关于Windows的启动引导过程，相信很多大牛都了如指掌，这里只是将自己的学习过程分享，文章中肯定有很多理解的不是很到位的地方，还望各位牛指点。一、MBR调试
debugStub.listen.guest32 = "TRUE"
debugStub.hideBreakpoints = "TRUE"
bios.bootDelay = "3000"
MEMORY:7C00 loc_7C00: ; CODE XREF: MEMORY:loc_7CAEJ
MEMORY:7C00 cli
MEMORY:7C01 cld
MEMORY:7C02 xor ax, ax
MEMORY:7C04 mov ss, ax
MEMORY:7C06 mov ds, ax
MEMORY:7C08 mov bp, 7C00h
MEMORY:7C0B lea sp, [bp-20h]
MEMORY:7C0E sti
MEMORY:7C0F mov ax, 1FE0h
MEMORY:7C12 mov es, ax
MEMORY:7C14 assume es:nothing
MEMORY:7C14 mov si, bp
MEMORY:7C16 mov di, bp
MEMORY:7C18 mov cx, 100h
MEMORY:7C1B rep movsw ; 把MBR移动到1FE0h:7C00h处
MEMORY:7C1D jmp far ptr 1FE0h:7C22h
MEMORY:27A22 loc_27A22: ; CODE XREF: MEMORY:7C1DJ
MEMORY:27A22 mov ds, ax
MEMORY:27A24 assume ds:MEMORY
MEMORY:27A24 mov ss, ax
MEMORY:27A26 assume ss:MEMORY
MEMORY:27A26 xor ax, ax
MEMORY:27A28 mov es, ax
MEMORY:27A2A lea di, [bp+1BEh] ; 获取分区表地址
MEMORY:27A2E test byte ptr [di], 80h ; 是否是活动分区
MEMORY:27A31 jnz short loc_7AA0[attach]6243[/attach]
MEMORY:27A33 add di, 10h ; 每个分区表项大小为16个字节
MEMORY:27A36 cmp di, 7DFEh ; 分区表搜索是否结束
MEMORY:27A3A jb short loc_7A2E
MEMORY:27AA0 call loc_7AB3
MEMORY:27AA3 jb short loc_7A5B
MEMORY:27AA5 cmp es:word_7DFE, 0AA55h
MEMORY:27AAC jnz short loc_7A7F
MEMORY:27AAE jmp far ptr loc_7C00
MEMORY:27AB3 mov bx, 55AAh
MEMORY:27AB6 mov ah, 41h ; 'A'
MEMORY:27AB8 int 13h ; DISK - Check for INT 13h Extensions
MEMORY:27AB8 ; BX = 55AAh, DL = drive number
MEMORY:27AB8 ; Return: CF set if not supported
MEMORY:27AB8 ; AH = extensions version
MEMORY:27AB8 ; BX = AA55h
MEMORY:27AB8 ; CX = Interface support bit map
MEMORY:27ABA jb short loc_7AEE
MEMORY:27ABC cmp bx, 0AA55h
MEMORY:27AC0 jnz short loc_7AEE
MEMORY:27AC2 test cl, 1
MEMORY:27AC5 jz short loc_7AEE
MEMORY:27AC7 jmp short loc_7AD9
MEMORY:27AEE mov ax, 204h
MEMORY:27AF1 mov bx, 7C00h
MEMORY:27AF4 mov cx, [di+2] ;di为分区表首地址
MEMORY:27AF7 mov dh, [di+1]
MEMORY:27AFA int 13h ; DISK - READ SECTORS INTO MEMORY
MEMORY:27AFA ; AL = number of sectors to read, CH = track, CL = sector
MEMORY:27AFA ; DH = head, DL = drive, ES:BX -> buffer to fill
MEMORY:27AFA ; Return: CF set on error, AH = status, AL = number of sectors read
MEMORY:27AFC retn
MEMORY:27AC9 db 10h
MEMORY:27ACA db 0
MEMORY:27ACB db 4
MEMORY:27ACC db 0
MEMORY:27ACD db 0
MEMORY:27ACE db 7Ch ; |
MEMORY:27ACF db 0
MEMORY:27AD0 db 0
MEMORY:27AD1 word_27AD1 dw 0 ; DATA XREF: MEMORY:7CDCw
MEMORY:27AD3 word_27AD3 dw 0 ; DATA XREF: MEMORY:loc_7CE2w
MEMORY:27AD5 db 0
MEMORY:27AD6 db 0
MEMORY:27AD7 db 0
MEMORY:27AD8 db 0
MEMORY:27AD9 ; ---------------------------------------------------------------------------
MEMORY:27AD9 mov ax, [di+8]
MEMORY:27ADC mov word_7CD1, ax
MEMORY:27ADF mov ax, [di+0Ah]
MEMORY:27AE2 mov word_7CD3, ax
MEMORY:27AE5 mov ax, 4200h
MEMORY:27AE8 mov si, 7CC9h
MEMORY:27AEB int 13h ; DISK - IBM/MS Extension - EXTENDED READ (DL - drive, DS:SI - disk address packet)
MEMORY:27AED retn
MEMORY:27AA3 jb short loc_7A5B
MEMORY:27AA5 cmp es:word_7DFE, 0AA55h
MEMORY:27AAC jnz short loc_7A7F
MEMORY:27AAE jmp far ptr loc_7C00
MEMORY:7C00 jmp short near ptr unk_7C5A
MEMORY:7C5A xor ax, ax
MEMORY:7C5C mov ds, ax
MEMORY:7C5E assume ds:MEMORY
MEMORY:7C5E mov es, ax
MEMORY:7C60 assume es:MEMORY
MEMORY:7C60 mov ss, ax
MEMORY:7C62 mov bp, 7C00h
MEMORY:7C65 mov sp, 7C00h
MEMORY:7C68 cmp byte ptr [bp+40h], 0FFh ; 检测磁盘物理驱动号是否正确
MEMORY:7C6D jnz short loc_7C73 ; 判断分区文件系统是fat12/fat16还是fat32
MEMORY:7C6F mov [bp+40h], dl
MEMORY:7C73
MEMORY:7C73 loc_7C73: ; CODE XREF: MEMORY:7C6Dj
MEMORY:7C73 cmp word ptr [bp+16h], 0 ; 判断分区文件系统是fat12/fat16还是fat32
MEMORY:7C78 jnz short loc_7C89 ; 如果是fat12/fat16则跳转
MEMORY:7C7A cmp dword ptr [bp+11h], 0 ; 判断分区文件系统是fat12/fat16还是fat32
MEMORY:7C80 jnz short loc_7C89 ; 如果是fat12/fat16则跳转
MEMORY:7C82 cmp word ptr [bp+2Ah], 0
MEMORY:7C87 jbe short loc_7C8C ; 如果是fat32则跳转
MEMORY:7C89
MEMORY:7C89 loc_7C89: ; CODE XREF: MEMORY:7C78j
MEMORY:7C89 ; MEMORY:7C80j
MEMORY:7C89 jmp loc_7D93
MEMORY:7C8C loc_7C8C: ; CODE XREF: MEMORY:7C87j
MEMORY:7C8C mov ax, 800h
MEMORY:7C8F mov dl, [bp+40h]
MEMORY:7C93 int 13h ; DISK - DISK - GET CURRENT DRIVE PARAMETERS (XT,AT,XT286,CONV,PS)
MEMORY:7C93 ; DL = drive number
MEMORY:7C93 ; Return: CF set on error, AH = status code, BL = drive type
MEMORY:7C93 ; DL = number of consecutive drives
MEMORY:7C93 ; DH = maximum value for head number, ES:DI -> drive parameter
MEMORY:7C95 jnb short loc_7C9C
MEMORY:7C97 mov cx, 0FFFFh
MEMORY:7C9A mov dh, cl
MEMORY:7C9C loc_7C9C: ; CODE XREF: MEMORY:7C95j
MEMORY:7C9C mov bl, ch ; ch存放的是柱面数的低8位（柱面数总共有10位，高2位来自于cl的高2位）
MEMORY:7C9E mov bh, cl ; cl的低6位存放的是没磁道扇区数（高2位和ch组合来表示柱面数）
MEMORY:7CA0 shr bh, 6 ; 这里把bh的值右移6位，那么bh中只剩下cl的高2位，然后和bl的8位一起表示柱面数，所以bx的值就是柱面数
MEMORY:7CA3 and cl, 3Fh ; 这里取的是cl的低6位的值
MEMORY:7CA6 movzx eax, dh ; dh存放的是磁头数
MEMORY:7CAA movzx ebx, bx
MEMORY:7CAE movzx ecx, cl
MEMORY:7CB2 inc eax ; 因为磁头数是从0开始计数，所以这里要+1
MEMORY:7CB4 inc ebx ; 柱面数也是从0开始计数，这里也要+1
MEMORY:7CB6 mul ecx ; 这里是磁头数*每磁道扇区数
MEMORY:7CB9 mul ebx ; 上面得到的结果*柱面数，得到的值其实就是这个分区的大小
MEMORY:7CBC mov dword_7DB4, eax
MEMORY:7CC0 mov eax, 0Eh
MEMORY:7CC6 add eax, [bp+1Ch] ; 计算第二个引导扇区的绝对偏移
MEMORY:7CCB mov cx, 1
MEMORY:7CCE xor bx, bx
MEMORY:7CD0 mov es, bx
MEMORY:7CD2 mov bx, 7E00h
MEMORY:7CD5 call loc_7CDB
MEMORY:7CD8 jmp loc_7E00
MEMORY:7CDB loc_7CDB: ; CODE XREF: MEMORY:7CD5p
MEMORY:7CDB push es
MEMORY:7CDC cmp eax, dword_7DB4
MEMORY:7CE1 jnb short loc_7CFF
MEMORY:7CE3 pushad
MEMORY:7CE5 mov ah, 41h ; 'A'
MEMORY:7CE7 mov bx, 55AAh
MEMORY:7CEA mov dl, [bp+40h]
MEMORY:7CEE int 13h ; DISK - Check for INT 13h Extensions
MEMORY:7CEE ; BX = 55AAh, DL = drive number
MEMORY:7CEE ; Return: CF set if not supported
MEMORY:7CEE ; AH = extensions version
MEMORY:7CEE ; BX = AA55h
MEMORY:7CEE ; CX = Interface support bit map
MEMORY:7CF0 jb short loc_7D49 ; 拓展功能不可用则跳转
MEMORY:7CF2 cmp bx, 0AA55h
MEMORY:7CF6 jnz short loc_7D49
MEMORY:7CF8 test cl, 1
MEMORY:7CFB jz short loc_7D49
MEMORY:7CFD popad
MEMORY:7CFF
MEMORY:7CFF loc_7CFF: ; CODE XREF: MEMORY:7CE1j
MEMORY:7CFF ; MEMORY:7D41j
MEMORY:7CFF pushad
MEMORY:7D01 cmp cx, 40h ; '@'
MEMORY:7D04 jbe short loc_7D09
MEMORY:7D06 mov cx, 40h ; '@'
MEMORY:7D09
MEMORY:7D09 loc_7D09: ; CODE XREF: MEMORY:7D04j
MEMORY:7D09 mov word ptr dword_7D45, cx
MEMORY:7D0D push 0
MEMORY:7D0F push 0
MEMORY:7D11 push eax
MEMORY:7D13 push es
MEMORY:7D14 push bx
MEMORY:7D15 push cx
MEMORY:7D16 push 10h
MEMORY:7D18 mov si, sp
MEMORY:7D1A mov dl, [bp+40h]
MEMORY:7D1E mov ah, 42h ; 'B'
MEMORY:7D20 int 13h ; DISK - IBM/MS Extension - EXTENDED READ (DL - drive, DS:SI - disk address packet)
MEMORY:7D22 jb short loc_7D8B
MEMORY:7D24 add sp, 10h
MEMORY:7D27 popad
MEMORY:7D29 push bx
MEMORY:7D2A mov ebx, dword_7D45
MEMORY:7D2F add eax, ebx
MEMORY:7D32 shl ebx, 5
MEMORY:7D36 mov dx, es
MEMORY:7D38 add dx, bx
MEMORY:7D3A mov es, dx
MEMORY:7D3C pop bx
MEMORY:7D3D sub cx, word ptr dword_7D45
MEMORY:7D41 jnz short loc_7CFF
MEMORY:7D43 pop es
MEMORY:7D44 retn
MEMORY:7E00 ; MEMORY:7E5Bj ...
MEMORY:7E00 mov eax, [bp+2Ch] ; 获取根目录簇号
MEMORY:7E05 cmp eax, 0FFFFFF8h
MEMORY:7E0B jb short loc_7E10
MEMORY:7E10 loc_7E10: ; CODE XREF: MEMORY:7E0Bj
MEMORY:7E10 mov bx, 2000h
MEMORY:7E13 mov es, bx
MEMORY:7E15 assume es:nothing
MEMORY:7E15 call loc_7F3E
MEMORY:7F3E dec eax
MEMORY:7F40 dec eax
MEMORY:7F42 xor edx, edx
MEMORY:7F45 movzx ebx, byte ptr [bp+0Dh] ; 获取每簇扇区数
MEMORY:7F4B mul ebx
MEMORY:7F4E push eax
MEMORY:7F50 xor edx, edx
MEMORY:7F53 movzx eax, byte ptr [bp+10h] ; 获取fat表数
MEMORY:7F59 mul dword ptr [bp+24h] ; 用fat表数*每fat扇区数
MEMORY:7F5E movzx ebx, word ptr [bp+0Eh] ; 获取保留扇区数
MEMORY:7F64 add eax, ebx
MEMORY:7F67 add eax, [bp+1Ch] ; 加上隐藏扇区数
MEMORY:7F6C pop ebx
MEMORY:7F6E add eax, ebx
MEMORY:7F71 xor bx, bx
MEMORY:7F73 movzx cx, byte ptr [bp+0Dh]
MEMORY:7F78 call sub_7CDB
MEMORY:7F7B retn
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
上传的附件：
我争取能全部看懂
