본문 바로가기

hacking sorcerer

MBR 어셈블리어와 간단한 해석 02

728x90
반응형

하나보다 더 많은 경우가 나왔습니다. 어떻게 할까요?

0000:063A mov al, [07B5]

해석 : 부팅가능한 엔트리를 하나를 초과하여 찾은 경우 “Invalid partition table”를 출력합니다.

 

여러 에러 메시지

0000:063D mov ah, 07

0000:063F mov si, ax

 

0000:0641 lodsb

0000:0642 cmp al, 00

0000:0644 je 0642

0000:0646 mov bx, 0007

0000:0649 mov ah, 0E

0000:064B int 10

(중략)

0000:064F mov [bp+10], cl

0000:0652 call 069B

0000:0055 jnb 0681

---------------------------------------------------------------------------

0000:0657 inc byte ptr [bp+10]

0000:065A cmp byte ptr [bp+04], 0B

0000:065E je 066B

0000:0660 cmp byte prt [bp+04], 0C

0000:0664 je 066B

0000:0666 mov al, [07B6]

0000:0669 jne 063D

---------------------------------------------------------------------------

0000:066B add byte ptr [bp+02], 06

0000:066F add word ptr [bp+08], 0006

0000:0673 adc word ptr [bp+0A], 0000

0000:0677 call 069B

0000:067A jnb 0681

0000:067C mov al, [07B6]

0000:067F jmp 063D

해석 : Outputting error messages for each situation.

 

시그니처 값 확인

0000:0681 cmp word ptr [7DFE], AA55 ;시그니처 값 확인

0000:0687 je 0694 ;확인되었으면 0694로 점프

0000:0689 cmp byte ptr [bp+10], 00

0000:068D je 0657

0000:068F mov al, [07B7]

0000:0692 jmp 063D ;"Missing operating system" 출력

해석 : Verifying that the AA 55 value is correct. If correct, jump to 0694. However, if it does not match, output "Missing operationg system".

 

CHS 주소값, LBA 주소값

0000:069B mov di, 0005

0000:069E mov dl, [bp+00]

0000:06A1 mov ah, 08

0000:06A3 int 13

(중략)

0000:06A7 mov al, cl

0000:06A9 and al, 3F

0000:06AB cbw

0000:06AC mov bl, dh

0000:06AE mov bh, ah

0000:06B0 inc bx

0000:06B1 mul bx

0000:06B3 mov dx, cx

0000:06B5 xchg dh, dl

0000:06B7 mov cl, 06

0000:06B9 shr dh, cl

0000:06BB inc dx

0000:06BC mul dx

0000:06BE cmp [bp+0A], dx

0000:06C1 ja 06E6

0000:06C3 jb 06CA

0000:06C5 cmp [bp+08], ax

0000:06C8 jnb 06E6

 

해석 : Quarterly statements are divided according to whether you use a CHS address or an LBA address. These days, CHS addresses do not have much meaning, so we will use LBA addresses.

출처 : Me
728x90
반응형