win95.asm

部分常用系统的引导程序

; - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
;
; Description:  Heroic attempt to disassemble the Windows 95 Boot Sector.
; Date:         16. Aug. 1998
; Author:       Mr. X
; Email:        unknown
; Comment:      This boot code is messy.
; Status:       PART I, II and III are now pretty much done.
; Important:    "SHLD EDX,EAX,16" This is a Microsoft Patent.
;               Also take a look at the "list near EOF"
;
; ---> CUT HERE IF YOU LIKE TO LISTEN TO ME <---
;
; This file will assemble into a fully functional (I hope) Win95B boot code.
;
;  tasm win95 /m
;  tlink win95,win95.bin /t
;
; Ask someone for the proper dropper code...
; - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
;
; AFTER DISASSEMBLY I have this impression:
;
;  This is what Bill Gates said... when Win95 was going to be released:
;
;  "Gates: OK, then we're ready to press the CD's and start shipping out 
;   this new load of shit, but of course nobody will notice... harr harr.
;   Employee: Hey, Mr. Gates what about the Boot Sector?? We haven't 
;   written the FAT32 support routines there yet...
;   Gates: Ah, that's right... anybody?? We have just 45 minutes...
;   Employee #2: Well, I think I can hack some shit together...
;   Gates: Fine, go for it... remember you have only 44 minutes...
;   Employee #2: I think I can do it.
;   Gates: Fine, then I'll just go home... We've made it!!"
;
; FUNNY?
;
; There is some really strange code in this boot record....
;
; I bet Bill Gates hired some crazy mother fucker to write this shit.
; It seems like he had really tried to make the code fit within one sector.
; But when it didn't hid just decided to use three instead...
;
; This is a typical microsoft solution, they mix stupid 8086 code... with
; cheap solutions and then suddenly they use 386 code...
;
; And then there is the new FAT32 data structures where they have moved
; the volume label, FileSystem ID and serial number down to make room for
; some extended FAT32 variables... it sucks. Why not rearange the whole
; structure... An OS would not try to interpret the shit anyway, because
; the Partitioni Table SYSID has changed with FAT32.
;
; As I said... crazy mother fucker...
;
; Well, well... here's some of the stuff... with a mix of mine and sourcer's
; comments...
;
; Another thing about TASM, which I use, of course I didn't buy it... I'm
; have a shareware version ;) on a 30 year trial period.
;
; Back to what I was about to say again... When I use the brXXXX variables
; in indexing with BP, TASM generates 16-bit offset in operands even when
; they are less than 128... the Win95 code uses byte offsets (I'm not sure
; if I'm expressing myself clear here). When I changed the code from:
;
; mov AX,[bp+brHPC] to mov AX,[bp+128], TASM did use the byte offset form...
; This made my code a little less readable... but the comments should give
; you an idea of what data is being accessed.
;
; Basically this boot sector code is 32 bit extension for a 16 bit patch to
; an 8 bit boot sector originally coded for a 4 bit microprocessor, written
; by a 2 bit company, that can't stand 1 bit of competition.
;
; ---> CUT HERE IF YOU DOES NOT LIKE TO LISTEN TO ME <---

.386C

CODE            SEGMENT USE16

                ASSUME  CS:CODE, DS:CODE, SS:NOTHING

; BOOT RECORD - PART I - MAIN BOOT SECTOR CODE

; Just so I've said it - ASM opcodes are only readable when capitalized,
; but I forgot to set the option in sourcer... so I wrote a small TP program
; that capitalized everything but what's after the semicolon...

Win95b          PROC    FAR

                JMP     SkipData        ; 0000h

brINT13Flag     DB      90H             ; 0002h - 0EH for INT13 AH=42 READ
brOEM           DB      'MSWIN4.1'      ; 0003h - OEM ID - Windows 95B
brBPS           DW      512             ; 000Bh - Bytes per sector
brSPC           DB      8               ; 000Dh - Sector per cluster
brResCount      DW      32              ; 000Eh - Reserved sectors
brFATs          DB      2               ; 0010h - FAT copies
brRootEntries   DW      0               ; 0011h - Root directory entries
brSectorCount   DW      0               ; 0013h - Sectors in volume, < 32MB
brMedia         DB      0F8H            ; 0015h - Media descriptor
brSPF           DW      0               ; 0016h - Sectors per FAT
brSPH           DW      63              ; 0018h - Sectors per head/track
brHPC           DW      128             ; 001Ah - Heads per cylinder
brHidden        DD      63              ; 001Ch - Hidden sectors
brSectors       DD      6305985         ; 0020h - Total number of sectors
brSPF32         DD      6153            ; 0024h - Sector per FAT (FAT32)
brFlags         DW      0               ; 0028h - Flags (FAT32)
brVersion       DW      0               ; 002Ah - FS Version (FAT32)
brRootCluster   DD      2               ; 002Ch - Root start cluster (FAT32)
brFSInfoSector  DW      1               ; 0030h - FS Info Sector (FAT32)
brBackupBoot    DW      6               ; 0032h - Backup Boot Record
brReserved      DB      6 DUP (0)       ; 0038h - Reserved
brShitter       DB      6 DUP (0)       ; 003Bh - Unused filler??
brDrive         DB      80H             ; 0040h - BIOS drive number
brHeadTemp      DB      00H             ; 0041h - Head/temp number????
brSignature     DB      29H             ; 0042h - Extended Boot Record sig.
brSerialNum     DD      404418EAH       ; 0043h - Volume serial number
brLabel         DB      'HARDDISK   '   ; 0047h - Volume label
brFSID          DB      'FAT32   '      ; 0052h - File System ID

SkipData:
                CLI
                XOR     CX,CX
                MOV     SS,CX                   ; SS=CX=0

        ; Set up stack 8 bytes below us, do you know why???
        ; Yes, it's because somewhere in this code, the shitter who
        ; wrote this... save the start of data area DWORD at 7C00H - 4 and
        ; the value -1 at 7C00H - 8... cool?

                MOV     SP,7C00H - 8            
                MOV     ES,CX                   ; ES=CX=0
                MOV     BP,78H                  

        ; Point DS:SI to INT 1E - DISKETTE PARAMS structure...

                LDS     SI,DWORD PTR SS:[BP]

		PUSH	DS
		PUSH	SI
		PUSH	SS
		PUSH	BP

                MOV     DI,522H

                MOV     SS:[BP],DI                 ; setup our INT 1E
                MOV     SS:[BP+2],CX

        ; copy 11 bytes from old diskette parameter table into
        ; es:522h, that is 0000:0522 or 0050:0022 - into the PrtScr/DOS area.
        ; I assume that 0001-0021 is used for something else 0050:0000 I know
        ; is the PrtScr flag byte.

                MOV     CL,11
                CLD
                REP     MOVSB
                                        
                MOV     DS,CX                   ; DS=CX=0

                MOV     BP,7C00H                ; point BP to start of us

                MOV     BYTE PTR [DI-2],0FH     ; modify head settle time

                MOV     AX,SS:[BP+18H]

                MOV     [DI-7],AL               ; modify sectors per track

        ; compare drive number with 0...
        ; if greater than or equal... go to MBRReadError
        ; I guess that lower than zero... must be -1 .. -128 (80H..FFH)
        ; Which would mean Harddisk boot...

                CMP     SS:[BP+40H],CL          ; Boot from diskette?
                JGE     MBRReadError

                MOV     AX,CX                   ; AX=CX=0
                CWD                             ; DX=AX[15]-> (ZerO)

                MOV     BX,0700H                ; Use 0000:0700 for sector
                                                ; read buffer

                CALL    ReadSector              ; load Master Boot Record
                JC      MBRReadError            ; error?

                SUB     BX,58                   ; BX = 08C6h (700h - 3Ah)
                                                ; point to "start" field
                             
                MOV     EAX,DS:[7C1CH]          ; load hidden sectors
CheckMBR:
                CMP     EAX,[BX]                ; Is this our entry??

                MOV     DL,[BX-4]               ; Put System ID in DL

                JNZ     NotOurs                 ; Jump if not our entry

        ; If system ID or "partition type", is 0Ch or 0Eh, ReadSector
        ; will use INT13/42H...

                OR      DL,2                    ; set bit 1, to allow for
                                                ; types 0Ch or 0Eh to be
                                                ; thought of as both 0Eh.

                MOV     SS:[BP+2],DL            ; set brINT13Flag
NotOurs:
                ADD     BL,16                   ; skip to next entry...
                JNB     CheckMBR                ; More entries?
MBRReadError:
                MOV     DI,2

        ; FAT32 - Is sector per FAT zero?

                CMP     WORD PTR SS:[BP+16H],0
                JNE     ShowErrMsg1

        ; Put number of hidden sectors in DX:AX

                MOV     AX,WORD PTR SS:[BP+1CH]
                MOV     DX,WORD PTR SS:[BP+1EH]

                MOV     CX,3    ; Boot Record is 3 sectors...

        ; Start loading reminder of Boot Record for FAT32
LoadIt:
                DEC     CX
                INC     AX                      ; next Boot Record sector

                JNZ     Skipper                 ; AX wrap-around?
                INC     DX                      ; Yes, inc DX too
Skipper:
                MOV     BX,7E00H                ; into 0000:7E00

                CALL    ReadSectorX             ; Read Sector
                JNC     ReadOK                  ; no error?

                MOV     AL,0F8H                 ; what's this????

		DEC	DI
                JZ      NoMore                  ; Jump if no more sectors

                MOV     AX,SS:[BP+32H]          ; get backup boot sector
                XOR     DX,DX                   

                MOV     CX,3                    
                CMP     CX,AX                   ; compare backup BS num
                JA      ShowErrMsg1             ; with 3 (or vice versa)

                                                ; if 3 is higher than
                                                ; backup sector number,
                                                ; Bill's oooutta here...

                MOV     SI,SS:[BP+0EH]          ; SI = # of reserved sectors
                CMP     CX,SI
                JAE     ShowErrMsg1             ; same thing here... if 3 is
                                                ; higher then the number of
                                                ; reserved sectors... Bill's
                                                ; gone

                SUB     SI,CX                   ; get number reserved sectors
                                                ; excluding the three boot
                                                ; sectors...

        ; add number of hidden sectors to DX:AX

                ADD     AX,WORD PTR SS:[BP+1CH]
                ADC     DX,WORD PTR SS:[BP+1EH]

                JMP     LoadIt
NoMore:
                JNC     ShowErrMsg1             ; Jump if carry=0
                JMP     ShowErrMsg2
ReadOK:
                CMP     WORD PTR SS:[BP+2AH],0
                JA      ShowErrMsg1             ; Jump if not version 0.0?

                JMP     GOFAT32
ShowErrMsg1:
                MOV     SI,OFFSET ErrMsg1 + 7C00H
PrintMessage:
                LODSB                           ; get msg Skip length

                CBW
                ADD     SI,AX                   ; Skip control data
NextChar:
                LODSB                           ; get chacacter

		TEST	AL,AL
                JZ      LastChar                ; End of string?

                CMP     AL,-1
                JE      SkipChar                ; End of first part?

                MOV     AH,0EH                  ; TTY write character
                MOV     BX,7
                INT     10H

                JMP     NextChar                ; repeat write...
SkipChar:
                MOV     SI,OFFSET ErrMsg4 + 7C00H       ; point to tail message
                JMP     PrintMessage