OSDev.org

Hello all!

I wrote a simple FAT* loader, in FASM. It loads a file placed in root directory and jumps to it. You can change name of file, address for loading and entry point. Max file size is 0x10000. Note, whole segment, specified by LDR_BASE constant may be used during loading of your file!
Also, I tried to comment 'weired' things (sorry for my English ).

I tested my loader as hard as I can, but I am still not sure. So, if it fail, please, let me know by mail, post description of a problem here, or in my LJ. Also I want to reduce code's size for FAT12/32, at least by 11 bytes, to move the code to address 0x8000 when it gets control. If you have a suggestion, how to do it without changing whole structure -- write me.

Some interesting observations:
1. MS FAT driver doesn't changes sectors, which lay in the last cluster of a file, beyond 'file size'. In other words, if you have a file size of 15 bytes, 512 bytes per sector and 8 sectors per cluster, last 7 sectors of a cluster will be left intact by driver. My loader loads all sectors of last cluster.
2. It is possible to hide files very simply, without hooks and so on. Just change 0xE5 signature in the first character of FAT-entry which designates deleted file, and all entries after this one will not be showen. But CHKDSK finds it very quickly. It thinks, that FS is corrupted and restores this files into FILE*.CHK files.

Am I stupid, or forum doesn't support file storage here?
FAT12
FAT16
FAT32
Hope, it will be usefull .

I didn't write a good installer yet, but you can use the simpliest program, which copies boot code from a file, given by 1st operand to a file given by 2nd operand, and, for example, WinHex for dumping boot sectors.

Mikae wrote:2. It is possible to hide files very simply, without hooks and so on. Just change 0xE5 signature in the first character of FAT-entry which designates deleted file, and all entries after this one will not be showen. But CHKDSK finds it very quickly. It thinks, that FS is corrupted and restores this files into FILE*.CHK files.

Err... if your root directory ever fills up, (or possibly before that depending on how a FAT driver is implemented) that entry could be overwritten. There should be another 'hidden' bit that does more of what you would want.

If you want to hide something, like an extended boot loader, use the "Reserved" sector count in the BPB.

Mike

that entry could be overwritten.

Yes, sure. 0x0, like 0xE5 designates deleted entry, and also gives a hint to a driver, that there are no used entries (after this one) in this directory. This 'method' is just for fun, not for serious programs .