PDESC Struc
LIMIT DW 0
BASE DD 0
PDESC ENDS

.486p
DSEG segment use16

GDT LABEL byte
db 8 dup (0)
db 0FFh, 0FFh, 000h, 000h, 000h, 093h, 000h, 000h
db 0FFh, 0FFh, 000h, 000h, 000h, 093h, 08Fh, 000h
GDT_END LABEL byte

GDTLEN = $- GDT

VGDTR PDESC <GDTLEN-1,>


offsetz equ 7fff00h


spi_rom_256_bytes db 256 dup(?)

DSEG ends

CSEG segment use16
assume cs:CSEG,ds:DSEG

START:
mov ax,DSEG
mov ds,ax

mov bx, 16
mul bx
add ax, offset GDT
adc dx, 0
mov word ptr VGDTR.BASE, ax
mov word ptr VGDTR.BASE+2, dx

mov al, 96h
out 80h, al

lgdt fword ptr VGDTR
cli
call Enable_A20

mov al, 97h
out 80h, al

mov eax, cr0
or al, 01h
mov cr0, eax

jmp Enter_PM
Enter_PM:

xor eax, eax
mov al, 99h
out 80h, al

mov ax, 10h
mov es, ax

mov eax, cr0
and al, 0FEh
mov cr0, eax
jmp Exit_PM
Exit_PM:

mov al, 94h
out 80h, al

xor eax, eax
; mov ds, ax ; DS = ES = 0
mov es, ax
sti

mov al, 98h
out 80h, al

;
; You may add your code here to RW 32bit memory Start
;

;london:can i add pusha and popa? pusha will not affect flags register

mov di,offset spi_rom_256_bytes
mov ecx,7fff00h

read_spi_rom_256_bytes:
;set the linear addr(the offset to read) spibar=0fed1f800h
mov esi,0fed1f808h ;FADDR--DWORD
mov eax,ecx
mov dword ptr es:[esi],eax ;"es:" must be added,don't know why?


mov esi,0fed1f806h
mov ax,0301h
mov word ptr es:[esi],ax

;wait and test if scip(spi cycle in progress) bit cleared and fdone(flash cycle done) bit set,double check?
testz:
mov esi,0fed1f804h ;HSFS--WORD
mov ax, word ptr es:[esi]
and ax,0021h ;0000,0000,0010,0001b
cmp ax,1h
jnz testz


mov esi,0fed1f804h
mov ax, word ptr es:[esi]
and ax,06h
cmp ax,0
jnz endz



mov esi,0fed1f810h
mov eax,dword ptr es:[esi]

mov dword ptr ds:[di],eax
add di,4
add ecx,4
cmp ecx,800000h
jnz read_spi_rom_256_bytes


push es
mov bx,0b800h
mov es,bx
mov cx,0 ;for carriage return
mov di,offset spi_rom_256_bytes

print_block:
mov bx,cx

print_a_line:
mov al,byte ptr ds:[di]
mov ah,al
shr ah,4
.if(ah<=9)
add ah,30h
.else
add ah,41h
sub ah,10
.endif
mov es:[bx],ah
inc bx
mov dl,0eh
mov es:[bx],dl
inc bx

and al,0fh
.if(al<=9)
add al,30h
.else
add al,41h
sub al,10
.endif
mov es:[bx],al
inc bx
mov es:[bx],dl
inc bx

mov al,32
mov es:[bx],al
inc bx
mov es:[bx],dl
inc bx

inc di
push di
sub di,offset spi_rom_256_bytes
and di,0fh
cmp di,0
pop di
jne print_a_line

add cx,160
cmp di,offset spi_rom_256_bytes+256
jnz print_block

;mov the cursor down
mov dh,16
mov dl,0
mov bh,0
mov ah,2
int 10h

pop es
;
; You may add your code here to RW 32bit memory end
;
endz:
mov ax, 4c00h
int 21h

Enable_A20 PROC NEAR PUBLIC

push ax
in al, 92h
or al, 2
out 92h, al
pop ax

ret
Enable_A20 ENDP

CSEG ends
end START

[招生]系统0day安全班，企业级设备固件漏洞挖掘，Linux平台漏洞挖掘！