A minor mystery recently surfaced while analyzing DOS boot sectors. DOS uses several criteria when deciding whether a boot sector contains a valid BPB, and one of the criteria is (oddly enough) checking whether the first two bytes of the sector contain a jump instruction, which then presumably skips over the BPB. The MSDISK.INC module in the MS-DOS 3.21 OAK is a good example. The opcodes considered valid are EBh (JMP short), E9h (JMP), or 69h. Wait, an IMUL instruction? Well, no, that’s not what the comment in the source code says:
cmp byte ptr cs:[DiskSector],069H ; Is it a direct jump?
je Check_Signature ; don't need to find a NOP
cmp byte ptr cs:[DiskSector],0E9H ; DOS 2.0 jump?
je Check_Signature ; no need for NOP
cmp byte ptr cs:[DiskSector],0EBH ; How about a short jump.
jne BadDisk
The problem is that 69h is not a documented 8086 instruction. It’s an IMUL opcode on 80186 and later, but that seems highly implausible. Besides, the comment clearly says it’s a jump.
Since the undocumented 8086 opcodes are, well, undocumented, could 69h possibly behave like a jump on an 8088/8086 processor? A very good question, with remarkably few answers. One might think that in the hacker culture surrounding early PCs, it would be inevitable that someone would find out what the undocumented instructions really do. But that doesn’t appear to be the case. A fairly exhaustive search turned up nothing, even in books like Undocumented PC (Frank van Gilluwe) which devote significant space to undocumented instructions. It still seems that someone, somewhere must have published something…
A quick look at several emulators turned up nothing either. Fortunately, Raúl Gutiérrez Sanz had a genuine 8088 and enough determination to find out what the undocumented opcodes really do. Continue reading →