|
发表于 2017-11-24 17:44:30
|
显示全部楼层
随便放一点debug的源代码,你可以看到,它里面也有无数个CALL、PUSH、POP、PUSHF、PUSHA之类的与栈密切相关的指令。
- debug2F:
- pushf
- cmp ax,1687h
- dpmidisable: ;set [IP+1]=0 if hook 2F is to be disabled
- jz @F
- popf
- jmp cs:[oldi2f]
- @@:
- call cs:[oldi2f]
- and ax,ax
- jnz @F
- mov word ptr cs:[dpmientry+0],di
- mov word ptr cs:[dpmientry+2],es
- mov di,offset mydpmientry
- push cs
- pop es
- @@:
- iret
- mydpmientry:
- mov cs:[dpmi32],al
- call cs:[dpmientry]
- jc @F
- call installdpmi
- @@:
- retf
- .286
- ;--- client entered protected mode.
- ;--- inp: [sp+4] = client real-mode CS
-
- installdpmi proc
- pusha
- mov bp,sp ;[bp+16] = ret installdpmi, [bp+18]=ip, [bp+20]=cs
- push ds
- mov bx,cs
- mov ax,000Ah ;get a data descriptor for DEBUG's segment
- int 31h
- jc fataldpmierr
- mov ds,ax
- mov [cssel],cs
- mov [dssel],ds
- mov cx,2 ;alloc 2 descriptors
- xor ax,ax
- int 31h
- jnc @F
- fataldpmierr:
- mov ax,4CFFh
- int 21h
复制代码 |
|