
                                                    z{z{
i  O@Ҧ²T j                     }|}|}
==========================================================================
eG
 
    eⶰDnOniDU즳 IDTDGDT Ϊk ,MoˤwgiH²檺i
JO@Ҧ ,O٤HAg{ ,]٥ݩU~Ի ,LA
Ue ,S@ХB[n ,g٬O~b"["W ,Ṳ̄dU
nHgSOuFjv ,pGg ,᭱m峹zj]ݤ ,
̷|q峹gedC
 
--------------------------------------------------------------------------
zwwwwwwww{
x80386 ȦsТx
|wwwwwwww}
 
    80386 ȦsFXR 32 줸H~ ,W[F\hsȦs ,F@
ϥΪ̼Ȧs(AX.BX....SI.DI)UwgFѥH~ ,]W[FtμȦsBHXR
X Ȧs....C
 
 
ϡDϥΪ̼Ȧs    EAX.EBX.ECX.EDX.ESI,EDI.EBP.ESP
 
СDOмȦs  CS.EIP ӼȦs
 
ѡDϬqȦs      CS.SS.DS.ES.FS.GS
    M 80386 wgiJ 32 줸ɥN ,OoXӼȦsO 16 줸 ,Bh
    F FS.GS ӼȦs ,oӼȦsõLSNq ,UiH⥦ DS.ES
    ӬݫݡC
 
ҡDtμȦs
    A. Ȧs:]t CR0.CR2.CR3 T ,Uiݨ|F@ CR1 ,]O
       386.486.586 SȦs
    B. Ȧs:]t DR0.DR1.DR2.DR3.DR6.DR7 @ ,]O|F DR4.DR5 
        ,]PW
    C. O@Ҧq:IDT.GDT.LDT.TR
 
--------------------------------------------------------------------------
zwwww{
xu@x
|wwww}
 
    z]wYǨtμȦsH ,qä|Wҳ]wu@ ,ݳzLu
@ʧ@~|_ ,oӤu@ΤrF ,̻{u@NO
Ťʧ@Ciyu@O]t INT_X BJMP TSSϬq... ,䤤INT_X
Ob V86 U{Yoͤ_ ,q|۰ʤܫO@Ҧ ,éIsO@ҦU
_Bz{ ,AѫO@ҦU{MwO_Is V86  U_Vq ,
oO@ҦBA^ V86 U , @oͨ⦸u@......
 
zww{
xŢx
|ww}
 
    O@ҦU ,Ŧ@ 0.1.2.3 |ӵ ,䤤0ŵų̰ ,3ų̧C ,
0Ŧ]O̰ ,]]H٬uSvšv ,ε{Ŭh֩O?
oܦb EFLAG  IOPL (BIT12.13)  ,b V86 UŦhbO̧C3 ,
HȬ '11'C
 
    γ\U|{ۤvhקoӺXбNۤvŽհNnF ,ƹWn
ngLu@ʧ@ ,Ť~Qק ,ӸgLu@ʧ@ ,A{
vN浹OH ;A²檺 ,o INT_X  ,q|NŤ̰(ƹ
WOѤ_WMw) ,öiJO@Ҧ ,O@Ҧ{AӨMwNϥΪ̪
EFLAG 򵥯 ,MA IRETD^ V86 ,Oε{ڥmL̦iJO
@ҦåC(o˧AkbV86Um̰Ŷ....i)
 
    ŪCiHMwۤvhֱv ,Ҧpų̰H~iHŪgtμȦs
 ,lHQŪgtμȦs|o General Protection Error 0D ,AiH
QŤ ,onŪtθ귽 ,|o INT_0D ,ӭ쥻oON|Q
 ,Ӱ|̩\ EIP Ȥ]boW ,pG INT_0D Bz{hL
oӫO ,h|ûboӫO(ΦP)C
 
    b V86 Uoͤ_ ,|۰ PUSH EIP.CS.EFLAG.ESP.SS......ƭӼȦs ,
æ۰ʱN SS.ESP ȴ ,HKoͤ_ ,|ʥΨ V86 | ,iOpGo
ͪO General Protection Error(Uٲ`),h|b PUSH EIP eAh\J@
DWORD ~NX ,pGz{b IRETD ehoӥisb~NX ,
h|oͤiwGCo]OO@ҦU{ng]@C SSPESP
Ҵ ,hO̪iJO@Ҧ ,ѳ̰ŪHMw(\TSSϬq)C
 
    ĤG̵̦ GDT  ,䤤 93 NigϬq ,pG] 89 ,h
ܦϬqO TSS  ,A TR Ȧsӫwoͤ_ ,Ψ@ӰϬq.
 
|Ҩӻ ,UO GDT 
 
gdttab  db      000h,000h,000h,000h,000h,000h,000h,000h ;00
        db      0ffh,0ffh,000h,000h,000h,09bh,000h,000h ;08
        db      0ffh,0ffh,000h,000h,000h,093h,08fh,000h ;10
        db      0ffh,0ffh,000h,000h,000h,089h,000h,000h ;18
        db      0ffh,0ffh,000h,000h,000h,089h,000h,000h ;20
        db      0ffh,0ffh,000h,000h,000h,093h,000h,000h ;28
        db      0ffh,007h,000h,000h,000h,093h,000h,000h ;30
        db      0ffh,0ffh,000h,080h,00bh,093h,000h,000h ;38
        db      0ffh,0ffh,000h,000h,000h,093h,000h,000h ;40
 
  ڭ̥iHݨ 18.20  Selector nNO 89h ,]NO̭ǭӳiHO
TSS yz ,pG MOV AX,0018BLTR AX ,hܵoͤu@ , 0018 
yzC
 
--------------------------------------------------------------------------
zwwwwww{
xTSS ²x
|wwwwww}
    TSS ]H٬uu@v ,]wpU ,ԱiݮѤԲӡC
 
tssltr  dd      00000000h
        dd      0000ff00h       ;ESP
        dw      0028h,0000h     ;SS.0
        dd      0,0,0,0,0
        dw      offset enter_v86,0000h      ;EIP
        dd      00000200h       ;EFlag
        dd      0,0,0,0
        dd      0000ff00h       ;ESP
        dd      0,0,0
        dw      0010h,0000h     ;ES.0
        dw      0008h,0000h     ;CS.0
        dw      0028h,0000h     ;SS.0
        dw      0010h,0000h     ;DS,0
        dw      0010h,0000h     ;FS.0
        dw      0010h,0000h     ;GS.0
        dw      0000h,0000h     ;LDT.0
        dw      0000h,0068h     ;0.IOMAP_I
        db      1000h dup (0)   ;4K IOMAP 
        dw      0ffffh
 
 
    pGz{ϥ JMP XXXX:YYYYYYYY 覡쥻ϸ` ,쥻w
YYYYYYYY NLγ~ ,]ҦȦsNQ檺ƭ(tCS.EIP) ,
Ťʧ@C
 
 
--------------------------------------------------------------------------
zwwwwwww{
xiJ V86  Ҧx
|wwwwwww}
 
        cli
        lgdt    fword ptr cs:gdtadds
        lidt    fword ptr cs:idtadds
        mov     eax,cr0
        or      al,01h
        mov     cr0,eax
        mov     bx,0018h
        ltr     bx            ;oͤu@ ,SS:ESP NѦ 0018 Ϭq
        jmp     0020h:0000h   ;iJu@ ,|즹椺w CS:EIP
                               (LTR.JMP iVP@)
 
enter_v86 :                   ;]zwN CS:EIP VB~
        xor     eax,eax
        mov     ax,code
        push    eax             ;GS
        push    eax             ;FS
        push    eax             ;DS
        push    eax             ;ES
        push    eax             ;SS
        mov     ax,0f000h
        push    eax             ;ESP
        mov     eax,00023000h   ;]wVM=1    =3
        push    eax             ;Eflag
        xor     eax,eax
        mov     ax,code
        push    eax             ;CS
        mov     ax,offset return_dos
        push    eax             ;EIP
        clts                    ;N 387  32 줸Ҧ
        iretd                   ;^ V86 (@uX24h BYTE)
 
򱵵۴N{^ V86 U~...
--------------------------------------------------------------------------
zwwwwwwww{
x_VqBzx
|wwwwwwww}
 
    bO@ҦU ,ͤ_ ,|^O@Ҧ ,OzݥhIs V86 U
_ ,HK{TC
 
    V86 Uoͤ_ ,CPU |X LTR ҳ]w SS:ESP  ,MN V86 U
hȦsȦs ,L] CPU wܦ 32 줸Ҧ ,ҥH| SP ȷ|Q
 12 byte (쥻O6byte ,ΥH\ IP.CS.FLAG) ,B|EIPȷ|V V86
U INT_X U@ ,]AݥN V86 U SP ȥ[ 6 byte ,íק V86 U
 SS:SP ̪e INT_X U@ ,MNO@ҦU| CS:EIP ȫV
V86 U_} ,oˤ~iHa V86 U_C
 
    UȦCX_Bz覡....zݳBz 256 Ӥ_C
 
new_20 :
        push    0020h
        jmp     int_emu
new_21 :
        push    0021h
        jmp     int_emu
new_22 :
        push    0022h
        jmp     int_emu
new_23 :
        push    0023h
        jmp     int_emu
 
int_emu :
        push    bp
        mov     bp,sp
        add     bp,04h
        push    eax
        push    ebx
        mov     ax,0010h                ;
        mov     ds,ax                   ;(Selector 0010h  Base=0)
        mov     ax,ss:[bp+0ch]          ;
        sub     ax,06h                  ;V86SP-6
        mov     ss:[bp+0ch],ax          ;
        xor     eax,eax                 ;
        xor     ebx,ebx                 ;קV86USS:SP ,\J
        mov     ax,ss:[bp+10h]          ;INT_X ᪺U@} ,V86
        shl     eax,04h                 ;U{IRET^INT_XU@
        mov     bx,ss:[bp+0ch]          ;
        add     ebx,eax                 ;
        mov     ax,ss:[bp+00h]          ;
        mov     ds:[ebx],ax             ;
        mov     ax,ss:[bp+04h]          ;
        mov     ds:[ebx+02h],ax         ;
        mov     ax,ss:[bp+08h]          ;
        mov     ds:[ebx+04h],ax         ;
        nop
        xor     ebx,ebx                 ;
        mov     bx,ss:[bp-02h]          ;
        shl     ebx,02h                 ;
        mov     ax,ds:[ebx]             ;IRETD V86_ҫ}~
        mov     ss:[bp+00h],ax          ;(d 0000:0000 _)
        mov     ax,ds:[ebx+02h]         ;
        mov     ss:[bp+04h],ax          ;
        mov     eax,ss:[bp+08h]
        or      eax,00032000h           ;=3  VM=1
        and     eax,0fffffeffh          ;'T'X
        mov     ss:[bp+08h],eax
        pop     ebx
        pop     eax
        pop     bp
        add     sp,02h
        iretd
 
--------------------------------------------------------------------------
zwwwwww{
xۮeʪBzx
|wwwwww}
 
    γ\zgbJ QEMM386BEMM386  ,b V86 U MOV EAX,CR0 
O ,Oe̴ŪgtμȦsݦb̰Ť~i , User  
ib̧CŤU楻ROO ?  UOF覡C
 
 
        (User)  V86 U MOV EAX,CR0
                     
                o General Protection 0D
                CPU ۰ʤJO@Ҧ ,ð INT_0D Bz{
                (|̦hxsF~NX DWORD)
                     
        (EMM)   ˬdoͿ~]
                Ū EAX,CR0 (]ɤwO̰ ,iHT)
                     
        (EMM)   ק| EIP  ,VU@O
                     
        (EMM)   קϥΪ̵ 3 / ]w VM Xе 1
                     
        (EMM)   ESP Ȧ~NX 4byte
                     
        (EMM)      IRETD ^ V86
                     
        (User) ϥΪ̨o EAX ƭ
 
    ѩ{@jbbO@ҦU ,ҥHϥΪ̮ڥPı ,uDۤvu
ŪtμȦsCoKO EMM tFqC
 
 
    A|Ҩӻ ,̩Ҽg DEBUGOS ,boӨtΤUziH MOV EAX,CR0 ,N
O]̦[HBz ,iOˬdO@Ҧ~]̨èSBz MOV EBX,CR0
 ,ObotΤU ,zNSk楻ROF ,ziHոլݡC
 
    ӼзǪ{O|b V86 UŪgtμȦs ,iOT]`{
Oo˷d ,ҦpʤѤ| MOV EAX,CR3 ,άO@ǫO@{|gJȦs
(DRx)CҥHFۮe ,oǳ̦nihC
 
--------------------------------------------------------------------------
zwwwwww{
xd I/O  Ox
|wwwwww}
 
    biJO@Ҧ ,ziHb IOMAP ̳]wYǦ줸 ,ΥH޲z I/O  ,C
Bit ܤ@Ӱ ,4K=32768 ,z]w줸 ,ŧCHŪgN|o
General Protection Error 0D ,MANiH[HBz ,L I/O MAP u]w
ŪgɵoͲ` ,LkW]wŪ~oͩζȼgJ~o ,]d I/O 
Hnۤvh{]CoI]Oܳ·ЪC
 
--------------------------------------------------------------------------
    J V86  ,٦ܦhDnBz ,]tW쪺 ,M HIMEM.SYS ۮe
 ,oǰDݱzۤvhMѨMkC
 
    O@Ҧ̥uशШ즹 ,AUh`zקڤ| ,]T
X ,LzpG|J V86 ,۵M]gbO@ҦU檺{~Cp
DAӫHC
 
    DEBUGOS oӤpnwg\ KPEMU300.ZIP F ,oO@M KeyPro p
nC
 
zwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww{
x  Soft Bugger nE 90:90/2                    ns޳N  x
x  BBS:02-5955461 24HR          ID:Werong Ho               -- nE --  x
|wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww}

