1

I currently disassembled NTLDR of Windows XP. During the process of booting, NTLDR uses the following interrupt:

INT 10H, AX=2000H, BX=0301H, CX=0H, DX=0H

I don't know the meaning of this interrupt. What does it mean?

2
  • Could you post a code/assembler output snippet with that interrupt? It would be helpful to see that particular location in the assembler output. Aug 20, 2012 at 13:11
  • Also, are you sure that the byte order (endianness) was computed correctly, and AX is 2000H and not 0020H? Aug 20, 2012 at 13:17

1 Answer 1

1

Understanding the answer is going to require a bit of assembly language to understand.

Of the multipurpose registers used by x86 and x64 processors, EAX, EBX, ECX, and EDX can be divided into to halves. So EAX breaks down into AX and AH. The same holds true for EBX and so on. AX, BX, CX, and DX are the lower halves of the EAX, EBX, ECX, and EDX registers. The interrupt 10H is the video interrupt code.

5
  • *two...not to. gramer fale
    – Jason Lane
    Aug 17, 2012 at 15:52
  • I think it's unlikely to be using the extended registers for int 10H for backwards-compatibility reasons.
    – martineau
    Aug 17, 2012 at 19:29
  • 1
    I actually want to know what does the INT=10h/AH=20H mean. There is no documented sub-service under the int10h/ah=20h, but it exists in Ntldr.
    – user153409
    Aug 20, 2012 at 12:08
  • @JasonLane: You can edit that
    – Journeyman Geek
    Aug 20, 2012 at 12:26
  • @znatz are you sure the byte-order is correct? Aug 20, 2012 at 15:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .