Is there anyway other than using the DX library, to write to video memory. I just want to black it completely out. With my video card, there are a whole slough of tests that come with it, like Video Apature Test and stuff like that. A few of them completely lock video memory, and write patterns to the screen. I want to know how they do that, and i dont think its using DX. Any ideas? Thanx, cheers!
Posted on 2003-11-12 00:50:35 by Snoopy2K
Video card and video chips all behave someqhat differently. Most of them may respect the VESA standard but some don't. That's why the card or chip comes with a specific driver most of the time.

If you run in DOS mode, you could inquire if VESA is supported and, if so, then get the required information with specific INTs in order to access its video memory correctly. This would require a 1000-page book to properly explain all the possibilities.

If you run under Windows, you don't have direct access to the hardware (unless you know how to access ring0). You must then access the video memory indirectly with a "compatible DC" for quick access to individual pixels. Or, you can change screen pixels directly with a few of the APIs, including drawing lines, ellipses, etc., without using directX.

Raymond
Posted on 2003-11-12 11:10:20 by Raymond
Get to ring zero to write to this memory. Load ds with 10h. XP may not let you do this in which case you will have to manupulate the page directory. Use "Invlpg" to clear TLB entry.
Posted on 2003-11-15 01:09:19 by mrgone
Hi,

mrgone, can you please post a little example...
I'm interested, too

Regards,
Nordwind64
Posted on 2003-11-15 06:42:12 by Nordwind64
I attached an old 16bit example:

If your gonna attempt direct reads and writes you will need a page fault handler to avoid a BSOD. This one is good for two byte reads or writes. If you use offsets in your pointers than I suggest you also handle Debug exceptions 1 and 3. You can use this as a model.
.data

ErrorCode dd 0
HwordpFault dd 0
LwordpFault dd 0
MSDW dd 0
saveESI dd 0
IDTbase dd 0



push ecx ; save selector
push ebp ; A way of storing information
push esp ; on the stack
pop ebp
xor ecx,ecx
xor edx,edx
push ecx
push edx
SIDT ss: ; Store IDT address and seg. limit on stack
pop edx ; high word
pop ecx ; low word
pop ebp
mov eax,edx
shr eax,010h
shl ecx,010h
or eax,ecx ; IDT address now in "eax"
mov IDTbase,eax
pop ecx




;_______________________________________________________
; Setup Page Fault

push edi
mov edi,IDTbase
push ds
mov ds,GlobalSel
mov eax, dword ptr ds: ;High word of 8 bytes
mov HwordpFault,eax
mov eax, dword ptr ds: ;IDT base + 70=
mov LwordpFault,eax ;Page Fault Exception
push ebx
xor ebx,ebx
push cs
pop ebx ;*
ror eax,010h
mov eax,PageFault ; location of new ISR
push ecx
mov ecx,LwordpFault
mov cx,ax
mov dword ptr ds:,ecx
mov ecx,HwordpFault
ror ecx,010h
shr eax,010h
mov cx,ax
rol ecx,010h
mov dword ptr ds:,ecx
pop ecx
pop ebx
pop ds
pop edi


PageFault: ;(ISR)

mov saveESI,esi
push ebp
mov ebp,esp
mov MSDW,eax
mov eax,dword ptr ss: :Eflags
mov Startflags,eax
mov eax,dword ptr ss: ; got address here
add eax,02h ; jmp over 2 byte instruction
mov dword ptr ss:,eax
pop ebp
mov eax, dword ptr ss: ;good EIP
mov GoodEIP,eax
pop eax ;flags
pop eax ;CS
pop eax ;EIP changed here
pop eax
mov ErrorCode,eax
mov eax,MSDW
mov esi,saveESI
jmp dword ptr

you need to restore interrupt vector table address when done:

restorePF:

push ds
mov ds,GlobalSel
push eax
push edi
mov eax,HwordpFault ; Restore Int vector
mov edi,IDTbase
mov dword ptr,eax
mov eax,LwordpFault
mov dword ptr ,eax
pop edi
pop eax
pop ds
Posted on 2003-11-15 10:51:02 by mrgone
snoopy, under windows you use GDI or DX (or OGL if you're one of those types). Simple as that.
Posted on 2003-11-15 11:47:37 by f0dder
I forgot about overlapping segments in 16 bit real mode programming. Anyway the actual physical address of the video memory starts at 000A0000h and it is remapped to 800A0000h. The Video memory obviously can't be paged out so you can write to it from Ring0. I just tried it and it worked fine. I drew a long black line which erased the top of the screen like this:



push ds
mov ds,10h
mov esi,0800A0000h
mov ecx,1000h
mov eax,0000h
Draw:
mov dword ptr ,eax
add esi,04h
loop Draw
pop ds

See fodder, no big VooDoo
Posted on 2003-11-18 01:27:15 by mrgone
I assume this question was for win32, as it's posted under the Main forum. And under win32, you don't do it that way. Period. Even if you go ring0 to draw to the screen (which is a rather mad thing to do), can you rely on the video memory being remapped to this exact addres? And all of the video memory? And how will you figure out the pixel format being used? And what state the graphics adapter is in?

I played a (slight) bit with kernel-mode graphics output on NT, and found that framebuffers where mapped at very different locations. I stopped working on the project, as it all became too messy - I didn't feel like deeply hooking the system, nor figuring out the kernel-mode GDI or DDraw components.
Posted on 2003-11-18 09:32:51 by f0dder
Writing to video memory is dangerous if you're under windows!
There's a whole lot of stuff in there in video memory you really shouldn't touch as chances are it'll crash the card.
DMA'd data, scatter-gather tables, display lists, z-buffers, and quite probably propriatory information.

There's a reason DX and openGL were designed as a HAL, it's because each IHV provide functions in different ways. Mess with the information that the driver puts in vid-mem, and it will crash! It's like loading softice and changing registers to random values.

If you really have to access the whole of video memory (rather than a small portion that legacy methods allow), you'll need to hand over cash and sign NDAs for the chosen hardware you want to mess around with. Even then, it will have to be within a simple OS, or no OS at all (windows is a complex beast).

Mirno
Posted on 2003-11-18 14:51:43 by Mirno
Hey Mirno,

He is not messing with the video memory and GPU states :grin: he is just directly writting to the video frame buffer (only THAT is mapped there),

no need to overestimate the things they say to you about "how bad it is to directly access video RAM",

Please do not place equal sign between the video framebuffer and other GPU memory/register/states/pipelines ... no matter what lies they say.... there is no clear TRUE logical explanation for the denial of direct video memory acces in today modern OSes :tongue:

What he presents here It is an interesting thing to know indeed .

But i agree with fodder:
It is not very nice, neither much usefull, to do so under win32 when there is a simple ::Lock of the primary surface in DirectDraw that will give you exactly the same thing... but with the advantage of OS compliant code and independence from hardware... not to metion that you do not have to hack your way into Ring0.

Pretty useless for your own simple/small OS ... since IN there YOU can decide where video RAM is located and what selectors to use for accesing it.
Posted on 2003-11-18 15:11:06 by BogdanOntanu
And the nice thing about using APIs is it's easy to get the pixel format too... and all the other nice information.
Posted on 2003-11-18 15:41:58 by f0dder
Believe me Bogdan, the frame buffer does contain those things under windows!
There was a time when graphics cards (some still do) have separate pools of memory for different things (like the Wildcat 7000 cards), but most now have a single unified pool of memory. A part of that will map into the VGA space, and is nice and safe to use under DOS, but under windows, the frame buffer contains the Z buffer, texture maps, DMA data (which may then be fed into the pipeline), cached pixel & vertex shader programs (which go into the GPU), chip states (for OGL, GDI, and DX renderer states, which can be fed into the pipeline), and a whole lot more which may be archetecture dependant (the kyro cards used binning for example, some of the bins may well be shunted out to memory, these are fed back into the pipeline).

If you overclock the memories of a graphics card it can and will crash if you overclock too much, this is because the memory gets corrupted, and fed back in to the chip. If you modify the frame buffer of the card while it runs in windows it can crash the card.

There is a true logical explanation for why you cannot access the frame buffer directly, it's because the format any data stored there can be in any format the IHV chooses, and you the programmer is kept from that by the API. The actual visual part of the frame buffer may not be RGBARGBARGBA, but RRRGGGBBBAAA for example. Having to hand code routines for individual graphics cards was a nightmare that for the most part ended with the death of MS-DOS, but as a consequence of the hardware getting so much more complicated, you've got to leave it in the hands of the people who built it to drive it.

Mirno
Posted on 2003-11-18 18:36:14 by Mirno
Well i know how to do it using DX. I just dont want the user to have to have DX installed for the program to run correctly. Am i assured that at least SOME version of DX will be installed on Win98 and on?
Posted on 2003-11-18 19:04:02 by Snoopy2K
Snoopy:
----------------
YES you are assured that at least some version of DirectX is installed with EVERY Windows starting from the first Win95 version. You only need IDirectDraw1 interfaces for geting a pointer to primary==framebuffer


Mirno:
----------
Sorry but i can not believe you :grin: because i know you are wrong

I have made my own OS and i can place the framebuffer at any address i like and i can write well past over it and nothing happens not crash no problems

Trust me ONLY the framebuffer is normaly mapped into memory space.

Man Think about it!
-The memory mapped into CPU space has to be provided with double acces: 1) from the CPU and 2) from the GPU --> this makes it 2xSlower that all other video memory.
-It will be a waste of CPU memory space (some new cards can have 128M of video RAM)
-It will reduce the speed of video card dramatically as the GPU is indeed able to perform extra fast texture and stuff operations BUT ONLY if it has the SINGLE acces of THAT zones of video RAM, or else it will have to wait for the CPU

Instead video cards map some texture/surface memory in CPU space when ::Lock is called to allow you to fill the texture with raw bitmap data and then unmap it and retract from any interaction with CPU address/data bus just imediately after you call ::Unlock. After this they have single/exclusive access to that area of video memory, you can NOT touch THAT even if you burn without a new ::Lock

(of course i am NOT talking about cheap system shared video memory all in one motherboards here)

If you overclock the video board 2 things will happen:
1)GPU might get hot and it will fail to execute instructions
2)Video RAM will get hot ar will NOT be able to keep in sync with either GPU or CPU

Unlikely common belief not the GPU is the problem here as its failure under well designed video drivers --aka ones that check for errors and do not expect execution for ever-- will result ONLY in Garbage ON SCREEN

However failure to sync with the CPU timmings will result in arbitrary data beeing placed on system bus and will soon triple fault the CPU (if you get lucky that is)
Or destroy the OS core components and result in an unreliable/unstable system

NO you CAN NOT crash the video card by directly modifying the framebuffer data, i do it every day and other do it also in their games and i never get a crash because of this (of course i use DX and not hacks to do this)

DMA is not used for "centurys" in video boards. They use IRQ just to signal ready for commands, quite useless also, many video boards can run perfectly without any DMA or IRQ.

Instead, today they use AGP acceleration to speed up System RAM to Video RAM while uploading texture data

The pipeline is executed from very high speed RAM that is never visible on the system bus. It is filled either byt GPU in/out commands or by special memory maped areas that are way away from framebuffer location

besides lies and miths, there is NO logical true reason for not alowing direct access to framebuffer

well to be honest by using dramatic optimisations via this... the drivers are capable to add 0.5% up to 1.0% speed-up but also cut tremendouse functionality off, mainly versatility and caps for new algorithms

There are many formats that a framebuffer can be presented to the programmer, and usually he can enumerate and choose the most suited for it application (check VESA docs but also DX docs)

This makes little up to NONE impact on video board as the hardware to deal with this different formats is trivial == just exchange some hard lines in the final output to DAC chip

Coding for different pixel and texture formats is not as complicated and certainly it did NOT kill DOS games or OS.

I will not be coding routines for each video board initializations and stuff (i will let DX do this for me)

I might just CHOOSE what texture/framebuffer format suits me best from the list presented as available by the video card and act acordingly-- no nightmare just FUN

Besides allmost all cards today support 16bits (5:6:5 or 5:5:5) or 32 bits or 24 bits not so many routines to code for... besides DX will do the conversions for you if YOU so like it... AT worst IF i am so stupid to want to support ALL above by hand i will just have to write 4 (four) ROUTINES, i am sure it's a huge number :tongue:

The hardware is not geting so much complicated it is just going more and more secret that is all, its is the ideea that big companys exchange informations at barter basis while individuals and small companys are left to die slowly and feed with garbage and lies and myths.

It is utterly sad that they also choose to believe lies and then promote them... but such is life...

Basically nVidia itself was easy cought cheating and directly accessing framebuffer and /or not clearing it completly in between frames in order to cheat at 3D benchmarks, this is the only thing that happens IF you let the "profesionalls" do it,

They just need more money like everybody else :P

So they will not have any new surprises from somebody doing something beautiful and new ... somewhere in a small garage :grin: never again
Posted on 2003-11-18 19:58:31 by BogdanOntanu
IT'll be hard to do it without DX, its some pretty nasty stuff, but mrgone's trick looks like fun, I'm gonna try it just for kicks. :D

If it screws up my PC I'm coming after you mrgone >=| =P (joking!)
Posted on 2003-11-18 21:41:39 by x86asm
You all are scaring me. I was just trying to help Snoopy. Bogdan you are right though. It is alot of garbage to dig through but the internet is cheap compared to buying all thoughs books. I guess that's the trade off.
Posted on 2003-11-19 03:39:03 by mrgone
mrgone: You are the MAN!! :)))
Thank you for the code!!!!

I've experienced with your source under W2K and XP without problems when I stay into the 10000h limit.
I fear that it is only a 64k segment because when I attempted to treat it as a linear framebuffer, I corrupted the core of the system....i.e. I was unable to turn off my pc by using the power switch!!!!!!
I had literally to unplug the cable!

push ds
mov ax, 10h
mov ds, ax
mov esi,0800A0000h
mov ecx, 1000h; OK
;mov ecx,10000h; 65536 Don't exceed this limit!
;mov ecx,300000h; To off the PC you need unplugging the cable!!!!!
mov eax,0000h
Draw:
mov dword ptr ,eax
add esi,04h
rdtsc;add eax,04h; variations on the theme.....
loop Draw
pop ds

Then I attempted to call it periodically by a ring3 timer which calls the code at ring0....it worked for a while, and it finished up corrupting iexplore.exe without preventing me from using task manager and other stuff....

So...I hope to continue experiencing with this video memory, and I hope to find a LFB or I'll have to deal with video pages...

A question about this instruction which generates an error under MASM32: how can I translate it?
mov eax, dword ptr ss: ;good EIP

Bogdan:

I agree with you...and I remember those good old days when APPLEs came out from garages....:)
Posted on 2003-11-19 04:20:01 by fooCoder
Ok GoodEIP is the faulting instruction address pulled off the stack. You can get it from CR2 reg also.
The offset 10000h is linear address 800B0000h. Below I did a read starting at 800AF000h so we can see that something is indeed going on there as you said. I would interpret that as "Interleave" or "Interlace". That means you would have to jump to another memory block to continue writing.
I am not working in the video right now. I got my hands full tracking GlobalAlloc blocks of memory. It seems Windows Allocates memory using "GlobalAlloc" as a 4Meg page but I find 4K pieces spread out all around 1st 4K and even crossing into other 4Meg pages. Another dirty trick!


00000000 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000010 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000020 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000030 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000040 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000050 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000060 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000070 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000080 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000090 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
000000A0 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
000000B0 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
000000C0 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
000000D0 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
000000E0 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
000000F0 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000100 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000110 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000120 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000130 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000140 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000150 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000160 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000170 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000180 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000190 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
000001A0 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
000001B0 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
000001C0 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
000001D0 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
000001E0 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
000001F0 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000200 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000210 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000220 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000230 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000240 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000250 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000260 D4 80 80 80 40 40 40 C3-B3 A3 C3 B3 A3 C3 B3 A3 ....@@@.........
00000270 C1 B1 A0 C1 B1 A0 C1 B1-A0 C1 B1 A0 C1 B1 A0 C1 ................
00000280 B1 A0 C1 B1 A0 C1 B1 A0-C1 B1 A0 C1 B1 A0 C1 B1 ................
00000290 A0 C1 B1 A0 C1 B1 A0 C1-B1 A0 C1 B1 A0 C1 B1 A0 ................
000002A0 C2 B2 A1 C2 B2 A1 C2 B2-A1 C2 B2 A1 C2 B2 A1 C2 ................
000002B0 B2 A1 C2 B2 A1 C2 B2 A1-C1 B1 A0 C1 B1 A0 C1 B1 ................
000002C0 A0 C1 B1 A0 C1 B1 A0 C1-B1 A0 C1 B1 A0 C1 B1 A0 ................
000002D0 C2 B2 A1 C2 B2 A1 C2 B2-A1 C2 B2 A1 C2 B2 A1 C2 ................
000002E0 B2 A1 C2 B2 A1 C2 B2 A1-C0 B0 9F C0 B0 9F C0 B0 ................
000002F0 9F C0 B0 9F C0 B0 9F C0-B0 9F C0 B0 9F C0 B0 9F ................
00000300 C2 B0 9F C4 B0 9F C4 B0-9F C4 B0 9F C4 B0 9F C4 ................
00000310 B0 9F C4 B0 9F C4 B0 9F-C0 AC 9B C0 AC 9B C0 AC ................
00000320 9B C0 AC 9B C0 AC 9B C0-AC 9B C0 AC 9B C0 AC 9B ................
00000330 BF AB 9A BF AB 9A C0 AC-9B C0 AC 9B C0 AC 9B C0 ................
00000340 AC 9B C0 AC 9B C0 AC 9B-BE AA 99 BE AA 99 BE AA ................
00000350 99 BE AA 99 BE AA 99 BE-AA 99 BE AA 99 BE AA 99 ................
00000360 BF A9 97 BE A8 96 BE A8-96 BE A8 96 BD A7 95 BD ................
00000370 A7 95 BC A6 94 BC A6 94-BC A6 94 BB A5 93 BB A5 ................
00000380 93 BB A5 93 BA A4 92 BA-A4 92 B9 A3 91 B9 A4 8F ................
00000390 BD A4 90 BC A4 8E BC A4-8E BB A3 8D B9 A1 8B B8 ................
000003A0 A0 8A B8 A0 8A B7 9F 89-B6 9E 88 B5 9D 87 B3 9B ................
000003B0 85 B2 9A 84 B2 9A 84 B2-9A 84 B2 9A 84 B3 9B 85 ................
000003C0 C8 D0 D4 FF FF FF C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
000003D0 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
000003E0 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
000003F0 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000400 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000410 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000420 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000430 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000440 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000450 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000460 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000470 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000480 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000490 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
000004A0 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
000004B0 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
000004C0 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
000004D0 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
000004E0 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
000004F0 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000500 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000510 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000520 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000530 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000540 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000550 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000560 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000570 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000580 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000590 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
000005A0 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
000005B0 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
000005C0 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
000005D0 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
000005E0 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
000005F0 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000600 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000610 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000620 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000630 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000640 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000650 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000660 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000670 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000680 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000690 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
000006A0 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
000006B0 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
000006C0 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
000006D0 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
000006E0 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
000006F0 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000700 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000710 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000720 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000730 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000740 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000750 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000760 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000770 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000780 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000790 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
000007A0 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
000007B0 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
000007C0 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
000007D0 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
000007E0 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
000007F0 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000800 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000810 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000820 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000830 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000840 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000850 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000860 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000870 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000880 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000890 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
000008A0 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
000008B0 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
000008C0 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
000008D0 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
000008E0 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
000008F0 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000900 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000910 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000920 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000930 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000940 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000950 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000960 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000970 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000980 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000990 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
000009A0 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
000009B0 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
000009C0 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
000009D0 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
000009E0 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
000009F0 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000A00 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000A10 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000A20 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000A30 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000A40 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000A50 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000A60 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000A70 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000A80 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000A90 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000AA0 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000AB0 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000AC0 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000AD0 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000AE0 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000AF0 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000B00 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000B10 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000B20 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000B30 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000B40 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000B50 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000B60 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000B70 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000B80 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000B90 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000BA0 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000BB0 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000BC0 D4 80 80 80 40 40 40 C4-B4 A4 C4 B4 A4 C4 B4 A4 ....@@@.........
00000BD0 C1 B1 A0 C1 B1 A0 C1 B1-A0 C1 B1 A0 C1 B1 A0 C1 ................
00000BE0 B1 A0 C1 B1 A0 C1 B1 A0-C1 B1 A0 C1 B1 A0 C1 B1 ................
00000BF0 A0 C1 B1 A0 C1 B1 A0 C1-B1 A0 C1 B1 A0 C1 B1 A0 ................
00000C00 C2 B2 A1 C2 B2 A1 C2 B2-A1 C2 B2 A1 C2 B2 A1 C2 ................
00000C10 B2 A1 C2 B2 A1 C2 B2 A1-C1 B1 A0 C1 B1 A0 C1 B1 ................
00000C20 A0 C1 B1 A0 C1 B1 A0 C1-B1 A0 C1 B1 A0 C1 B1 A0 ................
00000C30 C2 B2 A1 C2 B2 A1 C2 B2-A1 C2 B2 A1 C2 B2 A1 C2 ................
00000C40 B2 A1 C2 B2 A1 C2 B2 A1-C1 B1 A0 C1 B1 A0 C1 B1 ................
00000C50 A0 C1 B1 A0 C1 B1 A0 C1-B1 A0 C1 B1 A0 C1 B1 A0 ................
00000C60 C3 B1 A0 C3 B1 A0 C3 B1-A0 C3 B1 A0 C3 B1 A0 C3 ................
00000C70 B1 A0 C3 B1 A0 C3 B1 A0-BF AD 9C BF AD 9C BF AD ................
00000C80 9C BF AD 9C BF AD 9C BF-AD 9C BF AD 9C BF AD 9C ................
00000C90 BE AC 9B BE AC 9B BE AC-9B BE AC 9B BE AC 9B BE ................
00000CA0 AC 9B BE AC 9B BE AC 9B-BD AB 9A BD AB 9A BD AB ................
00000CB0 9A BD AB 9A BD AB 9A BD-AB 9A BD AB 9A BF AB 9A ................
00000CC0 BF A9 97 BF A9 97 BF A9-97 BE A8 96 BD A7 95 BD ................
00000CD0 A7 95 BD A7 95 BC A6 94-BC A6 94 BC A6 94 BC A6 ................
00000CE0 94 BB A5 93 BA A4 92 BA-A4 92 BA A4 92 B9 A4 8F ................
00000CF0 BD A4 90 BC A4 8E BC A4-8E BB A3 8D B9 A1 8B B8 ................
00000D00 A0 8A B8 A0 8A B7 9F 89-B7 9F 89 B6 9E 88 B4 9C ................
00000D10 86 B3 9B 85 B2 9A 84 B2-9A 84 B3 9B 85 B4 9C 86 ................
00000D20 C8 D0 D4 FF FF FF C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000D30 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000D40 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000D50 C8 D0 D4 C8 D0 D4 80 80-80 C8 D0 D4 C8 D0 D4 C8 ................
00000D60 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000D70 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000D80 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000D90 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000DA0 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000DB0 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000DC0 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000DD0 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000DE0 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000DF0 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000E00 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000E10 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000E20 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000E30 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000E40 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000E50 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000E60 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000E70 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000E80 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000E90 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000EA0 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000EB0 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000EC0 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000ED0 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000EE0 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000EF0 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000F00 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000F10 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000F20 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000F30 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000F40 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000F50 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000F60 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000F70 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000F80 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000F90 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000FA0 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000FB0 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000FC0 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00000FD0 D0 D4 C8 D0 D4 C8 D0 D4-C8 D0 D4 C8 D0 D4 C8 D0 ................
00000FE0 D4 C8 D0 D4 C8 D0 D4 C8-D0 D4 C8 D0 D4 C8 D0 D4 ................
00000FF0 C8 D0 D4 C8 D0 D4 C8 D0-D4 C8 D0 D4 C8 D0 D4 C8 ................
00001000 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001010 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001020 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001030 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001040 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001050 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001060 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001070 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001080 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001090 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000010A0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000010B0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000010C0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000010D0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000010E0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000010F0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001100 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001110 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001120 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001130 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001140 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001150 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001160 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001170 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001180 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001190 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000011A0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000011B0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000011C0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000011D0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000011E0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000011F0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001200 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001210 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001220 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001230 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001240 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001250 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001260 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001270 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001280 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001290 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000012A0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000012B0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000012C0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000012D0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000012E0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000012F0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001300 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001310 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001320 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001330 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001340 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001350 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001360 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001370 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001380 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001390 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000013A0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000013B0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000013C0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000013D0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000013E0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000013F0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001400 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001410 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001420 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001430 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001440 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001450 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001460 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001470 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001480 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001490 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000014A0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000014B0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000014C0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000014D0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000014E0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000014F0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001500 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001510 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001520 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001530 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001540 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001550 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001560 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001570 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001580 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001590 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000015A0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000015B0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000015C0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000015D0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000015E0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000015F0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001600 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001610 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001620 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001630 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001640 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001650 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001660 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001670 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001680 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001690 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000016A0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000016B0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000016C0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000016D0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000016E0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000016F0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001700 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001710 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001720 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001730 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001740 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001750 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001760 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001770 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001780 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001790 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000017A0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000017B0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000017C0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000017D0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000017E0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
000017F0 FF FF FF FF FF FF FF FF-FF FF FF FF FF FF FF FF ................
00001800
Posted on 2003-11-19 10:47:53 by mrgone
Xcuse me mrgone the link you posted dont relates to 0x800A0000 does it?
its just how to write at 0xA0000 under dos... or am i wrong?
And why do you need all this(set a page fault...) under dos wihle you can use unreal mode?(I dont know about exception, paging...)

And why do you say to put 0x10 in ds? is it a selector of a desc with a zero base addr under win?
even then you where you you can not write to a specific PHYSICAL addr can you?

If so you can just write to 0xA0000 instead, its just the standard 64kb mem window of the vga... and above there are bios routines eeprom etc... (the 1st meg).
Didnt know it 0xA0000 also always was the beginning of lfb... but when you say "remapped" do you mean by the chipset ?? by win? HOW did you learn that?? and there are only the 1st 64k like under the 1st meg??

My ideas for accessing the lfb:

you can make a dos prog (is it possible to call a dos prog from a win PE and come back?) (even a .com) that calls int0x10 vesa get info, to know the addr of lfb, but its physical so under win you dont know where it is; you can go ring0 to map it to physical? (i dunno jack about that) and then access it direcly with a zero based seg.

Or if you went in ring0, hey, who cares about dos progs? you just jump in 16b seg and call int!! :)

Or you can do the same with a dos dpmi exe, you call int 0x10 , get lfb_physical, call dpmi(getmemblock) and dpmi(map_linear_to physical) then use your allocated mem to write to lfb without having called the vesa setmode... do you think it will go on the screen of windows direcly? great!! It must be possible, many demos used dpmi and vesa2.0 and work under win "dos" emu, the only thing is they call vesa setmode before writing...:)

I would love to try but I badly lack knowledge of dpmi and behavior of dos progs in the NTdosvirtualmachine.

Who would have thought you could do more things with the dos emulation system than with a win32 PE?
But maybe I m wrong and you cant because the dos emu has restrictions... for ex. you cant trash your bootsector by calling int0x13 bios sector write can you??

Maybe also the lfb returned by int0x10 is not the same that the one used in win graphic modes... maybe even its not valid until the vesa setmode!(but I think and hope it is)

Tell me what do you think of these methods guys please and correct me if I m wrong!
Posted on 2003-11-19 11:16:32 by HeLLoWorld
0xB0000 is the start of text mem under dos I think, or is it 0xB8000?
Anyway that makes sense for a dos programmer... I wonder if its some parts of vram that are remapped high to 0x800A0000 and so on, like you say(where did you see that?) ...

... or (tilt!) arent you reading the 1st meg of linear addr space???? just an idea. maybe the last bit of addr bus is irrelevant under win, or has another meaning, just supposing. after all, who has 4Gb of mem? (ok, some will come up and say "me!", but I dont think motherboard support it.:)

All this is very interesting to me .

btw a big question comes to my head: theres a dpmi server integrated in win, isnt it? how does it relates to the dos realmode emu system??
are 32b (or 16b) dpmi progs running in v86 mode like other dos progs, or is it special?
can v86 have cs with 32b?

hah, what a mess with dos, win, processor modes and addr schemes, all this for compatibility...
But how interesting I find it!
I really knew nothin before (and REALLY nothin) when I started, saw win, dos, dosboxes, textmodes-apps runnin in windows(although they thougt they write directly to textvideomem , or write directly to their RM IDT...)(even though i started with dos)

Heck, emulation coupled to multitasking is a big mess!
Now i still dont know much, but i can see what i know and what i dont know... (well, at least a part of it:)
Posted on 2003-11-19 11:35:45 by HeLLoWorld