注册
登录
| 关键词： nbsp code mov partition short axcode push DB 分区表 代码 |
之所以贴出来,是有些地方不明白,希望能于大家交流分析我系统2K PRO SP4,C盘采用NTFS,用WinHex提取MBR和DBR,拿IDA分析的.关键在DBR几处不明白.1.一点预备知识: 主引导扇区代码（MBR） 代码: ;====================================================================================; ; MBR( Master Boot Record )主引导记录包含两部分的内容，前446字节为启动代码及数据，而; 从446(0x1BE)开始则是分区表，分区表由四个分区项组成，每个分区项数据为16字节，记录了; 启动时需要的分区参数。;; 在CPU上电之后，若由硬盘启动，则BIOS将硬盘的主引导记录（位于0柱面、0磁道、1扇区）读; 入7C00处，然后将控制权交给主引导代码。主引导代码的任务包括：; (1) 扫描分区表，找到一个激活(可引导)分区；; (2) 找到激活分区的起始扇区；; (3) 将激活分区的引导扇区装载到内存7C00处；; (4) 将控制权交给引导扇区代码；; ; 如果主引导代码无法完成上述任务，它将显示以下错误信息之一：; No active partition.; Invalid partition table.; Error loading operating system.; Missing operating system.;;====================================================================================; FAT16分区尺寸与LBA;====================================================================================; LBA HeadsPerCylinder SectorsPerTrack Maximum Size for Boot Partition; Disabled 64 32 1GB; Enabled 255 63 4GB;; 为了适应超过8G的硬盘，Windows2000忽略了Start CHS和End CHS，而使用StartLBA和TotalSector ; 来确定分区在整个磁盘中的位置和大小。; ;====================================================================================; 分区表项结构(16字节);====================================================================================;; typedef struct _PARTITION_ENTRY; {; UCHAR BootIndicator; // 能否启动标志; UCHAR StartHead; // 该分区起始磁头号; UCHAR StartSector; // 起始柱面号高2位：6位起始扇区号; UCHAR StartCylinder; // 起始柱面号低8位; UCHAR PartitionType; // 分区类型; UCHAR EndHead; // 该分区终止磁头号; UCHAR EndSector; // 终止柱面号高2位：6位终止扇区号; UCHAR EndCylinder; // 终止柱面号低8位; ULONG StartLBA; // 起始扇区号; ULONG TotalSector; // 分区尺寸（总扇区数）; }PARTITION_ENTRY,*PPARTITION_ENTRY;;;====================================================================================; 主引导记录(MBR)结构 ;====================================================================================; typedef struct _MASTER_BOOT_RECORD; {; UCHAR BootCode[446];; PARTITION_ENTRY Partition[4];; USHORT Signature;; }MASTER_BOOT_RECORD,*PMASTER_BOOT_RECORD;;;====================================================================================2.MBR详细分析 代码:code:7C00 code segment byte public 'CODE' use16code:7C00 assume cs:codecode:7C00 org 7C00hcode:7C00 assume es:nothing, ss:nothing, ds:code, fs:nothing, gs:nothingcode:7C00 start proc farcode:7C00 xor ax, axcode:7C02 mov ss, axcode:7C04 mov sp, 7C00hcode:7C07 sticode:7C08 push axcode:7C09 pop escode:7C0A push ax ; es=ds=ss=0x0000code:7C0B pop ds ; initial segment and stack code:7C0C cldcode:7C0D push axcode:7C0E mov si, 7C00hcode:7C11 mov di, 600h code:7C14 mov cx, 200h code:7C17 rep movsb ; move this MBR code to 600hcode:7C19 mov di, 61Eh code:7C1C push dicode:7C1D retf ; jmp 0000:61Ehcode:7C1E xor bx, bx ; ip=61Ehcode:7C20 xor dx, dxcode:7C22 mov si, 7BEh ; partition statecode:7C25 mov cl, 4 ; Search DPT,and it has 4 itemes,code:7C27 check_next_partition: code:7C27 test byte ptr [si], 80h ; 0x80->Active 0x00->not activecode:7C2A jz short search_active_partition ; next item, size of one item is 10hcode:7C2Acode:7C2C mov dx, si ; save item base addresscode:7C2E inc bx ; the sum of the active itemcode:7C2F search_active_partition: code:7C2F add si, 10h ; next item, size of one item is 10hcode:7C32 loop check_next_partition ; 0x80->Active 0x00->not activecode:7C34 cmp bx, 1code:7C37 jz short found_partition_activecode:7C39 mov si, 0C4h ; sz_Invalid_DPT Si=lpString (Offset)code:7C3C mov cx, 17h ; lengthcode:7C3F jmp short Display_Error_Informatin ; add base ipcode:7C41 nopcode:7C42 found_partition_active: code:7C42 push dxcode:7C43 mov ah, 41hcode:7C45 mov dl, 80hcode:7C47 mov bx, 55AAhcode:7C4A int 13h ; Detect sport extend int 13h callcode:7C4C pop dxcode:7C4D cmp bx, 0AA55hcode:7C51 jnz short CHSReadMBRFormDiskcode:7C53 test cl, 1code:7C56 jz short CHSReadMBRFormDiskcode:7C58 LBAReadMBRFormDisk:code:7C58 mov ax, 4200hcode:7C5B mov si, 7ADh code:7C5E mov cl, 10hcode:7C60 init_disk_addr_pkt: code:7C60 mov byte ptr [si], 0code:7C63 inc sicode:7C64 loop init_disk_addr_pktcode:7C66 mov si, 7ADhcode:7C69 mov di, dx ; dx point to active item base addresscode:7C6B mov byte ptr [si], 10h ; packet_size=16 (DB must)code:7C6E mov byte ptr [si+2], 1 ; sector_count 01h (DW)code:7C72 mov word ptr [si+4], 7C00h ; buffer_addr (DD)code:7C77 mov bx, [di+8] ; line address of sectors (DD RAV)code:7C7A mov [si+8], bx ; sector_base (QD)code:7C7D mov bx, [di+0Ah] ; line address of sectors + 2 (DD RAV)code:7C80 mov [si+0Ah], bx ; sector_base + 2 (QD)code:7C83 jmp short ReadDiskcode:7C85 nopcode:7C86 CHSReadMBRFormDisk: code:7C86 mov ax, 201h code:7C89 mov bx, 7C00h ; offset buffer_addr (DW)code:7C8C mov si, dx ; dx point to active item base addresscode:7C8E mov cx, [si+2] ; CH = track, CL = sectorcode:7C91 mov dh, [si+1] ; DH = headcode:7C94 ReadDisk: code:7C94 mov dl, 80hcode:7C96 int 13h AH = status, AL = number of sectors readcode:7C98 mov si, 7DFEhcode:7C9B cmp word ptr [si], 0AA55h ; chech is invalid MBRcode:7C9F jz short Load_OS_MBRcode:7CA1 mov si, 0DBhcode:7CA4 mov cx, 18hcode:7CA7 jmp short Display_Error_Informatin ; add base ipcode:7CA9 nopcode:7CAA Load_OS_MBR: code:7CAA xor ax, axcode:7CAC push axcode:7CAD mov ax, 7C00hcode:7CB0 push axcode:7CB1 retf ; jmp load os MBR code:7CB2 Display_Error_Informatin:code:7CB2 add si, 600h ; add base ipcode:7CB6 Display: code:7CB6 lodsb ; AL = charactercode:7CB7 mov bx, 7 ; BH = display page BL = foreground colorcode:7CBA mov ah, 0Ehcode:7CBC int 10h ; VIDEO - WRITE CHARACTER AND ADVANCE CURSORcode:7CBE loop Displaycode:7CC0 db 0B1hcode:7CC1 db 0Fhcode:7CC2 db 0E2h ; ?code:7CC3 db 0FCh ; ?code:7CC4 sz_Invalid_DPT db 'Invalid partition tableMissing operating system',0code:7CF4 sz_MBR_Information db 'Master Boot Record Wrote by DiskMan Ver1.30',0code:7D20 db 98h dup(0) ; not use spacecode:7DB8 s_Zmzm db 'ZmZm',0 ; not use data, can set any data if you likecode:7DBD db 0code:7DBE First_Item_DPT db 80h ; statuecode:7DBF db 1 ; 开始头code:7DC0 dw 1 ; 开始扇区code:7DC2 db 7 ; 分区类型指示code:7DC3 db 0FEh ; 结束头code:7DC4 dw 0CCFFh ; 结束扇code:7DC6 dd 3Fh ; 扇区在前的分区 1code:7DCA dd 0EE834Ehcode:7DCE Second_Item_DPT db 0 ; statuecode:7DCF db 0code:7DD0 dw 0CDC1hcode:7DD2 db 0Fhcode:7DD3 db 0FEh ; ?code:7DD4 dw 0FFFFhcode:7DD6 dd 0EE838Dhcode:7DDA dd 3BB47F9hcode:7DDE T_Item_DPT db 10h dup(0)code:7DEE F_Item_DPT db 10h dup(0)code:7DFE MBR_Flag db 55h ; Ucode:7DFF db 0AAh ; ?code:7DFF code endscode:7DFF end start 3.DBR详细分析 代码:code:7C00 ; File Name : D:\DBR.COMcode:7C00 ; Format : MS-DOS COM-filecode:7C00 ; Base Address: 1000h Range: 10100h-10300h Loaded length: 200hcode:7C00code:7C00 .686pcode:7C00 .mmxcode:7C00 .model tinycode:7C00code:7C00 ; ###########################################################################code:7C00code:7C00 ; Segment type: Pure codecode:7C00 code segment byte public 'CODE' use16code:7C00 assume cs:codecode:7C00 org 7C00hcode:7C00 assume es:nothing, ss:nothing, ds:code, fs:nothing, gs:nothingcode:7C00code:7C00 ; =============== S U B R O U T I N E =======================================code:7C00code:7C00 public startcode:7C00 start proc farcode:7C00 jmp short begincode:7C00code:7C02 ; ---------------------------------------------------------------------------code:7C02 nopcode:7C02code:7C02 ; ---------------------------------------------------------------------------code:7C03 sz_Ntfs db 'NTFS ',0code:7C0C db 2, 8, 7 dup(0), 0F8h, 2 dup(0), 3Fh, 0, 0FFh, 0, 3Fh, 7 dup(0), 80h, 0, 80h, 0, 4Dhcode:7C0C db 83h, 0EEh, 7 dup(0), 0Ch, 5 dup(0), 10h, 7 dup(0), 0F6h, 3 dup(0), 1, 3 dup(0), 61hcode:7C0C db 0F5h, 0B9h, 0B3h, 2Fh, 0F6h, 33h, 13h, 4 dup(0)code:7C54 ; ---------------------------------------------------------------------------code:7C54code:7C54 begin: code:7C54 clicode:7C55 xor ax, axcode:7C57 mov ss, axcode:7C59 mov sp, 7C00hcode:7C5C sticode:7C5D mov ax, 7C0h code:7C60 mov ds, axcode:7C62 assume ds:nothingcode:7C62 call GetCurrentDriveParamentscode:7C62code:7C65 mov ax, 0D00h code:7C68 mov es, axcode:7C6A xor bx, bxcode:7C6C mov byte ptr ds:0Eh, 10hcode:7C71 call ReadDiskSectorscode:7C71code:7C74 push 0D00h code:7C77 push 26Ah code:7C7A retfcode:7C7Acode:7C7A start endp code:7C7Acode:7C7B ; =============== S U B R O U T I N E =======================================code:7C7Bcode:7C7B GetCurrentDriveParaments proc near code:7C7B mov dl, ds:24h ; DL = drive number,Why must use ds:24h Memory?code:7C7F mov ah, 8code:7C81 int 13hcode:7C83 jnb short success code:7C83code:7C85 mov cx, 0FFFFhcode:7C88 mov dh, clcode:7C88code:7C8A success: code:7C8A movzx eax, dh ; why now can use 'EAX' register,but it in use 16?code:7C8E inc axcode:7C8F movzx edx, cl code:7C93 and dl, 3Fhcode:7C96 mul dxcode:7C98 xchg cl, chcode:7C9A shr ch, 6code:7C9D inc cxcode:7C9E movzx ecx, cxcode:7CA2 mul ecxcode:7CA5 mov ds:20h, eaxcode:7CA9 retncode:7CA9code:7CA9 GetCurrentDriveParaments endpcode:7CA9code:7CAA ; =============== S U B R O U T I N E =======================================code:7CAAcode:7CAA CheckExtenInt13 proc near code:7CAA mov ah, 41hcode:7CAC mov bx, 55AAhcode:7CAF mov dl, ds:24hcode:7CB3 int 13hcode:7CB5 jb short exitcode:7CB5code:7CB7 cmp bx, 0AA55hcode:7CBB jnz short exitcode:7CBBcode:7CBD test cl, 1code:7CC0 jz short exitcode:7CC0code:7CC2 inc byte ptr ds:14h ; set a flagecode:7CC6 exit: code:7CC6 retncode:7CC6code:7CC6 CheckExtenInt13 endpcode:7CC6code:7CC7 ; =============== S U B R O U T I N E =======================================code:7CC7code:7CC7 ReadDiskSectors proc near code:7CC7 pushadcode:7CC9 push dscode:7CCA push escode:7CCB continue_work: code:7CCB mov eax, ds:10hcode:7CCF add eax, ds:1Chcode:7CD4 cmp eax, ds:20hcode:7CD9 jb read_disk_sectorscode:7CD9code:7CDD push dscode:7CDE push large 0code:7CE1 push eaxcode:7CE3 push escode:7CE4 push bxcode:7CE5 push large 10010hcode:7CEB cmp byte ptr ds:14h, 0 ; check a flagecode:7CF0 jnz continuecode:7CF0code:7CF4 call CheckExtenInt13code:7CF4code:7CF7 cmp byte ptr ds:14h, 0 ; check a flagecode:7CFC jz cant_continuecode:7D00 continue: code:7D00 mov ah, 42hcode:7D02 mov dl, ds:24hcode:7D06 push sscode:7D07 pop dscode:7D08 mov si, spcode:7D0A int 13hcode:7D0C pop eaxcode:7D0E pop bxcode:7D0F pop escode:7D10 pop eaxcode:7D12 pop eaxcode:7D14 pop dscode:7D15 jmp short exitcode:7D15code:7D17 ; ---------------------------------------------------------------------------code:7D17 read_disk_sectors: code:7D17 xor edx, edxcode:7D1A movzx ecx, word ptr ds:18hcode:7D20 div ecxcode:7D23 inc dlcode:7D25 mov cl, dlcode:7D27 mov edx, eaxcode:7D2A shr edx, 10hcode:7D2E div word ptr ds:1Ahcode:7D32 xchg dl, dh ; DH = headcode:7D34 mov dl, ds:24h ; ES:BX -> buffer to fillcode:7D38 mov ch, al ; CH = trackcode:7D3A shl ah, 6 ; DL = drivecode:7D3D or cl, ah ; CL = sectorcode:7D3F mov ax, 201h ; AL = number of sectors to readcode:7D42 int 13hcode:7D42code:7D44 exit: code:7D44 jb cant_continuecode:7D44code:7D48 mov ax, escode:7D4A add ax, 20hcode:7D4D mov es, axcode:7D4F inc dword ptr ds:10hcode:7D54 dec word ptr ds:0Ehcode:7D58 jnz continue_workcode:7D58code:7D5C pop escode:7D5D pop dscode:7D5E popadcode:7D60 retncode:7D60code:7D61 ; ---------------------------------------------------------------------------code:7D61code:7D61 cant_continue: code:7D61 code:7D61 mov al, ds:1F8hcode:7D64 call PrintErrorMessagecode:7D64code:7D67 mov al, ds:1FBhcode:7D6A call PrintErrorMessagecode:7D6Acode:7D6D sticode:7D6Dcode:7D6E no_end: code:7D6E jmp short no_endcode:7D6Ecode:7D6E ReadDiskSectors endpcode:7D6Ecode:7D70 ; =============== S U B R O U T I N E =======================================code:7D70code:7D70 PrintErrorMessage proc near code:7D70 code:7D70 mov ah, 1code:7D72 mov si, axcode:7D72code:7D74code:7D74 continue: code:7D74 lodsbcode:7D75 cmp al, 0code:7D77 jz short exitcode:7D77code:7D79 mov ah, 0Ehcode:7D7B mov bx, 7code:7D7E int 10h code:7D7E code:7D80 jmp short continuecode:7D80code:7D82 ; ---------------------------------------------------------------------------code:7D82 exit: code:7D82 retncode:7D82code:7D82 PrintErrorMessage endpcode:7D82code:7D82 ; ---------------------------------------------------------------------------code:7D83 db 0Dh, 0Ahcode:7D85 sz_DiskReadError db 'A disk read error occurred',0code:7DA0 db 0Dh, 0Ahcode:7DA2 sz_NtldrIsMissing db 'NTLDR is missing',0code:7DB3 db 0Dh, 0Ahcode:7DB5 sz_NtldrIsCompressed db 'NTLDR is compressed',0code:7DC9 db 0Dh, 0Ahcode:7DCB sz_PressCtrlAltDel db 'Press Ctrl+Alt+Del to restart',0Dh,0Ah,0code:7DEB db 0Dh dup(0), 83h, 0A0h, 0B3h, 0C9h, 2 dup(0), 55h, 0AAhcode:7DEB code endscode:7DEBcode:7DEB end start |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
