000:0038                 mov     byte ptr [bp+11h], 5
seg000:003C                 mov     byte ptr [bp+10h], 0
seg000:0040
seg000:0040 loc_40:                                 ; DATA XREF: seg000:014Fr
seg000:0040                 mov     ah, 41h ; 'A'
seg000:0042                 mov     bx, 55AAh
seg000:0045                 int     13h             ; DISK - Check for INT 13h Extensions
seg000:0045                                         ; BX = 55AAh, DL = drive number
seg000:0045                                         ; Return: CF set if not supported
seg000:0045                                         ; AH = extensions version
seg000:0045                                         ; BX = AA55h
seg000:0045                                         ; CX = Interface support bit map
seg000:0047                 pop     bp
seg000:0048                 jb      short int_13_ext_no_supported
seg000:004A                 cmp     bx, 0AA55h      ; DATA XREF: seg000:0045r
seg000:004A                                         ; seg000:007Er ...
seg000:004E                 jnz     short int_13_ext_no_supported
seg000:0050                 test    cx, 1
seg000:0054                 jz      short int_13_ext_no_supported
seg000:0056                 inc     byte ptr [bp+10h]
seg000:0059
seg000:0059 int_13_ext_no_supported:                ; CODE XREF: seg000:0048j
seg000:0059                                         ; seg000:004Ej ...
seg000:0059                 pushad
seg000:005B                 cmp     byte ptr [bp+10h], 0
seg000:005F                 jz      short orginal_read_sectors ; DATA XREF: seg000:0032r
seg000:0061                 push    large 0
seg000:0067                 push    large dword ptr [bp+8] ; DATA XREF: seg000:00E5r
seg000:0067                                         ; seg000:0125r
seg000:006B                 push    0
seg000:006E                 push    7C00h
seg000:0071                 push    1
seg000:0074                 push    10h
seg000:0077                 mov     ah, 42h ; 'B'
seg000:0079                 mov     dl, [bp+0]
seg000:007C                 mov     si, sp
seg000:007E                 int     13h             ; DISK - IBM/MS Extension - EXTENDED READ (DL - drive, DS:SI - disk address packet)
seg000:0080                 lahf
seg000:0081                 add     sp, 10h
seg000:0084                 sahf
seg000:0085                 jmp     short extension_read_sectors_finished
seg000:0087 ; ---------------------------------------------------------------------------
seg000:0087
seg000:0087 orginal_read_sectors:                   ; CODE XREF: seg000:005Fj
seg000:0087                 mov     ax, 201h
seg000:008A                 mov     bx, 7C00h
seg000:008D                 mov     dl, [bp+0]
seg000:0090                 mov     dh, [bp+1]
seg000:0093                 mov     cl, [bp+2]
seg000:0096                 mov     ch, [bp+3]
seg000:0099                 int     13h             ; DISK - READ SECTORS INTO MEMORY
seg000:0099                                         ; AL = number of sectors to read, CH = track, CL = sector
seg000:0099                                         ; DH = head, DL = drive, ES:BX -> buffer to fill
seg000:0099                                         ; Return: CF set on error, AH = status, AL = number of sectors read
seg000:009B
seg000:009B extension_read_sectors_finished:        ; CODE XREF: seg000:0085j
seg000:009B                 popad
seg000:009D                 jnb     short read_sector_no_error
seg000:009F                 dec     byte ptr [bp+11h]
seg000:00A2                 jnz     short reset_disk_system
seg000:00A4                 cmp     byte ptr [bp+0], 80h ; '€'
seg000:00A8                 jz      ErrorLoadOS
seg000:00AC                 mov     dl, 80h ; '€'
seg000:00AE                 jmp     short TryReadActiveSector
seg000:00B0 ; ---------------------------------------------------------------------------
seg000:00B0
seg000:00B0 reset_disk_system:                      ; CODE XREF: seg000:00A2j
seg000:00B0                 push    bp
seg000:00B1                 xor     ah, ah
seg000:00B3                 mov     dl, [bp+0]
seg000:00B6                 int     13h             ; DISK - RESET DISK SYSTEM
seg000:00B6                                         ; DL = drive (if bit 7 is set both hard disks and floppy disks reset)
seg000:00B8                 pop     bp
seg000:00B9                 jmp     short int_13_ext_no_supported
seg000:00BB ; ---------------------------------------------------------------------------
seg000:00BB
seg000:00BB read_sector_no_error:                   ; CODE XREF: seg000:009Dj
seg000:00BB                 cmp     word ptr ds:7DFEh, 0AA55h
seg000:00C1                 jnz     short ErrorUndefined ; 检测结束标志位
seg000:00C3                 push    word ptr [bp+0]
seg000:00C6                 call    keyboard_status_8042
seg000:00C9                 jnz     short loc_E2
seg000:00CB                 cli
seg000:00CC                 mov     al, 0D1h ; '  ; A20总线
seg000:00CE                 out     64h, al         ; 8042 keyboard controller command register.
seg000:00CE                                         ; Write output port (next byte to port 60h):
seg000:00CE                                         ; 7:  1=keyboard data line pulled low (inhibited)
seg000:00CE                                         ; 6:  1=keyboard clock line pulled low (inhibited)
seg000:00CE                                         ; 5:  enables IRQ 12 interrupt on mouse IBF
seg000:00CE                                         ; 4:  enables IRQ 1 interrupt on keyboard IBF
seg000:00CE                                         ; 3:  1=mouse clock line pulled low (inhibited)
seg000:00CE                                         ; 2:  1=mouse data line pulled low (inhibited)
seg000:00CE                                         ; 1:  A20 gate on/off
seg000:00CE                                         ; 0:  reset the PC (THIS BIT SHOULD ALWAYS BE SET TO 1)
seg000:00D0                 call    keyboard_status_8042
seg000:00D3                 mov     al, 0DFh ; '
seg000:00D5                 out     60h, al         ; 8042 keyboard controller data register.
seg000:00D7                 call    keyboard_status_8042
seg000:00DA                 mov     al, 0FFh
seg000:00DC                 out     64h, al         ; 8042 keyboard controller command register.
seg000:00DC                                         ; Pulse output port.
seg000:00DC                                         ; Bits 0-3 indicate ports to pulse.
seg000:00DE                 call    keyboard_status_8042
seg000:00E1                 sti
seg000:00E2
seg000:00E2 loc_E2:                                 ; CODE XREF: seg000:00C9j
seg000:00E2                 mov     ax, 0BB00h
seg000:00E5                 int     1Ah             ; Trusted Computing Group call - TCG_StatusCheck
seg000:00E5                                         ; Return: EAX = 0 if supported
seg000:00E5                                         ; EBX = 41504354h ('TCPA')
seg000:00E5                                         ; CH:CL = TCG BIOS Version
seg000:00E5                                         ; EDX = BIOS TCG Feature Flags
seg000:00E5                                         ; ESI = Pointer to Event Log
seg000:00E5                                         ;
seg000:00E7                 and     eax, eax
seg000:00EA                 jnz     short JumpDBR
seg000:00EC                 cmp     ebx, 41504354h
seg000:00F3                 jnz     short JumpDBR
seg000:00F5                 cmp     cx, 102h
seg000:00F9                 jb      short JumpDBR
seg000:00FB                 push    large 0BB07h    ; eax
seg000:0101                 push    large 200h      ; ecx
seg000:0107                 push    large 8         ; edx
seg000:010D                 push    ebx             ; ebx
seg000:010F                 push    ebx             ; esp
seg000:0111                 push    ebp             ; ebp
seg000:0113                 push    large 0         ; esi
seg000:0119                 push    large 7C00h     ; edi = 7c00h
seg000:011F                 popad
seg000:0121                 push    0
seg000:0124                 pop     es              ; esi = 0
seg000:0125                 int     1Ah
seg000:0127
seg000:0127 ; =============== S U B R O U T I N E =======================================
seg000:0127
seg000:0127 ; Attributes: noreturn
seg000:0127
seg000:0127 JumpDBR         proc near               ; CODE XREF: seg000:00EAj
seg000:0127                                         ; seg000:00F3j ...
seg000:0127                 pop     dx
seg000:0128                 xor     dh, dh
seg000:012A                 jmp     far ptr 0:7C00h
seg000:012A JumpDBR         endp ; sp-analysis failed
seg000:012A
seg000:012A ; ---------------------------------------------------------------------------
seg000:012F                 db 0CDh ; 
seg000:0130                 db  18h
seg000:0131 ; ---------------------------------------------------------------------------
seg000:0131
seg000:0131 ErrorUndefined:                         ; CODE XREF: seg000:00C1j
seg000:0131                 mov     al, ds:7B7h
seg000:0134                 jmp     short DisplayErrorMsg
seg000:0136 ; ---------------------------------------------------------------------------
seg000:0136
seg000:0136 ErrorLoadOS:                            ; CODE XREF: seg000:00A8j
seg000:0136                 mov     al, ds:7B6h
seg000:0139                 jmp     short DisplayErrorMsg
seg000:013B ; ---------------------------------------------------------------------------
seg000:013B
seg000:013B InvaildPartitionTable:                  ; CODE XREF: seg000:0029j
seg000:013B                 mov     al, ds:7B5h
seg000:013E
seg000:013E DisplayErrorMsg:                        ; CODE XREF: seg000:0134j
seg000:013E                                         ; seg000:0139j
seg000:013E                 xor     ah, ah
seg000:0140                 add     ax, 700h
seg000:0143                 mov     si, ax
seg000:0145
seg000:0145 LoopDisplayErrorMsg:                    ; CODE XREF: seg000:0151j
seg000:0145                 lodsb
seg000:0146                 cmp     al, 0
seg000:0148                 jz      short Standby
seg000:014A                 mov     bx, 7
seg000:014D                 mov     ah, 0Eh
seg000:014F                 int     10h             ; - VIDEO - WRITE CHARACTER AND ADVANCE CURSOR (TTY WRITE)
seg000:014F                                         ; AL = character, BH = display page (alpha modes)
seg000:014F                                         ; BL = foreground color (graphics modes)
seg000:0151                 jmp     short LoopDisplayErrorMsg
seg000:0153 ; ---------------------------------------------------------------------------
seg000:0153
seg000:0153 Standby:                                ; CODE XREF: seg000:0148j
seg000:0153                 hlt
seg000:0153 ; ---------------------------------------------------------------------------
seg000:0154                 db 0EBh ; 
seg000:0155                 db 0FDh ; 
seg000:0156
seg000:0156 ; =============== S U B R O U T I N E =======================================
seg000:0156
seg000:0156
seg000:0156 keyboard_status_8042 proc near          ; CODE XREF: seg000:00C6p
seg000:0156                                         ; seg000:00D0p ...
seg000:0156                 sub     cx, cx
seg000:0158
seg000:0158 loc_158:                                ; CODE XREF: keyboard_status_8042+8j
seg000:0158                 in      al, 64h         ; 8042 keyboard controller status register
seg000:0158                                         ; 7:  PERR    1=parity error in data received from keyboard
seg000:0158                                         ;    +----------- AT Mode ----------+------------ PS/2 Mode ------------+
seg000:0158                                         ; 6: |RxTO    receive (Rx) timeout  | TO      general timeout (Rx or Tx)|
seg000:0158                                         ; 5: |TxTO    transmit (Tx) timeout | MOBF    mouse output buffer full  |
seg000:0158                                         ;    +------------------------------+-----------------------------------+
seg000:0158                                         ; 4:  INH     0=keyboard communications inhibited
seg000:0158                                         ; 3:  A2      0=60h was the port last written to, 1=64h was last
seg000:0158                                         ; 2:  SYS     distinguishes reset types: 0=cold reboot, 1=warm reboot
seg000:0158                                         ; 1:  IBF     1=input buffer full (keyboard can't accept data)
seg000:0158                                         ; 0:  OBF     1=output buffer full (data from keyboard is available)
seg000:015A                 jmp     short $+2
seg000:015C ; ---------------------------------------------------------------------------
seg000:015C
seg000:015C loc_15C:                                ; CODE XREF: keyboard_status_8042+4j
seg000:015C                 and     al, 2
seg000:015E                 loopne  loc_158
seg000:0160                 and     al, 2
seg000:0162                 retn
seg000:0162 keyboard_status_8042 endp
seg000:0162
seg000:0162 ; ---------------------------------------------------------------------------
seg000:0163                 db  49h ; I
seg000:0164 aNvalidPartitio db 'nvalid partition table',0
seg000:017B                 db  45h ; E
seg000:017C aRrorLoadingOpe db 'rror loading operating system',0
seg000:019A                 db  4Dh ; M
seg000:019B aIssingOperatin db 'issing operating system',0
seg000:01B3                 db 2 dup(0), 63h, 7Bh, 9Ah, 8 dup(0), 2, 0, 0EEh, 0FEh
seg000:01B3                 db 7Fh, 99h, 1, 3 dup(0), 4 dup(0FFh), 30h dup(0), 55h
seg000:01B3                 db 0AAh
seg000:01B3 seg000          ends
seg000:01B3
seg000:01B3
seg000:01B3                 end