我在 2 个场景中遇到过 0x55AA:
0x55AA
。0x55AA
0x55AA
有什么特别之处?
0x55AA
的二进制版本是
0101010110101010
。是因为0和1均匀交错吗?但我不认为这是一个强有力的标准。
引导签名),并且该组合出现在扇区的最后两个字节中的可能性很小,这就是选择它的原因。
类似地,SMBIOS可以找到入口点扫描 BIOS 中的 _SM_
签名,该签名必须位于像这样的段边界上;
Find_SMBIOS:
push ds
push bx ; Preserve essential
push si
; Establish DS:BX to point to base of BIOS code
mov ax, 0xf000
mov ds, ax ; Segment where table lives
xor bx, bx ; Initial pointer
mov eax, '_SM_' ; Scan buffer for this signature
; Loop has maximum of 4096 interations. As table is probably at top of buffer, cycling
; though it backwards saves time. In my test bed, BOCH's 2.6.5 BIOS-bochs-latest it was
; 1,451 interations.
.L0: sub bx, 16 ; Bump pointer to previous segment
jnz .J0
; Return NULL in AX and set CF. Either AX or flag can be tested on return.
mov ax, bx
stc
jmp .Done
; Did we find signature at this page
.J0: cmp [bx], eax
jnz .L0 ; NZ, keep looking
; Calculate checksum to verify position
mov cx, 15
mov ax, cx
mov si, bx ; DS:SI = Table entry point
; Compute checksum on next 15 bytes
.L1: lodsb
add ah, al
loop .L1
or ah, ah
jnz .L0 ; Invalid, try to find another occurence
; As entry point is page aligned, we can do this to determine segment.
shr bx, 4
mov ax, ds
add ax, bx
clc ; NC, found signature
.Done:
pop si
pop bx ; Restore essential
pop ds
ret
该签名在十六进制转储中很容易识别,并且适合 16 位寄存器。我不知道这两个标准的促成因素在哪里,但同样,0x5f4d535f 出现在偶数 16 字节边界上的概率非常不可能。