Here is a detailed guide to using the protected mode bootable debugger. Please note that the screenshots provided here are from an 386 emulator called bochs for convieniance sake.
Argument notation
[x] means that argument is optional
<x> means that argument is required
x can be in decimal like 15 or in hex (entered as 0xf)
l <startLogicalSector> [numSectors]
or
l <startCylinder> <startHead> <startPhysicalSector> [numSectors]
Loads a program from a 1.44 inch floppy (in A:) .The size of code is <numSectors> (or 1 if not specified) sectors. Each sector is 512 bytes in size.The starting sector can be specified logically (<startLogicalSector>) or in terms of physical disk geometry as shown above . Please note that <startCylinder> ranges from 0 to 79, <startHead> from 0 to 1 ,<startPhysicalSector> from 1 to 18.
The program is allocated four segments to start with :
code (cs) : 64k ,readonly
data (ds) : 64k ,rw
stack(ss) : 64k ,rw
extdata (es) : 256k ,rw
(Above four segments are created in the ldt)
New segments can be created using the 'roseg' command detailed later. Example :
to load a program starting from sector 2 , having a size of 600 bytes (hence two sectors long).
>l 2 2 (Screenshot goes here)
i : The program shall break when the eip equals the offset value, hence it would just break before the instr cs:<offset> .
r : The program shall break just before the instr where it tries to read the memory location ds:<offset>
w : Same as above , but will break when the program tries to write something to the above specified location.
Please note that a maximum of four break points are only currently supported, this is because only four break points are supported in 386.
Fills the memory starting from <segmentSel:offset> with <byte1>,<byte2> ... .This is done for <numBytes> . If N is less than numBytes , the bytes are repeated again.
Also <byte1> can be in hex or decimal (to represent asci chars type their codes).
Allows the user to key in hex code for a maximum of 1kb size . The user keys in the hex code like this : 'cd01404040cd01bc40' , ie without spaces , however he is allowed to enter newlines in b/w for more readability . This functions exactly like the load command , except that the code is keyed in , instead of being loaded from a floppy.
Provides a hex dump of the code that is being executed , requires a load.
Prompts a person to reboot the machine , on saying yes the machine is rebooted.
If command is not specified , a one line description of each command is given . Else a detailed explanation(like given here) is shown for the specified command.
System calls are also implemented, to invoke them from the user program , put the syscall no in eax, the first argument if any in ebx, the second arg if any in ecx and do a software interrupt of 0x80 like 'int 0x80'.For example ,to invoke the exit system call , you can : 'xor eax,eax ; int 0x80' .
If a system call returns a value like the getch syscall , the return value is stored in eax. Some syscalls may change the eflags bits like kbhit. The following system calls are implemented :
To go up a line press Ctrl+U , to go down a line press Ctrl+D , on some keyboards the pgUp , pgDown , and the up/down arrow keys also might work.
Guide to some of the nifty features :
Shortcomings