NASM has this nice feature which is local labels. Local labels start with '.' character. So instead of 'gdt_start:' and 'gdt_end:' you can have 'gdt:' and '.end:' labels. You refer to local labels with something like 'gdt.end'. Local label identifiers can be reused as many times as you want.
@@screeck The 16 bit "Big" Real Mode/Unrealmode is undocumented. Jumping from PM to RM is not changing the segment size back to 64 kb on 80386+. The last himem.sys XMS memory manager for DOS can handle up to 4 gb memory too.
@@screeck Example to build one instruction to copy a part of the linear framebuffer (dosbox svga-S3 emulation at C0000000) of VBE graphic modes from the upper left corner to the center of the screen in 16 bit Big real mode. One instruction: rep DB 67h ; address size prefix movsd ; copy ECX double words from ds:esi to es:edi
@@screeck Address calculation. xor ax, ax mov ax, cs mov ds, ax mov es, ax shl eax, 4 mov esi, 0C0000000h sub esi, eax ; ds:esi = address 0C0000000h mov edi, esi add edi, center We can get the linear address of the framebuffer from the mode specific information function AX= 4001h of the int 10h. Documentation: vbe3.pdf
This code is performing a mode switch to Protected Mode and then back to a "Big Real Mode." This is useful in environments where you need the advantages of protected mode (like access to all 4 GB of memory and advanced features) while still using 16-bit BIOS and DOS-like functionality.
Great video Bro. Please make a Udemy course on low level programming and Malware. Programming OS , Network protocol. It'll definitely become a best seller.
NASM has this nice feature which is local labels. Local labels start with '.' character. So instead of 'gdt_start:' and 'gdt_end:' you can have 'gdt:' and '.end:' labels. You refer to local labels with something like 'gdt.end'. Local label identifiers can be reused as many times as you want.
That "Limte" comment that you don't notice even after moving it twice, and copying it once! XD
1:00 got to love x86
cool, Polske czuć, leci sub!
whats the difference between dw and db?
size: word is 2 bytes, byte is 1 byte dw = define word, db = define byte
You didn't ask for 'dd' but that is definde double word, or 4 bytes
@@metamud8686 thank you!
Bro can you make some vedios on how to gain reverse shell access to multiple systems. After gaining access to one system?
Cool video👍Unfortunately all Discord links are invalid
In the protected mode we can’t use the bios functions any longer and it is not easy to use the hdd controller on port 01F0h to load a file or to switch into the graphic mode for example. It is more easy to use the 16 bit "BIG" Real Mode to have an read/write access to the memory up to 4 gb.
072A:0100 FA CLI
072A:0101 E470 IN AL,70
072A:0103 0C80 OR AL,80
072A:0105 E670 OUT 70,AL
072A:0107 6631C0 XOR EAX,EAX
072A:010A 8CC8 MOV AX,CS
072A:010C A36D01 MOV [016D],AX
072A:010F 66C1E004 SHL EAX,04
072A:0113 6689C3 MOV EBX,EAX
072A:0116 A3B201 MOV [01B2],AX
072A:0119 A3BA01 MOV [01BA],AX
072A:011C 66C1C810 ROR EAX,10
072A:0120 A2B401 MOV [01B4],AL
072A:0123 A2BC01 MOV [01BC],AL
072A:0126 6631C0 XOR EAX,EAX
072A:0129 B8A801 MOV AX,01A8
072A:012C 6601C3 ADD EBX,EAX
072A:012F C706A0012700 MOV WORD PTR [01A0],0027
072A:0135 66891EA201 MOV [01A2],EBX
072A:013A 9C PUSHF
072A:013B 0F0116A001 LGDT [01A0]
072A:0140 8CD2 MOV DX,SS
072A:0142 0F20C0 MOV EAX,CR0
072A:0145 0C01 OR AL,01
072A:0147 0F22C0 MOV CR0,EAX
072A:014A EA50010800 JMP 0008:0150
-ucs:150 l1F
072A:0150 B81000 MOV AX,0010
072A:0153 8ED0 MOV SS,AX
072A:0155 B81800 MOV AX,0018
072A:0158 8ED8 MOV DS,AX
072A:015A 8EC0 MOV ES,AX
072A:015C 8EE0 MOV FS,AX
072A:015E 8EE8 MOV GS,AX
072A:0160 0F20C0 MOV EAX,CR0
072A:0163 6683E0FE AND EAX,-02
072A:0167 0F22C0 MOV CR0,EAX
072A:016A EA70013407 JMP 0734:0170
-ucs:170 l2F
072A:0170 8ED2 MOV SS,DX
072A:0172 9D POPF
072A:0173 31C9 XOR CX,CX
072A:0175 E464 IN AL,64
072A:0177 2402 AND AL,02
072A:0179 E0FA LOOPNZW 0175
072A:017B 751A JNZ 0197
072A:017D B0D1 MOV AL,D1
072A:017F E664 OUT 64,AL
072A:0181 31C9 XOR CX,CX
072A:0183 E464 IN AL,64
072A:0185 2402 AND AL,02
072A:0187 E0FA LOOPNZW 0183
072A:0189 75EE JNZ 0179
072A:018B B0DF MOV AL,DF
072A:018D E660 OUT 60,AL
072A:018F 31C9 XOR CX,CX
072A:0191 E464 IN AL,64
072A:0193 2402 AND AL,02
072A:0195 E0FA LOOPNZW 0191
072A:0197 E470 IN AL,70
072A:0199 247F AND AL,7F
072A:019B E670 OUT 70,AL
072A:019D FB STI
072A:019E C3 RET
-dcs:1A0 l8
072A:01A0 00 00 00 00 00 00 00 00- ........
-dcs:1A8 l8
072A:01A0 -00 00 00 00 00 00 00 00 ........
-dcs:1B0 l8
072A:01B0 FF FF 00 00 00 9A 00 00- ........
-dcs:1B8 l8
072A:01B0 -FF FF 00 00 00 92 00 00 ........
-dcs:1C0 l8
072A:01C0 FF FF 00 00 00 92 FF FF- ........
Can you link some resources regarding to this?
@@screeck The 16 bit "Big" Real Mode/Unrealmode is undocumented. Jumping from PM to RM is not changing the segment size back to 64 kb on 80386+. The last himem.sys XMS memory manager for DOS can handle up to 4 gb memory too.
@@screeck Example to build one instruction to copy a part of the linear framebuffer (dosbox svga-S3 emulation at C0000000) of VBE graphic modes from the upper left corner to the center of the screen in 16 bit Big real mode.
One instruction:
rep
DB 67h ; address size prefix
movsd ; copy ECX double words from ds:esi to es:edi
@@screeck Address calculation.
xor ax, ax
mov ax, cs
mov ds, ax
mov es, ax
shl eax, 4
mov esi, 0C0000000h
sub esi, eax ; ds:esi = address 0C0000000h
mov edi, esi
add edi, center
We can get the linear address of the framebuffer from the mode specific information function AX= 4001h of the int 10h. Documentation: vbe3.pdf
This code is performing a mode switch to Protected Mode and then back to a "Big Real Mode." This is useful in environments where you need the advantages of protected mode (like access to all 4 GB of memory and advanced features) while still using 16-bit BIOS and DOS-like functionality.
brother great content
Thanks!
Great video Bro.
Please make a Udemy course on low level programming and Malware.
Programming OS , Network protocol.
It'll definitely become a best seller.
Bro fix your discord link
This one should work: discord.com/invite/XsJbSMYq