Re: Searching for string problems

[Richard B. Johnson]

On Wed, 23 Apr 2003, Andrew Kirilenko wrote:

> Hello!
>
> > > > scan:	movw	%cs, %ax
> > > > 	movw	%ax, %ds
> > > > 	movw	%ax, %es
> > > > 	movw	$where_in_BIOS_to_start, %bx
> > > > 	cld
> > > > 1:	movw	$cl_id_str, %si		# Offset of search string
> > > > 	movw	$cl_id_end, %cx		# Offset of string end + 1
> > > > 	subw	%si, %cx		# String length
> > > > 	decw	%cx			# Don't look for the \0
> > > > 	movw	%bx, %di		# ES:DI = where to look
> > > > 	repz	cmpsb			# Loop while the same
> > > > 	jz	found			# Found the string
> > > > 	incw	%bx			# Next starting offset
> > > > 	cmpw	$_BIOS_END, %bx		# Check for limit
> > > > 	jb	1b			# Continue
> > > > never_found_anywhere:
> > > >
> > > > found:
> > >
> > > I've written something similar to this before - and it wont' work, so
> > > I've reimplemented it. The problem is, that I don't know how to set ES
> > > properly. I only know, that BIOS data (and code) is located in
> > > 0xe000..0xf000 (real address).
> >
> > Yeah. So. I set ES and DS to be exactly where CS is. This means that
> > if your &!)(^$&_ code executes it will work. So, instead of trying
> > it, you just blindly ignore it and state that it won't work.
> >
> > Bullshit. I do this for a living and I gave you some valuable time
> > which you rejected out-of-hand. Have fun.
>
> Of course, I've tried your code as well - the same result! Sorry, if you
> haven't understand me.
>
> The problem is, that I don't know where this BIOS code is relative to current
> code segment (CS). I only know (hope), that it should be in
> 0x0:0xe000...0x0:0xf000. I have tried to set ES to 0 (xor %ax, %ax; mov %ax,
> %es) - no luck as well. BTW, `strings /dev/mem | grep "REQUESTED STRING"`
> founds it perfectly...
>
> Best regards,
> Andrew.
> -

The bios is in segment 0xf000. You set ES to that area. ES:DI will
start at 0 if bx=0 in the code shown. The BIOS is only 64k.
This means that where bx is being incremented (it should be incw, not
incb). It would generate an assembly error with incb which is why
I knew you didn't even try it.  -- you just jnz back to 1b, without
any additional test.

Cheers,
Dick Johnson
Penguin : Linux version 2.4.20 on an i686 machine (797.90 BogoMips).
Why is the government concerned about the lunatic fringe? Think about it.