Question

I know I succeed in writing my code to that address using int 13h because I can see it at that memory location. What I can’t do is jump there.

I put 0x1000 (three zeros there) into es and 0x0000 into bx and I know that [es:bx] means the address calculated by (es * 0x10) + bx which does equal 0x10000 (four zeros there). But eip, the instruction pointer, never does go there.

I’ve tried jmp [es:bx], jmp 0x1000:0x0000, and a bunch of other permutations that NASM doesn’t even accept.

My boot loader as it currently is (which still isn’t working) is here. I booted it up in Qemu and did a memsave on the first 50 bytes at 0x10000, opened it up with tweak, and saw my “kernel” code there (simple . But EIP still refuses to be 0x10000, or reach it and then hang where I want it, is what I mean). Full images of the situation here

Answer 1

A far jump can’t use use a memory location just for the segment. Here are several ways you can do it:

1) simple hardcoded address for both segment and offset.

jmp 0x1000:0

2) indirect jump using a full address:

entry dw 0x0000 ; offset
      dw 0x1000 ; segment

jmp far dword ptr [entry] ; far jump (syntax might differ)

3) a far return

push SYSADDR ; segment
push 0       ; offset
retf         ; far return

A common trick used in DOS time was patching the intruction:

  mov ax, SYSADDR
  mov word ptr [myjump+3], ax
myjump:
  jmp 0x0000:0x0000

or using a part of it as a variable:

myjump:
  db 0xEA           ; far jmp opcode 
  dw 0x0000         ; offset part
  SYSADDR dw 0x1000 ; segment part

Disclaimer: all of the aboves come from memory and I might have gotten some parts wrong (e.g. the order of segment/offset was very confusing).