系统2K PRO SP4,C盘采用NTFS,用WinHex提取MBR和DBR,拿IDA分析的.关键在DBR几处不明白.
1.一点预备知识:
主引导扇区代码（MBR）
2.MBR详细分析
1.一点预备知识:
主引导扇区代码（MBR）
代码:
;====================================================================================
;
; MBR( Master Boot Record )主引导记录包含两部分的内容，前446字节为启动代码及数据，而
; 从446(0x1BE)开始则是分区表，分区表由四个分区项组成，每个分区项数据为16字节，记录了
; 启动时需要的分区参数。
;
; 在CPU上电之后，若由硬盘启动，则BIOS将硬盘的主引导记录（位于0柱面、0磁道、1扇区）读
; 入7C00处，然后将控制权交给主引导代码。主引导代码的任务包括：
; (1) 扫描分区表，找到一个激活(可引导)分区；
; (2) 找到激活分区的起始扇区；
; (3) 将激活分区的引导扇区装载到内存7C00处；
; (4) 将控制权交给引导扇区代码；
;
; 如果主引导代码无法完成上述任务，它将显示以下错误信息之一：
; No active partition.
; Invalid partition table.
; Error loading operating system.
; Missing operating system.
;
;====================================================================================
; FAT16分区尺寸与LBA
;====================================================================================
; LBA HeadsPerCylinder SectorsPerTrack Maximum Size for Boot Partition
; Disabled 64 32 1GB
; Enabled 255 63 4GB
;
; 为了适应超过8G的硬盘，Windows2000忽略了Start CHS和End CHS，而使用StartLBA和TotalSector
; 来确定分区在整个磁盘中的位置和大小。
;
;====================================================================================
; 分区表项结构(16字节)
;====================================================================================
;
; typedef struct _PARTITION_ENTRY
; {
; UCHAR BootIndicator; // 能否启动标志
; UCHAR StartHead; // 该分区起始磁头号
; UCHAR StartSector; // 起始柱面号高2位：6位起始扇区号
; UCHAR StartCylinder; // 起始柱面号低8位
; UCHAR PartitionType; // 分区类型
; UCHAR EndHead; // 该分区终止磁头号
; UCHAR EndSector; // 终止柱面号高2位：6位终止扇区号
; UCHAR EndCylinder; // 终止柱面号低8位
; ULONG StartLBA; // 起始扇区号
; ULONG TotalSector; // 分区尺寸（总扇区数）
; }PARTITION_ENTRY,*PPARTITION_ENTRY;
;
;====================================================================================
; 主引导记录(MBR)结构
;====================================================================================
; typedef struct _MASTER_BOOT_RECORD
; {
; UCHAR BootCode[446];
; PARTITION_ENTRY Partition[4];
; USHORT Signature;
; }MASTER_BOOT_RECORD,*PMASTER_BOOT_RECORD;
;
;====================================================================================
代码:
code:7C00 code segment byte public 'CODE' use16 code:7C00 assume cs:code code:7C00 org 7C00h code:7C00 assume es:nothing, ss:nothing, ds:code, fs:nothing, gs:nothing code:7C00 start proc far code:7C00 xor ax, ax code:7C02 mov ss, ax code:7C04 mov sp, 7C00h code:7C07 sti code:7C08 push ax code:7C09 pop es code:7C0A push ax ; es=ds=ss=0x0000 code:7C0B pop ds ; initial segment and stack code:7C0C cld code:7C0D push ax code:7C0E mov si, 7C00h code:7C11 mov di, 600h code:7C14 mov cx, 200h code:7C17 rep movsb ; move this MBR code to 600h code:7C19 mov di, 61Eh code:7C1C push di code:7C1D retf ; jmp 0000:61Eh code:7C1E xor bx, bx ; ip=61Eh code:7C20 xor dx, dx code:7C22 mov si, 7BEh ; partition state code:7C25 mov cl, 4 ; Search DPT,and it has 4 itemes, code:7C27 check_next_partition: code:7C27 test byte ptr [si], 80h ; 0x80->Active 0x00->not active code:7C2A jz short search_active_partition ; next item, size of one item is 10h code:7C2A code:7C2C mov dx, si ; save item base address code:7C2E inc bx ; the sum of the active item code:7C2F search_active_partition: code:7C2F add si, 10h ; next item, size of one item is 10h code:7C32 loop check_next_partition ; 0x80->Active 0x00->not active code:7C34 cmp bx, 1 code:7C37 jz short found_partition_active code:7C39 mov si, 0C4h ; sz_Invalid_DPT Si=lpString (Offset) code:7C3C mov cx, 17h ; length code:7C3F jmp short Display_Error_Informatin ; add base ip code:7C41 nop code:7C42 found_partition_active: code:7C42 push dx code:7C43 mov ah, 41h code:7C45 mov dl, 80h code:7C47 mov bx, 55AAh code:7C4A int 13h ; Detect sport extend int 13h call code:7C4C pop dx code:7C4D cmp bx, 0AA55h code:7C51 jnz short CHSReadMBRFormDisk code:7C53 test cl, 1 code:7C56 jz short CHSReadMBRFormDisk code:7C58 LBAReadMBRFormDisk: code:7C58 mov ax, 4200h code:7C5B mov si, 7ADh code:7C5E mov cl, 10h code:7C60 init_disk_addr_pkt: code:7C60 mov byte ptr [si], 0 code:7C63 inc si code:7C64 loop init_disk_addr_pkt code:7C66 mov si, 7ADh code:7C69 mov di, dx ; dx point to active item base address code:7C6B mov byte ptr [si], 10h ; packet_size=16 (DB must) code:7C6E mov byte ptr [si+2], 1 ; sector_count 01h (DW) code:7C72 mov word ptr [si+4], 7C00h ; buffer_addr (DD) code:7C77 mov bx, [di+8] ; line address of sectors (DD RAV) code:7C7A mov [si+8], bx ; sector_base (QD) code:7C7D mov bx, [di+0Ah] ; line address of sectors + 2 (DD RAV) code:7C80 mov [si+0Ah], bx ; sector_base + 2 (QD) code:7C83 jmp short ReadDisk code:7C85 nop code:7C86 CHSReadMBRFormDisk: code:7C86 mov ax, 201h code:7C89 mov bx, 7C00h ; offset buffer_addr (DW) code:7C8C mov si, dx ; dx point to active item base address code:7C8E mov cx, [si+2] ; CH = track, CL = sector code:7C91 mov dh, [si+1] ; DH = head code:7C94 ReadDisk: code:7C94 mov dl, 80h code:7C96 int 13h AH = status, AL = number of sectors read code:7C98 mov si, 7DFEh code:7C9B cmp word ptr [si], 0AA55h ; chech is invalid MBR code:7C9F jz short Load_OS_MBR code:7CA1 mov si, 0DBh code:7CA4 mov cx, 18h code:7CA7 jmp short Display_Error_Informatin ; add base ip code:7CA9 nop code:7CAA Load_OS_MBR: code:7CAA xor ax, ax code:7CAC push ax code:7CAD mov ax, 7C00h code:7CB0 push ax code:7CB1 retf ; jmp load os MBR code:7CB2 Display_Error_Informatin: code:7CB2 add si, 600h ; add base ip code:7CB6 Display: code:7CB6 lodsb ; AL = character code:7CB7 mov bx, 7 ; BH = display page BL = foreground color code:7CBA mov ah, 0Eh code:7CBC int 10h ; VIDEO - WRITE CHARACTER AND ADVANCE CURSOR code:7CBE loop Display code:7CC0 db 0B1h code:7CC1 db 0Fh code:7CC2 db 0E2h ; ? code:7CC3 db 0FCh ; ? code:7CC4 sz_Invalid_DPT db 'Invalid partition tableMissing operating system',0 code:7CF4 sz_MBR_Information db 'Master Boot Record Wrote by DiskMan Ver1.30',0 code:7D20 db 98h dup(0) ; not use space code:7DB8 s_Zmzm db 'ZmZm',0 ; not use data, can set any data if you like code:7DBD db 0 code:7DBE First_Item_DPT db 80h ; statue code:7DBF db 1 ; 开始头 code:7DC0 dw 1 ; 开始扇区 code:7DC2 db 7 ; 分区类型指示 code:7DC3 db 0FEh ; 结束头 code:7DC4 dw 0CCFFh ; 结束扇 code:7DC6 dd 3Fh ; 扇区在前的分区 1 code:7DCA dd 0EE834Eh code:7DCE Second_Item_DPT db 0 ; statue code:7DCF db 0 code:7DD0 dw 0CDC1h code:7DD2 db 0Fh code:7DD3 db 0FEh ; ? code:7DD4 dw 0FFFFh code:7DD6 dd 0EE838Dh code:7DDA dd 3BB47F9h code:7DDE T_Item_DPT db 10h dup(0) code:7DEE F_Item_DPT db 10h dup(0) code:7DFE MBR_Flag db 55h ; U code:7DFF db 0AAh ; ? code:7DFF code ends code:7DFF end start
|
3.DBR详细分析
代码:
code:7C00 ; File Name : D:/DBR.COM code:7C00 ; Format : MS-DOS COM-file code:7C00 ; Base Address: 1000h Range: 10100h-10300h Loaded length: 200h code:7C00 code:7C00 .686p code:7C00 .mmx code:7C00 .model tiny code:7C00 code:7C00 ; ########################################################################### code:7C00 code:7C00 ; Segment type: Pure code code:7C00 code segment byte public 'CODE' use16 code:7C00 assume cs:code code:7C00 org 7C00h code:7C00 assume es:nothing, ss:nothing, ds:code, fs:nothing, gs:nothing code:7C00 code:7C00 ; =============== S U B R O U T I N E ======================================= code:7C00 code:7C00 public start code:7C00 start proc far code:7C00 jmp short begin code:7C00 code:7C02 ; --------------------------------------------------------------------------- code:7C02 nop code:7C02 code:7C02 ; --------------------------------------------------------------------------- code:7C03 sz_Ntfs db 'NTFS ',0 code:7C0C db 2, 8, 7 dup(0), 0F8h, 2 dup(0), 3Fh, 0, 0FFh, 0, 3Fh, 7 dup(0), 80h, 0, 80h, 0, 4Dh code:7C0C db 83h, 0EEh, 7 dup(0), 0Ch, 5 dup(0), 10h, 7 dup(0), 0F6h, 3 dup(0), 1, 3 dup(0), 61h code:7C0C db 0F5h, 0B9h, 0B3h, 2Fh, 0F6h, 33h, 13h, 4 dup(0) code:7C54 ; --------------------------------------------------------------------------- code:7C54 code:7C54 begin: code:7C54 cli code:7C55 xor ax, ax code:7C57 mov ss, ax code:7C59 mov sp, 7C00h code:7C5C sti code:7C5D mov ax, 7C0h code:7C60 mov ds, ax code:7C62 assume ds:nothing code:7C62 call GetCurrentDriveParaments code:7C62 code:7C65 mov ax, 0D00h code:7C68 mov es, ax code:7C6A xor bx, bx code:7C6C mov byte ptr ds:0Eh, 10h code:7C71 call ReadDiskSectors code:7C71 code:7C74 push 0D00h code:7C77 push 26Ah code:7C7A retf code:7C7A code:7C7A start endp code:7C7A code:7C7B ; =============== S U B R O U T I N E ======================================= code:7C7B code:7C7B GetCurrentDriveParaments proc near code:7C7B mov dl, ds:24h ; DL = drive number,Why must use ds:24h Memory? code:7C7F mov ah, 8 code:7C81 int 13h code:7C83 jnb short success code:7C83 code:7C85 mov cx, 0FFFFh code:7C88 mov dh, cl code:7C88 code:7C8A success: code:7C8A movzx eax, dh ; why now can use 'EAX' register,but it in use 16? code:7C8E inc ax code:7C8F movzx edx, cl code:7C93 and dl, 3Fh code:7C96 mul dx code:7C98 xchg cl, ch code:7C9A shr ch, 6 code:7C9D inc cx code:7C9E movzx ecx, cx code:7CA2 mul ecx code:7CA5 mov ds:20h, eax code:7CA9 retn code:7CA9 code:7CA9 GetCurrentDriveParaments endp code:7CA9 code:7CAA ; =============== S U B R O U T I N E ======================================= code:7CAA code:7CAA CheckExtenInt13 proc near code:7CAA mov ah, 41h code:7CAC mov bx, 55AAh code:7CAF mov dl, ds:24h code:7CB3 int 13h code:7CB5 jb short exit code:7CB5 code:7CB7 cmp bx, 0AA55h code:7CBB jnz short exit code:7CBB code:7CBD test cl, 1 code:7CC0 jz short exit code:7CC0 code:7CC2 inc byte ptr ds:14h ; set a flage code:7CC6 exit: code:7CC6 retn code:7CC6 code:7CC6 CheckExtenInt13 endp code:7CC6 code:7CC7 ; =============== S U B R O U T I N E ======================================= code:7CC7 code:7CC7 ReadDiskSectors proc near code:7CC7 pushad code:7CC9 push ds code:7CCA push es code:7CCB continue_work: code:7CCB mov eax, ds:10h code:7CCF add eax, ds:1Ch code:7CD4 cmp eax, ds:20h code:7CD9 jb read_disk_sectors code:7CD9 code:7CDD push ds code:7CDE push large 0 code:7CE1 push eax code:7CE3 push es code:7CE4 push bx code:7CE5 push large 10010h code:7CEB cmp byte ptr ds:14h, 0 ; check a flage code:7CF0 jnz continue code:7CF0 code:7CF4 call CheckExtenInt13 code:7CF4 code:7CF7 cmp byte ptr ds:14h, 0 ; check a flage code:7CFC jz cant_continue code:7D00 continue: code:7D00 mov ah, 42h code:7D02 mov dl, ds:24h code:7D06 push ss code:7D07 pop ds code:7D08 mov si, sp code:7D0A int 13h code:7D0C pop eax code:7D0E pop bx code:7D0F pop es code:7D10 pop eax code:7D12 pop eax code:7D14 pop ds code:7D15 jmp short exit code:7D15 code:7D17 ; --------------------------------------------------------------------------- code:7D17 read_disk_sectors: code:7D17 xor edx, edx code:7D1A movzx ecx, word ptr ds:18h code:7D20 div ecx code:7D23 inc dl code:7D25 mov cl, dl code:7D27 mov edx, eax code:7D2A shr edx, 10h code:7D2E div word ptr ds:1Ah code:7D32 xchg dl, dh ; DH = head code:7D34 mov dl, ds:24h ; ES:BX -> buffer to fill code:7D38 mov ch, al ; CH = track code:7D3A shl ah, 6 ; DL = drive code:7D3D or cl, ah ; CL = sector code:7D3F mov ax, 201h ; AL = number of sectors to read code:7D42 int 13h code:7D42 code:7D44 exit: code:7D44 jb cant_continue code:7D44 code:7D48 mov ax, es code:7D4A add ax, 20h code:7D4D mov es, ax code:7D4F inc dword ptr ds:10h code:7D54 dec word ptr ds:0Eh code:7D58 jnz continue_work code:7D58 code:7D5C pop es code:7D5D pop ds code:7D5E popad code:7D60 retn code:7D60 code:7D61 ; --------------------------------------------------------------------------- code:7D61 code:7D61 cant_continue: code:7D61 code:7D61 mov al, ds:1F8h code:7D64 call PrintErrorMessage code:7D64 code:7D67 mov al, ds:1FBh code:7D6A call PrintErrorMessage code:7D6A code:7D6D sti code:7D6D code:7D6E no_end: code:7D6E jmp short no_end code:7D6E code:7D6E ReadDiskSectors endp code:7D6E code:7D70 ; =============== S U B R O U T I N E ======================================= code:7D70 code:7D70 PrintErrorMessage proc near code:7D70 code:7D70 mov ah, 1 code:7D72 mov si, ax code:7D72 code:7D74 code:7D74 continue: code:7D74 lodsb code:7D75 cmp al, 0 code:7D77 jz short exit code:7D77 code:7D79 mov ah, 0Eh code:7D7B mov bx, 7 code:7D7E int 10h code:7D7E code:7D80 jmp short continue code:7D80 code:7D82 ; --------------------------------------------------------------------------- code:7D82 exit: code:7D82 retn code:7D82 code:7D82 PrintErrorMessage endp code:7D82 code:7D82 ; --------------------------------------------------------------------------- code:7D83 db 0Dh, 0Ah code:7D85 sz_DiskReadError db 'A disk read error occurred',0 code:7DA0 db 0Dh, 0Ah code:7DA2 sz_NtldrIsMissing db 'NTLDR is missing',0 code:7DB3 db 0Dh, 0Ah code:7DB5 sz_NtldrIsCompressed db 'NTLDR is compressed',0 code:7DC9 db 0Dh, 0Ah code:7DCB sz_PressCtrlAltDel db 'Press Ctrl+Alt+Del to restart',0Dh,0Ah,0 code:7DEB db 0Dh dup(0), 83h, 0A0h, 0B3h, 0C9h, 2 dup(0), 55h, 0AAh code:7DEB code ends code:7DEB code:7DEB end start |
1221
扫一扫
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
