0

I try disassemble boot sector for floppy 360K MS-DOS 2.0. There is code:

;bios parameter block here

seg000:001F                 db    0
seg000:0020                 db  0Ah
seg000:0021                 db 0DFh
seg000:0022                 db    2
seg000:0023                 db  25h ; %
seg000:0024                 db    2
seg000:0025                 db    9
seg000:0026                 db  2Ah ; *
seg000:0027                 db 0FFh
seg000:0028                 db  50h ; P
seg000:0029                 db 0F6h ; ¡
seg000:002A                 db    0
seg000:002B                 db    2
seg000:002C ; ---------------------------------------------------------------------------
seg000:002C
seg000:002C reboot:                                 ; CODE XREF: seg000:loc_77j
seg000:002C                 int     19h             ; DISK BOOT
seg000:002C                                         ; causes reboot of disk system
seg000:002E
seg000:002E msdos_main:                             ; CODE XREF: seg000:0000j
seg000:002E                 cli
seg000:002F                 xor     ax, ax
seg000:0031                 mov     ss, ax
seg000:0033                 mov     sp, 7C00h
seg000:0036                 mov     ds, ax
seg000:0038                 mov     word ptr ds:loc_79+1, ax
seg000:003B                 mov     word ptr ds:loc_77+1, 7C21h ; DATA XREF: print_msg+Br
seg000:0041                 sti
seg000:0042                 int     13h



seg000:0074                 call    read_root_dir_into_memory
seg000:0077
seg000:0077 loc_77:                                 ; DATA XREF: seg000:003Bw
seg000:0077                 jb      short reboot
seg000:0079
seg000:0079 loc_79:                                 ; DATA XREF: seg000:0038w
seg000:0079                 mov     ax, ds:7C13h    ; StartUserData
seg000:007C                 mov     ds:7D7Eh, ax    ; StartUserDataVal
seg000:007F                 mov     ax, 70h ; 'p'   ; location 0h:0700h is for read IBMBIO.COM for MS-DOS
seg000:0082                 mov     es, ax

I dont understand this lines:

seg000:0038                 mov     word ptr ds:loc_79+1, ax
seg000:003B                 mov     word ptr ds:loc_77+1, 7C21h ; DATA XREF: print_msg+Br

What is this? This lines break code seems.

UPD.

I took this code:

seg000:0038                 mov     word ptr ds:loc_79+1, ax
seg000:003B                 mov     word ptr ds:loc_77+1, 7C21h ; DATA XREF: print_msg+Br

In hex view:

A3 7A 00 C7 06 78 00 21 7C

Using C++ write binary, then disassemble it, result is:

seg000:0000                 mov     ds:7Ah, ax
seg000:0003                 mov     word ptr ds:78h, 7C21h

And offset in memory 0h:78h seems is disk parameter table, and what is ds:7Ah I dont know.

Improve this question

2 Answers 2

Reset to default
1

Interrupt vector table on 8086 is a vector that consists of 256 total interrupts placed at first 1 kb of memory from 0000h to 03ffh, where each vector consists of segment and offset as a jump table to memory address. So, 78h >> 2 = 1Eh and 7Ah >> 2 = 1Eh . Int 1E is not an interrupt, but a far pointer to the diskette base table

Improve this answer
8
  • 78h >> 2 = 1Eh and 7Ah >> 2 = 1Eh you mean shift right on 2 bits?
    – black4joss
    Commented Jun 18, 2023 at 8:50
  • 1
    Each interrupt vector contains segment and offset - total 4 bytes. 78h >> 2 == 78h / 4, same with 7Ah . I's segment and offset of diskette base table.
    – Igor Matyuh
    Commented Jun 19, 2023 at 9:07
  • 1
    Correct. BPB describes the physical layout of a disk volume as bytes per sector, sectors per cluster, num of FAT, etc. DPT contains initialization parameters as clock ticks until motor off, FM or MFM Mode, gap length when formatting (5,25" or 3,5"), etc.
    – Igor Matyuh
    Commented Jun 20, 2023 at 19:54
  • 1
    Is it IDA's auto-generanted comment or you manage to find some source code?
    – Igor Matyuh
    Commented Jun 21, 2023 at 7:41
  • 1
    Matches this information , but no idea about 15 milliseconds value.
    – Igor Matyuh
    Commented Jun 21, 2023 at 14:27
1

I hope I understood this code correctly. :)

These instructions move data into memory locations. So basically if code exists there, it will be overriden and instructions will change their meaning.

  1. seg000:0038 A3 7A 00 mov word ptr ds:loc_79+1, ax

    It means move ax = 0000 to address ds:loc_79+1. Memory cells 7A and 7B now contain value 00. And if You read bytes starting from address 0079 instruction

    seg000:0079 A1 13 7C mov ax, ds:7C13h

    will change to mov ax, ds:0000h (A1 00 00)

    Same thing happens to second instruction.

  2. seg000:003B C7 06 78 00 21 7C mov word ptr ds:loc_77+1, 7C21h

    Under address 0077 there is jb short reboot According to intel manual this is short conditional jump, so this is 2 byte instruction 72 cb | JB rel8 | D | Valid | Valid | Jump short if below (CF=1)

    Byte 72 stay intact because code writes word 7C21 to address 78 and the trick is that byte 0079 which previously contain value A1 (see point 1), will be changed to 7C

    So now memory will look like:

    77 78 79 7A 7B 
    72 21 7C 00 00 

    seg000:0077 loc_77:     
    seg000:0077                 jb/jnae 21 ; (jump 21h bytes forward)
    seg000:0079
    seg000:0079 loc_79:                    
    seg000:0079                 jl/jnge 00 ; (execute next instruction)

    seg000:002C reboot:                                 ; CODE XREF: seg000:loc_77j
    seg000:002C CD 19               int     19h             ; DISK BOOT
    seg000:002C                                         ; causes reboot of disk system
    seg000:002E
    seg000:002E msdos_main:                             ; CODE XREF: seg000:0000j
    seg000:002E FA                  cli
    seg000:002F 31 C0               xor     ax, ax
    seg000:0031 8E D0               mov     ss, ax
    seg000:0033 BC 00 7C            mov     sp, 7C00h
    seg000:0036 8E D8               mov     ds, ax
    seg000:0038 A3 7A 00            mov     word ptr ds:loc_79+1, ax
    seg000:003B C7 06 78 00 21 7C   mov     word ptr ds:loc_77+1, 7C21h ; DATA XREF: print_msg+Br
    seg000:0041 FB                  sti
    seg000:0042 CD 13               int     13h

I hope I didn't mess anything... and this is mbr loaded to 0:7C00 btw.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.