下沙论坛
标题:
[转帖]2000/xp下读硬盘序列号[汇编]
[打印本页]
作者:
游侠无极限
时间:
2003-11-2 18:09
标题:
[转帖]2000/xp下读硬盘序列号[汇编]
我可没这个水平
2 {" ~. c& k I
.686p
9 h# n! {: J+ f6 A/ c" l
.model
flat
,
stdcall
/ a$ E9 ~( O) ]1 V+ B: A
option
casemap
:
none
; case sensitive
( g- a( }5 u/ G: ]! i& P
; #########################################################################
. ]9 r, S R f. u: w
include
\masm32\
include
\windows.inc
8 F- E: @7 n% y+ ^
include
\masm32\
include
\user32.inc
: `6 P. F5 m9 i4 L
include
\masm32\
include
\kernel32.inc
: B0 y# |' D& L- S
include
\masm32\
include
\advapi32.inc
. C* _1 F) @; d: I1 q
5 H& x x) ^( `
includelib
\masm32\
lib
\user32.lib
- T1 W1 r; e4 Y% f! R! K* v
includelib
\masm32\
lib
\kernel32.lib
; ]# b- ~6 y' @
includelib
\masm32\
lib
\advapi32.lib
# _4 q" t* P" g5 r/ V3 p
DEBUG =
TRUE
7 l9 R4 A! O" Y0 |; s8 R
9 P J' B3 \% M p: G
HMODULE typedef
dword
1 o+ ]- G2 }& [4 f% V6 a' ~3 _. w0 [
NTSTATUS typedef
dword
4 A; ]0 q% [0 t; g
PACL typedef
dword
: w0 g( s! R. |8 Q( R. B
PSECURITY_DESCRIPTOR typedef
dword
1 {/ v1 z* t# [# Q2 Q/ M+ v
1 ]7 U4 g! I j
OBJ_INHERIT=2
/ T" a2 |! p" }
OBJ_PERMANENT=10h
0 Q& G% q6 l4 s& w1 u9 c* f
OBJ_EXCLUSIVE=20h
6 }6 h5 ]8 J$ i4 i
OBJ_CASE_INSENSITIVE=40h
0 c+ u8 c% t2 q* J0 y, L+ m8 M2 e
OBJ_OPENIF=80h
. C0 C4 b2 ^! v
OBJ_OPENLINK =100h
5 E, D3 F3 u# I# R9 P2 Q
OBJ_KERNEL_HANDLE=200
& }$ a7 r6 S! k
OBJ_VALID_ATTRIBUTES=3F2h
1 F5 U3 b2 L, o$ V* \
9 C& P2 l- O1 E4 t
SE_KERNEL_OBJECT = 6
& [. C5 X! }6 O/ H
GRANT_ACCESS =1
* F" K# W& _; ]1 l3 H
NO_INHERITANCE =0
+ d2 J9 ~8 ?) C% a" J
TRUSTEE_IS_NAME=1
# X$ U/ I- B+ \) c& L. l3 c3 H
TRUSTEE_IS_USER=1
% m4 q! |) b; r" S
STATUS_SUCCESS =0
( h( p* `8 L/ k/ t( X4 ]- F6 s$ K
STATUS_ACCESS_DENIED =0C0000022h
1 a$ d* H! J0 f' `1 D
; H8 W" ^5 o! G1 a# s
STATUS_ACCESS_VIOLATION
equ
0C0000005h
. p4 R3 P; L1 x) P
STATUS_INFO_LENGTH_MISMATCH
equ
0C0000004h
- q* O" i, D8 t& o* T! e# ^: T
SystemModuleInformation
equ
11
6 s* E$ n3 U w' ?: {3 k
PVOID TYPEDEF
DWORD
8 ?9 ~4 `) N( Q) d9 S& R. L; r5 x0 n
UNLONG TYPEDEF
DWORD
; j$ K/ j3 a/ ?0 x+ Z
CHAR TYPEDEF
BYTE
% x# Z, h7 U- D
( c* o. v/ Y# `' o4 t4 R) T3 R) Q0 V
UNICODE_STRING struct
, Z' x% w) g3 F9 G/ I
nLength
word
?
8 @& ?* _; a0 |+ Y) q4 Z
MaximumLength
word
?
, `$ _% m" m& y/ _
Buffer
dword
?
) W; E7 K4 G- Q O: [: a q+ L3 [2 j
UNICODE_STRING
ends
$ h' r; K2 s! Y! r4 A
5 H8 @/ Y" c+ p" z# I/ O
OBJECT_ATTRIBUTES struct
% u% }" s" l7 N$ c4 t/ E
nLength
dword
?
! d/ I! M$ \3 O% l6 g: m. r8 k
RootDirectory HANDLE ?
7 g+ E- ^& v1 x$ D
ObjectName
dword
?
UNICODE_STRING
3 R% p( C0 ~- z1 G$ s
Attributes
dword
?
;
' ^; `$ H @) S/ @9 i5 ~5 _" f/ ^( F
SecurityDescriptor
dword
?
; PVOID // Points to type SECURITY_DESCRIPTOR
" J+ V5 b/ h# Y& t
SecurityQualityOfService
dword
?
VOID // Points to type SECURITY_QUALITY_OF_SERVICE
0 M* r D2 f! h5 R# V
OBJECT_ATTRIBUTES
ends
: i+ z* |% K0 I- \9 L
* E" v5 X$ ^- e- [7 T- j9 Q
, V3 F9 y, @) Q! I1 W! J$ S
TRUSTEE struct
, t7 I" }- {3 o6 k3 ^' x
pMultipleTrustee
dword
?
TRUSTEE
, t! J' {( v$ F* T% _) b
MultipleTrusteeOperation
dword
?
; MULTIPLE_TRUSTEE_OPERATION
. U$ C# |2 G& x* G7 p1 `2 y$ B
TrusteeForm
dword
?
;TRUSTEE_FORM
, _# m, M% E3 g" e) c
TrusteeType
dword
?
;TRUSTEE_TYPE
, P9 \! u9 l4 {$ I) b0 K0 E
ptstrName
dword
?
;LPTSTR
6 \# ?7 d( n& a7 y3 p A
TRUSTEE
ends
7 f- X& B: f# Q6 [% h' }
) {7 S- `- B/ Q. x9 y& I) Z6 Z
+ U* @: b% g C0 x2 ~
EXPLICIT_ACCESS struct
( x( k$ ^1 k D# c( J3 Q
grfAccessPermissions
DWORD
?
/ Z3 y. E {5 H9 ~
grfAccessMode
dword
?
;ACCESS_MODE
) u9 v5 h+ I% O
grfInheritance
DWORD
?
;
/ R1 q- n: k. ~- _: N
Trustee TRUSTEE <>
;
0 \0 u: N; d9 G; L/ Z7 n7 R
EXPLICIT_ACCESS
ends
* A. \; y& X7 S' }* }
8 b; N% g5 g c. x( T% @
MyGATE struct
;门结构类型定义
& t7 D% x: w1 O
OFFSETL
WORD
?
;32位偏移的低16位
' \. H. x8 ]$ M2 G
SELECTOR
WORd
?
;选择子
& {: i. i; B! s
DCOUNT
BYTE
?
;双字计数字段
: x' v5 M6 n7 S) {+ x1 O
GTYPE
BYTE
?
;类型
+ N% M, ^2 ^5 b
OFFSETH
WORD
?
;32位偏移的高16位
w0 d; T- l4 A7 y4 Y
MyGATE
ends
& J% ?$ |" ]0 }8 L
% k( u' T9 F* q) y- r4 d: q
IDEINFO struct
# s) E0 O! Z8 B" h
wGenConfig
dw
?
- D3 e. P. A* W7 Z. S
wNumCyls
dw
?
;拄面数
, `" s3 Y9 e& v p" d/ D
wReserved
dw
?
" {+ x, @/ E3 V( n1 E
wNumHeads
dw
?
;磁头数
5 u, ^2 J5 ]( V2 o
wBytesPerTrack
dw
?
;每道字节数
7 }' l3 t3 D7 T
wBytesPerSector
dw
?
;每扇区字节数
& P! {1 N- m7 @ t
wSectorsPerTrack
dw
?
;每道山区数
) Q. j- J3 M+ S( n. Z! O2 _
wVendorUnique
dw
3 dup (?)
& B2 P2 m1 t" x Z% N
sSerialNumber
db
20 dup (?)
;硬盘序列号
! o% [1 v+ j4 z# r9 D
wBufferType
dw
?
;
" I9 t! y: A- @3 c
wBufferSize
dw
?
; ;n * 512
4 c: n m5 R& S& n
wECCSize
dw
?
- b$ j( u8 {* o+ x- S+ u) J! f
sFirmwareRev
db
8 dup (?)
;
) v8 e: c- x% I/ y( G
sModelNumber
db
40 dup (?)
~' w# n1 D! ]2 q$ b) u
wMoreVendorUnique
dw
?
6 h# Q6 n" J7 [3 E
wDoubleWordIO
dw
?
, e0 @+ L2 x/ ~" G9 z Z6 z" M0 l
wCapabilities
dw
?
, `$ s+ x- v5 e. A
wReserved1
dw
?
3 U3 w& `: g4 z+ v* Y- g% P
wPIOTiming
dw
?
;
! h8 f( a3 z. @$ v
wDMATiming
dw
?
;
: X+ O0 z) `9 o9 T+ u- K
wBS
dw
?
/ O" } l" \& u
wNumCurrentCyls
dw
?
;
9 F& [: [* ]- }7 ]0 A1 r
wNumCurrentHeads
dw
?
;
2 w& l/ M5 {9 Z- [) l- \1 u1 M
wNumCurrentSectorsPerTrack
dw
?
;
" H' z' h' X9 } w0 `* p+ ^
dwCurrentSectorCapacity
dd
?
;
: u3 F( n# F+ Z4 `- Q
wMultSectorStuff
dw
?
;
% v- x; q& H$ k" X9 U' m B) o. J
dwTotalAddressableSectors
dd
?
;
3 R/ j, x( e4 y7 Y0 J
wSingleWordDMA
dw
?
;
, P8 l/ F, {* ^: X
wMultiWordDMA
dw
?
;
: z; W# D( B, O$ @* |- g; ?! u' t M
bReserved
db
128 dup (?)
- r a0 E5 S& @
IDEINFO
ends
1 p" a- A. U1 k) w9 @2 c
: m5 `1 N$ m) J" r6 b" q1 q' G
) H1 x! W& ~$ r: R0 a
SetPhyscialMemorySectionCanBeWrited
proto
:
dword
+ q5 L6 S7 n. e
MiniMmGetPhysicalAddress
proto
:
dword
s2 O. g' l! a' U' r
5 X3 d( j# a3 y# b0 S! _) @% r; ~6 {
ENTERRING0
macro
$ f' g! U9 d/ D) _# \
pushad
' A- j6 n$ X5 |# X
pushfd
p% s, K& x! G) M9 m# u# }
cli
$ k/ M4 b, {5 m" w7 f) ?, \
mov
eax
,
cr0
;get rid off readonly protect
& a$ p9 I% B; t, H
and
eax
,0fffeffffh
; P2 ^3 T- E3 l6 w: y! C
mov
cr0
,
eax
: X1 J9 A! N% P
endm
9 O' [( d. U0 j2 t+ S
" Z$ A; } I) X
LEAVERING0
macro
% @- ?1 D" E" Q2 q" {8 l6 s9 L2 U7 A: Q
mov
eax
,
cr0
;restore readonly protect
1 g, x* R/ v2 A" w$ y3 e6 |. Z
or
eax
,10000h
( _3 R5 ~6 z6 ^* l; g4 L! E
mov
cr0
,
eax
) c; b+ g. d: `* d+ i6 C
sti
# N3 E. ^1 w D7 N0 K/ @6 _4 H" o) c
popfd
% K6 ?3 I1 G# g4 S4 W% Q! Q
popad
+ k% u, w& u( T4 W$ B
retf
( x2 \0 J& {6 H% I) u8 _/ e! }. z0 |+ n
endm
1 h7 Z; u4 {9 o9 `) A7 M
3 u( [# W1 ?) j; D- [- p7 y, _3 g X
5 @2 g- S9 P& M/ B0 m' [
UNICODE_STR
macro
str
* \& |9 {$ s( I2 X( s0 z
irpc _c,<
str
>
7 y7 e" C/ F0 I, A% ?5 G
db
'&_c'
5 c5 [5 y2 S6 p4 S
db
0
+ K% R5 a( X& i" u
endm
! S% u- u, g- J$ s2 o
endm
/ A) F& C# _( m: R
3 V; g+ E/ H# D# _ P3 U
.data?
) b. M1 \3 b# d y
GdtLimit
dw
?
* l7 C& M$ m, u/ a
GdtAddr
dd
?
. d" L4 F1 e; C9 B5 {$ i. K* N! Q O
( U, z" `$ [3 X, z+ L
mapAddr
dd
?
! s. S& ], @5 J# H- a
OldEsp
dd
?
" j8 u/ m0 d/ f k3 E
$ y$ M' P# p8 W+ Z H
readed
dw
?
; Q' ~! y' ? O6 ` D
buffer
db
512 dup(?)
! u% f9 q" ?3 Y8 o$ V
ShowText
db
512*3 dup (?)
: y5 }9 w7 f7 X+ g( {$ t0 C3 C
% |0 K' E6 @, G" z: l% t
szBuffer
db
1024 dup (?)
# S# y0 K% M# h
szModelNumber
db
41 dup (?)
! o: H+ j4 u4 t" z1 `; k
szSerialNumber
db
21 dup (?)
R5 a6 r1 Y; \5 x2 P( x
szFirmwareRev
db
9 dup (?)
- T4 A. _) }$ G) H" g8 |( P
. @# z9 m2 L; _% P4 j+ T
stIDEINFO IDEINFO >
2 K3 s2 k5 k8 \: }1 e
5 g) a9 T" z5 S+ h
.data
2 k. ?& |$ r0 X7 H
align 4
1 b; y6 b$ y! O* E
objname
dw
objnamestr_size,objnamestr_size+2
# d7 v$ L$ W& o+ c0 Q
objnameptr
dd
0
; }9 Y4 b* k( t( S8 Z4 o
objnamestr
equ
this
byte
2 ^, n7 {' i) \- z6 E C7 D2 m
UNICODE_STR <\Device\PhysicalMemory>
6 r8 g1 a& H1 j4 Q0 t% @- _( J$ V
objnamestr_size
equ
$-objnamestr
# k1 F, j4 D+ _4 M6 t8 X4 T: f
( G3 d5 F$ H/ m! D7 Z4 V3 y( J! v
szTitle
db
'IDE 硬盘信息',0
4 i& w& X2 n: \1 I
szErrInfo
db
'无法读取硬盘信息',0
, G3 C. ]4 B# J
szIDEInfo
db
'柱面数 : %d',0dh,0ah
G& B. c& ]' @2 ?
db
'磁头数 : %d',0dh,0ah
/ ~ ` a; I: V1 K
db
'每道扇区数 : %d',0dh,0ah
9 |0 y- V4 x+ G4 |2 E
db
'缓冲大小 : %d 扇区',0dh,0ah
. [) y& {3 Y/ ^
db
'硬盘型号 : %40s',0dh,0ah
; Z! w7 S& U9 ?6 U2 @8 G1 s
db
'序列号 : %20s',0dh,0ah
3 x% X3 f$ R* ?* { s8 S; `
db
'版本号 : %8s',0
! p5 B3 y# x* \+ f- W4 c7 Z
- Q" [) g5 W V/ j
align 4
" A1 }8 i4 t" L- x' C/ Q, {9 r9 [
ObjAttr
db
24 dup (0)
0 N3 D- D% T) q) b Z
. i2 m( {. Z" p) j
Callgt
dq
0
;call gate's sel
ff
% \7 h$ B0 H# [+ P4 ]" @6 B/ [
Caption
db
'Windows XP绝对磁盘读写',0
* }3 x( |: p5 r* l
Digit
db
'0123456789ABCDEF',0
/ Y- V, V% o6 L7 L$ Q% d: k, I/ j
.code
& t% _( w o/ j5 [$ k; ]
_ShowBuffer
proc
;显示所读出的信息
" h) w3 e4 s8 b* L+ S
;把数据转换成16进制的形式
" `8 _$ ~/ `0 j1 a5 E" n
mov
[readed],512
, S5 [& S5 y0 ?; } a6 t
mov
esi
,
offset
buffer
;数据
+ R% x" i( A7 s2 M: K% g
mov
edi
,
offset
ShowText
;转换后的数据
8 B4 W) ]: J Y+ b2 P0 o9 Y/ y
mov
ebx
,
offset
Digit
$ v- y; a: F% T
xor
ecx
,
ecx
1 x# {: \+ g% S( s
xor
eax
,
eax
- e0 H2 l, U# A2 }- t2 r
computeAgain:
$ M; x4 U# c, K2 W
cmp
[readed],0
. \/ W* }; \* {( U; G* x# S
jz
endCompute
7 a' I1 d9 a9 j
dec
[readed]
/ b1 ^7 H' z. s& j
lodsb
9 V' Y* c4 E! O# n6 N% _1 j& R/ R$ h
push
eax
/ l& t; ~0 l9 h( G, u S
shr
eax
,4
;高4位
! I/ L) m9 y" g: R3 q0 `% K% E8 E
xlatb
' \" r) }' T+ U$ q$ u% k7 G9 p* l. y! B
stosb
+ q3 C, I" L2 k+ g' b7 ?/ p
pop
eax
+ V5 m4 `8 S+ A8 l1 \' z/ |
and
eax
,0fH
;低4位
0 ~5 e& |. r, J* M e
xlatb
, u- {8 \ C$ T
stosb
( i0 k. _" B" n
mov
byte
ptr
[
edi
],' '
;空格
0 g8 T6 V4 F' E9 w* j& r
inc
edi
9 D9 z) t! q9 X; P
inc
ecx
! f T$ M: i' w9 k. O H
cmp
ecx
,16
% T* f1 a' q( { a) C
jnz
computeAgain
1 K0 g- ^6 v+ Q1 N1 Q& U
xor
ecx
,
ecx
- m* `6 A1 j- R: E
mov
byte
ptr
[
edi
-1],13
;回车
- `" |: w- |+ G- T
jmp
computeAgain
- v% @ ]5 }' p/ S. b- {8 O4 Z1 V
endCompute:
- V9 E# r! s7 t7 `9 \
;显示
; A9 x# ?4 q6 b {( r8 t/ u8 v" Y
invoke
MessageBoxA,NULL,
offset
ShowText,
offset
Caption,MB_OK
& S% V8 c3 k8 D( X \& E
ret
( z) ]$ d$ t0 m7 ?
_ShowBuffer
endp
! }4 y8 Q4 }% W& W( d
# E' ?& G( x2 V3 b2 _4 n* K
SetPhyscialMemorySectionCanBeWrited
proc
uses
ebx
esi
edi
hSection:HANDLE
5 ~; F. m5 T; b0 r; L0 H. B
local
pDacl: PACL
6 O# b1 W S# y# v( d
local
pNewDacl
ACL
7 m" O' O8 T6 ?, C r
local
pSD
SECURITY_DESCRIPTOR
% X3 n7 W3 E. A, h0 S! C
local
dwRes:
DWORD
;
: x, j- `: y2 x4 N
local
ea:EXPLICIT_ACCESS
;
( ~# Y( W( X5 P S* l3 W
invoke
GetSecurityInfo,hSection,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION, NULL,NULL,
addr
pDacl,NULL,
addr
pSD
0 i4 H: x' S, k( O" x+ Q$ {+ X! ~
cmp
eax
,ERROR_SUCCESS
+ \2 B" E5 q7 B0 d3 K1 b! O
jz
@f
# d) p5 C. Z# }9 c. K
jmp
OutSet
2 O" j% D* l* T
@@:
8 U" o9 F, |/ n! c( G1 g! u
mov
dwRes,
eax
# O9 Q2 g5 F4 D1 j
mov
ea.grfAccessPermissions ,SECTION_MAP_WRITE
;2
: [0 H; F/ r% u' p' j) j6 @% z, U. f
mov
ea.grfAccessMode ,GRANT_ACCESS
;1
8 u0 ?3 h7 M) f, O" i
mov
ea.grfInheritance,NO_INHERITANCE
;0
9 v7 g1 `+ \0 @# |4 I
mov
ea.Trustee.pMultipleTrustee,0
3 `* L4 P7 R# w$ |* x) y6 q
mov
ea.Trustee.MultipleTrusteeOperation,0
3 i! e8 R% U3 f) }+ Q+ W, d- p5 u
mov
ea.Trustee.TrusteeForm,TRUSTEE_IS_NAME
;1
' u. W8 b: H; H& Z' c) ]8 c
mov
ea.Trustee.TrusteeType,TRUSTEE_IS_USER
;1
$ l G1 L" `- ^" I2 e3 f' h
call
@f
4 x6 t: E+ Q- x; G
db
"CURRENT_USER"
,0
; Y: X" P X8 a! M! `1 A
@@:
: x* h0 b/ ^$ A: `
pop
edx
0 S& X1 s9 y2 v" A8 l
mov
ea.Trustee.ptstrName,
edx
1 l& m1 }! e! H* p% v$ X
invoke
SetEntriesInAcl,1,
addr
ea,pDacl,
addr
pNewDacl
: S7 ^: h- l9 f3 p4 R
cmp
eax
,ERROR_SUCCESS
6 p) _+ {5 @$ |( W) O1 s( U/ ?
jz
@f
8 `) Z% B1 p2 t# P X
jmp
OutSet
$ g0 m8 A4 E$ g& Y, b# U, n
@@:
% v- b2 T) l* l9 i( }
invoke
SetSecurityInfo,hSection,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION, NULL,NULL,pNewDacl,NULL
: l3 z2 {- o- Q. [! s* A+ |
OutSet:
+ C/ d0 x3 K6 |' a
cmp
pSD,0
( X- D e6 F4 K8 h+ B
jz
@f
# H$ Y. I4 H8 l8 r- z) b
invoke
LocalFree,pSD
! ^0 O, ^$ T4 V8 J
@@:
5 K/ K7 |; q0 ~2 y' z
cmp
pNewDacl,0
) V. T0 I6 {" G# N% E1 f; D G
jz
@f
2 h$ v8 |& p) y$ ]: @2 K
invoke
LocalFree,pNewDacl
( e5 |5 a8 P6 S4 s
@@:
$ Q5 k3 p* G. ]3 m4 a
ret
. c! c, v8 R$ T3 F# R' N
SetPhyscialMemorySectionCanBeWrited
endp
+ H/ K( S! b% \: F' V
( z# H+ p4 G! c) t$ O# U
MiniMmGetPhysicalAddress
proc
virtualaddress:
dword
& H2 @& q+ j" n4 I( `2 D- M
mov
eax
,virtualaddress
2 ] ]. B; Y$ m8 j& n6 w. a
cmp
eax
,80000000h
9 j6 ?# I& Y6 _7 Y5 p) b; _
jb
@f
+ C3 _* G4 ~* W& W0 A
cmp
eax
,0a0000000h
# ^2 i0 j' W( B: D6 b! X& g
jae
@f
8 x' ^6 L7 H0 q+ |) h' ^' ?
and
eax
,1FFFF000h
) w) o3 E# A0 g- T, u) a4 l. Z
ret
7 a) s8 d1 C- S" q* E D
@@:
0 K* k( B( |; ^1 x( B3 e4 w0 k
mov
eax
,0
& _2 w; t) s: c" ~/ W
ret
1 w# C( v: S( f
MiniMmGetPhysicalAddress
endp
/ W( h3 G* @3 P
8 ~- A5 C8 s8 ~/ W
ExecRing0Proc
proc
/ C- ~0 i# c: i! Q; p) } Q! v2 H. r
local
tmpSel:
dword
4 D+ r! B K% y+ b. F
local
setcg:
dword
s' u9 Q3 W, G. n+ L( d
local
BaseAddress:
dword
/ N7 l& R0 Y1 b: ^
local
NtdllMod :
dword
% L1 Y, w& y& r9 w6 q
local
hSection:HANDLE
) }# e: S6 p0 B A1 }
local
status:NTSTATUS
/ b2 y5 c1 l9 |5 L0 \% t# N9 F
local
objectAttributes:OBJECT_ATTRIBUTES
$ c* E% @7 o. {( f
local
objName:UNICODE_STRING
6 V8 \8 @; n `9 o/ L# G4 W' B
mov
status,STATUS_SUCCESS
;
$ u8 ?+ u* B! t3 H3 N" Q
sgdt
GdtLimit
+ |1 a- I; f$ Y F
invoke
MiniMmGetPhysicalAddress,GdtAddr
0 s% O* d# _2 M% D
mov
mapAddr,
eax
+ [ J% x1 p6 Q5 z9 E; U
test
eax
,
eax
( a) `& j/ o$ E
jz
Exit1
" M! [& U5 O9 F7 n; Z% G
call
@f
8 p# t7 g$ B3 J
db
"Ntdll.dll"
,0
3 x" B5 z. T: T0 r4 U
@@:
8 y& K" C. ]+ W V1 j8 G
call
LoadLibraryA
4 x7 E* ^( b) P8 q k( r8 L8 }: b
mov
NtdllMod,
eax
. F% e8 o/ F% n6 e, u! a
7 S; K. n) `% T3 }! G
lea
edx
,objnamestr
: O0 N7 a o8 B8 D! g% T
mov
objnameptr,
edx
9 F6 i( y+ ~2 C# u9 j* j' }
lea
edi
,ObjAttr
+ k) w6 m" |1 N4 k' b8 S! V
and
di
,0fffch
;align to 4 bytes,or ZwOpenSection will fail
8 J' J- ~' w3 p( u( u [
push
edi
;edi->ObjAttr
% U7 d5 V% P6 ?9 p
push
24
;length of <\Device\PhysicalMemory>
6 P( U$ F, k( X4 Q- Q" N" e' G D' B9 M
pop
ecx
3 k# B+ W, L$ }4 q; k
push
ecx
5 v- ?( B4 |$ @9 ^
xor
eax
,
eax
! f9 j! B2 J+ i: v& U1 c
rep
stosb
;put ObjAttr with 0
5 a9 U; x ^$ s/ \
pop
ecx
5 D* a( @3 T5 p( i
pop
edi
& m7 _( f' I5 z) S3 ^; K. C/ L$ A
mov
esi
,
edi
' r" P* V4 j; ~1 h* ^3 c
stosd
0 M6 X( k( S& T; s5 x9 | s [
mov
dword
ptr
[
esi
],
ecx
( D, c, r V: N7 s
stosd
/ _8 @* p6 T" q( x- R: e
lea
eax
,[
edx
-8]
;eax->objname
5 E# V6 o" U& k! N6 c9 X1 {1 e3 E
stosd
;ObjAddr(18h,00,00,00,00,00,00,00,offset objname,40,02,00,00,dd 2 dup(0)
o& ^) s% I/ w t: I: n. _2 T& F: l
mov
dword
ptr
[
edi
],240h
& Q0 L6 m) f, w) }$ o1 Y/ g
6 j% y# s' j! `) h! {3 L
call
@f
( j/ T7 L, W! O5 G- U' v1 a
db
"ZwOpenSection"
,0
8 t) ^4 ]1 S& J4 O* X! X/ u
@@:
, y( a8 L' K- {+ v" K
push
NtdllMod
j* B) [3 U9 @* R$ j) u* j! h1 y$ V
call
GetProcAddress
( ]: ] {* U8 b
mov
ebx
,
eax
;ebx=ZwOpenSection
6 {% j. {# G# i2 @$ Z
2 J& H2 S3 L& E
push
esi
;esi->ObjAttr
9 e4 v, p0 @3 l8 H, g/ |5 Z- h
push
SECTION_MAP_READ
or
SECTION_MAP_WRITE
( \) C. u7 q" j/ k
lea
edi
,hSection
5 J- V0 e1 Q# \7 Y8 `9 `2 i
push
edi
;edi->hSection
' k$ N7 N; C! F1 m8 v! E+ _ p
call
eax
;ZwOpenSection(&hSection,SECTION_MAP_READ or SECTION_MAP_WRITE,ObjAttr)
0 R+ `% |: j3 j% P* d
3 f$ ?; A, O& B
mov
status,
eax
) _# z' X( e, ?1 b
cmp
status,STATUS_ACCESS_DENIED
3 d+ B$ o9 F& z6 p* w
jnz
AccessPermit
* J3 m/ U* d" c. \' m9 V
mov
eax
,
ebx
: P( T7 I0 R8 o; v
$ l. n+ M1 [9 O- L
push
esi
% L* ?/ ?" b! t3 r5 y
push
READ_CONTROL
or
WRITE_DAC
" K4 E5 J* ]6 C' X
push
edi
% \2 s- F9 v7 ?, W1 r6 x, [9 N
call
eax
3 j" r( d# F4 W$ F4 d" T o* w4 U5 \7 c
# }( _9 q3 g9 ^1 A
mov
status,
eax
- q, X1 n1 A9 X" p, i
invoke
SetPhyscialMemorySectionCanBeWrited,hSection
v- K) O) x* k# [% A
1 @( g V1 C. P+ q M% ]& P
call
@f
, I+ k2 H" r5 j0 |
db
"ZwClose"
,0
& N# o$ f, n( M5 @
@@:
8 o6 I1 R/ b8 D6 k# f
push
NtdllMod
8 M/ ~+ u+ w/ x) k+ C" v
call
GetProcAddress
& _+ F6 V9 A$ t, }
5 o2 @" c' r7 k, R) D1 i5 B
push
hSection
1 @3 K3 u' b6 N. X+ ?* d/ k
call
eax
;zwClose hSection
/ {9 x- B. x9 q: h" \
2 Y& x i& m% s6 W! E) [
mov
eax
,
ebx
9 v( p% |1 ]" O7 n
6 J" y/ Q; V# k! p
push
esi
8 Z4 c2 O$ @# K5 p% m# l
push
SECTION_MAP_READ
or
SECTION_MAP_WRITE
, _; b% l( }8 U7 Q) j! D
lea
edi
,hSection
, J3 h$ _7 ^9 | C1 P X- b$ _
push
edi
! w5 R: O+ s4 B+ s7 N
call
eax
1 [: g. m8 ~$ s2 C! {* \4 _6 K
mov
status ,
eax
5 g4 {2 t: a( t: [
;status =ZwOpenSection(&hSection,SECTION_MAP_WRITE|SECTION_MAP_WRITE,&objectAttributes);
^, ]; z) s" J4 p
AccessPermit:
. F; t2 I( v6 d, C$ X3 Q* B
cmp
status ,STATUS_SUCCESS
2 L1 m/ B* A4 w O! i0 \( ?# ]
jz
@f
( I5 G! H' B/ v* W" Y/ P+ S4 G; N
;printf("Error Open PhysicalMemory Section Object,Status:%08X\n",status);
2 j$ J# C5 X( v& k
;return 0;
0 R0 k `- }2 {& \! Q4 i/ b
mov
eax
,0
, r' X, |0 d4 l# p" Z
ret
0 V, K. W3 [6 H# V
@@:
. {. y% h, P B3 e% X
movzx
eax
,
word
ptr
[GdtLimit]
" }' e8 I: r; a# z2 e0 X) E$ ?$ L
inc
eax
& _- Q6 t+ f I0 k7 g
invoke
MapViewOfFile,hSection, FILE_MAP_READ
or
FILE_MAP_WRITE, 0, mapAddr,
eax
4 \5 E. T' a1 B4 a: n7 d+ ?
mov
BaseAddress,
eax
7 b7 B9 k: }9 r9 K) B9 \. r2 [
cmp
BaseAddress,0
/ k" |- r% _1 F& c
jnz
@f
) c2 n, p4 c$ j2 s) C0 _& U- H( q
;printf("Error MapViewOffile:");
- e4 d4 K# U& ]- Y$ r
rintWin32Error(GetLastError()); return 0;
E1 g/ Q+ o- p, @' _" |
mov
eax
,0
/ a" A0 W- v9 H7 _2 S6 u% L9 x
ret
) a! ^2 X+ t l3 M# b+ z, K5 \
@@:
7 V0 u# i, U [5 s1 I
mov
esi
,
eax
;esi->gdt base
* F/ e. @* w8 {& e- V" f& s( P4 v
mov
ecx
,3e0h
6 ?0 _# v5 u- L i: I. Q; D+ g. _
mov
eax
,GdtAddr
- g2 ~; |8 _* M/ w4 t
.if
dword
ptr
[
esi
+
ecx
+2]!=0ec0003e8h
6 S7 ^ F+ @2 n. V
mov
byte
ptr
[
esi
],0c3h
/ _+ N! W: e: [
+ w. l c' I/ Q! B# E
mov
word
ptr
[
esi
+
ecx
],
ax
* z1 o; g+ d7 K) \
shr
eax
,16
3 \* E, M9 x8 p( V1 F6 f
mov
word
ptr
[
esi
+
ecx
+6],
ax
. b% }2 r- d {% |
mov
dword
ptr
[
esi
+
ecx
+2],0ec0003e8h
( E- B# v o0 M; f8 F; |# l
# h, P. ]9 `2 c6 j2 V8 d+ i
mov
dword
ptr
[
esi
+
ecx
+8],0000ffffh
" G- M ?% {* W, c' d- \
mov
dword
ptr
[
esi
+
ecx
+12],00cf9a00h
, i: b% W, h# }8 d
.endif
( J8 m/ _& i# p& M k& w
7 B C9 Z1 C% X$ U( s5 E2 \
mov
setcg,
TRUE
, I& }7 S% O4 |. n' y1 S) ?4 {
cmp
setcg,0
! @; ]8 i$ m( Q1 e% i6 |
jnz
ChangeOK
* b V( n' H5 R" f2 H
call
@f
; |) P# L5 ]; y+ p3 x4 `+ }
db
"ZwClose"
,0
7 ]+ j5 Q! U% H) |9 ]
@@:
% ]0 Z2 O7 e) d! F
push
NtdllMod
* z A1 l; m! }( [$ |9 B
call
GetProcAddress
6 U: M1 `/ Y5 | E0 O7 o" j6 u7 ^
push
hSection
: w: ^! n8 ?1 O3 S7 g1 n5 }1 R5 w9 }
call
eax
9 h4 Y1 L- @6 {) X: ]
xor
eax
,
eax
~0 c0 c# d% q1 A* I, g" n7 s
ret
0 J. ^( K% ^, I$ b
ChangeOK:
# v6 L% c1 R8 o# p2 \
and
dword
ptr
Callgt,0
t4 A5 t/ d. @4 j. y$ }
xor
eax
,
eax
2 ^2 ^; P/ f$ e& ^; |* v5 N
mov
ax
,3e0h
9 x, N/ d) L6 E, e H4 f
or
al
,3h
4 Z1 [" o2 `* |# {0 K9 j+ T; e
mov
word
ptr
[Callgt+4],
ax
1 K/ O6 x: X0 p# A# W4 s4 e
;farcall[2]=((short)((ULONG)cg-(ULONG)BaseAddress))|3; //Ring 3 callgate;
u6 @! A$ ]( C7 k. \, a
lea
eax
,_Ring0Proc
: X3 ?$ j9 r0 L2 I& \4 A6 {
;invoke VirtualLock,eax,seglen
* U: [, m# S0 p. _' T
test
eax
,
eax
# u; I. e; Q1 q8 N G* K
jnz
@f
J2 [4 L, {+ P* W j; n" y5 t
xor
eax
,
eax
( b* x& E J1 V( T t5 L
ret
E1 l! e [" r
@@:
' y9 Y8 O" k/ t n0 N1 J
invoke
GetCurrentThread
# g/ \. d+ r4 Q. S# s3 ^* f! a
invoke
SetThreadPriority,
eax
,THREAD_PRIORITY_TIME_CRITICAL
; W$ Z) q3 U- [4 E% e( r
/ v! O; X1 q# r# f. T* I
invoke
Sleep,0
) t* ?+ n4 t" \+ }. F
call
fword
ptr
[Callgt]
;use callgate to Ring0!
/ H8 W6 K7 ^- K+ K" X9 ^ s
;_asm call fword ptr [farcall]
4 i, j" @* Y0 A8 o( L8 o a% ]/ X4 L$ w
_Ring0Proc:
; Ring0 code here..
0 |) j$ c0 n8 g! K+ o
mov
eax
,
esp
;save ring0 esp
! C g o4 s- e) y' F2 T) Q
mov
esp
,[
esp
+4]
;->ring3 esp
) o h$ F' _ ~
push
eax
$ c b& j* x4 W/ P
mov
ebx
,
offset
stIDEINFO
+ _. k1 a- e H* Y# F& S( u
assume
ebx
:
ptr
IDEINFO
; Z, m% C1 u. _( P& [. K* f: N
;********************************************************************
% H/ G1 c8 l+ g( @
; 等待硬盘就绪
! a3 u$ P9 O( a8 s3 q# X
;********************************************************************
9 E) W9 u3 E% d+ u- s% B+ j5 w+ x4 J9 u
mov
ecx
,10000h
. }9 U4 u, F3 n. O. K8 D
mov
dx
,01f7h
9 n, K. v& s3 c$ N: ?+ p7 P: g% o
@@:
. `7 M2 C' B+ T/ }
in
al
,
dx
- t: N; U, S* s8 m
cmp
al
,50h
6 z8 [! d6 l0 G( R
jz
@F
2 D, u b2 x/ c! R
loop
@B
6 F1 s; o# q- T, a
jmp
_II_TimeOut
9 o U. X: J4 [' H
@@:
+ s2 S0 h0 I2 l
;********************************************************************
% q9 R, P3 A* o1 W
; 发送命令
) J$ v5 J8 G- F H3 ?' u9 {
; 如果向主控制发送命令,则端口为 1f0h-1f7h
- w8 _+ u3 l' j/ I$ ]- @1 g
; 如果向副控制发送命令,则端口为 170h-177h
# ^4 z# t6 ]6 X0 O
; 1f6h 如果要检测的设备为该IDE接口的主(MASTER)设备,
8 b2 g8 r' F1 a* |, @2 [
; 那么发送 a0,如果为从那么发送 b0
3 q$ I4 X* X5 y' f, U' \( E% e
; 1f7h 如果要检测的设备为 ATA 设备那么发送 ec
3 \" R' L) m. u8 S8 Y1 L0 r
; 如果为 ATAPI 设备那么发送 a1
+ {$ W/ q9 ]# ^! j
;********************************************************************
% M" u! B+ T8 o* M4 @2 l t# |& G
mov
al
,0a0h
;Drive 0,Head 0
& M! | [( r; a; l7 I
mov
dx
,01f6h
;Drive and head port
0 |; V% q( a8 [& t o8 g
out
dx
,
al
8 q) H8 _. J' O% l+ g9 e" ~
9 G# y( J: a/ t8 V" P/ _
mov
al
,0ech
- X+ q( I7 Q! U; v m
inc
dx
;Command port
& I7 y* N q7 V
out
dx
,
al
, ^0 x# \( e4 I1 w/ ^9 j- Y
;********************************************************************
o% K+ T% I. s+ b6 r @
; 等待硬盘就绪
# I+ C5 Q( T, R q h; W
;********************************************************************
! f7 E8 g+ X) t) x
mov
ecx
,10000h
& c% i5 y3 g8 u0 e0 {
@@:
/ N+ c8 }5 r# S& h3 \. S
in
al
,
dx
;1f7 (r-status register)
C8 f% D( T5 _9 B. s
cmp
al
,58h
;(driver is ready ,and seek complete)
- J1 Y6 N& E9 \8 |, I. B
jz
@F
{% J) z) f% ]) }5 J/ `
loop
@B
! {1 T* P4 k2 A# x! k$ t
jmp
_II_TimeOut
3 X+ h+ p% i% P' i( w
@@:
0 O$ @# _- @" i6 Q
;********************************************************************
* {6 r+ h4 N9 n: @
; 将返回信息读回
. ]$ Q) v. B2 ]+ l( z
; 注意一定要读满 100h 个字长
& ]- [ s5 Y+ t" d
;********************************************************************
& R! ?5 v# C% N! l+ L+ q" v: W
cld
9 j" O4 O* x. O1 T
mov
edx
,01f0h
;data port - data comes in and out here
; `3 O/ I6 W4 w9 \* h
mov
edi
,
ebx
8 I6 a; G e* ~& W) C7 x
mov
ecx
,0100h
+ i/ Y1 M0 ]2 O' M7 O; n
rep
insw
+ n( ?' J f. @! e% ^
;********************************************************************
8 k- {6 S3 _% d- P6 A! l
; 返回的信息中,型号、序列号、版本号为字形式
* D# z! Z# @. p/ U F# I- b
; 需要整理到字符串的形式
; l% C5 L0 V% i. ]# ^, @7 h
;********************************************************************
" a$ X/ q* N& g" T; [: g
lea
esi
,[
ebx
].sSerialNumber
~9 ^$ Q2 U2 v6 x0 R$ T) w' y& b
mov
edi
,
esi
% ^0 Z+ _3 T7 ~
mov
ecx
,10
5 ?2 U4 s3 g- r* q6 {+ c0 Y
@@:
# z- z4 U ?+ f; ?# ^
lodsw
E; Q7 b% O; N" ^
xchg
ah
,
al
1 F! e, w( I6 F& T! V9 y. G C, [6 E
stosw
9 K: r+ J5 X9 Y1 d; ?, J
loop
@B
6 g: M" h/ F$ h/ N; e
* S# {) l" j) M" e8 k) u3 d
lea
esi
,[
ebx
].sFirmwareRev
1 F5 ?5 r5 j' }7 k3 O0 I: y; a$ a
mov
edi
,
esi
|+ }7 I/ _; P; U& J; l
mov
ecx
,24
2 u; P7 f: |+ f0 f
@@:
9 D2 A% Z. |2 _
lodsw
% Y; p# T0 x5 b) [* y" E- f
xchg
ah
,
al
# j# V$ X" \& x: C" g& [
stosw
0 {' e: |8 g$ \' M
loop
@B
, A. w! Q! r1 f
_II_TimeOut:
3 J+ [5 J& t/ V
assume
ebx
:nothing
7 L' X9 v/ l4 p! w9 _ _, ~6 I$ h
, \: O2 ]0 D7 ~: A. r$ z5 r
pop
esp
;restore ring0 esp
: r' _" L2 s, N' R( P! r
push
offset
Ring3
8 g9 h7 O) Z X$ Q: h* Y
retf
: `8 b8 {& @" S) V. V! N
Ring0CodeLen=$-_Ring0Proc
1 { m# E( C8 C% t! T
- ?2 o* h+ h$ K1 v/ _9 b
Ring3:
# Q) ] Q E+ B/ g8 b2 i
invoke
GetCurrentThread
8 T" ^6 a5 n+ N
invoke
SetThreadPriority,
eax
,THREAD_PRIORITY_NORMAL
2 ?! K8 w) E! i& C2 C" t
/ N2 A0 ~2 l: m% w" k
;invoke VirtualUnlock,Entry,seglen
4 n% u5 q; r5 m* s) P" i( o4 T, t
) d1 F- `8 f, B5 L1 H/ m
call
@f
' e6 _# G6 Z- W6 G; i
db
"ZwClose"
,0
8 T3 r$ L8 u" a, e9 g. `0 {+ Y4 A
@@:
' Z: d/ ]. }. e$ k8 y
push
NtdllMod
- k1 T1 h8 k. U/ X6 \' c
call
GetProcAddress
$ g: q+ B v/ a! _; D
push
hSection
. @, r+ {# W2 `' V- Z: X
call
eax
0 T2 E) F! s7 X
mov
eax
,
TRUE
$ F" J$ P* i [1 `1 H, ~
ret
8 a( G$ G/ g1 s
ExecRing0Proc
endp
y# r" M1 F# m5 ?# V' F4 q! p% A" {
( J! ]3 g# x( \% [; e
main:
; n5 \$ K4 w6 o. z
assume
fs
:nothing
" J) S n+ L' ?- q9 ^( J
push
offset
MySEH
7 E( u5 T, u8 h, \* }9 w" ]
push
fs
:[0]
1 m- v/ ?; o8 t( ?1 [
mov
fs
:[0],
esp
L. ^1 ?' {0 S! K6 N4 n
mov
OldEsp,
esp
4 _ h2 y9 H# i
mov
ax
,
ds
;if Win9x?
5 G8 ^; n$ p8 V9 z% h1 X1 g
test
ax
,4
; D4 W0 Q8 x3 H1 H
jnz
Exit1
! L2 j$ i" C5 ^# B9 b
invoke
ExecRing0Proc
9 J* z1 A6 H3 V) \+ W0 ^( I
* B0 h7 c: @: Z! U
.if
stIDEINFO.wNumCyls
: ~$ b- F5 |! X4 s
lea
esi
,stIDEINFO.sModelNumber
% b7 a7 p# I! R4 s4 ?, n
mov
edi
,
offset
szModelNumber
U' `1 L4 h6 M5 ?3 v' G2 x# s
mov
ecx
,sizeof stIDEINFO.sModelNumber
5 Y% y( O; l5 P" a
rep
movsb
& C [6 m7 D0 {# k4 Z: H
8 i& ]2 M, a2 V4 Z& Y9 Q
lea
esi
,stIDEINFO.sSerialNumber
( Q& J: T1 i% r& H, ?5 L6 V
mov
edi
,
offset
szSerialNumber
4 H1 N# ]+ c, z2 U
mov
ecx
,sizeof stIDEINFO.sSerialNumber
1 d8 Z0 |" L, _+ O! |
rep
movsb
. u5 H1 q! }& L e
1 Q% w) U5 I3 {" N( v1 O3 N
lea
esi
,stIDEINFO.sFirmwareRev
- ^7 M! {' @& r1 c* h1 V
mov
edi
,
offset
szFirmwareRev
, u3 `/ @3 {" P, w _
mov
ecx
,sizeof stIDEINFO.sFirmwareRev
( r! l5 o( d! j# U3 h" M
rep
movsb
5 ?3 y. \+ F& j3 N8 o+ K, Q
" K" ~1 W% A; y! a
movzx
eax
,stIDEINFO.wNumCyls
% |+ n. q3 @' W( G9 z# _$ r
movzx
ebx
,stIDEINFO.wNumHeads
3 d' Z, [# k# W. v* I
movzx
ecx
,stIDEINFO.wSectorsPerTrack
. _* k+ }* j' L. q: C
movzx
edx
,stIDEINFO.wBufferSize
% j4 | {. W. O6 }) \
invoke
wsprintf,
addr
szBuffer,
addr
szIDEInfo,
eax
,
ebx
,
ecx
,
edx
,
addr
szModelNumber,
addr
szSerialNumber,
addr
szFirmwareRev
2 d/ s8 X/ E7 }8 x7 n2 f ^$ Q
mov
eax
,
offset
szBuffer
; @$ D( o; i1 D) ?2 s& R" D% m
.else
' K* Z' H$ d+ ]/ m& M3 ]
mov
eax
,
offset
szErrInfo
. n0 C( x5 l4 A# I
.endif
Q+ b5 o) ^; @8 x
@@:
4 U- Q2 E3 U8 v
invoke
MessageBox,NULL,
eax
,
addr
szTitle,MB_ICONINFORMATION
or
MB_OK
1 t0 ^1 x" y- w& E3 z
Exit1:
, P' [2 p& y; {
pop
fs
:[0]
2 r* n ~; ?% p3 s7 d M$ l' b# A
add
esp
,4
1 X4 }( c) l4 ?+ o. X! Q
invoke
ExitProcess,0
- x: b( G. [& m; ?# J
y# F% d+ W* d' l: r s
MySEH :
2 m2 L. ]* w* ?/ P& T
mov
esp
,OldEsp
- f% _4 W4 G* o) G* b( y
pop
fs
:[0]
Y- ?* A. p2 F }
add
esp
,4
4 w. c, h' p$ Q/ e4 x
invoke
ExitProcess,-1
7 g8 o/ T' G' |
end
main
0 d4 O. j2 {( S& }$ R$ ^
) v) y) Y M+ z5 |) P+ Y3 G
[此贴子已经被作者于2003-11-2 18:14:02编辑过]
6 |# f$ d* K* \: u; P" v! ^2 S
作者:
bigfoot
时间:
2003-11-3 16:22
提示:
作者被禁止或删除 内容自动屏蔽
作者:
firelinux
时间:
2003-11-19 00:12
win32位汇编,真的很不错,业余的时间,全都投进去了
作者:
唐明
时间:
2003-11-26 19:36
要能有台机器试一下多好,学汇编还从没想过去ring0,也感觉没哪个必要。
6 d$ A/ T W6 J2 ^4 H# \& @
现在闲着真相试试。这片文章我在家保存了有快一年了。不用感觉可惜了。一直停着不用,我都快忘了那些曾经那些依稀的记忆了。水能给我一台电脑,我力马高喊:有你这么富的吗?
作者:
fyer
时间:
2003-12-3 03:31
提示:
作者被禁止或删除 内容自动屏蔽
作者:
游侠无极限
时间:
2003-12-3 15:33
很久以前?
+ Q' p, p9 V( r& a; I
不是吧,这个是 轻描淡写 编程论坛的斑竹写的
作者:
fyer
时间:
2003-12-24 19:21
提示:
作者被禁止或删除 内容自动屏蔽
欢迎光临 下沙论坛 (http://bbs.xiasha.cn/)
Powered by Discuz! X3.3