Re: Resident code?

Hello f0dder,

f0dder wrote:
> > 3)
> > When WinNT loads, how does it address disks? Does it still use INT13
> > or it does that through its own I/O to the disk ?
> >
> > At what stages of windowsNT loading does the INT13 (provided by the
> > BIOS) stop functioning?
>
> For IDE disks, NTLDR switches between PM and RM to do int13 calls while
> loading boot-time drivers. Once boot-time drivers are loaded, it then has
> native support for the disk (whatever kind of disk it might be), and then
> stops using the BIOS.

>
> If you want to do boot-time full-hdd encryption, you thus need both resident
> boot-code from the MBR, as well as a filter driver that layers on the disk
> driver used.
>

Yes, that's what I figured, but I wasn't sure when the BIOS INT13h
support is dropped and at what stage the drivers will take place.

How can one make sure?

> You can have a look at how DriveCrypt handles this (interesting journey),
> and there's also a sourceforge project or two that does full-hdd
> encryuption.

I'ld love to study these projects, do you have names / links?

Thanks for your insights,

Elias

.

Relevant Pages