
                                                    z{z{
i  O@Ҧ²| j                     }|}|}
==========================================================================
eG
    eDnOѲĤTi覡 ,sAФ@ V86 d I/O 
ʧ@ ,]n֤HĤT覡@b....iOڼg٤O
ܦna ,ҥHg@C
 
--------------------------------------------------------------------------
zwwwwwwww{
x80386 ȦsТx
|wwwwwwww}
 
    80386 ȦsFXR 32 줸H~ ,W[F\hsȦs ,F@
ϥΪ̼Ȧs(AX.BX....SI.DI)UwgFѥH~ ,]W[FtμȦsBHXR
X Ȧs....C
 
 
ϡDϥΪ̼Ȧs    EAX.EBX.ECX.EDX.ESI,EDI.EBP.ESP
 
СDOмȦs  CS.EIP ӼȦs
 
ѡDϬqȦs      CS.SS.DS.ES.FS.GS
    M 80386 wgiJ 32 줸ɥN ,OoXӼȦsO 16 줸 ,Bh
    F FS.GS ӼȦs ,oӼȦsõLSNq ,UiH⥦ DS.ES
    ӬݫݡC
 
ҡDtμȦs
    A. Ȧs:]t CR0.CR2.CR3 T ,Uiݨ|F@ CR1 ,]O
       386.486.586 SȦs
    B. Ȧs:]t DR0.DR1.DR2.DR3.DR6.DR7 @ ,]O|F DR4.DR5 
        ,]PW
    C. O@Ҧq:IDT.GDT.LDT.TR
 
: 586 _sW CR4.DR4.DR5 tμȦs
--------------------------------------------------------------------------
zwwww{
xu@x
|wwww}
 
    z]wYǨtμȦsH ,qä|Wҳ]wu@ ,ݳzLu
@ʧ@~|_ ,oӤu@ΤrF ,̻{u@NO
ʧ@Ciyu@O]t INT_X BJMP TSSϬq... ,䤤 INT_X
Ob V86U{Yoͤ_ ,q|۰ʤܫO@Ҧ ,éIsO@ҦU
_Bz{ ,AѫO@ҦU{MwO_Is V86  U_Vq ,
oO@ҦBA^ V86 U , @oͨ⦸u@......
 
zww{
xŢx
|ww}
 
    O@ҦU ,Ŧ@ 0.1.2.3 |ӵ ,䤤0ŵų̰ ,3ų̧C ,
0Ŧ]O̰ ,]]H٬uSvšv ,ε{Ŭh֩O?
oܦb EFLAG  IOPL (BIT12.13)  ,b V86 UŦhbO̧C3 ,
HȬ '11'C
 
    γ\U|{ۤvhקoӺXбNۤvŽհNnF ,ƹWn
ngLu@ʧ@ ,Ť~Qק ,ӸgLu@ʧ@ ,A{
vN浹OH ;A²檺 ,o INT_X  ,q|NŤ̰(ƹ
WOѤ_WMw) ,öiJO@Ҧ ,O@Ҧ{AӨMwNϥΪ̪
EFLAG 򵥯 ,MA IRETD^ V86 ,Oε{ڥmL̦iJO
@ҦåC(o˧AkbV86Um̰Ŷ....i)
 
    ŪCiHMwۤvhֱv ,Ҧpų̰H~iHŪgtμȦs
 ,lHQŪgtμȦs|o General Protection Error 0D ,AiH
QŤ ,onŪtθ귽 ,|o INT_0D  ,ӭ쥻oON|Q
 ,Ӱ|̩\ EIP Ȥ]boW ,pG INT_0D  Bz{hL
oӫO ,h|ûboӫO(ΦP)C    G
 
    b V86 Uoͤ_ ,|۰ PUSH EIP.CS.EFLAG.ESP.SS......ƭӼȦs ,
æ۰ʱN SS.ESP ȴ ,HKoͤ_ ,|ʥΨ V86  | ,iOpGo
ͪO General Protection Error(Uٲ`),h|b PUSH EIP eAh\J@
DWORD  ~NX ,pGz{b IRETD ehoӥisb~NX ,h
|oͤiwGCo]OO@ҦU{ng]@C  SS PESP
Ҵ ,hO̪iJO@Ҧ ,ѳ̰ŪHMw(\TSSϬq)C
 
    ĤG̵̦ GDT  ,䤤 93 NigϬq ,pG] 89 ,h
ܦϬqO TSS  ,A TR Ȧsӫwoͤ_ ,Ψ@ӰϬq.
 
|Ҩӻ ,UO GDT 
 
gdttab  db      000h,000h,000h,000h,000h,000h,000h,000h ;00
        db      0ffh,0ffh,000h,000h,000h,09bh,000h,000h ;08
        db      0ffh,0ffh,000h,000h,000h,093h,08fh,000h ;10
        db      0ffh,0ffh,000h,000h,000h,089h,000h,000h ;18
        db      0ffh,0ffh,000h,000h,000h,089h,000h,000h ;20
        db      0ffh,0ffh,000h,000h,000h,093h,000h,000h ;28
        db      0ffh,007h,000h,000h,000h,093h,000h,000h ;30
        db      0ffh,0ffh,000h,080h,00bh,093h,000h,000h ;38
        db      0ffh,0ffh,000h,000h,000h,093h,000h,000h ;40
 
  ڭ̥iHݨ 18.20  Selector nNO 89h ,]NO̭ǭӳiHO
TSS yz ,pG MOV AX,0018BLTR AX ,hܵoͤu@ , 0018 
yzC
 
@:General Protection Error oͫ|hIsӤ_ ,O@벣ͤ_u|
     sJ EIP.CS.EFLAG.ESP.SS.... ,Oo General Protection Error 
     ||sJ ~NX.EIP.CS.EFLAG.ESP.SS.....
     |hsF@"~NX" ,Oob^ V86 enNȴh !!
 
G:eo GP Error #0D Is INT_0D ,ou໡Ob ,]y@z
     w ,AơC
 
--------------------------------------------------------------------------
zwwwwww{
xTSS ²x
|wwwwww}
    TSS ]H٬uu@v ,]wpU ,ԱiݮѤԲӡC
 
tssltr  dd      00000000h
        dd      0000ff00h       ;ESP
        dw      0028h,0000h     ;SS.0
        dd      0,0,0,0,0
        dw      offset enter_v86,0000h      ;EIP
        dd      00000200h       ;EFlag
        dd      0,0,0,0
        dd      0000ff00h       ;ESP
        dd      0,0,0
        dw      0010h,0000h     ;ES.0
        dw      0008h,0000h     ;CS.0
        dw      0028h,0000h     ;SS.0
        dw      0010h,0000h     ;DS,0
        dw      0010h,0000h     ;FS.0
        dw      0010h,0000h     ;GS.0
        dw      0000h,0000h     ;LDT.0
        dw      0000h,0068h     ;0.IOMAP_I
        db      1000h dup (0)   ;4K IOMAP 
        dw      0ffffh
 
 
    pGz{ϥ JMP XXXX:YYYYYYYY 覡쥻ϸ` ,쥻w
YYYYYYYY NLγ~ ,]ҦȦsNQ檺ƭ(tCS.EIP) ,
Ťʧ@C
 
 
--------------------------------------------------------------------------
zwwwwwww{
xiJ V86  Ҧx
|wwwwwww}
 
        cli
        lgdt    fword ptr cs:gdtadds
        lidt    fword ptr cs:idtadds
        mov     eax,cr0
        or      al,01h
        mov     cr0,eax
        mov     bx,0018h
        ltr     bx            ;oͤu@ ,SS:ESP NѦ 0018 Ϭq
        jmp     0020h:0000h   ;iJu@ ,|즹椺w CS:EIP
                               (LTR.JMP iVP@)
 
enter_v86 :                   ;]zwN CS:EIP VB~
        xor     eax,eax
        mov     ax,code
        push    eax             ;GS
        push    eax             ;FS
        push    eax             ;DS
        push    eax             ;ES
        push    eax             ;SS
        mov     ax,0f000h
        push    eax             ;ESP
        mov     eax,00023000h   ;]wVM=1    =3
        push    eax             ;Eflag
        xor     eax,eax
        mov     ax,code
        push    eax             ;CS
        mov     ax,offset return_dos
        push    eax             ;EIP
        clts                    ;N 387  32 줸Ҧ
        iretd                   ;^ V86 (@uX24h BYTE)
 
򱵵۴N{^ V86 U~...
--------------------------------------------------------------------------
zwwwwwwww{
x_VqBzx
|wwwwwwww}
    b V86 Uͤ_ ,q|۰ʤ^O@Ҧ ,ñq LTR ҫw}o
TSS  ,MH椺ƭs]w SS.ESP ,M V86 UUȦs\J
| ,bݪ`NO\b|ƬO32줸覡 ,ҥH DS.ES....
o16줸Ȧs\| , '0000' ,ΥHꨬ 32BitC
 
    ²ӻ ,buҦU V86UϥΤ@ SS:SP ,@zL_iJO@Ҧ
 , SS:SP ȦsNQmt@ռƭ(wqTSS) ,MANj
s\boӷs|Ϥ(]tSS.ESP) , IRETD ^ V86  ,SS:ESP
ȦsȤ~|q|uXCyܻ ,b V86Uoͤ_|ϥΦۤv| ,
Ӥ|}a V86 | ,o]NO S-ICE { 'T' ROo
| User |ơC
 
    sO@Ҧ| CS:EIP |V V86U "INT_X" U@ , SS:SP 
oӼƭ(Hͤ_|۰ʴ ,M|\J FLAG.CS.IP),]
O@ҦUBz_{ݭק V86  SP ȴ6 ,ñN V86  CS.IP.FLAG
\J V86 | ,̫Ahd 0000:0000  ,NO@Ҧ| CS:EIP 
קBV_Vq ,̫O@Ҧ{ IRETD ^ V86  , V86
U_ҫ} ,o˫KӼ DOS _ĪGC
 
PS:O@ҦU||s EFLAG.EIP.ECS.ESP.SS...... ѤF , Real Mode ٭n
   hnhC
 
    UȦCX_Bz覡....zݳBz 256 Ӥ_C
 
new_20 :
        push    0020h
        jmp     int_emu
new_21 :
        push    0021h
        jmp     int_emu
new_22 :
        push    0022h
        jmp     int_emu
new_23 :
        push    0023h
        jmp     int_emu
 
int_emu :
        push    bp
        mov     bp,sp
        add     bp,04h
        push    eax
        push    ebx
        mov     ax,0010h                ;
        mov     ds,ax                   ;(Selector 0010h  Base=0)
        mov     ax,ss:[bp+0ch]          ;
        sub     ax,06h                  ;V86SP-6
        mov     ss:[bp+0ch],ax          ;
        xor     eax,eax                 ;
        xor     ebx,ebx                 ;קV86USS:SP ,\J
        mov     ax,ss:[bp+10h]          ;INT_X ᪺U@} ,V86
        shl     eax,04h                 ;U{IRET^INT_XU@
        mov     bx,ss:[bp+0ch]          ;
        add     ebx,eax                 ;
        mov     ax,ss:[bp+00h]          ;
        mov     ds:[ebx],ax             ;
        mov     ax,ss:[bp+04h]          ;
        mov     ds:[ebx+02h],ax         ;
        mov     ax,ss:[bp+08h]          ;
        mov     ds:[ebx+04h],ax         ;
        nop
        xor     ebx,ebx                 ;
        mov     bx,ss:[bp-02h]          ;
        shl     ebx,02h                 ;
        mov     ax,ds:[ebx]             ;IRETD V86_ҫ}~
        mov     ss:[bp+00h],ax          ;(d 0000:0000 _)
        mov     ax,ds:[ebx+02h]         ;
        mov     ss:[bp+04h],ax          ;
        mov     eax,ss:[bp+08h]
        or      eax,00032000h           ;=3  VM=1
        and     eax,0fffffeffh          ;'T'X
        mov     ss:[bp+08h],eax
        pop     ebx
        pop     eax
        pop     bp
        add     sp,02h
        iretd
 
--------------------------------------------------------------------------
zwwwwww{
xd I/O  Ox
|wwwwww}
 
    TSS 椺Fiwqͤu@ ,SS.ESP.DS.ES....UȦs ,]
iH}@O鰵 IOMAP ,oOC Bit N@ PORT ,@ߺDO}4K
jp (65536),Y줸]w '1'  ,unO̰ŪHhŪg ,|
o GP Err #0D ,Mb̧CŪ V86 {]ҥ~ ,oͦ~ ,NΦPd
 I/O  ʧ@F ,򱵵۳zL̰ŪBz{hP_oͿ~] ,ҦpP_
{XO_ yEC  IN AL,DXzByEE  OUT DX,ALz ,άO䥦{X ,NiH
oͪ]OŪμgͪ ,d I/O  ,AO_|gF I/O { ?
 
    H S-ICE d I/O O ,ϥ IO-MAP 覡hd I/O ,MAPO
"EE.E4.EC.E6...." {XC
 
:IOMAP O]O TSS 檺@C
--------------------------------------------------------------------------
zwwwwwww{
xۮeʪBz@x      tμȦsۮeBzk
|wwwwwww}
 
    γ\zgbJ QEMM386BEMM386  ,b V86  U MOV EAX,CR0 
O ,Oe̴ŪgtμȦsݦb̰Ť~i , User i
b̧CŤU楻ROO ?  UOF覡C
 
 
        (User)  V86 U MOV EAX,CR0
                     
                o General Protection 0D
                CPU ۰ʤJO@Ҧ ,ð INT_0D Bz{
                (|̦hxsF~NX DWORD)
                     
        (EMM)   ˬdoͿ~]
                Ū EAX,CR0 (]ɤwO̰ ,iHT)
                     
        (EMM)   ק| EIP  ,VU@O
                     
        (EMM)   קϥΪ̵ 3 / ]w VM Xе 1
                     
        (EMM)   ESP Ȧ~NX 4byte
                     
        (EMM)      IRETD ^ V86
                     
        (User) ϥΪ̨o EAX ƭ
 
    ѩ{@jbbO@ҦU ,ҥHϥΪ̮ڥPı ,uDۤvu
ŪtμȦsCoKO EMM tFqC
 
    ӼзǪ{O|b V86  UŪgtμȦs ,iOT]`{
Oo˷d ,ҦpʤѤ| MOV EAX,CR3 ,άO@ǫO@{|gJȦs
 (DRx)CҥHFۮe ,oǳ̦nihC
 
:POoͪ]]iHQΧP_ I/O ؤk ,g_ӫܳ·СC
--------------------------------------------------------------------------
zwwwwwww{
xۮeʪBzGx      HIMEM.SYS
|wwwwwww}
    HIMEM.SYS O@ӥiH 1MB  H~O骺{ ,Le̦L ,n
ŪgWL 1MB  H~O饲ݶiJO@Ҧ~(ڻi) ,J
vO@Ҧ{ ,AJIs HIMEM.SYS hh 1MB H~O ,qM
|o GP Err #0D ,ӳoO] HIMEM.SYS bhO骺RO|hIs
BIOS  AH=87h  INT_15h hhO ,yܻNO]o BIOS _|iJO
@ҦhhO ,ҥH~|y ,]AO@Ҧ{ݥho
BIOS 禡 ,NiHP HIMEM.SYS ۮeFC
 
:BIOS AH=87h INT_15h |] GDT.IDT  ,MiJO@ҦhhO ,M
   Nb LIDT  LGDT ROWC
 
   t~pGA{\b 1MB HWO}h ,ٷ|t@ӰD ,
   LpGAwgǷ|Woǥ\ ,Aեhgӵ{hո ,A۵M|D
   |oͤD ,ѨMk]² ,A@w|ѨMC
--------------------------------------------------------------------------
    J V86   ,٦ܦhDnBz ,LW쪺ӰDpGABz
 ,򥻤WN|䥦jD ,A|iJO@Ҧ ,AӾǲ  VCPIBDPMI
N²FC
 
    pGU|JO@Ҧ ,UӬOǲ VCPI J覡 ,M
hy ,OnuFѨäeCĳUhRMjtX~EԤhB
굦 ,~[O@NOJO@Ҧ̨νd ,]tzL VCPIBۤv286.386
O@Ҧ ,MoODw欰 ,OoO@ӳ̨νdCӤʶǷs
EC
 
    O@Ҧ̼ȮɤШ즹 ,U@̱NzеO ,p
Gp\ ,ٷ|KЧCЦUpgX S-ICE  BPR
\ ,wY@O骺ŪgAC
 
 
zwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww{
x  Soft Bugger nE 90:90/2                    ns޳N  x
x  BBS:02-5955461 24HR          ID:Werong Ho               -- nE --  x
|wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww}

