[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: how could i get the hexadecimal content in memory at address FFFF0000-FFFFFFF0?



Star Liu 写道:
On Mon, Jul 14, 2008 at 4:22 PM, shell909090 <shell909090@gmail.com> wrote:
FFFF:0000, Too many F.
That's a history story about DOS and CP/M times...
When CPU has been reset, it will back to real mode and set SS=FFFF IP=0000.
Here has some code which is mapped from BIOS. Sometime when we take a
reflush to BIOS, will see something called "BootBlock", and can not be
modified. This is what it used for. Commonly, it will do something like
check memory, test if disk is ok, decide which device is used to boot, blah
blah blah. Finally, It will get a block(about 512 bytes) of code, load it to
0000:7c00, then jump into it. It is the code we call MBR. Then, Computer is
booted.
If u wanna to get this code, try to read BIOS.

可是怎么read bios呢?我可不想去读一堆C代码,我想直接读机器码,我会按照cpu手册去翻译机器码的

早说你会中文阿,累死我了。
会读机器码的叫做小强中的小强,要有这个能力,差不多你也应该知道编程器的用 途了吧。找个老机器的BIOS,用改锥敲下来,然后用编程器读出来就好了。不过如 果想省事点,那用BIOS备份工具备份BIOS,然后找个工具解开,用反编译器去看代码。 不过提醒你,这个代码可是真正意义上的汇编。很多时候现代汇编编程所必须的输 入/输出系统调用都是没有的,没有int,没有syscall(这是当然,因为是实模 式,而且系统都还没有初始化呢)。这个代码的难度比MBR更高,只能了解主板设 计后去in和out,或者是(出于兼容意义,可能性不高)想法 DMA(抱歉我也不会用 汇编操作DMA)。


Reply to: