引用 6 楼 baiminsheng 的回复: 下面是blcommon.c中的BootloaderMain代码 void BootloaderMain (void) { ? ? DWORD dwAction;? ? ? DWORD dwpToc = 0; ? ? DWORD dwImageStart = 0, dwImageLength = 0, dwLaunchAddr = 0; ? ? BOOL bDownloaded = FALSE; ? ? // relocate globals to RAM ? ? if (!KernelRelocate (pTOC)) ? ? { ? ? ? ? // spin forever ? ? ? ? HALT (BLERR_KERNELRELOCATE); ? ? } ? ? // (1) Init debug support. We can use OEMWriteDebugString afterward. ? ? if (!OEMDebugInit ()) ? ? { ? ? ? ? // spin forever ? ? ? ? HALT (BLERR_DBGINIT); ? ? } ? ? // output banner ? ? EdbgOutputDebugString (NKSignon, CURRENT_VERSION_MAJOR, CURRENT_VERSION_MINOR); ? ? // (3) initialize platform (clock, drivers, transports, etc) ? ? if (!OEMPlatformInit ()) ? ? { ? ? ? ? // spin forever ? ? ? ? HALT (BLERR_PLATINIT); ? ? } ? ? // system ready, preparing for download ? ? EdbgOutputDebugString ("System ready!\r\nPreparing for download...\r\n"); ? ? // (4) call OEM specific pre-download function ? ? switch (dwAction = OEMPreDownload ()) ? ? { ? ? case BL_DOWNLOAD: ? ? ? ? // (5) download image ? ? ? ? if (!DownloadImage (&dwImageStart, &dwImageLength, &dwLaunchAddr)) ? ? ? ? { ? ? ? ? ? ? // error already reported in DownloadImage ? ? ? ? ? ? SPIN_FOREVER; ? ? ? ? } ? ? ? ? bDownloaded = TRUE; ? ? ? ? // Check for pTOC signature ("CECE") here, after image in place ? ? ? ? if (*(LPDWORD) OEMMapMemAddr (dwImageStart, dwImageStart + ROM_SIGNATURE_OFFSET) == ROM_SIGNATURE) ? ? ? ? { ? ? ? ? ? ? dwpToc = *(LPDWORD) OEMMapMemAddr (dwImageStart, dwImageStart + ROM_SIGNATURE_OFFSET + sizeof(ULONG)); ? ? ? ? ? ? // need to map the content again since the pointer is going to be in a fixup address ? ? ? ? ? ? dwpToc = (DWORD) OEMMapMemAddr (dwImageStart, dwpToc + g_dwROMOffset); ? ? ? ? ? ? EdbgOutputDebugString ("ROMHDR at Address %Xh\r\n", dwImageStart + ROM_SIGNATURE_OFFSET + sizeof (DWORD)); // right after signature bms ? ? ? ? } ? ? ? ? // fall through ? ? case BL_JUMP: ? ? ? ? // Before jumping to the image, optionally check the image signature. ? ? ? ? // NOTE: if we haven't downloaded the image by now, we assume that it'll be loaded from local storage in OEMLaunch (or it ? ? ? ? // already resides in RAM from an earlier download), and in this case, the image start address might be 0.? This means ? ? ? ? // that the image signature routine will need to find the image in storage or in RAM to validate it.? Since the OEM"s ? ? ? ? // OEMLaunch function will need to do this anyways, we trust that it's within their abilities to do it here. ? ? ? ? // ? ? ? ? if (g_bBINDownload && g_pOEMCheckSignature) ? ? ? ? { ? ? ? ? ? ? if (!g_pOEMCheckSignature(dwImageStart, g_dwROMOffset, dwLaunchAddr, bDownloaded)) ? ? ? ? ? ? ? ? HALT(BLERR_CAT_SIGNATURE); ? ? ? ? } ? ? ? ? // (5) final call to launch the image. never returned ? ? ? ? OEMLaunch (dwImageStart, dwImageLength, dwLaunchAddr, (const ROMHDR *)dwpToc); ? ? ? ? // should never return ? ? ? ? // fall through ? ? default: ? ? ? ? // ERROR! spin forever ? ? ? ? HALT (BLERR_INVALIDCMD); ? ? } } 现在程序已经执行通过了DownloadImage函数，运行到了OEMMapMemAddr函数以后 就进入了该函数里面了。并且运行到? ? ? ? ? ? EdbgOutputDebugString ("ROMHDR at Address %Xh\r\n", dwImageStart + ROM_SIGNATURE_OFFSET + sizeof (DWORD));的时候就在超级终端显示了ROMHDR at Address 80201044h 就不动了，能给出进一步的解释吗？谢谢了