0x402000
Posted: Fri Oct 05, 2007 6:19 am
Hello,
Sorry i don't speak very well English, i'm French.
I try to understand how TLINK32 make my EXE program.
Example, i have this C program:
void toto();
unsigned int var = 0x1234;
unsigned int var2 = 0xABCD;
main()
{
toto();
asm {
nop
}
var = 0x4567;
asm {
nop
}
var2 = 0xCDEF;
asm {
nop
}
while(1) {}
}
void toto()
{
asm {
nop
nop
nop
}
}
I type to make exe:
TCC -c -ml TOTO.C
TLINK /n /x TOTO
NDISASM TOTO.EXE > TOTO.TXT
I have into TOTO.TXT
00000200 55 push bp
00000201 8BEC mov bp,sp
00000203 0E push cs
00000204 E81400 call 0x21b
00000207 90 nop
00000208 90 nop
00000209 C70604006745 mov word [0x4],0x4567
0000020F 90 nop
00000210 C7060600EFCD mov word [0x6],0xcdef
00000216 90 nop
00000217 EBFE jmp short 0x217
00000219 5D pop bp
0000021A CB retf
0000021B 55 push bp
0000021C 8BEC mov bp,sp
0000021E 90 nop
0000021F 90 nop
00000220 90 nop
00000221 5D pop bp
00000222 CB retf
00000223 0034 add [si],dh
00000225 12CD adc cl,ch
00000227 AB stosw
It's OK, in 16 bit mode, date 0x1234 is in 0022:0004 (mov word [0x4],0x4567 with DS=0022h) and 0xABCD in 0022:0006.
Now i try to make 32 bits exe:
BCC32 -c -tWC TOTO.C
TLINK32 -n TOTO
NDISASM -u TOTO.EXE > TOTO.TXT
Now i have into TOTO.TXT:
000005FF 00558B add [ebp-0x75],dl
00000602 EC in al,dx
00000603 E81B000000 call 0x623
00000608 90 nop
00000609 C705002040006745 mov dword [0x402000],0x4567
-0000
00000613 90 nop
00000614 C70504204000EFCD mov dword [0x402004],0xcdef
-0000
0000061E 90 nop
0000061F EBFE jmp short 0x61f
00000621 5D pop ebp
00000622 C3 ret
00000623 55 push ebp
00000624 8BEC mov ebp,esp
00000626 90 nop
00000627 90 nop
00000628 90 nop
00000629 5D pop ebp
0000062A C3 ret
for code and:
000007FF 003412 add [edx+edx],dh
00000802 0000 add [eax],al
00000804 CDAB int 0xab
for data, but why mov dword [0x402000],0x4567 ?
data is in 800h, or 200h without header of exe file, why 0x402000 ?
If i copy this file ( 600h to end of file ) into memory in real mode before swap to protected mode, how processor can found data ?
Thank you for responses !
I'm newbie :wink:
Sorry i don't speak very well English, i'm French.
I try to understand how TLINK32 make my EXE program.
Example, i have this C program:
void toto();
unsigned int var = 0x1234;
unsigned int var2 = 0xABCD;
main()
{
toto();
asm {
nop
}
var = 0x4567;
asm {
nop
}
var2 = 0xCDEF;
asm {
nop
}
while(1) {}
}
void toto()
{
asm {
nop
nop
nop
}
}
I type to make exe:
TCC -c -ml TOTO.C
TLINK /n /x TOTO
NDISASM TOTO.EXE > TOTO.TXT
I have into TOTO.TXT
00000200 55 push bp
00000201 8BEC mov bp,sp
00000203 0E push cs
00000204 E81400 call 0x21b
00000207 90 nop
00000208 90 nop
00000209 C70604006745 mov word [0x4],0x4567
0000020F 90 nop
00000210 C7060600EFCD mov word [0x6],0xcdef
00000216 90 nop
00000217 EBFE jmp short 0x217
00000219 5D pop bp
0000021A CB retf
0000021B 55 push bp
0000021C 8BEC mov bp,sp
0000021E 90 nop
0000021F 90 nop
00000220 90 nop
00000221 5D pop bp
00000222 CB retf
00000223 0034 add [si],dh
00000225 12CD adc cl,ch
00000227 AB stosw
It's OK, in 16 bit mode, date 0x1234 is in 0022:0004 (mov word [0x4],0x4567 with DS=0022h) and 0xABCD in 0022:0006.
Now i try to make 32 bits exe:
BCC32 -c -tWC TOTO.C
TLINK32 -n TOTO
NDISASM -u TOTO.EXE > TOTO.TXT
Now i have into TOTO.TXT:
000005FF 00558B add [ebp-0x75],dl
00000602 EC in al,dx
00000603 E81B000000 call 0x623
00000608 90 nop
00000609 C705002040006745 mov dword [0x402000],0x4567
-0000
00000613 90 nop
00000614 C70504204000EFCD mov dword [0x402004],0xcdef
-0000
0000061E 90 nop
0000061F EBFE jmp short 0x61f
00000621 5D pop ebp
00000622 C3 ret
00000623 55 push ebp
00000624 8BEC mov ebp,esp
00000626 90 nop
00000627 90 nop
00000628 90 nop
00000629 5D pop ebp
0000062A C3 ret
for code and:
000007FF 003412 add [edx+edx],dh
00000802 0000 add [eax],al
00000804 CDAB int 0xab
for data, but why mov dword [0x402000],0x4567 ?
data is in 800h, or 200h without header of exe file, why 0x402000 ?
If i copy this file ( 600h to end of file ) into memory in real mode before swap to protected mode, how processor can found data ?
Thank you for responses !
I'm newbie :wink: