📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

Blogs >> zen's Blog

Created: Friday, October 14 2005 12:34.03 CDT Modified: Saturday, October 15 2005 16:42.28 CDT
Printer Friendly ...
I guess I'll put a some code here...
Author: zen # Views: 630

30 Byte Demo

Sometime in the last year or so a friend on IRC mentioned he had written something for a sort of contest to write to coolest MS-DOS graphics demo. The catch was you only had 32 bytes. The contest was over by the time I heard about it, and it's been a while since then and I have no idea which site it was now, but here is some code I wrote that, IMNSHO, kicked the butts of all the entries in that contest.

In order to fully appreciate it, make sure you let it color cycle once thry the 256 colors. You'll know when it's getting good. ;]

                                                          
mov ax,13h           ; al =0x13 , ah = 0
int 10h              ; set video mode 0x13 (320x200x8bit)
mov bx,0a000h        ; address a000:0000  == start of VGA memory
mov ds,bx            ; so set the data segment to be that
xor cx,cx            ; give me something to be 0
top_of_loop:
mov al,[si]          ; grab one byte from video memory
inc ax               ; increment the word, not the byte
add al,ah            ; and add any overflow to the value (clever part ;])
mov [si], al         ; store it back in video ram
inc si               ; curpixel++
cmp si, 0fa00h       ; curpixel != 64000 == 320 * 200 ?
jnz top_of_loop      ; if so, do the next pixel
mov si,cx            ; otherwise, reset curpixel
jmp top_of_loop      ; and start from top of screen
                                                                                
                                                                                
I wrote this in a short space of time, and didn't really debug it very well. Now that I look at the commented version I just made of it, I can
see a few subtle things that could've made it better.

I'll quickly make some changes, and see how it looks.

.... some times passes ;] ...

Ok... Now it is a
28 Byte Demo

                                                          
mov ax,13h           ; al =0x13 , ah = 0
int 10h              ; set video mode 0x13 (320x200x8bit)
mov bx,0a000h        ; address a000:0000  == start of VGA memory
mov ds,bx            ; so set the data segment to be that
init_loop:
xor si,si            ; intialize the screen pointer
top_of_loop:
mov al,[si]          ; grab one byte from video memory
inc ax               ; increment the word, not the byte....
add al,ah            ; and add any overflow to the value (clever part ;])
mov [si], al         ; store it back in video ram
inc si               ; curpixel++
cmp si, 0fa00h       ; curpixel != 64000 == 320 * 200 ?
jnz top_of_loop      ; if so, do the next pixel
jmp init_loop      ; and start from top of screen
                                                                                
                                                                                
All I did was optimize out the the temporary cx variable.

How it works


/*
* You shouldn't expect this to actually work as C, but
* it should give you a rough idea.
*/
setGraphicsMode(0x13);
char *a000=address_at_start_of_16bit_segment(0xa000);

while(1) // nearly forgot the important part
{
for(i=0;i<64000;i++)
{
  ax[1]=a000[i];
  ax++;    // ax == (ah<<8)|al   if al > 0xff, then al = 0, ah++
  al=al+ah;
  a000[i]=al;
}
}


Notice that ah is never being reset... once it starts to increase, it will continue to... lets imagine a simple screen where all the values are up to 0xff


| 0|   1    2    3
0xff 0xff 0xff 0xff  <- video memory
SI=0x0000
mov al,[si] -> AX=0x00FF  AH=0x00  AL=0xFF
inc ax      -> AX=0x0100  AH=0x01 AL=0x00
add al,ah   -> AX=0x0101
mov [si],al
inc si

so now the state looks like this:

  0  | 1|   2    3
0x01 0xff 0xff 0xff
SI=0x0001
mov al,[si] -> AX=0x01FF  AH=0x01  AL=0xFF
inc ax      -> AX=0x0200  AH=0x02 AL=0x00
add al,ah   -> AX=0x0202
mov [si],al
inc si

and one more time, so you see the pattern...

  0    1  | 2|   3
0x01 0x02 0xff 0xff
SI=0x0002
mov al,[si] -> AX=0x00FF  AH=0x00  AL=0xFF
inc ax      -> AX=0x0300  AH=0x03 AL=0x00
add al,ah   -> AX=0x0303
mov [si],al
inc si
  0    1    2  | 3|
0x01 0x02 0x03 0xff

The next time around, things get even more complex. Iterative generated chaotic stuff.

This is what makes it interesting. ;]




Add New Comment
Comment:









There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit