This blog has previously examined a very very strange code fragment in the BIOS module of DOS. To recap, when deciding whether a boot sector might have a valid BPB, DOS checks whether the first byte is a relative jump (opcode E9h) or a short jump (opcode EBh), both used by different DOS versions. But it also checks for a “direct jump” with 69h opcode.
The code looks like this in the MS-DOS 3.21 OAK, source file dated May 1, 1987:
cmp byte ptr cs:[DiskSector],069H ; Is it a direct jump?
je Check_Signature ; don't need to find a NOP
cmp byte ptr cs:[DiskSector],0E9H ; DOS 2.0 jump?
je Check_Signature ; no need for NOP
cmp byte ptr cs:[DiskSector],0EBH ; How about a short jump.
jne BadDisk
cmp byte ptr cs:[DiskSector]+2,090H ; Is next one a NOP?
jne BadDisk
The code is not materially different in the MS-DOS 3.3 OAK, source file dated July 24, 1987:
cmp byte ptr cs:[DiskSector],069H ; Is it a direct jump?
JE Check_bpb_MediaByte ; DON'T NEED TO FIND A NOP
cmp byte ptr cs:[DiskSector],0E9H ; DOS 2.0 jump?
JE Check_bpb_MediaByte ; NO NEED FOR NOP
cmp byte ptr cs:[DiskSector],0EBH ; How about a short jump.
JNE INVALIDBOOTSEC
cmp byte ptr cs:[DiskSector]+2,090H ; Is next one a NOP?
JNE INVALIDBOOTSEC
The labels are different but the logic is identical. But of course there is no such “direct jump” on x86, and the 69h opcode (undocumented on 8086, IMUL on later CPUs) makes no sense whatsoever. So what is it?
Continue reading







