I take it you're using an ISO. Wouldn't be easier to just examine the disk images in OS2IMAGE rather then the floppy images?
I've recently learned about something called TTD (
Time Travel Debugging, which I think I mentioned elsewhere). It's a system where the entire state of the CPU is captured (Microsoft uses a "soft machine" (like Bochs) to capture it, but it can also be captured using a facility/feature of the x86 CPU, which is the ability to single-step every instruction by setting a flag value to signal an INT 1 interrupt).
I'd like to ultimately develop a set of primitive tools to enable this capture ability (initially across a COM port at bootup, then eventually to local disk files once drivers are loaded), to allow everything the CPU does to be intercepted, with all memory reads/writes being captured, and then an optional bit of storage to capture physical register changes as well as flags.
By doing this, any OS to be examined for security research would only need to be booted and arrive at the user interaction state. It would capture the entire range of everything in memory, how it got there, which instruction did it, and everything. This would allow for a comprehensive post-mortem analysis of the system after the fact. Every aspect of which logic was chosen at each branch, how structures were updated, etc., would be captured.
It would then become a process of mining that operation to follow branches algorithmically, to categorize them, prioritize them as items of interest (oft-called, central branching points, etc.), and to extrapolate from the code being run exactly what is happening where, why, when, and how often.
I've never done this before, so I'm charting new waters.
I would prefer to modify a version of Bochs to handle this all virtually for me, but I've never been able to get Bochs setup to properly run / boot / install OS/2. It's always reported a fatal error at some point.
In the alternative, Microsoft uses a custom-built virtual machine for this purpose. It is integrated seamlessly with Windows and allows the full host of host machine attributes being exposed tot he virtual machine, so that when you create a Window it actually displays on the screen, you can interact with keyboard, mouse, network, etc. It's quite a thing.
In any event, my goal is that instruction-by-instruction capture. If I can do it with INT 1 it would be great because that facility would work on any machine, but bet slow (probably 200-500x slower than normal, so a normal 45 second boot would take over 6 hours). But, it would only need to be done one time on each fixpack revision once everything is setup properly.
We'll see. I'm in uncharted waters here (at least with regards to my own experience / expertise). I proceed now only operating in theory, and it will require trial and error. I will post my efforts / attempts / results as I go though.
Remember also, the goal here is security research. I'm looking for where there are fatal flaws that could impact users resulting in data corruption, or the ability for some malicious software to take over / damage the system in some way.
