Rocksolid Light

Welcome to novaBBS (click a section below)

mail  files  register  nodelist  faq  login

"Help save the world!" -- Larry Wall in README


programming / alt.lang.asm / Re: Flashtek zlx.lod

SubjectAuthor
* Flashtek zlx.lodT. Ment
+- Re: Flashtek zlx.lodwolfgang kern
`- Re: Flashtek zlx.lodT. Ment

1
Subject: Flashtek zlx.lod
From: T. Ment
Newsgroups: alt.lang.asm
Organization: A noiseless patient Spider
Date: Wed, 27 Nov 2019 19:41 UTC
Path: i2pn2.org!i2pn.org!eternal-september.org!feeder.eternal-september.org!reader01.eternal-september.org!.POSTED!not-for-mail
From: t.m...@protocol.invalid (T. Ment)
Newsgroups: alt.lang.asm
Subject: Flashtek zlx.lod
Date: Wed, 27 Nov 2019 19:41:08 +0000
Organization: A noiseless patient Spider
Lines: 16
Message-ID: <oeitte9fij89sv05vcapjfut801meb6rh3@4ax.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Injection-Info: reader02.eternal-september.org; posting-host="0a7c6b26903404ce186d80f1d0122970";
logging-data="12118"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1/+AzJeeOjI/C2R0D3VX90mT5Rgg126Ykg="
Cancel-Lock: sha1:HQw9WF/Nbl3z6t9qTNNJWTIkb+Q=
X-Newsreader: Forte Agent 1.93/32.576 English (American)
View all headers
I disassembled Flashtek's zlx.lod (stub loader) and rebuilt the source,
trying to match the original binary. Using sourcer 8.01 and TASM 4.0, it
worked. except for two override bytes, 66 and 26.

TASM does this:

66| 26: 83 3E 019C  + cmp dword ptr es:[d_0000_019C_e], 0
    00

but the original binary has them reversed. The CPU seems OK with either
order, but I can't figure out which assembler they used. AFAICT it's not
TASM or MASM.

Any ideas?




Subject: Re: Flashtek zlx.lod
From: wolfgang kern
Newsgroups: alt.lang.asm
Organization: KESYS-development
Date: Wed, 27 Nov 2019 20:02 UTC
References: 1
Path: i2pn2.org!i2pn.org!aioe.org!.POSTED.a/R1ZziVlVmV5mL7J9RDKQ.user.gioia.aioe.org!not-for-mail
From: nowh...@never.at (wolfgang kern)
Newsgroups: alt.lang.asm
Subject: Re: Flashtek zlx.lod
Date: Wed, 27 Nov 2019 21:02:15 +0100
Organization: KESYS-development
Lines: 31
Message-ID: <qrmkoe$1sq7$1@gioia.aioe.org>
References: <oeitte9fij89sv05vcapjfut801meb6rh3@4ax.com>
Reply-To: nowhere@never.at
NNTP-Posting-Host: a/R1ZziVlVmV5mL7J9RDKQ.user.gioia.aioe.org
Mime-Version: 1.0
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 7bit
X-Complaints-To: abuse@aioe.org
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:66.0) Gecko/20100101
Thunderbird/66.0
X-Notice: Filtered by postfilter v. 0.9.2
Content-Language: en-US
View all headers
On 27.11.2019 20:41, T. Ment wrote:
I disassembled Flashtek's zlx.lod (stub loader) and rebuilt the source,
trying to match the original binary. Using sourcer 8.01 and TASM 4.0, it
worked. except for two override bytes, 66 and 26.

TASM does this:

66| 26: 83 3E 019C  + cmp dword ptr es:[d_0000_019C_e], 0
     00

but the original binary has them reversed. The CPU seems OK with either
order, but I can't figure out which assembler they used. AFAICT it's not
TASM or MASM.

Any ideas?

some early 386 clones had strict order on override bytes, while recent CPUs may work with any prefix order except FMA/FMA4 code page selection.

My personal preferred prefix bytes hierarchy is:

LOCK
REP /z/nz/..
SEGover
66
67

so I had   26 66 83 3e 9c 01 00   cmp word [es:019c],sxb 0

__
wolfgang


Subject: Re: Flashtek zlx.lod
From: T. Ment
Newsgroups: alt.lang.asm
Organization: A noiseless patient Spider
Date: Thu, 28 Nov 2019 21:34 UTC
References: 1
Path: i2pn2.org!i2pn.org!eternal-september.org!feeder.eternal-september.org!reader01.eternal-september.org!.POSTED!not-for-mail
From: t.m...@protocol.invalid (T. Ment)
Newsgroups: alt.lang.asm
Subject: Re: Flashtek zlx.lod
Date: Thu, 28 Nov 2019 21:34:37 +0000
Organization: A noiseless patient Spider
Lines: 25
Message-ID: <8ce0ue51c2p641mppscs5cemotfv811e3n@4ax.com>
References: <oeitte9fij89sv05vcapjfut801meb6rh3@4ax.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Injection-Info: reader02.eternal-september.org; posting-host="ce193fd401b3c5c04999327ebde36842";
logging-data="1751"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1+aIrdKxDFVmsHlrgZKY2z0j88U9E4J1Tw="
Cancel-Lock: sha1:jODUjI8ShwFNQY2zvf6zVopB0Og=
X-Newsreader: Forte Agent 1.93/32.576 English (American)
View all headers
On Wed, 27 Nov 2019 19:41:08 +0000, T. Ment wrote:

I disassembled Flashtek's zlx.lod (stub loader) and rebuilt the source,
trying to match the original binary. Using sourcer 8.01 and TASM 4.0, it
worked. except for two override bytes, 66 and 26.

TASM does this:

66| 26: 83 3E 019C  + cmp dword ptr es:[d_0000_019C_e], 0
    00

but the original binary has them reversed. The CPU seems OK with either
order, but I can't figure out which assembler they used. AFAICT it's not
TASM or MASM.

I later found MASM 5.10B in the Windows 3.1 DDK. It puts the override
bytes in the same order as zlx.lod, so now the two binaries match byte
for byte.

Now to understand the disassembled source. IDA freeware 5.0 helps with
its visual graph of the code, but I don't see any option to byte match
disassembly like sourcer 8.01 can. That's OK I can use both tools.





1
rocksolid light 0.7.2
clearneti2ptor