5 ms·
Undocumented 8086 Opcodes part 1 (2017)
- rwmj 4y agoPOP CS - dismissed as "useless" here - was used by some viruses to allow them to relocate their own code in memory. They stopped working when it became #UD on 286 and above! https://malwiki.org/index.php?title=Alameda https://malwiki.org/index.php?title=Alameda
- diydsp 4y agoBtw why is it "useless"? Does it pop the stack value into the Code Segment reg? Would that make the next instruction exec from the new CS:PC? Seems good for maybe a task scheduler?
- ajenner 4y agoYes, it pops the stack value into the CS register. But it doesn't update the PC as well - it'll continue to point to the offset (in the old CS) of the instruction after the "POP CS". So whatever code is in the new CS, it has to be "compatible" with the code in the old CS, in terms of the instructions starting in the right place. However, it's even more complicated than that because the prefetch queue is not flushed, so the exact address where it switches over will be unpredictable. For certain very specific scenarios it could potentially be useful to speed up conditional execution by eliminating those prefetch queue flushes, though.
- kvakvs 4y agoThe used font is great for text but atrocious for programming uses: 0 looks same as O, and the article is full of hexadecimal codes.
- lzooz 4y agoo is not a valid hexadecimal number.
- Waterluvian 4y agoI think what you might be picking up on is the mix of upper and lowercase that makes hex numbers feel a little off when reading.
- cesarb 4y agoProbably related to the post from yesterday ("How the 8086 processor's microcode engine works" (righto.com) https://news.ycombinator.com/item?id=33845941 https://news.ycombinator.com/item?id=33845941), which explains why "[...] the processor ignores certain bits when decoding instructions."
- mrlonglong 4y agoThis was over a year ago. Where's part 2 and others ?
- vesinisa 4y ago(2017)
- deleted 4y ago[deleted]