DBR详细分析
代码:
code:7C00 ; File Name : D:\DBR.COM
code:7C00 ; Format : MS-DOS COM-file
code:7C00 ; Base Address: 1000h Range: 10100h-10300h Loaded length: 200h
code:7C00
code:7C00 .686p
code:7C00 .mmx
code:7C00 .model tiny
code:7C00
code:7C00 ; ###########################################################################
code:7C00
code:7C00 ; Segment type: Pure code
code:7C00 code segment byte public 'CODE' use16
code:7C00 assume cs:code
code:7C00 org 7C00h
code:7C00 assume es:nothing, ss:nothing, ds:code, fs:nothing, gs:nothing
code:7C00
code:7C00 ; =============== S U B R O U T I N E =======================================
code:7C00
code:7C00 public start
code:7C00 start proc far
code:7C00 jmp short begin
code:7C00
code:7C02 ; ---------------------------------------------------------------------------
code:7C02 nop
code:7C02
code:7C02 ; ---------------------------------------------------------------------------
code:7C03 sz_Ntfs db 'NTFS ',0
code:7C0C db 2, 8, 7 dup(0), 0F8h, 2 dup(0), 3Fh, 0, 0FFh, 0, 3Fh, 7 dup(0), 80h, 0, 80h, 0, 4Dh
code:7C0C db 83h, 0EEh, 7 dup(0), 0Ch, 5 dup(0), 10h, 7 dup(0), 0F6h, 3 dup(0), 1, 3 dup(0), 61h
code:7C0C db 0F5h, 0B9h, 0B3h, 2Fh, 0F6h, 33h, 13h, 4 dup(0)
code:7C54 ; ---------------------------------------------------------------------------
code:7C54
code:7C54 begin:
code:7C54 cli
code:7C55 xor ax, ax
code:7C57 mov ss, ax
code:7C59 mov sp, 7C00h
code:7C5C sti
code:7C5D mov ax, 7C0h
code:7C60 mov ds, ax
code:7C62 assume ds:nothing
code:7C62 call GetCurrentDriveParaments
code:7C62
code:7C65 mov ax, 0D00h
code:7C68 mov es, ax
code:7C6A xor bx, bx
code:7C6C mov byte ptr ds:0Eh, 10h
code:7C71 call ReadDiskSectors
code:7C71
code:7C74 push 0D00h
code:7C77 push 26Ah
code:7C7A retf
code:7C7A
code:7C7A start endp
code:7C7A
code:7C7B ; =============== S U B R O U T I N E =======================================
code:7C7B
code:7C7B GetCurrentDriveParaments proc near
code:7C7B mov dl,
ds:24h ; DL = drive number,Why must use ds:24h Memory?我也不明白 为什么要这样使用
code:7C7F mov ah, 8
code:7C81 int 13h
code:7C83 jnb short success
code:7C83
code:7C85 mov cx, 0FFFFh
code:7C88 mov dh, cl
code:7C88
code:7C8A success:
code:7C8A movzx eax, dh ; why now can use 'EAX' register,but it in use 16?
code:7C8E inc ax
code:7C8F movzx edx, cl
code:7C93 and dl, 3Fh
code:7C96 mul dx
code:7C98 xchg cl, ch
code:7C9A shr ch, 6
code:7C9D inc cx
code:7C9E movzx ecx, cx
code:7CA2 mul ecx
code:7CA5 mov ds:20h, eax
code:7CA9 retn
code:7CA9
code:7CA9 GetCurrentDriveParaments endp
code:7CA9
code:7CAA ; =============== S U B R O U T I N E =======================================
code:7CAA
code:7CAA CheckExtenInt13 proc near
code:7CAA mov ah, 41h
code:7CAC mov bx, 55AAh
code:7CAF mov dl, ds:24h
code:7CB3 int 13h
code:7CB5 jb short exit
code:7CB5
code:7CB7 cmp bx, 0AA55h
code:7CBB jnz short exit
code:7CBB
code:7CBD test cl, 1
code:7CC0 jz short exit
code:7CC0
code:7CC2 inc byte ptr ds:14h ; set a flage
code:7CC6 exit:
code:7CC6 retn
code:7CC6
code:7CC6 CheckExtenInt13 endp
code:7CC6
code:7CC7 ; =============== S U B R O U T I N E =======================================
code:7CC7
code:7CC7 ReadDiskSectors proc near
code:7CC7 pushad
code:7CC9 push ds
code:7CCA push es
code:7CCB continue_work:
code:7CCB mov
eax, ds:10h
code:7CCF add
eax, ds:1Ch
code:7CD4 cmp
eax, ds:20h这些代表什么？希望大家给详细的解释解释code:7CD9 jb read_disk_sectors
code:7CD9
code:7CDD push ds
code:7CDE push large 0
code:7CE1 push eax
code:7CE3 push es
code:7CE4 push bx
code:7CE5 push large 10010h
code:7CEB cmp byte ptr ds:14h, 0 ; check a flage
code:7CF0 jnz continue
code:7CF0
code:7CF4 call CheckExtenInt13
code:7CF4
code:7CF7 cmp byte ptr ds:14h, 0 ; check a flage
code:7CFC jz cant_continue
code:7D00 continue:
code:7D00 mov ah, 42h
code:7D02 mov dl, ds:24h
code:7D06 push ss
code:7D07 pop ds
code:7D08 mov si, sp
code:7D0A int 13h
code:7D0C pop eax
code:7D0E pop bx
code:7D0F pop es
code:7D10 pop eax
code:7D12 pop eax
code:7D14 pop ds
code:7D15 jmp short exit
code:7D15
code:7D17 ; ---------------------------------------------------------------------------
code:7D17 read_disk_sectors:
code:7D17 xor edx, edx
code:7D1A movzx ecx, word ptr ds:18h
code:7D20 div ecx
code:7D23 inc dl
code:7D25 mov cl, dl
code:7D27 mov edx, eax
code:7D2A shr edx, 10h
code:7D2E div word ptr ds:1Ah
code:7D32 xchg dl, dh ; DH = head
code:7D34 mov dl, ds:24h ; ES:BX -> buffer to fill
code:7D38 mov ch, al ; CH = track
code:7D3A shl ah, 6 ; DL = drive
code:7D3D or cl, ah ; CL = sector
code:7D3F mov ax, 201h ; AL = number of sectors to read
code:7D42 int 13h
code:7D42
code:7D44 exit:
code:7D44 jb cant_continue
code:7D44
code:7D48 mov ax, es
code:7D4A add ax, 20h
code:7D4D mov es, ax
code:7D4F inc dword ptr ds:10h
code:7D54 dec word ptr ds:0Eh
code:7D58 jnz continue_work
code:7D58
code:7D5C pop es
code:7D5D pop ds
code:7D5E popad
code:7D60 retn
code:7D60
code:7D61 ; ---------------------------------------------------------------------------
code:7D61
code:7D61 cant_continue:
code:7D61
code:7D61 mov al, ds:1F8h
code:7D64 call PrintErrorMessage
code:7D64
code:7D67 mov al, ds:1FBh
code:7D6A call PrintErrorMessage
code:7D6A
code:7D6D sti
code:7D6D
code:7D6E no_end:
code:7D6E jmp short no_end
code:7D6E
code:7D6E ReadDiskSectors endp
code:7D6E
code:7D70 ; =============== S U B R O U T I N E =======================================
code:7D70
code:7D70 PrintErrorMessage proc near
code:7D70
code:7D70 mov ah, 1
code:7D72 mov si, ax
code:7D72
code:7D74
code:7D74 continue:
code:7D74 lodsb
code:7D75 cmp al, 0
code:7D77 jz short exit
code:7D77
code:7D79 mov ah, 0Eh
code:7D7B mov bx, 7
code:7D7E int 10h
code:7D7E
code:7D80 jmp short continue
code:7D80
code:7D82 ; ---------------------------------------------------------------------------
code:7D82 exit:
code:7D82 retn
code:7D82
code:7D82 PrintErrorMessage endp
code:7D82
code:7D82 ; ---------------------------------------------------------------------------
code:7D83 db 0Dh, 0Ah
code:7D85 sz_DiskReadError db 'A disk read error occurred',0
code:7DA0 db 0Dh, 0Ah
code:7DA2 sz_NtldrIsMissing db 'NTLDR is missing',0
code:7DB3 db 0Dh, 0Ah
code:7DB5 sz_NtldrIsCompressed db 'NTLDR is compressed',0
code:7DC9 db 0Dh, 0Ah
code:7DCB sz_PressCtrlAltDel db 'Press Ctrl+Alt+Del to restart',0Dh,0Ah,0
code:7DEB db 0Dh dup(0), 83h, 0A0h, 0B3h, 0C9h, 2 dup(0), 55h, 0AAh
code:7DEB code ends
code:7DEB
code:7DEB end start
[课程]Android-CTF解题方法汇总！
