1. Skip to content

1. Drivers

{% macro nameTable(name, guid=None) %}

1.0.1 Device registrations

Device Name {% if name %}`\Device\{{ name }}`{% endif %}
Linked To {% if name %}`\DosDevices\{{name}}` (`\\.\{{name}}`){% endif %}
Device GUID {% if guid %}`{{ "{" }}{{ guid }}{{ "}" }}`{% endif %}

Ring* systems makes use of a number of (mostly) bespoke drivers, listed below:

  • `geminifs.sys`
  • `kbfilter.sys`
  • `columba.sys`
  • `mxcmos.sys`
  • `mxhwreset.sys`
  • `mxjvs.sys`
  • `mxparallel.sys`
  • `mxsmbus.sys`
  • `mxsram.sys`
  • `mxsram_pci_isa_bridge.sys`
  • `mxsram_pcmcia.sys`
  • `mxsuperio.sys`
  • `mxusbdevice.sys`

1.1 kbfilter

kbfilter is a service responsible for blocking keyboard input.

The driver can be disabled by setting FilterEnable at HKLM\System\CurrentControlSet\Services\kbfilter\Parameters to 0.

1.2 geminifs

GeminiFS is a custom filesystem driver used by the games to construct the X: mountpoint.

1.3 columba

Columba is a driver used to fetch DMI information about the current system.

{{ nameTable(“columba”) }}

1.3.1 IO control codes

IOCTL Code #define Bytes in Bytes out Meaning
`0x9c406104` `{{ ioctl("0x9c406104") }}` Read the DMI at a given offset

1.4 mxcmos

mxcmos is unknown currently

1.5 mxhwreset

This driver is used exclusively to power cycle the PC.

{{ nameTable(“mxhwreset”) }}

1.5.1 IO control codes

IOCTL Code #define Bytes in Bytes out Meaning
`0x9c402000` `{{ ioctl("0x9c402000") }}` 0 0 Writes `0xE` to PORT `0xCF9`, causing a power cycle.

1.6 mxjvs

mxjvs is the driver used to communicate with the JVS IO board connected to the Ring* PC via the JVS USB port.

{{ nameTable(“mxjvs”) }}

1.6.1 IO control codes

IOCTL Code #define Bytes in Bytes out Meaning
`0x9c402000` `{{ ioctl("0x9c402000") }}` _variable_ _variable_ Exchange JVS packets with the JVS IO board

1.6.2 Extra values used, currently unknown

  • `\Device\Serial3`
  • `{86e0d1e0-8089-11d0-9ce4-08003e301f73}`

1.7 mxparallel

mxparallel is a wrapper driver for the parallel port used to communicate with the keychip

{{ nameTable(“mxparallel”) }}

1.7.1 IO control codes

IOCTL Code #define Bytes in Bytes out Meaning
`0x9c40a000` `{{ ioctl("0x9c40a000") }}` Write data
`0x9c406004` `{{ ioctl("0x9c406004") }}` Read data
`0x9c40a008` `{{ ioctl("0x9c40a008") }}` Write status
`0x9c40600c` `{{ ioctl("0x9c40600c") }}` Read status
`0x9c40a010` `{{ ioctl("0x9c40a010") }}` Write control
`0x9c406014` `{{ ioctl("0x9c406014") }}` Read control
`0x9c40a018` `{{ ioctl("0x9c40a018") }}` Write flags
`0x9c40601c` `{{ ioctl("0x9c40601c") }}` Read flags

1.7.2 Ports used

  • `\Device\ParallelPort0`

1.8 mxsmbus

This driver communicates with the system message bus chip on the motherboard. This driver appears to be a slightly modified reference driver from Intel. The exact chipset used varies depending on the system:

RingWide Intel(R) 82801G(ICH7 Family)SMBus Controller
RingEdge Intel(R) ICH9 SMBus Controller
RingEdge 2 Intel(R) 5 Series/3400 Series Chipset Family SMBus Controller

Devices currently confirmed to be located on the system message bus:

Address Device
`0x20` PCA9535; used for DIP switches
`0x30`
`0x55`
`0x57` EEPROM

{{ nameTable(None, “5c49e1fe-3fec-4b8d-a4b5-76be7025d842”) }}

1.8.1 IO control codes

IOCTL Code #define Bytes in Bytes out Meaning
`0x9c406000` `{{ ioctl("0x9c406000") }}` 0 4 Not totally understood, but appears to retrieve the port number
`0x9c402004` `{{ ioctl("0x9c402004") }}` 25~h~ 25~h~ Exchange data over the smbus
`0x9c406008` `{{ ioctl("0x9c406008") }}` 0 4 Retrieve the driver version
`0x9c40200c` `{{ ioctl("0x9c40200c") }}` 27~h~ 27~h~ Exchange data with an I2C device over the smbus

1.8.2 Ports used

Unsure

1.9 mxsram

The on-board SRAM. This device driver also supports reading and writing like a file.

{{ nameTable(“mxsram”) }}

1.9.1 IO control codes

IOCTL Code #define Bytes in Bytes out Meaning
`0x70000` `IOCTL_DISK_GET_DRIVE_GEOMETRY` 0 18~h~
`0x7405c` `IOCTL_DISK_GET_LENGTH_INFO` 0 8
`0x9c406000` `{{ ioctl("0x9c406000") }}` Ping
`0x9c406004` `{{ ioctl("0x9c406004") }}` Get sector size
`0x9c406008` `{{ ioctl("0x9c406008") }}` Get version

1.9.2 Ports used

  • `\Device\memcard0`

1.10 mxsram_pci_isa_bridge

mxsram_pci_isa_bridge is unknown currently

1.11 mxsram_pcmcia

mxsram_pcmcia is unknown currently

1.12 mxsuperio

This driver communicates with some additional on-board devices. Notably EEPROM and the W83791D hardware monitor.

{{ nameTable(“mxsuperio”) }}

1.12.1 IO control codes

IOCTL Code #define Bytes in Bytes out Meaning
`0x9c406000` `{{ ioctl("0x9c406000") }}` Ping
`0x9c402004` `{{ ioctl("0x9c402004") }}` Read
`0x9c40a008` `{{ ioctl("0x9c40a008") }}` Write
`0x9c40200c` `{{ ioctl("0x9c40200c") }}` Hardware monitor Read
`0x9c40a010` `{{ ioctl("0x9c40a010") }}` Hardware monitor write

1.12.2 Ports used

  • ``

1.13 mxusbdevice

Monitors connected devices to the system, and when a device connects matching the GUID_DEVINTERFACE_USB_DEVICE class ({a5dcbf10-6530-11d2-901f-00c04fb951ed}) it checks the VID and PID. If it matches a pair it has been instructed to scan for, it increments the count and informs the caller.

{{ nameTable(“mxusbdevice”) }}

1.13.1 IO control codes

IOCTL Code #define Bytes in Bytes out Meaning
`0x9c402000` `{{ ioctl("0x9c402000") }}` 8 0 Equeue a new query. `{ uint insertion_count, wchar_t vid; wchar_t pid }` is currently my best guess regarding the structure of the payload.