Captulo I: INTRODUCCIN

1.1. - NUMEROS BINARIOS, OCTALES Y HEXADECIMALES.

El sistema de numeracin utilizado habitualmente es la base 10; es decir, consta de 10
dgitos (0-9) que podemos colocar en grupos, ordenados de izquierda a derecha y de
mayor a menor.
Cada posicin tiene un valor o peso de 10n donde n representa el lugar contado por la
derecha:
1357 = 1 x 103 + 3 x 102 + 5 x 101 + 7 x 100
Explcitamente, se indica la base de numeracin como 135710.
En un ordenador el sistema de numeracin es binario -en base 2, utilizando el 0 y el 1hecho propiciado por ser precisamente dos los estados estables en los dispositivos
digitales que componen una computadora.
Anlogamente a la base 10, cada posicin tiene un valor de 2n donde n es la posicin
contando desde la derecha y empezando por 0:
1012 = 1 x 22 + 0 x 21 + 1 x 20
Adems, por su importancia y utilidad, es necesario conocer otros sistemas de
numeracin como pueden ser el octal (base 8) y el hexadecimal (base 16). En este ltimo
tenemos, adems de los nmeros del 0 al 9, letras -normalmente en maysculas- de la A a
la F.
Llegar a un nmero en estos sistemas desde base 2 es realmente sencillo si agrupamos
las cifras binarias de 3 en 3 (octal) o de 4 en 4 (hexadecimal):
Base 2 a base 8: 101 0112 = 538
Base 2 a base 16: 0010 10112 = 2B16
A la inversa, basta convertir cada dgito octal o hexadecimal en binario:
Base 8 a base 2: 248 = 010 1002

Base 16 a base 2: 2416 = 0010 01002

De ahora en adelante, se utilizarn una serie de sufijos para determinar el sistema de
numeracin empleado:
Sufijo Base Ejemplos
b

01101010b

o,q

175o

10

789d

16

6A5h

En caso de que no aparezca el sufijo, el nmero se considera decimal; es decir, en base

10.
1.2. - CAMBIO DE BASE.
Pese a que las conversiones entre base 2 y base 8 y 16 son prcticamente directas,
existe un sistema general para realizar el cambio de una base a otra. El paso de cualquier
base a base 10 lo vimos antes:
6A5h = 6 x 162 + 10 x 161 + 5 x 160
Inversamente, si queremos pasar de base 10 a cualquier otra habr que realizar
sucesivas divisiones por la base y tomar los restos:

donde 4 es el ltimo cociente (menor que la base) y los restantes dgitos son los restos en
orden inverso.
1.3. - ESTRUCTURA ELEMENTAL DE LA MEMORIA.
1.3.1. - BIT.
Toda la memoria del ordenador se compone de dispositivos electrnicos que pueden
adoptar nicamente dos estados, que representamos matemticamente por 0 y 1.
Cualquiera de estas unidades de informacin se denomina BIT, contraccin de binary
digit en ingls.
1.3.2. - BYTE.
Cada grupo de 8 bits se conoce como byte u octeto. Es la unidad de almacenamiento

en memoria, la cual est constituida por un elevado nmero de posiciones que almacenan
bytes. La cantidad de memoria de que dispone un sistema se mide en Kilobytes (1 Kb =
1024 bytes), en Megabytes (1 Mb = 1024 Kb), Gigabytes (1 Gb = 1024 Mb), Terabytes (1
Tb = 1024 Gb) o Petabytes (1 Pb = 1024 Tb).
Los bits en un byte se numeran de derecha a izquierda y de 0 a 7, correspondiendo con
los exponentes de las potencias de 2 que reflejan el valor de cada posicin. Un byte nos
permite, por tanto, representar 256 estados (de 0 a 255) segn la combinacin de bits que
tomemos.
1.3.3. - NIBBLE.
Cada grupo de cuatro bits de un byte constituye un nibble, de forma que los dos
nibbles de un byte se llaman nibble superior (el compuesto por los bits 4 a 7) e inferior (el
compuesto por los bits 0 a 3). El nibble tiene gran utilidad debido a que cada uno
almacena un dgito hexadecimal:

Binario Hex. Decimal Binario Hex. Decimal

0000

1000

0001

1001

0010

1010

10

0011

1011

11

0100

1100

12

0101

1101

13

0110

1110

14

0111

1111

15

1.4. - OPERACIONES ARITMTICAS SENCILLAS EN BINARIO.

Para sumar nmeros, tanto en base 2 como hexadecimal, se sigue el mismo proceso
que en base 10:

1010 1010b
+ 0011 1100b
-------------1110 0110b

1.5. - COMPLEMENTO A DOS.

Podemos observar que la suma se desarrolla de la forma tradicional; es decir:

sumamos normalmente, salvo en el caso de
1 + 1 = 102 , en cuyo caso tenemos un acarreo de 1 (lo que nos llevamos).

En general, se define como valor negativo de un nmero el que necesitamos sumarlo

para obtener 00h, por ejemplo:
FFh
+ 01h
-----100h

Como en un byte solo tenemos dos nibbles, es

decir, dos dgitos hexadecimales, el resultado es
0 (observar cmo el 1 ms significativo subrayado
es ignorado). Luego FFh=-1. Normalmente, el bit 7
se considera como de signo y, si est activo (a 1)
el nmero es negativo.

Por esta razn, el nmero 80h, cuyo complemento a dos es l mismo, se considera
negativo (-128) y el nmero 00h, positivo. En general, para hallar el complemento a dos
de un nmero cualquiera basta con calcular primero su complemento a uno, que consiste
en cambiar los unos por ceros y los ceros por unos en su notacin binaria; a continuacin
se le suma una unidad para calcular el complemento a dos. Con una calculadora, la
operacin es ms sencilla: el complemento a dos de un nmero A de n bits es 2n-A.
Otro factor a considerar es cuando se pasa de operar con un nmero de cierto tamao
(ej., 8 bits) a otro mayor (pongamos de 16 bits). Si el nmero es positivo, la parte que se
aade por la izquierda son bits a 0. Sin embargo, si era negativo (bit ms significativo
activo) la parte que se aade por la izquierda son bits a 1. Este fenmeno, en cuya
demostracin matemtica no entraremos, se puede resumir en que el bit ms significativo
se copia en todos los aadidos: es lo que se denomina la extensin del signo: los dos
siguientes nmeros son realmente el mismo nmero (el -310): 11012 (4 bits) y 111111012
(8 bits).
1.6. - AGRUPACIONES DE BYTES.
Tipo

Definicin

Palabra

2 bytes contiguos

Doble palabra

2 palabras contiguas (4 bytes)

Cudruple palabra 4 palabras contiguas (8 bytes)

Prrafo

16 bytes

Pgina

256 bytes, 16 Kb, etc.

Segmento

64 Kbytes

1.7. - REPRESENTACIN DE LOS DATOS EN MEMORIA.

1.7.1. - NUMEROS BINARIOS: mximo nmero representable:
Tipo
1 byte

Sin signo
255

2 bytes

65.535

4 bytes

4.294.967.295

8 bytes 18.446.744.073.709.551.615
Tipo

Positivo

Negativo

1 byte

127

-128

2 bytes

32.767

-32.768

4 bytes

2.147.483.647

-2.147.483.648

8 bytes 9.223.372.036.854.775.807 -9.223.372.036.854.775.808

Los nmeros binarios de ms de un byte se almacenan en la memoria en los

procesadores de Intel en orden inverso: 01234567h se almacenara: 67h, 45h, 23h, 01h.
1.7.2. - NUMEROS BINARIOS CODIFICADOS EN DECIMAL (BCD).
Consiste en emplear cuatro bits para codificar los dgitos del 0 al 9 (desperdiciando las
seis combinaciones que van de la 1010 a la 1111). La ventaja es la simplicidad de
conversin a/de base 10, que resulta inmediata. Los nmeros BCD pueden almacenarse
desempaquetados, en cuyo caso cada byte contiene un dgito BCD (Binary-Coded
Decimal); o empaquetados, almacenando dos dgitos por byte (para construir los nmeros
que van del 00 al 99). La notacin BCD ocupa cuatro bits -un nibble- por cifra, de forma
que en el formato desempaquetado el nibble superior siempre es 0.
1.7.3. - NUMEROS EN PUNTO FLOTANTE.
Son grupos de bytes en los que una parte se emplea para guardar las cifras del nmero
(mantisa) y otra para indicar la posicin del punto flotante (exponente), de modo
equivalente a la notacin cientfica. Esto permite trabajar con nmeros de muy elevado
tamao -segn el exponente- y con una mayor o menor precisin en funcin de los bits
empleados para codificar la mantisa.
1.7.4. - CDIGO ASCII.
El cdigo A.S.C.I.I. (American Standard Code for Information Interchange) es un
convenio adoptado para asignar a cada carcter un valor numrico; su origen est en los
comienzos de la Informtica tomando como muestra algunos cdigos de la transmisin de
informacin de radioteletipo. Se trata de un cdigo de 7 bits con capacidad para 128
smbolos que incluyen todos los caracteres alfanumricos del ingls, con smbolos de
puntuacin y algunos caracteres de control de la transmisin.
Con posterioridad, con la aparicin de los microordenadores y la gran expansin entre
ellos de los IBM-PC y compatibles, la ampliacin del cdigo ASCII realizada por esta

marca a 8 bits, con capacidad para 128 smbolos adicionales, experimenta un

considerable auge, siendo en la actualidad muy utilizada y recibiendo la denominacin
oficial de pgina de cdigos 437 (EEUU). Se puede consultar al final de este libro. Es
habitualmente la nica pgina soportada por las BIOS de los PC. Para ciertas
nacionalidades se han diseado otras pginas especficas que requieren de un software
externo. En las lenguas del estado espaol y en las de la mayora de los dems pases de
la UE, esta tabla cubre todas las necesidades del idioma.
1.8. - OPERACIONES LGICAS EN BINARIO.
Se realizan a nivel de bit y pueden ser de uno o dos operandos:
x NOT (x)
0

x y x AND y x OR y x XOR y
00

01

10

11

Volver al ndice

Captulo II: ARQUITECTURA E HISTORIA DE LOS

MICROORDENADORES

El ensamblador es un lenguaje de programacin que, por la traduccin directa de los

mnemnicos a instrucciones maquina, permite realizar aplicaciones rpidas, solucionando
situaciones en las que los tiempos de ejecucin constituye el factor principal para que el
proceso discurra con la suficiente fluidez. Esta situacin, que indudablemente s influye
sobre la eleccin del lenguaje de programacin a utilizar en el desarrollo de una
determinada rutina, y dada la aparicin de nuevos compiladores de lenguajes de alto nivel
que optimizan el cdigo generado a niveles muy prximos a los que un buen
programador es capaz de realizar en ensamblador, no es la nica razn para su utilizacin.
Es sobradamente conocido que los actuales sistemas operativos son programados en
su mayor parte en lenguajes de alto nivel, especialmente C, pero siempre hay una parte en
la que el ensamblador se hace casi insustituible bajo DOS y es la programacin de los
drivers para los controladores de dispositivos, relacionados con las tareas de ms bajo
nivel de una mquina, fundamentalmente las operaciones de entrada/salida en las que es
preciso actuar directamente sobre los dems chips que acompaan al microprocesador.
Por ello y porque las instrucciones del lenguaje ensamblador estn ntimamente ligadas a
la mquina, vamos a realizar primero un somero repaso a la arquitectura interna de un
microordenador.
2.1. - ARQUITECTURA VON NEWMAN.
Centrndonos en los ordenadores sobre los que vamos a trabajar desarrollar a grandes
rasgos la arquitectura Von Newman que, si bien no es la primera en aparecer, s que lo
hizo prcticamente desde el comienzo de los ordenadores y se sigue desarrollando
actualmente. Claro es que est siendo desplazada por otra que permiten una mayor
velocidad de proceso, la RISC.
En los primeros tiempos de los ordenadores, con sistemas de numeracin decimal, una
electrnica sumamente complicada muy susceptible a fallos y un sistema de
programacin cableado o mediante fichas, Von Newman propuso dos conceptos bsicos
que revolucionaran la incipiente informtica:
a) La utilizacin del sistema de numeracin binario. Simplificaba enormemente los
problemas que la implementacin electrnica de las operaciones y funciones lgicas
planteaban, a la vez proporcionaba una mayor inmunidad a los fallos (electrnica digital).

b) Almacenamiento de la secuencia de instrucciones de que consta el programa en

una memoria interna, fcilmente accesible, junto con los datos que referencia. De este
forma la velocidad de proceso experimenta un considerable incremento; recordemos que
anteriormente una instruccin o un dato estaban codificados en una ficha en el mejor de
los casos.
Tomando como modelo las mquinas que aparecieron incorporando las anteriores
caractersticas, el ordenador se puede considerar compuesto por las siguientes partes:
- La Unidad Central de Proceso, U.C.P., ms conocida por sus siglas en ingls
(CPU).
- La Memoria Interna, MI.
- Unidad de Entrada y Salida, E/S.
- Memoria masiva Externa, ME.
Realicemos a continuacin una descripcin de lo que se entiende por cada una de estas
partes y cmo estn relacionadas entre si:
- La Unidad Central de Proceso (CPU) viene a ser el cerebro del ordenador y tiene por
misin efectuar las operaciones aritmtico-lgicas y controlar las transferencias de
informacin a realizar.
- La Memoria Interna (MI) contiene el conjunto de instrucciones que ejecuta la CPU
en el transcurso de un programa. Es tambin donde se almacenan temporalmente las
variables del mismo, todos los datos que se precisan y todos los resultados que devuelve.
- Unidades de entrada y salida (E/S) o Input/Output (I/O): son las encargadas de la
comunicacin de la mquina con el exterior, proporcionando al operador una forma de
introducir al ordenador tanto los programas como los datos y obtener los resultados.
Como es de suponer, estas tres partes principales de que consta el ordenador deben
estar ntimamente conectadas; aparece en este momento el concepto de bus: el bus es un
conjunto de lneas que enlazan los distintos componentes del ordenador, por ellas se
realiza la transferencia de datos entre todos sus elementos.
Se distinguen tres tipos de bus:
- De control: forman parte de l las lneas que seleccionan desde dnde y hacia dnde
va dirigida la informacin, tambin las que marcan la secuencia de los pasos a seguir para
dicha transferencia.
- De datos: por l, de forma bidireccional, fluyen los datos entre las distintas partes
del ordenador.
- De direcciones: como vimos, la memoria est dividida en pequeas unidades de
almacenamiento que contienen las instrucciones del programa y los datos. El bus de
direcciones consta de un conjunto de lneas que permite seleccionar de qu posicin de la

memoria se quiere leer su contenido. Tambin direcciona los puertos de E/S.

La forma de operar del ordenador en su conjunto es direccionar una posicin de la
memoria en busca de una instruccin mediante el bus de direcciones, llevar la instruccin
a la unidad central de proceso -CPU- por medio del bus de datos, marcando la secuencia
de la transferencia el bus de control. En la CPU la instruccin se decodifica, interpretando
qu operandos necesita: si son de memoria, es necesario llevarles a la CPU; una vez que
la operacin es realizada, si es preciso se devuelve el resultado a la memoria.
2.2. - EL MICROPROCESADOR.
Un salto importante en la evolucin de los ordenadores lo introdujo el
microprocesador: se trata de una unidad central de proceso contenida totalmente en un
circuito integrado. Comenzaba as la gran carrera en busca de lo ms rpido, ms
pequeo; rpidamente el mundo del ordenador empez a ser accesible a pequeas
empresas e incluso a nivel domstico: es el boom de los microordenadores personales.
Aunque cuando entremos en la descripcin de los microprocesadores objeto de nuestro
estudio lo ampliaremos, har un pequeo comentario de las partes del microprocesador:
- Unidad aritmtico-lgica: Es donde se efectan las operaciones aritmticas (suma,
resta, y a veces producto y divisin) y lgicas (and, or, not, etc.).
- Decodificador de instrucciones: All se interpretan las instrucciones que van llegando
y que componen el programa.
- Bloque de registros: Los registros son celdas de memoria en donde queda
almacenado un dato temporalmente. Existe un registro especial llamado de indicadores,
estado o flags, que refleja el estado operativo del microprocesador.
- Bloque de control de buses internos y externos: supervisa todo el proceso de
transferencias de informacin dentro del microprocesador y fuera de l.
2.3. - BREVE HISTORIA DEL ORDENADOR PERSONAL Y EL DOS.
La trepidante evolucin del mundo informtico podra provocar que algn recin
llegado a este libro no sepa exactamente qu diferencia a un ordenador "AT" del viejo
"XT" inicial de IBM. Algunos trminos manejados en este libro podran ser desconocidos
para los lectores ms jvenes. Por ello, haremos una pequea introduccin sobre la
evolucin de los ordenadores personales, abarcando toda la historia (ya que no es muy
larga).

La premonicin.
En 1973, el centro de investigacin de Xerox en Palo Alto desarroll un equipo
informtico con el aspecto externo de un PC personal actual. Adems de pantalla y
teclado, dispona de un artefacto similar al ratn; en general, este aparato (denominado
Alto) introdujo, mucho antes de que otros los reinventaran, algunos de los conceptos

universalmente aceptados hoy en da. Sin embargo, la tecnologa del momento no

permiti alcanzar todas las intenciones. Alguna innovacin, como la pantalla vertical, de
formato similar a una hoja de papel (que desearan algunos actuales internautas para los
navegadores) an no ha sido adoptada: nuestros PC's siguen pareciendo televisores con
teclas, y los procesadores de textos no muestran legiblemente una hoja en vertical
completa incluso en monitores de 20 pulgadas.

El microprocesador.
El desarrollo del primer microprocesador por Intel en 1971, el 4004 (de 4 bits), supuso
el primer paso hacia el logro de un PC personal, al reducir drsticamente la circuitera
adicional necesaria. Sucesores de este procesador fueron el 8008 y el 8080, de 8 bits. Ed
Roberts construy en 1975 el Altair 8800 basndose en el 8080; aunque esta mquina no
tena teclado ni pantalla (slo interruptores y luces), era una arquitectura abierta
(conocida por todo el mundo) y cuyas tarjetas se conectaban a la placa principal a travs
de 100 terminales, que ms tarde terminaran convirtindose en el bus estndar S-100 de
la industria.
El Apple-I apareci en 1976, basado en el microprocesador de 8 bits 6502, en aquel
entonces un recin aparecido aunque casi 10 veces ms barato que el 8080 de Intel. Fue
sucedido en 1977 por el Apple-II. No olvidemos los rudimentos de la poca: el Apple-II
tena un lmite mximo de 48 Kbytes de memoria. En el mismo ao, Commodore sac su
PET con 8 Kbytes. Se utilizaban cintas de casete como almacenamiento, aunque
comenzaron a aparecer las unidades de disquete de 5. Durante finales de los 70
aparecieron muchos otros ordenadores, fruto de la explosin inicial del microprocesador.

Los micros de los 80.

En 1980, Sir Clive Sinclair lanz el ZX-80, seguido muy poco despus del ZX-81.
Estaban basados en un microprocesador sucesor del 8085 de Intel: el Z80 (desarrollado
por la empresa Zilog, creada por un ex-ingeniero de Intel). Commodore irrumpi con sus
VIC-20 y, posteriormente, el Commodore 64, basados an en el 6502 y, este ltimo, con
mejores posibilidades grficas y unos 64 Kb de memoria. Su competidor fue el ZXSpectrum de Sinclair, tambin basado en el Z80, con un chip propio para gestin de
grficos y otras tareas, la ULA, que permiti rebajar su coste y multiplic su difusin por
europa, y en particular por Espaa. Sin embargo, todos los ordenadores domsticos de la
poca, como se dieron en llamar, estaban basados en procesadores de 8 bits y tenan el
lmite de 64 Kb de memoria. Los intentos de rebasar este lmite manteniendo an esos
chips por parte de la plataforma MSX (supuesto estndar mundial con la misma suerte
que ha corrido el Esperanto) o los CPC de Amstrad, de poco sirvieron.

El IBM PC.
Y es que IBM tambin fabric su propio ordenador personal con vocacin profesional:
el 12 de agosto de 1981 present el IBM PC. Estaba basado en el microprocesador 8088,
de 16 bits, cuyas instrucciones sern las que usemos en este libro, ya que todos los

procesadores posteriores son bsicamente (en MS-DOS) versiones mucho ms rpidas

del mismo. El equipamiento de serie consista en 16 Kbytes de memoria ampliables a 64
en la placa base (y a 256 aadiendo tarjetas); el almacenamiento externo se haca en
cintas de casete, aunque pronto aparecieron las unidades de disco de 5 pulgadas y
simple cara (160/180 Kb por disco) o doble cara (320/360 Kb). En 1983 apareci el IBM
PC-XT, que traa como novedad un disco duro de 10 Mbytes. Un ao ms tarde
aparecera el IBM PC-AT, introduciendo el microprocesador 286, as como ranuras de
expansin de 16 bits (el bus ISA de 16 bits) en contraposicin con las de 8 bits del PC y el
XT (bus ISA de 8 bits), adems incorporaba un disco duro de 20 Mbytes y disquetes de
5 pero con 1.2 Mbytes.
En general, todos los equipos con procesador 286 o superior pueden catalogarse
dentro de la categora AT; el trmino XT hace referencia al 8088/8086 y similares.
Finalmente, por PC (a secas) se entiende cualquiera de ambos; aunque si se hace
distincin entre un PC y un AT en la misma frase, por PC se sobreentiende un XT, menos
potente. El trmino PC ya digo, no obstante, es hoy en da mucho ms general,
referenciando habitualmente a cualquier ordenador personal.
Alrededor del PC se estaba construyendo un imperio de software ms importante que
el propio hardware: estamos hablando del sistema operativo PC-DOS. Cuando
aparecieron mquinas compatibles con el PC de IBM, tenan que respetar la
compatibilidad con ese sistema, lo que fue sencillo (ya que Microsoft, le gustara o no a
IBM, desarroll el MS-DOS, compatible con el PC-DOS pero que no requera la BIOS
del ordenador original, cuyo copyright era de IBM). Incluso, el desarrollo de los
microprocesadores posteriores ha estado totalmente condicionado por el MS-DOS. [Por
cierto, la jugada del PC-DOS/MS-DOS se repetira en alguna manera pocos aos despus
con el OS/2-Windows].
A partir de 1986, IBM fue paulatinamente dejando de tener la batuta del mercado del
PC. La razn es que la propia IBM tena que respetar la compatibilidad con lo anterior, y
en ese terreno no tena ms facilidades para innovar que la competencia. El primer
problema vino con la aparicin de los procesadores 386: los dems fabricantes se
adelantaron a IBM y lanzaron mquinas con ranuras de expansin an de 16 bits, que no
permitan obtener todo el rendimiento. IBM desarroll demasiado tarde, en 1987, la
arquitectura Microchannel, con bus de 32 bits pero cerrada e incompatible con tarjetas
anteriores (aunque se desarrollaron nuevas tarjetas, eran caras) y la incluy en su gama de
ordenadores PS/2 (alguno de cuyos modelos era an realmente ISA). La insolente
respuesta de la competencia fue la arquitectura EISA, tambin de 32 bits pero compatible
con la ISA anterior.
Otro ejemplo: si IBM gobern los estndares grficos hasta la VGA, a partir de ah
sucedi un fenmeno similar y los dems fabricantes se adelantaron a finales de los 80
con mejores tarjetas y ms baratas; sin embargo, se perdi la ventaja de la normalizacin
(no hay dos tarjetas superiores a la VGA que funcionen igual).
EISA tambin era caro, as que los fabricantes orientales, cruzada ya la barrera de los

aos 90, desarrollaron con la norma VESA las placas con bus local (VESA Local Bus);
bsicamente es una prolongacin de las patillas de la CPU a las ranuras de expansin, lo
que permite tarjetas rpidas de 32 bits pero muy conflictivas entre s. Esta arquitectura de
bus se populariz mucho con los procesadores 486. Sin embargo, al final el estndar que
se ha impuesto ha sido el propuesto por el propio fabricante de las CPU: Intel, con su bus
PCI, que con el Pentium se ha convertido finalmente en el nico estndar de bus de 32
bits. Estas mquinas an admiten no obstante las viejas tarjetas ISA, suficientes para
algunas aplicaciones de baja velocidad (modems,... etc).

3.2. - REGISTROS DEL 8086 Y DEL 286.

Estos procesadores disponen de 14 registros de 16 bits (el 286 alguno ms, pero no se
suele emplear bajo DOS). La misin de estos registros es almacenar las posiciones de
memoria que van a experimentar repetidas manipulaciones, ya que los accesos a memoria
son mucho ms lentos que los accesos a los registros. Adems, hay ciertas operaciones
que slo se pueden realizar sobre los registros. No todos los registros sirven para
almacenar datos, algunos estn especializados en apuntar a las direcciones de memoria.
La mecnica bsica de funcionamiento de un programa consiste en cargar los registros
con datos de la memoria o de un puerto de E/S, procesar los datos y devolver el resultado
a la memoria o a otro puerto de E/S. Obviamente, si un dato slo va a experimentar un
cambio, es preferible realizar la operacin directamente sobre la memoria, si ello es
posible. A continuacin se describen los registros del 8086.
AX

SP

CS

IP

BX

BP

DS

flags

CX

SI

SS

DX

DI

ES

Registros
Registros Registro puntero
Registros punteros de
de
de instrucciones
de datos
pila e
segmento
y flags
ndices

- Registros de datos:
AX, BX, CX, DX: pueden utilizarse bien como registros de 16 bits o como dos
registros separados de 8 bits (byte superior e inferior) cambiando la X por H o L segn
queramos referirnos a la parte alta o baja respectivamente. Por ejemplo, AX se
descompone en AH (parte alta) y AL (parte baja). Evidentemente, cualquier cambio
sobre AH o AL altera AX!: valga como ejemplo que al incrementar AH se le estn
aadiendo 256 unidades a AX.

AX = Acumulador.
Es el registro principal, es utilizado en las instrucciones de multiplicacin y
divisin y en algunas instrucciones aritmticas especializadas, as como en ciertas
operaciones de carcter especfico como entrada, salida y traduccin. Obsrvese que el
8086 es suficientemente potente para realizar las operaciones lgicas, la suma y la resta
sobre cualquier registro de datos, no necesariamente el acumulador.
BX = Base.
Se usa como registro base para referenciar direcciones de memoria con
direccionamiento indirecto, manteniendo la direccin de la base o comienzo de tablas o
matrices. De esta manera, no es preciso indicar una posicin de memoria fija, sino la
nmero BX (as, haciendo avanzar de unidad en unidad a BX, por ejemplo, se puede ir
accediendo a un gran bloque de memoria en un bucle).
CX = Contador.
Se utiliza comnmente como contador en bucles y operaciones repetitivas de
manejo de cadenas. En las instrucciones de desplazamiento y rotacin se utiliza como
contador de 8 bits.
DX = Datos.
Usado en conjuncin con AX en las operaciones de multiplicacin y divisin que
involucran o generan datos de 32 bits. En las de entrada y salida se emplea para
especificar la direccin del puerto E/S.
- Registros de segmento:
Definen reas de 64 Kb dentro del espacio de direcciones de 1 Mb del 8086. Estas
reas pueden solaparse total o parcialmente. No es posible acceder a una posicin de
memoria no definida por algn segmento: si es preciso, habr de moverse alguno.
CS = Registro de segmento de cdigo (code segment).
Contiene la direccin del segmento con las instrucciones del programa. Los
programas de ms de 64 Kb requieren cambiar CS peridicamente.
DS = Registro de segmento de datos (data segment).
Segmento del rea de datos del programa.
SS = Registro de segmento de pila (stack segment).
Segmento de pila.
ES = Registro de segmento extra (extra segment).
Segmento de ampliacin para zona de datos. Es extraordinariamente til actuando
en conjuncin con DS: con ambos se puede definir dos zonas de 64 Kb, tan alejadas

como se desee en el espacio de direcciones, entre las que se pueden intercambiar datos.
- Registros punteros de pila:
SP = Puntero de pila (stack pointer).
Apunta a la cabeza de la pila. Utilizado en las instrucciones de manejo de la pila.
BP = Puntero base (base pointer).
Es un puntero de base, que apunta a una zona dentro de la pila dedicada al
almacenamiento de datos (variables locales y parmetros de las funciones en los
programas compilados).
- Registros ndices:
SI = ndice fuente (source index).
Utilizado como registro de ndice en ciertos modos de direccionamiento indirecto,
tambin se emplea para guardar un valor de desplazamiento en operaciones de cadenas.
DI = ndice destino (destination index).
Se usa en determinados modos de direccionamiento indirecto y para almacenar un
desplazamiento en operaciones con cadenas.
- Puntero de instrucciones o contador de programa:
IP = Puntero de instruccin (instruction pointer).
Marca el desplazamiento de la instruccin en curso dentro del segmento de cdigo.
Es automticamente modificado con la lectura de una instruccin.
- Registro de estado o de indicadores (flags).
Es un registro de 16 bits de los cuales 9 son utilizados para indicar diversas
situaciones durante la ejecucin de un programa. Los bits 0, 2, 4, 6, 7 y 11 son
indicadores de condicin, que reflejan los resultados de operaciones del programa; los
bits del 8 al 10 son indicadores de control y el resto no se utilizan. Estos indicadores
pueden ser comprobados por las instrucciones de salto condicional, lo que permite variar
el flujo secuencial del programa segn el resultado de las operaciones.
15 14 13 12 11 10 9 8

6 5 4 3 2 1 0

OF DF IF TF SF ZF AF PF CF
CF (Carry Flag): Indicador de acarreo. Su valor ms habitual es lo que nos
llevamos en una suma o resta.

OF (Overflow Flag): Indicador de desbordamiento. Indica que el resultado de una

operacin no cabe en el tamao del operando destino.
ZF (Zero Flag): Indicador de resultado 0 o comparacin igual.
SF (Sign Flag): Indicador de resultado o comparacin negativa.
PF (Parity Flag): Indicador de paridad. Se activa tras algunas operaciones
aritmtico-lgicas para indicar que el nmero de bits a uno resultante es par.
AF (Auxiliary Flag): Para ajuste en operaciones BCD.
DF (Direction Flag): Indicador de direccin. Manipulando bloques de memoria,
indica el sentido de avance (ascendente/descendente).
IF (Interrupt Flag): Indicador de interrupciones: puesto a 1 estn permitidas.
TF (Trap Flag): Indicador de atrape (ejecucin paso a paso).

3.4. - MODOS DE DIRECCIONAMIENTO.

Son los distintos modos de acceder a los datos en memoria por parte del procesador.
Antes de ver los modos de direccionamiento, echaremos un vistazo a la sintaxis general
de las instrucciones, ya que pondremos alguna en los ejemplos:
INSTRUCCIN

DESTINO, FUENTE

Donde destino indica dnde se deja el resultado de la operacin en la que pueden

participar (segn casos) FUENTE e incluso el propio DESTINO. Hay instrucciones, sin
embargo, que slo tienen un operando, como la siguiente, e incluso ninguno:
INSTRUCCIN

DESTINO

Como ejemplos, aunque no hemos visto an las instrucciones utilizaremos un par de

ellas: la de copia o movimiento de datos (MOV) y la de suma (ADD).
3.4.1. - ORGANIZACIN DE DIRECCIONES: SEGMENTACIN.
Como ya sabemos, los microprocesadores 8086 y compatibles poseen registros de un
tamao mximo de 16 bits que direccionaran hasta 64K; en cambio, la direccin se
compone de 20 bits con capacidad para 1Mb, hay por tanto que recurrir a algn artificio
para direccionar toda la memoria. Dicho artificio consiste en la segmentacin: se trata de
dividir la memoria en grupos de 64K. Cada grupo se asocia con un registro de segmento;
el desplazamiento (offset) dentro de ese segmento lo proporciona otro registro de 16 bits.
La direccin absoluta se calcula multiplicando por 16 el valor del registro de segmento y
sumando el offset, obtenindose una direccin efectiva de 20 bits. Esto equivale a
concebir el mecanismo de generacin de la direccin absoluta, como si se tratase de que
los registros de segmento tuvieran 4 bits a 0 (imaginarios) a la derecha antes de sumarles
el desplazamiento:
direccin = segmento * 16 + offset

En la prctica, una direccin se indica con la notacin SEGMENTO:OFFSET;

adems, una misma direccin puede expresarse de ms de una manera: por ejemplo,
3D00h:0300h es equivalente a 3D30:0000h. Es importante resaltar que no se puede
acceder a ms de 64 Kb en un segmento de datos. Por ello, en los procesadores 386 y
superiores no se deben emplear registros de 32 bit para generar direcciones (bajo DOS),
aunque para los clculos pueden ser interesantes (no obstante, s sera posible configurar
estos procesadores para poder direccionar ms memoria bajo DOS con los registros de 32
bits, aunque no resulta por lo general prctico).
3.4.2. - MODOS DE DIRECCIONAMIENTO.
- Direccionamiento inmediato: El operando es una constante situada detrs del cdigo
de la instruccin. Sin embargo, como registro destino no se puede indicar uno de
segmento (habr que utilizar uno de datos como paso intermedio).
ADD

AX,0fffh

El nmero hexadecimal 0fffh es la constante numrica que en el direccionamiento

inmediato se le sumar al registro AX. Al trabajar con ensambladores, se pueden definir
smbolos constantes (ojo, no variables) y es ms intuitivo:
dato

EQU
MOV

0fffh
AX,dato

; smbolo constante

Si se referencia a la direccin de memoria de una variable de la siguiente forma,

tambin se trata de un caso de direccionamiento inmediato:
dato
dato

DW
MO

0fffh
AX,OFFSET dato

; ahora es una variable

; AX = "direccin de memoria" de

Porque hay que tener en cuenta que cuando traduzcamos a nmeros el smbolo
podra quedar:
17F3:0A11

DW
MOV

FFF
AX,0A11

- Direccionamiento de registro: Los operandos, necesariamente de igual tamao, estn

contenidos en los registros indicados en la instruccin:
MOV
MOV

DX,AX
AH,AL

- Direccionamiento directo o absoluto: El operando est situado en la direccin

indicada en la instruccin, relativa al segmento que se trate:
MOV
MOV

AX,[57D1h]
AX,ES:[429Ch]

Esta sintaxis (quitando la 'h' de hexadecimal) sera la que admite el programa DEBUG
(realmente habra que poner, en el segundo caso, ES: en una lnea y el MOV en otra). Al
trabajar con ensambladores, las variables en memoria se pueden referenciar con etiquetas
simblicas:

dato

MOV
MOV

AX,dato
AX,ES:dato

DW

1234h

; variable del programa

En el primer ejemplo se transfiere a AX el valor contenido en la direccin

apuntada por la etiqueta dato sobre el segmento de datos (DS) que se asume por defecto;
en el segundo ejemplo se indica de forma explcita el segmento tratndose del segmento
ES. La direccin efectiva se calcula de la forma ya vista con anterioridad: Registro de
segmento * 16 + desplazamiento_de_dato (este desplazamiento depende de la posicin al
ensamblar el programa).
- Direccionamiento indirecto: El operando se encuentra en una direccin sealada por
un registro de segmento*16 ms un registro base (BX/BP) o ndice (SI/DI). (Nota: BP
acta por defecto con SS).
MOV
MOV

AX,[BP]
ES:[DI],AX

; AX = [SS*16+BP]
; [ES*16+DI] = AX

- Indirecto con ndice o indexado: El operando se encuentra en una direccin

determinada por la suma de un registro de segmento*16, un registro de ndice, SI o DI y
un desplazamiento de 8 16 bits. Ejemplos:
MOV
ADD

AX,[DI+DESP]
[SI+DESP],BX

MOV
ADD

AX,desp[DI]
desp[SI],BX

- Indirecto con base e ndice o indexado a base: El operando se encuentra en una

direccin especificada por la suma de un registro de segmento*16, uno de base, uno de
ndice y opcionalmente un desplazamiento de 8 16 bits:
MOV
MOV

AX,ES:[BX+DI+DESP]
CS:[BX+SI+DESP],CX

MOV
MOV

AX,ES:desp[BX][DI]
CS:desp[BX][SI],CX

Combinaciones de registros de segmento y desplazamiento.

Como se ve en los modos de direccionamiento, hay casos en los que se indica
explcitamente el registro de segmento a usar para acceder a los datos. Existen unos
segmentos asociados por defecto a los registros de desplazamiento (IP, SP, BP, BX, DI,
SI); slo es necesario declarar el segmento cuando no coincide con el asignado por
defecto. En ese caso, el ensamblador genera un byte adicional (a modo de prefijo) para
indicar cul es el segmento referenciado. La siguiente tabla relaciona las posibles
combinaciones de los registros de segmento y los de desplazamiento:

CS

SS

DS

ES

IP

No

No

No

SP

No

No

No

BP con prefijo por defecto con prefijo

con prefijo

BX con prefijo con prefijo por defecto

con prefijo

SI con prefijo con prefijo por defecto

con prefijo

DI con prefijo con prefijo por defecto con prefijo(1)

(1) Tambin por defecto en el manejo de cadenas.
Los 386 y superiores admiten otros modos de direccionamiento ms sofisticados, que
se vern en el prximo captulo, despus de conocer todas las instrucciones del 8086. Por
ahora, con todos estos modos se puede considerar que hay ms que suficiente. De hecho,
algunos se utilizan en muy contadas ocasiones.
3.5. - LA PILA.
La pila es un bloque de memoria de estructura LIFO (Last Input First Output: ltimo
en entrar, primero en salir) que se direcciona mediante desplazamientos desde el registro
SS (segmento de pila). Las posiciones individuales dentro de la pila se calculan sumando
al contenido del segmento de pila SS un desplazamiento contenido en el registro puntero
de pila SP. Todos los datos que se almacenan en la pila son de longitud palabra, y cada
vez que se introduce algo en ella por medio de las instrucciones de manejo de pila (PUSH
y POP), el puntero se decrementa en dos; es decir, la pila avanza hacia direcciones
decrecientes. El registro BP suele utilizarse normalmente para apuntar a una cierta
posicin de la pila y acceder indexadamente a sus elementos -generalmente en el caso de
variables- sin necesidad de desapilarlos para consultarlos.
La pila es utilizada frecuentemente al principio de una subrutina para preservar los
registros que no se desean modificar; al final de la subrutina basta con recuperarlos en
orden inverso al que fueron depositados. En estas operaciones conviene tener cuidado, ya
que la pila en los 8086 es comn al procesador y al usuario, por lo que se almacenan en
ella tambin las direcciones de retorno de las subrutinas. Esta ltima es, de hecho, la ms
importante de sus funciones. La estructura de pila permite que unas subrutinas llamen a
otras que a su vez pueden llamar a otras y as sucesivamente: en la pila se almacenan las
direcciones de retorno, que sern las de la siguiente instruccin que provoc la llamada a
la subrutina. As, al retornar de la subrutina se extrae de la pila la direccin a donde
volver. Los compiladores de los lenguajes de alto nivel la emplean tambin para pasar los
parmetros de los procedimientos y para generar en ella las variables automticas
-variables locales que existen durante la ejecucin del subprograma y se destruyen
inmediatamente despus-. Por ello, una norma bsica es que se debe desapilar siempre
todo lo apilado para evitar una prdida de control inmediata del ordenador.

6.6 - LAS FUNCIONES DEL DOS Y DE LA BIOS.

El cdigo de la BIOS, almacenado en las memorias ROM del ordenador, constituye la
primera capa de software de los ordenadores compatibles. La BIOS accede directamente
al hardware, liberando a los programas de usario de las tareas ms complejas. Parte del
cdigo de la BIOS es actualizado durante el arranque del ordenador, con los ficheros que
incluye el sistema operativo. El sistema operativo o DOS propiamente dicho se instala
despus: el DOS no realiza ningn acceso directo al hardware, en su lugar se apoya en la
BIOS, constituyendo una segunda capa de software. El DOS pone a disposicin de los
programas de usuario unas funciones muy evolucionadas para acceder a los discos y a los
recursos del ordenador. Por encima del DOS se suele colocar habitualmente al
COMMAND.COM, aunque realmente el COMMAND no constituye capa alguna de
software: es un simple programa de utilidad, como cualquier otro, ejecutado sobre el
DOS y que adems no pone ninguna funcin a disposicin del sistema (al menos,
documentada), su nica misin es cargar otros programas.
FUNCIONES DE LA BIOS
Las funciones de la BIOS se invocan, desde los programas de usuario, ejecutando una
interrupcin software con un cierto valor inicial en los registros. La BIOS emplea un
cierto rango de interrupciones, cada una encargada de una tarea especfica:
INT 10h: Servicios de Vdeo (texto y grficos).
INT 11h: Informe sobre la configuracin del equipo.
INT 12h: Informe sobre el tamao de la memoria convencional.
INT 13h: Servicios de disco (muy elementales: pistas, sectores, etc.).
INT 14h: Comunicaciones en serie.
INT 15h: Funciones casette (PC) y servicios especiales del sistema (AT).
INT 16h: Servicios de teclado.
INT 17h: Servicios de impresora.
INT 18h: Llamar a la ROM del BASIC (slo mquinas IBM).
INT 19h: Reinicializacin del sistema.
INT 1Ah: Servicios horarios.
INT 1Fh: Apunta a la tabla de los caracteres ASCII 128-255 (8x8 puntos).
La mayora de las interrupciones se invocan solicitando una funcin determinada (que
se indica en el registro AH al llamar) y se limitan a devolver un resultado en ciertos
registros, realizando la tarea solicitada. En general, slo resultan modificados los
registros que devuelven algo, aunque BP es corrompido en los servicios de vdeo de las
mquinas ms obsoletas.

FUNCIONES DEL DOS

El DOS emplea varias interrupciones, al igual que la BIOS; sin embargo, cuando se
habla de funciones del DOS, todo el mundo sobreentiende que se trata de llamar a la INT
21h, la interrupcin ms importante con diferencia.
INT 20h: Terminar programa (tal vez en desuso).
INT 21h: Servicios del DOS.
INT 22h: Control de finalizacin de programas.
INT 23h: Tratamiento de Ctrl-C.
INT 24h: Tratamiento de errores crticos.
INT 25h: Lectura absoluta de disco (sectores lgicos).
INT 26h: Escritura absoluta en disco (sectores lgicos).
INT 27h: Terminar dejando residente el programa (en desuso).
INT 28h: Idle (ejecutada cuando el ordenador est inactivo).
INT 29h: Impresin rpida en pantalla (no tanto).
INT 2Ah: Red local MS NET.
INT 2Bh-2Dh: Uso interno del DOS.
INT 2Eh: Procesos Batch.
INT 2Fh: Interrupcin Multiplex.
INT 30h-31h: Compatibilidad CP/M-80.
INT 32h: Reservada.
Las funciones del DOS se invocan llamando a la INT 21h e indicando en el registro
AH el nmero de funcin a ejecutar. Slo modifican los registros en que devuelven los
resultados, devolviendo normalmente el acarreo activo cuando se produce un error (con
un cdigo de error en el acumulador). Muchas funciones de los lenguajes de
programacin frecuentemente se limitan a llamar al DOS.
Todos los valores mostrados a continuacin son hexadecimales; el de la izquierda es
el nmero de funcin (lo que hay que cargar en AH antes de llamar); algunas funciones
del DOS se dividen a su vez en subfunciones, seleccionables mediante AL (segundo valor
numrico, en los casos en que aparece). Las funciones marcadas con U> fueron
histricamente indocumentadas, aunque Microsoft desclasific casi todas ellas a partir
del MS-DOS 5.0 (en muchas secciones de este libro, escritas con anterioridad, se las
referencia an como indocumentadas). Se indica tambin la versin del DOS a partir de
la que estn disponibles.
En general, se debe intentar emplear siempre las funciones que requieran la menor
versin posible del DOS; sin embargo, no es necesario buscar la compatibilidad con el
DOS 1.0: esta versin no soporta subdirectorios, y el sistema de ficheros se basa en el
horroroso mtodo FCB. Los FCB ya no estn soportados siquiera en la ventana de
compatibilidad DOS de OS/2, siendo recomendable ignorar su existencia y trabajar con
los handles, al estilo del UNIX, que consisten en unos nmeros que identifican a los
ficheros cuando son abiertos. Existen 5 handles predefinidos permanentemente abiertos:
0 (entrada estndar -teclado-), 1 (salida estndar -pantalla-), 2 (salida de error estndar

-tambin pantalla-), 3 (entrada/salida por puerto serie) y 4 (salida por impresora): la

pantalla, el teclado, etc. pueden ser manejados como simples ficheros.

Captulo VII: ARQUITECTURA DEL PC, AT Y PS/2 BAJO DOS

7.1. - LAS INTERRUPCIONES

Son seales enviadas a la CPU para que termine la ejecucin de la instruccin en
curso y atienda una peticin determinada, continuando ms tarde con lo que estaba
haciendo.
Cada interrupcin lleva asociado un nmero que identifica el tipo de servicio a
realizar. A partir de dicho nmero se calcula la direccin de la rutina que lo atiende y
cuando se retorna se contina con la instruccin siguiente a la que se estaba ejecutando
cuando se produjo la interrupcin. La forma de calcular la direccin de la rutina es
multiplicar por cuatro el valor de la interrupcin para obtener un desplazamiento y, sobre
el segmento 0, con dicho desplazamiento, se leen dos palabras: la primera es el
desplazamiento y la segunda el segmento de la rutina deseada. Por tanto, en el primer
kilobyte de memoria fsica del sistema, existe espacio suficiente para los 256 vectores de
interrupcin disponibles.
Hay tres tipos bsicos de interrupciones:

Interrupciones internas o excepciones: Las genera la propia CPU cuando se

produce una situacin anormal o cuando llega el caso. Por desgracia, IBM se salt
olmpicamente la especificacin de Intel que reserva las interrupciones 0-31 para
el procesador.
o

o
o

INT 0: error de divisin, generada automticamente cuando el cociente no

cabe en el registro o el divisor es cero. Slo puede ser generada mediante
DIV o IDIV. Hay una sutil diferencia de comportamiento ante esta
interrupcin segn el tipo de procesador: el 8088/8086 y los NEC V20 y
V30 almacenan en la pila, como cabra esperar, la direccin de la
instruccin que sigue a la que caus la excepcin. Sin embargo, el 286 y
superiores almacenan la direccin del DIV o IDIV que causa la excepcin.
INT 1: paso a paso, se produce tras cada instruccin cuando el procesador
est en modo traza (utilizada en depuracin de programas).
INT 2: interrupcin no enmascarable, tiene prioridad absoluta y se produce
incluso aunque estn inhibidas las interrupciones (con CLI) para indicar
un hecho muy urgente (fallo en la alimentacin o error de paridad en la
memoria).

o
o

Interrupciones hardware: Son las generadas por la circuitera del ordenador en

respuesta a algn evento. Las ms importantes son:
o

o
o
o

INT 3: utilizada para poner puntos de ruptura en la depuracin de

programas, debido a que es una instruccin de un solo byte muy cmoda
de utilizar.
INT 4: desbordamiento, se dispara cuando se ejecuta un INTO y haba
desbordamiento.
INT 5: rango excedido en la instruccin BOUND (slo 286 y superiores).
Ha sido incorrectamente empleada por IBM para volcar la pantalla por
impresora.
INT 6: cdigo de operacin invlido (slo a partir del 286). Se produce al
ejecutar una instruccin indefinida, en la pila se almacena el CS:IP de la
instruccin ilegal.
INT 7: dispositivo no disponible (slo a partir del 286).

INT 8: Se produce con una frecuencia peridica determinada por el canal

0 del chip temporizador 8253/8254 (en la prctica, unas 18,2 veces por
segundo). Como desde esta interrupcin se invoca a su vez a INT 1Ch
-porque as lo dispuso IBM-, es posible ligar un proceso a INT 1Ch para
que se ejecute peridicamente.
INT 9: generada al pulsar o soltar una tecla.
INT 0Ah, 0Bh, 0Ch, 0Dh, 0Eh, 0Fh: Puertos serie, impresora y
controladores de disquete.
INT 70h, 71h, 72h, 73h, 74h, 75h, 76h, 77h: Generadas en los AT y
mquinas superiores por el segundo chip controlador de interrupciones.

Interrupciones software: Producidas por el propio programa (instruccin INT)

para invocar ciertas subrutinas. La BIOS y el DOS utilizan algunas interrupciones
a las que se puede llamar con determinados valores en los registros para que
realicen ciertos servicios. Tambin existe alguna que otra interrupcin que se
limita simplemente a apuntar a modo de puntero a una tabla de datos.

Los vectores de interrupcin pueden ser desviados hacia un programa propio que,
adems, podra quedar residente en memoria. Si se reprograma por completo una
interrupcin y sta es de tipo hardware, hay que realizar una serie de tareas adicionales,
como enviar una seal fin de interrupcin hardware al chip controlador de interrupciones.
Si se trata adems de la interrupcin del teclado del PC o XT, hay que enviar una seal de
reconocimiento al mismo ... en resumen: conviene documentarse debidamente antes de
intentar hacer nada. Todos estos problemas se evitan si la nueva rutina que controla la
interrupcin llama al principio (o al final) al anterior gestor de la misma, que es lo ms
normal, como se ver ms adelante.

Para cambiar un vector de interrupcin existen cuatro mtodos:

1. El elegante: es adems el ms cmodo y compatible. De hecho, algunos
programas de DOS funcionan tambin bajo OS/2 si han sido diseados con esta
tcnica. Basta con llamar al servicio 25h del DOS (INT 21h) y decirle qu
interrupcin hay que desviar y a dnde:
2.
3.
4.
5.

vector
gestin

6.

MOV

AH,25h

; servicio para cambiar

MOV
LEA

AL,vector
DX,rutina

; entre 0 y 255
; DS:DX nueva rutina de

INT

21h

; llamar al DOS

7. El ps: es menos seguro y compatible (ningn programa que emplea esta

tcnica corre en OS/2) y consiste en hacer casi lo que hace el DOS pero sin
llamarle. Es adems mucho ms incmodo y largo, pero muy usado por
programadores despistados:
8.
9.
10.
11.
12.
13.

MOV
MOV
MOV
PUSH
MOV

14.

LEA

15.

CLI

16.

MOV

[BX],DX

; cambiar vector

17.

MOV

[BX+2],CS

; cambiar vector

18.

STI

19.

POP

0000
gestin
interrupcin
(offset)
(segmento)
interrupciones

BL,vector*4
BH,0
AX,0
DS
DS,AX
DX,rutina

; vector a cambiar en BL
; ahora en BX
; preservar DS
; apuntar al segmento
; CS:DX nueva rutina de
; evitar posible

; permitir
DS

; restaurar DS

20. El mtodo correcto es similar al ps, consiste en cambiar el vector de un

tirn (cambiar a la vez segmento y offset con un REP MOVS) con objeto de
evitar una posible interrupcin no enmascarable que se pueda producir en ese
momento crtico en que ya se ha cambiado el offset pero todava no el segmento
(CLI no inhibe la interrupcin no enmascarable). Este sistema es todava algo ms
engorroso, pero es el mejor y es el que utiliza el DOS en el mtodo (1).
21. El mtodo incorrecto es muy usado por los malos programadores. Es similar al
ps slo que sin inhibir las interrupciones mientras se cambia el vector, con el
riesgo de que se produzca una interrupcin cuando se ha cambiado slo medio
vector. Los peores programadores lo emplean sobre todo para cambiar INT 8
INT 1Ch, que se producen con una cadencia de 18,2 veces por segundo.

7.2. - LA MEMORIA. LOS PUERTOS DE ENTRADA Y SALIDA.

Dentro del megabyte que puede direccionar un 8086, los primeros 1024 bytes estn
ocupados por la tabla de vectores de interrupcin. A continuacin existen 256 bytes de
datos de la BIOS y otros tantos para el BASIC y el DOS. De 600h a 9FFFFh est la
memoria del usuario (casi 640 Kb). En A0000h comienza el rea de expansin de
memoria de pantalla (EGA y VGA). En B0000h comienzan otros 64 Kb de los
adaptadores de texto MDA y grficos (CGA). De C0000h a EFFFFh aparecen las
extensiones de la ROM (aadidas por las tarjetas grficas, discos duros, etc.) y en F0000h
suele estar colocada la BIOS del sistema (a veces tan slo 8 Kb a partir de FE000h). Los
modernos sistemas operativos (DR-DOS y MS-DOS 5.0 y posteriores) permiten colocar
RAM en huecos vacos por encima de los 640 Kb en las mquinas 386 (y algn 286
con cierto juego especial de chips). Esta zona de memoria sirve para cargar programas
residentes. De hecho, el propio sistema operativo se sita (en 286 y superiores) en los
primeros 64 Kb de la memoria extendida (HMA) que pueden ser direccionados desde el
DOS, dejando ms memoria libre al usuario dentro de los primeros 640 Kb. Para ms
informacin, puede consultarse el
Los puertos de entrada y salida (E/S) permiten a la CPU comunicarse con los
perifricos. Los 80x86 utilizan los buses de direcciones y datos ordinarios para acceder a
los perifricos, pero habilitando una lnea que distinga el acceso a los mismos de un
acceso convencional a la memoria (si no existieran los puertos de entrada y salida, los
perifricos deberan interceptar el acceso a la memoria y estar colocados en algn rea de
la misma). Para acceder a los puertos E/S se emplean las instrucciones IN y OUT
7.6. - LOS DISCOS.
7.6.1. - ESTRUCTURA FISICA.
Los discos son el principal medio de almacenamiento externo de los ordenadores
compatibles. Pueden ser unidades de disco flexible, removibles, o discos duros -fijos-.
Constan bsicamente de una superficie magntica circular dividida en pistas concntricas,
cada una de las cuales se subdivide a su vez en cierto nmero de sectores de tamao fijo.
Como normalmente se emplean ambas caras de la superficie, la unidad ms elemental
posee en la actualidad dos cabezas de lectura/escritura, una para cada lado del disco. Los
tres parmetros comunes a todos los discos son, por tanto: el nmero de cabezas, el de
pistas y el de sectores. El trmino cilindro i hace referencia a la totalidad de las pistas i de
todas las caras. Bajo DOS, los sectores tienen un tamao de 512 bytes (tanto en discos
duros como en disquetes) que es difcil cambiar (aunque no imposible). Los sectores se
numeran a partir de 1, mientras que las pistas y las caras lo hacen desde 0. El DOS
convierte esta estructura fsica de tres parmetros a otra: el nmero de sector lgico, que
se numera a partir de 0 (los sectores fsicos les denominaremos a partir de ahora sectores
BIOS para distinguirlos de los sectores lgicos del DOS). Para un disco de SECTPISTA

sectores BIOS por pista y NUMCAB cabezas, los sectores lgicos se relacionan con la
estructura fsica por la siguiente frmula:
Sector lgico = (sector_BIOS - 1) + cara * SECTPISTA + cilindro * SECTPISTA * NUMCAB - X1

7.6.3. - LA FAT.
Despus del sector de arranque, aparecen en el disco una serie de sectores que
constituyen la Tabla de Localizacin de Ficheros (File Alocation Table o FAT). Consiste
en una especie de mapa que indica qu zonas del disco estn libres, cules ocupadas,
dnde estn los sectores defectuosos, etc. Normalmente hay dos copias consecutivas de la
FAT (vase el offset 16 del sector de arranque), ya que es el rea ms importante del disco
de la que dependen todos los dems datos almacenados en l. No deja de resultar extrao
que ambas copias de la FAT estn fsicamente consecutivas en el disco: si
accidentalmente se estropeara una de ellas (por ejemplo, rayando con un bolgrafo el
disco) lo ms normal es que la otra tambin resultara daada. En general, muchos
programas de chequeo de disco no se molestan en verificar si ambas FAT son idnticas
(empezando por algunas versiones de CHKDSK). Por otra parte, hubiera sido mejor
eleccin haberla colocado en el centro del disco: dada la frecuencia de los accesos a la
misma, de cara a localizar los diferentes fragmentos de los ficheros, ello mejorara
notablemente el tiempo de acceso medio. Aunque cierto es que los cachs de disco y los
buffers del config.sys pueden hacer casi milagros... a costa de memoria.

7.6.7. - LA BIOS Y LOS DISQUETES.

Resulta interesante conocer el comportamiento de la BIOS en relacin a los disquetes,
ya que las aplicaciones desarrolladas bajo DOS de una u otra manera habrn de cooperar
con la BIOS por razones de compatibilidad (o al menos respetar ciertas especificaciones).
El funcionamiento del disquete se controla a travs de funciones de la INT 13h, aunque
esta interrupcin por lo general acaba llamando a la INT 40h que es quien realmente
gestiona el disco en las BIOS modernas de AT. Las funciones soportadas por esta
interrupcin son: reset del sistema de disco (reset del controlador de disquetes, envo del
comando specify y recalibramiento del cabezal), consulta del estado del disco (obtener
resultado de la ltima operacin), lectura, escritura y verificacin de sectores, formateo
de pistas, obtencin de informacin del disco y las disqueteras, deteccin del cambio de
disco, establecimiento del tipo de soporte para formateo... algunas de estas ltimas
funciones no estn disponibles en las mquinas PC/XT. La BIOS se apoya en varias
variables ubicadas en el segmento 40h de la memoria. Estas variables son las siguientes
Estado de recalibramiento del disquete. Esta variable indica varias cosas: si
Byte 40h:3Eh se ha producido una interrupcin de disquete, o si es preciso recalibrar
alguna disquetera debido a un reset anterior.

Estado de los motores. En esta variable se indica, adems del estado de los
Byte 40h:3Fh motores de las 4 posibles disqueteras (si estn encendidos o no), la ltima
unidad que fue seleccionada y la operacin en curso sobre la misma.
Cuenta para la detencin del motor. Este byte es decrementado por la
interrupcin peridica del temporizador; cuando llega a 0 todos los
motores de las disqueteras (realmente, el nico que estaba girando) son
Byte 40h:40h
detenidos. Dejar el motor girando unos segundos tras la ltima operacin
evita tener que esperar a que el motor acelere antes de la siguiente (si esta
llega poco despus).
Estado de la ltima operacin: se actualiza tras cada acceso al disco,
Byte 40h:41h
indicando los errores producidos (0 = ninguno).
A partir de esta direccin, 7 bytes almacenan el resultado de la ltima
Bytes 40h:42h operacin de disquete o disco duro. Se trata de los 7 bytes que devuelve el
NEC765 tras los principales comandos.
Control del soporte (AT). Esta variable almacena, entre otros, la ltima
Byte 40h:8Bh
velocidad de transferencia seleccionada.
Informacin del controlador de disquete (AT). Se indica si la unidad
Byte 40h:8Fh soporta 80 cilindros (pues s, la verdad) y si soporta varias velocidades de
transferencia.
Estado del soporte en la unidad A. Se indica la velocidad de transferencia a
emplear en el disquete introducido en esta unidad, si precisa o no saltos
Byte 40h:90h dobles del cabezal (caso de los disquetes de 40 cilindros en unidades de
80), y el resultado de los intentos de la BIOS (la velocidad puede ser
correcta o no, segn se haya logrado determinar el tipo de soporte).
Byte 40h:91h Lo mismo que el byte anterior, pero para la unidad B.
Byte 40h:92h Estado del soporte en la unidad A al inicio de la operacin.
Byte 40h:93h Estado del soporte en la unidad B al inicio de la operacin.
Byte 40h:94h Nmero de cilindro en curso en la unidad A.
Byte 40h:95h Nmero de cilindro en curso en la unidad B.
Adems de estas variables, la BIOS utiliza tambin una tabla de parmetros apuntada
por la INT 1Eh. Los valores para programar ciertas caractersticas del FDC segn el tipo
de disco pueden variar, aunque algunos son comunes. Esta tabla determina las principales
caractersticas de operacin del disco. Dicha tabla est inicialmente en la ROM, en la
posicin 0F000h:0EFC7h de todas las BIOS compatibles (prcticamente el 100%),
aunque el DOS suele desviarla a la RAM para poder actualizarla. El formato de la misma
es:
Se corresponde con el byte 1 del comando 'Specify' del 765, que indica el step
byte 0: rate (el tiempo de acceso cilindro-cilindro, a menudo es 0Dh = 3 6 ms) y el
head unload time (normalmente, 0Fh = 240 480 ms).
Es el byte 2 del comando 'Specify': los bits 7..1 indican el head load time
byte 1:
(normalmente 01h = 2 4 ms) y el bit 0 suele estar a 0 para indicar modo DMA.
Tics de reloj (pulsos de la interrupcin 8) que transcurren tras el acceso hasta que
byte 2:
se para el motor.

byte 3: Bytes por sector (0=128, 1=256, 2=512, 3=1024).

byte 4: Sectores por pista.
Longitud del GAP entre sectores (normalmente 2Ah en unidades de 5 y 1Bh en
byte 5:
las de 3).
byte 6: Longitud de sector (ignorado si el byte 3 no es 0).
Longitud del GAP 3 al formatear (80 en 5 y 3-DD, 84 en 5-HD y 108 en
byte 7:
3-HD).
byte 8: Byte de relleno al formatear (normalmente 0F6h).
byte 9: Tiempo de estabilizacin del cabezal en ms.
byte 10: Tiempo de aceleracin del motor (en unidades de 1/8 de segundo).

Captulo VIII: LA GESTIN DE MEMORIA DEL DOS

8.1. - TIPOS DE MEMORIA EN UN PC.

Daremos un breve repaso a los tipos de memoria asociados a los ordenadores
compatibles en la actualidad. Conviene tambin echar un vistazo al apndice I, donde se
describe de manera ms esquemtica, para completar la explicacin.
8.1.1. - Memoria convencional.
Es la memoria RAM comprendida entre los 0 y los 640 Kb; es la memoria utilizada
por el DOS para los programas de usuario. Los 384 Kb restantes hasta completar el
megabyte se reservan para otros usos, como memoria para grficos, BIOS, etc. En
muchas mquinas, un buen fragmento de esta memoria est ocupado por el sistema
operativo y los programas residentes, quedando normalmente no ms de 560 Kb a
disposicin del usuario.
8.1.2. - Memoria superior.
Este trmino, de reciente aparicin, designa el rea comprendida entre los 640 y los
1024 Kb de memoria del sistema. Entre 1989 y 1990 aparecieron programas capaces de
gestionar este rea para aprovechar los huecos de la misma que no son utilizados por la
BIOS ni las tarjetas grficas. La memoria superior no se toma de la memoria instalada en
el equipo, sino que est en ciertos chips aparte relacionados con la BIOS, los grficos,
etc. Por ello, un AT con 1 Mb de RAM normalmente posee 640 Kb de memoria
convencional y 384 Kb de memoria extendida. Los segmentos A0000 y B0000 estn
reservados para grficos, aunque rara vez se utilizan simultneamente. El segmento
C0000 contiene la ROM del disco duro en XT (en AT el disco duro lo gestiona la propio
BIOS del sistema) y/o BIOS de tarjetas grficas. El segmento D0000 es empleado

normalmente para el marco de pgina de la memoria expandida. El segmento E0000

suele estar libre y el F0000 almacena la BIOS del equipo. Los modernos sistemas
operativos DOS permiten (en los equipos 386 386sx y superiores) colocar memoria
fsica extendida en el espacio de direcciones de la memoria superior; con ello es factible
rellenar los huecos vacos y aprovecharlos para cargar programas residentes. Ciertos
equipos 286 tambin soportan esta memoria, gracias a unos chips de apoyo, pero no es
frecuente.
8.1.3. - Memoria de vdeo.
El primer adaptador de vdeo de IBM era slo para texto y empleaba 4 Kb. Despus
han ido apareciendo la CGA (16 Kb), EGA (64-256 Kb), VGA (256 Kb) y SVGA (hasta 2
Mb). Como slo hay 128 Kb reservados para grficos en el espacio de direcciones del
8086, las tarjetas ms avanzadas tienen paginada su memoria y con una serie de puertos
de E/S se indica qu fragmento del total de la memoria de vdeo est siendo direccionado
(en la VGA, slo 64 Kb en A0000).
8.1.4. - Memoria expandida.
Surgi en los PC/XT como respuesta a la necesidad de romper el lmite de los 640 Kb,
y se trata de un sistema de paginacin. Consiste en aadir chips de memoria en una
tarjeta de expansin, as como una cierta circuitera que permita colocar un fragmento de
esa memoria extra en lo que se denomina marco de pgina de memoria expandida, que
normalmente es el segmento D0000 del espacio de direcciones del 8086 (64 Kb). Este
marco de pgina est dividido en 4 bloques de 16 Kb. All se pueden colocar bloques de
16 Kb extrados de esos chips adicionales por medio de comandos de E/S enviados a la
tarjeta de expansin. Para que los programas no tengan que hacer accesos a los puertos y
para hacer ms cmodo el trabajo, surgi la especificacin LIM-EMS (Lotus-IntelMicrosoft Expanded Memory System) que consiste bsicamente en un driver instalable
desde el config.sys que pone a disposicin de los programas un amplio abanico de
funciones invocables por medio de la interrupcin 67h. La memoria expandida est
dividida en pginas lgicas de 16 Kb que pueden ser colocadas en las normalmente 4
pginas fsicas del marco de pgina. Los microprocesadores 386 (incluido obviamente el
SX) permiten adems convertir la memoria extendida en expandida, gracias a sus
mecanismos de gestin de memoria: en estas mquinas la memoria expandida es emulada
por EMM386 o algn gestor similar.
8.1.5. - Memoria extendida.
Es la memoria ubicada por encima del primer mega en los procesadores 286 y
superiores. Slo se puede acceder a la mayora de esta memoria en modo protegido, por
lo que su uso queda relegado a programas complejos o diversos drivers que la aprovechen
(discos virtuales, cachs de disco duro, etc.). Hace ya bastante tiempo se dise una
especificacin para que los programas que utilicen la memoria extendida puedan convivir
sin conflictos: se trata del controlador XMS. Este controlador implementa una serie de
funciones normalizadas que adems facilitan la utilizacin de la memoria extendida,

optimizando las transferencias de bloques en los 386 y superiores (utiliza

automticamente palabras de 32 bits para acelerar el acceso). La especificacin XMS
viene en el programa HIMEM.SYS, HIDOS.SYS y en algunas versiones del EMM386.
El controlador XMS tambin aade funciones normalizadas para acceder a la memoria
superior.
8.1.6. - Memoria cach.
Desde el punto de vista del software, es memoria (convencional, expandida o
extendida) empleada por un controlador de dispositivo (driver) para almacenar las partes
del disco de ms frecuente uso, con objeto de acelerar el acceso a la informacin. A nivel
hardware, la memoria cach es una pequea RAM ultrarrpida que acompaa a los
microprocesadores ms avanzados; los programas no tienen que ocuparse de la misma.
Tambin incorporan memorias cach algunos controladores de disco duro, aunque se trata
bsicamente de memoria normal y corriente para acelerar los accesos.
8.1.7. - Memoria shadow RAM.
Los chips de ROM no han evolucionado tanto como las memorias RAM; por ello es
frecuente que un 486 a 66 MHz tenga una BIOS de slo 8 bits a 8 Mhz. A partir de los
procesadores 386 (tambin 386sx) y superiores, existen unos mecanismos de gestin de
memoria virtual que permiten colocar RAM en el espacio lgico de direcciones de la
ROM. Con ello, es factible copiar la ROM en RAM y acelerar sensiblemente el
rendimiento del sistema, especialmente con los programas que se apoyan en la BIOS.
Tambin los chipset de la placa base pueden aadir soporte para esta caracterstica. La
shadow RAM normalmente son 384 Kb que reemplazan cualquier fragmento de ROM
ubicado entre los 640-1024Kb de RAM durante el proceso de arranque (boot) del
sistema. En ocasiones, el usuario puede optar entre 384 Kb de shadow 384 Kb ms de
memoria extendida en el programa SETUP de su ordenador.
8.1.8. - Memoria CMOS RAM.
Son 64 bytes de memoria (128 en algunas mquinas) ubicados en el chip del reloj de
tiempo real de la placa base de los equipos AT y superiores. A esta memoria se accede por
dos puertos de E/S y en ella se almacena la configuracin y fecha y hora del sistema, que
permanecen tras apagar el ordenador (gracias a las pilas). Evidentemente no se puede
ejecutar cdigo sobre la RAM CMOS (Ni pueden esconderse virus, al contrario de lo que
algunos mal informados opinan. Otra cosa es que utilicen algn byte de la CMOS para
controlar su funcionamiento).
8.1.9. - Memoria alta o HMA.
Se trata de los primeros 64 Kb de la memoria extendida (colocados entre los 1024 y
los 1088 Kb). Normalmente, cuando se intentaba acceder fuera del primer megabyte (por
ejemplo, con un puntero del tipo FFFF:1000 = 100FF0) un artificio de hardware lo
impeda, convirtiendo esa direccin en la 0:0FF0 por el simple procedimiento de poner a

cero la lnea A20 de direcciones del microprocesador en los 286 y superiores. Ese
artificio de hardware lo protagoniza el chip controlador del teclado (8042) ya que la lnea
A20 pasa por sus manos. Si se le insta a que conecte los dos extremos (enviando un
simple comando al controlador del teclado) a partir de ese momento es el
microprocesador quien controla la lnea A20 y, por tanto, en el ejemplo anterior se
hubiera accedido efectivamente a la memoria extendida. Los nuevos sistemas operativos
DOS habilitan la lnea A20 y, gracias a ello, estn disponibles otros 64 Kb adicionales.
Para ser exactos, como el rango va desde FFFF:0010 hasta FFFF:FFFF se puede acceder
a un total de 65520 bytes (64 Kb menos 16 bytes) de memoria. Tngase en cuenta que las
direcciones FFFF:0000 a la FFFF:000F estn dentro del primer megabyte. En el HMA se
cargan actualmente el DR-DOS 5.0/6.0 y el MS-DOS 5.0 y posteriores; evidentemente
siempre que el equipo, adems de ser un AT, disponga como mnimo de 64 Kb de
memoria extendida. En ciertos equipos poco compatibles es difcil habilitar la lnea A20,
por lo que el HIMEM.SYS de Microsoft dispone de un parmetro que se puede variar
probando docenas de veces hasta conseguirlo, si hay suerte (adems, hay BIOS muy
intervencionistas que dificultan el control de A20).

11.8. - LOS CONTROLADORES DE DISPOSITIVO Y EL DOS.

Una vez instalado el controlador de dispositivo, puede ser necesario para los
programas del usuario interaccionar con l. Para ello se ha definido oficialmente un
mecanismo de comunicacin: el control IOCTL. En principio, un controlador de
dispositivo puede ser hallado recorriendo la cadena de controladores de dispositivo para
localizarlo y acceder directamente a su cdigo y datos. Sin embargo, en los controladores
ms evolucionados, el mtodo IOCTL es el ms recomendable.
El control IOCTL (que permite separar el flujo de datos con el dispositivo de la
informacin de control) se ejerce por medio de la funcin 44h del DOS, siendo posible lo
siguiente:
- Averiguar los atributos de un controlador de dispositivo, a partir del nombre. Esto
permite, entre otras cosas, distinguir entre un dispositivo real y un fichero con el mismo
nombre. Seguro que el lector ha construido alguna vez un programa que abre un fichero
de salida de datos con el nombre que indica el usuario: hay usuarios muy pillines que en
lugar del clsico PEPE.TXT prefieren indicar, por ejemplo, CON, estropeando la bonita
pantalla que tanto trabajo haba costado pintar. Una solucin consiste, antes de abrir el
fichero de salida, en asegurarse de que es realmente un fichero.
- Leer del controlador o enviarle una tira de caracteres de control. Esto slo es posible
si el controlador soporta IOCTL. Por ejemplo, un driver encargado de gestionar un puerto
serie especial podra admitir cadenas del tipo "9600,n,8,1" para fijar la velocidad de
transmisin, paridad, etc. El trabajo que requiere codificar la rutina IOCTL OUTPUT,
encargada de recibir estos datos, puede en muchos casos merecer la pena.

- Averiguar el estado del controlador: saber si tiene caracteres disponibles, o si ya ha

transmitido el ltimo enviado. Esta caracterstica, entre otras, es implementada por la
orden IOCTL INPUT del controlador.
Para obtener informacin detallada acerca de la funcin 44h del DOS hay que
consultar, lgicamente, la bibliografa al respecto (recomendable el INTERRUP.LST).
Volver al ndice

Captulo XII: EL HARDWARE DE APOYO AL MICROPROCESADOR

En este captulo se mostrar detenidamente el funcionamiento de todos los chips

importantes que lleva el ordenador en la placa base y alguno de los colocados en las
tarjetas de expansin.
Nota: Por limitaciones tcnicas, al describir los circuitos integrados las seales
que son activas a nivel bajo no tendrn la tradicional barra negadora encima; en su
lugar aparecern precedidas del signo menos: -CS, -WR, -MEMR, ...
En algunos casos, acceder directamente a los chips no es necesario: en general, es
mejor dejar el trabajo al DOS, o en su defecto a la BIOS. Sin embargo, hay casos en que
es estrictamente necesario hacerlo: por ejemplo, para programar temporizaciones, hacer
sonidos, comunicaciones serie por interrupciones, acceso a discos de formato no estndar,
etc. Algunas veces bastar con la informacin que aparece en el apartado donde se
describe la relacin del chip con los PC; sin embargo, a menudo ser necesario consultar
la informacin tcnica del apartado ubicado inmediatamente antes, para lo que bastan
unos conocimientos razonables de los sistemas digitales. Los ordenadores modernos
normalmente no llevan los integrados explicados en este captulo; sin embargo, poseen
circuitos equivalentes que los emulan por completo.
12.1. - LAS CONEXIONES DEL 8088.
Resulta interesante tener una idea global de las conexiones del 8086 con el exterior de
cara a entender mejor la manera en que interacciona con el resto de los elementos del
ordenador. Se ha elegido el 8088 por ser el primer procesador que tuvo el PC; a efectos
de entender el resto del captulo es suficiente con el 8088.
El 8088 puede trabajar en dos modos: mnimo (pequeas aplicaciones) y mximo
(sistemas multiprocesador). Los requerimientos de conexin con el exterior cambian en
funcin del modo que se decida emplear, aunque una parte de las seales es comn en
ambos.

LNEAS COMUNES AL MODO MXIMO Y MNIMO DEL 8088.

AD7..0:

Address Data Bus. Son lneas multiplexadas, que pueden actuar como bus de datos o de
direcciones, evidentemente en tiempos distintos.

A15..8:

Address Bus. En todo momento almacenan la parte media del bus de direcciones.
Address/Status. Parte alta del bus de direcciones, multiplexada: cuando no salen direcciones,
la lnea S5 indica el estado del bandern de interrupciones; las lneas S4:S3 informan del
A19..16/S6..3:
registro de segmento empleado para realizar el acceso a memoria: 00-ES, 01-SS, 10-CS, 11DS; S6 no se usa.
-RD:
Read. Indica una lectura de memoria o de un dispositivo de entrada/salida.
READY:
Ready. Lnea de entrada que indica el final de la operacin de memoria o E/S.
Interrupt Request. Lnea de peticin de interrupciones enmascarables; el 8088 la observa
INTR:
peridicamente.
Test. En respuesta a la instruccin mquina WAIT (no TEST!), el 8088 se para a comprobar
-TEST:
esta lnea hasta que se ponga a 0.
Non-maskable Interrupt. Lnea de peticin de la interrupcin de tipo 2, que no puede ser
NMI:
enmascarada.
RESET:
Provoca una inicializacin interna que culmina saltando a FFFF:0.
MN/-MX:
Esta lnea indica si se trata de un sistema mnimo o mximo.

LNEAS EXCLUSIVAS DEL MODO MNIMO DEL 8088.

IO/-M:
-wr:
-INTA:
ALE:
DT/-R:
-DEN:
HOLD:
HLDA:
-SS0:

Status Line. Indica si se trata de un acceso a memoria o a un puerto de entrada/salida. No es vlida

todo el tiempo (solo a ratos).
Write. Indica una escritura en memoria o en un dispositivo de entrada/salida (segn el estado de
IO/-M).
Interrupt Acknowledge. Es la seal de reconocimiento de interrupcin (solicitada a travs de INTR
o NMI).
Address Latch Enable. Indica al exterior que las lneas de direccin contienen una direccin vlida,
con objeto de que la circuitera externa la almacene en una pequea memoria (latch). Seal
necesaria slo por culpa de la multiplexacin.
Data Transmit/Receive. Seal necesaria para emplear un transceiver 8286/8287 en el bus, con
objeto de controlar el flujo de datos a travs del mismo (si se recibe/transmite).
Data Enable. Necesario tambin para emplear el transceiver: sirve como entrada de habilitacin
para el mismo.
Hold. Lnea de entrada para solicitar al 8088 que se desconecte de los buses. Empleada por los
controladores de DMA.
Hold Acknowledge. Lnea complementaria de HOLD: el 8088 enva una seal de reconocimiento
cuando se desconecta del bus.
Status Line. Lnea de apoyo que, junto con IO/-M y DT/-R, permite determinar con precisin el
estado del bus:
IO/-M
DT/-R
-SS0
------- ------- ------1
0
0
1
0
1
1
1
0
1
1
1
0
0
0
0
0
1
0
1
0
0
1
1

Estado del bus

-----------------------------Reconocimiento de interrupcin
Lectura de puerto E/S
Escritura en puerto E/S
Estado Halt
Acceso a cdigo
Lectura de memoria
Escritura en memoria
Inactivo

LNEAS EXCLUSIVAS DEL MODO MXIMO DEL 8088.

-S0/-S1/-S2: Status. Estas lneas indican el estado del bus:

-S2
-S1
-S0
Estado del bus
------- ------- ------- -----------------------------0
0
0
Reconocimiento de interrupcin
0
0
1
Lectura de puerto E/S
0
1
0
Escritura en puerto E/S
0
1
1
Estado Halt
1
0
0
Acceso a cdigo
1
0
1
Lectura de memoria
1
1
0
Escritura en memoria
1
1
1
Inactivo
-RQ/Request/Grant. Estas patillas bidireccionales permiten a los dems procesadores conectados al
GT0..1:
bus forzar al 8088 a que libere el bus al final del ciclo en curso.
Lock. Lnea que sirve al 8088 para prohibir el acceso al bus a otros procesadores (se activa tras
la instruccin mquina LOCK y dura mientras se ejecuta la siguiente instruccin -la que sigue a
-LOCK:
LOCK, que es realmente un prefijo-). Tambin se activa automticamente en los momentos
crticos de un ciclo de interrupcin.
QS1/QS0: Queue Status. Permite determinar el estado de la cola de instrucciones del 8088.

DIFERENCIAS IMPORTANTES CON EL 8086.

El 8086 cambia el patillaje sensiblemente, aunque la mayora de las seales son
similares. En lugar de 8 lneas de datos y direcciones multiplexadas (AD0..7) el 8086
posee 16, ya que el bus de datos es de 16 bits. Existe una lnea especialmente importante
en el 8086, -BHE/S7 (Bus High Enables/Status), que normalmente indica si se accede a la
parte alta del bus de datos o no (operaciones 8/16 bits). El 8086 posee una cola de
instrucciones de 6 bytes, en lugar de 4.
FORMATO DE LAS INSTRUCCIONES DEL 8086.
Resulta absurdo estudiar la composicin binaria de las instrucciones mquina de
ningn procesador; en los casos en que sea necesario se pueden ver los cdigos con
alguna utilidad de depuracin. Sin embargo, a ttulo de curiosidad, se expone a
continuacin el formato general de las instrucciones (aunque hay algunas excepciones y
casos especiales).
+---+---+---+---+---+---+---+---+ +---+---+---+---+---+---+---+---+
+---------------------+ +---------------------+
| Cdigo de Operacin | D | W | | MOD |
REG
| REG/MEM | |
byte/palabra despl. | | byte/palabra inmed. |
+---+---+---+---+---+---+---+---+ +---+---+---+---+---+---+---+---+
+---------------------+ +---------------------+

El cdigo de operacin ocupa 6 bits; el bit D indica si es el operando fuente (=0) el

que est en el campo registro (REG) o si lo es el operando destino (=1): la razn es que el
8086 slo admite un operando a memoria, como mucho (o el fuente, o el destino, no los
dos a la vez). El bit W indica el tamao de la operacin (byte/palabra). MOD indica el
modo de direccionamiento: 00-sin desplazamiento (no existe campo de desplazamiento),
01-desplazamiento de 8 bits, 10-desplazamiento de 16 bits y 11-registro (tanto fuente

como destino estn en registro). El campo REG indica el registro involucrado en la

instruccin, que puede ser de 8 16 bits (segn indique W): 0-AX/AL, 1-CX/CL, 2DX/DL, 3-BX/BL, 4-SP/AH, 5-BP/CH, 6-SI/DH, 7-DI/BH; en el caso de registros de
segmento slo son significativos los dos bits de menor peso: 00-ES, 01-CS, 10-SS, 11DS. El campo R/M, en el caso de modo registro (MOD=11) se codifica igual que el
campo REG; en caso contrario se indica la forma en que se direcciona la memoria: 0:
[BX+SI+desp], 1: [BX+DI+desp], 2: [BP+SI+desp], 3: [BP+DI+desp], 4: [SI+desp], 5:
[DI+desp], 6: [BP+desp], 7: [BX+desp].
Volver al ndice

Captulo XIII: EL ENSAMBLADOR Y EL LENGUAJE C

El lenguaje C es sin duda el ms apropiado para la programacin de sistemas,

pudiendo sustituir al ensamblador en muchos casos. Sin embargo, hay ocasiones en que
es necesario acceder a un nivel ms bajo por razones de operatividad e incluso de
necesidad (programas residentes que economicen memoria, algoritmos rpidos para
operaciones crticas, etc.). Es entonces cuando resulta evidente la necesidad de poder
emplear el ensamblador y el C a la vez.
Para comprender este captulo, basta tener unos conocimientos razonables de C
estndar. Aqu se explicarn las funciones de librera necesarias para acceder al ms bajo
nivel, as como la manera de integrar el ensamblador y el C.
13.1 - USO DEL TURBO C y BORLAND C A BAJO NIVEL.
A continuacin veremos algunas funciones, macros y estructuras de la librera DOS.H
del Turbo C.
13.1.1 - ACCESO A LOS PUERTOS DE E/S.
int inp (int puerto);
E/S una palabra (16 bits) */
int inport (int puerto);
E/S una palabra (16 bits) */
unsigned char inportb (int puerto);
E/S un byte (8 bits) */
int outp (int puerto, int valor);
E/S una palabra (16 bits) */
void outport (int puerto, int valor);
E/S una palabra (16 bits) */
void outportb (int puerto, unsigned char valor);
E/S un byte (8 bits) */

/* leer del puerto

/* leer del puerto
/* leer del puerto
/* enviar al puerto
/* enviar al puerto
/* enviar al puerto

Aunque pueden parecer demasiadas, algunas son idnticas (caso de inp() e inport()) y
otras se diferencian slo ligeramente en el tipo de los datos devueltos, lo cual es
irrelevante si se tiene en cuenta que el dato devuelto es descartado (caso de outp() y
outport()). En general, lo normal es emplear inport() e inportb() para la entrada, as como
outport() y outportb() para la salida. Por ejemplo, para enviar el EOI al final de una
interrupcin hardware se puede ejecutar: outportb(0x20, 0x20);
13.1.2 - ACCESO A LA MEMORIA.

int peek (unsigned seg, unsigned off);

palabra (16 bits) en seg:off */
char peekb (unsigned seg, unsigned off);
(8 bits) en seg:off */
void poke (unsigned seg, unsigned off, int valor);
valor (16 bits) en seg:off */
void pokeb (unsigned seg, unsigned off, char valor);
valor (8 bits) en seg:off */
unsigned FP_OFF (void far *puntero);
de variable tipo far */
unsigned FP_SEG (void far *puntero);
segmento de variable tipo far */
void far *MK_FP (unsigned seg, unsigned off);
seg:off en puntero tipo far */

/* leer la
/* leer el byte
/* poner palabra
/* poner byte
/* obtener offset
/* obtener
/* convertir

Las funciones peek(), peekb(), poke() y pokeb() tienen una utilidad evidente de cara a
consultar y modificar las posiciones de memoria. Cuando se necesita saber el segmento
y/o el offset de una variable del programa, las macros FP_OFF y FP_SEG devuelven
dicha informacin. Por ltimo, con MK_FP es posible asignar una direccin de memoria
absoluta a un puntero far. Por ejemplo, si se declara una variable:
char far *pantalla_color;
se puede hacer que apunte a la memoria de vdeo del modo texto de los adaptadores de
color con:
pantalla_color = MK_FP (0xB800, 0);
y despus se podra limpiar la pantalla con un bucle:
*pantalla_color++=0;

for (i=0; i<4000; i++)

13.1.3 - CONTROL DE INTERRUPCIONES.

void enable(void);
equivalente a STI */
void disable(void);
equivalente a CLI */

/* habilitar interrupciones hardware,

/* inhibir interrupciones hardware,

13.1.4 - LLAMADA A INTERRUPCIONES.

Para llamar a las interrupciones es conveniente conocer antes ciertas estructuras y
uniones.
struct WORDREGS {
unsigned int
};

ax, bx, cx, dx, si, di, cflag, flags;

struct BYTEREGS {
unsigned char
};

al, ah, bl, bh, cl, ch, dl, dh;

union

REGS

struct
struct

WORDREGS x;
BYTEREGS h;

};
struct SREGS
{
unsigned int es;
int ds;
};

unsigned int cs;

unsigned int ss;

unsigned

struct REGPACK {
unsigned
r_ax, r_bx, r_cx, r_dx;
unsigned
r_bp, r_si, r_di, r_ds, r_es, r_flags;
};

A continuacin, se listan las funciones que permiten invocar las interrupciones:

int int86(int interrupcin, union REGS *entrada, union REGS *salida);
int int86x(int interrupcin, union REGS *entrada, union REGS *salida,
struct REGS *rsegmento);
void intr(int interrupcin, struct REGPACK *registros);

Las dos primeras funciones se basan en la declaracin de dos uniones: una para
entrada y otra para salida, que simbolizan los valores iniciales (antes de llamar a la
interrupcin) y finales (tras la llamada) en los registros. Si se desea que la misma unin
que indica los valores iniciales devuelva los finales, se puede indicar por duplicado:
union REGS regs;
regs.h.ah = 0;
regs.h.al = 0x13;
int86 (0x10, &regs, &regs);

/* VGA 320x200 - 256 colores */

/* cambiar modo de vdeo */

La diferencia entre int86() e int86x() reside en que la ltima permite trabajar con los
registros de segmento (la estructura SREGS se puede inicializar con los valores que
tienen que tener los registros de segmento antes de llamar a la interrupcin; a la vuelta,
dicha estructura habr sido modificada para indicar el valor devuelto en los registros de
segmento tras la interrupcin).
Hay quien prefiere trabajar con REGPACK, que con una sola estructura permite
tambin operar con los registros de segmento y la emplea tanto para enviar como para
recibir los resultados. El inconveniente, poco relevante, es que slo admite registros de 16
bits, lo que suele obligar a hacer desplazamientos y forzar el empleo de mscaras para
trabajar con las mitades necesarias:
struct REGPACK bios;
bios.r_ax = 0x13;
intr (0x10, &bios);

/* VGA 320x200 - 256 colores */

/* cambiar modo de vdeo */

13.1.5 - CAMBIO DE VECTORES DE INTERRUPCIN.

void interrupt (*getvect(int interrupcin))();

vector de interrupcin */
void setvect (int interrupcin, void interrupt (*rutina)());
establecer vector de interrupcin */

/* obtener
/*

La funcin getvect() devuelve un puntero con la direccin del vector de interrupcin

indicado. La funcin setvect() permite desviar un vector hacia la rutina de tipo interrupt
que se indica. Interrupt es una palabra clave del Turbo C que ser explicada en el futuro.
Por ahora, baste el siguiente programa de ejemplo:
void interrupt nueva_rutina();
interrupcin */
void interrupt (*vieja_rutina)();
vector inicial */
int main()
{
vieja_rutina = getvect (5);
(activada con Print Screen) */
setvect (5, nueva_rutina);
rutina de control */
. . .
. . .
. . .
setvect (5, vieja_rutina);
5 */
}
void interrupt nueva_rutina()
{
. . .
}

/* nuestra funcin de
/* variable para almacenar el

/* almacenar direccin de INT 5

/* desviar INT 5 a nuestra propia
/* resto del programa */
/* restaurar rutina inicial de INT

/* rutina de control de INT 5 */

13.1.6 - PROGRAMAS RESIDENTES.

void keep (unsigned char errorlevel, unsigned tamao);

La funcin anterior, basada en el servicio 31h del DOS, permite a un programa

realizado en C quedar residente en la memoria. Adems del cdigo de retorno, es preciso
indicar el tamao del rea residente (en prrafos). Es difcil determinar con precisin la
memoria que ocupa un programa en C. Sin embargo, en muchos casos la siguiente
frmula puede ser vlida:
keep (0,

(_SS + ((_SP + area_de_seguridad)/16) - _psp));

En los casos en que no lo sea, se le puede hacer que vuelva a serlo aumentando el
tamao del rea de seguridad (que en los programas menos conflictivos ser 0). Tanto
_psp como _SS y _SP estn definidas ya por el compilador, por lo que la lnea anterior es
perfectamente vlida (sin ms) al final de un programa.

13.1.7 - VARIABLES GLOBALES PREDEFINIDAS INTERESANTES.

_version
/* devuelve
_osmajor
/* devuelve
en el DOS 5.0 */
_osminor
/* devuelve
0 en el DOS 5.0 */
_psp
/* segmento
_stklen
/* contiene
_heaplen
/* almacena
maximizarlo) */

la versin del DOS de manera completa */

el nmero principal de versin del DOS: ej., 5
el nmero secundario de versin del DOS: ej.,
del PSP */
el tamao de la pila, en bytes */
el tamao inicial del heap, en bytes (0 para

De estas variables predefinidas, las ms tiles son quiz las que devuelven la versin
del DOS, lo que ahorra el esfuerzo que supone averiguarlo llamando al DOS o
empleando la funcin de librera correspondiente. Tambin es til _psp, que permite un
acceso a este rea del programa de manera inmediata.
13.1.8 - INSERCIN DE CDIGO EN LNEA.
void _ _emit_ _ (argumento,...);
void geninterrupt (int interrupcin);

Por medio de _ _emit_ _() se puede colocar cdigo mquina de manera directa dentro
del programa en C. No es conveniente hacerlo as porque as, ya que alterar directamente
los registros de la CPU acabar alterando el funcionamiento esperado del compilador y
haciendo fallar el programa. Sin embargo, en un procedimiento dedicado exclusivamente
a almacenar cdigo inline (en lnea), es seguro este mtodo, sobre todo si se tiene cuidado
de no alterar los registros SI y DI (empleados muy a menudo por el compilador como
variables de tipo register). Por medio de geninterrupt() se puede llamar directamente a
una interrupcin: geninterrupt (interr) es exactamente lo mismo que _ _emit_ _(0xCD,
interr) ya que 0xCD es el cdigo de operacin de INT. Por ejemplo, para volcar la
pantalla por impresora se puede ejecutar geninterrupt(5). Con los smbolos _AX, _AL,
_AH, _BX, _BL, _BH, _CX, _CL, _CH, _DX, _DL, _DH, _SI, _DI, _BP, _SP, _CS,
_DS, _ES, _SS y _FLAGS se puede acceder directamente a los registros de la CPU. Hay
que tomar tambin precauciones para evitar efectos laterales (una asignacin tipo
_DS=0x40 no afectar slo a DS).
13.1.9 - LAS PALABRAS CLAVE INTERRUPT Y ASM.
Con interrupt <declaracin_de_funcin>; se declara una determinada funcin como
de tipo interrupcin. En estas funciones, el compilador preserva y restaura todos los
registros al comienzo y final de las mismas; finalmente, retorna con IRET. Por tanto, es
til para funciones que controlan interrupciones. Para emplear esto, se debera compilar
el programa con la opcin test stack overflow y las variables tipo registro desactivadas.
Con asm se pueden insertar instrucciones en ensamblador, como se ver ms adelante.

13.2 - INTERFAZ C (BORLAND/MICROSOFT) - ENSAMBLADOR.

13.2.1 - MODELOS DE MEMORIA.
Los modelos de memoria constituyen las diversas maneras de acceder a la memoria
por parte de los compiladores de C. En el caso del Turbo C se pueden distinguir los
siguientes:
TINY: Se emplea en los programas donde es preciso apurar el consumo de memoria
hasta el ltimo byte. Los 4 registros de segmento (CS, DS, ES, SS) estn asignados a la
misma direccin, por lo que existe un total de 64 Kb donde se mezclan cdigo, datos y
pila. Los programas de este tipo pueden convertirse a formato COM.
SMALL: Se utiliza en aplicaciones pequeas. Los segmentos de cdigo y datos son
diferentes y no se solapan. Por ello, hay 64 kb para cdigo y otros 64 Kb a repartir entre
datos y pila.
Segmentos
Modelo Cdigo
Tiny
Small

Datos

Punteros
Pila

64 Kb

Cdigo Datos
near

near

64 Kb

64 Kb

near

near

Medium 1 Mb

64 Kb

far

near

Compact 64 Kb

1 Mb

near

far

Large

1 Mb

1 Mb

far

far

Huge

1 Mb

1 Mb
(Bloques > 64 Kb)

far

far

MEDIUM: Este modelo es ideal para programas largos que no manejan demasiados
datos. Se utilizan punteros largos para el cdigo (que puede extenderse hasta 1 Mb) y
cortos para los datos: la pila y los datos juntos no pueden exceder de 64 Kb.
COMPACT: Al contrario que el anterior, este modelo es el apropiado para los programas
pequeos que emplean muchos datos. Por ello, el programa no puede exceder de 64 Kb
aunque los datos que controla pueden alcanzar el Mb, ya que los punteros de datos son de
tipo far por defecto.
LARGE: Empleado en las aplicaciones grandes y tambin por los programadores de
sistemas que no tienen paciencia para andar forzando continuamente el tipo de los
punteros (para rebasar el lmite de 64 Kb). Tanto los datos como el cdigo pueden
alcanzar el Mb, aunque no se admite que los datos estticos ocupen ms de 64 Kb. Este
modo es el que menos problemas da para manejar la memoria, no siendo quiz tan lento y
pesado como indica el fabricante.

HUGE: Similar al anterior, pero con algunas ventajas: por un lado, todos los punteros
son normalizados automticamente y se admiten datos estticos de ms de 64 Kb. Por
otro, y gracias a esto ltimo, es factible manipular bloques de datos de ms de 64 Kb cada
uno, ya que los segmentos de los punteros se actualizan correctamente. Sin embargo, este
modelo es el ms costoso en tiempo de ejecucin de los programas.
13.2.2 - INTEGRACIN DE MDULOS EN ENSAMBLADOR.
LA SENTENCIA ASM
La sentencia asm permite incluir cdigo ensamblador dentro del programa C,
utilizando los mnemnicos normales del ensamblador. Sin embargo, el uso de esta
posibilidad est ms o menos limitado segn la versin del compilador. En Turbo C 2.0,
los programas que utilizan este mtodo es necesario salir a la lnea de comandos para
compilarlos con el tradicional compilador de lnea, lo cual resulta poco atractivo. En
Turbo C++ 1.0, se puede configurar adecuadamente el compilador para que localice el
Turbo Assembler y lo utilice automticamente para ensamblar, sin necesidad de salir del
entorno integrado. Sin embargo, es a partir del Borland C++ cuando se puede trabajar a
gusto: en concreto, la versin Borland C++ 2.0 permite ensamblar sin rodeos cdigo
ensamblador incluido dentro del listado C. El nico inconveniente es la limitacin del
hardware disponible: para un PC/XT, el Turbo C 2.0 es el nico compilador
aceptablemente rpido. Sin embargo, en un 286 es ms recomendable el Turbo C++,
mientras que en un 386 modesto (o incluso en un 286 potente) resulta ms interesante
emplear el Borland C++ 2.0: las versiones 3.X de este compilador son las ms adecuadas
para un 486 o superior (bajo DOS).
La sintaxis de asm se puede entender fcilmente con un ejemplo:
main()
{
int dato1, dato2, resultado;
printf("Dame dos nmeros: "); scanf("%d %d", &dato1, &dato2);
asm
asm
asm
mult:
asm
asm
asm
asm
}

push ax; push cx;

mov cx,dato1
mov ax,0h
add
loop
mov
pop

ax,dato2
mult
resultado,ax
cx; pop ax;

printf("Su producto por el peor mtodo da: %d", resultado);

Como se ve en el ejemplo, los registros utilizados son convenientemente preservados

para no alterar el valor que puedan tener en ese momento (importante para el
compilador). Tambin puede observarse lo fcil que resulta acceder a las variables. Ah,

cuidado con BP: el registro BP es empleado mucho por el compilador y no conviene

tocarlo (ni siquiera guardndolo en la pila). De hecho, la instruccin MOV CX,DATO1
ser compilada como MOV CX,[BP-algo] al ser una variable local de main().
Esta es la nica sintaxis soportada por el Turbo C 2.0; sin embargo, en las versiones
ms modernas del compilador se admiten las llaves '{' y '}' para agrupar varias sentencias
asm:
asm {
push ax; push cx;
mov cx,dato1
mov ax,0h }
mult: asm {
add ax,dato2
loop mult
mov resultado,ax
pop cx; pop ax;
}

SUBRUTINAS EN ENSAMBLADOR
Cuando las rutinas a incluir son excesivamente largas, resulta ms conveniente
escribirlas como ficheros independientes y ensamblarlas por separado, incluyndolas en
un fichero de proyecto (*.PRJ) seleccionable en los mens del compilador.
Para escribir este tipo de rutinas hay que respetar las mismas definiciones de
segmentos que realiza el compilador. Hoy en da existe algo ms de flexibilidad; sin
embargo, aqu se expone el mtodo general para mezclar cdigo de ensamblador con C.
Veamos el siguiente programa en C:
int variable;
extern dato;
extern funcion();
main()
{
int a=21930; char b='Z';
variable = funcion (a, b, 0x12345678);
}

La variable variable es una variable global del programa a la que no se asigna valor
alguno en el momento de definirla. Tanto a como b son variables locales del
procedimiento main() y son asignadas con un cierto valor inicial; funcion() no aparece
por ningn sitio, ya que ser codificada en ensamblador en un fichero independiente. A
dicha funcin se le pasan 3 parmetros. La manera de hacerlo es colocndolos en la pila
(empezando por el ltimo y acabando por el primero). Por ello, el compilador meter

primero en la pila el valor 1234h y luego el 5678h (necesita dos palabras de pila porque
es un dato de tipo long). Luego coloca en la pila el carcter almacenado en la variable b:
como los valores que se apilan son siempre de 16 bits, la parte alta est a 0. Finalmente,
deposita el dato entero a. Seguidamente, llama a la funcin funcion() con un CALL que
puede ser de dos tipos: corto (CALL/RET en el mismo segmento) o largo (CALL/RETF
entre distintos segmentos). Esta llamada a la funcin, por tanto, provoca un
almacenamiento adicional de 2 bytes (modelos TINY, SMALL y COMPACT) o 4 (en los
restantes modelos de memoria, que podramos llamar largos).
El esqueleto de la subrutina en ensamblador que ha de recibir esos datos y, tras
procesarlos, devolver un resultado de tipo int es el siguiente:
DGROUP

GROUP

_DATA

SEGMENT WORD PUBLIC 'DATA'

PUBLIC _dato
; _dato ser accesible desde el

programa C
_dato
_DATA
_BSS
_info
_BSS
_TEXT

DW
ENDS

_DATA, _BSS

; valor inicial a 0

SEGMENT
WORD PUBLIC 'BSS'
EXTRN _variable:WORD
; variable externa
DW
?
; sin valor inicial
ENDS
SEGMENT BYTE PUBLIC 'CODE'
ASSUME CS:_TEXT,DS:DGROUP,SS:DGROUP
PUBLIC _funcion

; _funcion ser accesible desde

PROC
PUSH
MOV
MOV
MOV
MOV
MOV
; ...
; ...
ADD
ADD
SUB
; ...
; ...
MOV
MOV
POP
RET
ENDP

NEAR
BP
BP,SP
BX,[BP+4]
CX,[BP+6]
AX,[BP+8]
DX,[BP+10]

; funcion() del C

CX,BX
CX,AX
CX,DX

; cuerpo de la funcin

AX,CX
SP,BP
BP

; resultado (tipo int)

el programa C
_funcion

_funcion

;
;
;
;

recuperar variable 'a'

recuperar variable 'b'
AX = 5678h
DX = 1234h -> DX:AX = 12345678h

_TEXT

ENDS
END

Como se puede observar, se respetan ciertas convenciones en cuanto a los nombres de

los segmentos y grupos. En el segmento _DATA se definen las variables inicializadas (las
que tienen un valor inicial): _dato podra haber sido accedida perfectamente desde el
programa en C, ya que es declarada como pblica. Por otro lado, en el segmento _BSS se
definen o declaran las variables que no son inicializadas con un valor inicial (como es el
caso de la variable _variable del programa C, que fue definida simplemente como int
variable: en el listado ensamblador se la declara como externa ya que est definida en el
programa C). El compilador de C precede siempre de un subrayado a todas las variables y
funciones cuando compila, motivo por el cual hay que hacer lo propio en el listado
ensamblador. Al tratarse de un modelo de memoria pequeo, _BSS y _DATA estn
agrupados. En el segmento _TEXT se almacena el cdigo, es decir, las funciones
definidas: en nuestro caso, slo una (el procedimiento _funcion). Como es de tipo NEAR,
slo se podr emplear con programas C compilados en un modelo de memoria TINY,
SMALL o COMPACT (para los dems modelos hay que poner FAR en lugar de NEAR).
Esta funcin de ejemplo en ensamblador no utiliza ninguna variable, pero tanto _variable
(la variable del programa C) como, por supuesto, _info o _dato son plenamente
accesibles.
A la hora de acceder a las variables, hay que tener en cuenta el modelo de memoria:
como no emplea ms de 64 Kb para cdigo (modelos TINY, SMALL o COMPACT), el
compilador slo ha colocado en la pila el offset de la direccin de retorno (registro IP).
Nosotros apilamos despus BP (ya que lo vamos a manchar) por lo que el ltimo dato que
apil el programa C antes de llamar a la rutina en ensamblador habr de ser accedido en
[BP+4]. La ventaja de inicializar BP es que luego se pueden introducir datos en la pila sin
perder la posibilidad de acceder a los parmetros de la rutina que llama. Si el
procedimiento fuera de tipo FAR (modelos MEDIUM, LARGE y HUGE), todos los
accesos indexados sobre la pila se incrementaran en dos unidades (por ejemplo, [BP+6]
en vez de [BP+4] para acceder a la variable a) debido a que tambin se habra
almacenado CS en la llamada. Como se puede observar, la rutina no preserva ni restaura
todos los registros que va a emplear: slo es necesario devolver intactos DS, SS, BP y
(por si se emplean variables register) SI y DI; los dems registros pueden ser libremente
alterados. Como la funcin es de tipo entero, devuelve el resultado en AX; si fuera de tipo
long lo devolvera en DX:AX.
El modelo de memoria tambin cuenta en los parmetros que son pasados a la rutina
en ensamblador cuando no son pasados por valor (es decir, cuando se pasan punteros). En
el ejemplo, podramos haber pasado un puntero que podra ser de tipo corto (para cargarlo
en BX, por ejemplo, y efectuar operaciones tipo [BX]). Sin embargo, si se pasan punteros
a variables de tipo far (o si se emplea un modelo de memoria COMPACT, LARGE o
HUGE) es necesario cargar la direccin con una instruccin LES de 32 bits.
Esta rutina de ejemplo en ensamblador es slo demostrativa, por lo que no debe el
lector intentar encontrar alguna utilidad prctica, de ah que incluso ni siquiera emplee

todas las variables que define.

Evidentemente, cuando el programa C retome el control, habr de equilibrar la pila
sumando 8 unidades a SP (para compensar las 4 palabras que apil antes de llamar a la
funcin en ensamblador). En general, el funcionamiento general del C en las llamadas a
procedimientos se basa en apilar los parmetros empezando por el ltimo y llamar al
procedimiento: ste, a su vez, preserva BP y lo hace apuntar a dichos parmetros (a los
que acceder con [BP+desp]); a continuacin, le resta a SP una cantidad suficiente para
que quepan en la pila todas las variables locales (a las que acceder con [BP-desp]); antes
de retornar restaura el valor inicial de SP y recupera BP de la pila. Es entonces cuando el
procedimiento que llam, al recuperar el control, se encarga de sumar el valor adecuado a
SP para equilibrar la pila (devolverla al estado previo a la introduccin de los
parmetros).
Desde las rutinas en ensamblador tambin se puede llamar a las funciones del
compilador, apilando adecuadamente los parmetros en la pila (empezando por el ltimo)
y haciendo un CALL al nombre de la funcin precedido de un subrayado: no olvidar
nunca al final sumar a SP la cantidad necesaria para reequilibrar la pila.
AVISO IMPORTANTE: Algo a tener en cuenta es que el compilador de C es sensible
a las maysculas: funcion() no es lo mismo que FUNCION(). Por ello, al ensamblar, es
obligatorio emplear como mnimo el parmetro /mx del ensamblador con objeto de que
no ponga todos los smbolos automticamente en maysculas (con /mx se respetan las
minsculas en los smbolos globales y con /ml en todos los smbolos). En MASM 6.0, el
equivalente a /mx es /Cx y la opcin /Cp se corresponde con /ml.
Volver al ndice

Apndice I - MAPA DE MEMORIA BAJO MS-DOS y DR-DOS 6.0

La memoria convencional en las mquinas ms potentes est casi enteramente a

disposicin del usuario, aunque en los PC/XT el ncleo del sistema operativo ocupa un
buen fragmento de la misma (unos 45 Kb). En los 286 y superiores, el ncleo del sistema
se ubica en el HMA (primeros 64 Kb de la memoria extendida). La memoria de vdeo
est dividida en dos bloques de 64 Kb: el ubicado entre A0000-AFFFF lo emplean la
EGA, VGA y SuperVga en modo grfico. El segundo, entre B0000-BFFFF es usado por
la CGA y la Hrcules, tambin en modo grfico. En modo de texto, el adaptador
monocromo de IBM (primeros PC sin grficos) emplea 4 Kb a partir de B0000; el
adaptador de color utiliza 16 kb a partir de B8000. Las EGA/VGA soportan ambos tipos
de pantallas de texto; las tarjetas bifrecuencia tambin. Entre C0000 y CFFFF puede
estar ubicada la BIOS de la VGA (normalmente entre C0000 y C7FFF) o las BIOS de
discos duros de XT, el resto de este segmento (en 386) es memoria superior donde cargar
los programas residentes con HILOAD (o LOADHIGH en MS-DOS) que as no ocupan
memoria convencional. Los segmentos de 64 Kb que comienzan en D0000 y E0000
pueden contener extensiones de la BIOS (normalmente discos duros de XT) o tambin
memoria superior. Uno de los dos puede ser empleado para la ventana de memoria
expandida EMS (PC/XT/AT), normalmente el primero. En F0000 est colocada la ROM
BIOS (aunque en PC/XT es frecuente que slo estn ocupados los ltimos 8 Kb; en los
AT suele ubicarse un programa SETUP que permite al usuario definir la configuracin de
la mquina). Por encima, los primeros 64 Kb de memoria extendida son accesibles
incluso desde el modo real del 286 y 386, siempre que la lnea de direcciones A20 est
habilitada (lo que sucede a partir del DR-DOS y del MS-DOS 5.0). Para ello, con
CS=FFFF se puede acceder a 65520 bytes (casi 64Kb) de RAM adicionales donde se
puede cargar el ncleo del sistema operativo y quiz algn que otro programa residente
(DR-DOS 6.0). El resto de la memoria en mquinas 286/386 es memoria extendida, que
puede ser direccionada por controladores de disco virtual o cachs de disco duro, e
incluso -en 386- puede ser convertida por software en memoria expandida paginable en el
segmento (dentro del primer mega) habilitado al efecto.
Volver al ndice

Apndice II - TABLA DE INTERRUPCIONES DEL SISTEMA

INT 00:
INT 01:
INT 02:
INT 03:
INT 04:
INT 05:
INT 06:
INT 07:
INT 08:
INT 09:
INT 0A:
INT 0B:
INT 0C:
INT 0D:
INT 0E:
INT 0F:
INT 10:
INT 11:
INT 12:
INT 13:
INT 14:
INT 15:
INT 16:
INT 17:
INT 18:
INT 19:
INT 1A:
INT 1B:
INT 1C:
INT 1D:
INT 1E:
INT 1F:
INT 20:
INT 21:
INT 22:
INT 23:
INT 24:

Divisin por cero

Ejecucin paso a paso
No Enmascarable (NMI)
Puntos de ruptura
Desbordamiento (INTO)
Volcar pantalla por impresora (BIOS)
Cdigo de operacin incorrecto
Reservada
IRQ 0: Contador de hora del sistema (BIOS)
IRQ 1: Interrupcin de teclado (BIOS)
IRQ 2: canal E/S, segundo 8259 del AT
IRQ 3: COM2
IRQ 4: COM1
IRQ 5: disco duro XT, LPT2 en AT, retrazo vertical PCjr
IRQ 6: Controlador del disquete
IRQ 7: LPT1
Servicios de vdeo (BIOS)
Listado del equipo (BIOS)
Tamao de memoria (BIOS)
Servicios de disco (BIOS)
Comunicaciones en serie (BIOS)
Servicios del sistema (BIOS)
Servicios de teclado (BIOS)
Servicios de impresora (BIOS)
IBM Basic (ROM del BASIC)
Arranque del sistema (BIOS)
Fecha/hora del sistema
Accin de CTRL-BREAK (BIOS)
Proceso peridico del usuario (Usuario)
Parmetros de vdeo (BIOS)
Parmetros del disquete (BIOS)
Tabla de caracteres grficos (BIOS)
Fin de programa (DOS)
Servicio del sistema operativo (DOS)
Direccin de terminacin (DOS)
DOS CTRL-BREAK (DOS)
Manipulador de errores crticos (DOS)

INT 25:
INT 26:
INT 27:
INT 28:
INT 29:
INT 2A:
INT 2B-2D:
INT 2E:
INT 2F:
INT 30:
INT 31:
INT 32:
INT 33:
INT 34-3F:
INT 40:
INT 41:
INT 42:
INT 43:
INT 44-45:
INT 46:
INT 47-49:
INT 4A:
INT 4B-5F:
INT 60-66:
INT 67:
INT 68-6F:
INT 70:
INT 71:
INT 72:
INT 73:
INT 74:
INT 75:
INT 76:
INT 77:
INT 78-7F:
INT 80-85:
INT 86-F0:
INT F1-FF:

Lectura absoluta de disco (DOS)

Escritura absoluta en disco (DOS)
Terminar permaneciendo residente (DOS)
DOS Idle (programas residentes que usan funciones DOS)
DOS TTY (impresin en pantalla)
Red local MS net
Uso interno del DOS
Procesos Batch (DOS)
Multiplex (DOS)
Compatibilidad CP/M-80 (xx:YYyy en JMP XXxx:YYyy)
Compatibilidad CP/M-80 (XX en JMP XXxx:YYyy)
Reservada
Controlador del ratn
Reservadas
Interrupcin de disquete (BIOS)
Parmetros del disco duro 1 (BIOS)
Apunta a la INT 10h original del BIOS si existe VGA
Caracteres grficos EGA (BIOS)
Reservadas
Parmetros del disco duro 2 (BIOS)
Reservadas
Alarma del usuario
Reservadas
Para uso de los programas
Interrupcin de EMS (controlador EMS)
Reservadas
IRQ 8: Reloj de tiempo real AT (2 chip 8259-AT)
IRQ 9: IRQ 2 redireccionada (2 chip 8259-AT)
IRQ 10: reservada (2 chip 8259-AT)
IRQ 11: reservada (2 chip 8259-AT)
IRQ 12: interrupcin de ratn IBM (2 chip 8259-AT)
IRQ 13: error de coprocesador matemtico (2 chip 8259-AT)
IRQ 14: controlador disco fijo (2 chip 8259-AT)
IRQ 15: reservada (2 chip 8259-AT)
Reservadas
Reservadas para el Basic
Usadas por el Basic
Para uso de los programas

Volver al ndice

Apndice III - TABLA DE VARIABLES DE LA BIOS

La siguiente informacin procede del fichero MEMORY.LST de Robin Walker,

incluido en el mismo paquete del INTERRUP.LST. La informacin est actualizada
mayoritariamente al 24/8/92. Se han eliminado aspectos demasiado tcnicos sobre las
tarjetas EGA/VGA y alguna informacin sobre hardware no estndar.
Las variables de la BIOS comienzan en el segmento de memoria 40h, justo despus
de la tabla de vectores de interrupcin. Son empleadas por los programas de control
ubicados en las memorias ROM del ordenador. En general, siempre es preferible utilizar
una funcin de la BIOS que modificar directamente sus variables, aunque a veces ello no
es posible o puede no resultar conveniente. Los campos colocados entre llaves ('{' y '}')
no estn documentados por IBM y podran cambiar en el futuro. Los cdigos entre
corchetes indican a qu mquinas o configuraciones, en exclusiva, se aplica la
informacin.
Offset
00h

Tamao
WORD

Descripcin

WORD

Direccin E/S base del segundo puerto serie (0 si no

Direccin E/S base del primer puerto serie (0 si no

instalado)

02h

instalado)

04h

WORD

Direccin E/S base del tercer puerto serie (0 si no

06h

WORD

Direccin E/S base del cuarto puerto serie (0 si no

instalado)
instalado)
orden por

el programa POST de la BIOS que inicializa el

sistema, sin
BIOS pueden

08h

Nota: Los campos de arriba son rellenados en estricto

WORD

dejar huecos. Los puertos serie del DOS y de la

redefinirse modificando estos campos.
Direccin E/S base del primer puerto paralelo (0 si

no instalado)

0Ah

WORD

Direccin E/S base del segundo puerto paralelo (0 si

0Ch

WORD

Direccin E/S base del tercer puerto paralelo (0 si

no instalado)
no instalado)

0Eh

WORD

si no instalado)

orden por

[Mquinas no PS]:
Direccin E/S base del cuarto puerto paralelo (0
[Mquinas PS]:
Segmento del rea de datos extendida de la BIOS
Nota: Los campos de arriba son rellenados en estricto

sistema, sin

dejar huecos. Los puertos paralelo del DOS y de

la BIOS

10h

WORD

interno

pueden redefinirse modificando estos campos.

Hardware instalado:
bits 15-14: nmero de puertos paralelos
bit
13: [PC Convertible] = 1 si hay modem
bit
12: reservado
bits 11- 9: nmero de puertos serie
bit
8: reservado
bits 7- 6: nmero de disqueteras - 1
bits 5- 4: modo de vdeo inicial
00b = EGA,VGA,PGA
01b = 40 x 25 color
10b = 80 x 25 color
11b = 80 x 25 mono
bit
3: reservado
bit
2: [mquinas PS] = 1 si hay dispositivo

apuntador

bit
bit

arrancar

12h

el programa POST de la BIOS que inicializa el

BYTE

fabricacin}

[mquinas no PS] reservado

1: = 1 si hay coprocesador
0: = 1 si hay disquete disponible para

[PC Convertible] estado del POST

[AT] {Banderines de inicializacin de los test de

13h
15h
16h

WORD
BYTE
BYTE

17h

BYTE

18h

BYTE

19h

BYTE

Tamao de memoria convencional en kbytes (0-640)

[AT] {Usado en los test de fabricacin}
[AT] {Usado en los test de fabricacin}
[PS/2 Mod 30] Banderines de control de la BIOS
Banderines de estado del teclado 1:
bit 7 =1 INSert activo
bit 6 =1 Caps Lock activo
bit 5 =1 Num Lock activo
bit 4 =1 Scroll Lock activo
bit 3 =1 cualquier Alt pulsado
bit 2 =1 cualquier Ctrl pulsado
bit 1 =1 Shift izquierdo pulsado
bit 0 =1 Shift derecho pulsado
Banderines de estado del teclado 2:
bit 7 = 1 INSert pulsado
bit 6 = 1 Caps Lock pulsado
bit 5 = 1 Num Lock pulsado
bit 4 = 1 Scroll Lock pulsado
bit 3 = 1 Estado de pausa activo
bit 2 = 1 Sys Req pulsada
bit 1 = 1 Alt izquierdo pulsado
bit 0 = 1 Ctrl izquierdo pulsado
Teclado: Area de trabajo para Alt-nnn (nnn=teclado

1Ah
1Ch

WORD
WORD

Teclado: puntero al prximo carcter en el buffer

Teclado: puntero a la primera entrada vaca en el

numrico)

buffer

1Eh 16 WORDs

Buffer del teclado (cola circular, ver offsets 80h y

82h para moverlo)

3Eh

BYTE

del disquete

3Fh

BYTE

formateo
verificacin

Estado de recalibracin del disquete:

bit 7 = 1 Se ha producido interrupcin hardware
bits 6-4 reservados
bit 3 = 1 Recalibrada disquetera 3
bit 2 = 1 Recalibrada disquetera 2
bit 1 = 1 Recalibrada disquetera 1
bit 0 = 1 Recalibrada disquetera 0
Estado del motor del disquete:
bit 7 = 1 la operacin en curso es escritura o
= 0 la operacin en curso es lectura o

bit 6
reservado
bits 5-4 nmero de disquetera seleccionada (0-3)
bit 3 = 1 motor de la disquetera 3 en marcha
bit 2 = 1 motor de la disquetera 2 en marcha
bit 1 = 1 motor de la disquetera 1 en marcha
bit 0 = 1 motor de la disquetera 0 en marcha
40h
BYTE
Contador de tics de reloj que faltan para parar
motor de la disquetera
41h
BYTE
Estado de la ltima operacin de disco (0 =
correcta)
bit 7 = 1 unidad no preparada
bit 6 = 1 error de posicionamiento del cabezal
bit 5 = 1 fallo general del controlador
bits 4-0:
00h no hay error
01h solicitud incorrecta
02h no encontrada la marca de direcciones
03h error de proteccin contra escritura
04h sector no encontrado
06h lnea de disco cambiado activa
08h el DMA se ha desbordado
09h el DMA ha cruzado una frontera de 64k
0Ch medio fsico desconocido
10h fallo de CRC al leer
42h 7 BYTEs
Bytes de estado/comandos de la Disquetera/Disco fijo
49h
BYTE
Modo de vdeo activo
4Ah
WORD
Nmero de columnas en pantalla
4Ch
WORD
Tamao del buffer de vdeo de la pgina activa en
bytes
4Eh
WORD
Desplazamiento sobre la memoria de pantalla de la
pgina activa
50h 16 BYTEs
Posicin del cursor (columna, fila) para las 8
pginas
60h
WORD
Tipo de cursor, compatible 6845, byte alto=lnea
inicial, bajo=final
62h
BYTE
Pgina activa
63h
WORD
Direccin E/S base del controlador de vdeo:
color=03D4h, mono=03B4h

65h

BYTE

Valor actual del registro de seleccin de modo

03D8h/03B8h

66h

BYTE

Valor actual almacenado en el registro de paleta de

67h

DWORD

Punto de retorno al modo real tras ciertos resets

6Bh
6Ch

BYTE
DWORD

Ultima interrupcin no esperada por el POST

Tics de reloj (1/18,2 segundos) ocurridos desde

70h

BYTE

Flag de medianoche, <> 0 si el contador pasa de las

la CGA 03D9h
del POST

medianoche

23:59:59.99

71h
72h

BYTE
WORD

(arranque caliente)
al arrancar

74h

BYTE

Bandern de Ctrl-Break: bit 7=1

Bandern de reset del POST:
= 1234h si no realizar chequeo de memoria
= 4321h [solo PS/2 MCA] si preservar la memoria
= 5678h [PC Convertible] sistema detenido
= 9ABCh [PC Convertible] test de fabricacin
= ABCDh [PC Convertible] bucle del POST
=
64h modo Burn-in
Estado de la ltima operacin del disco fijo: {salvo

unidades ESDI}

disco

formateo

75h
76h

00h
01h
02h
03h
04h
05h
07h

no hubo error
funcin solicitada incorrecta
no encontrada marca de direcciones
error de proteccin contra escritura
sector no encontrado
fallo en el reset
fallo en la actividad de los parmetros del

08h
09h
0Ah
0Bh
0Dh

el DMA se ha desbordado
alineamiento de datos incorrecto para el DMA
detectado bandern de sector errneo
detectada pista errnea
nmero incorrecto de sectores para el

BYTE
BYTE

0Eh detectada marca de direcciones de control

0Fh nivel de arbitrio del DMA fuera de rango
10h error ECC o CRC incorregible
11h error de datos ECC corregido
20h fallo general del controlador
40h fallo en el posicionamiento del cabezal
80h fuera de tiempo, no responde
AAh disco no preparado
BBh error indefinido
CCh fallo de escritura en el disco seleccionado
E0h el registro de errores es cero
FFh fallo de sentido
Disco fijo: nmero de discos fijos
Disco fijo: byte de control {IBM lo documenta slo

BYTE

Disco fijo: offset del puerto E/S {IBM lo documenta

en el XT}

77h

slo en el XT}

78h

3 BYTEs

Contadores de time-out para los puertos paralelos

1-3

7Bh

no PS]

BYTE

Contador time-out para puerto paralelo 4 [mquinas

bit 5 = 1 si especificacin de DMA virtual

soportada [PS] (ver INT 4B)
7Ch 4 BYTEs
Contadores de time-out para los puertos serie 1-4
80h
WORD
Offset de inicio del buffer del teclado respecto al
segmento 40h
(normalmente 1Eh)
82h
WORD
Offset del fin del buffer del teclado+1 respecto al
segmento 40h
(normalmente 3Eh)
[La BIOS del XT con fecha 8/11/82 acaba aqu]

84h
85h

BYTE
WORD

87h

BYTE

Vdeo: lneas en pantalla menos 1 en EGA/MCGA/VGA

Video: altura del carcter, en pixels, en

EGA/MCGA/VGA

Vdeo: control de EGA/VGA.

bit 7: = 1 si no limpiar RAM (ver INT 10h, AH=0)
88h
BYTE
Vdeo: switches EGA/VGA [MCGA: reservado]
89h
BYTE
Vdeo: MCGA/VGA opcin de control del modo
8Ah
BYTE
Vdeo [MCGA/VGA]: ndice en tabla Cdigos de
Combinaciones de Pantalla
8Bh
BYTE
Control del medio fsico del disco [no XT]:
bits 7-6: Ultima tasa de transferencia fijada por
el controlador:
00=500kbps, 01=300kbps, 10=250kbps,
11=1Mbps
bits 5-4: Ultimo step rate seleccionado en el
disquete:
00-0Ch, 01=0Dh, 10=0Eh, 11=0Ah
bits 3-2: {Tasa de transferencia al inicio de la
operacin}
bits 1-0: reservado
8Ch
BYTE
Estado del controlador del disco fijo [no XT]
8Dh
BYTE
Estado de error del controlador de disco fijo [no
XT]
8Eh
BYTE
Control de interrupciones del disco fijo [no XT]
8Fh
BYTE
Informacin del controlador de disquete [no XT]:
bit 7: reservado
bit 6: = 1 si disco 1 determinado
bit 5: = 1 si disco 1 es multi-ratio, vlido si
disco determinado
bit 4: = 1 si disco 1 soporta 80 pistas, siempre
vlido
bit 3: reservado
bit 2: = 1 si disco 0 determinado
bit 1: = 1 si disco 0 es multi-ratio, vlido si
disco determinado
bit 0: = 1 si disco 0 soporta 80 pistas, siempre
vlido

90h
91h

BYTE
BYTE

Estado fsico de la disquetera 0

Estado fsico de la disquetera 1
bits 7-6:
tasa de transferencia a disquete:
00=500kbps, 01=300kbps,
10=250kbps, 11=1Mbps
bit
5: = 1 si doble salto de pista requerido
(e.g. 360Kb en 1.2Mb)
bit
4: = 1 si superficie ya determinada
bit
3: reservado
bits 2-0: a la salida de la BIOS, contiene:
000 intentando 360Kb en 360Kb
001 intentado 360Kb en 1.2Mb
010 intentando 1.2MB en 1.2Mb
011 determinado 360Kb en 360Kb
100 determinado 360Kb en 1.2Mb
101 determinado 1.2Mb en 1.2Mb (contina
en pg siguiente)
110 reservado
111 todos los dems formatos
92h
BYTE
Estado fsico de la disquetera 0 al inicio de la
operacin
93h
BYTE
Estado fsico de la disquetera 1 al inicio de la
operacin
94h
BYTE
Nmero de pista en curso de la disquetera 0
95h
BYTE
Nmero de pista en curso de la disquetera 1
96h
BYTE
Estado del teclado, byte 1
bit 7 = 1 proceso de lectura de ID en marcha
bit 6 = 1 el ltimo cdigo ledo fue el primero
de dos cdigos ID
bit 5 = 1 forzar Num Lock si se lee el ID y es un
teclado expandido
bit 4 = 1 teclado expandido instalado
bit 3 = 1 Alt derecho pulsado
bit 2 = 1 Ctrl derecho pulsado
bit 1 = 1 ltimo cdigo ledo fue E0h
bit 0 = 1 ltimo cdigo ledo fue E1h
97h
BYTE
Estado del teclado, byte 2
bit 7 = 1 error de transmisin del teclado
bit 6 = 1 actualizacin de LEDs en curso
bit 5 = 1 cdigo RESEND recibido del teclado
bit 4 = 1 cdigo ACK recibido del teclado
bit 3 reservado, debe ser cero
bit 2 LED de Caps Lock
bit 1 LED de Num Lock
bit 0 LED de Scroll Lock
98h
DWORD
Timer2: [AT, PS excepto Mod 30] puntero al bandern
de espera de
usuario completada (ver INT 15, AX=8300h)
9Ch
DWORD
Timer2: [AT, PS exc Mod 30] contador de espera del
usuario (microseg.)
A0h
BYTE
Timer2: [AT, PS exc Mod 30] bandern de espera
activa:
bit 7 = 1 tiempo de espera transcurrido
bits 6-1 reservados

A1h

7 BYTEs

A4h

DWORD

bit 0 = 1 INT 15h, AH=86h ha sucedido

Reservado para adaptadores de red local (ser

verdad?)

[PS/2 Mod 30] Vector de la interrupcin del disco

duro preservada

A8h

DWORD

Video: En EGA/MCGA/VGA, puntero al Video Save

Pointer Table

ACh-AFh
B0h
BYTE
LOOP cuando se pita

B0h
DWORD
B4h
WORD
B6h 3 BYTEs
B9h 7 BYTEs
C0h 14 BYTEs
CEh
WORD
D0h-EFh
D0h-DCh
F0h-FFh
100h
BYTE
10Eh
BYTE

Reservados
(Phoenix 386 BIOS 1.10 10a) contador para retardo
ante un buffer de teclado lleno
Puntero al controlador de disco ptico 3363.
Reservado
Reservado para el POST?
???
Reservado
Cuenta de das desde el ltimo arranque???
Reservado
Usado por Digiboard MV/4
Reservado para el usuario
Byte de estado de Print Screen
Estado de BREAK al inicio de la ejecucin de

BASICA.COM

10Fh
116h
11Ah

BYTE
DWORD
DWORD

Volver al ndice

Bandern: 02h si BASICA v2.10 est ejecutndose

INT 1Bh al inicio de la ejecucin de BASICA.COM
INT 24h al inicio de la ejecucin de BASICA.COM

Apndice IV - PUERTOS DE ENTRADA Y SALIDA

PC/XT

8255)

PC/AT

tiempo real

000
020
040
060

00F
021
043
063

Controlador de DMA (8237)

Controlador de interrupciones (8259)
Temporizador (8253)
Interface programable de perifricos (PPI,

081 - 083
0A0 - 0AF
200 - 20F
210 - 217
2F8 - 2FF
300 - 31F
320 - 32F
378 - 37F
380 - 38C
3B0 - 3BF
3D0 - 3D7
3F0 - 3F7
3F8 - 3FF
790 - 793
B90 - B93
1390 - 1393
2390 - 2393

Registros de pgina del DMA (74LS612)

Registro de mscara de la NMI (0A0)
Joystick
Unidad de expansin
2 puerto serie
Tarjetas prototipo
Disco duro
1 puerto paralelo
SDLC
Adaptador monocromo/impresora
Adaptador CGA
Controlador de disquete (NEC 765)
1 Puerto serie
Bloques (adaptador 1)
Bloques (adaptador 2)
Bloques (adaptador 3)
Bloques (adaptador 4)

000
020
040
060
070

01F
021
05F
06F
07F

1 Controlador de DMA (8237)

1 Controlador de interrupciones (8259)
Temporizador (8254)
Controlador del teclado (8042)
Registro de mscara de la NMI; reloj de

080
0A0
0C0
0F0
1F0
200
258
278
2E1
2E2
2F8
300
360
378
380
3A0
3B0
3C0
3D0

09F
0A1
0DF
0FF
1F8
207
25F
27F

2E3
2FF
31F
36F
37F
38C
3AF
3BF
3CF
3DF

Registros de pgina del DMA (74LS612)

2 Controlador de interrupciones (8259)
2 Controlador de DMA (8237)
Coprocesador matemtico
Disco duro
Joystick
Intel Above Board
2 puerto paralelo
GPIB (adaptador 0)
Adquisicin de datos (adaptador 0)
2 puerto serie
Tarjetas prototipo
Reservados
1 puerto paralelo
2 SDLC o comunicacin bisncrona
1 SDLC
Adaptador monocromo/impresora
EGA/VGA
Adaptador CGA

3F0 - 3F7
3F8 - 3FF
6E2 - 6E3
790 - 793
AE2 - AE3
B90 - B93
EE2 - EE3
1390 - 1393
22E1
2390 - 2393
42E1
62E1
82E1
A2E1
C2E1
E2E1

Volver al ndice

Controlador de disquete (NEC 765)

1 Puerto serie
Adquisicin de datos (Adaptador 1)
Bloques (adaptador 1)
Adquisicin de datos (Adaptador 2)
Bloques (adaptador 2)
Adquisicin de datos (Adaptador 3)
Bloques (adaptador 3)
GPIB (Adaptador 1)
Bloques (adaptador 4)
GPIB (Adaptador 2)
GPIB (Adaptador 3)
GPIB (Adaptador 4)
GPIB (Adaptador 5)
GPIB (Adaptador 6)
GPIB (Adaptador 7)

Apndice V - CDIGOS DE RASTREO DEL TECLADO. CDIGOS

SECUNDARIOS.

Las teclas marcadas con 'Ex' son exclusivas de teclados expandidos; generan los
mismos cdigos de rastreo que sus correspondientes teclas no expandidas, aunque
precedidos de un cdigo de rastreo adicional 0E0h como mnimo, por lo general
(consultar el apartado 5.2 del captulo 7 para ms detalles).
Cdigos secundarios.
A continuacin se listan los cdigos secundarios. Estos se producen al pulsar ciertas
combinaciones especiales de teclas, a las que el controlador de INT 9 responde colocando
un cdigo ASCII 0 en el buffer, a menudo junto al cdigo de rastreo, para identificarlas;
las teclas expandidas provocan frecuentemente la insercin de un ASCII 0E0h o bien
0F0h. Estos cdigos secundarios son el valor devuelto en AH por las funciones 0, 1, 10h
y 11h de la BIOS, cuando stas devuelven un carcter ASCII 0 0E0h en AL.
Ha de tenerse en cuenta que la BIOS modifica en ocasiones el valor ledo del buffer
del teclado, aunque en la siguiente tabla hay pautas para detectar esta circunstancia si
fuera necesario. En primer lugar, cuando se invoca a la BIOS con las funciones 0 y 1, ste
se encarga de simular las teclas normales con las expandidas, as como de ocultar las
combinaciones exclusivamente expandidas. Aquellos cdigos precedidos de (*) en la
tabla son ocultados por la BIOS (como si no se hubiera pulsado las teclas) al emplear las
funciones 0 y 1, sacndolos del buffer e ignorndolos. En concreto, estos cdigos son
almacenados con un cdigo ASCII 0F0h en el buffer del teclado. Lgicamente, para las
funciones 10h y 11h s existen, aunque la BIOS devuelve un 0 en AL (y no un 0F0h). A
los cdigos precedidos por (#) les sucede lo mismo: slo existen para las funciones 10h y
11h, al emplear dichas funciones la BIOS devuelve en AL el valor 0 (el autntico
contenido del buffer en esta ocasin, sin necesidad de transformarlo). Por ltimo, los
cdigos precedidos por (@) existen tanto para las funciones 0 y 1 como para la 10h y la
11h: la ventaja de usar las dos ltimas es que devuelven en AL el autntico cdigo ASCII
del buffer (0E0h), permitiendo diferenciar entre la pulsacin de una tecla normal y su
correspondiente expandida.
En general, quien no desee complicarse la vida con este galimatas (debido a una
evidente falta de previsin en el diseo del primer teclado) puede limitarse a emplear las
combinaciones normales (las no marcadas con #, # ni *). Por otra parte, para emplear las
combinaciones sealadas con (#), (@) o (*) hay que asegurarse previamente de que la
BIOS soporta teclado expandido (vase captulo 7, apartado 5.3).

Para diferenciar las teclas repetidas, en la tabla siguiente, las teclas entrecomilladas se
suponen expandidas o, en su defecto, ubicadas en el teclado numrico. Por ejemplo: "5"
es el 5 del teclado numrico, "<-" es el cursor izquierdo expandido y <- a secas el normal
(esto es, la tecla 4 del teclado numrico con Num Lock inactivo). Se emplea la notacin
anglosajona: Ctrl (Control), Alt (Alt o AltGr), Shift (Mays), Ins (Insert), Del (Supr),
Home (Inicio), End (Fin), PgUp (RePg), PgDn (AvPg).

Excepciones:
Hay un par de teclas que sin tener un cdigo ASCII 0, 0E0h ni 0F0h reciben un
tratamiento especial por parte de la BIOS, que provoca que el cdigo secundario no sea el
de rastreo acostumbrado: el Intro del teclado numrico genera un cdigo ASCII 0Dh,
como cabra esperar, pero su cdigo secundario es 0E0h; lo mismo sucede con el '/' del
teclado numrico. Las funciones 0 y 1 de la BIOS traducen este 0E0h al valor
correspondiente a la tecla Intro principal y al '-' del teclado principal (tecla que ocupa la
posicin del '/' en los teclados norteamericanos), para compatibilizar con los teclados no
expandidos.
Volver al ndice

Apndice VI - TAMAOS Y TIEMPOS DE EJECUCIN DE LAS

INSTRUCCIONES

En la tabla de esta pgina se listan las instrucciones del ensamblador por orden
alfabtico, indicndose el nmero de bytes consumidos al ser ensambladas as como los
tiempos tericos de ejecucin en 8088, 286, 386 y 486. Estos tiempos son tericos y no
deberan ser utilizados para temporizaciones exactas. Por otra parte son diferentes de un
procesador a otro. Los tiempos se expresan en estados de mquina (1 MHz equivale a
1.000.000 de estados o ciclos de reloj) estando la capacidad de ejecucin de instrucciones
lgicamente en funcin de los MHz del equipo que se trate. Estos tiempos se aplican
suponiendo que se cumplen las siguientes hiptesis:

La instruccin ya ha sido extrada de la memoria y decodificada.

Los datos, si los hay, estn alineados (a palabra o doble palabra).
No hay estados de espera en la placa principal del ordenador.
Nadie ha sustraido el control del bus a la CPU (el DMA no debe estar actuando y
no han de producirse ciclos de refresco de la memoria).
No se produce ninguna interrupcin o excepcin durante la ejecucin.

Evidentemente, es casi imposible que los tiempos tericos sean los reales, teniendo en
cuenta todos estos factores. Cuanto menos potente es la mquina, mucho ms lentos son
los tiempos reales; por el contrario, en ordenadores con cach y procesador avanzado los
tiempos efectivos pueden ser en ocasiones mejores que los tericos!. Por ejemplo, el 486
emplea ya la tecnologa pipeline, lo que le permite simultanear la ejecucin de una
instruccin con la decodificacin de la siguiente y la lectura de memoria de la posterior
as como almacenar el resultado de la anterior. Esto, con las lgicas limitaciones de un
procesador CISC, permite en la prctica ejecutar un alto nmero de instrucciones en un
solo ciclo (cada una de ellas, claro). Por tanto, para lo que s sirven las tablas es para
decidir qu instrucciones emplear en ciertos procesos en que el tiempo de ejecucin o la
memoria consumida son crticos, especialmente en las mquinas menos potentes. Como
muestra de lo sumamente tericos que son estos tiempos, a continuacin se listan dos
rutinas con las que he probado experimentalmente los tiempos de ejecucin en diversos
microprocesadores. Ambas rutinas constan de un bucle que se repite cierto nmero de
veces; mientras tanto las interrupciones estn inhibidas, por lo que se cronometran a
mano:
Ciclos tericos
8088

486
RutinaA:

CLI

286

386

MOV
XOR

bucle:

AX,1000h
CX,CX

repite:
LOOP repite
(m=2)
6 2
DEC AX
1
JNZ bucle
(m=2)
3 1
STI
RutinaB:
1

17 5

2
8+m 4 (m=2)

2
16 4

2
7+m 3 (m=2)

2
11+m
2
7+m 3

bucle1:

CLI
XOR
MOV

CX,CX
AX,BX

bucle2:

MOV

AX,BX

AX,BX

DEC

CX

JNZ

fin

16 4

1
.

...
bucle16384: MOV

.
1
(m=1)

3 1

(m=2)
fin:

JMP

bucle1

7+m 3

15

7+m

7+m 3
7+m

STI

Por ejemplo, la rutina B ejecuta 16384 instrucciones del tipo MOV AX,BX (2 ciclos
cada una) as como un decremento (2 ciclos) un salto que no se realiza -salvo al final del
todo- (4 ciclos en 8088) y otro salto absoluto (15 ciclos en 8088). Se emplea este rodeo
ya que los saltos condicionales, como conocer el lector, slo pueden desviar algo ms de
100 bytes el flujo del programa (y este bucle ocupa nada menos que 32 Kb). En total,
32787 ciclos que, repetidos 65536 veces, suponen 2.148.728.832 ciclos. Con un 8088
corriendo a 8 MHz (8 millones de ciclos) cabra esperar una demora de 268,59 segundos.
Sin embargo, mi reloj de pulsera dice que son nada menos que 1194!, unas 4,44 veces
ms de lo que los tiempos tericos de Intel sugieren. De hecho, esto implica que cada
MOV tarda casi 9 ciclos reales en un 8088, y no 2. Sin embargo, en el caso de la rutina A
apenas hay diferencia entre el tiempo terico y el real: el tiempo que emplea la
instruccin LOOP es bastante alto en comparacin con lo que se tarda en traer dicha
instruccin de la memoria, por lo que la diferencia porcentual se reduce notablemente.
RUTINA A

RUTINA B

Terico Efectivo Terico Efectivo

8088-4.77 956,71 1014,00 450,47 1946,00
V20-8

570,43 623,30 268,59 1194,00

286-12

223,70 254,00 179,02 188,25

386-25* 139,59 135,20

85,93

93,50

486-25*

64,42

75,50

42,96

69,10

(*) El 386 careca de memoria cach y el 486

slo posea los 8 Kb de cach incluidos en el chip.
Pautas para interpretar la tabla de instrucciones.
El 8088, bastante menos potente que el 286, vara enormemente la velocidad de
ejecucin de las instrucciones en funcin del modo de direccionamiento, hay que aadir
adems dos ciclos de reloj en este procesador cuando se usa un prefijo de registro de
segmento. En la siguiente tabla se indica el nmero de ciclos de reloj adicionales que
deben considerarse en el 8086/8088 para calcular la direccin de memoria efectiva (EA,
Efective Address) en la tabla de tiempos, segn el tipo de direccionamiento:
Componentes

Operandos

valor EA

(a) Base o ndice

[BX], [BP], [SI], [DI]

(b) Desplazamiento

desp

(c1) Base + ndice

[BX+SI], [BX+DI]

(c2) Base + ndice

[BP+SI], [BP+DI]

(d) Desplaz.+ base/ndice [BX+desp], [BP+desp], [DI+desp], [SI+desp]

(e) Desplaz.+ base + ndice

11

[BX+SI+desp], [BX+DI+desp]

Los datos entre parntesis en el 8088 indican el tiempo empleado por las palabras de
16 bits, fuera del parntesis hacen referencia a 8 bits (los 8086 y superiores no son ms
lentos con datos de 16 que con los de 8 bits, siempre lgicamente que stos estn en una
posicin de memoria par). Aunque el 286 y 386 no penalizan tanto los modos de
direccionamiento complejos, a los tiempos marcados con (#) hay que aadir un ciclo si en
el offset participan tres elementos (ej., BP+DI+desp). La letra {m} se refiere al nmero
de bytes totales de la siguiente instruccin que se va a ejecutar. Cuando aparecen dos
opciones en las instrucciones de salto condicional, el menor tiempo de ejecucin se
verifica cuando el salto no se realiza. Todas las instrucciones especficas de 386 ocupan,
bajo DOS, un byte ms de lo que indican las tablas debido a que se utiliza un prefijo para
forzar el modo 32 bit en segmentos de 16. En los tiempos del 386, los datos entre
parntesis se aplican cuando la CPU est en modo virtual 86; en general, los tiempos de
ejecucin corresponden al modo real (en modo protegido, podran variar).
Inst.
Operandos
Bytes
Ciclos 8088
Ciclos 286
Ciclos 386
Ciclos 486
------ ----------------------------------- ------- -------------------------- ------------ -----------AAA
1
8
3
4
3

AAD

14

AAM

16

AAS

ADC

ADC

7 #

ADC

7 #

ADC

ADC

7 #

ADC

ADD

ADD

7 #

ADD

7 #

ADD

ADD

7 #

ADD

AND

AND

7 #

AND

7 #

AND

AND

7 #

AND

BOUND

13 #

BOUND
(no existe)
BSF
(no existe)
BSF
(no existe)
BSF
(no existe)
BSF
(no existe)
BSR
(no existe)

19

14

17

15

4
3
registro, registro
2
1
registro, memoria
6
2
memoria, registro
7
3
registro, inmediato
2
1
memoria, inmediato
7
3
acumulador, inmediato
2
1
registro, registro
2
1
registro, memoria
6
2
memoria, registro
7
3
registro, inmediato
2
1
memoria, inmediato
7
3
acumulador, inmediato
2
1
registro, registro
2
1
registro, memoria
6
2
memoria, registro
7
3
registro, inmediato
2
1
memoria, inmediato
7
3
acumulador, inmediato
2
1
registro16, memoria16
10
7
registro32, memoria32
10
7
registro16, registro16
10+3*n
6-42
registro16, memoria16
10+3*n
7-43
registro32, registro32
10+3*n
6-42
registro32, memoria32
10+3*n
7-43
registro16, registro16
10+3*n
6-42

60

83

2-4

9(13)+EA

2-4

16(24)+EA

3-4

3-6

17(25)+EA

2-3

2-4

9(13)+EA

2-4

16(24)+EA

3-4

3-6

17(25)+EA

2-3

2-4

9(13)+EA

2-4

16(24)+EA

3-4

3-6

17(25)+EA

2-3

2-4

(no existe)

2-6

(no existe)

(no existe)

5-7

(no existe)

(no existe)

5-7

(no existe)

(no existe)

BSR
(no existe)
BSR
(no existe)
BSR
(no existe)
BT
(no existe)
BT
(no existe)
BT
(no existe)
BT
(no existe)
BT
(no existe)
BT
(no existe)
BT
(no existe)
BT
(no existe)
BTC
(no existe)
BTC
(no existe)
BTC
(no existe)
BTC
(no existe)
BTC
(no existe)
BTC
(no existe)
BTC
(no existe)
BTC
(no existe)
BTR
(no existe)
BTR
(no existe)
BTR
(no existe)
BTR
(no existe)
BTR
(no existe)
BTR
(no existe)
BTR
(no existe)
BTR
(no existe)
BTS
(no existe)

registro16, memoria16
10+3*n
7-43
registro32, registro32
10+3*n
6-42
registro32, memoria32
10+3*n
7-43
registro16, registro16
3
3
memoria16, registro16
12
8
registro32, registro32
3
3
memoria32, registro32
12
8
registro16, inmediato8
3
3
memoria16, inmediato8
6
3
registro32, inmediato8
3
3
memoria32, inmediato8
6
3
registro16, registro16
6
6
memoria16, registro16
13
13
registro32, registro32
6
6
memoria32, registro32
13
13
registro16, inmediato8
6
6
memoria16, inmediato8
8
8
registro32, inmediato8
6
6
memoria32, inmediato8
8
8
registro16, registro16
6
6
memoria16, registro16
13
13
registro32, registro32
6
6
memoria32, registro32
13
13
registro16, inmediato8
6
6
memoria16, inmediato8
8
8
registro32, inmediato8
6
6
memoria32, inmediato8
8
8
registro16, registro16
6
6

5-7

(no existe)

(no existe)

5-7

(no existe)

(no existe)

5-7

(no existe)

(no existe)

5-7

(no existe)

(no existe)

6-8

(no existe)

(no existe)

6-8

(no existe)

(no existe)

5-7

(no existe)

(no existe)

5-7

(no existe)

(no existe)

6-8

(no existe)

(no existe)

6-8

(no existe)

(no existe)

5-7

(no existe)

(no existe)

5-7

(no existe)

(no existe)

6-8

(no existe)

(no existe)

6-8

(no existe)

(no existe)

BTS
(no existe)
BTS
(no existe)
BTS
(no existe)
BTS
(no existe)
BTS
(no existe)
BTS
(no existe)
BTS
(no existe)
CALL
7+m
CALL
13+m
CALL
11+m
CALL
7+m
CALL
16+m
CBW
2
CDQ
(no existe)
CLC
2
CLD
2
CLI
3
CMC
2
CMP
2
CMP
6 #
CMP
7 #
CMP
3
CMP
6 #
CMP
3
CMPS
8
CMPS
5+9*n
CWD
2
CWDE
(no existe)

memoria16, registro16
13
13
registro32, registro32
6
6
memoria32, registro32
13
13
registro16, inmediato8
6
6
memoria16, inmediato8
8
8
registro32, inmediato8
6
6
memoria32, inmediato8
8
8
procedimiento near (intrasegmento)
7+m
3
procedimiento far (intersegmento)
17+m
18
intrasegmento indirecto a memoria
10+m
5
intrasegmento indirecto a registro
7+m
5
intersegmento indirecto a memoria
22+m
17
3

3
2

2
2
registro, registro
2
1
registro, memoria
6
2
memoria, registro
5
2
registro, inmediato
2
1
memoria, inmediato
5
2
acumulador, inmediato
2
1
10
(REP)
5+9*n

5 (CX=0) 7+7*n
3
3

(no existe)

(no existe)

5-7

(no existe)

(no existe)

6-8

(no existe)

(no existe)

6-8

(no existe)

23

36

2-4

29+EA

24

2-4

57+EA

(no existe)

2-4

9(13)+EA

2-4

9(13)+EA

3-4

3-6

5-7

10(14)+EA

2-3

22(30)

9+22(30)*n

(no existe)

3
3

DAA
DAS

4
2
DEC
registro byte
2
2
1
DEC
registro palabra
2
2
1
DEC
memoria
7 #
6
3
DIV
registro byte
14
14
16
DIV
registro palabra
22
22
24
DIV
registro32
(no existe)
38
40
DIV
byte de memoria
17 #
17
16
DIV
palabra de memoria
25 #
25
24
DIV
palabra32 de memoria
(no existe)
41
40
ENTER
constante16, 0
11
10
14
ENTER
constante16, 1
15
12
17
ENTER
constante16, nivel
12+4*(n-1)
15+4*(n-1)
17+3*n
ESC
inmediato, memoria
9-20 #
(ver coproc.) (ver coproc.)
ESC
inmediato, registro
2
(ver coproc.) (ver coproc.)
HLT
2
5
4
IDIV
registro byte
17
19
19
IDIV
registro palabra
25
27
27
IDIV
registro32
(no existe)
43
43
IDIV
byte de memoria
20 #
19
20
IDIV
palabra de memoria
28 #
27
28
IDIV
palabra32 de memoria
(no existe)
43
44
IMUL
registro byte
13
9-14
13-18
IMUL
registro palabra
21
9-22
13-26
IMUL
registro32
(no existe)
9-38
13-42
IMUL
byte de memoria
16
12-17
13-18
IMUL
palabra de memoria
24 #
12-25
13-26

2-4

15(23)+EA

80-90

144-162

(no existe)

2-4

86-96+EA

2-4

154-172+EA

2-6

(no existe)

(no existe)

(no existe)

(no existe)

2-4

8(12)+EA

101-112

165-185

(no existe)

2-4

107-118+EA

2-4

175-194+EA

2-6

(no existe)

80-98

128-154

(no existe)

2-4

86-104+EA

2-4

138-164+EA

IMUL
palabra32 de memoria
(no existe)
12-41
13-42
IMUL
registro16 destino, constante
21
9-22
13-26
IMUL
registro16 destino, memoria
(no existe)
12-25
13-26
IMUL
registro32 destino, memoria
(no existe)
12-41
13-42
IMUL
registro destino, registro, cte.
21
9-22
13-26
IMUL
registro destino, memoria, cte.
24 #
12-25
13-26
IN
acumulador, puerto fijo
5
12(26)
14(27)
IN
acumulador, DX
5
13(27)
14(27)
INC
registro byte
2
2
1
INC
registro palabra
2
2
1
INC
memoria
7 #
6
3
INS
5
15(29)
17(30)
INS
(REP)
5+4*n
13(27)+6*n
16(29)+8*n
INT
3
23+m
33
26
INT
inmediato
23+m
37
30
INTO
24+m 3
35 3
28 3
IRET
17+m
22
15
JCXZ
8+m 4
9+m 5
3 1
JECXZ
(no existe)
9+m 5
3 1
JMP
short
7+m
7+m
3
JMP
near (intrasegmento)
7+m
7+m
3
JMP
far
(intersegmento)
11+m
12+m
17
JMP
intrasegmento indirecto a memoria
11+m #
10+m
5
JMP
intrasegmento indirecto a registro
7+m
7+m
5
JMP
intersegmento indirecto a memoria
15+m
17+m
13
Jxxx
inmediato8
7+m 3
7+m 3
3 1
Jxxx
inmediato32
(no existe)
7+m 3
3 1
LAHF
2
2
3

2-6

(no existe)

3-4

(no existe)

5-7

(no existe)

5-7

(no existe)

2-4

(no existe)

3-4

(no existe)

10(14)

8(12)

2-4

15(23)+EA

(no existe)

(no existe)

52

51

1
1
2

53 4
32
18 6

(no existe)

15

15

15

2-4

18+EA

11

2-4

24+EA

16 4

(no existe)

7 #
3 #
5
7 #

LDS
LEA
LEAVE
LES

LFS
(no existe)
LGS
(no existe)
LSS
(no existe)
LOCK
0
LODS
5
LODS
5+4*n
LOOP
8+m 4
LOOPE
8+m 4
LOOPNE
8+m 4
LOOPZ
8+m 4
LOOPNZ
8+m 4
MOV
3
MOV
5
MOV
2
MOV
5 #
MOV
3 #
MOV
2
MOV
3 #
MOV
2
MOV
2
MOV
5 #
MOV
3 #
MOVS
5
MOVS
5+4*n

6
6

6
1

5
(REP)
5+6*n

5
5 (CX=0) 7+4*n

11+m

2 6

11+m

9 6

11+m

9 6

11+m

9 6

11+m
9 6
memoria, acumulador
2
1
acumulador, memoria
4
1
registro, registro
2
1
registro, memoria
4
1
memoria, registro
2
1
registro, inmediato
2
1
memoria, inmediato
2
1
registro de segmento, registro
2
3
registro, registro de segmento
2
3
registro de segmento, memoria
5
9
memoria, registro de segmento
2
3
7
(REP)
5+4*n

24+EA

2-4

2+EA

2-4

7
5 (CX=0) 12+3*n

(no

existe)

2-4

24+EA

2-4

(no existe)

2-4

(no existe)

2-4

(no existe)

12(16)

9+13(17)*n

17 5

18 6

19 5

18 6

19 5

10(14)

10(14)

2-4

8(12)+EA

2-4

9(13)+EA

2-3

3-6

10(14)+EA

2-4

8(12)+EA

2-4

9(13)+EA

1
1

18(26)
9+17(25)*n

MOVSX
(no existe)
MOVSX
(no existe)
MOVSX
(no existe)
MOVSX
(no existe)
MOVSX
(no existe)
MOVSX
(no existe)
MOVZX
(no existe)
MOVZX
(no existe)
MOVZX
(no existe)
MOVZX
(no existe)
MOVZX
(no existe)
MOVZX
(no existe)
MUL
13
MUL
21
MUL
(no existe)
MUL
16 #
MUL
24 #
MUL
(no existe)
NEG
2
NEG
7 #
NOP
3
NOT
2
NOT
7 #
OR
2
OR
7 #
OR
7 #
OR
3
OR
7 #

registro16, registro8
3
3
registro16, memoria8
6
3
registro32, registro8
3
3
registro32, memoria8
6
3
registro32, registro16
3
3
registro32, memoria16
6
3
registro16, registro8
3
3
registro16, memoria8
6
3
registro32, registro8
3
3
registro32, memoria8
6
3
registro32, registro16
3
3
registro32, memoria16
6
3
registro byte
9-14
13
registro palabra
9-22
13
registro32
9-38
13
byte de memoria
12-27
18
palabra de memoria
12-25
26
palabra32 de memoria
12-41
42
registro
2
1
memoria
6
3
3
1
registro
2
1
memoria
6
3
registro, registro
2
1
registro, memoria
6
3
memoria, registro
7
3
registro, inmediato
2
1
memoria, inmediato
7
3

(no existe)

5-7

(no existe)

(no existe)

5-7

(no existe)

(no existe)

5-7

(no existe)

(no existe)

5-7

(no existe)

(no existe)

5-7

(no existe)

(no existe)

5-7

(no existe)

70-77

118-133

(no existe)

2-4

76-83+EA

2-4

128-143+EA

2-6

(no existe)

2-4

16(24)+EA

2-4

16(24)+EA

2-4

9(13)+EA

2-4

16(24)+EA

3-4

3-6

17(25)+EA

3
3
3
5

OR
OUT
OUT
OUTS

OUTS
5+4*n
POP
5
POP
5
POP
5 #
POPA
19
POPAD
(no existe)
POPF
5
POPFD
(no existe)
PUSH
3
PUSH
5 #
PUSH
3
PUSHA
17
PUSHAD
(no existe)
PUSHF
3
PUSHFD
(no existe)
RCL
2
RCL
5
RCL
5
RCL
8 #
RCL
7 #
RCL
8 #
RCR
2
RCR
5
RCR
5

acumulador, inmediato
2
1
puerto fijo, acumulador
10(24)
16(29)
DX, acumulador
11(25)
16(29)
byte o palabra
14(28)
17(30)
(REP)
12(26)+5*n
17(31)+5*n
registro normal
4
4
registro de segmento
7
3
memoria
5
6
24

9
24

9
9

5
registro
2
memoria
5
inmediato
2
18

9
1
4
1
11

18
4

11
4

4
registro,1
9
3
registro,CL
9
8-30
registro, contador
9
8-30
memoria, contador
10
9-31
memoria,1
10
4
memoria,CL
10
9-31
registro,1
9
3
registro,CL
9
8-30
registro, contador
9
8-30

2-3

10(14)

8(12)

(no existe)

(no existe)

12

12

2-4

25+EA

(no existe)

(no existe)

12

(no existe)

14

2-4

24+EA

2-3

(no existe)

(no existe)

(no existe)

14

(no existe)

8+4*bits

(no existe)

3-6

(no existe)

2-4

15(23)+EA

2-4

20(28)+EA+4*bits

8+4*bits

(no existe)

RCR

8 #

RCR

7 #

RCR

8 #

REP

REPE

REPNE

REPZ

REPNZ

RET

11+m

RET

11+m

RET

15+m

RET

15+m
2
5
5
8 #
7 #
8 #
2
5
5
8 #
7 #
8 #
2
2
5
5

ROL
ROL
ROL
ROL
ROL
ROL
ROR
ROR
ROR
ROR
ROR
ROR
SAHF
SAL
SAL
SAL

memoria, contador
10
9-31
memoria,1
10
4
memoria,CL
10
9-31
0

0
0
intrasegmento
10+m
5
intrasegmento con SP+inmediato
10+m
5
intersegmento
18+m
13
intersegmento con SP+inmediato
18+m
14
registro,1
3
3
registro,CL
3
3
registro, contador
3
2
memoria, contador
7
4
memoria,1
7
4
memoria,CL
7
4
registro,1
3
3
registro,CL
3
3
registro, contador
3
2
memoria, contador
7
4
memoria,1
7
4
memoria,CL
7
4
3
2
registro,1
3
3
registro,CL
3
3
registro, contador
3
2

3-6

(no existe)

2-4

15(23)+EA

2-4

20(28)+EA+4*bits

20

24

32

31

8+4*bits

(no existe)

3-6

(no existe)

2-4

15(23)+EA

2-4

20(28)+EA+4*bits

8+4*bits

(no existe)

3-6

(no existe)

2-4

15(23)+EA

2-4

20(28)+EA+4*bits

8+4*bits

(no existe)

8 #
7 #
8 #
2
5
5
8 #
7 #
8 #
2
7 #
7 #
3
7 #
3
7

SAL
SAL
SAL
SAR
SAR
SAR
SAR
SAR
SAR
SBB
SBB
SBB
SBB
SBB
SBB
SCAS

SCAS
5+8*n
SETcc
(no existe)
SETcc
(no existe)
SHL
2
SHL
5
SHL
5
SHL
8 #
SHL
7 #
SHL
8 #
SHLD
(no existe)
SHLD
(no existe)
SHLD
(no existe)

memoria, contador
7
4
memoria,1
7
4
memoria,CL
7
4
registro,1
3
3
registro,CL
3
3
registro, contador
3
2
memoria, contador
7
4
memoria,1
7
4
memoria,CL
7
4
registro, registro
2
1
registro, memoria
6
2
memoria, registro
7
3
registro, inmediato
2
1
memoria, inmediato
7
3
acumulador, inmediato
2
1
7
6
(REP)
5+8*n 5 (CX=0) 7+5*n
registro8
4
4
memoria8
5
3
registro,1
3
3
registro,CL
3
3
registro, contador
3
2
memoria, contador
7
4
memoria,1
7
4
memoria,CL
7
4
registro16, registro16, inmediato8
3
2
memoria16, registro16, inmediato8
7
3
registro32, registro32, inmediato8
3
2

3-6

(no existe)

2-4

15(23)+EA

2-4

20(28)+EA+4*bits

8+4*bits

(no existe)

3-6

(no existe)

2-4

15(23)+EA

2-4

20(28)+EA+4*bits

2-4

9(13)+EA

2-4

16(24)+EA

3-4
3-6

4
17(25)+EA

2-3

15(19)

9+15(19)*n

(no existe)

4-6

(no existe)

8+4*bits

(no existe)

3-6

(no existe)

2-4

15(23)+EA

2-4

20(28)+EA+4*bits

(no existe)

6-8

(no existe)

(no existe)

SHLD
(no existe)
SHLD
(no existe)
SHLD
(no existe)
SHLD
(no existe)
SHLD
(no existe)
SHR
2
SHR
5
SHR
5
SHR
8 #
SHR
7 #
SHR
8 #
SHRD
(no existe)
SHRD
(no existe)
SHRD
(no existe)
SHRD
(no existe)
SHRD
(no existe)
SHRD
(no existe)
SHRD
(no existe)
SHRD
(no existe)
STC
2
STD
2
STI
2
STOS
3
STOS
4+3*n
SUB
2
SUB
7 #
SUB
7 #
SUB
3

memoria32, registro32, inmediato8

7
3
registro16, registro16, CL
3
2
memoria16, registro16, CL
7
3
registro32, registro32, CL
3
2
memoria32, registro32, CL
7
3
registro,1
3
3
registro,CL
3
3
registro, contador
3
2
memoria, contador
7
4
memoria,1
7
4
memoria,CL
7
4
registro16, registro16, inmediato8
3
2
memoria16, registro16, inmediato8
7
3
registro32, registro32, inmediato8
3
2
memoria32, registro32, inmediato8
7
3
registro16, registro16, CL
3
2
memoria16, registro16, CL
7
3
registro32, registro32, CL
3
2
memoria32, registro32, CL
7
3
2

4
5
(REP)
5+5*n 5 (CX=0) 7+4*n
registro, registro
2
1
registro, memoria
6
2
memoria, registro
7
3
registro, inmediato
2
1

6-8

(no existe)

(no existe)

5-7

(no existe)

(no existe)

5-7

(no existe)

8+4*bits

(no existe)

3-6

(no existe)

2-4

15(23)+EA

2-4

20(28)+EA+4*bits

(no existe)

6-8

(no existe)

(no existe)

6-8

(no existe)

(no existe)

5-7

(no existe)

(no existe)

5-7

(no existe)

11(15)

9+10(14)*n

2-4

9(13)+EA

2-4

16(24)+EA

3-4

7 #
3
2
6 #
6 #
3
6 #
3
3
3
3
5 #
5
2
7 #
7 #
3
7 #
3

SUB
SUB
TEST
TEST
TEST
TEST
TEST
TEST
WAIT
XCHG
XCHG
XCHG
XLAT
XOR
XOR
XOR
XOR
XOR
XOR

memoria, inmediato
7
3
acumulador, inmediato
2
1
registro, registro
2
1
registro, memoria
5
2
memoria, registro
5
2
registro, inmediato
2
1
memoria, inmediato
5
2
acumulador, inmediato
2
1
6
1-3
AX,registro16
3
3
registro, registro
3
3
memoria, registro
5
5
5
4
registro, registro
2
1
registro, memoria
6
2
memoria, registro
7
3
registro, inmediato
2
1
memoria, inmediato
7
3
acumulador, inmediato
2
1

Volver al ndice

3-6

17(25)+EA

2-3

2-4

9(13)+EA

2-4

16(24)+EA

3-4

3-6

17(25)+EA

2-3

2-4

17(25)+EA

11

2-4

9(13)+EA

2-4

16(24)+EA

3-4

3-6

17(25)+EA

2-3

Apndice VII - SEALES DEL SLOT DE EXPANSIN ISA

El slot de expansin del XT, de 8 bits, consta de 62 terminales en un conector hembra,

31 por cada cara. La cara A es la de los componentes; por la B slo hay pistas. Viendo las
tarjetas por arriba (por la cara de componentes) y con los conectores exteriores a la
derecha, la numeracin comienza de derecha a izquierda. En los AT el slot de 16 bits
consta de 36 terminales ms, distribuidos en grupos de 18 en dos nuevas caras (C y D).
La mayora de las mquinas AT poseen slots de 8 y 16 bits, aunque lo ideal sera que
todos fueran de 16 (en los de 16 bits se pueden insertar tambin tarjetas de 8 bits, dejando
la otra mitad al aire).
Las seales en la parte de 8 bits son idnticas en XT y AT, si se excepta la lnea IRQ2
que en los AT es realmente IRQ9 (IRQ2 es empleada en la placa base para conectar en
cascada el segundo controlador de interrupciones; por compatibilidad con los XT, cuando
se produce una IRQ9 -normalmente una INT 71h- se invoca por software la INT 0Ah).
En el siguiente esquema, las lneas activas en alto van precedidas de un signo (+); las
activas en estado lgico bajo (-). Los smbolos I (Input) y O (Output) indican si las lneas
son de entrada, salida o bidireccionales.

El slot de expansin de los PC contiene bsicamente las principales seales del 8086
demultiplexadas, as como otras de interrupciones, DMA, control de E/S, etc. Las seales
presentes en el slot de expansin de 8 bits son:
OSC:
ALE:
TC:
DRQ1DRQ3:
DACK1DACK3:
IRQ2IRQ7:

(Oscilator) Seal de reloj de casi 70 ns (14,31818 MHz) que est la mitad del
perodo en estado alto y la otra mitad en estado bajo.
(Address Latch Enable) Indica en su flanco de bajada que el latch de
direcciones se ha cargado con una direccin vlida procedente del
microprocesador.
(Terminal Count) Indica el final de la cuenta en algn canal de DMA.
(DMA Request) Lneas asncronas de peticin de DMA (1 mayor prioridad, 3
menor). Esta lnea debe activarse hasta que DACK (activo a nivel bajo) suba.
(DMA Acknowledge) Indica que ha sido atendida la peticin de DMA y que
debe bajarse el correspondiente DRQ.
(Interrupt request) Indica una peticin de interrupcin (2 mayor prioridad, 7
menor). La seal debe mantenerse activa hasta que la interrupcin acabe de
ser procesada.

IOR:
IOW:
MEMR:
MEMW:
RESET
DRV:
A0-A19:
D0-D7:
AEN:

I/O CH
RDY:
I/O CH
CK:

(Input/Output Read) Seala al dispositivo de E/S que se va a leer el bus de

datos; esta lnea la controla la CPU o el DMA.
(Input/Output Write) Seala al dispositivo de E/S que se va a escribir en el bus
de datos; esta lnea la controla tambin la CPU o el DMA.
(Memory Read) Indica que se va a efectuar una lectura de la memoria en la
direccin contenida en el bus de direcciones. La activa la CPU o el DMA.
(Memory Write) Indica que se va a efectuar una escritura en memoria en la
direccin contenida en el bus de direcciones. La activa la CPU o el DMA.
(Reset drive) Avisa de que el sistema est en proceso de reinicializacin, para
que todos los dispositivos conectados se inicialicen. Se activa en el flanco de
bajada de la seal del reloj.
(Address) Bus de direcciones comn a la memoria y a la E/S, controlado por
la CPU o el DMA.
(Data) Bus de datos que conecta el microprocesador y los dems
componentes.
(Address Enable) Valida la direccin almacenada en A0-A19. Esto permite
inhibir la CPU y los dems dispositivos, pudiendo el DMA tomar el control.
Los perifricos deben decodificar la direccin comprobando que AEN est en
estado bajo.
(I/O Channel Ready) Esta lnea se pone momentneamente en estado bajo por
los perifricos lentos (no durante ms de 10 ciclos de reloj) cuando detectan
una direccin vlida en una operacin de E/S, con objeto de poder
sincronizarse con la CPU, que genera estados de espera.
(I/O Channel Check) Indica si se ha producido un error de paridad en la
memoria o en los dispositivos E/S.

En los AT, las lneas adicionales completan fundamentalmente la nueva longitud de los
buses de datos y direcciones, permitiendo acceder tambin al resto del nuevo hardware:
Nuevas lneas de peticin/reconocimiento de DMA para los canales 5, 6 y 7,
as como el 0 (realmente el 4) que en los XT no estaba disponible al ser
empleado por el refresco de memoria.
Nuevos niveles de interrupcin: 10, 11, 12, 13, 14 y 15. IRQ8 es interna a la
IRQ:
placa base y no est presente en el slot; IRQ9 se utiliza para emular IRQ2.
I/O CS 16: Indica un acceso de 16 bits en los puertos E/S.
MEM CS
Indica un acceso de 16 bits en la memoria.
16:
D8-D15: Parte alta del bus de datos.
A17-A23: Parte alta del bus de direcciones.
DRQ y
DACK:

Volver al ndice

Apndice VIII - FUNCIONES DEL SISTEMA, LA BIOS

Y EL DOS ALUDIDAS EN ESTE LIBRO

Lgicamente, las funciones del DOS y la BIOS podran llenar varios libros de mayor
tamao que ste. Por ello, se listarn exclusivamente las funciones que se utilizan en los
programas ejemplo y en las explicaciones. Toda la informacin ha sido obtenida del
INTERRUPT.LST, en su mayora de la versin 39 del mismo (ver bibliografa), en este
libro se recoge menos de un 8% de las lneas de dicho fichero. Todas las funciones
recogidas en el INTERRUPT tienen el siguiente formato:
--------V-1000------------------------------INT 10 - VIDEO - SET VIDEO MODE
AH = 00h
AL = mode (see below)
Return: AL = video mode flag (Phoenix BIOS)
20h mode > 7
30h modes 0-5 and 7
3Fh mode 6
AL = CRT controller mode byte (Phoenix 386 BIOS
v1.10)

Al principio de la funcin, en la lnea de guiones, suele haber uno, dos o tres nmeros
hexadecimales de 8 bits (pegados unos a otros) que indican, por orden de aparicin:
nmero de la interrupcin, valor de llamada en AH, valor de llamada en AL. En el
ejemplo superior se trata de la INT 10h, a la que hay que llamar con AH=0. Si fueran
necesarios ms valores en otros registros normalmente se indicar de manera explcita en
la cabecera. Esta cabecera es til, ya que un fichero de varios megas no es operativo
consultarlo con TYPE (y muchos editores de texto no pueden cargarlo): lo normal es
emplear una de esas pequeas utilidades para ver ficheros de texto, que permiten moverse
arriba y abajo con las teclas de los cursores (como README.COM que acompaa a los
compiladores de Borland): esos programas suelen tener opciones de bsqueda de texto;
de esta manera, buscando la cadena "-210A" se podra encontrar rpidamente la funcin
0Ah del DOS (INT 21h).

--------!--FLAGS------------------------------------------------The use of -> instead of = signifies that the indicated register

or register
pair contains a pointer to the specified item, rather than the
item itself.
One or more letters may follow the interrupt number; they have the
following

meanings: U - undocumented function, u - partially documented

function,
P - available only in protected mode, R - available only in real
or V86 mode,
C - callout or callback (usually hooked rather than called),
O - obsolete (no longer present in current versions)

--------!--CATEGORIES-------------------------------------------The ninth column of the divider line preceding an entry usually

contains a
classification code (the entry has not been classified if that
character is
a dash). The codes currently in use are:
A - applications, a - access software (screen readers,
etc),
B - BIOS, b - vendor-specific BIOS extensions,
C - CPU-generated, c - caches/spoolers,
D - DOS kernel, d - disk I/O enhancements,
E - DOS extenders, e - electronic mail, F - FAX,
f - file manipulation, G - debuggers/debugging tools,
H - hardware, h - vendor-specific hardware,
I - IBM workstation/terminal emulators, i - system
info/monitoring
J - Japanese, j - joke programs,
K - keyboard enhancers, k - file compression,
l - shells/command interpreters,
M - mouse/pointing device, m - memory management,
N - network, n - non-traditional input devices,
O - other operating systems,
P - printer enhancements, p - power management,
Q - DESQview/TopView and Quarterdeck programs,
R - remote control/file access, r - runtime support,
S - serial I/O, s - sound/speech,
T - DOS-based task switchers/multitaskers, t - TSR
libraries
U - resident utilities, u - emulators,
V - video, v - virus/antivirus,
W - MS Windows, X - expansion bus BIOSes,
y - security, * - reserved (and not otherwise classified)

--------C00----------------------------------------------------INT 00 - CPU-generated - DIVIDE ERROR

Desc:
generated if the divisor of a DIV or IDIV instruction is
zero or the
quotient overflows the result register; DX and AX will
be unchanged.
Notes: on an 8086/8088, the return address points to the
following instruction
on an 80286+, the return address points to the divide
instruction
an 8086/8088 will generate this interrupt if the result of
a division
is 80h (byte) or 8000h (word)
SeeAlso: INT 04

--------C01----------------------------------------------------INT 01 - CPU-generated - SINGLE STEP

Desc:
TF is

generated after each instruction if TF (trap flag) is set;

cleared on invoking the single-step interrupt handler

Notes: interrupts are prioritized such that external interrupts
are invoked
after the INT 01 pushes CS:IP/FLAGS and clears TF, but
before the
first instruction of the handler executes
used by debuggers for single-instruction execution
tracing, such as
MS-DOS DEBUG's T command
SeeAlso: INT 03

--------H02----------------------------------------------------INT 02 - external hardware - NON-MASKABLE INTERRUPT

Desc:
generated by the CPU when the input to the NMI pin is
asserted
Notes: return address points to start of interrupted instruction
on 80286+
on the 80286+, further NMIs are disabled until the next
IRET
instruction, but one additional NMI is remembered by the
hardware
and will be serviced after the IRET instruction
reenables NMIs
maskable interrupts may interrupt the NMI handler if
interrupts are
enabled
although the Intel documentation states that this
interrupt is
typically used for power-failure procedures, it has many
other uses
on IBM-compatible machines:
Memory parity error: all except Jr, CONV, and some
machines
without memory parity
Breakout switch on hardware debuggers
Coprocessor interrupt: all except Jr and CONV
Keyboard interrupt: Jr, CONV
I/O channel check: CONV, PS50+
Disk-controller power-on request: CONV
System suspend: CONV
Real-time clock: CONV
System watch-dog timer, time-out interrupt: PS50+
DMA timer time-out interrupt: PS50+
Low battery: HP 95LX
Module pulled: HP 95LX

--------C03----------------------------------------------------INT 03 - CPU-generated - BREAKPOINT

Desc:
generated by the one-byte breakpoint instruction (opcode
CCh)
Notes: used by debuggers to implement breakpoints, such as MS-DOS
DEBUG's G
command
also used by Turbo Pascal versions 1,2,3 when {$U+}
specified
return address points to byte following the breakpoint
instruction
SeeAlso: INT 01

--------C04----------------------------------------------------INT 04 - CPU-generated - INTO DETECTED OVERFLOW

Desc:
the INTO instruction will generate this interrupt if OF
(Overflow Flag)
is set; otherwise, INTO is effectively a NOP
Note:
may be used for convenient overflow testing (to prevent
errors from
propagating) instead of JO or a JNO/JMP combination
SeeAlso: INT 00

--------B05----------------------------------------------------INT 05 - PRINT SCREEN

Desc:
dump the current text screen to the first printer
Notes: normally invoked by the INT 09 handler when PrtSc key is
pressed, but
may be invoked directly by applications
byte at 0050h:0000h contains status used by default
handler
00h not active
01h PrtSc in progress
FFh last PrtSc encountered error
default handler is at F000h:FF54h in IBM PC and 100%compatible BIOSes
SeeAlso: INT 10/AH=12h/BL=20h

--------C05----------------------------------------------------INT 05 - CPU-generated (80186+) - BOUND RANGE EXCEEDED

Desc:
generated by BOUND instruction when the value to be tested
is less than
the indicated lower bound or greater than the indicated
upper bound.
Note:
returning from this interrupt re-executes the failing
BOUND instruction

--------C06----------------------------------------------------INT 06 - CPU-generated (80286+) - INVALID OPCODE

Desc:
this interrupt is generated when the CPU attempts to
execute an
invalid opcode (most protected-mode instructions are
considered
invalid in real mode) or a BOUND, LDS, LES, or LIDT
instruction
which specifies a register rather than a memory address
Notes: return address points to beginning of invalid instruction
with proper programming, this interrupt may be used to
emulate
instructions which do not exist; many 386 BIOSes emulate
the 80286
undocumented LOADALL instruction which was removed from
the 80386+
generated by the 80386+ when the LOCK prefix is used with
instructions
other than BTS, BTR, BTC, XCHG, XADD (486), CMPXCHG
(486), INC, DEC,
NOT, NEG, ADD, ADC, SUB, SBB, AND, OR, or XOR, or any
instruction
not accessing memory.
SeeAlso: INT 0C"CPU",INT 0D"CPU"

--------C07----------------------------------------------------INT 07 - CPU-generated (80286+) - PROCESSOR EXTENSION

NOT AVAILABLE
Desc:
this interrupt is automatically called if a coprocessor
instruction is
encountered when no coprocessor is installed
Note:
can be used to emulate a numeric coprocessor in software
SeeAlso: INT 09"MATH UNIT PROTECTION"

--------H08----------------------------------------------------INT 08 - IRQ0 - SYSTEM TIMER

Desc:
generated 18.2 times per second by channel 0 of the 8254
system timer,
this interrupt is used to keep the time-of-day clock
updated
Notes: programs which need to be invoked regularly should use INT
1C unless
they need to reprogram the timer while still keeping the
time-of-day
clock running at the proper rate
default handler is at F000h:FEA5h in IBM PC and 100%compatible BIOSes
may be masked by setting bit 0 on I/O port 21h
SeeAlso: INT 1C,INT 4A,INT 50"DESQview",INT 58"DoubleDOS",INT
70,INT 78"GO32"

SeeAlso: INT D8"Screen Thief"

--------C08----------------------------------------------------INT 08 - CPU-generated (80286+) - DOUBLE EXCEPTION

DETECTED
Desc:
or an

called when multiple exceptions occur on one instruction,

exception occurs in an exception handler

Notes: called in protected mode if an interrupt above the defined
limit of
the interrupt vector table occurs
return address points at beginning of instruction with
errors or the
beginning of the instruction which was about to execute
when the
external interrupt caused the exception
if an exception occurs in the double fault handler, the
CPU goes into
SHUTDOWN mode (which circuitry in the PC/AT converts to
a reset);
this "triple fault" is a faster way of returning to real
mode on
many 80286 machines than the standard keyboard
controller reset

--------H09----------------------------------------------------INT 09 - IRQ1 - KEYBOARD DATA READY

Desc:
this interrupt is generated when data is received from the
keyboard.
This is normally a scan code (from either a keypress
*or* a key
release), but may also be an ACK or NAK of a command on
AT-class
keyboards.
Notes: this IRQ may be masked by setting bit 1 on I/O port 21h
if the BIOS supports an enhanced (101/102-key) keyboard,
it calls
INT 15/AH=4Fh after reading the scan code from the
keyboard and
before further processing; all further processing uses
the scan
code returned from INT 15/AH=4Fh
the default interrupt handler is at F000h:E987h in 100%compatible
BIOSes
the interrupt handler performs the following actions for
certain
special keystrokes:
Ctrl-Break
clear keyboard buffer, place word 0000h
in buffer,
invoke INT 1B, and set flag at
0040h:0071h
SysRq
invoke INT 15/AH=85h

next INT 09

Ctrl-Numlock place system in a tight wait loop until

Ctrl-Alt-Del jump to BIOS startup code (either

F000h:FFF0h or the
destination of the jump at that
address)
Shift-PrtSc invoke INT 05
DRDOS hooks this interrupt to control the cursor shape
(underscore/
half block) for overwrite/insert mode
DR Multiuser DOS hooks this interrupt for cursor shape
control and to
control whether Ctrl-Alt-Del reboots the current session
or the
entire system
SeeAlso: INT 05,INT 0B"HP 95LX",INT 15/AH=4Fh,INT 15/AH=85h,INT
16,INT 1B
SeeAlso: INT 2F/AX=A901h,INT 51"DESQview",INT 59"DoubleDOS",INT
79"GO32"
Values for scan code:
01h
Esc
02h
1 !
03h
2 @
04h
3 #
05h
4 $
06h
5 %
07h
6 ^
08h
7 &
09h
8 *
0Ah
9 (
0Bh
0 )
0Ch
- _
0Dh
= +
0Eh
Backspace
0Fh
Tab
10h
Q
11h
W
12h
E
13h
R
14h
T
15h
Y
16h
U
17h
I
18h
O
19h
P
1Ah
[ {
1Bh
] }
1Ch
Enter
1Dh
Ctrl
1Eh
A
1Fh
S
20h
D
code
21h
F
code
22h
G

31h
32h
33h
34h
35h
36h
37h
38h
39h
3Ah
3Bh
3Ch
3Dh
3Eh
3Fh
40h
41h
42h
43h
44h
45h
46h
47h
48h
49h
4Ah
4Bh
4Ch
4Dh
4Eh
4Fh
50h

N
M
, <
. >
/ ?
Right Shift
Grey*
Alt
SpaceBar
CapsLock
F1
F2
F3
F4
F5
F6
F7
F8
F9
F10
NumLock
ScrollLock
Home
UpArrow
PgUp
GreyLeftArrow
Keypad 5
RightArrow
Grey+
End
DownArrow

51h
52h

63h
64h
65h
66h
67h
68h
69h
6Ah
6Bh
6Ch
6Dh

F16
F17
F18
F19
F20
F21
F22
F23
F24
-EraseEOF

6Fh

Copy/Play

72h

CrSel

74h
75h
76h

ExSel
-Clear

E0h

prefix

PgDn

E1h

prefix

Ins

FAh

ACK

23h
H
53h
Del
FEh
RESEND
24h
J
54h
SysRq
FFh
kbd
error/buffer full
25h
K
26h
L
56h
left \| (102-key)
27h
; :
57h
F11
28h
' "
58h
F12
29h
` ~
2Ah
Left Shift
5Ah
PA1
2Bh
\ |
5Bh
F13
2Ch
Z
5Ch
F14
2Dh
X
5Dh
F15
2Eh
C
2Fh
V
30h
B
Note:
scan codes 56h-E1h are only available on the extended
(101/102-key)
keyboard and Host Connected (122-key) keyboard; scan
codes 5Ah-76h
are only available on the 122-key keyboard

--------C09----------------------------------------------------INT 09 - CPU-generated (80286,80386) - PROCESSOR

EXTENSION
PROTECTION ERROR
Desc:
called if the coprocessor attempts to access memory
outside a segment
boundary; it may occur at an arbitrary time after the
coprocessor
instruction was issued
Note:
until the condition is cleared or the coprocessor is
reset, the only
coprocessor instruction which may be used is FNINIT;
WAIT or other
coprocessor instructions will cause a deadlock because
the
coprocessor is still busy waiting for data
SeeAlso: INT 07"CPU"

--------H0A----------------------------------------------------INT 0A - IRQ2 - LPT2 (PC), VERTICAL RETRACE INTERRUPT

(EGA,VGA)
Notes: the TOPS and PCnet adapters use this interrupt request
line by default
DOS 3.2 revectors IRQ2 to a stack-switching routine
on ATs and above, the physical data line for IRQ2 is
labeled IRQ9 and
connects to the slave 8259. The BIOS redirects the
interrupt for
IRQ9 back here.
under DESQview, only the INT 15h vector and BASIC segment
address (the

handler's

word at 0000h:0510h) may be assumed to be valid for the

process
many VGA boards do not implement the vertical retrace
interrupt,
including the IBM VGA Adapter where the traces are
either cut or
removed
SeeAlso: INT 52"DESQview",INT 5A"DoubleDOS",INT 71,INT 7A"GO32"

--------H0B----------------------------------------------------INT 0B - IRQ3 - SERIAL COMMUNICATIONS (COM2)

Desc:
automatically asserted by the UART when COM2 needs
attention, if the
UART has been programmed to generate interrupts
Notes: the TOPS and PCnet adapters use this interrupt request
line as an
alternate
on PS/2s, COM2 through COM8 share this interrupt; on many
PC's, COM4
shares this interrupt
may be masked by setting bit 3 on I/O port 21h
SeeAlso: INT 0C"COM1",INT 53"DESQview",INT 5B"DoubleDOS",INT
7B"GO32"

--------H0C----------------------------------------------------INT 0C - IRQ4 - SERIAL COMMUNICATIONS (COM1)

Desc:
automatically asserted by the UART when COM1 needs
attention, if the
UART has been programmed to generate interrupts
BUG:
this vector is modified but not restored by Direct Access
v4.0, and
may be left dangling by other programs written with the
same version
of compiled BASIC
Notes: on many PC's, COM3 shares this interrupt
may be masked by setting bit 4 on I/O port 21h
SeeAlso: INT 0B"COM2",INT 54"DESQview",INT 5C"DoubleDOS",INT
7C"GO32"

--------H0D----------------------------------------------------INT 0D - IRQ5 - FIXED DISK (PC,XT), LPT2 (AT), reserved

(PS/2)
Notes: under DESQview, only the INT 15h vector and BASIC segment
address (the
word at 0000h:0510h) may be assumed to be valid for the
handler's
process
the Tandy 1000, 1000A, and 1000HD use IRQ2 for the hard
disk; the

1000EX, HX, RLX, RLX-HD, RLX-B, RLX-HD-B use IRQ5

instead; the
1000RL, RL-HD, SL, SL/2, TL, TL/2, and TL/3 are jumperselectable
for either IRQ2 or IRQ5 (default IRQ5); the 1000SX and
TX are
DIP-switch selectable for IRQ2 or IRQ5 (default IRQ2);
the RSX and
RSX-HD use IRQ14. Tandy systems which use IRQ2 for the
hard disk
interrupt use IRQ5 for vertical retrace.
may be masked by setting bit 5 on I/O port 21h
SeeAlso: INT 0E"IRQ6",INT 0F"IRQ7",INT 55"DESQview",INT
5D"DoubleDOS"
SeeAlso: INT 7D"GO32"

--------H0E----------------------------------------------------INT 0E - IRQ6 - DISKETTE CONTROLLER

Desc:
on

this interrupt is generated by the floppy disk controller

completion of an operation
Notes: default handler is at F000h:EF57h in IBM PC and 100%compatible BIOSes
may be masked by setting bit 6 on I/O port 21h
SeeAlso: INT 0D"IRQ5",INT 56"DESQview",INT 5E"DoubleDOS",INT
7E"GO32"

--------H0F----------------------------------------------------INT 0F - IRQ7 - PARALLEL PRINTER

Desc:
this interrupt is generated by the LPT1 printer adapter
when the
printer becomes ready
Notes: most printer adapters do not reliably generate this
interrupt
the 8259 interrupt controller generates an interrupt
corresponding to
IRQ7 when an error condition occurs
SeeAlso: INT 0D"LPT2",INT 57"DESQview",INT 5F"DoubleDOS",INT
7F"GO32"

--------V1000--------------------------------------------------INT 10 - VIDEO - SET VIDEO MODE

AH = 00h
AL = mode (see below)
Return: AL = video mode flag (Phoenix BIOS)
20h mode > 7
30h modes 0-5 and 7
3Fh mode 6
AL = CRT controller mode byte (Phoenix 386 BIOS v1.10)
Desc:
specify the display mode for the currently active display
adapter

Notes: IBM standard modes do not clear the screen if the high bit
of AL is set
(EGA or higher only)
Values for video mode:
text/ text pixel
pixel colors disply scrn system
grph resol box
resoltn
pages
addr
00h = T
40x25 8x8
16gray
8
B800
CGA,PCjr,Tandy
= T
40x25 8x14
16gray
8
B800 EGA
= T
40x25 8x16
16
8
B800 MCGA
= T
40x25 9x16
16
8
B800 VGA
01h = T
40x25 8x8
16
8
B800
CGA,PCjr,Tandy
= T
40x25 8x14
16
8
B800 EGA
= T
40x25 8x16
16
8
B800 MCGA
= T
40x25 9x16
16
8
B800 VGA
02h = T
80x25 8x8
16gray
4
B800
CGA,PCjr,Tandy
= T
80x25 8x14
16gray
4
B800 EGA
= T
80x25 8x16
16
4
B800 MCGA
= T
80x25 9x16
16
4
B800 VGA
03h = T
80x25 8x8
16
4
B800
CGA,PCjr,Tandy
= T
80x25 8x14
16
4
B800 EGA
= T
80x25 8x16
16
4
B800 MCGA
= T
80x25 9x16
16
4
B800 VGA
04h = G
40x25 8x8
320x200
4
B800
CGA,PCjr,EGA,MCGA,VGA
05h = G
40x25 8x8
320x200 4gray
B800 CGA,PCjr,EGA
= G
40x25 8x8
320x200
4
B800 MCGA,VGA
06h = G
80x25 8x8
640x200
2
B800
CGA,PCjr,EGA,MCGA,VGA
07h = T
80x25 9x14
mono
var
B000
MDA,Hercules,EGA
= T
80x25 9x16
mono
B000 VGA
08h = T 132x25 8x8
16
B800 ATI EGA/VGA
Wonder [2]
= T 132x25 8x8
mono
B000 ATI EGA/VGA
Wonder [2]
= G
20x25 8x8
160x200
16
PCjr, Tandy
1000
= G
90x43 8x8
720x352 mono
B000 Hercules +
MSHERC.COM
= G
90x45 8x8
mono
B000 Hercules +
HERKULES [11]
09h = G
40x25 8x8
320x200
16
PCjr, Tandy
1000
0Ah = G
80x25 8x8
640x200
4
PCjr, Tandy
1000
0Bh =
reserved (used internally by EGA BIOS)
= G
80x25 8x8
640x200
16
Tandy 1000
SL/TL [13]
0Ch =
reserved (used internally by EGA BIOS)
0Dh = G
40x25 8x8
320x200
16
8
A000 EGA,VGA
0Eh = G
80x25 8x8
640x200
16
4
A000 EGA,VGA
0Fh = G
80x25 8x14 640x350 mono
2
A000 EGA,VGA
10h = G
80x25 8x14 640x350
4
2
A000 64k EGA

= G
640x350
16
11h = G
80x30 8x16 640x480 mono
EGA,ATI VIP
12h = G
80x30 8x16 640x480 16/256k
= G
80x30 8x16 640x480 16/64
Wonder
= G
640x480
16
UltraVision+256K EGA
13h = G
40x25 8x8
320x200 256/256k
VIP
Index: video modes
Index: installation check|HERKULES

A000 256k EGA,VGA

A000 VGA,MCGA,ATI
A000 VGA,ATI VIP
A000 ATI EGA

A000 VGA,MCGA,ATI

--------V1002--------------------------------------------------INT 10 - VIDEO - SET CURSOR POSITION

AH = 02h
BH = page number
0-3 in modes 2&3
0-7 in modes 0&1
0 in graphics modes
DH = row (00h is top)
DL = column (00h is left)
SeeAlso: AH=03h,AH=05h,INT 60/DI=030Bh

--------V1003--------------------------------------------------INT 10 - VIDEO - GET CURSOR POSITION AND SIZE

AH = 03h
BH = page number
0-3 in modes 2&3
0-7 in modes 0&1
0 in graphics modes
Return: AX = 0000h (Phoenix BIOS)
CH = start scan line
CL = end scan line
DH = row (00h is top)
DL = column (00h is left)
Notes: a separate cursor is maintained for each of up to 8
display pages
many ROM BIOSes incorrectly return the default size for a
color display
(start 06h, end 07h) when a monochrome display is
attached
SeeAlso: AH=01h,AH=02h,AH=12h/BL=34h

--------V1005--------------------------------------------------INT 10 - VIDEO - SELECT ACTIVE DISPLAY PAGE

AH = 05h
AL = new page number (00h to number of pages - 1) (see

AH=00h)
Desc:
specify which of possibly multiple display pages will be
visible

Note:
to determine whether the requested page actually exists,
use AH=0Fh
to query the current page after making this call
SeeAlso: AH=0Fh,AH=43h,AH=45h

--------V1006--------------------------------------------------INT 10 - VIDEO - SCROLL UP WINDOW

AH = 06h
AL = number of lines by which to scroll up (00h = clear
entire window)
BH = attribute used to write blank lines at bottom of
window
CH,CL = row,column of window's upper left corner
DH,DL = row,column of window's lower right corner
Note:
affects only the currently active page (see AH=05h)
Warning: some implementations have a bug which destroys BP
SeeAlso: AH=07h,AH=72h,AH=73h,AX=7F07h,INT 50/AX=0014h

--------V1008--------------------------------------------------INT 10 - VIDEO - READ CHARACTER AND ATTRIBUTE AT CURSOR

POSITION
AH = 08h
BH = page number (00h to number of pages - 1) (see AH=00h)
Return: AH = charater's attribute (see below)
AL = character
Notes: for monochrome displays, a foreground of 1 with background
0 is
underlined
the blink bit may be reprogrammed to enable intense
background colors
using AX=1003h or by programming the CRT controller
the foreground intensity bit (3) can be programmed to
switch between
character sets A and B on EGA and VGA cards, thus
enabling 512
simultaneous characters on screen. In this case the
bit's usual
function (intensity) is regularly turned off.
SeeAlso: AH=09h,AX=1003h,AX=5001h
Bitfields for character's attribute:
bit 7 blink
bits 6-4 background color
000 black
100 red
001 blue
101 magenta
010 green
110 brown
011 cyan
111 white
bits 3-0 foreground color
0000 black
1000 dark gray
0001 blue
1001 light blue
0010 green
1010 light green
0011 cyan
1011 light cyan
0100 red
1100 light red

0101 magenta
0110 brown
0111 light gray

1101 light magenta

1110 yellow
1111 white

--------V1009--------------------------------------------------INT 10 - VIDEO - WRITE CHARACTER AND ATTRIBUTE AT

CURSOR POSITION
AH
AL
BH
BL

=
=
=
=

09h
character to display
page number (00h to number of pages - 1) (see AH=00h)
attribute (text mode) or color (graphics mode)
if bit 7 set in graphics mode, character is xor'ed

onto screen
CX = number of times to write character
Notes: all characters are displayed, including CR, LF, and BS
replication count in CX may produce an unpredictable
result in graphics
modes if it is greater than the number of positions
remaining in the
current row
SeeAlso: AH=08h,AH=0Ah,AH=4Bh"GRAFIX",INT 17/AH=60h,INT 1F,INT
43,INT 44

--------V100C--------------------------------------------------INT 10 - VIDEO - WRITE GRAPHICS PIXEL

screen)
Desc:
Notes:

AH = 0Ch
BH = page number
AL = pixel color (if bit 7 set, value is xor'ed onto
CX = column
DX = row
set a single pixel on the display in graphics modes
valid only in graphics modes
BH is ignored if the current video mode supports only one

page
SeeAlso: AH=0Dh,AH=46h

--------V100E--------------------------------------------------INT 10 - VIDEO - TELETYPE OUTPUT

AH = 0Eh
AL = character to write
BH = page number
BL = foreground color (graphics modes only)
Desc:
display a character on the screen, advancing the cursor
and scrolling
the screen as necessary
Notes: characters 07h (BEL), 08h (BS), 0Ah (LF), and 0Dh (CR) are
interpreted
and do the expected things
IBM PC ROMs dated 4/24/81 and 10/19/81 require that BH be
the same as

the current active page

SeeAlso: AH=02h,AH=0Ah

--------V100F--------------------------------------------------INT 10 - VIDEO - GET CURRENT VIDEO MODE

AH = 0Fh
Return: AH = number of character columns
AL = display mode (see AH=00h)
BH = active page (see AH=05h)
Notes: if mode was set with bit 7 set ("no blanking"), the
returned mode will
also have bit 7 set
EGA, VGA, and UltraVision return either AL=03h (color) or
AL=07h
(monochrome) in all extended-row text modes
SeeAlso: AH=00h,AH=05h,AX=10F2h/BL=00h,AX=1130h,AX=CD04h

--------V101002------------------------------------------------INT 10 - VIDEO - SET ALL PALETTE REGISTERS

(PCjr,Tandy,EGA,VGA)
AX = 1002h
ES:DX -> palette register list
Note:
under UltraVision, the palette locking status (see
AX=CD01h)
determines the outcome
SeeAlso: AX=1000h,AX=1001h,AX=1009h,AX=CD01h

Format of palette register list:

Offset Size
Description
00h 16 BYTEs
colors for palette registers 00h through 0Fh
10h
BYTE
border color

--------V101012------------------------------------------------INT 10 - VIDEO - SET BLOCK OF DAC REGISTERS (VGA/MCGA)

AX = 1012h
BX = starting color register
CX = number of registers to set
ES:DX -> table of 3*CX bytes where each 3 byte group
represents one
byte each of red, green and blue (0-63)
SeeAlso: AX=1010h,AX=1017h,INT 62/AX=00A5h

--------V101013------------------------------------------------INT 10 - VIDEO - SELECT VIDEO DAC COLOR PAGE (VGA)

AX = 1013h
BL = subfunction
00h select paging mode
BH = 00h select 4 blocks of 64
BH = 01h select 16 blocks of 16

01h select page

BH = page number (00h to 03h) or (00h to 0Fh)
Note:
this function is not valid in mode 13h
SeeAlso: AX=101Ah

--------V101A00------------------------------------------------INT 10 - VIDEO - GET DISPLAY COMBINATION CODE

(PS,VGA/MCGA)
AX = 1A00h
Return: AL = 1Ah if function was supported
BL = active display code (see below)
BH = alternate display code
SeeAlso: AH=12h/BL=35h,AX=1A01h,AH=1Bh
Values for display combination code:
00h
no display
01h
monochrome adapter w/ monochrome display
02h
CGA w/ color display
03h
reserved
04h
EGA w/ color display
05h
EGA w/ monochrome display
06h
PGA w/ color display
07h
VGA w/ monochrome analog display
08h
VGA w/ color analog display
09h
reserved
0Ah
MCGA w/ digital color display
0Bh
MCGA w/ monochrome analog display
0Ch
MCGA w/ color analog display
FFh
unknown display type

--------V-104F00----------------------------INT 10 - VESA SuperVGA BIOS - GET SuperVGA INFORMATION

AX = 4F00h
ES:DI -> 256-byte buffer for SuperVGA information (see

#0063)
Return: AL = 4Fh if function supported
AH = status
00h successful
ES:DI buffer filled
01h failed
Desc:
determine whether VESA BIOS extensions are present and the
capabilities
supported by the display adapter
SeeAlso: AX=4E00h,AX=4F01h,AX=7F00h,AX=A00Ch
Index: installation check;VESA SuperVGA
Format of SuperVGA information:
Offset Size
Description
(Table 0063)
00h 4 BYTEs
signature ("VESA")
04h
WORD
VESA version number
06h
DWORD
pointer to OEM name
"761295520" for ATI
0Ah 4 BYTEs
capabilities
0Eh
DWORD
pointer to list of supported VESA and OEM video
modes

(list of words terminated with FFFFh)

12h
WORD
total amount of video memory in 64K blocks
14h 236 BYTEs reserved
Notes: the list of supported video modes is stored in the
reserved portion of
the SuperVGA information record by some implementations,
and it may
thus be necessary to either copy the mode list or use a
different
buffer for all subsequent VESA calls
the 1.1 VESA document specifies 242 reserved bytes at the
end, so the
buffer should be 262 bytes to ensure that it is not
overrun

--------V-104F01----------------------------INT 10 - VESA SuperVGA BIOS - GET SuperVGA MODE

INFORMATION
AX = 4F01h
CX = SuperVGA video mode
ES:DI -> 256-byte buffer for mode information (see #0064)
Return: AL = 4Fh function supported
AH = status
00h successful
ES:DI buffer filled
01h failed
Desc:
determine the attributes of the specified video mode
SeeAlso: AX=4F00h,AX=4F02h
Format of VESA SuperVGA mode information:
Offset Size
Description
(Table 0064)
00h
WORD
mode attributes (see #0065)
02h
BYTE
window attributes, window A (see #0066)
03h
BYTE
window attributes, window B (see #0066)
04h
WORD
window granularity in KB
06h
WORD
window size in KB
08h
WORD
start segment of window A
0Ah
WORD
start segment of window B
0Ch
DWORD
-> FAR window positioning function (equivalent to
AX=4F05h)
10h
WORD
bytes per scan line
---remainder is optional for VESA modes in v1.0/1.1, needed for
OEM modes--12h
WORD
width in pixels (graphics) or characters (text)
14h
WORD
height in pixels (graphics) or characters (text)
16h
BYTE
width of character cell in pixels
17h
BYTE
height of character cell in pixels
18h
BYTE
number of memory planes
19h
BYTE
number of bits per pixel
1Ah
BYTE
number of banks
1Bh
BYTE
memory model type (see #0067)
1Ch
BYTE
size of bank in KB
1Dh
BYTE
number of image pages
1Eh
BYTE
reserved (0)
---VBE v1.2+--1Fh
BYTE
red mask size
20h
BYTE
red field position

21h
BYTE
22h
BYTE
23h
BYTE
24h
BYTE
25h
BYTE
26h
BYTE
27h
BYTE
28h 216 BYTEs

green mask size

green field size
blue mask size
blue field size
reserved mask size
reserved mask position
direct color mode info
reserved (0)

Bitfields for VESA SuperVGA mode attributes:

Bit(s) Description
(Table 0065)
0
mode supported
1
optional information available
2
BIOS output supported
3
set if color, clear if monochrome
4
set if graphics mode, clear if text mode
Bitfields for VESA SuperVGA window attributes:
Bit(s) Description
(Table 0066)
0
exists
1
readable
2
writable
3-7
reserved
(Table 0067)
Values for VESA SuperVGA memory model type:
00h
text
01h
CGA graphics
02h
HGC graphics
03h
16-color (EGA) graphics
04h
packed pixel graphics
05h
"sequ 256" (non-chain 4) graphics
06h
direct color (HiColor, 24-bit color)
07h
YUV (luminance-chrominance, also called YIQ)
08h-0Fh reserved for VESA
10h-FFh OEM memory models

--------V-104F02----------------------------INT 10 - VESA SuperVGA BIOS - SET SuperVGA VIDEO MODE

AX = 4F02h
BX = mode
bit 15 set means don't clear video memory
Return: AL = 4Fh function supported
AH = status
00h successful
01h failed
SeeAlso: AX=4E03h,AX=4F01h,AX=4F03h
(Table 0068)
Values for VESA video mode:
00h-FFh OEM video modes (see #0009 at AH=00h)
100h
640x400x256
101h
640x480x256
102h
800x600x16
103h
800x600x256
104h
1024x768x16
105h
1024x768x256

106h
1280x1024x16
107h
1280x1024x256
108h
80x60 text
109h
132x25 text
10Ah
132x43 text
10Bh
132x50 text
10Ch
132x60 text
---VBE v1.2--10Dh
320x200x32K
10Eh
320x200x64K
10Fh
320x200x16M
110h
640x480x32K
111h
640x480x64K
112h
640x480x16M
113h
800x600x32K
114h
800x600x64K
115h
800x600x16M
116h
1024x768x32K
117h
1024x768x64K
118h
1024x768x16M
119h
1280x1024x32K
11Ah
1280x1024x64K
11Bh
1280x1024x16M
Index: video modes
(Table 0069)
Values for S3 OEM video mode:
201h
640x480x256
202h
800x600x16
203h
800x600x256
204h
1024x768x16
205h
1024x768x256
206h
1280x960x16
208h
1280x1024x16
211h
640x480x64K (Diamond Stealth 24)
212h
640x480x16M (Diamond Stealth 24)
301h
640x480x32K
Note:
these modes are only available on video cards using S3's
VESA driver
Index: video modes

--------V-104F03----------------------------INT 10 - VESA SuperVGA BIOS - GET CURRENT VIDEO MODE

AX = 4F03h
Return: AL = 4Fh function supported
AH = status
00h successful
BX = video mode (see #0068,#0069)
01h failed
SeeAlso: AH=0Fh,AX=4E04h,AX=4F02h

--------V-104F04----------------------------INT 10 - VESA SuperVGA BIOS - SAVE/RESTORE SuperVGA

VIDEO STATE
AX = 4F04h
DL = subfunction
00h get state buffer size
Return: BX = number of 64-byte blocks needed

01h save video states

ES:BX -> buffer
02h restore video states
ES:BX -> buffer
CX = states to save/restore (see #0070)
Return: AL = 4Fh function supported
AH = status
00h successful
01h failed
Bitfields for VESA SuperVGA states to save/restore:
Bit(s) Description
(Table 0070)
0
video hardware state
1
video BIOS data state
2
video DAC state
3
SuperVGA state

--------V-104F05----------------------------INT 10 - VESA SuperVGA BIOS - CPU VIDEO MEMORY CONTROL

AX = 4F05h
BH = subfunction
00h select video memory window
DX = window address in video memory (in
granularity units)
01h get video memory window
Return: DX = window address in video memory (in
gran. units)
BL = window number
00h window A
01h window B
Return: AL = 4Fh function supported
AH = status
00h successful
01h failed
SeeAlso: AX=4F01h,AX=4F06h,AX=4F07h,AX=7000h/BX=0004h

--------V-104F06----------------------------INT 10 - VESA SuperVGA BIOS v1.1+ - GET/SET LOGICAL

SCAN LINE
LENGTH
AX = 4F06h
BL = function
00h set scan line length
CX = desired width in pixels
01h get scan line length
Return: AL = 4Fh if function supported
AH = status
00h successful
01h failed
BX = bytes per scan line
CX = number of pixels per scan line
DX = maximum number of scan lines
Notes: if the desired width is not achievable, the next larger
width will be
set
the scan line may be wider than the visible area of the
screen

are

this function is valid in text modes, provided that values

multiplied by the character cell width/height

SeeAlso: AX=4F01h,AX=4F05h,AX=4F07h

--------V-104F07BH00------------------------INT 10 - VESA SuperVGA BIOS v1.1+ - GET/SET DISPLAY

START
AX = 4F07h
BH = 00h (reserved)
BL = function
00h set display start
CX = leftmost displayed pixel in scan line
DX = first displayed scan line
01h get display start
Return: BH = 00h
CX = leftmost displayed pixel in scan line
DX = first displayed scan line
Return: AL = 4Fh if function supported
AH = status
00h successful
01h failed
Note:
this function is valid in text modes, provided that values
are
multiplied by the character cell width/height
SeeAlso: AX=4F01h,AX=4F05h,AX=4F06h

--------V-104F08----------------------------INT 10 - VESA SuperVGA BIOS v1.2+ - GET/SET DAC PALETTE

CONTROL
AX = 4F08h
BL = function
00h set DAC palette width
BH = desired number of bits per primary color
01h get DAC palette width
Return: AL = 4Fh if function supported
AH = status
BH = current number of bits per primary (06h = standard
VGA)

--------B11----------------------------------------------------INT 11 - BIOS - GET EQUIPMENT LIST

Return: (E)AX = BIOS equipment list word (see below)
Note:
since older BIOSes do not know of the existence of EAX,
the high word
of EAX should be cleared before this call if any of the
high bits
will be tested
Bitfields for BIOS equipment list:
bit 0 floppy disk(s) installed (see bits 6-7)
bit 1 80x87 coprocessor installed
bits 2,3 number of 16K banks of RAM on motherboard (PC only)
number of 64K banks of RAM on motherboard (XT only)
bit 2 pointing device installed (PS)
bit 3 unused (PS)

bits 4-5 initial video mode

00 EGA, VGA, or PGA
01 40x25 color
10 80x25 color
11 80x25 monochrome
bits 6-7 number of floppies installed less 1 (if bit 0 set)
bit 8 DMA support installed (PCjr, Tandy 1400LT)
DMA support *not* installed (Tandy 1000's)
bits 9-11 number of serial ports installed
bit 12 game port installed
bit 13 serial printer attached (PCjr)
internal modem installed (PC/Convertible)
bits 14-15 number of parallel ports installed
---Compaq, Dell, and many other 386/486 machines-bit 23: page tables set so that Weitek coprocessor addressable in
real mode
bit 24: Weitek math coprocessor present
---Compaq Systempro--bit 25: internal DMA parallel port available
bit 26: IRQ for internal DMA parallel port (if bit 25 set)
0 = IRQ5
1 = IRQ7
bits 27,28: parallel port DMA channel
00 DMA channel 0
01 DMA channel 0 ???
10 reserved
11 DMA channel 3
SeeAlso: INT 12

--------B12----------------------------------------------------INT 12 - BIOS - GET MEMORY SIZE

Return: AX = kilobytes of contiguous memory starting at absolute
address 00000h
Note:
this call returns the contents of the word at 0040h:0013h;
in PC and
XT, this value is set from the switches on the
motherboard
SeeAlso: INT 11,INT 2F/AX=4A06h

--------B1300--------------------------------------------------INT 13 - DISK - RESET DISK SYSTEM

AH = 00h
DL = drive (if bit 7 is set both
disks reset)
Return: AH = status (see AH=01h)
CF clear if successful (returned
CF set on error
Note:
forces controller to recalibrate
track 0)
SeeAlso: AH=0Dh,AH=11h,INT 21/AH=0Dh,INT

hard disks and floppy

AH=00h)
drive heads (seek to
4E"TI Professional"

--------B1301--------------------------------------------------INT 13 - DISK - GET STATUS OF LAST OPERATION

AH = 01h
DL = drive (bit 7 set for hard disk)
Return: CF clear if successful (returned status 00h)
CF set on error
AH = status of previous operation (see below)
Note:
some BIOSes return the status in AL; the PS/2 Model 30/286
returns the
status in both AH and AL
Values for status:
00h
successful completion
01h
invalid function in AH or invalid parameter
02h
address mark not found
03h
disk write-protected
04h
sector not found/read error
05h
reset failed (hard disk)
06h
disk changed (floppy)
07h
drive parameter activity failed (hard disk)
08h
DMA overrun
09h
attempted DMA across 64K boundary
0Ah
bad sector detected (hard disk)
0Bh
bad track detected (hard disk)
0Ch
unsupported track or invalid media
0Dh
invalid number of sectors on format (hard disk)
0Eh
control data address mark detected (hard disk)
0Fh
DMA arbitration level out of range (hard disk)
10h
uncorrectable CRC or ECC error on read
11h
data ECC corrected (hard disk)
20h
controller failure
31h
no such drive (Compaq)
32h
incorrect drive type stored in CMOS (Compaq)
40h
seek failed
80h
timeout (not ready)
AAh
drive not ready (hard disk)
BBh
undefined error (hard disk)
CCh
write fault (hard disk)
E0h
status register error (hard disk)
FFh
sense operation failed (hard disk)

--------B1302--------------------------------------------------INT 13 - DISK - READ SECTOR(S) INTO MEMORY

AH
AL
CH
CL

=
=
=
=

02h
number of sectors to read (must be nonzero)
low eight bits of cylinder number
sector number 1-63 (bits 0-5)
high two bits of cylinder (bits 6-7, hard disk only)
DH = head number
DL = drive number (bit 7 set for hard disk)
ES:BX -> data buffer
Return: CF set on error

if AH = 11h (corrected ECC error), AL = burst length

CF clear if successful
AH = status (see AH=01h)
AL = number of sectors transferred
Notes: errors on a floppy may be due to the motor failing to spin
up quickly
enough; the read should be retried at least three times,
resetting
the disk with AH=00h between attempts
the IBM AT BIOS and many other BIOSes use only the low
four bits of
DH (head number) since the WD-1003 controller which is
the standard
AT controller (and the controller that IDE emulates)
only supports
16 heads
AWARD AT BIOS and AMI 386sx BIOS have been extended to
handle more
than 1024 cylinders by placing bits 10 and 11 of the
cylinder number
into bits 6 and 7 of DH
SeeAlso: AH=03h,AH=0Ah

--------B1303--------------------------------------------------INT 13 - DISK - WRITE DISK SECTOR(S)

AH
AL
CH
CL

=
=
=
=

03h
number of sectors to write (must be nonzero)
low eight bits of cylinder number
sector number 1-63 (bits 0-5)
high two bits of cylinder (bits 6-7, hard disk only)
DH = head number
DL = drive number (bit 7 set for hard disk)
ES:BX -> data buffer
Return: CF set on error
CF clear if successful
AH = status (see AH=01h)
AL = number of sectors transferred
Notes: errors on a floppy may be due to the motor failing to spin
up quickly
enough; the write should be retried at least three
times, resetting
the disk with AH=00h between attempts
the IBM AT BIOS and many other BIOSes use only the low
four bits of
DH (head number) since the WD-1003 controller which is
the standard
AT controller (and the controller that IDE emulates)
only supports
16 heads
AWARD AT BIOS and AMI 386sx BIOS have been extended to
handle more
than 1024 cylinders by placing bits 10 and 11 of the
cylinder number
into bits 6 and 7 of DH
SeeAlso: AH=02h,AH=0Bh

--------B1304--------------------------------------------------INT 13 - DISK - VERIFY DISK SECTOR(S)

AH
AL
CH
CL

=
=
=
=

04h
number of sectors to verify (must be nonzero)
low eight bits of cylinder number
sector number 1-63 (bits 0-5)
high two bits of cylinder (bits 6-7, hard disk only)
DH = head number
DL = drive number (bit 7 set for hard disk)
ES:BX -> data buffer (PC,XT,AT with BIOS prior to
11/15/85)
Return: CF set on error
CF clear if successful
AH = status (see AH=01h)
AL = number of sectors verified
Notes: errors on a floppy may be due to the motor failing to spin
up quickly
enough; the write should be retried at least three
times, resetting
the disk with AH=00h between attempts
this function does not compare the disk with memory, it
merely
checks whether the sector's stored CRC matches the
data's actual CRC
the IBM AT BIOS and many other BIOSes use only the low
four bits of
DH (head number) since the WD-1003 controller which is
the standard
AT controller (and the controller that IDE emulates)
only supports
16 heads
AWARD AT BIOS and AMI 386sx BIOS have been extended to
handle more
than 1024 cylinders by placing bits 10 and 11 of the
cylinder number
into bits 6 and 7 of DH
SeeAlso: AH=02h

--------B1305--------------------------------------------------INT 13 - FLOPPY - FORMAT TRACK

AH = 05h
AL = number of sectors to format
CH = track number
DH = head number
DL = drive number
ES:BX -> address field buffer (see below)
Return: CF set on error
CF clear if successful
AH = status (see AH=01h)
Notes: on AT or higher, call AH=17h first
the number of sectors per track is read from the diskette
parameter

table pointed at by INT 1E

SeeAlso: AH=05h"FIXED",AH=17h,AH=18h,INT 1E
Format of address field buffer entry (one per sector in track):
Offset Size
Description
00h
BYTE
track number
01h
BYTE
head number (0-based)
02h
BYTE
sector number
03h
BYTE
sector size (00h=128 bytes, 01h=256 bytes,
02h=512, 03h=1024)

--------B-13057FSI324D----------------------INT 13 - 2M - FORMAT TRACK

AX = 057Fh
SI = 324Dh ("2M")
CH = track number
DH = head number
DL = drive number
ES:BX -> boot sector of future 2M diskette
Return: CF set on error
CF clear if successful
AH = status (see AH=01h)
Program: 2M is a TSR developed by Ciriaco Garcia de Celis to
support
non standard diskettes with 820-902/1476-1558K (5.25
DD/HD)
and 984-1066/1804-1886K/3608-3772K (3.5 DD/HD/ED)
Notes: it is not necessary to call AH=17h/AH=18h first (will be
ignored)
diskette format must begin always on cylinder 0 head 0
the installation check for 2M must search a
"CiriSOFT:2M:3.0" or
"CiriSOFT:2MX:3.0" or similar (recomended ":2M:" or
":2MX:"
substrings) in CiriSOFT TSR interface
the boot sector can be obtained from a 2M diskette already
formatted if
reading (AH=02h) with normal head number in 2M 1.x and
with head 80h
in 2M 2.0+
since 2M 2.0+ release, the BOOT sector is emulated using
first physical
sector of FAT2; the second-sixth physical sectors of
FAT2 in HD or ED
diskettes store the SuperBOOT code. To skip the FAT2
emulation (using
FAT1) of 2M, in order to read the SuperBOOT code, in 2M
2.0+ the head
number must be 80h instead 0 (bit 7 on) in read/write
functions, and
the number of sectors must be 7+FT in HD and 2+FT in DD,
being FT the
number of sectors ocupied by one FAT. This lets diskcopy
programs to
format 2M target disks copying also the SuperBOOT code.
If target

diskette is already 2MF formatted (provided of boot

code) this trick
it is not necessary
when using STV technology (offset 65 of boot sector equal
to 1) it is
necessary to write the full track before formatting
(except track 0
side 0) to complete the format and skip future CRC
errors on read;
with 2M 2.0+ in track 0 side 1 the head used must be 81h
instead 1.
Optimized diskcopy programs may do a format-write-verify
secuential
phases to improve performance
SeeAlso: AH=05h"FLOPPY",INT 2F"CiriSOFT TSR interface"

--------B1308--------------------------------------------------INT 13 - DISK - GET DRIVE PARAMETERS

(PC,XT286,CONV,PS,ESDI,SCSI)

AH = 08h
DL = drive (bit 7 set for hard disk)
Return: CF set on error
AH = status (07h) (see AH=01h)
CF clear if successful
AH = 00h
BL = drive type (AT/PS2 floppies only) (see below)
CH = low eight bits of maximum cylinder number
CL = maximum sector number (bits 5-0)
high two bits of maximum cylinder number (bits 76)
DH = maximum head number
DL = number of drives
ES:DI -> drive parameter table (floppies only)
Notes: may return successful even though specified drive is
greater than the
number of attached drives of that type (floppy/hard);
check DL to
ensure validity
for systems predating the IBM AT, this call is only valid
for hard
disks, as it is implemented by the hard disk BIOS rather
than the
ROM BIOS
Toshiba laptops with HardRAM return DL=02h when called
with DL=80h,
but fail on DL=81h. The BIOS data at 40h:75h correctly
reports 01h.
SeeAlso: AH=06h"Adaptec",AH=15h,INT 1E,INT 41
Values for drive type:
01h
360K
02h
1.2M
03h
720K
04h
1.44M

05h
??? (reportedly an obscure drive type shipped on some IBM
machines)
2.88M on some machines (at least AMI 486 BIOS)
06h
2.88M

--------B1316--------------------------------------------------INT 13 - FLOPPY DISK - DETECT DISK CHANGE (XT 1/10/86

or
later,XT286,AT,PS)
AH = 16h
DL = drive number
Return: CF clear if change line inactive
AH = 00h (disk not changed)
CF set if change line active
AH = status
06h change line active or not supported
80h drive not ready or not present
Note:
call AH=15h first to determine whether the drive supports
a change
line
SeeAlso: AH=15h

--------B154F--------------------------------------------------INT 15 C - KEYBOARD - KEYBOARD INTERCEPT (AT model

3x9,XT2,XT286,CONV,PS)
AH
AL
CF
Return: CF

= 4Fh
= hardware scan code
set
set
AL = hardware scan code
CF clear
scan code should be ignored
Note:
called by INT 09 handler to translate scan codes; the INT
09 code does
not examine the scan code it reads from the keyboard
until after
this function returns. This permits software to
rearrange the
keyboard; for example, swapping the CapsLock and Control
keys, or
turning the right Shift key into Enter.
SeeAlso: INT 09,INT 15/AH=C0h

--------B1585--------------------------------------------------INT 15 C - OS HOOK - SysRq KEY ACTIVITY (AT,PS)

AH
AL
CF
Return: CF

= 85h
= SysRq key action (00h pressed, 01h released)
clear
clear if successful
AH = 00h
CF set on error

AH = status (see AH=84h)

called by keyboard decode routine
the default handler simply returns successfully; programs
which wish
to monitor the SysRq key must hook this call
SeeAlso: INT 09
Notes:

--------B1586--------------------------------------------------INT 15 - BIOS - WAIT (AT,PS)

AH = 86h
CX:DX = interval in microseconds
Return: CF clear if successful (wait interval elapsed)
CF set on error or AH=83h wait already in progress
AH = status (see AH=84h)
Note:
the resolution of the wait period is 977 microseconds on
most systems
because most BIOSes use the 1/1024 second fast interrupt
from the AT
real-time clock chip which is available on INT 70
SeeAlso: AH=41h,AH=83h,INT 1A/AX=FF01h,INT 70

--------B1590--------------------------------------------------INT 15 - OS HOOK - DEVICE BUSY (AT,PS)

AH = 90h
AL = device type (see below)
ES:BX -> request block for type codes 80h through BFh
CF clear
Return: CF set if wait time satisfied
CF clear if driver must perform wait
AH = 00h
Notes: type codes are allocated as follows:
00-7F non-reentrant devices; OS must arbitrate access
80-BF reentrant devices; ES:BX points to a unique
control block
C0-FF wait-only calls, no complementary INT 15/AH=91h
call
floppy and hard disk BIOS code uses this call to implement
a timeout;
for device types 00h and 01h, a return of CF set means
that the
timeout expired before the disk responded.
this function should be hooked by a multitasker to allow
other tasks
to execute while the BIOS is waiting for I/O completion;
the default
handler merely returns with AH=00h and CF clear
SeeAlso: AH=91h,INT 13/AH=00h,INT 17/AH=00h,INT 1A/AH=83h
Values for device type:
00h
disk
01h
diskette
02h
keyboard
03h
PS/2 pointing device

21h
80h
FBh
FCh
FDh
FEh

waiting for keyboard input (Phoenix BIOS)

network
digital sound (Tandy)
disk reset (PS)
diskette motor start
printer

--------B1591--------------------------------------------------INT 15 - OS HOOK - DEVICE POST (AT,PS)

AH = 91h
AL = device type (see AH=90h)
ES:BX -> request block for type codes 80h through BFh
CF clear
Return: AH = 00h
Note:
this function should be hooked by a multitasker to allow
other tasks
to execute while the BIOS is waiting for I/O completion;
the default
handler merely returns with AH=00h and CF clear
SeeAlso: AH=90h

--------B15C0--------------------------------------------------INT 15 - SYSTEM - GET CONFIGURATION (XT after

1/10/86,AT mdl
3x9,CONV,XT286,PS)

AH = C0h
Return: CF set if BIOS doesn't support call
CF clear on success
ES:BX -> ROM table (see below)
AH = status
00h successful
86h unsupported function
Notes: the 1/10/86 XT BIOS returns an incorrect value for the
feature byte
the configuration table is at F000h:E6F5h in 100%
compatible BIOSes
Dell machines contain the signature "DELL" or "Dell" at
absolute FE076h
and a model byte at absolute address FE845h
Hewlett-Packard machines contain the signature "HP" at
F000h:00F8h and
a product identifier at F000h:00FAh (see below)
Compaq machines can be identified by the signature string
"COMPAQ" at
F000h:FFEAh, and is preceded by additional information
(see below)
Tandy 1000 machines contain 21h in the byte at F000h:C000h
and FFh in
the byte at FFFFh:000Eh; Tandy 1000SL/TL machines only
provide the
first three data bytes (model/submodel/revision) in the
returned
table

some AST machines contain the string "COPYRIGHT AST

RESEARCH" one byte
past the end of the configuration table
the Phoenix 386 BIOS contains a second version and date
string
(presumably the last modification for that OEM version)
beginning at
F000h:FFD8h, with each byte doubled (so that both ROM
chips contain
the complete information)
SeeAlso: AH=C7h,AH=C9h,AH=D1h
Format of ROM configuration table:
Offset Size
Description
00h
WORD
number of bytes following
02h
BYTE
model (see below)
03h
BYTE
submodel (see below)
04h
BYTE
BIOS revision: 0 for first release, 1 for 2nd,
etc.
05h
BYTE
feature byte 1 (see below)
06h
BYTE
feature byte 2 (see below)
07h
BYTE
feature byte 3 (see below)
08h
BYTE
feature byte 4:
bit 7: ??? (set on N51SX, CL57SX)
bits 6-4: reserved
bit 3: ??? (set on some 1992 PS/1's, 35SX, 40SX)
bits 2-1: reserved
bit 0: ??? (set on N51SX, CL57SX, 57SX)
09h
BYTE
feature byte 5:
reserved (0) (IBM)
??? (08h) (Phoenix 386 v1.10)
---AWARD BIOS--0Ah N BYTEs
AWARD copyright notice
---Phoenix BIOS--0Ah
BYTE
??? (00h)
0Bh
BYTE
major version
0Ch
BYTE
minor version (BCD)
0Dh 4 BYTEs
ASCIZ string "PTL" (Phoenix Technologies Ltd)
---Quadram Quad386--0Ah 17 BYTEs
ASCII signature string "Quadram Quad386XT"
Bitfields for feature byte 1:
bit 7 DMA channel 3 used by hard disk BIOS
bit 6 2nd 8259 installed
bit 5 Real-Time Clock installed
bit 4 INT 15/AH=4Fh called upon INT 09h
bit 3 wait for external event (INT 15/AH=41h) supported
bit 2 extended BIOS area allocated (usually at top of RAM)
bit 1 bus is Micro Channel instead of ISA
bit 0 system has dual bus (Micro Channel + ISA)
Bitfields for feature
bit 7 reserved
bit 6 INT 16/AH=09h
bit 5 INT 15/AH=C6h
bit 4 INT 15/AH=C7h
bit 3 INT 15/AH=C8h

byte 2:
(keyboard functionality) supported
(get POS data) supported
(return memory map info) supported
(en/disable CPU functions) supported

bit 2
bit 1
bit 0

non-8042 keyboard controller

data streaming supported
reserved

Bitfields for feature byte 3:

bits 7-5 reserved
bit 4 ??? (set on 1992 PS/1's, N51SX, CL57SX, 35SX?, 40SX?)
bit 3 SCSI subsystem supported on system board
bit 2 information panel installed
bit 1 IML (Initial Machine Load) system
bit 0 SCSI supported in IML
Values for model/submodel/revision:
Model Submdl Rev
BIOS date
System
FFh
*
*
04/24/81
PC (original)
FFh
*
*
10/19/81
PC (some bugfixes)
FFh
*
*
10/27/82
PC (HD, 640K, EGA support)
FFh
00h
rev
???
Tandy 1000SL
FFh
01h
rev
???
Tandy 1000TL
FFh
46h
***
???
Olivetti M15
FEh
*
*
08/16/82
PC XT
FEh
*
*
11/08/82
PC XT and Portable
FEh
43h
***
???
Olivetti M240
FEh
A6h
???
???
Quadram Quad386
FDh
*
*
06/01/83
PCjr
FCh
*
*
01/10/84
AT models 068,099 6 MHz
20MB
FCh
00h
00h
???
PC3270/AT
FCh
00h
01h
06/10/85
AT model 239
6 MHz
30MB
FCh
00h
> 01h
???
7531/2 Industrial AT
FCh
01h
00h
11/15/85
AT models 319,339 8 MHz,
Enh Keyb, 3.5"
FCh
01h
00h
09/17/87
Tandy 3000
FCh
01h
00h
01/15&88
Toshiba T5200/100
FCh
01h
00h
12/26*89
Toshiba T1200/XE
FCh
01h
00h
04/05A92
Toshiba T4500SX-C
FCh
01h
00h
07/17o92
Toshiba T1800SX
FCh
01h
00h
12/25n92
Toshiba T1850SX
FCh
01h
00h
01/13E93
Toshiba T4400C
(Those date characters are not typos)
FCh
01h
00h
03/08/93
Compaq DESKPRO/i
FCh
01h
00h
various
Compaq DESKPRO, SystemPro,
ProSignia
FCh
01h
20h
06/10/92
AST
FCh
01h
30h
???
Tandy 3000NL
FCh
01h
???
???
Compaq 286/386
FCh
02h
00h
04/21/86
PC XT-286
FCh
02h
00h
various
Compaq LTE Lite
FCh
02h
00h
08/05/93
Compaq Contura
486/486c/486cx
FCh
04h
00h
02/13/87
** PS/2 Model 50 (10 MHz/1 ws
286)
FCh
04h
02h
???
PS/2 Model 50
FCh
04h
03h
04/18/88
PS/2 Model 50Z (10 MHz/0
ws 286)
FCh
04h
04h
???
PS/2 Model 50Z

FCh
05h
FCh
06h
FCh
06h
FCh
08h
FCh
08h
FCh
09h
FCh
09h
FCh
0Bh
286)
FCh
20h
FCh
30h
FCh
31h
FCh
33h
FCh
42h
FCh
45h
XP 5)
FCh
48h
FCh
4Fh
FCh
50h
FCh
51h
FCh
52h
FCh
81h
FCh
81h
FCh
82h
FCh
94h
FBh
00h
support
FBh
00h
FBh
4Ch
FAh
00h
FAh
00h
FAh
01h
8086)
FAh
30h
FAh
4Eh
FAh
FEh
F9h
00h
F9h
FFh
F8h
00h
F8h
01h
F8h
02h
F8h
04h
F8h
04h
2 system brd
F8h
04h
2 system brd
F8h
05h
F8h
06h
F8h
07h
F8h
07h
F8h
07h
F8h
07h
F8h
09h
1 system brd
F8h
09h
F8h
09h

00h
00h
01h
***
00h
00h
02h
00h

02/13/87
???
???
???
???
???
06/28/89
02/16/90

** PS/2 Model 60 (10 MHz 286)

IBM 7552-140 "Gearbox"
IBM 7552-540 "Gearbox"
Epson, unknown model
PS/2 Model 25/286
PS/2 Model 25 (10 MHz 286)
PS/2 Model 30-286
PS/1 Model 2011 (10 MHz

00h
***
***
***
***
***

02/18/93
???
???
???
???
???

Compaq ProLinea
Epson, unknown model
Epson, unknown model
Epson, unknown model
Olivetti M280
Olivetti M380 (XP 1, XP3,

***
***
***
***
***
00h
01h
01h
00h
01h

???
???
???
???
???
01/15/88
???
???
???
01/10/86

Olivetti M290
Olivetti M250
Olivetti M380 (XP 7)
Olivetti PCS286
Olivetti M300
Phoenix 386 BIOS v1.10 10a
"OEM machine"
"OEM machine"
Zenith 386
PC XT-089, Enh Keyb, 3.5"

02h
***
00h
01h
00h

05/09/86
???
09/02/86
12/12/86
???

PC XT
Olivetti M200
PS/2 Model 30 (8 MHz 8086)
PS/2 Model 30
PS/2 Model 25/25L (8 MHz

00h
***
00h
00h
00h
00h
00h
00h
00h
02h

???
???
???
09/13/85
???
03/30/87
10/07/87
???
???
04/11/88

IBM Restaurant Terminal

Olivetti M111
IBM PCradio 9075
PC Convertible
PC Convertible
** PS/2 Model 80 (16MHz 386)
PS/2 Model 80 (20MHz 386)
PS/2 Model 55-5571
PS/2 Model 70
PS/2 Model 70 20MHz, type

03h

03/17/89

PS/2 Model 70 20MHz, type

00h
00h
00h
01h
02h
03h
00h

???
???
???
???
???
???
???

IBM PC 7568
PS/2 Model 55-5571
IBM PC 7561/2
PS/2 Model 55-5551
IBM PC 7561/2
PS/2 Model 55-5551
PS/2 Model 70 16MHz, type

02h
03h

04/11/88
03/17/89

PS/2 Model 70 some models

PS/2 Model 70 some models

F8h
0Bh
typ 2 sys brd
F8h
0Bh
F8h
0Ch
386SX)
F8h
0Dh
3 system brd
F8h
0Eh
F8h
0Fh
F8h
10h
F8h
11h
486)
F8h
12h
F8h
13h
486)
F8h
14h
486), 95 XP
F8h
15h
F8h
16h
486)
F8h
17h
F8h
19h
(20 MHz 386SX)
F8h
1Ah
F8h
1Bh
486)
F8h
1Ch
386SX)
F8h
1Eh
386SX)
F8h
23h
F8h
23h
386SX)
F8h
25h
F8h
25h
386SLC)
F8h
26h
F8h
26h
386SX)
F8h
28h
F8h
29h
F8h
2Ah
486)
F8h
2Bh
F8h
2Ch
F8h
2Ch
486SX)
F8h
2Dh
486SX)
F8h
2Eh
F8h
2Eh
486SX + 487SX)
F8h
2Fh
486SX + 487SX)
F8h
30h
386SX)
F8h
33h

00h

01/18/89

PS/2 Model P70 (8573-121)

02h
00h

12/16/89
11/02/88

PS/2 Model P70 ??

PS/2 Model 55SX (16 MHz

00h

???

00h
00h
00h
00h

???
???
???
10/01/90

PS/1
PS/1
PS/2
PS/2

00h
00h

???
10/01/90

PS/2 Model 95 XP
PS/2 Model 90 XP (33 MHz

00h

10/01/90

PS/2 Model 90-AK9 (25 MHz

00h
00h

???
10/01/90

PS/2 Model 90 XP
PS/2 Model 90-AKD (33 MHz

00h
05h

???
???

PS/2 Model 90 XP
PS/2 Model 35/35LS or 40

00h
00h

???
10/02/89

PS/2 Model 95 XP
PS/2 Model 70-486 (25 MHz

00h

02/08/90

PS/2 Model 65-121 (16 MHz

00h

02/08/90

PS/2 Model 55LS (16 MHz

00h
01h

???
???

PS/2 Model L40 SX

PS/2 Model L40 SX (20 MHz

00h
06h

???
???

PS/2 Model 57 SLC

PS/2 Model M57 (20 MHz

00h
01h

???
???

PS/2 Model 57 SX
PS/2 Model 57 (20 MHz

00h
00h
00h

???
???
???

PS/2 Model 95 XP
PS/2 Model 90 XP
PS/2 Model 95 XP (50 MHz

00h
00h
01h

???
???
???

PS/2 Model 90 (50 MHz 486)

PS/2 Model 95 XP
PS/2 Model 95 (20 MHz

00h

???

PS/2 Model 90 XP (20 MHz

00h
01h

???
???

PS/2 Model 95 XP
PS/2 Model 95 (20 MHz

00h

???

PS/2 Model 90 XP (20 MHz

00h

???

PS/1 Model 2121 (16 MHz

00h

???

PS/2 Model 30-386

PS/2 Model 70 25MHz, type

486SX
486DX
Model 55-5551
Model 90 XP (25 MHz

F8h
34h
F8h
36h
F8h
37h
F8h
38h
F8h
39h
F8h
3Fh
F8h
40h
F8h
41h
F8h
45h
F8h
46h
F8h
47h
(Pentium)
F8h
48h
F8h
49h
F8h
4Ah
F8h
4Bh
F8h
4Eh
F8h
50h
MHz 386)
F8h
50h
F8h
52h
486)
F8h
56h
F8h
57h
F8h
58h
F8h
59h
F8h
5Ah
F8h
5Bh
F8h
5Ch
F8h
5Dh
F8h
5Eh
F8h
61h
F8h
62h
F8h
80h
F8h
80h
F8h
81h
F8h
87h
F8h
88h
F8h
97h
F8h
99h
F8h
F2h
F8h
F6h
F8h
FDh
(with VPD)
F8h
???
486SX)
F8h
???
486SX)
F8h
???
486SX + 487SX)
F8h
???
486SX + 487SX)
E1h
???
DOS4GW.EXE)
E1h
00h
9Ah
*
30h
???

00h
00h
00h
00h
00h
00h
00h
00h
00h
00h
00h

???
???
???
???
???
???
???
???
???
???
???

PS/2
PS/2
PS/2
PS/2
PS/2
PS/2
PS/2
PS/2
PS/2
PS/2
PS/2

Model
Model
Model
Model
Model
Model
Model
Model
Model
Model
Model

25-386
95 XP
90 XP
57
95 XP
90 XP
95 XP
77
90 XP (Pentium)
95 XP (Pentium)
90/95 E

00h
00h
00h
00h
00h
00h

???
???
???
???
???
???

PS/2 Model 85
PS/ValuePoint 325T
PS/ValuePoint 425SX
PS/ValuePoint 433DX
PS/2 Model 295
PS/2 Model P70 (8573) (16

01h
00h

12/16/89
???

PS/2 Model P70 (8570-031)

PS/2 Model P75 (33 MHz

00h
00h
00h
00h
00h
00h
00h
00h
00h
***
***
00h
01h
00h
00h
00h
00h
00h
30h
30h
00h

???
???
???
???
???
???
???
???
???
???
???
???
11/21/89
???
???
???
???
???
???
???
???

PS/2 Model CL57 SX

PS/2 Model 90 XP
PS/2 Model 95 XP
PS/2 Model 90 XP
PS/2 Model 95 XP
PS/2 Model 90 XP
PS/2 Model 95 XP
PS/2 Model N51 SLC
IBM ThinkPad 700
Olivetti P500
Olivetti P800
PS/2 Model 80 (25 MHz 386)
PS/2 Model 80-A21
PS/2 Model 55-5502
PS/2 Model N33SX
PS/2 Model 55-5530T
PS/2 Model 55 Note N23SX
PS/2 Model N51 SX
Reply Model 32
Memorex Telex
IBM Processor Complex

???

???

PS/2 Model 90 (25 MHz

???

???

PS/2 Model 95 (25 MHz

???

???

PS/2 Model 90 (25 MHz

???

???

PS/2 Model 95 (25 MHz

???

???

??? (checked for by

00h
*
???

???
???
???

PS/2 Model 55-5530 Laptop

Compaq XT/Compaq Plus
Sperry PC

2Dh
???
???

*
*
???
Compaq PC/Compaq Deskpro
56h
???
???
Olivetti, unknown model
74h
???
???
Olivetti, unknown model
* This BIOS call is not implemented in these early versions.
Read Model byte at F000h:FFFEh and BIOS date at F000h:FFF5h.
** These BIOS versions require the DASDDRVR.SYS patches.
*** These Olivetti and Epson machines store the submodel in the
byte at
F000h:FFFDh.
Values for Dell model byte:
02h
Dell 200
03h
Dell 300
05h
Dell 220
06h
Dell 310
07h
Dell 325
09h
Dell 310A
0Ah
Dell 316
0Bh
Dell 220E
0Ch
Dell 210
0Dh
Dell 316SX
0Eh
Dell 316LT
0Fh
Dell 320LX
11h
Dell 425E
Format of Compaq product information:
Address
Size
Description
F000h:FFE4h
BYTE
product family code (first byte)
F000h:FFE4h
BYTE
Point release number
F000h:FFE4h
BYTE
ROM version code
F000h:FFE4h
BYTE
product family code (second byte)
F000h:FFE8h
WORD
BIOS type code
Bitfields for Hewlett-Packard product identifier:
bits 4-0
machine code
0 original Vectra
1 ES/12
2 RS/20
3 Portable/CS
4 ES
5 CS
6 RS/16
other reserved
bits 7-5
CPU type
0 = 80286
1 = 8088
2 = 8086
3 = 80386
other reserved

--------B1600--------------------------------------------------INT 16 - KEYBOARD - GET KEYSTROKE

AH = 00h
Return: AH = BIOS scan code
AL = ASCII character

Notes: on extended keyboards, this function discards any extended

keystrokes,
returning only when a non-extended keystroke is
available
the BIOS scan code is usually, but not always, the same as
the hardware
scan code processed by INT 09. It is the same for ASCII
keystrokes
and most unshifted special keys (F-keys, arrow keys,
etc.), but
differs for shifted special keys.
SeeAlso: AH=01h,AH=05h,AH=10h,AH=20h,INT 18/AH=00h

--------B1601--------------------------------------------------INT 16 - KEYBOARD - CHECK FOR KEYSTROKE

AH = 01h
Return: ZF set if no keystroke available
ZF clear if keystroke available
AH = BIOS scan code
AL = ASCII character
Note:
if a keystroke is present, it is not removed from the
keyboard buffer;
however, any extended keystrokes which are not
compatible with 83/84key keyboards are removed in the process of checking
whether a
non-extended keystroke is available
SeeAlso: AH=00h,AH=11h,AH=21h,INT 18/AH=01h

--------B1602--------------------------------------------------INT 16 - KEYBOARD - GET SHIFT FLAGS

AH = 02h
Return: AL = shift flags (see below)
SeeAlso: AH=12h,AH=22h,INT 17/AH=0Dh,INT 18/AH=02h

Bitfields for shift flags:

bit 7 Insert active
bit 6 CapsLock active
bit 5 NumLock active
bit 4 ScrollLock active
bit 3 Alt key pressed (either Alt on 101/102-key keyboards)
bit 2 Ctrl key pressed (either Ctrl on 101/102-key keyboards)
bit 1 left shift key pressed
bit 0 right shift key pressed

--------B1605--------------------------------------------------INT 16 - KEYBOARD - STORE KEYSTROKE IN KEYBOARD BUFFER

(AT/PS w enh
keybd only)
AH = 05h
CH = scan code

CL = ASCII character
Return: AL = 00h if successful
01h if keyboard buffer full
Note:
under DESQview, the following "keystrokes" invoke the
following
actions when they are read from the keyboard buffer:
38FBh or FB00h switch to next window (only if
main menu
popped up)
38FCh or FC00h pop up DESQview main menu
38FEh or FE00h close the current window
38FFh or FF00h pop up DESQview learn menu
SeeAlso: AH=00h,AH=71h,AH=FFh,INT 15/AX=DE10h

--------B1610--------------------------------------------------INT 16 - KEYBOARD - GET ENHANCED KEYSTROKE (enhanced

kbd support
only)

AH = 10h
Return: AH = BIOS scan code
AL = ASCII character
Notes: if no keystroke is available, this function waits until
one is placed
in the keyboard buffer
the BIOS scan code is usually, but not always, the same as
the hardware
scan code processed by INT 09. It is the same for ASCII
keystrokes
and most unshifted special keys (F-keys, arrow keys,
etc.), but
differs for shifted special keys.
unlike AH=00h, this function does not discard extended
keystrokes
INT 16/AH=09h can be used to determine whether this
function is
supported, but only on later model PS/2s
SeeAlso: AH=00h,AH=09h,AH=11h,AH=20h

--------B1611--------------------------------------------------INT 16 - KEYBOARD - CHECK FOR ENHANCED KEYSTROKE (enh

kbd support
only)
AH = 11h
Return: ZF set if no keystroke available
ZF clear if keystroke available
AH = BIOS scan code
AL = ASCII character
Notes: if a keystroke is available, it is not removed from the
keyboard buffer
unlike AH=01h, this function does not discard extended
keystrokes

some versions of the IBM BIOS Technical Reference

erroneously report
that CF is returned instead of ZF
INT 16/AH=09h can be used to determine whether this
function is
supported, but only on later model PS/2s
SeeAlso: AH=01h,AH=09h,AH=10h,AH=21h

--------B1612--------------------------------------------------INT 16 - KEYBOARD - GET EXTENDED SHIFT STATES (enh kbd

support
only)
AH = 12h
Return: AL = shift flags 1 (same as returned by AH=02h) (see
below)
AH = shift flags 2 (see below)
Notes: AL bit 3 set only for left Alt key on many machines
AH bits 7 through 4 always clear on a Compaq SLT/286
INT 16/AH=09h can be used to determine whether this
function is
supported, but only on later model PS/2s
SeeAlso: AH=02h,AH=09h,AH=22h,AH=51h,INT 17/AH=0Dh

Bitfields for shift flags 1:

bit 7 Insert active
bit 6 CapsLock active
bit 5 NumLock active
bit 4 ScrollLock active
bit 3 Alt key pressed (either Alt on 101/102-key keyboards)
bit 2 Ctrl key pressed (either Ctrl on 101/102-key keyboards)
bit 1 left shift key pressed
bit 0 right shift key pressed
Bitfields for shift flags 2:
bit 7 SysRq key pressed
bit 6 CapsLock pressed
bit 5 NumLock pressed
bit 4 ScrollLock pressed
bit 3 right Alt key pressed
bit 2 right Ctrl key pressed
bit 1 left Alt key pressed
bit 0 left Ctrl key pressed

--------B18----------------------------------------------------INT 18 - DISKLESS BOOT HOOK (START CASSETTE BASIC)

Desc:
called when there is no bootable disk available to the
system
Notes: only PCs produced by IBM contain BASIC in ROM, so the
action is
unpredictable on compatibles; this interrupt often
reboots the
system, and often has no effect at all

network cards with their own BIOS can hook this interrupt

to allow

a diskless boot off the network (even when a hard disk

is present

if none of the partitions is marked as the boot

partition)
SeeAlso: INT 86"NetBIOS"

--------B19----------------------------------------------------INT 19 - SYSTEM - BOOTSTRAP LOADER

Desc:
This interrupt reboots the system without clearing memory
or restoring
interrupt vectors. Because interrupt vectors are
preserved, this
interrupt usually causes a system hang if any TSRs have
hooked
vectors from 00h through 1Ch, particularly INT 08.
Notes: Usually, the BIOS will try to read sector 1, head 0, track
0 from drive
A: to 0000h:7C00h. If this fails, and a hard disk is
installed, the
BIOS will read sector 1, head 0, track 0 of the first
hard disk.
This sector should contain a master bootstrap loader and
a partition
table. After loading the master boot sector at
0000h:7C00h, the
master bootstrap loader is given control. It will scan
the partition
table for an active partition, and will then load the
operating
system's bootstrap loader (contained in the first sector
of the
active partition) and give it control.
true IBM PCs and most clones issue an INT 18 if neither
floppy nor hard
disk have a valid boot sector
to accomplish a warm boot equivalent to Ctrl-Alt-Del,
store 1234h in
0040h:0072h and jump to FFFFh:0000h. For a cold boot
equivalent to
a reset, store 0000h at 0040h:0072h before jumping.
VDISK.SYS hooks this interrupt to allow applications to
find out how
much extended memory has been used by VDISKs (see
below). DOS 3.3+
PRINT hooks INT 19 but does not set up a correct VDISK
header block
at the beginning of its INT 19 handler segment, thus
causing some
programs to overwrite extended memory which is already
in use.
the default handler is at F000h:E6F2h for 100% compatible
BIOSes

MS-DOS 3.2+ hangs on booting (even from floppy) if the

hard disk
contains extended partitions which point at each other
in a loop,
since it will never find the end of the linked list of
extended
partitions
SeeAlso: INT 14/AH=17h,INT 18
Format of VDISK
segment):
Offset Size
00h 18 BYTEs
12h 11 BYTEs
version n.m
1Dh 15 BYTEs
2Ch 3 BYTEs
memory

header block (at beginning of INT 19 handler's

Description
n/a (for VDISK.SYS, the device driver header)
signature string "VDISK Vn.m" for VDISK.SYS
n/a
linear address of first byte of available extended

Format of hard disk master boot sector:

Offset Size
Description
00h 446 BYTEs Master bootstrap loader code
1BEh 16 BYTEs
partition record for partition 1 (see below)
1CEh 16 BYTEs
partition record for partition 2
1DEh 16 BYTEs
partition record for partition 3
1EEh 16 BYTEs
partition record for partition 4
1FEh
WORD
signature, AA55h indicates valid boot block
Format of partition record:
Offset Size
Description
00h
BYTE
boot indicator (80h = active partition)
01h
BYTE
partition start head
02h
BYTE
partition start sector (bits 0-5)
03h
BYTE
partition start track (bits 8,9 in bits 6,7 of
sector)
04h
BYTE
operating system indicator (see below)
05h
BYTE
partition end head
06h
BYTE
partition end sector (bits 0-5)
07h
BYTE
partition end track (bits 8,9 in bits 6,7 of
sector)
08h
DWORD
sectors preceding partition
0Ch
DWORD
length of partition in sectors
Values for operating system indicator:
00h
empty
01h
DOS 12-bit FAT
02h
XENIX root file system
03h
XENIX /usr file system (obsolete)
04h
DOS 16-bit FAT
05h
DOS 3.3+ extended partition
06h
DOS 3.31+ Large File System
07h
QNX
07h
OS/2 HPFS
07h
Advanced Unix
08h
AIX bootable partition, SplitDrive
09h
AIX data partition
09h
Coherent filesystem

0Ah
OS/2 Boot Manager
0Ah
OPUS
0Ah
Coherent swap partition
10h
OPUS
18h
AST special Windows swap file
24h
NEC MS-DOS 3.x
40h
VENIX 80286
50h
Disk Manager, read-only partition
51h
Disk Manager, read/write partition
51h
Novell???
52h
CP/M
52h
Microport System V/386
56h
GoldenBow VFeature
61h
SpeedStor
63h
Unix SysV/386, 386/ix
63h
Mach, MtXinu BSD 4.3 on Mach
63h
GNU HURD
64h
Novell NetWare
65h
Novell NetWare (3.11)
70h
DiskSecure Multi-Boot
75h
PC/IX
80h
Minix v1.1 - 1.4a
81h
Minix v1.4b+
81h
Linux
81h
Mitac Advanced Disk Manager
82h
Linux Swap partition (planned)
84h
OS/2-renumbered type 04h partition (related to hiding DOS
C: drive)
93h
Amoeba file system
94h
Amoeba bad block table
B7h
BSDI file system (secondarily swap)
B8h
BSDI swap partition (secondarily file system)
C1h
DR-DOS 6.0 LOGIN.EXE-secured 12-bit FAT partition
C4h
DR-DOS 6.0 LOGIN.EXE-secured 16-bit FAT partition
C6h
DR-DOS 6.0 LOGIN.EXE-secured Huge partition
DBh
CP/M, Concurrent CP/M, Concurrent DOS
DBh
CTOS (Convergent Technologies OS)
E1h
SpeedStor 12-bit FAT extended partition
E4h
SpeedStor 16-bit FAT extended partition
F2h
DOS 3.3+ secondary
FEh
LANstep
FFh
Xenix bad block table

--------B1B----------------------------------------------------INT 1B C - KEYBOARD - CONTROL-BREAK HANDLER

Desc:
this interrupt is automatically called when INT 09
determines that
Control-Break has been pressed
Note:
normally points to a short routine in DOS which sets the
Ctrl-C flag,
thus invoking INT 23h the next time DOS checks for CtrlC.
SeeAlso: INT 23

--------B1C----------------------------------------------------INT 1C - TIME - SYSTEM TIMER TICK

Desc:
this interrupt is automatically called on each clock tick
by the INT 08
handler
Notes: this is the preferred interrupt to chain when a program
needs to be
invoked regularly
not available on NEC 9800-series PCs
SeeAlso: INT 08

--------B1E----------------------------------------------------INT 1E - SYSTEM DATA - DISKETTE PARAMETERS

Note:
default parameter table at F000h:EFC7h for 100% compatible
BIOSes
SeeAlso: INT 13/AH=0Fh,INT 41
Format of diskette parameter table:
Offset Size
Description
00h
BYTE
first specify byte
bits 7-4: step rate
bits 3-0: head unload time (0Fh = 240 ms)
01h
BYTE
second specify byte
bits 7-1: head load time (01h = 4 ms)
bit
0: non-DMA mode (always 0)
02h
BYTE
delay until motor turned off (in clock ticks)
03h
BYTE
bytes per sector (00h = 128, 01h = 256, 02h = 512,
03h = 1024)
04h
BYTE
sectors per track
05h
BYTE
length of gap between sectors (2Ah for 5.25", 1Bh
for 3.5")
06h
BYTE
data length (ignored if bytes-per-sector field
nonzero)
07h
BYTE
gap length when formatting (50h for 5.25", 6Ch for
3.5")
08h
BYTE
format filler byte (default F6h)
09h
BYTE
head settle time in milliseconds
0Ah
BYTE
motor start time in 1/8 seconds

--------B1F----------------------------------------------------INT 1F - SYSTEM DATA - 8x8 GRAPHICS FONT

Desc:
this vector points at 1024 bytes of graphics data, 8 bytes
for each
character 80h-FFh
Note:
graphics data for characters 00h-7Fh stored at F000h:FA6Eh
in 100%
compatible BIOSes
SeeAlso: INT 10/AX=5000h,INT 43

--------D20----------------------------------------------------INT 20 - DOS 1+ - TERMINATE PROGRAM

CS = PSP segment
Return: never
Note:
(see INT 21/AH=00h)
SeeAlso: INT 21/AH=00h,INT 21/AH=4Ch

--------D2102--------------------------------------------------INT 21 - DOS 1+ - WRITE CHARACTER TO STANDARD OUTPUT

AH = 02h
DL = character to write
Return: AL = last character output (despite the official docs
which state
nothing is returned) (at least DOS 3.3-5.0)
Notes: ^C/^Break are checked, and INT 23 executed if pressed
standard output is always the screen under DOS 1.x, but
may be
redirected under DOS 2+
the last character output will be the character in DL
unless DL=09h
on entry, in which case AL=20h as tabs are expanded to
blanks
SeeAlso: AH=06h,AH=09h

--------D2109--------------------------------------------------INT 21 - DOS 1+ - WRITE STRING TO STANDARD OUTPUT

AH = 09h
DS:DX -> '$'-terminated string
Return: AL = 24h (the '$' terminating the string, despite official
docs which
state that nothing is returned) (at least DOS 3.35.0)
Notes: ^C/^Break are checked, and INT 23 is called if either
pressed
standard output is always the screen under DOS 1.x, but
may be
redirected under DOS 2+
under the FlashTek X-32 DOS extender, the pointer is in
DS:EDX
SeeAlso: AH=02h,AH=06h"OUTPUT"

--------D210A--------------------------------------------------INT 21 - DOS 1+ - BUFFERED INPUT

AH = 0Ah
DS:DX -> buffer (see below)
Return: buffer filled with user input
Notes: ^C/^Break are checked, and INT 23 is called if either
detected

DOS 2+

reads from standard input, which may be redirected under

if the maximum buffer size (see below) is set to 00h, this

call returns
immediately without reading any input
SeeAlso: AH=0Ch,INT 2F/AX=4810h
Format of input
Offset Size
00h
BYTE
01h
BYTE
be recalled

buffer:
Description
maximum characters buffer can hold
(input) number of chars from last input which may

(return) number of characters actually read,

excluding CR
02h N BYTEs
actual characters read, including the final
carriage return

--------D211A--------------------------------------------------INT 21 - DOS 1+ - SET DISK TRANSFER AREA ADDRESS

Notes:

AH = 1Ah
DS:DX -> Disk Transfer Area (DTA)
the DTA is set to PSP:0080h when a program is started
under the FlashTek X-32 DOS extender, the pointer is in

DS:EDX
SeeAlso: AH=11h,AH=12h,AH=2Fh,AH=4Eh,AH=4Fh

--------D2125--------------------------------------------------INT 21 - DOS 1+ - SET INTERRUPT VECTOR

AH = 25h
AL = interrupt number
DS:DX -> new interrupt handler
Notes: this function is preferred over direct modification of the
interrupt
vector table
some DOS extenders place an API on this function, as it is
not
directly meaningful in protected mode
under DR-DOS 5.0+, this function does not use any of the
DOS-internal
stacks and may thus be called at any time
Novell NetWare (except the new DOS Requester) monitors the
offset of
any INT 24 set, and if equal to the value at startup,
substitutes
its own handler to allow handling of network errors;
this introduces
the potential bug that any program whose INT 24 handler
offset
happens to be the same as COMMAND.COM's will not have
its INT 24
handler installed
SeeAlso: AX=2501h,AH=35h

--------D212A--------------------------------------------------INT 21 - DOS 1+ - GET SYSTEM DATE

AH = 2Ah
Return: CX = year (1980-2099)
DH = month
DL = day
---DOS 1.10+--AL = day of week (00h=Sunday)
SeeAlso: AH=2Bh"DOS",AH=2Ch,AH=E7h,INT 1A/AH=04h,INT 2F/AX=120Dh

--------D212C--------------------------------------------------INT 21 - DOS 1+ - GET SYSTEM TIME

AH = 2Ch
Return: CH = hour
CL = minute
DH = second
DL = 1/100 seconds
Note:
on most systems, the resolution of the system clock is
about 5/100sec,
so returned times generally do not increment by 1
on some systems, DL may always return 00h
SeeAlso: AH=2Ah,AH=2Dh,AH=E7h,INT 1A/AH=00h,INT 1A/AH=02h,INT
1A/AH=FEh
SeeAlso: INT 2F/AX=120Dh

--------D212F--------------------------------------------------INT 21 - DOS 2+ - GET DISK TRANSFER AREA ADDRESS

AH = 2Fh
Return: ES:BX -> current DTA
Note:
under the FlashTek X-32 DOS extender, the pointer is in
ES:EBX
SeeAlso: AH=1Ah

--------D2130--------------------------------------------------INT 21 - DOS 2+ - GET DOS VERSION

AH = 30h
---DOS 5+ --AL = what to return in BH
00h OEM number (as for DOS 2.0-4.0x)
01h version flag
Return: AL = major version number (00h if DOS 1.x)
AH = minor version number
BL:CX = 24-bit user serial number (most versions do not
use this)
---if DOS <5 or AL=00h--BH = MS-DOS OEM number (see below)
---if DOS 5+ and AL=01h--BH = version flag

Notes:
(10)
(20)
SETVER

bit 3: DOS is in ROM

other: reserved (0)
the OS/2 v1.x Compatibility Box returns major version 0Ah
the OS/2 v2.x Compatibility Box returns major version 14h
the Windows/NT DOS box returns version 5.00, subject to

DOS 4.01 and 4.02 identify themselves as version 4.00; use

INT 21/AH=87h to distinguish between the original
European MS-DOS 4.0
and the later PC-DOS 4.0x and MS-DOS 4.0x
IBM DOS 6.1 reports its version as 6.00; use the OEM
number to
distinguish between MS-DOS 6.00 and IBM DOS 6.1 (there
was never an
IBM DOS 6.0)
generic MS-DOS 3.30, Compaq MS-DOS 3.31, and others
identify themselves
as PC-DOS by returning OEM number 00h
the version returned under DOS 4.0x may be modified by
entries in
the special program list (see AH=52h); the version
returned under
DOS 5+ may be modified by SETVER--use AX=3306h to get
the true
version number
SeeAlso: AX=3000h/BX=3000h,AX=3306h,AX=4452h,AH=87h,INT
15/AX=4900h
SeeAlso: INT 2F/AX=122Fh,INT 2F/AX=E002h
Values for DOS OEM number:
00h
IBM
01h
Compaq
02h
MS Packaged Product
04h
AT&T
05h
Zenith
06h
Hewlett-Packard
0Dh
Packard-Bell
16h
DEC
23h
Olivetti
29h
Toshiba
33h
Novell (Windows/386 device IDs only)
34h
MS Multimedia Systems (Windows/386 device IDs only)
35h
MS Multimedia Systems (Windows/386 device IDs only)
4Dh
Hewlett-Packard
66h
PhysTechSoft (PTS-DOS)
99h
General Software's Embedded DOS
EEh
DR-DOS
EFh
Novell DOS
FFh
Microsoft, Phoenix

--------D2131--------------------------------------------------INT 21 - DOS 2+ - TERMINATE AND STAY RESIDENT

AH = 31h

AL = return code
DX = number of paragraphs to keep resident
Return: never
Notes: the value in DX only affects the memory block containing
the PSP;
additional memory allocated via AH=48h is not affected
the minimum number of paragraphs which will remain
resident is 11h
for DOS 2.x and 06h for DOS 3+
most TSRs can save some memory by releasing their
environment block
before terminating (see AH=26h,AH=49h)
SeeAlso: AH=00h,AH=4Ch,AH=4Dh,INT 20,INT 22,INT 27

--------D2134--------------------------------------------------INT 21 - DOS 2+ - GET ADDRESS OF INDOS FLAG

AH = 34h
Return: ES:BX -> one-byte InDOS flag
Notes: the value of InDOS is incremented whenever an INT 21
function begins
and decremented whenever one completes
during an INT 28 call, it is safe to call some INT 21
functions even
though InDOS may be 01h instead of zero
InDOS alone is not sufficient for determining when it is
safe to
enter DOS, as the critical error handling decrements
InDOS and
increments the critical error flag for the duration of
the critical
error. Thus, it is possible for InDOS to be zero even
if DOS is
busy.
SMARTDRV 4.0 sets the InDOS flag while flushing its
buffers to disk,
then zeros it on completion
the critical error flag is the byte immediately following
InDOS in
DOS 2.x, and the byte BEFORE the InDOS flag in DOS 3+
and
DR-DOS 3.41+ (except COMPAQ DOS 3.0, where the critical
error flag
is located 1AAh bytes BEFORE the critical section flag)
for DOS 3.1+, an undocumented call exists to get the
address of the
critical error flag (see AX=5D06h)
this function was undocumented prior to the release of DOS
5.0.
SeeAlso: AX=5D06h,AX=5D0Bh,INT 15/AX=DE1Fh,INT 28

--------D2135--------------------------------------------------INT 21 - DOS 2+ - GET INTERRUPT VECTOR

AH = 35h

AL = interrupt number
Return: ES:BX -> current interrupt handler
Note:
under DR-DOS 5.0+, this function does not use any of the
DOS-internal
stacks and may thus be called at any time
SeeAlso: AH=25h,AX=2503h

--------D2136--------------------------------------------------INT 21 - DOS 2+ - GET FREE DISK SPACE

AH = 36h
DL = drive number (00h = default, 01h = A:, etc)
Return: AX = FFFFh if invalid drive
else
AX = sectors per cluster
BX = number of free clusters
CX = bytes per sector
DX = total clusters on drive
Notes: free space on drive in bytes is AX * BX * CX
total space on drive in bytes is AX * CX * DX
"lost clusters" are considered to be in use
according to Dave Williams' MS-DOS reference, the value in
DX is
incorrect for non-default drives after ASSIGN is run
SeeAlso: AH=1Bh,AH=1Ch

--------D2138--------------------------------------------------INT 21 - DOS 2+ - GET COUNTRY-SPECIFIC INFORMATION

AH = 38h
--DOS 2.x-AL = 00h get current-country info
DS:DX -> buffer for returned info (see below)
Return: CF set on error
AX = error code (02h)
CF clear if successful
AX = country code (MS-DOS 2.11 only)
buffer at DS:DX filled
--DOS 3+-AL = 00h for current country
AL = 01h thru 0FEh for specific country with code <255
AL = 0FFh for specific country with code >= 255
BX = 16-bit country code
DS:DX -> buffer for returned info (see below)
Return: CF set on error
AX = error code (02h)
CF clear if successful
BX = country code
DS:DX buffer filled
Note:
this function is not supported by the Borland DPMI host,
but no error
is returned; as a workaround, one should allocate a
buffer in
conventional memory with INT 31/AX=0100h and simulate an
INT 21 with

INT 31/AX=0300h
SeeAlso: AH=65h,INT 10/AX=5001h,INT 2F/AX=110Ch,INT 2F/AX=1404h
Format of DOS 2.00-2.10 country info:
Offset Size
Description
00h
WORD
date format 0 = USA
mm dd yy
1 = Europe dd mm yy
2 = Japan yy mm dd
02h
BYTE
currency symbol
03h
BYTE
00h
04h
BYTE
thousands separator char
05h
BYTE
00h
06h
BYTE
decimal separator char
07h
BYTE
00h
08h 24 BYTEs
reserved
Format of DOS 2.11+ country info:
Offset Size
Description
00h
WORD
date format (see above)
02h 5 BYTEs
ASCIZ currency symbol string
07h 2 BYTEs
ASCIZ thousands separator
09h 2 BYTEs
ASCIZ decimal separator
0Bh 2 BYTEs
ASCIZ date separator
0Dh 2 BYTEs
ASCIZ time separator
0Fh
BYTE
currency format
bit 2 = set if currency symbol replaces decimal
point
bit 1 = number of spaces between value and
currency symbol
bit 0 = 0 if currency symbol precedes value
1 if currency symbol follows value
10h
BYTE
number of digits after decimal in currency
11h
BYTE
time format
bit 0 = 0 if 12-hour clock
1 if 24-hour clock
12h
DWORD
address of case map routine
(FAR CALL, AL = character to map to upper case [>=
80h])
16h 2 BYTEs
ASCIZ data-list separator
18h 10 BYTEs
reserved
Values for country code:
001h
United States
002h
Canadian-French
003h
Latin America
01Fh
Netherlands
020h
Belgium
021h
France
022h
Spain
024h
Hungary (not supported by DR-DOS 5.0)
026h
Yugoslavia (not supported by DR-DOS 5.0)
027h
Italy
029h
Switzerland
02Ah
Czechoslovakia/Tjekia (not supported by DR-DOS 5.0)
02Bh
Austria (DR-DOS 5.0)
02Ch
United Kingdom
02Dh
Denmark

02Eh
02Fh
030h
031h
037h
03Dh
051h
052h
056h
058h
05Ah
15Fh
162h
166h
311h
3CCh

Sweden
Norway
Poland (not supported by DR-DOS 5.0)
Germany
Brazil (not supported by DR-DOS 5.0)
International English [Australia in DR-DOS 5.0]
Japan (DR-DOS 5.0, MS-DOS 5.0+)
Korea (DR-DOS 5.0)
China (MS-DOS 5.0+)
Taiwan (MS-DOS 5.0+)
Turkey (MS-DOS 5.0+)
Portugal
Iceland
Finland
Middle East/Saudi Arabia (DR-DOS 5.0,MS-DOS 5.0+)
Israel (DR-DOS 5.0,MS-DOS 5.0+)

--------D213C--------------------------------------------------INT 21 - DOS 2+ - "CREAT" - CREATE OR TRUNCATE FILE

AH = 3Ch
CX = file attributes (see below)
DS:DX -> ASCIZ filename
Return: CF clear if successful
AX = file handle
CF set on error
AX = error code (03h,04h,05h) (see AH=59h)
Notes: if a file with the given name exists, it is truncated to
zero length
under the FlashTek X-32 DOS extender, the pointer is in
DS:EDX
DR-DOS checks the system password or explicitly supplied
password at
the end of the filename against the reserved field in
the directory
entry before allowing access
SeeAlso: AH=16h,AH=3Dh,AH=5Ah,AH=5Bh,AH=93h,INT 2F/AX=1117h
Bitfields for file attributes:
bit 0 read-only
bit 1 hidden
bit 2 system
bit 3 volume label (ignored)
bit 4 reserved, must be zero (directory)
bit 5 archive bit
bit 7 if set, file is shareable under Novell NetWare

--------D213D--------------------------------------------------INT 21 - DOS 2+ - "OPEN" - OPEN EXISTING FILE

AH = 3Dh
AL = access and sharing modes (see below)
DS:DX -> ASCIZ filename
CL = attribute mask of files to look for (server call
only)

Return: CF clear if successful

AX = file handle
CF set on error
AX = error code (01h,02h,03h,04h,05h,0Ch,56h) (see
AH=59h)
Notes: file pointer is set to start of file
file handles which are inherited from a parent also
inherit sharing
and access restrictions
files may be opened even if given the hidden or system
attributes
under the FlashTek X-32 DOS extender, the pointer is in
DS:EDX
DR-DOS checks the system password or explicitly supplied
password at
the end of the filename against the reserved field in
the directory
entry before allowing access
sharing modes are only effective on local drives if SHARE
is loaded
SeeAlso: AH=0Fh,AH=3Ch,AX=4301h,AX=5D00h,INT 2F/AX=1116h,INT
2F/AX=1226h
Bitfields for access and sharing modes:
bits 2-0 access mode
000 read only
001 write only
010 read/write
011 (DOS 5+ internal) passed to redirector on EXEC to
allow
case-sensitive filenames
bit 3 reserved (0)
bits 6-4 sharing mode (DOS 3+)
000 compatibility mode
001 "DENYALL" prohibit both read and write access by
others
010 "DENYWRITE" prohibit write access by others
011 "DENYREAD" prohibit read access by others
100 "DENYNONE" allow full access by others
111 network FCB (only available during server call)
bit 7 inheritance
if set, file is private to current process and will not be
inherited
by child processes
File sharing behavior:
|
Second and subsequent Opens
First
|Compat Deny
Deny
Deny
Deny
Open
|
All
Write Read
None
|R W RW R W RW R W RW R W RW R W RW
- - - - -| - - - - - - - - - - - - - - - - Compat R |Y Y Y N N N 1 N N N N N 1 N N
W |Y Y Y N N N N N N N N N N N N
RW|Y Y Y N N N N N N N N N N N N
- - - - -|
Deny
R |C C C N N N N N N N N N N N N
All
W |C C C N N N N N N N N N N N N

RW|C C C
- - - - -|
Deny
R |2 C C
Write W |C C C
RW|C C C
- - - - -|
Deny
R |C C C
Read
W |C C C
RW|C C C
- - - - -|
Deny
R |2 C C
None
W |C C C
RW|C C C
Legend: Y = open
C = open
1 = open
code
2 = open
24

N N N

N N N

N N N

N N N

N N N
N N N
N N N

Y N N
N N N
N N N

N N N
Y N N
N N N

Y N N
Y N N
Y N N

N N N
N N N
N N N

N Y N
N N N
N N N

N N N
N Y N
N N N

N Y N
N Y N
N Y N

N N N Y Y Y N N N Y Y Y
N N N N N N Y Y Y Y Y Y
N N N N N N N N N Y Y Y
succeeds, N = open fails with error code 05h
fails, INT 24 generated
succeeds if file read-only, else fails with error
succeeds if file read-only, else fails with INT

--------D213E--------------------------------------------------INT 21 - DOS 2+ - "CLOSE" - CLOSE FILE

AH = 3Eh
BX = file handle
Return: CF clear if successful
AX destroyed
CF set on error
AX = error code (06h) (see AH=59h)
Note:
if the file was written to, any pending disk writes are
performed, the
time and date stamps are set to the current time, and
the directory
entry is updated
SeeAlso: AH=10h,AH=3Ch,AH=3Dh,INT 2F/AX=1106h,INT 2F/AX=1227h

--------D213F--------------------------------------------------INT 21 - DOS 2+ - "READ" - READ FROM FILE OR DEVICE

AH = 3Fh
BX = file handle
CX = number of bytes to read
DS:DX -> buffer for data
Return: CF clear if successful
AX = number of bytes actually read (0 if at EOF before
call)
CF set on error
AX = error code (05h,06h) (see AH=59h)
Notes: data is read beginning at current file position, and the
file position
is updated after a successful read
the returned AX may be smaller than the request in CX if a
partial
read occurred
if reading from CON, read stops at first CR

under the FlashTek X-32 DOS extender, the pointer is in

DS:EDX
SeeAlso: AH=27h,AH=40h,AH=93h,INT 2F/AX=1108h,INT 2F/AX=1229h

--------D2140--------------------------------------------------INT 21 - DOS 2+ - "WRITE" - WRITE TO FILE OR DEVICE

AH = 40h
BX = file handle
CX = number of bytes to write
DS:DX -> data to write
Return: CF clear if successful
AX = number of bytes actually written
CF set on error
AX = error code (05h,06h) (see AH=59h)
Notes: if CX is zero, no data is written, and the file is
truncated or
extended to the current position
data is written beginning at the current file position,
and the file
position is updated after a successful write
the usual cause for AX < CX on return is a full disk
BUG:
a write of zero bytes will appear to succeed when it
actually failed
if the write is extending the file and there is not
enough disk
space for the expanded file (DOS 5.0-6.0); one should
therefore check
whether the file was in fact extended by seeking to 0
bytes from
the end of the file (INT 21/AX=4202h/CX=0/DX=0)
under the FlashTek X-32 DOS extender, the pointer is in
DS:EDX
SeeAlso: AH=28h,AH=3Fh,AH=93h,INT 2F/AX=1109h

--------O214452------------------------------------------------INT 21 - DR-DOS 3.41+ - DETERMINE DOS TYPE/GET DR-DOS

VERSION
AX = 4452h ("DR")
CF set
Return: CF set if not DR-DOS
AX = error code (see AH=59h)
CF clear if DR-DOS
DX = AX = version code
AH = single-user/multiuser nature
10h single-user
AL = operating system version ID (see below)
14h multiuser
AL = operating system version ID (see
AX=4451h)
Notes: the DR-DOS version is stored in the environment variable
VER
use this function if looking for single-user capabilities,
AX=4451h

multiuser

if looking for multiuser; this call should never return

values
SeeAlso: AX=4412h,AX=4451h,AX=4459h
Values for operating system version ID:
60h
DOS Plus
63h
DR-DOS 3.41
64h
DR-DOS 3.42
65h
DR-DOS 5.00
67h
DR-DOS 6.00
70h
PalmDOS
71h
DR-DOS 6.0 March 1993 "business update"
72h
Novell DOS 7.0

--------O214458------------------------------------------------INT 21 U - DR-DOS 5.0+ internal - GET POINTER TO

INTERNAL VARIABLE
TABLE
AX = 4458h
Return: ES:BX -> internal variable table (see below)
AX = ??? (0B50h for DR-DOS 5.0, 0A56h for DR-DOS 6.0)
SeeAlso: AX=4452h
Format of internal variable table:
Offset Size
Description
00h
WORD
???
02h
WORD
segment of ???
04h 7 BYTEs
???
0Bh
WORD
KB of extended memory at startup
0Dh
BYTE
number of far jump entry points
0Eh
WORD
segment containing far jumps to DR-DOS entry
points (see below)
10h
WORD
(only if kernel loaded in HMA) offset in HMA of
first free HMA
memory block (see below) or 0000h if none; segment
is FFFFh
12h
WORD
pointer to segment of environment variables set in
CONFIG,
or 0000h if already used
---DR-DOS 6.0--14h
WORD
(only if kernel loaded in HMA) offset in HMA of
first used HMA
memory block (see below) or 0000h if none; segment
is FFFFh
Note:
the segment used for the DR-DOS 6.0 CONFIG environment
variables
(excluding COMSPEC, VER and OS) is only useful for
programs/drivers
called from CONFIG.SYS. The word is set to zero later
when the area
is copied to the COMMAND.COM environment space. This
allows
CONFIG.SYS to pass information to AUTOEXEC.BAT.

Format of kernel entry jump table for DR-DOS 5.0-6.0:

Offset Size
Description
00h 5 BYTEs
far jump to kernel entry point for CP/M CALL 5
05h 5 BYTEs
far jump to kernel entry point for INT 20
0Ah 5 BYTEs
far jump to kernel entry point for INT 21
0Fh 5 BYTEs
far jump to kernel entry point for INT 22 (RETF)
14h 5 BYTEs
far jump to kernel entry point for INT 23 (RETF)
19h 5 BYTEs
far jump to kernel entry point for INT 24
1Eh 5 BYTEs
far jump to kernel entry point for INT 25
23h 5 BYTEs
far jump to kernel entry point for INT 26
28h 5 BYTEs
far jump to kernel entry point for INT 27
2Dh 5 BYTEs
far jump to kernel entry point for INT 28
32h 5 BYTEs
far jump to kernel entry point for INT 2A (IRET)
37h 5 BYTEs
far jump to kernel entry point for INT 2B (IRET)
3Ch 5 BYTEs
far jump to kernel entry point for INT 2C (IRET)
41h 5 BYTEs
far jump to kernel entry point for INT 2D (IRET)
46h 5 BYTEs
far jump to kernel entry point for INT 2E (IRET)
4Bh 5 BYTEs
far jump to kernel entry point for INT 2F
Notes: all of these entry points are indirected through this jump
table
to allow the kernel to be relocated into high memory
while leaving
the actual entry addresses in low memory for maximum
compatibility
some of these entry points (22h,23h,24h,2Eh,2Fh) are
replaced as soon
as COMMAND.COM is loaded, and return immediately to the
caller, some
returning an error code (the original handler for INT 2F
returns
AL=03h [fail]).
Format of HMA Memory Block (DR-DOS 6.0 kernel loaded in HMA):
Offset Size
Description
00h
WORD
offset of next HMA Memory Block (0000h if last
block)
02h
WORD
size of this block in bytes (at least 10h)
04h
BYTE
type of HMA Memory Block (interpreted by MEM)
00h system
01h KEYB
02h NLSFUNC
03h SHARE
04h TaskMAX
05h COMMAND
05h
var
TSR (or system) code and data. DR-DOS TSR's, such
as KEYB,
hooks interrupts using segment FFFEh instead
FFFFh.

--------D2148--------------------------------------------------INT 21 - DOS 2+ - ALLOCATE MEMORY

AH = 48h
BX = number of paragraphs to allocate
Return: CF clear if successful

AX = segment of allocated block

CF set on error
AX = error code (07h,08h) (see AH=59h)
BX = size of largest available block
DOS 2.1-6.0 coalesces free blocks while scanning for a

Notes:
block to

allocate
.COM programs are initially allocated the largest
available memory
block, and should free some memory with AH=49h before
attempting any
allocations
under the FlashTek X-32 DOS extender, EBX contains a
protected-mode
near pointer to the allocated block on a successful
return
SeeAlso: AH=49h,AH=4Ah,AH=58h,AH=83h

--------D2149--------------------------------------------------INT 21 - DOS 2+ - FREE MEMORY

AH
ES
Return: CF
CF

= 49h
= segment of block to free
clear if successful
set on error
AX = error code (07h,09h) (see AH=59h)
Notes: apparently never returns an error 07h, despite official
docs; DOS 2.1+
code contains only an error 09h exit
DOS 2.1-6.0 does not coalesce adjacent free blocks when a
block is
freed, only when a block is allocated or resized
the code for this function is identical in DOS 2.1-6.0
except for
calls to start/end a critical section in DOS 3+
SeeAlso: AH=48h,AH=4Ah

--------D214A--------------------------------------------------INT 21 - DOS 2+ - RESIZE MEMORY BLOCK

AH
BX
ES
Return: CF
CF

= 4Ah
= new size in paragraphs
= segment of block to resize
clear if successful
set on error
AX = error code (07h,08h,09h) (see AH=59h)
BX = maximum paragraphs available for specified memory

block
Notes: under DOS 2.1-6.0, if there is insufficient memory to
expand the block
as much as requested, the block will be made as large as
possible
DOS 2.1-6.0 coalesces any free blocks immediately
following the block
to be resized

SeeAlso: AH=48h,AH=49h,AH=83h

--------D214B--------------------------------------------------INT 21 - DOS 2+ - "EXEC" - LOAD AND/OR EXECUTE PROGRAM

AH = 4Bh
AL = type of load
00h load and execute
01h load but do not execute
03h load overlay
04h load and execute in background (European MS-DOS
4.0 only)
"Exec & Go" (see also AH=80h)
DS:DX -> ASCIZ program name (must include extension)
ES:BX -> parameter block (see below)
CX = mode (subfunction 04h only)
0000h child placed in zombie mode after
termination
0001h child's return code discarded on termination
Return: CF clear if successful
BX,DX destroyed
if subfunction 01h, process ID set to new program's
PSP; get with
INT 21/AH=62h
CF set on error
AX = error code (01h,02h,05h,08h,0Ah,0Bh) (see AH=59h)
Notes: DOS 2.x destroys all registers, including SS:SP
under ROM-based DOS, if no disk path characters (colons or
slashes)
are included in the program name, the name is searched
for in the
ROM module headers (see below) before searching on disk
for functions 00h and 01h, the calling process must ensure
that there
is enough unallocated memory available; if necessary, by
releasing
memory with AH=49h or AH=4Ah
for function 01h, the AX value to be passed to the child
program is put
on top of the child's stack
for function 03h, DOS assumes that the overlay is being
loaded into
memory allocated by the caller
function 01h was undocumented prior to the release of DOS
5.0
some versions (such as DR-DOS 6.0) check the parameters
and parameter
block and return an error if an invalid value (such as
an offset of
FFFFh) is found
background programs under European MS-DOS 4.0 must use the
new
executable format
new executables begin running with the following register
values
AX = environment segment

BX = offset of command tail in environment segment

CX = size of automatic data segment (0000h = 64K)
ES,BP = 0000h
DS = automatic data segment
SS:SP = initial stack
the command tail corresponds to an old executable's
PSP:0081h and
following, except that the 0Dh is turned into a NUL
(00h); new
format executables have no PSP
under the FlashTek X-32 DOS extender, only function 00h is
supported
and the pointers are passed in DS:EDX and ES:EBX
DR-DOS 6 always loads .EXE-format programs with no fixups
above the
64K mark to avoid the EXEPACK bug
names for the various executable type understood by
various
environments:
MZ old-style DOS executable
NE Windows or OS/2 1.x segmented ("new")
executable
LE Windows virtual device driver (VxD) linear
executable
LX variant of LE used in OS/2 2.x
W3 Windows WIN386.EXE file; a collection of LE
files
PE Win32 (Windows NT and Win32s) portable
executable based on
Unix COFF
BUGS:
DOS 2.00 assumes that DS points at the current program's
PSP
Load Overlay (subfunction 03h) loads up to 512 bytes too
many if the
file contains additional data after the actual overlay
SeeAlso: AX=4B05h,AH=4Ch,AH=4Dh,AH=64h"OS/2",AH=8Ah,INT 2E
Format of EXEC parameter block for AL=00h,01h,04h:
Offset Size
Description
00h
WORD
segment of environment to copy for child process
(copy caller's
environment if 0000h)
02h
DWORD
pointer to command tail to be copied into child's
PSP
06h
DWORD
pointer to first FCB to be copied into child's PSP
0Ah
DWORD
pointer to second FCB to be copied into child's
PSP
0Eh
DWORD
(AL=01h) will hold subprogram's initial SS:SP on
return
12h
DWORD
(AL=01h) will hold entry point (CS:IP) on return
Format of EXEC parameter block for AL=03h:
Offset Size
Description
00h
WORD
segment at which to load overlay
02h
WORD
relocation factor to apply to overlay if in .EXE
format

Format of EXEC parameter block for FlashTek X-32:

Offset Size
Description
00h
PWORD
48-bit far pointer to environment string
06h
PWORD
48-bit far pointer to command tail string
Format of .EXE file header:
Offset Size
Description
00h 2 BYTEs
.EXE signature, either "MZ" or "ZM" (5A4Dh or
4D5Ah)
02h
WORD
number of bytes in last 512-byte page of
executable
04h
WORD
total number of 512-byte pages in executable
(includes any
partial last page)
06h
WORD
number of relocation entries
08h
WORD
header size in paragraphs
0Ah
WORD
minimum paragraphs of memory to allocation in
addition to
executable's size
0Ch
WORD
maximum paragraphs to allocate in addition to
executable's size
0Eh
WORD
initial SS relative to start of executable
10h
WORD
initial SP
12h
WORD
checksum (one's complement of sum of all words in
executable)
14h
DWORD
initial CS:IP relative to start of executable
18h
WORD
offset within header of relocation table
40h or greater for new-format
(NE,LE,LX,W3,PE,etc.) executable
1Ah
WORD
overlay number (normally 0000h = main program)
---new executable--1Ch 4 BYTEs
???
20h
WORD
behavior bits
22h 26 BYTEs
reserved for additional behavior info
3Ch
DWORD
offset of new executable (NE,LE,etc) header within
disk file,
or 00000000h if plain MZ executable
---Borland TLINK--1Ch 2 BYTEs
??? (apparently always 01h 00h)
1Eh
BYTE
signature FBh
1Fh
BYTE
TLINK version (major in high nybble, minor in low
nybble)
20h 2 BYTEs
??? (v2.0 apparently always 72h 6Ah, v3.0+ seems
always 6Ah 72h)
---ARJ self-extracting archive--1Ch 4 BYTEs
signature "RJSX" (older versions, new signature is
"aRJsfX" in
the first 1000 bytes of the file)
---LZEXE 0.90 compressed executable--1Ch 4 BYTEs
signature "LZ09"
---LZEXE 0.91 compressed executable--1Ch 4 BYTEs
signature "LZ91"
---PKLITE compressed executable--1Ch
BYTE
minor version number
1Dh
BYTE
bits 0-3: major version
bit 4: extra compression
bit 5: huge (multi-segment) file

1Eh 6 BYTEs
signature "PKLITE" (followed by copyright message)
---LHarc 1.x self-extracting archive--1Ch 4 BYTEs
unused???
20h 3 BYTEs
jump to start of extraction code
23h 2 BYTEs
???
25h 12 BYTEs
signature "LHarc's SFX "
---LHA 2.x self-extracting archive--1Ch 8 BYTEs
???
24h 10 BYTEs
signature "LHa's SFX " (v2.10) or "LHA's SFX "
(v2.13)
---TopSpeed C 3.0 CRUNCH compressed file--1Ch
DWORD
018A0001h
20h
WORD
1565h
---PKARCK 3.5 self-extracting archive--1Ch
DWORD
00020001h
20h
WORD
0700h
---BSA (Soviet archiver) self-extracting archive--1Ch
WORD
000Fh
1Eh
BYTE
A7h
---LARC self-extracting archive--1Ch 4 BYTEs
???
20h 11 BYTEs
"SFX by LARC "
---LH self-extracting archive--1Ch 8 BYTEs
???
24h 8 BYTEs
"LH's SFX "
---other linkers--1Ch
var
optional information
--N
N DWORDs relocation items
Notes: if word at offset 02h is 4, it should be treated as 00h,
since pre-1.10
versions of the MS linker set it that way
if both minimum and maximum allocation (offset 0Ah/0Ch)
are zero, the
program is loaded as high in memory as possible
the maximum allocation is set to FFFFh by default
Format of ROM Module Header:
Offset Size
Description
00h 2 BYTEs
ROM signature 55h, AAh
02h
BYTE
size of ROM in 512-byte blocks
03h 3 BYTEs
POST initialization entry point (near JMP
instruction)
06h
ROM Program Name List [array]
Offset Size
Description
00h
BYTE
length of ROM program's name (00h if end
of name list)
01h N BYTEs
program name
N+1 3 BYTEs
program entry point (near JMP instruction)
Format of new executable header:
Offset Size
Description
00h 2 BYTEs
"NE" (4Eh 45h) signature
02h 2 BYTEs
linker version (major, then minor)
04h
WORD
offset from start of this header to entry table
(see below)
06h
WORD
length of entry table in bytes

08h
0Ch

DWORD
BYTE

0Dh

BYTE

API)

file load CRC (0 in Borland's TPW)

program flags
bits 0-1 DGROUP type
0 = none
1 = single shared
2 = multiple (unshared)
3 = (null)
bit 2: global initialization
bit 3: protected mode only
bit 4: 8086 instructions
bit 5: 80286 instructions
bit 6: 80386 instructions
bit 7: 80x87 instructions
application flags
bits 0-2: application type
001 full screen (not aware of Windows/P.M.

maintained)

010 compatible with Windows/P.M. API

011 uses Windows/P.M. API
bit 3: is a Family Application (OS/2)
bit 5: 0=executable, 1=errors in image
bit 6: non-conforming program (valid stack is not

init routine

bit 7: DLL or driver rather than application

(SS:SP info invalid, CS:IP points at FAR
called with AX=module handle which

returns AX=0000h

on failure, AX nonzero on successful

initialization)
0Eh
WORD
10h
WORD
12h
WORD
<> DS)
14h
DWORD
segment table
18h
DWORD
index

auto data segment index

initial local heap size
initial stack size (added to data seg, 0000h if SS
program entry point (CS:IP), "CS" is index into
initial stack pointer (SS:SP), "SS" is segment
if SS=automatic data segment and SP=0000h, the

stack pointer is

set to the top of the automatic data segment,

just below the

local heap
segment count
module reference count
length of nonresident names table in bytes
offset from start of this header to segment table

1Ch
WORD
1Eh
WORD
20h
WORD
22h
WORD
(see below)
24h
WORD
26h
WORD
table
28h
WORD
reference table
2Ah
WORD
table

offset from start of this header to resource table

offset from start of this header to resident names
offset from start of this header to module
offset from start of this header to imported names
(array of counted strings, terminated with a

string of length

2Ch
table
30h
table
32h

DWORD

00h)
offset from start of file to nonresident names

WORD

count of moveable entry point listed in entry

WORD

34h
36h

WORD
BYTE

37h

BYTE

file alignment size shift count

0 is equivalent to 9 (default 512-byte pages)
number of resource table entries
target operating system
00h unknown
01h OS/2
02h Windows
03h European MS-DOS 4.x
04h Windows 386
05h BOSS (Borland Operating System Services)
other EXE flags
bit 0: supports long filenames
bit 1: 2.X protected mode
bit 2: 2.X proportional font
bit 3: gangload area
offset to return thunks or start of gangload area
offset to segment reference thunks or length of

38h
WORD
3Ah
WORD
gangload area
3Ch
WORD
minimum code swap area size
3Eh 2 BYTEs
expected Windows version (minor version first)
Note:
this header is documented in detail in the Windows 3.1 SDK
Programmer's
Reference, Vol 4.
Format of Codeview trailer (at end of executable):
Offset Size
Description
00h
WORD
signature 4E42h ('NB')
02h
WORD
Microsoft debug info version number
04h
DWORD
Codeview header offset
Format of new executable segment table record:
00h
WORD
offset in file (shift left by alignment shift to
get byte offs)
02h
WORD
length of image in file (0000h = 64K)
04h
WORD
segment attributes (see below)
06h
WORD
number of bytes to allocate for segment (0000h =
64K)
Note:
the first segment table entry is entry number 1
Bitfields for segment attributes:
bit 0 data segment rather than code segment
bit 1 unused???
bit 2 real mode
bit 3 iterated
bit 4 movable
bit 5 sharable
bit 6 preloaded rather than demand-loaded
bit 7 execute-only (code) or read-only (data)
bit 8 relocations (directly following code for this segment)
bit 9 debug info present
bits 10,11
80286 DPL bits
bit 12
discardable

bits 13-15

discard priority

Format of new executable entry table item (list):

Offset Size
Description
00h
BYTE
number of entry points (00h if end of entry table
list)
01h
BYTE
segment number (00h if end of entry table list)
02h 3N BYTEs
entry records
Offset Size
Description
00h
BYTE
flags
bit 0: exported
bit 1: single data
bits 2-7: unused???
01h
WORD
offset within segment
Format of new executable relocation data (immediately follows
segment image):
Offset Size
Description
00h
WORD
number of relocation items
02h 8N BYTEs
relocation items
Offset Size
Description
00h
BYTE
relocation type
00h LOBYTE
02h BASE
03h PTR
05h OFFS
0Bh PTR48
0Dh OFFS32
01h
BYTE
flags
bit 2: additive
02h
WORD
offset within segment
04h
WORD
target address segment
06h
WORD
target address offset
Format of new executable resource data:
Offset Size
Description
00h
WORD
alignment shift count for resource data
02h N RECORDs resources
Format of resource record:
Offset Size
Description
00h
WORD
type ID
0000h if end of resource records
>= 8000h if integer type
else offset from start of resource table
to type string
02h
WORD
number of resources of this type
04h
DWORD
reserved for runtime use
08h N Resources (see below)
Note:
resource type and name strings are stored immediately
following the
resource table, and are not null-terminated
Format of new executable resource entry:
Offset Size
Description
00h
WORD
offset in alignment units from start of file to
contents of
the resource data

02h
04h

WORD
WORD

06h

WORD

length of resource image in bytes

flags
bit 4: moveable
bit 5: shareable
bit 6: preloaded
resource ID
>= 8000h if integer resource
else offset from start of resource table to

resource string
08h
DWORD
reserved for runtime use
Notes: resource type and name strings are stored immediately
following the
resource table, and are not null-terminated
strings are counted strings, with a string of length 0
indicating the
end of the resource table
Format of new executable module reference table [one bundle of
entries]:
Offset Size
Description
00h
BYTE
number of records in this bundle (00h if end of
table)
01h
BYTE
segment indicator
00h unused
FFh movable segment, segment number is in entry
else segment number of fixed segment
02h N RECORDs
Format of segment record
Offset Size
Description
00h
BYTE
flags
bit 0: entry is exported
bit 1: entry uses global (shared) data
bits 7-3: number of parameter words
---fixed segment--01h
WORD
offset
---moveable segment--01h 2 BYTEs
INT 3F instruction (CDh 3Fh)
03h
BYTE
segment number
05h
WORD
offset
Note:
table entries are numbered starting from 1
Format of new executable resident/nonresident name table entry:
Offset Size
Description
00h
BYTE
length of string (00h if end of table)
01h N BYTEs
ASCII text of string
N+1
WORD
ordinal number (index into entry table)
Notes: the first string in the resident name table is the module
name; the
first entry in the nonresident name table is the module
description
the strings are case-sensitive; if the executable was
linked with
/IGNORECASE, all strings are in uppercase
Format of Linear Executable (enhanced mode executable) header:
Offset Size
Description
00h 2 BYTEs
"LE" (4Ch 45h) signature (Windows)

02h
endian)
03h
endian)
04h
08h

BYTE

"LX" (4Ch 58h) signature (OS/2)

byte order (00h = little-endian, nonzero = big-

BYTE

word order (00h = little-endian, nonzero = big-

DWORD
WORD

executable format level

CPU type (see also INT 15/AH=C9h)
01h Intel 80286 or upwardly compatible
02h Intel 80386 or upwardly compatible
03h Intel 80486 or upwardly compatible
04h Intel Pentium (80586) or upwardly compatible
20h Intel i860 (N10) or compatible
21h Intel "N11" or compatible
40h MIPS Mark I (R2000, R3000) or compatible
41h MIPS Mark II (R6000) or compatible
42h MIPS Mark III (R4000) or compatible
target operating system
01h OS/2
02h Windows
03h European DOS 4.0
04h Windows 386
module version
module type
bit 2: initialization (only for DLLs)
0 = global
1 = per-process
bit 4: no internal fixups in executable image
bit 5: no external fixups in executable image
bits 8,9,10:
0 = unknown
1 = incompatible with PM windowing \
2 = compatible with PM windowing
>

0Ah

WORD

0Ch
10h

DWORD
DWORD

(only for
programs)

for .EXE)
14h
DWORD
18h
Initial
DWORD
DWORD
20h
Initial
DWORD
DWORD
28h
DWORD
2Ch
DWORD
30h
34h

DWORD
DWORD

3 = uses PM windowing API

bit 13: module not loadable (only for programs)

bits 17,16,15: module type
000 program
001 library (DLL)
011 protected memory library module
100 physical device driver
110 virtual device driver
bit 30: per-process library termination
(requires valid CS:EIP, can't be set
number of memory pages
CS:EIP
object number
offset
SS:ESP
object number
offset
memory page size
(Windows LE) bytes on last page
(OS/2 LX) page offset shift count
fixup section size
fixup section checksum

38h
3Ch
40h
44h
48h
4Ch
50h
54h
58h
5Ch
60h
64h
68h
6Ch
70h
74h
78h
7Ch
80h
84h
88h
8Ch
90h
94h
98h
9Ch
A0h
A4h
A8h
ACh 20
C0h
C2h
Note:
drivers

DWORD
DWORD
DWORD
DWORD
DWORD
DWORD
DWORD
DWORD
DWORD
DWORD
DWORD
DWORD
DWORD
DWORD
DWORD
DWORD
DWORD
DWORD
DWORD
DWORD
DWORD
DWORD
DWORD
DWORD
DWORD
DWORD
DWORD
DWORD
DWORD
BYTEs
WORD
WORD
used by

loader section size

loader section checksum
offset of object table (see below)
object table entries
object page map table offset
object iterate data map offset
resource table offset
resource table entries
resident names table offset
entry table offset
module directives table offset
Module Directives entries
Fixup page table offset
Fixup record table offset
imported modules name table offset
imported modules count
imported procedures name table offset
per-page checksum table offset
data pages offset
preload page count
non-resident names table offset
non-resident names table length
non-resident names checksum
automatic data object
debug information offset
debug information length
preload instance pages number
demand instance pages number
extra heap allocation
reserved
device ID (MS-Windows VxD only)
DDK version (MS-Windows VxD only)
EMM386.EXE, QEMM, and Windows 3.0 Enhanced Mode

Format of object table entry:

Offset Size
Description
00h
DWORD
virtual size in bytes
04h
DWORD
relocation base address
08h
DWORD
object flags (see below)
0Ch
DWORD
page map index
10h
DWORD
page map entries
14h 4 BYTEs
reserved??? (apparently always zeros)
Bitfields for object flags:
bit 0 readable
bit 1 writable
bit 2 executable
bit 3 resource
bit 4 discardable
bit 5 shared
bit 6 preloaded
bit 7 invalid
bit 8-9 type
00 normal
01 zero-filled
10 resident

11 resident and contiguous

bit 10 resident and long-lockable
bit 11 reserved
bit 12 16:16 alias required
bit 13 "BIG" (Huge: 32-bit)
bit 14 conforming
bit 15 "OBJECT_I/O_PRIVILEGE_LEVEL"
bits 16-31 reserved
Format of object page map table entry:
Offset Size
Description
00h
BYTE
??? (usually 00h)
01h
WORD
(big-endian) index to fixup table
0000h if no relocation info
03h
BYTE
type (00h hard copy in file, 03h some relocation
needed)
Format of resident names table entry:
Offset Size
Description
00h
BYTE
length of name
01h N BYTEs
name
N+1 3 BYTEs
???
Format of LE linear executable entry table:
Offset Size
Description
00h
BYTE
number of entries in table
01h 10 BYTEs per entry
Offset Size
Description
00h
BYTE
bit flags
bit 0: non-empty bundle
bit 1: 32-bit entry
01h
WORD
object number
03h
BYTE
entry type flags
bit 0: exported
bit 1: uses single data rather
than instance
bit 2: reserved
bits 3-7: number of stack
parameters
04h
DWORD
offset of entry point
08h 2 BYTEs
???
Note:
empty bundles (bit flags at 00h = 00h) are used to skip
unused indices,
and do not contain the remaining nine bytes
Format of LX linear executable entry table [array]:
Offset Size
Description
00h
BYTE
number of bundles following (00h = end of entry
table)
01h
BYTE
bundle type
00h empty
01h 16-bit entry
02h 286 callgate entry
03h 32-bit entry
04h forwarder entry
bit 7 set if additional parameter typing
information is present

---bundle type 00h--no additional fields

---bundle type 01h--02h
WORD
object number
04h
BYTE
entry flags
bit 0: exported
bits 7-3: number of stack parameters
05h
WORD
offset of entry point in object (shifted by page
size shift)
---bundle type 02h--02h
WORD
object number
04h
BYTE
entry flags
bit 0: exported
bits 7-3: number of stack parameters
05h
WORD
offset of entry point in object
07h
WORD
reserved for callgate selector (used by loader)
---bundle type 03h--02h
WORD
object number
04h
BYTE
entry flags
bit 0: exported
bits 7-3: number of stack parameters
05h
DWORD
offset of entry point in object
---bundle type 04h--02h
WORD
reserved
04h
BYTE
forwarder flags
bit 0: import by ordinal
bits 7-1 reserved
05h
WORD
module ordinal
(forwarder's index into Import Module Name table)
07h
DWORD
procedure name offset or import ordinal number
Note:
all fields after the first two bytes are repeated N times
Bitfields for linear executable fixup type:
bit 7 ordinal is BYTE rather than WORD
bit 6 16-bit rather than 8-bit object number/module ordinal
bit 5 addition with DWORD rather than WORD
bit 4 relocation info has size with new two bytes at end
bit 3 reserved (0)
bit 2 set if add to destination, clear to replace destination
bits 1-0
type
00 internal fixup
01 external fixup, imported by ordinal
10 external fixup, imported by name
11 internal fixup via entry table
Format of linear executable fixup record:
Offset Size
Description
00h
BYTE
type
bits 7-4: modifier (0001 single, 0011 multiple)
bits 3-0: type
0000 byte offset
0010 word segment
0011 16-bit far pointer (DWORD)
0101 16-bit offset
0110 32-bit far pointer (PWORD)
0111 32-bit offset

1000 near call or jump, WORD/DWORD based

on seg attrib
01h
BYTE
linear executable fixup type (see above)
---if single type--02h
WORD
offset within page
04h
relocation information
---internal fixup--BYTE
object number
---external,ordinal--BYTE
one-based module number in Import Module table
BYTE/WORD ordinal number
WORD/DWORD value to add (only present if modifier bit 4
set)
---external,name--BYTE
one-based module number in Import Module table
WORD
offset in Import Procedure names
WORD/DWORD value to add (only present if modifier bit 4
set)
---if multiple type--02h
BYTE
number of items
03h
var
relocation info as for "single" type (see above)
N WORDs
offsets of items to relocate
Format of old Phar Lap .EXP file header:
Offset Size
Description
00h 2 BYTEs
"MP" (4Dh 50h) signature
02h
WORD
remainder of image size / page size (page size =
512h)
04h
WORD
size of image in pages
06h
WORD
number of relocation items
08h
WORD
header size in paragraphs
0Ah
WORD
minimum number of extra 4K pages to be allocated
at the end
of program, when it is loaded
0Ch
WORD
maximum number of extra 4K pages to be allocated
at the end
of program, when it is loaded
0Eh
DWORD
initial ESP
12h
WORD
word checksum of file
14h
DWORD
initial EIP
18h
WORD
offset of first relocation item
1Ah
WORD
overlay number
1Ch
WORD
??? (wants to be 1)
Format of new Phar Lap .EXP file header:
Offset Size
Description
00h 2 BYTEs
signature ("P2" for 286 .EXP executable, "P3" for
386 .EXP)
02h
WORD
level (01h flat-model file, 02h multisegmented
file)
04h
WORD
header size
06h
DWORD
file size in bytes
0Ah
WORD
checksum
0Ch
DWORD
offset of run-time parameters within file
10h
DWORD
size of run-time parameters in bytes
14h
DWORD
offset of relocation table within file
18h
DWORD
size of relocation table in bytes

1Ch
DWORD
20h
DWORD
24h
WORD
26h
DWORD
2Ah
DWORD
2Eh
DWORD
32h
DWORD
36h
DWORD
3Ah
DWORD
3Eh
DWORD
42h
DWORD
46h
DWORD
4Ah
DWORD
4Eh
DWORD
52h
DWORD
56h
DWORD
end of program
5Ah
DWORD
end of program
5Eh
62h
66h
68h
6Ch
6Eh
70h
72h

DWORD
DWORD
WORD
DWORD
WORD
WORD
WORD
WORD

74h
DWORD
78h
DWORD
7Ch
DWORD
80h 256 BYTEs

offset of segment information table within file

size of segment information table in bytes
size of segment information table entry in bytes
offset of load image within file
size of load image on disk
offset of symbol table within file
size of symbol table in bytes
offset of GDT within load image
size of GDT in bytes
offset of LDT within load image
size of LDT in bytes
offset of IDT within load image
size of IDT in bytes
offset of TSS within load image
size of TSS in bytes
minimum number of extra bytes to be allocated at
(level 1 executables only)
maximum number of extra bytes to be allocated at
(level 1 executables only)
base load offset (level 1 executables only)
initial ESP
initial SS
initial EIP
initial CS
initial LDT
initial TSS
flags
bit 0: load image is packed
bit 1: 32-bit checksum is present
bits 4-2: type of relocation table
memory requirements for load image
32-bit checksum (optional)
size of stack segment in bytes
reserved (0)

Format of Phar Lap segment information table entry:

Offset Size
Description
00h
WORD
selector number
02h
WORD
flags
04h
DWORD
base offset of selector
08h
DWORD
minimum number of extra bytes to be allocated to
the segment
Format of 386|DOS-Extender run-time parameters:
Offset Size
Description
00h 2 BYTEs
signature "DX" (44h 58h)
02h
WORD
minimum number of real-mode params to leave free
at run time
04h
WORD
maximum number of real-mode params to leave free
at run time
06h
WORD
minimum interrupt buffer size in KB
08h
WORD
maximum interrupt buffer size in KB
0Ah
WORD
number of interrupt stacks
0Ch
WORD
size in KB of each interrupt stack
0Eh
DWORD
offset of byte past end of real-mode code and data

12h
14h

WORD
WORD

16h
WORD
2, or 3)
18h 104 BYTEs

size in KB of call buffers

flags
bit 0: file is virtual memory manager
bit 1: file is a debugger
unprivileged flag (if nonzero, executes at ring 1,
reserved (0)

Format of Phar Lap repeat block header:

Offset Size
Description
00h
WORD
byte count
02h
BYTE
repeat string length
Format of Borland debugging information header (following load
image):
Offset Size
Description
00h
WORD
signature 52FBh
02h
WORD
version ID
04h
DWORD
size of name pool in bytes
08h
WORD
number of names in namem pool
0Ah
WORD
number of type entries
0Ch
WORD
number of structure members
0Eh
WORD
number of symbols
10h
WORD
number of global symbols
12h
WORD
number of modules
14h
WORD
number of locals (optional)
16h
WORD
number of scopes in table
18h
WORD
number of line-number entries
1Ah
WORD
number of include files
1Ch
WORD
number of segment records
1Eh
WORD
number of segment/file correlations
20h
DWORD
size of load image after removing uninitialized
data and debug
info
24h
DWORD
debugger hook; pointer into debugged program whose
meaning
depends on program flags
28h
BYTE
program flags
bit 0: case-sensitive link
bit 1: pascal overlay program
29h
WORD
no longer used
2Bh
WORD
size of data pool in bytes
2Dh
BYTE
padding
2Eh
WORD
size of following header extension (currently 00h,
10h, or 20h)
30h
WORD
number of classes
32h
WORD
number of parents
34h
WORD
number of global classes (currently unused)
36h
WORD
number of overloads (currently unused)
38h
WORD
number of scope classes
3Ah
WORD
number of module classes
3Ch
WORD
number of coverage offsets
3Eh
DWORD
offset relative to symbol base of name pool
42h
WORD
number of browser information records
44h
WORD
number of optimized symbol records
46h
WORD
debugging flags
48h 8 BYTEs
padding

Note:
additional information on the Borland debugging info may
be found in
Borland's Open Architecture Handbook

--------D214C--------------------------------------------------INT 21 - DOS 2+ - "EXIT" - TERMINATE WITH RETURN CODE

AH = 4Ch
AL = return code
Return: never returns
Notes: unless the process is its own parent (see AH=26h, offset
16h in PSP),
all open files are closed and all memory belonging to
the process
is freed
all network file locks should be removed before calling
this function
SeeAlso: AH=00h,AH=26h,AH=4Bh,AH=4Dh,INT 15/AH=12h/BH=02h,INT
20,INT 22
SeeAlso: INT 60/DI=0601h

--------D2150--------------------------------------------------INT 21 - DOS 2+ internal - SET CURRENT PROCESS ID (SET

PSP ADDRESS)
AH = 50h
BX = segment of PSP for new process
Notes: DOS uses the current PSP address to determine which
processes own files
and memory; it corresponds to process identifiers used
by other OSs
under DOS 2.x, this function cannot be invoked inside an
INT 28h
handler without setting the Critical Error flag
under MS-DOS 3+ and DR-DOS 3.41+, this function does not
use any of
the DOS-internal stacks and may thus be called at any
time, even
during another INT 21h call
some Microsoft applications such as Quick C 2.51 use
segments of 0000h
and FFFFh and direct access to the SDA (see AX=5D06h) to
test whether
they are running under MS-DOS rather than a compatible
OS; although
one should only call this function with valid PSP
addresses, any
program hooking it should be prepared to handle invalid
addresses
supported by OS/2 compatibility box
this call was undocumented prior to the release of DOS 5.0
SeeAlso: AH=26h,AH=51h,AH=62h

--------D2151--------------------------------------------------INT 21 - DOS 2+ internal - GET CURRENT PROCESS ID (GET

PSP ADDRESS)
AH = 51h
Return: BX = segment of PSP for current process
Notes: DOS uses the current PSP address to determine which
processes own files
and memory; it corresponds to process identifiers used
by other OSs
under DOS 2.x, this function cannot be invoked inside an
INT 28h
handler without setting the Critical Error flag
under DOS 3+, this function does not use any of the DOSinternal stacks
and may thus be called at any time, even during another
INT 21h call
supported by OS/2 compatibility box
identical to the documented AH=62h
this call was undocumented prior to the release of DOS 5.0
SeeAlso: AH=26h,AH=50h,AH=62h

--------D2152--------------------------------------------------INT 21 U - DOS 2+ internal - "SYSVARS" - GET LIST OF

LISTS

AH = 52h
Return: ES:BX -> DOS list of lists
Notes: partially supported by OS/2 v1.1 compatibility box
(however, most
pointers are FFFFh:FFFFh, LASTDRIVE is FFh, and the NUL
header "next"
pointer is FFFFh:FFFFh).
on return, ES points at the DOS data segment (see also INT
2F/AX=1203h)
SeeAlso: INT 2F/AX=1203h
Format of List of Lists:
Offset Size
Description
-24
WORD
(DOS 3.1+) contents of CX from INT 21/AX=5E01h
-22
WORD
(DOS ???+) LRU counter for FCB caching
-20
WORD
(DOS ???+) LRU counter for FCB opens
-18
DWORD
(DOS ???+) address of OEM function handler (see
INT 21/AH=F8h)
FFFFh:FFFFh if not installed or not
available
-14
WORD
(DOS ???+) offset in DOS CS of code to return from
INT 21 call
-12
WORD
(DOS 3.1+) sharing retry count (see AX=440Bh)
-10
WORD
(DOS 3.1+) sharing retry delay (see AX=440Bh)
-8
DWORD
(DOS 3+) pointer to current disk buffer
-4
WORD
(DOS 3+) pointer in DOS data segment of unread CON
input

line,
rest
input
-2
WORD
00h
DWORD
AH=32h)
04h
DWORD
08h
DWORD
recently loaded

when CON is read via a handle, DOS reads an entire

and returns the requested portion, buffering the
for the next read.

0000h indicates no unread

segment of first memory control block

pointer to first Drive Parameter Block (see
pointer to first System File Table (see below)
pointer to active CLOCK$ device's header (most

driver with CLOCK bit set)

0Ch
DWORD
pointer to active CON device's header (most
recently loaded
driver with STDIN bit set)
---DOS 2.x--10h
BYTE
number of logical drives in system
11h
WORD
maximum bytes/block of any block device
13h
DWORD
pointer to first disk buffer (see below)
17h 18 BYTEs
actual NUL device driver header (not a pointer!)
NUL is always the first device on DOS's linked
list of device
drivers. (see below)
---DOS 3.0--10h
BYTE
number of block devices
11h
WORD
maximum bytes/block of any block device
13h
DWORD
pointer to first disk buffer (see below)
17h
DWORD
pointer to array of current directory structures
(see below)
1Bh
BYTE
value of LASTDRIVE command in CONFIG.SYS (default
5)
1Ch
DWORD
pointer to STRING= workspace area
20h
WORD
size of STRING area (the x in STRING=x from
CONFIG.SYS)
22h
DWORD
pointer to FCB table
26h
WORD
the y in FCBS=x,y from CONFIG.SYS
28h 18 BYTEs
actual NUL device driver header (not a pointer!)
NUL is always the first device on DOS's linked
list of device
drivers. (see below)
---DOS 3.1-3.3--10h
WORD
maximum bytes per sector of any block device
12h
DWORD
pointer to first disk buffer in buffer chain (see
below)
16h
DWORD
pointer to array of current directory structures
(see below)
1Ah
DWORD
pointer to system FCB tables (see below)
1Eh
WORD
number of protected FCBs (the y in the CONFIG.SYS
FCBS=x,y)
20h
BYTE
number of block devices installed
21h
BYTE
number of available drive letters (largest of 5,
installed
block devices, and CONFIG.SYS LASTDRIVE=). Also
size of
current directory structure array.
22h 18 BYTEs
actual NUL device driver header (not a pointer!)

list of device
34h
BYTE
---DOS 4.x--10h
WORD
12h
DWORD
16h
DWORD
(see below)
1Ah
DWORD
1Eh
WORD
FCBS=x,y)
20h
BYTE
21h
BYTE
installed
size of
22h 18 BYTEs
list of device

NUL is always the first device on DOS's linked

drivers. (see below)
number of JOIN'ed drives
maximum bytes per sector of any block device
pointer to disk buffer info record (see below)
pointer to array of current directory structures
pointer to system FCB tables (see below)
number of protected FCBs (the y in the CONFIG.SYS
(always 00h for DOS 5.0)
number of block devices installed
number of available drive letters (largest of 5,
block devices, and CONFIG.SYS LASTDRIVE=).

Also

current directory structure array.

actual NUL device driver header (not a pointer!)
NUL is always the first device on DOS's linked

drivers. (see below)

34h
BYTE
number of JOIN'ed drives
35h
WORD
pointer within IBMDOS code segment to list of
special program
names (see below)
(always 0000h for DOS 5.0)
37h
DWORD
pointer to FAR routine for resident IFS utility
functions
(see below)
may be called by any IFS driver which does not
wish to
service functions 20h or 24h-28h itself
3Bh
DWORD
pointer to chain of IFS (installable file system)
drivers
3Fh
WORD
the x in BUFFERS x,y (rounded up to multiple of 30
if in EMS)
41h
WORD
number of lookahead buffers (the y in BUFFERS x,y)
43h
BYTE
boot drive (1=A:)
44h
BYTE
flag: 01h to use DWORD moves (80386+), 00h
otherwise
45h
WORD
extended memory size in KB
---DOS 5.0-6.0--10h 39 BYTEs
as for DOS 4.x (see above)
37h
DWORD
pointer to SETVER program list or 0000h:0000h
3Bh
WORD
(DOS=HIGH) offset in DOS CS of function to fix A20
control
when executing special .COM format
3Dh
WORD
PSP of most-recently EXECed program if DOS in HMA,
0000h if low
3Fh 8 BYTEs
as for DOS 4.x (see above)
Format of memory control block (see also below):
Offset Size
Description
00h
BYTE
block type: 5Ah if last block in chain, otherwise
4Dh

01h

WORD

PSP segment of owner or

0000h if free
0006h if DR-DOS XMS UMB
0007h if DR-DOS excluded upper memory ("hole")
0008h if belongs to DOS
FFFAh if 386MAX UMB control block (see
AX=4402h"386MAX")
FFFDh if 386MAX locked-out memory
FFFEh if 386MAX UMB (immediately follows its
control block)
FFFFh if 386MAX 6.01 device driver
03h
WORD
size of memory block in paragraphs
05h 3 BYTEs
unused by MS-DOS
(386MAX) if locked-out block, region start/prev
region end
---DOS 2.x,3.x--08h 8 BYTEs
unused
---DOS 4+ --08h 8 BYTEs
ASCII program name if PSP memory block or DR-DOS
UMB,
else garbage
null-terminated if less than 8 characters
Notes: the next MCB is at segment (current + size + 1)
under DOS 3.1+, the first memory block is the DOS data
segment,
containing installable drivers, buffers, etc. Under DOS
4+ it is
divided into subsegments, each with its own memory
control block
(see below), the first of which is at offset 0000h.
for DOS 5+, blocks owned by DOS may have either "SC" or
"SD" in bytes
08h and 09h. "SC" is system code or locked-out interUMB memory,
"SD" is system data, device drivers, etc.
Some versions of DR-DOS use only seven characters of the
program name,
placing a NUL in the eighth byte.
Format of MS-DOS 5+ UMB control block:
Offset Size
Description
00h
BYTE
type: 5Ah if last block in chain, 4Dh otherwise
01h
WORD
first available paragraph in UMB if control block
at start
of UMB, 000Ah if control block at end of UMB
03h
WORD
length in paragraphs of following UMB or lockedout region
05h 3 BYTEs
unused
08h 8 BYTEs
block type name: "UMB" if start block, "SM" if end
block in UMB
Format of STARLITE (General Software's Embedded DOS) memory
control block:
Offset Size
Description
00h
BYTE
block type: 5Ah if last block in chain, otherwise
4Dh

01h
WORD
belongs to DOS
03h
WORD
05h
BYTE
06h
WORD
(0000h if last)
08h
WORD
or 0000h
0Ah 6 BYTEs

PSP segment of owner, 0000h if free, 0008h if

size of memory block in paragraphs
unused
segment address of next memory control block
segment address of previous memory control block
reserved

Format of DOS 4+ data segment subsegment control blocks:

Offset Size
Description
00h
BYTE
subsegment type (blocks typically appear in this
order)
"D" device driver
"E" device driver appendage
"I" IFS (Installable File System) driver
"F" FILES= control block storage area (for
FILES>5)
"X" FCBS=
control block storage area, if
present
"C" BUFFERS EMS workspace area (if BUFFERS /X
option used)
"B" BUFFERS= storage area
"L" LASTDRIVE= current directory structure array
storage area
"S" STACKS= code and data area, if present (see
below)
"T" INSTALL= transient code
01h
WORD
paragraph of subsegment start (usually the next
paragraph)
03h
WORD
size of subsegment in paragraphs
05h 3 BYTEs
unused
08h 8 BYTEs
for types "D" and "I", base name of file from
which the driver
was loaded (unused for other types)
Format of data at start of STACKS code segment (if present):
Offset Size
Description
00h
WORD
???
02h
WORD
number of stacks (the x in STACKS=x,y)
04h
WORD
size of stack control block array (should be 8*x)
06h
WORD
size of each stack (the y in STACKS=x,y)
08h
DWORD
pointer to STACKS data segment
0Ch
WORD
offset in STACKS data segment of stack control
block array
0Eh
WORD
offset in STACKS data segment of last element of
that array
10h
WORD
offset in STACKS data segment of the entry in that
array for
the next stack to be allocated (initially same as
value in 0Eh
and works its way down in steps of 8 to the value
in 0Ch as
hardware interrupts pre-empt each other)
Note:
the STACKS code segment data may, if present, be located
as follows:

DOS 3.2:
fairly early
DOS 3.3:
DOS data
segment

The code segment data is at a paragraph boundary

in the IBMBIO segment (seen at 0070:0190h)
The code segment is at a paragraph boundary in the
segment, which may be determined by inspecting the
pointers of the vectors for those of interrupts

02h, 08h-0Eh,

70h, 72-77h which have not been redirected by

device drivers or
TSRs.
DOS 4+
Identified by sub-segment control block type "S"
within the DOS
data segment.
SeeAlso: INT B4"STACKMAN"
Format of array elements in STACKS data segment:
Offset Size
Description
00h
BYTE
status: 00h=free, 01h=in use, 03h=corrupted by
overflow of
higher stack.
01h
BYTE
not used
02h
WORD
previous SP
04h
WORD
previous SS
06h
WORD
ptr to word at top of stack (new value for SP).
The word at the
top of the stack is preset to point back to this
control block.
SHARE.EXE hooks (DOS 3.1-6.00):
(offsets from first system file table--pointed at by
ListOfLists+04h)
Offset Size
Description
-3Ch
DWORD
pointer to FAR routine for ???
Note: not called by MS-DOS 3.3, set to 0000h:0000h
by
SHARE 3.3+
-38h
DWORD
pointer to FAR routine called on opening file
on call, internal DOS location points at
filename(see AX=5D06h)
Return: CF clear if successful
CF set on error
AX = DOS error code (24h) (see AH=59h)
Note: SHARE directly accesses DOS-internal data to
get name of
file just opened
-34h
DWORD
pointer to FAR routine called on closing file
ES:DI -> system file table
Note: does something to every Record Lock Record
for file
-30h
DWORD
pointer to FAR routine to close all files for
given computer
(called by AX=5D03h)
-2Ch
DWORD
pointer to FAR routine to close all files for
given process
(called by AX=5D04h)

-28h

DWORD

-24h

DWORD

-20h

DWORD

-1Ch
locked

DWORD

pointer to FAR routine to close file by name

(called by AX=5D02h)
DS:SI -> DOS parameter list (see AX=5D00h)
DPL's DS:DX -> name of file to close
Return: CF clear if successful
CF set on error
AX = DOS error code (03h) (see AH=59h)
pointer to FAR routine to lock region of file
call with BX = file handle
---DOS 3.x--CX:DX = starting offset
SI:AX = size
---DOS 4+--DS:DX -> lock range
DWORD start offset
DWORD size in bytes
Return: CF set on error
AL = DOS error code (21h) (see AH=59h)
Note: not called if file is marked as remote
pointer to FAR routine to unlock region of file
call with BX = file handle
---DOS 3.x--CX:DX = starting offset
SI:AX = size
---DOS 4+--DS:DX -> lock range
DWORD start offset
DWORD size in bytes
Return: CF set on error
AL = DOS error code (21h) (see AH=59h)
Note: not called if file is marked as remote
pointer to FAR routine to check if file region is
call with ES:DI -> system file table entry for

file

CX = length of region from current

position in file
-18h

DWORD

AX=5D00h)
sharing rec

specified SFT
-14h
SFT???

DWORD

Return: CF set if any portion of region locked

AX = 0021h
pointer to FAR routine to get open file list entry
(called by AX=5D05h)
call with DS:SI -> DOS parameter list (see
DPL's BX = index of sharing record
DPL's CX = index of SFT in SFT chain of
Return: CF set on error or not loaded
AX = DOS error code (12h) (see AH=59h)
CF clear if successful
ES:DI -> filename
CX = number of locks owned by
BX = network machine number
DX destroyed
pointer to FAR routine for updating FCB from
call with DS:SI -> unopened FCB

-10h
DWORD
file ???

ES:DI -> system file table entry

Return: BL = C0h???
Note: copies following fields from SFT to FCB:
starting cluster of file
0Bh
1Ah
sharing record offset
33h
1Ch
file attribute
04h
1Eh
pointer to FAR routine to get first cluster of FCB
call with ES:DI -> system file table entry
DS:SI -> FCB
Return: CF set if SFT closed or sharing record

offsets

-0Ch
DWORD
for process

mismatched
CF clear if successful
BX = starting cluster number from FCB
pointer to FAR routine to close file if duplicate

uses SFT

DS:SI -> system file table

Return: AX = number of handle in JFT which already
Note: called during open/create of a file
Note: if SFT was opened with inheritance enabled

and sharing

mode 111, does something to all other SFTs

owned by

same process which have the same file open

mode and
-08h

sharing record
pointer to FAR routine for closing file
Note: closes various handles referring to file

DWORD

most-recently

opened
pointer to FAR routine to update directory info in

-04h
DWORD
related SFT

entries
call with ES:DI -> system file table entry for
file (see below)
SFT)
0Dh) and date
and starting
last-accessed
file if file

AX = subfunction (apply to each related

00h: update time stamp (offset
stamp (offset 0Fh)
01h: update file size (offset 11h)
cluster (offset 0Bh).

Sets

cluster fields to start of

never accessed
02h: as function 01h, but last-

accessed fields

table entries

always changed
03h: do both functions 00h and 02h
Note: follows ptr at offset 2Bh in system file
Note: NOP if opened with no-inherit or via FCB

Notes: most of the above hooks (except -04h, -14h, -18h, and
-3Ch) assume
either that SS=DOS DS or SS=DS=DOS DS and directly
access
DOS-internal data
sharing hooks are not supported by DR-DOS 5-6; will
reportedly be
supported by Novell DOS 7
Format of sharing record:
Offset Size
Description
00h
BYTE
flag
00h free block
01h allocated block
FFh end marker
01h
WORD
size of block
03h
BYTE
checksum of pathname (including NUL)
if sum of ASCII values is N, checksum is (N/256 +
N%256)
04h
WORD
offset in SHARE's DS of first Record Lock Record
(see below)
06h
DWORD
pointer to start of system file table chain for
file
0Ah
WORD
unique sequence number
0Ch
var
ASCIZ full pathname
Note:
not supported by DR-DOS SHARE 1.1 and 2.0; will reportedly
be
supported by Novell DOS 7
Format of Record Lock Record (SHARE.EXE):
Offset Size
Description
00h
WORD
offset in SHARE's DS of next lock table in list or
0000h
02h
DWORD
offset in file of start of locked region
06h
DWORD
offset in file of end of locked region
0Ah
DWORD
pointer to System File Table entry for this file
0Eh
WORD
PSP segment of lock's owner
---DOS 5+ --10h
WORD
lock type: (00h lock all, 01h lock writes only)
Format of DOS 2.x system file tables:
Offset Size
Description
00h
DWORD
pointer to next file table (offset FFFFh if last)
04h
WORD
number of files in this table
06h 28h bytes per file
Offset Size
Description
00h
BYTE
number of file handles referring to this
file
01h
BYTE
file open mode (see AH=3Dh)
02h
BYTE
file attribute
03h
BYTE
drive (0 = character device, 1 = A, 2 = B,
etc)
04h 11 BYTEs
filename in FCB format (no path,no
period,blank-padded)
0Fh
WORD
???
11h
WORD
???
13h
DWORD
file size???

17h
WORD
file date in packed format (see AX=5700h)
19h
WORD
file time in packed format (see AX=5700h)
1Bh
BYTE
device attribute (see AX=4400h)
---character device--1Ch
DWORD
pointer to device driver
---block device--1Ch
WORD
starting cluster of file
1Eh
WORD
relative cluster in file of last cluster
accessed

-----20h
22h
24h

WORD
WORD
DWORD

absolute cluster number of current cluster

???
current file position???

Format of DOS 3.0 system file tables and FCB tables:

Offset Size
Description
00h
DWORD
pointer to next file table (offset FFFFh if last)
04h
WORD
number of files in this table
06h 38h bytes per file
Offset Size
Description
00h-1Eh as for DOS 3.1+ (see below)
1Fh
WORD
byte offset of directory entry within
sector
21h 11 BYTEs
filename in FCB format (no path/period,
blank-padded)
2Ch
DWORD
(SHARE.EXE) pointer to previous SFT
sharing same file
30h
WORD
(SHARE.EXE) network machine number which
opened file
(Windows Enhanced mode DOSMGR uses the
virtual machine
ID as the machine number; see INT
2F/AX=1683h)
32h
WORD
PSP segment of file's owner (first three
entries for
AUX/CON/PRN contain segment of IO.SYS
startup code)
34h
WORD
(SHARE.EXE) offset in SHARE code seg of
share record
36h
WORD
??? apparently always 0000h
Format of DOS 3.1-3.3x, DR-DOS 5.0-6.0 system file tables and FCB
tables:
Offset Size
Description
00h
DWORD
pointer to next file table (offset FFFFh if last)
04h
WORD
number of files in this table
06h 35h bytes per file
Offset Size
Description
00h
WORD
number of file handles referring to this
file
02h
WORD
file open mode (see AH=3Dh)
bit 15 set if this file opened via FCB
04h
BYTE
file attribute (see AX=4301h)
05h
WORD
device info word (see AX=4400h)
bit 15 set if remote file
bit 14 set means do not set file date/time
on closing

07h
DWORD
character device
(see AH=32h)
0Bh
0Dh

bit 12 set means don't inherit on EXEC

bits 5-0 drive number for disk files
pointer to device driver header if
else pointer to DOS Drive Parameter Block

WORD
WORD

starting cluster of file

file time in packed format (see AX=5700h)
not used for character devices in DR-DOS
0Fh
WORD
file date in packed format (see AX=5700h)
not used for character devices in DR-DOS
11h
DWORD
file size
---system file table--15h
DWORD
current offset in file (may be larger than

size of

file; INT 21/AH=42h does not check new

position)
---FCB table--15h
WORD
counter for last I/O to FCB
17h
WORD
counter for last open of FCB
(these are separate to determine the times
of the
latest I/O and open)
--19h
WORD
relative cluster within file of last
cluster accessed
1Bh
WORD
absolute cluster number of last cluster
accessed
0000h if file never read or written???
1Dh
WORD
number of sector containing directory
entry
1Fh
BYTE
number of dir entry within sector (byte
offset/32)
20h 11 BYTEs
filename in FCB format (no path/period,
blank-padded)
2Bh
DWORD
(SHARE.EXE) pointer to previous SFT
sharing same file
2Fh
WORD
(SHARE.EXE) network machine number which
opened file
(Windows Enhanced mode DOSMGR uses the
virtual machine
ID as the machine number; see INT
2F/AX=1683h)
31h
WORD
PSP segment of file's owner (see AH=26h)
(first three
entries for AUX/CON/PRN contain segment of
IO.SYS
startup code)
33h
WORD
offset within SHARE.EXE code segment of
sharing record (see above) 0000h = none
Format of DOS 4.0-6.0 system file tables and FCB tables:
Offset Size
Description
00h
DWORD
pointer to next file table (offset FFFFh if last)
04h
WORD
number of files in this table
06h 3Bh bytes per file
Offset Size
Description

00h

WORD

02h

WORD

04h
05h

BYTE
WORD

file

on closing

number of file handles referring to this

FFFFh if in use but not referenced
file open mode (see AH=3Dh)
bit 15 set if this file opened via FCB
file attribute (see AX=4301h)
device info word (see also AX=4400h)
bit 15 set if remote file
bit 14 set means do not set file date/time
bit
bit
bit
bit

if local)
07h
DWORD
character device

set
set
set
set

if
if
if
if

named pipe
no inherit
network spooler
device, clear if file (only

bits 6-0 as for AX=4400h

pointer to device driver header if
else pointer to DOS Drive Parameter Block

(see AH=32h)
only)

13
12
11
7

0Bh

WORD

0Dh
0Fh
11h
15h

WORD
WORD
DWORD
DWORD

or REDIR data
starting cluster of file (local files
file time in packed format (see AX=5700h)
file date in packed format (see AX=5700h)
file size
current offset in file (SFT)
LRU counters (FCB table, two WORDs)

---local file--19h
WORD
relative cluster within file of last
cluster accessed
1Bh
DWORD
number of sector containing directory
entry
1Fh
BYTE
number of dir entry within sector (byte
offset/32)
---network redirector--19h
DWORD
pointer to REDIRIFS record
1Dh 3 BYTEs
???
-----20h 11 BYTEs
filename in FCB format (no path/period,
blank-padded)
2Bh
DWORD
(SHARE.EXE) pointer to previous SFT
sharing same file
2Fh
WORD
(SHARE.EXE) network machine number which
opened file
(Windows Enhanced mode DOSMGR uses the
virtual machine
ID as the machine number; see INT
2F/AX=1683h)
31h
WORD
PSP segment of file's owner (see AH=26h)
(first three
entries for AUX/CON/PRN contain segment of
IO.SYS
startup code)
33h
WORD
offset within SHARE.EXE code segment of
sharing record (see above) 0000h = none

35h
WORD
clustr accessed

(local) absolute cluster number of last

(redirector) ???
37h
DWORD
pointer to IFS driver for file, 0000000h
if native DOS
Note:
the OS/2 2.0 DOS Boot Session does not properly fill in
the filename
field due to incomplete support for SFTs; the OS/2 2.0
DOS Window
does not appear to support SFTs at all
Format of current directory structure (CDS) (array, LASTDRIVE
entries):
Offset Size
Description
00h 67 BYTEs
ASCIZ path in form X:\PATH (local) or \\MACH\PATH
(network)
43h
WORD
drive attributes (see also note below and
AX=5F07h)
bit 15: uses network redirector \ invalid if 00,
installable
bit 14: physical drive
/ file system if
11
bit 13: JOIN'ed
\ path above is true path that
would be
bit 12: SUBST'ed / needed if not under SUBST or
JOIN
bit 7: remote drive hidden from redirector's
assign-list and
exempt from network connection
make/break commands;
set for CD-ROM drives
45h
DWORD
pointer to Drive Parameter Block for drive (see
AH=32h)
---local drives--49h
WORD
starting cluster of current directory
0000h = root, FFFFh = never accessed
4Bh
WORD
??? seems to be FFFFh always
4Dh
WORD
??? seems to be FFFFh always
---network drives--49h
DWORD
pointer to redirector or REDIRIFS record, or
FFFFh:FFFFh
(DOS 4 only) available for use by IFS driver
4Dh
WORD
stored user data from INT 21/AX=5F03h
-----4Fh
WORD
offset in current directory path of backslash
corresponding to
root directory for drive
this value specifies how many characters to hide
from the
"CHDIR" and "GETDIR" calls; normally set to 2 to
hide the
drive letter and colon, SUBST, JOIN, and
networks change it
so that only the appropriate portion of the true
path is
visible to the user
---DOS 4+ ---

51h

BYTE

52h
DWORD
(DOS 5+) for

(DOS 4 only, remote drives) device type

04h network drive
pointer to IFS driver (DOS 4) or redirector block

this drive, 00000000h if native DOS

56h
WORD
available for use by IFS driver
Notes: the path for invalid drives is normally set to X:\, but
may be empty
after JOIN x: /D in DR-DOS 5.0 or NET USE x: /D in older
LAN versions
normally, only one of bits 13&12 may be set together with
bit 14, but
DR-DOS 5.0 uses other combinations for bits 15-12: 0111
JOIN,
0001 SUBST, 0101 ASSIGN (see below)
Format of DR-DOS 5.0-6.0 current directory structure entry
(array):
Offset Size
Description
00h 67 BYTEs
ASCIZ pathname of actual root directory for this
logical drive
43h
WORD
drive attributes
1000h SUBSTed drive
3000h??? JOINed drive
4000h physical drive
5000h ASSIGNed drive
7000h JOINed drive
8000h network drive
45h
BYTE
physical drive number (0=A:) if this logical drive
is valid
46h
BYTE
??? apparently flags for JOIN and ASSIGN
47h
WORD
cluster number of start of parent directory (0000h
= root)
49h
WORD
entry number of current directory in parent
directory
4Bh
WORD
cluster number of start of current directory
4Dh
WORD
used for media change detection (details not
available)
4Fh
WORD
cluster number of SUBST/JOIN "root" directory
0000h if physical root directory
Format of device driver header:
Offset Size
Description
00h
DWORD
pointer to next driver, offset=FFFFh if last
driver
04h
WORD
device attributes
Character device:
bit 15 set (indicates character device)
bit 14 IOCTL supported (see AH=44h)
bit 13 (DOS 3+) output until busy supported
bit 12 reserved
bit 11 (DOS 3+) OPEN/CLOSE/RemMedia calls
supported
bits 10-8 reserved
bit 7 (DOS 5+) Generic IOCTL check call
supported (cmd 19h)
(see AX=4410h,AX=4411h)

bit 6

(DOS 3.2+) Generic IOCTL call supported

bit 5
bit 4

(see AX=440Ch,AX=440Dh)
reserved
device is special (use INT 29 "fast

bit 3

device is CLOCK$ (all reads/writes use

(command 13h)

console output")
transfer

record described below)

bit 2 device is NUL
bit 1 device is standard output
bit 0 device is standard input
Block device:
bit 15 clear (indicates block device)
bit 14 IOCTL supported
bit 13 non-IBM format
bit 12 network device (device is remote)
bit 11 (DOS 3+) OPEN/CLOSE/RemMedia calls
supported

drives)

bit 10 reserved
bit 9 direct I/O not allowed???
(set by DOS 3.3 DRIVER.SYS for "new"
bit 8

??? set by DOS 3.3 DRIVER.SYS for "new"

bit 7

(DOS 5+) Generic IOCTL check call

drives
supported (cmd 19h)
(command 13h)
and 18h

bit 6

(see AX=4410h,AX=4411h)
(DOS 3.2+) Generic IOCTL call supported
implies support for commands 17h

(see
AX=440Ch,AX=440Dh,AX=440Eh,AX=440Fh)
bits 5-2 reserved
bit 1
driver supports 32-bit sector
addressing (DOS 3.31+)
bit 0
reserved
Note: for European MS-DOS 4.0, bit 11 also
indicates that bits
8-6 contain a version code (000 = DOS
3.0,3.1;
001 = DOS 3.2, 010 = European DOS 4.0)
06h
WORD
device strategy entry point
call with ES:BX -> request header (see INT
2F/AX=0802h)
08h
WORD
device interrupt entry point
---character device--0Ah 8 BYTEs
blank-padded character device name
---block device--0Ah
BYTE
number of subunits (drives) supported by driver
0Bh 7 BYTEs
unused
--12h
WORD
(CD-ROM driver) reserved, must be 0000h
appears to be another device chain
14h
BYTE
(CD-ROM driver) drive letter (must initially be
00h)

15h
BYTE
16h 6 BYTEs
version

(CD-ROM driver) number of units

(CD-ROM driver) signature 'MSCDnn' where 'nn' is
(currently '00')

Format of CLOCK$ transfer record:

Offset Size
Description
00h
WORD
number of days since 1-Jan-1980
02h
BYTE
minutes
03h
BYTE
hours
04h
BYTE
hundredths of second
05h
BYTE
seconds
Format of DOS 2.x disk buffer:
Offset Size
Description
00h
DWORD
pointer to next disk buffer, offset = FFFFh if
last
least-recently used buffer is first in chain
04h
BYTE
drive (0=A, 1=B, etc), FFh if not in use
05h 3 BYTEs
unused??? (seems always to be 00h 00h 01h)
08h
WORD
logical sector number
0Ah
BYTE
number of copies to write (1 for non-FAT sectors)
0Bh
BYTE
sector offset between copies if multiple copies to
be written
0Ch
DWORD
pointer to DOS Drive Parameter Block (see AH=32h)
10h
buffered data
Format of DOS 3.x disk buffer:
Offset Size
Description
00h
DWORD
pointer to next disk buffer, offset = FFFFh if
last
least-recently used buffer is first in chain
04h
BYTE
drive (0=A,1=B, etc), FFh if not in use
05h
BYTE
buffer flags
bit 7: ???
bit 6: buffer dirty
bit 5: buffer has been referenced
bit 4: ???
bit 3: sector in data area
bit 2: sector in a directory, either root or
subdirectory
bit 1: sector in FAT
bit 0: boot sector??? (guess)
06h
WORD
logical sector number
08h
BYTE
number of copies to write (1 for non-FAT sectors)
09h
BYTE
sector offset between copies if multiple copies to
be written
0Ah
DWORD
pointer to DOS Drive Parameter Block (see AH=32h)
0Eh
WORD
unused??? (almost always 0)
10h
buffered data
Format of DOS 4.00 (pre UR 25066) disk buffer info:
Offset Size
Description
00h
DWORD
pointer to array of disk buffer hash chain heads
(see below)
04h
WORD
number of disk buffer hash chains (referred to as
NDBCH below)

06h
DWORD
0Ah
WORD
BUFFERS=x,y)
0Ch
BYTE
0Dh
WORD
0Fh
WORD
255)
11h
WORD
13h
WORD
15h
WORD
17h 4 WORDs

pointer to lookahead buffer, zero if not present

number of lookahead sectors, else zero (the y in
00h if buffers in EMS (/X), FFh if not
EMS handle for buffers, zero if not in EMS
EMS physical page number used for buffers (usually
??? seems always to be 0001h
segment of EMS physical page frame
??? seems always to be zero
EMS partial page mapping information???

Format of DOS 4.01 (from UR 25066 Corrctive Services Disk on) disk
buffer info:
Offset Size
Description
00h
DWORD
pointer to array of disk buffer hash chain heads
(see below)
04h
WORD
number of disk buffer hash chains (referred to as
NDBCH below)
06h
DWORD
pointer to lookahead buffer, zero if not present
0Ah
WORD
number of lookahead sectors, else zero (the y in
BUFFERS=x,y)
0Ch
BYTE
01h, possibly to distinguish from pre-UR 25066
format
0Dh
WORD
??? EMS segment for BUFFERS (only with /XD)
0Fh
WORD
??? EMS physical page number of EMS seg above
(only with /XD)
11h
WORD
??? EMS segment for ??? (only with /XD)
13h
WORD
??? EMS physical page number of above (only
with /XD)
15h
BYTE
??? number of EMS page frames present (only
with /XD)
16h
WORD
segment of one-sector workspace buffer allocated
in main memory
if BUFFERS/XS or /XD options in effect, possibly
to avoid DMA
into EMS
18h
WORD
EMS handle for buffers, zero if not in EMS
1Ah
WORD
EMS physical page number used for buffers (usually
255)
1Ch
WORD
??? appears always to be 0001h
1Eh
WORD
segment of EMS physical page frame
20h
WORD
??? appears always to be zero
22h
BYTE
00h if /XS, 01h if /XD, FFh if BUFFERS not in EMS
Format of DOS 4.x disk buffer hash chain head (array, one entry
per chain):
Offset Size
Description
00h
WORD
EMS logical page number in which chain is
resident, -1 if not
in EMS
02h
DWORD
pointer to least recently used buffer header. All
buffers on
this chain are in the same segment.
06h
BYTE
number of dirty buffers on this chain
07h
BYTE
reserved (00h)

Notes: buffered disk sectors are assigned to chain N where N is

the sector's
address modulo NDBCH, 0 <= N <= NDBCH-1
each chain resides completely within one EMS page
this structure is in main memory even if buffers are in
EMS
Format of DOS 4.0-6.0 disk buffer:
Offset Size
Description
00h
WORD
forward ptr, offset only, to next least recently
used buffer
02h
WORD
backward ptr, offset only
04h
BYTE
drive (0=A,1=B, etc) if bit 7 clear
SFT index if bit 7 set
FFh if not in use
05h
BYTE
buffer flags
bit 7: remote buffer
bit 6: buffer dirty
bit 5: buffer has been referenced (reserved in DOS
5+)
bit 4: search data buffer (only valid if remote
buffer)
bit 3: sector in data area
bit 2: sector in a directory, either root or
subdirectory
bit 1: sector in FAT
bit 0: reserved
06h
DWORD
logical sector number (local buffers only)
0Ah
BYTE
number of copies to write
for FAT sectors, same as number of FATs
for data and directory sectors, usually 1
0Bh
WORD
offset in sectors between copies to write for FAT
sectors
0Dh
DWORD
pointer to DOS Drive Parameter Block (see AH=32h)
11h
WORD
size of data in buffer if remote buffer (see flags
above)
13h
BYTE
reserved (padding)
14h
buffered data
Note:
for DOS 4.x, all buffered sectors which have the same hash
value
(computed as the sum of high and low words of the
logical sector
number divided by the number of disk buffer chains) are
on the same
doubly-linked circular chain; for DOS 5+, only a single
circular
chain exists.
the links consist of offset addresses only, the segment
being the same
for all buffers in the chain.
Format of DOS 5.0-6.0 disk buffer info:
Offset Size
Description
00h
DWORD
pointer to least-recently-used buffer header (may
be in HMA)
(see above)
04h
WORD
number of dirty disk buffers

06h
DWORD
0Ah
WORD
BUFFERS=x,y)
0Ch
BYTE
0Dh
DWORD
memory
11h 3 BYTEs
14h
WORD
16h
BYTE
17h
BYTE
during EXEC
18h
BYTE
off
19h
BYTE
load
1Ah
WORD
21/AX=4B05h)
1Ch
BYTE
chain
1Dh
WORD
being EXECed
1Fh
WORD
FFFFh if DOS

pointer to lookahead buffer, zero if not present

number of lookahead sectors, else zero (the y in
buffer location
00h base memory, no workspace buffer
01h HMA, workspace buffer in base memory
pointer to one-segment workspace buffer in base
unused
???
flag: INT 24 fail while making an I/O status call
temp storage for user memory allocation strategy
counter: number of INT 21 calls for which A20 is
bit flags
bit 0: ???
bit 1: SWITCHES=/W specified in CONFIG.SYS (don't
WINA20.SYS when MS Windows 3.0 starts)
bit 2: in EXEC state (INT 21/AX=4B05h)
offset of unpack code start (used only during INT
bit 0 set iff UMB MCB chain linked to normal MCB
minimum paragraphs of memory required by program
segment of first MCB in upper memory blocks or

memory chain in base 640K only (first UMB MCB

usually at 9FFFh,
locking out video memory with a DOS-owned memory
block)
21h
WORD
paragraph from which to start scanning during
memory allocation
Format of IFS driver list:
Offset Size
Description
00h
DWORD
pointer to next driver header
04h 8 BYTEs
IFS driver name (blank padded), as used by FILESYS
command
0Ch 4 BYTEs
???
10h
DWORD
pointer to IFS utility function entry point (see
below)
call with ES:BX -> IFS request (see below)
14h
WORD
offset in header's segment of driver entry point
???
Call IFS utility function entry point with:
AH = 20h miscellaneous functions
AL = 00h get date
Return: CX = year
DH = month
DL = day
AL = 01h get process ID and computer ID
Return: BX = current PSP segment
DX = active network machine number

AL = 05h get file system info

ES:DI -> 16-byte info buffer
Return: buffer filled
Offset Size
Description
00h 2 BYTEs
unused
02h
WORD
number of SFTs (actually
counts only
arrays)
entries

supported

02h

AH
AH
AH
AH

the first two file table

04h

WORD

06h
08h
0Eh

WORD
6 BYTEs
WORD

number of FCB table

number of proctected FCBs
unused
largest sector size

AL = 06h get machine name

ES:DI -> 18-byte buffer for name
Return: buffer filled with name starting at offset
AL = 08h get sharing retry count
Return: BX = sharing retry count
AL = other
Return: CF set
= 21h get redirection state
BH = type (03h disk, 04h printer)
Return: BH = state (00h off, 01h on)
= 22h ??? some sort of time calculation
AL = 00h ???
nonzero ???
= 23h ??? some sort of time calculation
= 24h compare filenames
DS:SI -> first ASCIZ filename
ES:DI -> second ASCIZ filename
Return: ZF set if files are same ignoring case and /

vs \

AH = 25h normalize filename

DS:SI -> ASCIZ filename
ES:DI -> buffer for result
Return: filename uppercased, forward slashes changed
to backslashes
AH = 26h get DOS stack
Return: DS:SI -> top of stack
CX = size of stack in bytes
AH = 27h increment InDOS flag
AH = 28h decrement InDOS flag
Note:
IFS drivers which do not wish to implement functions 20h
or 24h-28h may
pass them on to the default handler pointed at by
[LoL+37h]
Format of IFS request block:
Offset Size
Description
00h
WORD
total size in bytes of request
02h
BYTE
class of request
02h ???
03h redirection
04h ???

05h file access

06h convert error code to string
07h ???
03h
WORD
returned DOS error code
05h
BYTE
IFS driver exit status
00h success
01h ???
02h ???
03h ???
04h ???
FFh internal failure
06h 16 BYTEs
???
---request class 02h--16h
BYTE
function code
04h ???
17h
BYTE
unused???
18h
DWORD
pointer to ???
1Ch
DWORD
pointer to ???
20h 2 BYTEs
???
---request class 03h--16h
BYTE
function code
17h
BYTE
???
18h
DWORD
pointer to ???
1Ch
DWORD
pointer to ???
22h
WORD
returned ???
24h
WORD
returned ???
26h
WORD
returned ???
28h
BYTE
returned ???
29h
BYTE
unused???
---request class 04h--16h
DWORD
pointer to ???
1Ah
DWORD
pointer to ???
---request class 05h--16h
BYTE
function code
01h flush disk buffers
02h get disk space
03h MKDIR
04h RMDIR
05h CHDIR
06h delete file
07h rename file
08h search directory
09h file open/create
0Ah LSEEK
0Bh read from file
0Ch write to file
0Dh lock region of file
0Eh commit/close file
0Fh get/set file attributes
10h printer control
11h ???
12h process termination
13h ???
---class 05h function 01h--17h 7 BYTEs
???
1Eh
DWORD
pointer to ???
22h 4 BYTEs
???

26h
BYTE
???
27h
BYTE
???
---class 05h function 02h--17h 7 BYTEs
???
1Eh
DWORD
pointer to ???
22h 4 BYTEs
???
26h
WORD
returned total clusters
28h
WORD
returned sectors per cluster
2Ah
WORD
returned bytes per sector
2Ch
WORD
returned available clusters
2Eh
BYTE
returned ???
2Fh
BYTE
???
---class 05h functions 03h,04h,05h--17h 7 BYTEs
???
1Eh
DWORD
pointer to ???
22h 4 BYTEs
???
26h
DWORD
pointer to directory name
---class 05h function 06h--17h 7 BYTEs
???
1Eh
DWORD
pointer to ???
22h 4 BYTEs
???
26h
WORD
attribute mask
28h
DWORD
pointer to filename
---class 05h function 07h--17h 7 BYTEs
???
1Eh
DWORD
pointer to ???
22h 4 BYTEs
???
26h
WORD
attribute mask
28h
DWORD
pointer to source filespec
2Ch
DWORD
pointer to destination filespec
---class 05h function 08h--17h 7 BYTEs
???
1Eh
DWORD
pointer to ???
22h 4 BYTEs
???
26h
BYTE
00h FINDFIRST
01h FINDNEXT
28h
DWORD
pointer to FindFirst search data + 01h if

FINDNEXT

2Ch
WORD
search attribute if FINDFIRST
2Eh
DWORD
pointer to filespec if FINDFIRST
---class 05h function 09h--17h 7 BYTEs
???
1Eh
DWORD
pointer to ???
22h
DWORD
pointer to IFS open file structure (see
below)

26h
whether or
28h
2Ah
2Eh
32h
36h

WORD
WORD
4 BYTEs
DWORD
4 BYTEs
WORD

???

\ together, specify open vs. create,

??? / not to truncate

???
pointer to filename
???
file attributes on call
returned ???
38h
WORD
returned ???
---class 05h function 0Ah--17h 7 BYTEs
???
1Eh
DWORD
pointer to ???

below)

below)

below)

22h

DWORD

26h
28h

BYTE
DWORD

28h

WORD

pointer to IFS open file structure (see

seek type (02h = from end)

offset on call
returned new absolute position
---class 05h functions 0Bh,0Ch--17h 7 BYTEs
???
1Eh
DWORD
pointer to ???
22h
DWORD
pointer to IFS open file structure (see
number of bytes to transfer
returned bytes actually transferred
2Ah
DWORD
transfer address
---class 05h function 0Dh--17h 7 BYTEs
???
1Eh
DWORD
pointer to ???
22h
DWORD
pointer to IFS open file structure (see
26h
BYTE
file handle???
27h
BYTE
unused???
28h
WORD
???
2Ah
WORD
???
2Ch
WORD
???
2Eh
WORD
???
---class 05h function 0Eh--17h 7 BYTEs
???
1Eh
DWORD
pointer to ???
22h
DWORD
pointer to IFS open file structure (see

below)

below)

26h

BYTE

00h commit file

01h close file
27h
BYTE
unused???
---class 05h function 0Fh--17h 7 BYTEs
???
1Eh
DWORD
pointer to ???
22h 4 BYTEs
???
26h
BYTE
02h GET attributes
03h PUT attributes
27h
BYTE
unused???
28h 12 BYTEs
???
34h
WORD
search attributes???
36h
DWORD
pointer to filename
3Ah
WORD
(GET) returned ???
3Ch
WORD
(GET) returned ???
3Eh
WORD
(GET) returned ???
40h
WORD
(GET) returned ???
42h
WORD
(PUT) new attributes
(GET) returned attributes
---class 05h function 10h--17h 7 BYTEs
???
1Eh
DWORD
pointer to ???
22h
DWORD
pointer to IFS open file structure (see
26h
28h
2Ch
2Eh

WORD
DWORD
WORD
BYTE

???
pointer to ???
???
???

2Fh

BYTE

subfunction
01h get printer setup
03h ???
04h ???
05h ???
06h ???
07h ???
21h set printer setup
---class 05h function 11h--17h 7 BYTEs
???
1Eh
DWORD
pointer to ???
22h
DWORD
pointer to IFS open file structure (see
below)

26h
BYTE
subfunction
27h
BYTE
unused???
28h
WORD
???
2Ah
WORD
???
2Ch
WORD
???
2Eh
BYTE
???
2Fh
BYTE
???
---class 05h function 12h--17h 15 BYTEs
unused???
26h
WORD
PSP segment
28h
BYTE
type of process termination
29h
BYTE
unused???
---class 05h function 13h--17h 15 BYTEs
unused???
26h
WORD
PSP segment
---request class 06h--16h
DWORD
returned pointer to string corresponding to error
code at 03h
1Ah
BYTE
returned ???
1Bh
BYTE
unused
---request class 07h--16h
DWORD
pointer to IFS open file structure (see below)
1Ah
BYTE
???
1Bh
BYTE
unused???
Format of IFS open file structure:
Offset Size
Description
00h
WORD
???
02h
WORD
device info word
04h
WORD
file open mode
06h
WORD
???
08h
WORD
file attributes
0Ah
WORD
owner's network machine number
0Ch
WORD
owner's PSP segment
0Eh
DWORD
file size
12h
DWORD
current offset in file
16h
WORD
file time
18h
WORD
file date
1Ah 11 BYTEs
filename in FCB format
25h
WORD
???
27h
WORD
hash value of SFT address
(low word of linear address + segment&F000h)
29h 3 WORDs
network info from SFT
2Fh
WORD
???

Format of one item in DOS 4+ list of special program names:

Offset Size
Description
00h
BYTE
length of name (00h = end of list)
01h N BYTEs
name in format name.ext
N
2 BYTEs
DOS version to return for program (major,minor)
(see AH=30h,INT 2F/AX=122Fh)
---DOS 4 only--N+2
BYTE
number of times to return fake version number (FFh
= always)
Note:
if the name of the executable for the program making the
DOS "get
version" call matches one of the names in this list, DOS
returns the
specified version rather than the true version number

--------D2158--------------------------------------------------INT 21 - DOS 3+ - GET OR SET MEMORY ALLOCATION STRATEGY

memory

AH = 58h
AL = subfunction
00h get allocation strategy
Return: AX = current strategy
00h low memory first fit
01h low memory best fit
02h low memory last fit
---DOS 5+ --40h high memory first fit
41h high memory best fit
42h high memory last fit
80h first fit, try high then low

81h best fit, try high then low memory

82h last fit, try high then low memory
01h set allocation strategy
BL = new allocation strategy (see above)
BH = 00h (DOS 5+)
Return: CF clear if successful
CF set on error
AX = error code (01h) (see AH=59h)
Notes: the Set subfunction accepts any value in BL for DOS 3.x
and 4.x;
2 or greater means last fit
the Get subfunction returns the last value set
setting an allocation strategy involving high memory does
not
automatically link in the UMB memory chain; this must be
done
explicitly with AX=5803h in order to actually allocate
high memory
a program which changes the allocation strategy should
restore it
before terminating
Toshiba MS-DOS 2.11 supports subfunctions 00h and 01h
DR-DOS 3.41 reportedly reverses subfunctions 00h and 01h
SeeAlso: AH=48h,AH=49h,AH=4Ah,INT 2F/AX=4310h,INT 67/AH=3Fh

--------D2158--------------------------------------------------INT 21 - DOS 5+ - GET OR SET UMB LINK STATE

AH = 58h
AL = subfunction
02h get UMB link state
Return: AL = 00h UMBs not part of DOS memory chain
= 01h UMBs in DOS memory chain
03h set UMB link state
BX = 0000h remove UMBs from DOS memory chain
= 0001h add UMBs to DOS memory chain
Return: CF clear if successful
CF set on error
AX = error code (01h) (see AH=59h)
Note:
a program which changes the UMB link state should restore
it before
terminating

--------D-2159-BX0000-------------------------------------------INT 21 - DOS 3+ - GET EXTENDED ERROR INFORMATION

AH = 59h
BX = 0000h
Return: AX = extended error code (see below)
BH = error class (see below)
BL = recommended action (see below)
CH = error locus (see below)
ES:DI may be pointer (see error code list below)
CL, DX, SI, BP, and DS destroyed
Notes: functions available under DOS 2.x map the true DOS 3+
error code into
one supported under DOS 2.x
you should call this function to retrieve the true error
code when an
FCB or DOS 2.x call returns an error
under DR-DOS 5.0, this function does not use any of the
DOS-internal
stacks and may thus be called at any time
SeeAlso: AH=59h/BX=0001h,AX=5D0Ah,INT 2F/AX=122Dh
Values for
00h (0)
01h (1)
02h (2)
03h (3)
04h (4)
05h (5)
06h (6)
07h (7)
08h (8)
09h (9)
0Ah (10)
0Bh (11)
0Ch (12)
0Dh (13)

extended error code:

no error
function number invalid
file not found
path not found
too many open files (no handles available)
access denied
invalid handle
memory control block destroyed
insufficient memory
memory block address invalid
environment invalid (usually >32K in length)
format invalid
access code invalid
data invalid

0Eh (14) reserved

0Fh (15) invalid drive
10h (16) attempted to remove current directory
11h (17) not same device
12h (18) no more files
---DOS 3+--13h (19) disk write-protected
14h (20) unknown unit
15h (21) drive not ready
16h (22) unknown command
17h (23) data error (CRC)
18h (24) bad request structure length
19h (25) seek error
1Ah (26) unknown media type (non-DOS disk)
1Bh (27) sector not found
1Ch (28) printer out of paper
1Dh (29) write fault
1Eh (30) read fault
1Fh (31) general failure
20h (32) sharing violation
21h (33) lock violation
22h (34) disk change invalid
ES:DI -> ASCIZ volume label of required disk
23h (35) FCB unavailable
24h (36) sharing buffer overflow
25h (37) (DOS 4+) code page mismatch
26h (38) (DOS 4+) cannot complete file operation (out of input)
27h (39) (DOS 4+) insufficient disk space
28h-31h
reserved
32h (50) network request not supported
33h (51) remote computer not listening
34h (52) duplicate name on network
35h (53) network name not found
36h (54) network busy
37h (55) network device no longer exists
38h (56) network BIOS command limit exceeded
39h (57) network adapter hardware error
3Ah (58) incorrect response from network
3Bh (59) unexpected network error
3Ch (60) incompatible remote adapter
3Dh (61) print queue full
3Eh (62) queue not full
3Fh (63) not enough space to print file
40h (64) network name was deleted
41h (65) network: Access denied
42h (66) network device type incorrect
43h (67) network name not found
44h (68) network name limit exceeded
45h (69) network BIOS session limit exceeded
46h (70) temporarily paused
47h (71) network request not accepted
48h (72) network print/disk redirection paused
49h (73) network software not installed
(LANtastic) invalid network version
4Ah (74) unexpected adapter close
(LANtastic) account expired
4Bh (75) (LANtastic) password expired

4Ch
4Dh
4Eh
4Fh
50h
51h
52h
53h
54h
55h
56h
57h
58h
59h
5Ah
64h
65h
66h
67h
68h

(76)
(77)
(78)
(79)
(80)
(81)
(82)
(83)
(84)
(85)
(86)
(87)
(88)
(89)
(90)
(100)
(101)
(102)
(103)
(104)

(LANtastic) login attempt invalid at this time

(LANtastic v3+) disk limit exceeded on network node
(LANtastic v3+) not logged in to network node
reserved
file exists
reserved
cannot make directory
fail on INT 24h
(DOS 3.3+) too many redirections
(DOS 3.3+) duplicate redirection
(DOS 3.3+) invalid password
(DOS 3.3+) invalid parameter
(DOS 3.3+) network write fault
(DOS 4+) function not supported on network
(DOS 4+) required system component not installed
(MSCDEX) unknown error
(MSCDEX) not ready
(MSCDEX) EMS memory no longer valid
(MSCDEX) not High Sierra or ISO-9660 format
(MSCDEX) door open

Values for Error Class:

01h
out of resource (storage space or I/O channels)
02h
temporary situation (file or record lock)
03h
authorization (denied access)
04h
internal (system software bug)
05h
hardware failure
06h
system failure (configuration file missing or incorrect)
07h
application program error
08h
not found
09h
bad format
0Ah
locked
0Bh
media error
0Ch
already exists
0Dh
unknown
Values for Suggested Action:
01h
retry
02h
delayed retry
03h
prompt user to reenter input
04h
abort after cleanup
05h
immediate abort
06h
ignore
07h
retry after user intervention
Values for Error Locus:
01h
unknown or not appropriate
02h
block device (disk error)
03h
network related
04h
serial device (timeout)
05h
memory related

--------D215D06------------------------------------------------INT 21 U - DOS 3.0+ internal - GET ADDRESS OF DOS

SWAPPABLE DATA

AREA
AX = 5D06h
Return: CF set on error
AX = error code (see AH=59h)
CF clear if successful
DS:SI -> nonreentrant data area (includes all three
DOS stacks)
(critical error flag is first byte)
CX = size in bytes of area which must be swapped while
in DOS
DX = size in bytes of area which must always be
swapped
Notes: the Critical Error flag is used in conjunction with the
InDOS flag
(see AH=34h) to determine when it is safe to enter DOS
from a TSR
setting CritErr flag allows use of functions 50h/51h from
INT 28h under
DOS 2.x by forcing use of correct stack
swapping the data area allows reentering DOS unless DOS is
in a
critical section delimited by INT 2A/AH=80h and INT
2A/AH=81h,82h
under DOS 4.0, AX=5D0Bh should be used instead of this
function
SHARE and other DOS utilities consult the byte at offset
04h in the
DOS data segment (see INT 2F/AX=1203h) to determine the
SDA format
in use: 00h = DOS 3.x, 01h = DOS 4.0-6.0, other = error.
DR-DOS 3.41+ supports this function, but the SDA format
beyond the
first 18h bytes is completely different from MS-DOS
SeeAlso: AX=5D0Bh,INT 2A/AH=80h,INT 2A/AH=81h,INT 2A/AH=82h
Format of DOS 3.10-3.30 Swappable Data Area:
Offset Size
Description
-34
BYTE
(DOS 3.10+) printer echo flag (00h off, FFh
active)
-31
BYTE
(DOS 3.30) current switch character
-28
BYTE
(DOS 3.30) incremented on each INT 21/AX=5E01h
call
-27 16 BYTEs
(DOS 3.30) machine name set by INT 21/AX=5E01h
-11 5 WORDs
zero-terminated list of offsets which need to be
patched to
enable critical-section calls (see INT 2A/AH=80h)
-1
BYTE
unused padding
---start of actual SDA--00h
BYTE
critical error flag ("ErrorMode")
01h
BYTE
InDOS flag (count of active INT 21 calls)
02h
BYTE
drive on which current critical error occurred, or
FFh
(DR-DOS sets to drive number during INT 24, 00h
otherwise)
03h
BYTE
locus of last error
04h
WORD
extended error code of last error

06h
BYTE
07h
BYTE
08h
DWORD
0Ch
DWORD
10h
WORD
12h
WORD
14h
WORD
after reading

suggested action for last error

class of last error
ES:DI pointer for last error
current DTA
current PSP
stores SP across an INT 23
return code from last process termination (zerod

with AH=4Dh)
16h
BYTE
current drive
17h
BYTE
extended break flag
---remainder need only be swapped if in DOS--18h
WORD
value of AX on call to INT 21
1Ah
WORD
PSP segment for sharing/network
1Ch
WORD
network machine number for sharing/network (0000h
= us)
1Eh
WORD
first usable memory block found when allocating
memory
20h
WORD
best usable memory block found when allocating
memory
22h
WORD
last usable memory block found when allocating
memory
24h
WORD
memory size in paragraphs (used only during
initialization)
26h
WORD
last entry checked during directory search
28h
BYTE
flag: INT 24 returned Fail
29h
BYTE
flags: allowable INT 24 actions (passed to INT 24
in AH)
2Ah
BYTE
directory flag (00h directory, 01h file)
2Bh
BYTE
flag: FFh if Ctrl-Break termination, 00h otherwise
2Ch
BYTE
flag: allow embedded blanks in FCB
2Dh
BYTE
padding (unused)
2Eh
BYTE
day of month
2Fh
BYTE
month
30h
WORD
year - 1980
32h
WORD
number of days since 1-1-1980
34h
BYTE
day of week (0 = Sunday)
35h
BYTE
flag: console swapped during read from device
36h
BYTE
flag: safe to call INT 28 if nonzero
37h
BYTE
flag: if nonzero, INT 24 Abort turned into INT 24
Fail
(set only during process termination)
38h 26 BYTEs
device driver request header (see INT 2F/AX=0802h)
52h
DWORD
pointer to device driver entry point (used in
calling driver)
56h 22 BYTEs
device driver request header for I/O calls
6Ch 14 BYTEs
device driver request header for disk status check
7Ah
DWORD
pointer to device I/O buffer???
7Eh
WORD
???
80h
WORD
???
82h
BYTE
type of PSP copy (00h=simple for INT 21/AH=26h,
FFh=make child)
83h
BYTE
padding (unused)
84h 3 BYTEs
24-bit user number (see AH=30h)
87h
BYTE
OEM number (see AH=30h)
88h
WORD
offset to error code conversion table for INT
25/INT 26

8Ah 6 BYTEs
90h
BYTE
91h
BYTE
92h 128 BYTEs
112h 128 BYTEs
192h 21 BYTEs
1A7h 32 BYTEs
1C7h 81 BYTEs
being accessed
218h 11 BYTEs
223h
BYTE
224h 11 BYTEs
format)
22Fh
BYTE
230h
BYTE
231h
WORD
233h 5 BYTEs
238h
BYTE
239h
BYTE
23Ah
BYTE
23Bh
BYTE
23Ch
BYTE
23Dh
BYTE
found
23Eh
BYTE
together)
23Fh
BYTE
AX=5D00h)
240h
BYTE
241h
BYTE
242h
BYTE
243h
BYTE
244h
BYTE
245h
BYTE
246h
BYTE
247h
BYTE
file/dir if FFh
248h
BYTE
249h
BYTE
24Ah
BYTE
24Bh
BYTE
file's name

CLOCK$ transfer record (see AH=52h)

device I/O buffer for single-byte I/O functions
padding??? (unused)
buffer for filename
buffer for filename
findfirst/findnext search data block (see AH=4Eh)
directory entry for found file (see AH=11h)
copy of current directory structure for drive
FCB-format filename for device name comparison
terminating NUL for above filename
wildcard destination specification for rename (FCB
terminating NUL for above spec
???
destination file/directory starting sector
???
extended FCB file attribute
type of FCB (00h regular, FFh extended)
directory search attributes
file open/access mode
file found/delete flag
bit 0: file found
bit 4: file deleted
flag: device name found on rename, or file not
splice flag (file name and directory name
flag indicating how DOS function was invoked
(00h = direct INT 20/INT 21, FFh = server call
sector position within cluster
flag: translate sector/cluster (00h no, 01h yes)
flag: 00h if read, 01h if write
current working drive number
cluster factor
flag: cluster split mode
line edit (AH=0Ah) insert mode flag (nonzero = on)
canonicalized filename referred to existing
volume ID flag
type of process termination (00h-03h) (see AH=4Dh)
file create flag (00h = no)
value with which to replace first byte of deleted

(normally E5h, but 00h as described under INT

21/AH=13h)
24Ch
DWORD
pointer to Drive Parameter Block for critical
error invocation
temp: used during process termination
250h
DWORD
pointer to stack frame containing user registers
on INT 21
254h
WORD
stores SP across INT 24
256h
DWORD
pointer to DOS Drive Parameter Block for ???
25Ah
WORD
saving partial cluster number
25Ch
WORD
temp: sector of work current cluster

25Eh
WORD
referenced)
260h
WORD
262h
BYTE
263h
BYTE
264h
DWORD
268h
DWORD
26Ch
DWORD
being accessed
270h
DWORD
274h
WORD
refer
276h
WORD
278h
DWORD
(see AH=26h)
27Ch
WORD
27Eh
WORD
280h
WORD
282h
WORD
284h
WORD
286h
WORD
288h
WORD
28Ah
WORD
28Ch
WORD
28Eh
WORD
290h
WORD
292h
DWORD
296h
DWORD
29Ah
WORD
29Ch
WORD
29Eh
WORD
2A0h
WORD
2A2h
DWORD
2A6h
DWORD
2AAh
DWORD
2AEh
WORD
2B0h
WORD
2B2h
WORD
registers
2B4h
DWORD
reentered

high part of cluster number (only low byte

??? temp
Media ID byte returned by AH=1Bh,1Ch
padding (unused)
pointer to device header
pointer to current SFT
pointer to current directory structure for drive
pointer to caller's FCB
number of SFT to which file being opened will
temporary storage for file handle
pointer to a JFT entry in process handle table
offset in DOS DS of first filename argument
offset in DOS DS of second filename argument
offset of last component in pathname or FFFFh
offset of transfer address to add
last relative cluster within file being accessed
temp: absolute cluster number being accessed
directory sector number
??? current cluster number
??? current offset in file DIV bytes per sector
current sector number
current byte offset within sector
current offset in file
temp: file byte count
temp: file byte count
free file cluster entry
last file cluster entry
next file cluster number
number of bytes appended to file
pointer to current work disk buffer
pointer to working SFT
used by INT 21 dispatcher to store caller's BX
used by INT 21 dispatcher to store caller's DS
temporary storage while saving/restoring caller's
pointer to prev call frame (offset 250h) if INT 21

also switched to for duration of INT 24

2B8h 21 BYTEs
FindFirst search data for source file(s) of a
rename operation
(see AH=4Eh)
2CDh 32 BYTEs
directory entry for file being renamed (see AH=11h
for format)
2EDh 331 BYTEs critical error stack
403h 35 BYTEs scratch SFT
438h 384 BYTEs disk stack (functions greater than 0Ch, INT 25,INT
26)
5B8h 384 BYTEs character I/O stack (functions 01h through 0Ch)
---DOS 3.2,3.3x only--738h
BYTE
device driver lookahead flag (usually printer)
(see AH=64h)
739h
BYTE
volume change flag
73Ah
BYTE
flag: virtual open

73Bh

BYTE

???

--------D215D0A------------------------------------------------INT 21 - DOS 3.1+ - SET EXTENDED ERROR INFORMATION

AX = 5D0Ah
DS:DX -> 11-word DOS parameter list (see AX=5D00h)
Return: nothing. next call to AH=59h will return values from
fields AX,BX,CX,
DX,DI, and ES in corresponding registers
Notes: documented for DOS 5+, but undocumented in earlier
versions
the MS-DOS Programmer's Reference incorrectly states that
this call was
introduced in DOS 4, and fails to mention that the ERROR
structure
passed to this function is a DOS parameter list.
BUG:
DR-DOS 3.41 and 5.0 read the value for ES from the DS
field of the DPL;
fortunately, MS-DOS ignores the DS field, allowing a
generic routine
which sets both DS and ES fields to the same value
SeeAlso: AH=59h

--------D215D0B------------------------------------------------INT 21 OU - DOS 4.x only internal - GET DOS SWAPPABLE

DATA AREAS

AX = 5D0Bh
Return: CF set on error
AX = error code (see AH=59h)
CF clear if successful
DS:SI -> swappable data area list (see below)
Notes: copying and restoring the swappable data areas allows DOS
to be
reentered unless it is in a critical section delimited
by calls to
INT 2A/AH=80h and INT 2A/AH=81h,82h
SHARE and other DOS utilities consult the byte at offset
04h in the
DOS data segment (see INT 2F/AX=1203h) to determine the
SDA format
in use: 00h = DOS 3.x, 01h = DOS 4.0-6.0, other = error.
DOS 5+ use the SDA format listed below, but revert back to
the DOS 3.x
call for finding the SDA (see AX=5D06h)
SeeAlso: AX=5D06h,INT 2A/AH=80h,INT 2A/AH=81h,INT 2A/AH=82h,INT
2F/AX=1203h
Format of DOS 4.x swappable data area list:
Offset Size
Description
00h
WORD
count of data areas
02h N BYTEs
"count" copies of data area record
Offset Size
Description
00h
DWORD
address

04h
if swap in DOS

WORD

length and type

bit 15 set if swap always, clear
bits 14-0: length in bytes

Format of DOS 4.0-6.0 swappable data area:

Offset Size
Description
-34
BYTE
printer echo flag (00h off, FFh active)
-31
BYTE
current switch character (ignored by DOS 5+)
-28
BYTE
incremented on each INT 21/AX=5E01h call
-27 16 BYTEs
machine name set by INT 21/AX=5E01h
-11 5 WORDs
zero-terminated list of offsets which need to be
patched to
enable critical-section calls (see INT 2A/AH=80h)
(all offsets are 0D0Ch, but this list is still
present for
DOS 3.x compatibility)
-1
BYTE
unused padding
---start of actual SDA--00h
BYTE
critical error flag ("ErrorMode")
01h
BYTE
InDOS flag (count of active INT 21 calls)
02h
BYTE
drive on which current critical error occurred or
FFh
03h
BYTE
locus of last error
04h
WORD
extended error code of last error
06h
BYTE
suggested action for last error
07h
BYTE
class of last error
08h
DWORD
ES:DI pointer for last error
0Ch
DWORD
current DTA
10h
WORD
current PSP
12h
WORD
stores SP across an INT 23
14h
WORD
return code from last process termination (zerod
after reading
with AH=4Dh)
16h
BYTE
current drive
17h
BYTE
extended break flag
18h
BYTE
flag: code page switching
19h
BYTE
flag: copy of previous byte in case of INT 24
Abort
---remainder need only be swapped if in DOS--1Ah
WORD
value of AX on call to INT 21
1Ch
WORD
PSP segment for sharing/network
1Eh
WORD
network machine number for sharing/network (0000h
= us)
20h
WORD
first usable memory block found when allocating
memory
22h
WORD
best usable memory block found when allocating
memory
24h
WORD
last usable memory block found when allocating
memory
26h
WORD
memory size in paragraphs (used only during
initialization)
28h
WORD
last entry checked during directory search
2Ah
BYTE
flag: nonzero if INT 24 Fail
2Bh
BYTE
flags: allowable INT 24 responses (passed to INT
24 in AH)
2Ch
BYTE
flag: do not set directory if nonzero

2Dh
BYTE
2Eh
BYTE
2Fh
BYTE
30h
BYTE
31h
BYTE
32h
WORD
34h
WORD
36h
BYTE
37h
BYTE
38h
BYTE
39h
BYTE
Abort into Fail
3Ah 30 BYTEs
for
58h
DWORD
calling driver)
5Ch 22 BYTEs
72h 14 BYTEs
80h
DWORD
84h
WORD
86h
WORD
88h
BYTE
FFh=make child)
89h
DWORD
8Dh
DWORD
91h
BYTE
92h 3 BYTEs
95h
BYTE
96h 6 BYTEs
9Ch
BYTE
9Dh
BYTE
9Eh 128 BYTEs
11Eh 128 BYTEs
19Eh 21 BYTEs
1B3h 32 BYTEs
1D3h 88 BYTEs
being accessed
22Bh 11 BYTEs
236h
BYTE
237h 11 BYTEs
format)
242h
BYTE
243h
BYTE
244h
WORD
246h 5 BYTEs
24Bh
BYTE
24Ch
BYTE
24Dh
BYTE
24Eh
BYTE
24Fh
BYTE
250h
BYTE
found
251h
BYTE
together)
252h
BYTE

flag: program aborted by ^C

flag: allow embedded blanks in FCB
padding (unused)
day of month
month
year - 1980
number of days since 1-1-1980
day of week (0 = Sunday)
flag: console swapped during read from device
flag: safe to call INT 28 if nonzero
flag: abort currently in progress, turn INT 24
device driver request header (see INT 2F/AX=0802h)
device calls
pointer to device driver entry point (used in
device driver request header for I/O calls
device driver request header for disk status check
pointer to device I/O buffer
???
??? (0)
type of PSP copy (00h=simple for INT 21/AH=26h,
start offset of file region to lock/unlock
length of file region to lock/unlock
padding (unused)
24-bit user number (see AH=30h)
OEM number (see AH=30h)
CLOCK$ transfer record (see AH=52h)
device I/O buffer for single-byte I/O functions???
padding???
buffer for filename
buffer for filename
findfirst/findnext search data block (see AH=4Eh)
directory entry for found file (see AH=11h)
copy of current directory structure for drive
FCB-format filename for device name comparison
terminating NUL for above filename
wildcard destination specification for rename (FCB
terminating NUL for above spec
???
???
???
extended FCB file attributes
type of FCB (00h regular, FFh extended)
directory search attributes
file open/access mode
??? flag bits
flag: device name found on rename, or file not
splice flag??? (file name and directory name
flag indicating how DOS function was invoked

(00h = direct INT 20/INT 21, FFh = server call

AX=5D00h)
253h
BYTE
???
254h
BYTE
???
255h
BYTE
???
256h
BYTE
???
257h
BYTE
???
258h
BYTE
???
259h
BYTE
???
25Ah
BYTE
canonicalized filename referred to existing
file/dir if FFh
25Bh
BYTE
???
25Ch
BYTE
type of process termination (00h-03h)
25Dh
BYTE
???
25Eh
BYTE
???
25Fh
BYTE
???
260h
DWORD
pointer to Drive Parameter Block for critical
error invocation
264h
DWORD
pointer to stack frame containing user registers
on INT 21
268h
WORD
stores SP???
26Ah
DWORD
pointer to DOS Drive Parameter Block for ???
26Eh
WORD
segment of disk buffer
270h
WORD
???
272h
WORD
???
274h
WORD
???
276h
WORD
???
278h
BYTE
Media ID byte returned by AH=1Bh,1Ch
279h
BYTE
??? (doesn't seem to be referenced)
27Ah
DWORD
pointer to ???
27Eh
DWORD
pointer to current SFT
282h
DWORD
pointer to current directory structure for drive
being accessed
286h
DWORD
pointer to caller's FCB
28Ah
WORD
SFT index to which file being opened will refer
28Ch
WORD
temporary storage for file handle
28Eh
DWORD
pointer to a JFT entry in process handle table
(see AH=26h)
292h
WORD
offset in DOS DS of first filename argument
294h
WORD
offset in DOS DS of second filename argument
296h
WORD
???
298h
WORD
???
29Ah
WORD
???
29Ch
WORD
???
29Eh
WORD
???
2A0h
WORD
???
2A2h
WORD
??? directory cluster number???
2A4h
DWORD
???
2A8h
DWORD
???
2ACh
WORD
???
2AEh
DWORD
offset in file???
2B2h
WORD
???
2B4h
WORD
bytes in partial sector
2B6h
WORD
number of sectors
2B8h
WORD
???
2BAh
WORD
???
2BCh
WORD
???

2BEh
DWORD
2C2h
DWORD
2C6h
DWORD
2CAh
WORD
2CCh
WORD
2CEh
WORD
registers
2D0h
DWORD
reentered

number of bytes appended to file

pointer to ??? disk buffer
pointer to ??? SFT
used by INT 21 dispatcher to store caller's BX
used by INT 21 dispatcher to store caller's DS
temporary storage while saving/restoring caller's
pointer to prev call frame (offset 264h) if INT 21
also switched to for duration of INT 24
open mode/action for INT 21/AX=6C00h
??? (set to 00h by INT 21h dispatcher, 02h when a

2D4h
WORD
2D6h
BYTE
read is

performed, and 01h or 03h by INT 21/AX=6C00h)

2D7h
WORD
??? apparently unused
2D9h
DWORD
stored ES:DI for AX=6C00h
2DDh
WORD
extended file open action code (see AX=6C00h)
2DFh
WORD
extended file open attributes (see AX=6C00h)
2E1h
WORD
extended file open file mode (see AX=6C00h)
2E3h
DWORD
pointer to filename to open (see AX=6C00h)
2E7h
WORD
???
2E9h
WORD
???
2EBh
BYTE
???
2ECh
WORD
stores DS during call to [List-of-Lists + 37h]
2EEh
WORD
???
2F0h
BYTE
???
2F1h
WORD
??? bit flags
2F3h
DWORD
pointer to user-supplied filename
2F7h
DWORD
pointer to ???
2FBh
WORD
stores SS during call to [List-of-Lists + 37h]
2FDh
WORD
stores SP during call to [List-of-Lists + 37h]
2FFh
BYTE
flag, nonzero if stack switched in calling [Listof-Lists+37h]
300h 21 BYTEs
FindFirst search data for source file(s) of a
rename operation
(see AH=4Eh)
315h 32 BYTEs
directory entry for file being renamed (see
AH=11h)
335h 331 BYTEs critical error stack
480h 384 BYTEs disk stack (functions greater than 0Ch, INT 25,INT
26)
600h 384 BYTEs character I/O stack (functions 01h through 0Ch)
780h
BYTE
device driver lookahead flag (usually printer)
(see AH=64h)
781h
BYTE
volume change flag
782h
BYTE
flag: virtual open
783h
BYTE
???
784h
WORD
???
786h
WORD
???
788h
WORD
???
78Ah
WORD
???

--------D2162--------------------------------------------------INT 21 - DOS 3+ - GET CURRENT PSP ADDRESS

AH = 62h

Return: BX = segment of PSP for current process

Notes: under DOS 3+, this function does not use any of the DOSinternal stacks
and may thus be called at any time, even during another
INT 21h call
the current PSP is not necessarily the caller's PSP
identical to the undocumented AH=51h
SeeAlso: AH=50h,AH=51h

--------D22----------------------------------------------------INT 22 - DOS 1+ - PROGRAM TERMINATION ADDRESS

Desc:
this vector specifies the address of the routine which is
to be given
control after a program is terminated; it should never
be called
directly, since it does not point at an interrupt
handler
Notes: this vector is restored from the DWORD at offset 0Ah in
the PSP during
termination, and then a FAR JMP is performed to the
address in INT 22
normally points at the instruction immediately following
INT 21/AH=4Bh
call which loaded the current program
SeeAlso: INT 20,INT 21/AH=00h,INT 21/AH=31h,INT 21/AH=4Ch

--------D23----------------------------------------------------INT 23 - DOS 1+ - CONTROL-C/CONTROL-BREAK HANDLER

---DOS 1.x--Return: AH = 00h abort program
if all registers preserved, restart DOS call
---DOS 2+--CF clear
Return: all registers preserved
return via RETF or RETF 2 with CF set
DOS will abort program with errorlevel 0
else (RETF/RETF 2 with CF clear or IRET)
interrupted DOS call is restarted
Notes: this interrupt is invoked whenever DOS detects a ^C or
^Break; it
should never be called directly
MS-DOS 1.25 also invokes INT 23 on a divide overflow (INT
00)
DOS remembers the stack pointer before calling INT 23, and
if it is
not the same on return, pops and discards the top word;
this is what
permits a return with RETF as well as IRET or RETF 2
any DOS call may safely be made within the INT 23 handler,
although
the handler must check for a recursive invocation if it
does
call DOS

SeeAlso: INT 1B

--------D24----------------------------------------------------INT 24 - DOS 1+ - CRITICAL ERROR HANDLER

Note:
invoked when a critical (usually hardware) error is
encountered; should
never be called directly
SeeAlso: INT 21/AH=95h

Critical error handler is invoked with:

AH = type and processing flags
bit 7 clear = disk I/O error
set
= -- if block device, bad FAT image in
memory
-- if char device, error code in DI
bit 6 unused
bit 5 = 1 if Ignore allowed, 0 if not (DOS 3+)
bit 4 = 1 if Retry allowed, 0 if not (DOS 3+)
bit 3 = 1 if Fail allowed, 0 if not (DOS 3+)
bit 2 \ disk area of error 00 = DOS area 01 = FAT
bit 1 /
10 = root dir 11 = data
area
bit 0 = 1 if write, 0 if read
AL = drive number if AH bit 7 clear
BP:SI -> device driver header (BP:[SI+4] bit 15 set if
char device)
DI low byte contains error code if AH bit 7 set
00h write-protection violation attempted
01h unknown unit for driver
02h drive not ready
03h unknown command given to driver
04h data error (bad CRC)
05h bad device driver request structure length
06h seek error
07h unknown media type
08h sector not found
09h printer out of paper
0Ah write fault
0Bh read fault
0Ch general failure
0Dh (DOS 3+) sharing violation
0Eh (DOS 3+) lock violation
0Fh invalid disk change
10h (DOS 3+) FCB unavailable
11h (DOS 3+) sharing buffer overflow
12h (DOS 4+) code page mismatch
13h (DOS 4+) out of input
14h (DOS 4+) insufficient disk space
STACK: DWORD
return address for INT 24 call
WORD
flags pushed by INT 24
WORD
original AX on entry to INT 21
WORD
BX
WORD
CX
WORD
DX
WORD
SI

WORD
DI
WORD
BP
WORD
DS
WORD
ES
DWORD
return address for INT 21 call
WORD
flags pushed by INT 21
Handler must return:
AL = action code
00h ignore error and continue processing request
01h retry operation
02h terminate program through the equivalent of INT
21/AH=4Ch
(INT 20h for DOS 1.x)
03h fail system call in progress
SS,SP,DS,ES,BX,CX,DX preserved
Notes: the only DOS calls the handler may make are INT 21/AH=01h0Ch,30h,59h
if the handler returns to the application by popping the
stack, DOS
will be in an unstable state until the first call with
AH > 0Ch
for DOS 3.1+, IGNORE (AL=00h) is turned into FAIL (AL=03h)
on network
critical errors
if IGNORE specified but not allowed, it is turned into
FAIL
if RETRY specified but not allowed, it is turned into FAIL
if FAIL specified but not allowed, it is turned into ABORT
(DOS 3+) if a critical error occurs inside the critical
error handler,
the DOS call is automatically failed

--------D25----------------------------------------------------INT 25 - DOS 1+ - ABSOLUTE DISK READ (except partitions

> 32M)
AL = drive number (00h = A:, 01h = B:, etc)
CX = number of sectors to read
DX = starting logical sector number (0000h - highest
sector on drive)
DS:BX -> buffer for data
Return: CF clear if successful
CF set on error
AH = status
80h device failed to respond (timeout)
40h seek operation failed
20h controller failed
10h data error (bad CRC)
08h DMA failure
04h requested sector not found
03h write-protected disk (INT 26 only)
02h bad address mark
01h bad command
AL = error code (same as passed to INT 24 in DI)
AX = 0207h if more than 64K sectors on drive -- use
new-style call

Notes:
caller

may destroy all other registers except segment registers

original flags are left on stack, and must be popped by

this call bypasses the DOS filesystem

examination of CPWIN386.CPL indicates that if this call
fails with
error 0408h on an old-style (<32M) call, one should
retry the
call with the high bit of the drive number in AL set
BUGS:
DOS 3.1 through 3.3 set the word at ES:[BP+1Eh] to FFFFh
if AL is an
invalid drive number
DR-DOS 3.41 will return with a jump instead of RETF,
leaving the
wrong number of bytes on the stack; use the hugepartition version
(INT 25/CX=FFFFh) for all partition sizes under DR-DOS
3.41
SeeAlso: INT 13/AH=02h,INT 25/CX=FFFFh,INT 26

--------D-25---CXFFFF-------------------------------------------INT 25 - DOS 3.31+ - ABSOLUTE DISK READ (>32M hard-disk

partition)
CX = FFFFh
AL = drive number (0=A, 1=B, etc)
DS:BX -> disk read packet (see below)
Return: same as above
Notes: partition is potentially >32M (and requires this form of
the call) if
bit 1 of device attribute word in device driver is set
original flags are left on stack, and must be removed by
caller
this call bypasses the DOS filesystem
SeeAlso: INT 13/AH=02h,INT 25,INT 26/CX=FFFFh
Format of disk read packet:
Offset Size
Description
00h
DWORD
sector number
04h
WORD
number of sectors to read
06h
DWORD
transfer address

--------D26----------------------------------------------------INT 26 - DOS 1+ - ABSOLUTE DISK WRITE (except

partitions > 32M)
AL = drive number (00h = A:, 01h = B:, etc)
CX = number of sectors to write
DX = starting logical sector number (0000h - highest
sector on drive)
DS:BX -> data to write
Return: CF clear if successful
CF set on error
AH = status
80h device failed to respond (timeout)
40h seek operation failed

20h controller failed

10h data error (bad CRC)
08h DMA failure
04h requested sector not found
03h write-protected disk (INT 26 only)
02h bad address mark
01h bad command
AL = error code (same as passed to INT 24 in DI)
AX = 0207h if more than 64K sectors on drive -- use
new-style call
may destroy all other registers except segment registers
Notes: original flags are left on stack, and must be popped by
caller
this call bypasses the DOS filesystem, though DOS 5+
invalidates any
disk buffers referencing sectors which are written with
this call
examination of CPWIN386.CPL indicates that if this call
fails with
error 0408h on an old-style (<32M) call, one should
retry the
call with the high bit of the drive number in AL set
BUGS:
DOS 3.1 through 3.3 set the word at ES:[BP+1Eh] to FFFFh
if AL is an
invalid drive number
DR-DOS 3.41 will return with a jump instead of RETF,
leaving the
wrong number of bytes on the stack; use the hugepartition version
(INT 26/CX=FFFFh) for all partition sizes under DR-DOS
3.41
SeeAlso: INT 13/AH=03h,INT 25,INT 26/CX=FFFFh

--------D-26---CXFFFF-------------------------------------------INT 26 - DOS 3.31+ - ABSOLUTE DISK WRITE (>32M harddisk partition)

CX = FFFFh
AL = drive number (0=A, 1=B, etc)
DS:BX -> disk write packet (see below)
Return: same as above
Notes: partition is potentially >32M (and requires this form of
the call) if
bit 1 of device attribute word in device driver is set
original flags are left on stack, and must be removed by
caller
this call bypasses the DOS filesystem, though DOS 5+
invalidates any
disk buffers referencing sectors which are written with
this call
SeeAlso: INT 13/AH=03h,INT 25/CX=FFFFh,INT 26
Format of disk write packet:
Offset Size
Description
00h
DWORD
sector number
04h
WORD
number of sectors to read
06h
DWORD
transfer address

--------D27----------------------------------------------------INT 27 - DOS 1+ - TERMINATE AND STAY RESIDENT

DX = number of bytes to keep resident (max FFF0h)
CS = segment of PSP
Return: never
Notes: this is an obsolete call
INT 22, INT 23, and INT 24 are restored from the PSP
does not close any open files
the minimum number of bytes which will remain resident is
110h for
DOS 2.x and 60h for DOS 3+; there is no minimum for DOS
1.x, which
implements this service in COMMAND.COM rather than the
DOS kernel
SeeAlso: INT 21/AH=31h

--------D28----------------------------------------------------INT 28 C - DOS 2+ - DOS IDLE INTERRUPT

SS:SP = top of MS-DOS stack for I/O functions
Return: all registers preserved
Desc:
This interrupt is invoked each time one of the DOS
character input
functions loops while waiting for input. Since a DOS
call is in
progress even though DOS is actually idle during such
input waits,
hooking this function is necessary to allow a TSR to
perform DOS
calls while the foreground program is waiting for user
input. The
INT 28h handler may invoke any INT 21h function except
functions
00h through 0Ch.
Notes: under DOS 2.x, the critical error flag (the byte
immediately after the
InDOS flag) must be set in order to call DOS functions
50h/51h from
the INT 28h handler without destroying the DOS stacks.
calls to INT 21/AH=3Fh,40h from within an INT 28 handler
may not use a
handle which refers to CON
at the time of the call, the InDOS flag (see INT
21/AH=34h) is normally
set to 01h; if larger, DOS is truly busy and should not
be reentered
the default handler is an IRET instruction
supported in OS/2 compatibility box
the _MS-DOS_Programmer's_Reference_ for DOS 5.0
incorrectly documents
this interrupt as superseded
SeeAlso: INT 21/AH=34h,INT 2A/AH=84h,INT 2F/AX=1680h

--------D29----------------------------------------------------INT 29 C - DOS 2+ - FAST CONSOLE OUTPUT

AL = character to display
Return: nothing
Notes: automatically called when writing to a device with bit 4
of its device
driver header set (see also INT 21/AH=52h)
COMMAND.COM v3.2 and v3.3 compare the INT 29 vector
against the INT 20
vector and assume that ANSI.SYS is installed if the
segment is larger
the default handler under DOS 2.x and 3.x simply calls INT
10/AH=0Eh
the default handler under DESQview 2.2 understands the
<Esc>[2J
screen-clearing sequence, calls INT 10/AH=0Eh for all
others
SeeAlso: INT 21/AH=52h,INT 2F/AX=0802h,INT 79

--------D2D----------------------------------------------------INT 2D - DOS 2+ - RESERVED

Note:
this vector is not used in DOS versions <= 6.00, and
points at an IRET

--------t2D----------------------------------------------------INT 2D - ALTERNATE MULTIPLEX INTERRUPT SPECIFICATION

(AMIS)
[v3.5.1]
AH = multiplex number
AL = function
00h installation check
Return: AL = 00h if free
AL = FFh if multiplex number in use
CX = binary version number (CH =
major, CL = minor)
DX:DI -> signature string (see below)
identifying
the program using the
multiplex number
01h get entry point
Return: AL = 00h if all API calls via INT 2D
AL = FFh if entry point supported
DX:BX -> entry point for bypassing
interrupt chain
02h uninstall
DX:BX = return address for successful uninstall
(may be
ignored by TSR)
Return: AL = status
00h not implemented

01h unsuccessful
02h can not uninstall yet, will do so
when able

03h safe to remove, but no resident

uninstaller
resident code

(TSR still enabled)

BX = segment of memory block with
04h safe to remove, but no resident

uninstaller

(TSR now disabled)

BX = segment of memory block with
resident code
later
successful and

05h not safe to remove now, try again

FFh successful
return at DX:BX with AX destroyed if

TSR honors specific return address

03h request pop-up
Return: AL = status
00h not implemented or TSR is not a
pop-up
again later
when able
intervention required

through memory
out to pop up

01h can not pop up at this time, try

02h can not pop up yet, will do so
03h already popped up
04h unable to pop up, user
BX = standard reason code
0000h unknown failure
0001h interrupt chain passes
which must be swapped
0002h swap-in failed
CX = application's reason code if

nonzero
user

dependent

FFh TSR popped up and was exited by

BX = return value
0000h no return value
0001h TSR unloaded
0002h-00FFh reserved
0100h-FFFFh application-

04h determine chained interrupts

BL = interrupt number (except 2Dh)
Return: AL = status
00h not implemented
01h (obsolete) unable to determine
02h (obsolete) interrupt hooked
03h (obsolete) interrupt hooked,
address returned
DX:BX -> TSR's interrupt BL
handler

04h list of hooked interrupts returned

DX:BX -> interrupt hook list (see
below)
resident code

Notes:

its size), and

in that case.
in that case,

FFh interrupt not hooked

since INT 2D is known to be hooked, the
need not test for BL=2Dh (to minimize
the return value is therefore undefined
BL is ignored if the TSR returns AL=04h;
the caller needs to scan the return list

rather than
function.

If the

caller must cycle

it wishes to

making additional calls to this

return is not 00h or 04h, then the
through the remaining interrupt numbers
check.
return values 01h thru 03h are disparaged

and will be
specification;
version 3.3,
any

Notes:
program

removed from the next version of this

they are included for compatibility with
though they were probably never used in

implementation
05h get hotkeys
Return: AL = status
00h not implemented
FFh supported
DX:BX -> hotkey list (see below)
06h-0Fh reserved for future enhancements
Return: AL = 00h (not implemented)
other application-dependent
programs should not use fixed multiplex numbers; rather, a

should scan all multiplex numbers from 00h to FFh,

remembering the
first unused multiplex in case the program is not yet
installed.
For multiplex numbers which are in use, the program
should compare
the first 16 bytes of the signature string to determine
whether it
is already installed on that multiplex number. If not
previously
installed, it should use the first free multiplex
number.
functions other than 00h are not valid unless a program is
installed
on the selected multiplex number
to be considered fully compliant with version 3.5 of the
specification,

resident
TSRs that
must also
compliant

programs must implement at least functions 00h, 02h (no

uninstall code required), and 04h (return value 04h).
provide hotkeys with which the user can activate them
implement function 05h.

The absolute minimum fully-

implementation has an overhead of 64 bytes (80 bytes

with function
05h) plus 22 bytes per hooked interrupt (for the
interrupt sharing
protocol header and hook list entry).
the signature string and description may be used by memory
mappers
to display the installed programs
users of this proposal should adhere to the IBM interrupt
sharing
protocol (see below), which will permit removal of TSRs
in
arbitrary order and interrupt handler reordering. All
TSRs
following this proposal should be removable, though they
need not
keep the code for removing themselves resident; it is
acceptable
for a separate program to perform the removal.
A sample implementation including example TSRs and utility
programs
may be found in a separate package distributed as
AMISLnnn.ZIP
(AMISL091.ZIP as of this writing).
Please let me know if you choose to follow this proposal.
The
signature and a list of the private API calls you use
would be
appreciated, as well.
SeeAlso: INT 2F
Index: installation check;Alternate Multiplex Interrupt
Specification
Index: installation check;AMIS|installation check;FASTMOUS
Index: installation check;SPELLER|installation check;Monitor
Index: installation check;NOLPT|installation check;NOTE
Index: installation check;RBkeyswp|installation check;SWITCHAR
Index: installation check;VGABLANK|installation check;EATMEM
Index: installation check;RECALL|installation check;XPTR2
Index: uninstall;Alternate Multiplex Interrupt Specification|
uninstall;AMIS
Index: entry point;Alternate Multiplex Interrupt|entry point;AMIS
Format of signature string:
Offset Size
Description
00h 8 BYTEs
blank-padded manufacturer's name (possibly
abbreviated)
08h 8 BYTEs
blank-padded product name
10h 64 BYTEs
ASCIZ product description (optional, may be a
single 00h)

Note:
it is not necessary to reserve a full 64 bytes for the
description,
just enough to store the actual ASCIZ string
Format of interrupt hook list [array]:
Offset Size
Description
00h
BYTE
interrupt number (last entry in array is 2Dh)
01h
WORD
offset within hook list's segment of the interrupt
handler
this will point at the initial short jump of the
interrupt
sharing protocol header (see below)
Format of hotkey list:
Offset Size
Description
00h
BYTE
type of hotkey checking
bit 0: checks before chaining INT 09
bit 1: checks after chaining INT 09
bit 2: checks before chaining INT 15/AH=4Fh
bit 3: checks after chaining INT 15/AH=4Fh
bit 4: checks on INT 16/AH=00h,01h,02h
bit 5: checks on INT 16/AH=10h,11h,12h
bit 6: checks on INT 16/AH=20h,21h,22h
bit 7: reserved (0)
01h
BYTE
number of hotkeys (may be zero if TSR can disable
hotkeys)
02h 6N BYTEs
array of hotkey definitions
(one per hotkey, first should be primary hotkey)
Offset Size
Description
00h
BYTE
hotkey scan code (00h/80h if shift
states only)
hotkey triggers on release if bit
7 set
01h
WORD
required shift states (see below)
03h
WORD
disallowed shift states (see
below)
05h
BYTE
flags
bit 0: hotkey chained before
processing
bit 1: hotkey chained after
processing
bit 2: others should pass through
this hotkey
so that it can be
monitored
bit 3: hotkey will not activate if
other keys
pressed/released before
hotkey press is
completed
bit 4: this key is remapped into
some other key
bit 5-7: reserved (0)
Notes: except for bit 7, the shift states correspond exactly to
the return
values from INT 16/AH=12h. A set bit in the required
states word

indicates that the corresponding shift state must be

active when the
hotkey's scan code is received for the hotkey to be
recognized; a
clear bit means that the corresponding state may be
ignored. A set
bit in the disallowed shift states word indicates that
the
corresponding shift state must be inactive.
if bit 2 is set, either control key may be pressed for the
hotkey; if
bits 8 and 10 are both set, then both control keys must
be pressed.
Similarly for bits 3 and 9/11, as well as 7 and 0/1.
for the disallowed-states word, if one of the "either"
bits is set,
then both the corresponding left bit and right bit must
be set
examples:
Ctrl-Alt-Del monitoring: 53h 000Ch 0003h 06h
Alt-key tap (DESQview): B8h 0000h 0007h 08h
Shf-Shf-N (NOTE.COM):
31h 0003h 000Ch 00h
Index: hotkeys;AMIS
Bitfields for shift states:
bit 0 right shift pressed
bit 1 left shift pressed
bit 2 either control key pressed
bit 3 either Alt key pressed
bit 4 ScrollLock active
bit 5 NumLock active
bit 6 CapsLock active
bit 7 either shift key pressed
bit 8 left control key pressed
bit 9 left Alt key pressed
bit 10 right control key pressed
bit 11 right Alt key pressed
bit 12 ScrollLock pressed
bit 13 NumLock pressed
bit 14 CapsLock pressed
bit 15 SysRq key pressed
Format of interrupt sharing protocol interrupt handler entry
point:
Offset Size
Description
00h 2 BYTEs
short jump to actual start of interrupt handler,
immediately
following this data block (EBh 10h)
02h
DWORD
address of next handler in chain
06h
WORD
signature 424Bh
08h
BYTE
EOI flag
00h software interrupt or secondary hardware
interrupt handler
80h primary hardware interrupt handler (will issue
EOI)
09h 2 BYTEs
short jump to hardware reset routine

RETF)
0Bh 7 BYTEs

must point at a valid FAR procedure (may be just

reserved (0)

Signatures known to be in use:

'Byrial J' 'EKLAVO ' permits keyboard entry of Esperanto
accented letters
'CoveSoft' 'Burnout+' shareware screen saver Burnout Plus
'Crynwr ' 'SPELLER ' TSR spelling-checker
'CSJewell' 'Modula3L' Curtis Jewell's Modula-3 compiler (nonTSR)
'DAISYCHA' 'INDRIVER' Advanced Parallel Port daisy chain driver
(vendor name
in product description field, if desired)
(see also INT 2D/AL=DCh)
'ECLIPSE ' 'PLUMP
' Eclipse Software's printer and plotter
spooler
'GraySoft' 'GIPC
' GraySoft's Inter-Process Communications
driver
'heathh ' 'Monitor '
'J. Berry' 'RATSR
' RemoteAccess Network Manager workstation
module
'JWB
' 'RAMLIGHT' James Birdsall's on-screen RAMdisk
activity indicator
'Nildram ' 'ST
' Screen Thief graphics screen grabber
'R-Ware ' 'dLite
' run-time data decompression TSR
'Ralf B ' 'FASTMOUS' example TSR included with sample AMIS
library code
'Ralf B ' 'NOLPT n ' example TSR -- turn LPTn into bit-bucket
'Ralf B ' 'NOTE
' example TSR -- popup note-taker
'Ralf B ' 'RBkeyswp' RBkeyswap v3.0+ -- swap Esc/~ and
LCtrl/CapsLock keys
'Ralf B ' 'SWITCHAR' example TSR -- add switchar() support
removed from DOS5
'Ralf B ' 'VGABLANK' example TSR -- VGA-only screen blanker
'Sally IS' 'Mdisk
' removeable, resizeable RAMdisk
'Sally IS' 'Scr2Tex ' screen dumper with output in (La)Tex
format
'Thaco
' 'NEST
' Eirik Pedersen's programmer's delimiter
matcher
'TifaWARE' 'EATMEM ' George A. Theall's public domain memory
restrictor for
testing programs (v1.1+)
'TifaWARE' 'RECALL ' public domain commandline editor and
history (v1.2+)
'Todd
' 'XPTR2
' PC-to-Transputer interface by Todd Radel

---------2F----------------------------------------------------INT 2F - Multiplex - NOTES

AH = identifier of program which is to handle the
interrupt
00h-7Fh reserved for DOS
B8h-BFh reserved for networks
C0h-FFh reserved for applications
AL is the function code

This is a general mechanism for verifying the presence of a TSR

and

communicating with it. When searching for a free identifier

code for AH
using the installation check (AL=00h), the calling program
should set
BX/CX/DX to 0000h and must not depend on any registers other
than CS:IP
and SS:SP to be valid on return, since numerous programs now
use additional
registers on input and/or output for the installation check.
Notes: Since the multiplex chain is growing so long, and
beginning to
experience multiplex number collisions, I am proposing
an alternate
multiplex interrupt on INT 2D. If you decide to use the
alternate
multiplex, please let me know.
DOS and some other programs return values in the flags
register, so
any TSR which chains by calling the previous handler
rather than
jumping to it should ensure that the returned flags are
preserved
and passed back to the original caller
SeeAlso: INT 2D

--------t2F----------------------------------------------------INT 2F - BMB Compuscience Canada Utilities Interface INSTALLATION

CHECK
AH = xx (dynamically assigned based upon a search for a
multiplex
number which doesn't answer installed)
AL = 00h installation check
ES:DI = EBEBh:BEBEh
Return: AL = 00h not installed
01h not installed, not OK to install
FFh installed; if ES:DI was EBEBh:BEBEh on entry,
ES:DI will point
to a string of the form 'MMMMPPPPPPPPvNNNN' where
MMMM is a
short form of the manufacturer's name, PPPPPPPP
is a product
name and NNNN is the product's version number

--------t2F----------------------------------------------------INT 2F - Ross Wentworth's Turbo Pascal POPUP LIBRARY

AH = programmer-selected multiplex number
AL = function
00h installation check
Return: AL = FFh if installed
01h get TSR interrupt vectors

Return: DX:AX -> vector table (see below)

02h get TSR code segment
Return: AX = code segment for all interrupt

handlers

signature

Index:
Index:

03h call user exit routine and release TSR's memory

04h get signature string
Return: DX:AX -> counted string containing

05h get TSR's INT 2F handler

Return: DX:AX -> INT 2F handler
06h enable/disable TSR
BL = new state (00h disabled, 01h enabled)
07h activate TSR (popup if not disabled)
08h get hotkeys
BL = which hotkey (00h = hotkey 1, 01h = hotkey 2)
Return: AX = hotkey (AH = keyflags, AL = scancode)
09h set hotkey
BL = which hotkey (00h = hotkey 1, 01h = hotkey 2)
CX = new hotkey (CH = keyflags, CL = scancode)
0Ah-1Fh reserved
installation check;Ross Wentworth POPUP library
hotkeys;Ross Wentworth POPUP library

Format of vector table entry:

Offset Size
Description
00h
BYTE
vector number (00h = end of table)
01h
DWORD
original vector
05h
WORD
offset of interrupt handler in TSR's code segment

--------t2F----------------------------------------------------INT 2F - CiriSOFT Spanish University of Valladolid

TSR's Interface
AH = xx (dynamically assigned based upon a search for a
multiplex
number from C0h to FFh which doesn't answer
installed)
AL = 00h installation check
ES:DI = 1492h:1992h
Return: AL = 00h not installed
01h not installed, not OK to install
FFh installed; and if ES:DI was 1492h:1992h on entry,
ES:DI will
point to author_name_ver table (see below)
AH = FFh
Note:
this interface permits advanced communication with TSRs:
it is possible
to make a generic uninstall utility, advanced TSR
relocator programs
in order to fit fragmented memory areas, etc.
See also: INT 2D"AMIS",INT 2F"Compuscience"
Index: installation check;CiriSOFT TSR interface
Index: uninstall;CiriSOFT TSR interface
Format of author_name_ver table:
Offset Size
Description

-16
WORD
in programs

segment of the start of the resident TSR code (CS

with PSP, XMS upper memory segment if installed as

UMB...)
-14
WORD
offset of the start of the resident TSR code
(frequently 100h
in *.COM programs and 0 in upper memory TSR's).
-12
WORD
memory used by TSR (in paragraphs). Knowing the
memory area
used by TSR is possible to determine if hooked
vectors are
still pointing it (and if it is safe to
uninstall).
-10
BYTE
characteristics byte
bits 0-2: 000 normal program (with PSP)
001 upper XMS memory block (needed
HIMEM.SYS function
to free memory when uninstalling)
010 device driver (*.SYS)
011 device driver in EXE format
1xx others (reserved)
bits 3-6 reserved
bit 7 set if extra_table defined and supported
-9
BYTE
number of multiplex entry used (redefinition
available). Note
that the TSR must use THIS variable in it's INT
2Fh handler.
-8
WORD
offset to vector_area table (see below)
-6
WORD
offset to extra_area table (see bit 7 in offset
-10 and below)
-4
4 BYTEs
signature string "*##*"
00h
var
"AUTHOR:PROGRAM_NAME:VERSION",0 (variable length,
this area
is used in order to determine if the TSR is
already resident
and it's version code; the ':' char is used as
delimiter)
Format of vector_area table:
Offset Size
Description
-1
BYTE
number of vectors intercepted by TSR
00h
BYTE
first vector number
01h
DWORD
first vector pointer before installing the TSR
05h
BYTE
second vector number
06h
DWORD
second vector pointer before installing the TSR
0Ah
...
(and so on)
Note:
the TSR must use these variables to invoke the previous
interrupt
handler routines
Format of extra_area table (needed only to improve relocation
feature):
Offset Size
Description
00h
WORD
offset to external_ctrl table (0 if not supported)
02h
WORD
reserved for future use (0)
Format of external_ctrl table:

Offset Size
Description
00h
BYTE
bit 0: TSR is relocatable (no absolute segment
references)
01h
WORD
offset to a variable which can activate/inhibit
the TSR
---And if bit 0 in offset 00h is off:
03h
DWORD
pointer to ASCIZ pathname for executable file
which supports
/SR parameter (silent installation & inhibit)
07h
DWORD
pointer to first variable to initialize on the
copy reloaded
from the previous TSR still resident
0Bh
DWORD
pointer to last variable (all variables packed in
one block)

--------W2F1600------------------------------------------------INT 2F - MS Windows - WINDOWS ENHANCED MODE

INSTALLATION CHECK
AX = 1600h
Return: AL = status
00h neither Windows 3.x enhanced mode nor Windows/386
2.x running
01h Windows/386 2.x running
80h XMS version 1 driver installed (neither Windows
3.x enhanced
mode nor Windows/386 2.x running) (obsolete--see
note)
FFh Windows/386 2.x running
AL = anything else
AL = Windows major version number >= 3
AH = Windows minor version number
Notes: INT 2F/AH=16h comprises an API for non-Windows programs
(DOS device
drivers, TSRs, and applications) to cooperate with
multitasking
Windows/386 2.x and Windows 3.x and higher enhanced
mode.
certain calls are also supported in the Microsoft 80286
DOS extender in
Windows standard mode
this function served as the installation check and
AX=1610h served to
get the driver entry point for XMS version 1, which is
now obsolete.
Use AX=4300h and AX=4310h instead
SeeAlso: AX=160Ah,AX=1610h,AX=4300h,AX=4680h
Index: installation check;XMS version 1

--------W2F4680------------------------------------------------INT 2F U - MS Windows v3.0 - INSTALLATION CHECK

AX = 4680h
Return: AX = 0000h MS Windows 3.0 running in real (/R) or standard
(/S) mode,

nonzero

or DOS 5 DOSSHELL active

no Windows, Windows prior to 3.0, or Windows3

in enhanced

mode
Note:
Windows 3.1 finally provides an installation check which
works in all
modes (see AX=160Ah)
SeeAlso: AX=1600h,AX=160Ah

--------V2FAD00------------------------------------------------INT 2F U - DOS 3.3+ DISPLAY.SYS internal - INSTALLATION

CHECK
AX = AD00h
Return: AL = FFh if installed
BX = ??? (0100h for MS-DOS 3.3+)
Note:
DOS 5+ DISPLAY.SYS chains to previous handler if AL is not
one of the
subfunctions listed here

--------O2FAD00------------------------------------------------INT 2F U - DR-DOS 3.41,5.0 KEYB - INSTALLATION CHECK

AX = AD00h
Return: AX = FFFFh if installed
SeeAlso: AX=AD80h

--------K2FAD80------------------------------------------------INT 2F u - DOS 3.3+ KEYB.COM internal - INSTALLATION

CHECK
AX = AD80h
Return: AL = FFh if installed
BX = version number (BH = major, BL = minor)
ES:DI -> internal data (see below)
Notes: MS-DOS 3.30, PC-DOS 4.01, and MS-DOS 5.00 all report
version 1.00.
undocumented prior to the release of DOS 5.0

Format of KEYB internal data:

Offset Size
Description
00h
DWORD
original INT 09
04h
DWORD
original INT 2F
08h 6 BYTEs
???
0Eh
WORD
flags
10h
BYTE
???
11h
BYTE
???
12h 4 BYTEs
???
16h 2 BYTEs
country ID letters
18h
WORD
current code page
---DOS 3.3--1Ah
WORD
pointer to first item in list of code page
tables???
1Ch
WORD
pointer to ??? item in list of code page tables

1Eh 2 BYTEs
20h
WORD
22h
WORD
below)
24h 9 BYTEs
---DOS 4.01--1Ah 2 BYTEs
1Ch
WORD
tables???
1Eh
WORD
20h 2 BYTEs
22h
WORD
24h
WORD
below)
26h 9 BYTEs

???
pointer to key translation data
pointer to last item in code page table list (see
???
???
pointer to first item in list of code page
pointer to ??? item in list of code page tables
???
pointer to key translation data
pointer to last item in code page table list (see
???

Format of code page table list entries:

Offset Size
Description
00h
WORD
pointer to next item, FFFFh = last
02h
WORD
code page
04h 2 BYTEs
???
Format of translation data:
Offset Size
Description
00h
WORD
size of data in bytes, including this word
02h N-2 BYTEs ???

--------B4A----------------------------------------------------INT 4A C - SYSTEM - USER ALARM HANDLER

Desc:
This interrupt is invoked by the BIOS when a real-time
clock alarm
occurs; an application may use it to perform an action
at a
predetermined time.
Note:
this interrupt is called from within a hardware interrupt
handler,
so all usual precautions against reentering DOS must be
taken
SeeAlso: INT 1A/AH=06h

--------E67DE00------------------------------------------------INT 67 - Virtual Control Program Interface INSTALLATION CHECK

AX = DE00h
Return: AH = 00h
VCPI is present
BH = major version number
BL = minor version number
AH nonzero VCPI not present
BUG:
MS Windows 3.00 is reported to "object violently" to this
call.
SeeAlso: INT 2F/AX=1687h

--------H70----------------------------------------------------INT 70 - IRQ8 - CMOS REAL-TIME CLOCK

Desc:
this interrupt is called when the real-time clock chip
generates an
alarm or periodic interrupt, among others. The periodic
interrupt
occurs 1024 times per second.
Nots:
many BIOSes turn off the periodic interrupt in the INT 70h
handler
unless in an event wait (see INT 15/AH=83h or INT
15/AH=86h).
may be masked by setting bit 0 on I/O port A1h
SeeAlso: INT 08,INT 0F"HP 95LX",INT 15/AH=01h"Amstrad",INT
15/AH=83h
SeeAlso: INT 15/AH=86h,INT 1A/AH=02h,INT 58"DESQview"

--------H71----------------------------------------------------INT 71 - IRQ9 - REDIRECTED TO INT 0A BY BIOS

Notes:

may be masked by setting bit 1 on I/O port A1h

the default BIOS handler invokes INT 0A for compatibility,
since the
pin for IRQ2 on the PC expansion bus became the pin for
IRQ9 on the
AT expansion bus.
under DESQview, only the INT 15h vector and BASIC segment
address (the
word at 0000h:0510h) may be assumed to be valid for the
handler's
process
SeeAlso: INT 0A,INT 59

Volver al ndice

Apndice IX - ESPECIFICACIONES XMS Y EMS: TODAS SUS FUNCIONES

--------m2F4300------------------------------------------------INT 2F - EXTENDED MEMORY SPECIFICATION (XMS) v2+ INSTALLATION

CHECK

AX = 4300h
Return: AL = 80h XMS driver installed
AL <> 80h no driver
Notes: XMS gives access to extended memory and
noncontiguous/nonEMS memory
above 640K
this installation check DOES NOT follow the format used by
other
software
SeeAlso: AX=4310h
Index: installation check;XMS version 2+

--------m2F4310------------------------------------------------INT 2F - EXTENDED MEMORY SPECIFICATION (XMS) v2+ - GET

DRIVER
ADDRESS
AX = 4310h
Return: ES:BX -> driver entry point
Note:
HIMEM.SYS v2.77 chains to previous handler if AH is not
00h or 10h
SeeAlso: AX=4300h
Perform a FAR call to the driver entry point with AH set to the
function code
AH
function
00h Get XMS version number
Return: AX = XMS version (in BCD, AH=major, AL=minor)
BX = internal revision number
DX = 0001h if HMA (1M to 1M + 64K) exists
0000h if HMA does not exist
01h Request High Memory Area (1M to 1M + 64K)
DX = memory in bytes (for TSR or device drivers)
FFFFh if application program
Return: AX = 0001h success
= 0000h failure
BL = error code (80h,81h,90h,91h,92h)
(see below)
02h Release High Memory Area
Return: AX = 0001h success

= 0000h failure
BL = error code (80h,81h,90h,93h) (see
below)

03h

Global enable A20,

Return: AX = 0001h
= 0000h
BL =

04h

Global disable A20

Return: AX = 0001h success
= 0000h failure
BL = error code (80h,81h,82h,94h) (see

05h

Local enable A20, for direct access to extended

below)

below)
memory

for using the HMA

success
failure
error code (80h,81h,82h) (see

below)

Return: AX = 0001h success

= 0000h failure
BL = error code (80h,81h,82h) (see
06h

Local disable A20

Return: AX = 0001h success
= 0000h failure
BL = error code (80h,81h,82h,94h) (see

07h

Query A20 state

Return: AX = 0001h enabled
= 0000h disabled
BL = error code (00h,80h,81h) (see below)
Query free extended memory, not counting HMA
BL = 00h (some implementations leave BL unchanged on

below)

08h
success)

Return: AX = size of largest extended memory block in

KB
09h

below)

DX = total extended memory in KB

BL = error code (00h,80h,81h,A0h) (see below)
Allocate extended memory block
DX = Kbytes needed
Return: AX = 0001h success
DX = handle for memory block
= 0000h failure
BL = error code (80h,81h,A0h) (see

0Ah

Free extended memory block

DX = handle of block to free
Return: AX = 0001h success
= 0000h failure
BL = error code (80h,81h,A2h,ABh) (see

0Bh

Move extended memory block

DS:SI -> EMM structure (see below)
Note: if either handle is 0000h, the corresponding

below)

offset is
address in

considered to be an absolute segment:offset

directly addressable memory
Return: AX = 0001h success
= 0000h failure

BL = error code (80h-82h,A3h-A9h) (see

below)
0Ch

block
(see below)

Lock extended memory block

DX = handle of block to lock
Return: AX = 0001h success
DX:BX = 32-bit linear address of locked
= 0000h failure
BL = error code (80h,81h,A2h,ACh,ADh)

Note: MS Windows 3.x rejects this function for

handles allocated
after Windows started
0Dh Unlock extended memory block
DX = handle of block to unlock
Return: AX = 0001h success
= 0000h failure
BL = error code (80h,81h,A2h,AAh) (see
below)
0Eh Get handle information
DX = handle for which to get info
Return: AX = 0001h success
BH = block's lock count
BL = number of free handles left
DX = block size in KB
= 0000h failure
BL = error code (80h,81h,A2h) (see
below)
BUG: MS Windows 3.10 acts as though unallocated
handles are in use
Note: MS Windows 3.00 has problems with this call
0Fh Reallocate extended memory block
DX = handle of block
BX = new size of block in KB
Return: AX = 0001h success
= 0000h failure
BL = error code (80h,81h,A0h-A2h,ABh)
(see below)
10h Request upper memory block (nonEMS memory above 640K)
DX = size of block in paragraphs
Return: AX = 0001h success
BX = segment address of UMB
DX = actual size of block
= 0000h failure
BL = error code (80h,B0h,B1h) (see
below)
DX = largest available block
11h Release upper memory block
DX = segment address of UMB to release
Return: AX = 0001h success
= 0000h failure
BL = error code (80h,B2h) (see below)
12h (XMS v3.0) Reallocate upper memory block
DX = segment address of UMB to resize
BX = new size of block in paragraphs
Return: AX = 0001h success
= 0000h failure

BL = error code (80h,B0h,B2h) (see

below)
34h
44h
80h
81h
82h
code

DX = maximum available size (RM386)

(QEMM 5.11 only, undocumented) ???
(QEMM 5.11 only, undocumented) ???
(Netroom RM386 v6.00) Reallocate upper memory block
this function is identical to function 12h
(Netroom RM386 v6.00) re-enable HMA allocation
Return: AX = 0001h (success)
(Netroom RM386 v6.00) Cloaking API
DX = XMS handle of block containing protected-mode
CL = code size (00h 16-bit, else 32-bit)
ESI, EDI = parameters to pass to protected-mode code
Return: AX = status
0001h success
0000h failed
BL = error code (A2h,B0h) (see below)
Note: this calls offset 0 in the XMS memory block

with

EBX = physical address of block's start

CS = code selector for XMS block at EBX (16-bit or
32-bit)
mode 1088K
83h

chain

84h

88h

system)

memory
A0h)
status A0h)
89h

DS = data selector for XMS block, starting at EBX

ES = selector for V86 memory access to full realGS = selector for full flat address space
ESI, EDI from V86 mode
(Netroom RM386 v6.00) Create new UMB entry
BX = segment of high-memory block
DX = first page of start of block
CX = number of consecutive pages in block
DI = start of UMB in block
Return: AX = 0001h (success)
DI = segment of first high-DOS block
Note: the new UMB is not linked into the high-memory
(Netroom RM386 v6.00) Get all XMS handles info
CX = size of buffer for handle info
ES:DI -> buffer for handle info (see below)
Return: AX = 0001h (success)
DX = current number of allocated XMS handles
(XMS v3.0) Query free extended memory
Return: EAX = largest block of extended memory, in KB
BL = status
00h success
80h not implemented (i.e. on a 286
81h VDISK detected
A0h all extended memory allocated
ECX = physical address of highest byte of
(valid even on error codes 81h and
EDX = total Kbytes of extended memory (0 if
(XMS v3.0) Allocate any extended memory

with AH=0Ah)

EDX = Kbytes needed

Return: AX = 0001h success
DX = handle for allocated block (free
= 0000h failure
BL = status (80h,81h,A0h,A1h,A2h) (see

below)

8Eh

8Fh

(XMS v3.0) Get extended EMB handle information

DX = handle
Return: AX = 0001h success
BH = block's lock count
CX = number of free handles left
EDX = block size in KB
= 0000h failure
BL = status (80h,81h,A2h) (see below)
BUG: DOS 6.0 HIMEM.SYS leaves CX unchanged
(XMS v3.0) Reallocate any extended memory block
DX = unlocked handle
EBX = new size in KB
Return: AX = 0001h success
= 0000h failure
BL = status (80h,81h,A0h-A2h,ABh) (see

below)
Notes:

HIMEM.SYS requires at least 256 bytes free stack space

the XMS driver need not implement functions 10h through
12h to be
considered compliant with the standard
BUG:
HIMEM v3.03-3.07 crash on an 80286 machine if any of the
8Xh functions
are called
Error codes returned in BL:
00h
successful
80h
function not implemented
81h
Vdisk was detected
82h
an A20 error occurred
8Eh
a general driver error
8Fh
unrecoverable driver error
90h
HMA does not exist
91h
HMA is already in use
92h
DX is less than the /HMAMIN= parameter
93h
HMA is not allocated
94h
A20 line still enabled
A0h
all extended memory is allocated
A1h
all available extended memory handles are allocated
A2h
invalid handle
A3h
source handle is invalid
A4h
source offset is invalid
A5h
destination handle is invalid
A6h
destination offset is invalid
A7h
length is invalid
A8h
move has an invalid overlap
A9h
parity error occurred
AAh
block is not locked
ABh
block is locked
ACh
block lock count overflowed
ADh
lock failed

B0h
B1h
B2h

only a smaller UMB is available

no UMB's are available
UMB segment number is invalid

Format of EMM structure:

Offset Size
Description
00h
DWORD
number of bytes to move (must be even)
04h
WORD
source handle
06h
DWORD
offset into source block
0Ah
WORD
destination handle
0Ch
DWORD
offset into destination block
Notes: if source and destination overlap, only forward moves
(source base
less than destination base) are guaranteed to work
properly
if either handle is zero, the corresponding offset is
interpreted
as a real-mode address referring to memory directly
addressable
by the processor
Format of XMS handle info [array]:
Offset Size
Description
00h
BYTE
handle
01h
BYTE
lock count
02h
DWORD
handle size
06h
DWORD
handle physical address (only valid if lock count
nonzero)

--------m6740--------------------------------------------------INT 67 - LIM EMS - GET MANAGER STATUS

AH = 40h
Return: AH = status (00h,80h,81h,84h) (see below)
Note:
this call can be used only after establishing that the EMS
driver is in
fact present
SeeAlso: AH=3Fh,AX=FFA5h
Values for EMS function status:
00h
successful
80h
internal error
81h
hardware malfunction
83h
invalid handle
84h
undefined function requested by application
85h
no more handles available
86h
error in save or restore of mapping context
87h
insufficient memory pages in system
88h
insufficient memory pages available
89h
zero pages requested
8Ah
invalid logical page number encountered
8Bh
invalid physical page number encountered
8Ch
page-mapping hardware state save area is full
8Dh
save of mapping context failed
8Eh
restore of mapping context failed
8Fh
undefined subfunction

90h
undefined attribute type
91h
feature not supported
92h
successful, but a portion of the source region has been
overwritten
93h
length of source or destination region exceeds length of
region
allocated to either source or destination handle
94h
conventional and expanded memory regions overlap
95h
offset within logical page exceeds size of logical page
96h
region length exceeds 1M
97h
source and destination EMS regions have same handle and
overlap
98h
memory source or destination type undefined
9Ah
specified alternate map register or DMA register set not
supported
9Bh
all alternate map register or DMA register sets currently
allocated
9Ch
alternate map register or DMA register sets not supported
9Dh
undefined or unallocated alternate map register or DMA
register set
9Eh
dedicated DMA channels not supported
9Fh
specified dedicated DMA channel not supported
A0h
no such handle name
A1h
a handle found had no name, or duplicate handle name
A2h
attempted to wrap around 1M conventional address space
A3h
source array corrupted
A4h
operating system denied access

--------m6741--------------------------------------------------INT 67 - LIM EMS - GET PAGE FRAME SEGMENT

AH = 41h
Return: AH = status (see also AH=40h)
00h function successful
BX = segment of page frame
SeeAlso: AH=58h,AH=68h

--------m6742--------------------------------------------------INT 67 - LIM EMS - GET NUMBER OF PAGES

AH = 42h
Return: AH = status (see also AH=40h)
00h function successful
BX = number of unallocated pages
DX = total number of pages
BUG:
DOS 6.0 EMM386.EXE causes a system lock-up or reboot if in
AUTO mode
when this call is made; use AH=46h to ensure that EMM386
is ON
before making this call
SeeAlso: INT 2F/AX=2702h

--------m6743---------------------------------------------------

INT 67 - LIM EMS - GET HANDLE AND ALLOCATE MEMORY

AH = 43h
BX = number of logical pages to allocate
Return: AH = status (00h,80h,81h,84h,85h,87h,88h,89h) (see AH=40h)
DX = handle if AH=00h
SeeAlso: AH=45h

--------m6744--------------------------------------------------INT 67 - LIM EMS - MAP MEMORY

AH = 44h
AL = physical page number (0-3)
BX = logical page number
or FFFFh to unmap (QEMM)
DX = handle
Return: AH = status (00h,80h,81h,83h,84h,8Ah,8Bh) (see AH=40h)
SeeAlso: AH=69h

--------m6745--------------------------------------------------INT 67 - LIM EMS - RELEASE HANDLE AND MEMORY

AH = 45h
DX = EMM handle
Return: AH = status (00h,80h,81h,83h,84h,86h) (see AH=40h)
SeeAlso: AH=43h

--------m6746--------------------------------------------------INT 67 - LIM EMS - GET EMM VERSION

AH = 46h
Return: AH = status (00h,80h,81h,84h) (see AH=40h)
AL = EMM version number if AH=00h

--------m6747--------------------------------------------------INT 67 - LIM EMS - SAVE MAPPING CONTEXT

AH = 47h
DX = handle
Return: AH = status (see below)
SeeAlso: AH=48h

Values for status:

00h
successful
80h
internal error
81h
hardware malfunction
83h
invalid handle
84h
undefined function requested
8Ch
page-mapping hardware state save area is full
8Dh
save of mapping context failed
8Eh
restore of mapping context failed

--------m6748---------------------------------------------------

INT 67 - LIM EMS - RESTORE MAPPING CONTEXT

AH = 48h
DX = handle
Return: AH = status (00h,80h,81h,83h,84h,8Eh) (see AH=47h)
SeeAlso: AH=47h

--------m6749--------------------------------------------------INT 67 - LIM EMS - reserved - GET I/O PORT ADDRESSES

Note:

AH = 49h
defined in EMS 3.0, but undocumented in EMS 3.2

--------m674A--------------------------------------------------INT 67 - LIM EMS - reserved - GET TRANSLATION ARRAY

Note:

AH = 4Ah
defined in EMS 3.0, but undocumented in EMS 3.2

--------m674B--------------------------------------------------INT 67 - LIM EMS - GET NUMBER OF EMM HANDLES

AH = 4Bh
Return: AH = status (see below)
BX = number of EMM handles if AH=00h
Values for status:
00h
successful
80h
internal error
81h
hardware malfunction
83h
invalid handle
84h
undefined function requested

--------m674C--------------------------------------------------INT 67 - LIM EMS - GET PAGES OWNED BY HANDLE

AH = 4Ch
DX = EMM handle
Return: AH = status (see AH=4Bh)
BX = number of logical pages if AH=00h
SeeAlso: AH=4Dh

--------m674D--------------------------------------------------INT 67 - LIM EMS - GET PAGES FOR ALL HANDLES

AH = 4Dh
ES:DI -> array to receive information
Return: AH = status (00h,80h,81h,84h) (see AH=4Bh)
---if AH=00h--BX = number of active EMM handles
array filled with 2-word entries, consisting of a handle
and the
number of pages allocated to that handle

SeeAlso: AH=4Ch

--------m674E--------------------------------------------------INT 67 - LIM EMS - GET OR SET PAGE MAP

AH = 4Eh
AL = 00h if getting mapping registers
01h if setting mapping registers
02h if getting and setting mapping registers at once
03h if getting size of page-mapping array
DS:SI -> array holding information (AL=01h/02h)
ES:DI -> array to receive information (AL=00h/02h)
Return: AH = status
00h successful
AL = bytes in page-mapping array (AL=03h only)
array pointed to by ES:DI receives mapping info
(AL=00h/02h)
80h internal error
81h hardware malfunction
84h undefined function requested
8Fh undefined subfunction parameter
A3h contents of source array corrupted (EMS 4.0?)
Notes: this function was designed to be used by multitasking
operating systems
and should not ordinarily be used by appplication
software.
MD386 returns the size of the page-mapping array in AX
instead of AL
SeeAlso: AH=4Fh

--------m674F--------------------------------------------------INT 67 - LIM EMS 4.0 - GET/SET PARTIAL PAGE MAP

AH = 4Fh
AL = subfunction
00h get partial page map
DS:SI -> structure containing list of segments
whose mapping
contexts are to be saved
ES:DI -> array to receive page map
01h set partial page map
DS:SI -> structure containing saved partial page
map
02h get size of partial page map
BX = number of mappable segments in the partial map
to be saved
Return: AH = status
00h successful
80h internal error
81h hardware malfunction
84h undefined function requested
8Bh one of specified segments is not mappable
8Fh undefined subfunction parameter
A3h contents of partial page map corrupted or count of
mappable

segments exceeds total number of mappable segments

in system
AL = size of partial page map for subfunction 02h
SeeAlso: AH=4Eh

--------m6750--------------------------------------------------INT 67 - LIM EMS 4.0 - MAP/UNMAP MULTIPLE HANDLE PAGES

AH = 50h
AL = subfunction
00h use physical page numbers
01h use segment addresses
DX = handle
CX = number of entries in array
DS:SI -> mapping array (see below)
Return: AH = status
00h successful
80h internal error
81h hardware malfunction
83h invalid handle
84h undefined function requested
8Ah one or more logical pages are invalid
8Bh one or more physical pages are invalid
8Fh invalid subfunction
SeeAlso: AH=40h
Format of mapping array entry:
Offset Size
Description
00h
WORD
logical page number or FFFFh to unmap physical
page
02h
WORD
physical page number or segment address

--------m6751--------------------------------------------------INT 67 - LIM EMS 4.0 - REALLOCATE PAGES

AH
DX
BX
Return: AH
BX

=
=
=
=
=

51h
handle
number of pages to be allocated to handle
status (00h,80h,81h,83h,84h,87h,88h) (see below)
actual number of pages allocated to handle

Values for status:

00h
successful
80h
internal error
81h
hardware malfunction
83h
invalid handle
84h
undefined function requested
87h
more pages requested than present in system
88h
more pages requested than currently available
8Fh
undefined subfunction
90h
undefined attribute type
91h
feature not supported
A0h
no such handle name
A1h
duplicate handle name

--------m6752--------------------------------------------------INT 67 - LIM EMS 4.0 - GET/SET HANDLE ATTRIBUTES

AH = 52h
AL = subfunction
00h get handle attributes
Return: AL = attribute
00h handle is volatile
01h handle is nonvolatile
01h set handle attributes
BL = new attribute (see returned AL)
02h get attribute capability
Return: AL = attribute capability
00h only volatile handles supported
01h both volatile and non-volatile
supported
DX = handle
Return: AH = status (00h,80h,81h,83h,84h,8Fh-91h) (see AH=51h)
SeeAlso: AH=53h

--------m6753--------------------------------------------------INT 67 - LIM EMS 4.0 - GET/SET HANDLE NAME

AH = 53h
AL = subfunction
00h get handle name
ES:DI -> 8-byte buffer for handle name
01h set handle name
DS:SI -> 8-byte handle name
DX = handle
Return: AH = status (00h,80h,81h,83h,84h,8Fh,A1h) (see AH=51h)
SeeAlso: AH=52h

--------m6754--------------------------------------------------INT 67 - LIM EMS 4.0 - GET HANDLE DIRECTORY

AH = 54h
AL = subfunction
00h get handle directory
ES:DI -> buffer for handle directory (see below)
01h search for named handle
DS:SI -> 8-byte name
02h get total number of handles
Return: AL = number of entries in handle directory (subfunction
00h)
DX = value of named handle (subfunction 01h)
BX = total number of handles (subfunction 02h)
AH = status (00h,80h,81h,84h,8Fh,A0h,A1h) (see also
AH=51h)
A1h a handle found had no name
Format of handle directory entry:
Offset Size
Description

00h
02h

WORD
8 BYTEs

handle
handle's name

--------m6755--------------------------------------------------INT 67 - LIM EMS 4.0 - ALTER PAGE MAP AND JUMP

AH = 55h
AL = subfunction
00h physical page numbers provided by caller
01h segment addresses provided by caller
DX = handle
DS:SI -> structure containing map and jump address
Return: (at target address unless error)
AH = status (see below)
SeeAlso: AH=56h
Values for status:
00h
successful
80h
internal error
81h
hardware failure
83h
invalid handle
84h
undefined function requested
8Ah
invalid logical page number encountered
8Bh
invalid physical page number encountered
8Fh
invalid subfunction

--------m6756--------------------------------------------------INT 67 - LIM EMS 4.0 - ALTER PAGE MAP AND CALL

AH = 56h
AL = subfunction
00h physical page numbers provided by caller
DX = handle
DS:SI -> structure containing page map and call

address

01h segment addresses provided by caller

DX = handle
DS:SI -> structure containing page map and call

address

02h get page map stack space required

Return: BX = stack space required
Return: (if successful, the target address is called.
to return and
restore mapping context)
AH = status (see AH=55h)
SeeAlso: AH=55h

Use a RETF

--------m6757--------------------------------------------------INT 67 - LIM EMS 4.0 - MOVE/EXCHANGE MEMORY REGION

AH = 57h
AL = subfunction
00h move memory region
01h exchange memory region

DS:SI -> structure describing source and destination (see

below)
Return: AH = status (see below)
Note:
source and destination may overlap for a move, in which
case the copy
direction is chosen such that the destination receives
an intact copy
of the source region
Values for status:
00h
successful
80h
internal error
81h
hardware failure
83h
invalid handle
84h
undefined function requested
8Ah
invalid logical page number encountered
8Fh
undefined subfunction
92h
successful, but a portion of the source region has been
overwritten
93h
length of source or destination region exceeds length of
region
allocated to either source or destination handle
94h
conventional and expanded memory regions overlap
95h
offset within logical page exceeds size of logical page
96h
region length exceeds 1M
97h
source and destination EMS regions have same handle and
overlap
98h
memory source or destination type undefined
A2h
attempted to wrap around 1M conventional address space
Format of EMS copy data:
Offset Size
Description
00h
DWORD
region length in bytes
04h
BYTE
source memory type
00h conventional
01h expanded
05h
WORD
source handle (0000h if conventional memory)
07h
WORD
source initial offset (within page if EMS, segment
if convent)
09h
WORD
source initial segment (conv mem) or logical page
(EMS)
0Bh
BYTE
destination memory type
00h conventional
01h expanded
0Ch
WORD
destination handle
0Eh
WORD
destination initial offset
10h
WORD
destination initial segment or page

--------m6758--------------------------------------------------INT 67 - LIM EMS 4.0 - GET MAPPABLE PHYSICAL ADDRESS

ARRAY
AH = 58h
AL = subfunction
00h get mappable physical address array
ES:DI -> buffer to be filled with array

01h get number of entries in m.p.a. array

Return: CX = number of entries in array
AH = status (00h,80h,81h,84h,8Fh) (see AH=57h)
Note:
the returned array for subfunction 00h is filled in
physical segment
address order
Format of mappable physical address entry:
Offset Size
Description
00h
WORD
physical page segment
02h
WORD
physical page number

--------m6759--------------------------------------------------INT 67 - LIM EMS 4.0 - GET EXPANDED MEMORY HARDWARE

INFORMATION

below)

AH = 59h
AL = subfunction
00h get hardware configuration array
ES:DI -> buffer to be filled with array (see

01h get unallocated raw page count

Return: BX = unallocated raw pages
DX = total raw pages
Return: AH = status (see also AH=58h"EMS 4.0")
A4h access denied by operating system
Note:
subfunction 00h is for use by operating systems only, and
can be
enabled or disabled at any time by the operating system
Format of hardware configuration array:
Offset Size
Description
00h
WORD
size of raw EMM pages in paragraphs
02h
WORD
number of alternate register sets
04h
WORD
size of mapping-context save area in bytes
06h
WORD
number of register sets assignable to DMA
08h
WORD
DMA operation type
0000h DMA with alternate register sets
0001h only one DMA register set

--------m675A--------------------------------------------------INT 67 - LIM EMS 4.0 - ALLOCATE STANDARD/RAW PAGES

AH = 5Ah
AL = subfunction
00h allocate standard pages
01h allocate raw pages
BX = number of pages to allocate
Return: DX = handle
AH = status
00h successful
80h internal error
81h hardware failure
84h undefined function requested
85h no more handles available

87h insufficient memory pages in system

88h insufficient memory pages available
8Fh undefined subfunction

--------m675B--------------------------------------------------INT 67 - LIM EMS 4.0 - ALTERNATE MAP REGISTER SET

AH = 5Bh
AL = subfunction
00h get alternate map register set
Return: BL = current active alternate map register
set number
ES:DI -> map register context save area if
BL=00h
01h set alternate map register set
BL = new alternate map register set number
ES:DI -> map register context save area if BL=0
02h get alternate map save array size
Return: DX = array size in bytes
03h allocate alternate map register set
Return: BL = number of map register set; 00h = not
supported
04h deallocate alternate map register set
BL = number of alternate map register set
Return: AH = status (00h,80h,81h,84h,8Fh,9Ah-9Dh,A3h,A4h) (see
below)
Note:
this function is for use by operating systems only, and
can be
enabled or disabled at any time by the operating system
Values for status:
00h
successful
80h
internal error
81h
hardware malfunction
84h
undefined function requested
8Fh
undefined subfunction
9Ah
specified alternate map register or DMA register set not
supported
9Bh
all alternate map register or DMA register sets currently
allocated
9Ch
alternate map register or DMA register sets not supported
9Dh
undefined or unallocated alternate map register/DMA
register set
9Eh
dedicated DMA channels not supported
9Fh
specified dedicated DMA channel not supported
A3h
source array corrupted
A4h
operating system denied access

--------m675B--------------------------------------------------INT 67 - LIM EMS 4.0 - ALTERNATE MAP REGISTER SET - DMA

REGISTERS
AH = 5Bh
AL = subfunction
05h allocate DMA register set

supported

Return: BL = DMA register set number, 00h if not

06h enable DMA on alternate map register set

BL = DMA register set number
DL = DMA channel number
07h disable DMA on alternate map register set
BL = DMA register set number
08h deallocate DMA register set
BL = DMA register set number
Return: AH = status (00h,80h,81h,84h,8Fh,9Ah-9Fh,A3h,A4h) (see
AH=5Ah)
Note:
this function is for use by operating systems only, and
can be
enabled or disabled at any time by the operating system

--------m675C--------------------------------------------------INT 67 - LIM EMS 4.0 - PREPARE EXPANDED MEMORY HARDWARE

FOR WARM
BOOT
AH = 5Ch
Return: AH = status (see below)
Values for status:
00h
successful
80h
internal error
81h
hardware malfunction
84h
undefined function requested

--------m675D--------------------------------------------------INT 67 - LIM EMS 4.0 - ENABLE/DISABLE OS FUNCTION SET

FUNCTIONS
AH = 5Dh
AL = subfunction
00h enable OS Function Set
01h disable OS Function Set
02h return access key (resets memory manager, returns
access key at
next invocation)
BX,CX = access key returned by first invocation
Return: BX,CX = access key, returned only on first invocation of
function
AH = status (see also AH=5Ch)
8Fh undefined subfunction
A4h operating system denied access

Volver al ndice

Apndice XI - BIBLIOGRAFA

Ralf Brown.
Ralf Brown publica peridicamente un fichero (en ingls) con informacin muy
detallada sobre interrupciones (INTERRUP.LST), muy superior a la de cualquier libro.
Contiene todas las funciones de la BIOS, con informacin de mquinas y marcas
concretas, as como de casi todas las tarjetas (por ejemplo, de vdeo) del mercado.
Tambin estn todas las interrupciones y funciones del DOS, tanto las documentadas
como las secretas o indocumentadas. Aqu se pueden encontrar las funciones (va llamada
a interrupciones) de los controladores de memoria expandida y extendida, del ratn, de
las extensiones CD-ROM, de Desqview, de Windows,... en resumen: de casi todos los
programas importantes del mercado. Adems, se trata de un fichero de dominio pblico.
Peridicamente es actualizado con la informacin que altruistamente le envan personas
de todo el mundo. La versin 55 (mediados de 1997) ocupa unos 5 Mbytes, tras
descomprimir y juntar los diversos ficheros en que viene repartido. Se puede conseguir en
Internet y en las principales BBS.
Michael Tischer.
PC Interno. Programacin de sistema.
Editorial Marcombo - Data Becker, 1993. 1404 pginas + disco.
Este gigantesco libro rene en una sola obra un ingente volumen de informacin
til, relacionada con la programacin de sistemas de los PC. La primera parte constituye
una especie de introduccin a la programacin de sistemas (100 pginas). La segunda
parte (600 pginas) describe los grficos mejor que muchos otros libros especializados en
la materia, explica el teclado, los disquetes y discos duros, los puertos paralelo y serie, la
programacin del ratn y el joystick, el reloj de tiempo real, las memorias EMS y XMS,
la creacin de sonido, la deteccin del tipo de microprocesador... La tercera parte (250
pginas) comenta la estructura del sistema operativo DOS, las formatos COM y EXE, la
gestin de archivos, la gestin de memoria, los controladores de dispositivo,... La cuarta
parte (100 pginas) trata de la creacin de programas residente