Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I currently disassembled NTLDR of Windows XP. During the process of booting, NTLDR uses the following interrupt:

INT 10H, AX=2000H, BX=0301H, CX=0H, DX=0H

I don't know the meaning of this interrupt. What does it mean?

share|improve this question
    
Could you post a code/assembler output snippet with that interrupt? It would be helpful to see that particular location in the assembler output. –  Breakthrough Aug 20 '12 at 13:11
    
Also, are you sure that the byte order (endianness) was computed correctly, and AX is 2000H and not 0020H? –  Breakthrough Aug 20 '12 at 13:17

1 Answer 1

Understanding the answer is going to require a bit of assembly language to understand.

Of the multipurpose registers used by x86 and x64 processors, EAX, EBX, ECX, and EDX can be divided into to halves. So EAX breaks down into AX and AH. The same holds true for EBX and so on. AX, BX, CX, and DX are the lower halves of the EAX, EBX, ECX, and EDX registers. The interrupt 10H is the video interrupt code.

share|improve this answer
    
*two...not to. gramer fale –  Jason Lane Aug 17 '12 at 15:52
    
I think it's unlikely to be using the extended registers for int 10H for backwards-compatibility reasons. –  martineau Aug 17 '12 at 19:29
1  
I actually want to know what does the INT=10h/AH=20H mean. There is no documented sub-service under the int10h/ah=20h, but it exists in Ntldr. –  user153409 Aug 20 '12 at 12:08
    
@JasonLane: You can edit that –  Journeyman Geek Aug 20 '12 at 12:26
    
@znatz are you sure the byte-order is correct? –  Breakthrough Aug 20 '12 at 15:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.