flat assembler
Message board for the users of flat assembler.

Index > OS Construction > More Protected/Unreal Mode...

Author
Thread Post new topic Reply to topic
bitRAKE



Joined: 21 Jul 2003
Posts: 4020
Location: vpcmpistri
bitRAKE 15 Feb 2008, 00:41
Polygon is having trouble with this and I don't really know what state the machine is in because he is changing his BIOS. So, I asked myself how can the code get into unreal mode with minimal dependancies. This is what I came up with: (Suggestions/comments are of course desired.)
Code:
use16

push eax
push edx
push ds
push bp

push sp
push ss
xor eax,eax
xor edx,edx
pop ax
pop dx
shl eax,4                ; paragraph to bytes
add eax,edx              ; add offset to get physical address
sub eax,8*2              ; size of GDT

pushd $00CF9200
pushd $0000FFFF
push 0                   ; spacer
push eax                 ; physical address of GDT
push 8*2-1

mov bp,sp
mov eax,cr0
or al,1
cli
lgdt [bp]
mov cr0,eax
jmp short $+2

; briefly in protected mode

mov edx,8
mov ds,dx ; update hidden descriptor data for DS
and al,$FE
mov cr0,eax
jmp short $+2

use16

sti
add sp,8*2 ; remove GDT from stack

;########### DS availible for 32-bit offsets

mov byte [$B8000],"0" ; test it out

;########### DS availible for 32-bit offsets

pop bp
pop ds
pop edx
pop eax
retf    
...only depends on enough stack space.


Last edited by bitRAKE on 15 Feb 2008, 03:16; edited 1 time in total
Post 15 Feb 2008, 00:41
View user's profile Send private message Visit poster's website Reply with quote
edfed



Joined: 20 Feb 2006
Posts: 4330
Location: Now
edfed 15 Feb 2008, 01:06
Code:
use32 ; briefly in protected mode 

mov edx,8 
mov ds,dx ; update hidden descriptor data for DS 
mov es,dx ; update hidden descriptor data for ES 
mov fs,dx ; update hidden descriptor data for FS 
mov gs,dx ; update hidden descriptor data for GS 
mov ss,dx ; update hidden descriptor data for SS 
and al,$FE 
mov cr0,eax 
jmp short $+2 

use16 

    
Post 15 Feb 2008, 01:06
View user's profile Send private message Visit poster's website Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 20299
Location: In your JS exploiting you and your system
revolution 15 Feb 2008, 01:11
Code:
mov cs,dx ; update hidden descriptor data for CS    
Hehe, I'm always willing to offer confusing help Wink Twisted Evil
Post 15 Feb 2008, 01:11
View user's profile Send private message Visit poster's website Reply with quote
bitRAKE



Joined: 21 Jul 2003
Posts: 4020
Location: vpcmpistri
bitRAKE 15 Feb 2008, 01:20
Currently, only need one segment descriptor updated, would need to preserve the other registers if modified. Should correct the limits on DS before returning - just to be safe.

_________________
¯\(°_o)/¯ “languages are not safe - uses can be” Bjarne Stroustrup
Post 15 Feb 2008, 01:20
View user's profile Send private message Visit poster's website Reply with quote
Goplat



Joined: 15 Sep 2006
Posts: 181
Goplat 15 Feb 2008, 02:49
Quote:
jmp short $+2

use32 ; briefly in protected mode

No, CS is still 16-bit. This jmp does not actually do anything; you need a far jump to load CS from the GDT. (But if all you're doing is changing the data segments, you don't need a jump at all.)
Post 15 Feb 2008, 02:49
View user's profile Send private message Reply with quote
bitRAKE



Joined: 21 Jul 2003
Posts: 4020
Location: vpcmpistri
bitRAKE 15 Feb 2008, 03:09
Do you know why every BIOS I've looked at uses the short jumps when CS isn't updated? I could assume it is in error, because nothing I've seems to indicate a delay or anything is needed and it does seem to work without it.

Thank you, I've remove the "use32".

In protected mode, but not a 32-bit segment.

_________________
¯\(°_o)/¯ “languages are not safe - uses can be” Bjarne Stroustrup
Post 15 Feb 2008, 03:09
View user's profile Send private message Visit poster's website Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 20299
Location: In your JS exploiting you and your system
revolution 15 Feb 2008, 03:43
bitRAKE: I guess my little hint was too obscure. Goplat is correct about the CS thing (although I'm not sure about not needing the jmp), protected mode does not automatically mean 32bit, you can also have 16bit CS descriptors in PM. That is why I suggested to load CS, so that your code inside the use32 block will work as you expected.
Post 15 Feb 2008, 03:43
View user's profile Send private message Visit poster's website Reply with quote
bitRAKE



Joined: 21 Jul 2003
Posts: 4020
Location: vpcmpistri
bitRAKE 15 Feb 2008, 03:45
It doesn't need to be 32bit code - 16bit code is fine.

This code is tested and working (on my machine):
Code:
use16

push eax
push edx
push ds
push bp

push sp
push ss
xor eax,eax
xor edx,edx
pop ax
pop dx
shl eax,4                ; paragraph to bytes
add eax,edx              ; add offset to get physical address
sub eax,8*2              ; size of GDT

pushd $00CF9200
pushd $0000FFFF
push 0                   ; spacer
push eax                 ; physical address of GDT
push 8*2-1

mov bp,sp
mov eax,cr0
or al,1
cli
lgdt [bp]
mov cr0,eax
jmp short $+2
mov edx,8
mov ds,dx ; update hidden descriptor data for DS
and al,$FE
mov cr0,eax
jmp short $+2
sti

;###################### DS is zero and availible for 32-bit offsets

; display address of GDT
mov eax,[bp+2]
call MHEX

; do something with DS:00000000

@@: in al,$60
    dec al
    jne @B

;###################### DS is zero and availible for 32-bit offsets

; clear upper byte of descriptor limit
mov bp,sp
mov byte [bp+14],0
mov eax,cr0
or al,1
cli
lgdt [bp]
mov cr0,eax
jmp short $+2
mov edx,8
mov ds,dx ; update hidden descriptor data for DS
and al,$FE
mov cr0,eax
jmp short $+2

sti
add sp,8*2 ; remove GDT from stack

pop bp
pop ds
pop edx
pop eax
retf


; output 32-bit hex to screen
MHEX:
  ; change this to write to different parts of screen
  push eax
  push edx
  push cx
  mov edx,$B8000
  mov cx,8
.0:
  rol eax,4
  push eax
  and al,$F
  cmp al,10
  sbb al,$69
  das
  mov [edx],al
  pop eax
  add edx,2
  loop .0
  pop cx
  pop edx
  pop eax
  retn    

_________________
¯\(°_o)/¯ “languages are not safe - uses can be” Bjarne Stroustrup
Post 15 Feb 2008, 03:45
View user's profile Send private message Visit poster's website Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 20299
Location: In your JS exploiting you and your system
revolution 15 Feb 2008, 04:03
bitRAKE wrote:
It doesn't need to be 32bit code - 16bit code is fine.
Yes, you already showed that when you posted your BIOS code snippet in another thread. But, you put in use32 so we all assumed you wanted a 32bit code segment.
Post 15 Feb 2008, 04:03
View user's profile Send private message Visit poster's website Reply with quote
bitRAKE



Joined: 21 Jul 2003
Posts: 4020
Location: vpcmpistri
bitRAKE 15 Feb 2008, 05:42
I'm sorry for the confusion. The only goal is to access the full 32-bit address range without breaking anything else the BIOS is doing before or after this code runs.

_________________
¯\(°_o)/¯ “languages are not safe - uses can be” Bjarne Stroustrup
Post 15 Feb 2008, 05:42
View user's profile Send private message Visit poster's website Reply with quote
sinsi



Joined: 10 Aug 2007
Posts: 789
Location: Adelaide
sinsi 15 Feb 2008, 06:10
If you set FS/GS as your 4gig address range you should be OK - the BIOS tends not to use those registers, and the only way to access >64k segments is using either a dword address or a dword register >0000ffff (unusual to see in 16-bit code).

One thing to be wary of is the A20 line - if it's off, you can only access even megabytes. Also, himem.sys and the BIOS INT 15h "move extended memory" usually cheat by setting unreal mode (dunno if they alter FS/GS though).
Post 15 Feb 2008, 06:10
View user's profile Send private message Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2024, Tomasz Grysztar. Also on GitHub, YouTube.

Website powered by rwasa.