The first thing to do is to get the firmware service call entry address by scanning memory starting from the address in ESI for a 'BoxOnIO' signature. The information block format (BoxOnInfoBlock) can be seen in src/firmware/boxonio/boxonio.h in the source code.
The parameters are passed to the service as
Code: Select all
EAX = service call number
EBX = device ID
ECX = read or write byte count
EDX = disk packet
Code: Select all
[0x00000000] = Read/write buffer address
[0x00000004] = Disk position (low dword)
[0x00000008] = Disk position (high dword, currently not used so set to 0)
An example read from the tiny.s kernel
Code: Select all
; Read from disk 0 sector 0
mov eax, 0x00000002 ; Read file
mov ebx, 0x00130000 ; Disk 0
mov ecx, 0x00000200 ; 200 bytes
mov edx, diskPkt ; Read packet
mov [edx], dword rdBuf ; Buffer address
mov [edx + 4], dword 0 ; Disk position
call [serCall]