该用户从未签到
|
我可没这个水平+ x) j0 h5 o6 B
.686p
2 O3 r/ U3 j. r( L9 T1 ?- W+ s.model flat, stdcall# [- Q8 [9 M5 G1 D% K( v( P6 `; a
option casemap :none ; case sensitive
7 |* s& R( m/ X2 _1 X9 l; #########################################################################) J* k9 y) r) L2 f1 r$ r
include \masm32\include\windows.inc4 c5 a1 d3 q: ]1 a1 r; n; Q
include \masm32\include\user32.inc5 ?( }7 m3 H. v, a
include \masm32\include\kernel32.inc
& k7 V9 R' G6 p1 @" Cinclude \masm32\include\advapi32.inc
9 Q: T8 i: |( R . g a: l5 C) v, n) @
includelib \masm32\lib\user32.lib
/ o2 O* _+ T- ]% [7 H5 c) Z' @+ iincludelib \masm32\lib\kernel32.lib
: D6 l" \: z' m- X% I' y% fincludelib \masm32\lib\advapi32.lib' Z l& D8 G9 k: k7 {' W
DEBUG = TRUE, Q+ D H$ F; ~9 S
f! G9 C5 H# hHMODULE typedef dword
8 l2 w$ d e% W3 K- } D" V8 @* yNTSTATUS typedef dword7 G2 @, A0 U- M. a9 z: t
PACL typedef dword
, l5 z- C% M6 x0 D' s: gPSECURITY_DESCRIPTOR typedef dword
4 Y! e- Z4 z+ L* C( w- T6 J/ s3 ]# v" z
OBJ_INHERIT=2 $ ~! b& i }$ ~1 z6 f( f$ a
OBJ_PERMANENT=10h: g+ L7 u0 f& g* G' ~" a
OBJ_EXCLUSIVE=20h ' D# H5 Z, g2 _) C4 ^/ N3 H {
OBJ_CASE_INSENSITIVE=40h 0 h2 R# `, i, b/ |, ~$ u
OBJ_OPENIF=80h 3 R' q" {) A0 c7 L+ ^( P; m! L- }
OBJ_OPENLINK =100h 1 ~$ s- V1 v8 ]
OBJ_KERNEL_HANDLE=200
0 Z' L2 R: t9 t9 M8 V; yOBJ_VALID_ATTRIBUTES=3F2h
, t9 n; ?6 K; ~6 c2 L" f: L9 b
' j# u* v0 V: A) [' g9 G6 O8 PSE_KERNEL_OBJECT = 6
5 t, o. s$ u3 qGRANT_ACCESS =1, S1 |( l3 ^" M6 K" ?9 A+ P" k' }
NO_INHERITANCE =04 b2 [) S, E& L4 B; e2 u+ D6 Y
TRUSTEE_IS_NAME=1: ?( {9 l" t$ J/ y; I) U# N
TRUSTEE_IS_USER=10 B: z v/ t9 X5 ~
STATUS_SUCCESS =0 * W) `$ Y+ d/ d0 u2 A8 P$ h" o
STATUS_ACCESS_DENIED =0C0000022h P7 u. M8 b: K# O# |% S, m9 Y
1 p: s) C- Z) m7 {2 QSTATUS_ACCESS_VIOLATION equ 0C0000005h h# L; I+ x- G) ?
STATUS_INFO_LENGTH_MISMATCH equ 0C0000004h
$ \( j, B6 s/ q, \SystemModuleInformation equ 11: I- v' Y* n) F/ U7 U% k
PVOID TYPEDEF DWORD4 D( z! q" n+ v/ ~
UNLONG TYPEDEF DWORD
! |1 R$ j) Z. Z4 W. P( I3 B" f" nCHAR TYPEDEF BYTE
) y: R- r" `. x
8 U( P9 A$ ~3 cUNICODE_STRING struct ' U4 g% [# g) y, C3 L
nLength word ?
6 y; n" M8 D3 @. K- \ MaximumLength word ? 6 c$ h. }2 b& K: |# N3 N5 [
Buffer dword ?
+ o8 T6 j$ w% k( ?UNICODE_STRING ends2 e) k! @8 y+ O4 F& ^
) B1 {) t% w5 V3 W1 _4 `* zOBJECT_ATTRIBUTES struct ; M3 C8 ~; @, w* U$ u$ n( Y
nLength dword ? . z) I& Q% X2 F+ @3 P
RootDirectory HANDLE ? # r% n% ~2 z! e# t8 W1 [# o0 E
ObjectName dword ?UNICODE_STRING
7 c1 D9 U1 Y# K/ J1 q( k, w! [7 r Attributes dword ?; / @4 Y- q9 f& X" F* r
SecurityDescriptor dword ?; PVOID // Points to type SECURITY_DESCRIPTOR & U3 f+ v; S2 Z3 ~. M* [
SecurityQualityOfService dword ?VOID // Points to type SECURITY_QUALITY_OF_SERVICE 7 Y: F, q5 D% f
OBJECT_ATTRIBUTES ends , R6 H% e) N5 f- {" ~4 [
' y! G# }' X9 {0 P( j0 p3 [# {
$ z. c* _" T& E# t2 ?" y" T+ [TRUSTEE struct
. V6 t8 l9 p: _5 d" ?4 E pMultipleTrustee dword ?TRUSTEE 8 a; }, b: j- F8 w; m5 a }
MultipleTrusteeOperation dword ?; MULTIPLE_TRUSTEE_OPERATION
; D2 _# _8 E/ Z TrusteeForm dword ?;TRUSTEE_FORM$ }7 y0 K! |5 c5 t8 Z9 U- v
TrusteeType dword ?;TRUSTEE_TYPE
" } q9 _ }7 @ ptstrName dword ?;LPTSTR
! g q" x3 F6 }& a3 bTRUSTEE ends
9 F% f- t& n: z% ?! R/ v3 j4 X/ z# Y
0 j% @* I- e& @$ q0 T& h$ M5 M: m. O
EXPLICIT_ACCESS struct
( t7 y7 P! G3 ]% i grfAccessPermissions DWORD ?
. j5 }; J4 Y8 i9 ?- \' ?3 ]9 A9 j grfAccessMode dword ? ;ACCESS_MODE
* }/ t( F6 w( K# C grfInheritance DWORD ? ;3 o2 f! d" j( V. ?2 p9 D9 f2 F' W3 J6 {
Trustee TRUSTEE <> ;
1 W# V# J* C8 n- V$ SEXPLICIT_ACCESS ends
$ o4 G+ G3 N0 e* i% h4 D5 s5 B, {& z$ E# k8 N
MyGATE struct ;门结构类型定义
$ Y/ g9 N/ a, [; g2 R- p" }# r OFFSETL WORD ? ;32位偏移的低16位 @ o; A' ]: @ Y# U" i
SELECTOR WORd ? ;选择子
8 R4 J* {! | A- \% Z! N DCOUNT BYTE ? ;双字计数字段! h9 y! t6 c1 w/ V
GTYPE BYTE ? ;类型% b& k3 D5 Z; g, X
OFFSETH WORD ? ;32位偏移的高16位
( Z6 u; Q; c2 O9 }1 XMyGATE ends
7 I6 v, L' V M
7 U) ~7 q8 K# B' k2 I5 xIDEINFO struct% Q" W: `+ P& k% B. N* f/ @" G- M9 I
wGenConfig dw ?
( Z( H. Y+ ^' S4 ]wNumCyls dw ?;拄面数
) O" R8 x8 |* O0 R6 T n/ T* T4 DwReserved dw ?
+ ]$ x' K$ `: B6 ^4 ywNumHeads dw ?;磁头数. f/ w2 Q$ x! k, d5 u2 P. S3 g( J
wBytesPerTrack dw ?;每道字节数
* `% f3 h7 w8 w+ T* k* xwBytesPerSector dw ?;每扇区字节数1 e) l, b. ?7 U* j% E$ \
wSectorsPerTrack dw ?;每道山区数
7 D( l& m0 \' o( T. f8 M9 `wVendorUnique dw 3 dup (?)2 x1 n% W: U% R' _* M; ~8 j8 h
sSerialNumber db 20 dup (?);硬盘序列号, L! j$ E- _ B4 o
wBufferType dw ?;. o0 y3 H, |* V6 b H& t* z( d- Q
wBufferSize dw ?; ;n * 512
4 v+ }8 y+ h1 z b, C& AwECCSize dw ?
- p3 d) H5 S$ ?3 v4 w6 `+ |sFirmwareRev db 8 dup (?);
7 n% Y7 ?! D* ]0 u. s% HsModelNumber db 40 dup (?)
% V' g7 c, N& {/ w8 KwMoreVendorUnique dw ?
2 J2 @; @: o6 C( ]$ \6 ?wDoubleWordIO dw ?/ w* r, P B: X+ l s
wCapabilities dw ?0 X: K* a5 i2 z+ S9 Y. q
wReserved1 dw ?
2 n, c4 X: s6 | s9 OwPIOTiming dw ?;4 K7 {) S ]. t. L$ w, V
wDMATiming dw ?;5 g! v5 f1 }( W1 {( V. a$ x' }
wBS dw ?
7 k5 v6 W- _) h( P3 D% v& RwNumCurrentCyls dw ?;# g# ]$ Y& y3 F# @# w2 S
wNumCurrentHeads dw ?;
+ R) s! g, K0 R! w% p& x7 `wNumCurrentSectorsPerTrack dw ?;+ e7 X( [. @, |) U2 b
dwCurrentSectorCapacity dd ?;
$ z' F7 E* r8 FwMultSectorStuff dw ?;7 c0 }. L+ Q6 `: \* k# u
dwTotalAddressableSectors dd ?;( A/ _% S2 l3 D: l# w2 r( W
wSingleWordDMA dw ?;
- J6 M) u" W. A4 Y% ZwMultiWordDMA dw ?;* o/ w" M8 y. `+ t! H/ P* v' r: P" x
bReserved db 128 dup (?)
- L- m, \. @; }. {' |4 v" O, ZIDEINFO ends
, E% i( i& D7 I
: v7 k+ z/ }, g {; A) \. N/ ~$ b6 I& k; a; y- l
SetPhyscialMemorySectionCanBeWrited proto :dword8 f3 M- M1 L" M' i1 E5 k
MiniMmGetPhysicalAddress proto :dword
, q R0 z1 k4 Y
7 n( ]7 M* J, h/ J, YENTERRING0 macro5 K) m6 S8 L- K) E- F
pushad
0 N. ~+ z- T' |! n) P; x; Y/ Lpushfd
# Y" t" X f0 j$ r. O7 | ycli- R3 b" P* u4 q5 U% g/ T
mov eax,cr0 ;get rid off readonly protect) q0 }& z3 Q1 R
and eax,0fffeffffh ]: m8 [3 P7 o! c! ^3 f0 Y
mov cr0,eax8 }' ~9 P. M7 m6 @; P. J; H/ b! B" `
endm
# R& [5 W! v. j% \
1 l5 j4 q3 ^/ ?, ?# r7 {( E1 s& ^9 tLEAVERING0 macro# I8 X0 U2 g) V
mov eax,cr0 ;restore readonly protect& l6 m ]/ v4 H9 Y9 g3 }6 s+ b
or eax,10000h
) i0 h& I: ]6 amov cr0,eax8 l# _5 \$ ~# W
sti
* G( l8 X2 C1 I! \- z6 `& a( Xpopfd 5 ` {- d& g0 w( \! ~) @$ S& ~/ \
popad ! u% X. [- }/ a4 I0 d$ `3 X+ l
retf
+ Z' U3 R7 c' n' b$ u7 @endm
" P" G \; B# n1 T1 @$ f9 o5 Z& G# u' f0 u
' l0 N3 Y9 }( b& J: b9 D6 }- MUNICODE_STR macro str! U" z6 {0 n( S, q2 z5 b. L
irpc _c,<str>
8 |. b* B+ f- I; a& c1 I$ u; bdb '&_c'+ N9 l. k9 ~& @; {$ c' N
db 0, s5 D# ?. Q2 P8 g1 N) @9 C( d
endm) y/ n/ G3 L0 t7 f/ ]/ U
endm3 t$ D+ o4 x) m
$ ?- o7 h5 r/ D5 d- o; s, t9 F.data?
# B f& S& a7 Q5 |$ sGdtLimit dw ?: v0 [+ [. Y! a7 {' \/ j
GdtAddr dd ?9 H+ ^" w5 t0 N1 }& {- }6 t
; k' Y4 F' e$ I& Z, |mapAddr dd ?' P6 Y& A5 Y) i8 T( \! S3 }. [
OldEsp dd ?4 m# W9 o. }& l7 G$ M# X
2 Z3 y3 ]: M0 [readed dw ?% U8 p' q, M. Z& z2 ^
buffer db 512 dup(?)- I* c' _9 x) r6 k
ShowText db 512*3 dup (?)
& L2 D" H, r" @, S7 k# ?' A; d% b7 X
szBuffer db 1024 dup (?)
1 U- }% t. u1 i9 S3 t# RszModelNumber db 41 dup (?)
1 y+ q, E+ i3 v& P# SszSerialNumber db 21 dup (?)
. C0 M7 {- v. T6 X8 E sszFirmwareRev db 9 dup (?)( U8 Y' _+ D8 T1 y7 P
" A' T# D) B" h2 y/ [stIDEINFO IDEINFO >
3 `, x B8 c2 h. i% j2 X& p
+ I% X; u* B' E8 c% @7 q.data
2 p1 @( I9 x1 l3 }! y' Calign 4
' n9 Q) {5 X: ]- i# Pobjname dw objnamestr_size,objnamestr_size+2' `3 |5 k2 w) Z+ d
objnameptr dd 0$ e5 y* U1 L( ~; r J
objnamestr equ this byte
( E/ T8 w b- y+ q! }UNICODE_STR <\Device\PhysicalMemory>4 E7 H' n1 l7 W. i* m
objnamestr_size equ $-objnamestr# ~6 w. U" H5 R' f7 L
3 P4 P2 g1 {3 l
szTitle db 'IDE 硬盘信息',0
! X2 o1 ` x' F$ q5 EszErrInfo db '无法读取硬盘信息',0
* l' V l3 d% l5 d+ V' kszIDEInfo db '柱面数 : %d',0dh,0ah
l9 W" B* L& w- F db '磁头数 : %d',0dh,0ah
& D8 M |& }, [: R! B db '每道扇区数 : %d',0dh,0ah
6 ~% S3 z7 a) K db '缓冲大小 : %d 扇区',0dh,0ah1 g3 g' T- a/ s ~: N
db '硬盘型号 : %40s',0dh,0ah) X" ~9 ?" U. c" C0 i4 `0 l% W
db '序列号 : %20s',0dh,0ah
5 N& m6 v/ ]# w9 A) {7 W db '版本号 : %8s',0" w1 w6 r/ ]+ o
- R/ n* B: j6 z/ |+ }# Q
align 4
9 ?* b( J2 o0 O3 C! _6 }ObjAttr db 24 dup (0)
4 e- {4 v1 j& L& j/ k+ \4 Q- C8 ?1 k! P( E6 x9 v0 M
Callgt dq 0 ;call gate's selff7 g1 A" n; n% D4 J3 U
Caption db 'Windows XP绝对磁盘读写',0
5 X7 a& Q3 m G' {3 kDigit db '0123456789ABCDEF',0# J% u- Q, y( q4 N3 {1 f- A
.code
% L" p" V, @2 p7 \_ShowBuffer proc ;显示所读出的信息
$ @5 g) S% {) }& Z% B3 N' O. H4 t# v ;把数据转换成16进制的形式) b [$ ], ^! p+ b! ~, a
mov [readed],512
" Q1 y) q; Z8 I( G mov esi,offset buffer ;数据
9 i0 R7 E. A, b6 `5 M& k6 V& J7 @ mov edi,offset ShowText ;转换后的数据# ?" V8 a) _" _* @( e
mov ebx,offset Digit
?9 g* O9 K8 H7 P+ w) E2 N5 ] xor ecx,ecx
1 ~& m8 q& q5 B. O/ S xor eax,eax9 t* z q! X l0 h! R8 Q
computeAgain:, a s; J/ k* O% a
cmp [readed],0# t3 _8 {+ i7 `- N+ [. y5 ^7 L
jz endCompute" j( [9 ?' H. ^: m E+ J# H- J
dec [readed] ~' z* Q; A ]1 N7 P) r1 J$ ^
lodsb V6 g$ P! m& g7 |& p
push eax
; A% E) ]3 ~6 c2 v8 G! e5 Y1 H shr eax,4 ;高4位( c& ?' ^9 Y/ h) H0 h
xlatb9 _/ o5 R7 p6 ~. m6 l. U! S9 j
stosb
9 x! M$ \7 j& k; ^! H, g- t pop eax
, D/ a y6 C" K; Y9 G% G6 g) K4 W and eax,0fH ;低4位0 j/ m; p' E; w/ ?) d6 @/ L
xlatb9 J) x& r6 p/ Y* v) c4 b; }
stosb6 I# |; C) q) ~! [0 ]* Q" `
mov byte ptr[edi],' ' ;空格
. M$ F: o& Q0 r/ f" P, ? inc edi4 Y9 w( w7 y: |. B+ n0 K7 ?4 [
inc ecx# F5 N0 r# z. ] m
cmp ecx,16% Q) t5 x4 v( h# d
jnz computeAgain
" _. L2 W! M: B/ ?6 ` xor ecx,ecx
+ t* a, Z$ s, }; n mov byte ptr[edi-1],13 ;回车; [% W2 Z; J1 i1 C: E
jmp computeAgain
$ \5 W9 A4 U: ` t8 T) a! b. \6 O. D( o3 bendCompute:
" y+ R$ @) g( {1 J" X$ A1 y% t7 z ;显示
$ D: \6 z' N% o invoke MessageBoxA,NULL,offset ShowText,offset Caption,MB_OK3 q' g4 y! L7 @- D2 q
ret
. F4 I1 ` P6 |4 H3 ~_ShowBuffer endp
. j! [( H! e+ e/ k: p9 j
5 m8 O5 V( a) Q) gSetPhyscialMemorySectionCanBeWrited proc uses ebx esi edi hSection:HANDLE
( A* b2 F. W- j+ Z# U; Clocal pDacl: PACL
* I" a' w6 ]5 [! Ilocal pNewDaclACL 2 Q7 a3 ~0 V" L4 C1 q0 F- F( C
local pSD SECURITY_DESCRIPTOR ; s# ]# x) u* M9 p6 O9 U
local dwRes:DWORD ;
m o4 {5 I, Llocal ea:EXPLICIT_ACCESS ;2 ^+ g( d$ ]$ [8 Q" K6 x
invoke GetSecurityInfo,hSection,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION, NULL,NULL, addr pDacl,NULL, addr pSD1 y% f4 j0 l& w0 u1 A" b+ b
cmp eax,ERROR_SUCCESS
. K5 n6 `* `5 s- ~# wjz @f7 i- F1 g9 w6 ~0 s4 T
jmp OutSet
2 o, s- C% D% i4 ?6 l@@:9 U# h) e, \4 K$ n* a a
mov dwRes,eax
# c1 D/ P+ m, K$ |! e, [0 Amov ea.grfAccessPermissions ,SECTION_MAP_WRITE;2* j. n6 T+ E0 v0 a
mov ea.grfAccessMode ,GRANT_ACCESS;1
( g8 M- E& b5 Q% gmov ea.grfInheritance,NO_INHERITANCE;0. |: J3 D4 s! Z0 Y* n
mov ea.Trustee.pMultipleTrustee,08 v" R. {. t% Q% C9 K4 `+ Q/ A
mov ea.Trustee.MultipleTrusteeOperation,09 ^5 y% d+ u- Y3 p- B$ _/ a7 k
mov ea.Trustee.TrusteeForm,TRUSTEE_IS_NAME;1
9 u* | B0 g: Z/ fmov ea.Trustee.TrusteeType,TRUSTEE_IS_USER;1- K, p; d% H9 `3 u
call @f% e! r4 S2 A- }8 s. k! m
db "CURRENT_USER",0" M( b# v- k% C) K/ h$ x5 c
@@:) E' `* j; M) z9 f2 t& p
pop edx& j- n* I& r8 ~
mov ea.Trustee.ptstrName,edx5 _+ z5 x8 h3 i) H. H
invoke SetEntriesInAcl,1,addr ea,pDacl,addr pNewDacl7 W% k$ U( }( V& {
cmp eax,ERROR_SUCCESS
; H% ~- ]7 u, m; ]jz @f
+ C1 i' I/ U' X. ]1 ejmp OutSet9 c. w- M, v6 e. z% g
@@:
/ [& o- w2 C; J) Dinvoke SetSecurityInfo,hSection,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION, NULL,NULL,pNewDacl,NULL$ L5 Q0 a1 R6 P2 B
OutSet:$ E0 U4 e9 r1 N. w8 U s
cmp pSD,0
5 p1 ]9 ?5 `# Q/ Qjz @f
9 ]) k4 u1 ]! P$ B1 F V0 i9 ~invoke LocalFree,pSD; r2 @5 X6 Y$ w0 [* N# H/ f* L9 m/ p
@@:( q0 V4 `! F1 s5 M
cmp pNewDacl,0
( M/ \" T+ @7 z' p( G: f( jjz @f8 K& _0 ^* Z9 }; [* y5 g. n* z8 a
invoke LocalFree,pNewDacl2 u7 u, \' R K" T
@@:' \- i* |0 A1 N. v0 b
ret
9 x$ N8 {/ F( tSetPhyscialMemorySectionCanBeWrited endp/ u3 D/ _* o b& \
$ G, u8 ~4 [% @% I1 H' ~
MiniMmGetPhysicalAddress proc virtualaddress:dword! u8 Q; a6 `7 _0 H; g
mov eax,virtualaddress
: x/ g/ b* h- `( N cmp eax,80000000h
- R4 l& S- F; P6 w jb @f3 D. F! q2 y8 A4 @4 [4 ? Q. x
cmp eax,0a0000000h
/ f: l) |9 D1 E3 A. O2 P jae @f/ a6 j/ V: s6 J+ @- J* {! b
and eax,1FFFF000h: ~: a% z. ~; V9 m# D5 O; f
ret
! F" [/ ?+ j. P0 }1 P @@:
7 t0 y# b2 [' q' T! X3 i3 p mov eax,00 t$ D- l- [$ O+ A' M
ret
1 {* G1 Q6 x" {" l. N" L9 pMiniMmGetPhysicalAddress endp
. T: s$ F# ]' Q& @1 {# J) z# g1 d- i8 a8 Y$ r; v8 K5 a& S- L
ExecRing0Proc proc 8 b h% F0 k4 J) E3 y
local tmpSel:dword5 ]( p4 g! U' b$ G" V
local setcg:dword" e' B: ^1 Q+ D& j- s
local BaseAddress:dword
8 u' l+ | [7 ilocal NtdllMod :dword
" l ~/ t( \7 z- }" @+ L1 Zlocal hSection:HANDLE
; _8 X3 Y/ o+ v, wlocal status:NTSTATUS+ v/ w i$ v( r- q
local objectAttributes:OBJECT_ATTRIBUTES
2 u6 |" F) G# o' ^- `: z) U! {local objName:UNICODE_STRING
$ @2 ]5 M0 s. ^ K$ O# Cmov status,STATUS_SUCCESS;
! {/ l0 A, l0 }; \sgdt GdtLimit
. H9 V4 a$ Y+ {8 v3 minvoke MiniMmGetPhysicalAddress,GdtAddr
/ c1 h) m+ R# M' M" N- E: |mov mapAddr,eax4 e; U; }4 I4 k% s" K+ g& ]
test eax,eax. }' a8 }9 I! c+ y6 K1 k
jz Exit1+ h, W2 U( j. F) p( k W; q* s
call @f
: c9 \+ K, f/ ~& Rdb "Ntdll.dll",0
l# ^3 f! O3 @# a9 n7 Z& q j2 F- }@@:5 H8 V( C) ^ B' x0 h! r% q
call LoadLibraryA
6 O# c! U' D0 j; J! w* Omov NtdllMod,eax
' H6 Z! V* ]% u* G* c, a+ r
T1 a+ m9 q) c8 s& Olea edx,objnamestr
8 M) X4 o8 A, a% B: t% w) U0 Nmov objnameptr,edx
4 u( v& l6 d" c( P5 S4 j7 clea edi,ObjAttr
6 L1 W$ U/ B2 t; r" q% tand di,0fffch ;align to 4 bytes,or ZwOpenSection will fail
1 H+ t6 o Z! Q/ u0 s; E6 Y. J. kpush edi ;edi->ObjAttr
& V+ N+ M, Z/ v0 @+ u0 t% opush 24 ;length of <\Device\PhysicalMemory>
3 n6 k8 a! x5 `pop ecx& Y& r3 J% q7 F
push ecx
3 d3 L4 e o4 ?xor eax,eax
( V7 }. u: g& J a5 V- k0 X6 l3 Wrep stosb ;put ObjAttr with 03 i% { S% B0 P. A% V
pop ecx
, N3 L. l8 S$ z8 F Npop edi
4 o- i- a+ @3 h cmov esi,edi
, K( {, ~ n6 G+ U( g9 w+ dstosd
8 l% c8 s& |' V X" ^mov dword ptr[esi],ecx2 F* O! D, u! [& y% C
stosd
9 _9 Z% v/ D. {8 \) ]lea eax,[edx-8] ;eax->objname
0 M6 ~5 \1 o' c2 `( q+ fstosd ;ObjAddr(18h,00,00,00,00,00,00,00,offset objname,40,02,00,00,dd 2 dup(0). R) y, F* s* R
mov dword ptr [edi],240h( U, H( c3 ?/ L! [3 U% Z, t
! `. j9 B! X& y3 Fcall @f9 n5 {6 x/ O# B1 ?
db "ZwOpenSection",0
|& O; a1 \* B1 e# m% l. q@@:
1 p6 L$ G, r/ G8 Y0 Y6 X4 Bpush NtdllMod, z D7 _/ z% m
call GetProcAddress
- {$ t0 V5 y- |" [* g0 p6 R* \; [$ M Bmov ebx,eax ;ebx=ZwOpenSection
$ v4 E5 Z8 f9 T& [# a* s" B7 q8 p$ ? e7 | W1 {( p" L* Q$ F$ \
push esi ;esi->ObjAttr$ i. y# A+ U0 I4 _
push SECTION_MAP_READ or SECTION_MAP_WRITE
- B& k; S! m$ |% y# Mlea edi,hSection
$ r8 W( a; J p) \& gpush edi ;edi->hSection
8 \* ?2 _1 S. t) X6 xcall eax ;ZwOpenSection(&hSection,SECTION_MAP_READ or SECTION_MAP_WRITE,ObjAttr). m- s6 P, a% }0 D" U$ U
! K5 E* Q7 i) h9 B
mov status,eax/ F, H0 Q' P/ w" y' ]+ N
cmp status,STATUS_ACCESS_DENIED
: K$ p. p) z1 p' F8 L* \8 ajnz AccessPermit
, Q6 ?8 p. Y! k: k- J: ]: ?' Xmov eax,ebx
* ~; s, i) |- [+ i6 `* K# T
~0 T7 `/ ^0 o! m$ z# zpush esi
5 F3 u9 w1 y1 L5 b5 T: f0 qpush READ_CONTROL or WRITE_DAC ( k$ K' n. K' O+ [9 m
push edi
7 |* ]1 n. {% H( b2 Ycall eax
}- M* K% `( T; _3 O
5 Z: G3 V& j) G& Q& ]* Y; m; {' e( fmov status,eax
5 B: i \6 @" @5 vinvoke SetPhyscialMemorySectionCanBeWrited,hSection - S9 e- {# v k9 l2 ]7 I2 j
& G) o' C( L, o3 [call @f
; k! H8 y( M u: ~) N# {db "ZwClose",03 W; G- Q/ Q. P8 e1 @- A
@@:
7 c3 U" a$ C# Q/ @7 spush NtdllMod
) y z4 t( f) B) X6 u0 L# G. ]) ?call GetProcAddress
/ }2 x- O2 a! i
: @1 q* I# X" @% b; vpush hSection7 J3 t* K: e7 \2 h
call eax ;zwClose hSection
3 C0 d# s$ {/ T; F5 e- Z$ E$ a
$ ?4 P8 u, ]' X+ O3 @/ ^mov eax,ebx
$ E1 r/ e$ w# j' i% r
! Y( S: d+ E$ E1 I( {/ Tpush esi 3 ?, K# U/ ^3 R
push SECTION_MAP_READ or SECTION_MAP_WRITE
% Y3 [& {& k7 O- C- A) w9 m6 ?lea edi,hSection
z4 E% B/ N' ]# bpush edi
S7 G4 F. J+ Z e- F, n8 ocall eax3 K. `: v5 x% |) r# B% e& h
mov status ,eax6 P6 P2 _' u. ?% k) }; f
;status =ZwOpenSection(&hSection,SECTION_MAP_WRITE|SECTION_MAP_WRITE,&objectAttributes);
0 x: [+ \2 k/ s8 W: ~# s W/ c* MAccessPermit:
5 U9 h5 M# _, S9 ~" Y" wcmp status ,STATUS_SUCCESS
9 C; p) x( {8 t7 J! D# bjz @f
( \" w9 l8 C8 `;printf("Error Open PhysicalMemory Section Object,Status:%08X\n",status); $ G) S# q5 b2 i5 `
;return 0;" y9 Z# w+ R4 h1 k+ V
mov eax,0
: w3 M$ \; j. e: f2 t/ C$ m9 a) eret7 v+ A- q. Y8 k
@@:
5 x4 q5 S, `) D* X9 O0 Qmovzx eax,word ptr[GdtLimit]! d; K. [# A; v; m: v4 f5 r6 x
inc eax. M) A; Y+ q' l" W- i% Q/ f3 ~
invoke MapViewOfFile,hSection, FILE_MAP_READ or FILE_MAP_WRITE, 0, mapAddr, eax
6 l0 n! j* m$ v) C9 K: Omov BaseAddress,eax
3 N1 T: u8 H* R& bcmp BaseAddress,0
) k4 w: E1 w1 O+ b8 Y4 Njnz @f
1 A" c" K% I% e9 e;printf("Error MapViewOffile:"); 3 I/ K2 U4 K" |$ d
rintWin32Error(GetLastError()); return 0;
; W* e2 X9 v5 s% Tmov eax,0* M& }. T+ B$ s% T1 T5 U) U
ret
3 N" g' w" |5 A; r) J@@:
" M+ k3 b* P' S! H/ W/ v% v" rmov esi,eax ;esi->gdt base# [# x% b* V: c
mov ecx,3e0h
: ^2 D& E0 |8 W2 Pmov eax,GdtAddr
- C, q6 x& Z. @3 b.if dword ptr [esi+ecx+2]!=0ec0003e8h0 @/ L1 |# v- a9 O# e1 Y
mov byte ptr [esi],0c3h# [1 S3 R$ x9 r. x% q. p
, _6 L' Y7 c0 B1 i1 G% j- @. e+ i
mov word ptr [esi+ecx],ax+ O7 n& P5 O/ j
shr eax,16
- k# R: L! M/ x3 G/ D# Wmov word ptr [esi+ecx+6],ax
: ?+ @# Q- L. t' x+ mmov dword ptr [esi+ecx+2],0ec0003e8h
4 F% s& b" I6 K' u3 O% [0 I5 |! H3 q* T: U$ e% C" z# j/ y
mov dword ptr [esi+ecx+8],0000ffffh
* G2 [( i$ g" B* f0 ^4 B: }( r7 hmov dword ptr [esi+ecx+12],00cf9a00h: R( u3 r% i! }! W* h, w5 r
.endif1 J7 D* V, H$ j6 U8 u& u" p1 m
8 e; U; R3 L* L; i# D: T7 U
mov setcg,TRUE/ r* x8 \8 X# U5 ]3 ?, o
cmp setcg,0/ E& H1 y* F7 F3 l/ q& t
jnz ChangeOK% s/ z0 ~" A2 V x7 I$ P# T
call @f
) e( h' T d5 H+ a% Adb "ZwClose",0
1 G! d, T! k( d4 L2 B/ x@@:
) |4 S2 f1 D% K: e1 p' ]push NtdllMod3 X0 z* n" [ i( V
call GetProcAddress
1 S1 G# \( l1 ^# L# K* p8 A Tpush hSection! O$ R' ]% s5 m% m, k
call eax
* T/ U* m- U$ ~xor eax,eax
' I% `7 v! @5 M( ~" H6 \ret
+ E3 l8 p+ D% E @ChangeOK:
4 E2 H' a" y& g! r- Xand dword ptr Callgt,0
% O) _6 ?& w& Fxor eax,eax
" y, L: w4 S# x8 ?0 cmov ax,3e0h
7 E, d1 ~; x) G5 _4 o) Qor al,3h4 w* D& D! S* j3 u
mov word ptr [Callgt+4],ax 5 a) X( S2 ]$ V; s2 z: M
;farcall[2]=((short)((ULONG)cg-(ULONG)BaseAddress))|3; //Ring 3 callgate;
% I9 B1 i: L8 ]! I7 Blea eax,_Ring0Proc
* Q/ x. u0 D4 s0 h6 ^;invoke VirtualLock,eax,seglen
8 U3 Y R8 H( x% K2 M/ j1 L& ltest eax,eax5 d" ]) q7 q8 V! D( o
jnz @f
. q/ v) N$ o2 t+ L# Uxor eax,eax M! y) W8 _$ e+ D2 y3 J
ret
/ a i( P# y2 ^1 @4 V: T( W@@:! E, I9 k7 S5 O
invoke GetCurrentThread. ?/ T% O: N6 _# q4 m
invoke SetThreadPriority,eax,THREAD_PRIORITY_TIME_CRITICAL . y% {. Z# g6 W. C
. I* R! C9 K/ a. E# e/ ^# ^' o
invoke Sleep,0
# }8 u% l( s: o& I* h( `call fword ptr [Callgt] ;use callgate to Ring0!
8 }/ T1 S6 _* g' [) O% r;_asm call fword ptr [farcall]% @. t* H; G; I9 a: j# i' \" _
_Ring0Proc: ; Ring0 code here..
+ t1 h2 |' [& ~; bmov eax,esp ;save ring0 esp
. M: @0 u& j5 w6 y; Hmov esp,[esp+4];->ring3 esp' N2 E2 X2 b8 J, @) p! R5 ^3 D" k
push eax: m7 z' _2 ^/ Q+ a R3 Q' ?
mov ebx,offset stIDEINFO( d- w2 R/ ?, `3 b9 L
assume ebx:ptr IDEINFO
Z; Q5 F3 p; {* N \3 m0 F8 R;********************************************************************1 i5 B6 n* m" b5 E% I( m! P
; 等待硬盘就绪
" P# @4 D! y& L/ c ]% P;********************************************************************" |% {5 W0 f3 v
mov ecx,10000h
/ X3 @' C$ a; V# p mov dx,01f7h; n; J6 Q1 D3 r: |) [+ [
@@:. S! A8 P: F# W4 {7 j) b, l3 T' {
in al,dx
) D/ H6 W0 w: t) v+ I8 d) x cmp al,50h2 d3 j1 @7 k$ m5 q
jz @F
/ }* m2 P q( g$ }; A& [ loop @B( Z+ q J# l E/ @) W$ ~0 t" J
jmp _II_TimeOut! y' }4 x0 w2 d2 w0 l+ J6 ~
@@:
* t' q- ]' ~* R: y9 N1 G;********************************************************************; b2 k' F( U7 K2 ?: e5 @7 o
; 发送命令3 V( {7 P j' X. `- w7 i3 M
; 如果向主控制发送命令,则端口为 1f0h-1f7h
" L' _! q6 P0 d& h; 如果向副控制发送命令,则端口为 170h-177h. A; ?" }- `1 d+ \: V8 w
; 1f6h 如果要检测的设备为该IDE接口的主(MASTER)设备,
7 Q1 o( Y2 G+ ^; 那么发送 a0,如果为从那么发送 b06 f" W. Z+ j% x/ e, D" J
; 1f7h 如果要检测的设备为 ATA 设备那么发送 ec
7 \8 c) U* }' W1 g0 }$ A, Z; 如果为 ATAPI 设备那么发送 a14 f" t% J; \5 |
;********************************************************************4 P9 {1 v) [+ E' B. J2 q
mov al,0a0h ;Drive 0,Head 0( z' l w* B) a" _3 A1 _
mov dx,01f6h ;Drive and head port; i, V2 \& e8 E6 q1 S) H
out dx,al4 U% J z" {! h# G, f2 l$ f
' [8 [8 ?$ E, K! o
mov al,0ech & q1 g5 r' t3 [7 R( X
inc dx ;Command port g) a/ Z- C6 v; h' B, k
out dx,al0 ]$ ?* X6 X4 l" H
;********************************************************************9 t, H0 |8 C3 P$ [$ K0 b+ f5 D. ~4 p
; 等待硬盘就绪( _0 N/ x, n% ^( Y& @; f
;********************************************************************+ Y4 ]: E4 [3 O% Q# c. M" x, }
mov ecx,10000h
, m# C5 ?2 o" F4 K* U' O# X @@:
& C, F, E, [2 T2 `* W5 C4 b/ D in al,dx;1f7 (r-status register)8 ~: K, N$ { w0 k7 N
cmp al,58h;(driver is ready ,and seek complete)
% B; s1 s* y" l" h; p b2 J+ d jz @F
" K2 p, |7 R! I* Q+ H b loop @B
( y# d- x/ G {3 }: A jmp _II_TimeOut
4 Q! Z2 _4 [7 P5 U1 ], b @@:# Z4 p- T6 @9 g
;********************************************************************7 c* Z2 Q1 r; x! [1 b1 s
; 将返回信息读回
r3 S: T/ n" u/ U# j ^& P Y; 注意一定要读满 100h 个字长- f9 x- h/ M9 Y V1 E2 p) {6 J
;********************************************************************5 n3 s7 G# v# I$ y8 O& C4 R: U+ }
cld+ a4 v' ]9 I, m' B7 N$ |
mov edx,01f0h;data port - data comes in and out here9 F) i% ~) ~# Z. n* H/ A* J" Q1 f: N
mov edi,ebx
# C. j! e) ]4 X% {! I' m8 H mov ecx,0100h& {& }: P7 n6 t
rep insw
$ s2 t7 I$ R' X$ Y9 |; e;********************************************************************: w- \& v- r, L4 H, F2 C
; 返回的信息中,型号、序列号、版本号为字形式
- t# h( p- ]% u; 需要整理到字符串的形式8 K4 M3 r. r ^# V4 R
;********************************************************************
! c+ g& o% }2 e lea esi,[ebx].sSerialNumber2 v8 h/ e5 \& C
mov edi,esi
% F7 q8 L* }6 |0 c mov ecx,10
6 D9 p) w; Q* M! y+ `7 c @@:
3 {) @. w# ~! \- m" ~* p lodsw# s# {' x, V4 w* B3 v
xchg ah,al
& O0 _! k2 ?3 U stosw
- |6 K; z- _( k loop @B6 o" ?5 J, p x0 |, U
- y0 Q1 `/ M. `% L& a t4 w
lea esi,[ebx].sFirmwareRev
# h, g- \6 _1 c' Y6 t" E: D mov edi,esi$ K" R3 n* }/ y9 i
mov ecx,24% m/ j, z1 y* I ?7 i9 `, D
@@:
( y+ |; V+ e% K ] lodsw% U# b* o. Z- E( F2 `5 {
xchg ah,al" Z: ~+ p* j' v5 z0 i g" a
stosw
6 ]0 z- q1 B, W& ?1 { loop @B
9 {; B4 w3 l) @3 i+ D9 j_II_TimeOut:
! \, _. z7 Q8 m' C# H6 xassume ebx:nothing6 o& M9 l& v+ s$ p- b$ O! R
+ u; Z: T! S- c6 M3 q3 f
pop esp ;restore ring0 esp
, N6 U* u" Z1 q6 n, S, n* |push offset Ring36 n9 b3 q. n& Y0 k: c! e
retf! Q6 B" d8 ?: [ K, R
Ring0CodeLen=$-_Ring0Proc
4 M* l" P" E+ W( Y( \( W
4 F3 m) [, e* J5 `9 P" V! nRing3:+ \9 O; R( g' F0 k
invoke GetCurrentThread: N" b! e; j2 `6 Q$ E* r. K
invoke SetThreadPriority,eax,THREAD_PRIORITY_NORMAL 8 z2 g% x' t# X# n9 c1 `
' {& V1 q X5 F3 k
;invoke VirtualUnlock,Entry,seglen
2 r; M9 i. `4 D, P% \& j9 M. L4 S
" f2 W) k5 ]( n, Vcall @f/ @. {2 G0 U# m& ^
db "ZwClose",0, O# R! `- S3 c" D
@@:5 E4 o5 W( m) g: f
push NtdllMod
% I$ j% A- F) [# k% Ucall GetProcAddress! U; v. |" t3 a, f
push hSection# d* Q6 a( P( `! R! t- y5 I7 E
call eax& k" R# x2 G5 Q; F
mov eax,TRUE
0 N$ r/ n+ `# c0 n7 Eret
1 u" [5 M+ i( d; F6 D# qExecRing0Proc endp
+ R2 g, Z; w' w0 h$ y3 o4 B/ C* b" x& L5 D
main:: @3 w4 I. i7 G3 N0 [ P
assume fs:nothing. h5 ^: Y5 F+ \6 j: |
push offset MySEH
8 O+ G3 M/ J$ o9 `5 q# jpush fs:[0]
! v2 [, T, j7 t, e& U& Umov fs:[0],esp
: D6 q! ^- e# Z. U: o2 G" R/ Ymov OldEsp,esp- e [/ ^# S, f8 s1 ]4 f
mov ax,ds ;if Win9x?3 }" P& G% T3 m
test ax,4; e/ _3 [% z4 g6 f( Y& p
jnz Exit1
, [% w& Y4 _5 a. xinvoke ExecRing0Proc% @' @% ^# V, `7 j+ o! w9 I
# S% x1 ~& y: R+ ]+ t: ]$ m
.if stIDEINFO.wNumCyls( {- b8 ^" n5 Y* Q% d5 H" i9 v6 h2 I
lea esi,stIDEINFO.sModelNumber! c: j1 R$ l! T, }. \6 m
mov edi,offset szModelNumber6 }+ X) Y/ v5 b, _% o y( i- d
mov ecx,sizeof stIDEINFO.sModelNumber, m5 g0 c# C# [6 G
rep movsb/ u# \: r7 T8 i0 Y, T
% S/ N& j$ p+ {5 ]+ m lea esi,stIDEINFO.sSerialNumber
, b8 J4 N" y2 X" o4 B# Q! P% d mov edi,offset szSerialNumber
; I/ I% g9 K4 D2 ]: G mov ecx,sizeof stIDEINFO.sSerialNumber: e: {9 Y9 S+ Y$ A' {: q
rep movsb/ [5 u- b8 M! u1 E" B/ j1 Q
+ P$ B& \5 A% s3 O% K lea esi,stIDEINFO.sFirmwareRev9 Y( w0 V% a) G# e9 ]
mov edi,offset szFirmwareRev" x1 { h. e/ p- G
mov ecx,sizeof stIDEINFO.sFirmwareRev7 {5 C, f6 P$ y% `$ W
rep movsb
- e9 g2 b5 e; s7 L
7 D" a4 V8 `6 u' V5 W1 G movzx eax,stIDEINFO.wNumCyls6 J1 [- ^/ J5 b1 z
movzx ebx,stIDEINFO.wNumHeads
$ \5 j. _& Q) ^5 E0 \* k n movzx ecx,stIDEINFO.wSectorsPerTrack0 v& B2 x4 D8 D. }, f6 i5 a
movzx edx,stIDEINFO.wBufferSize) K# P" z7 ^/ ?4 S6 k Y
invoke wsprintf,addr szBuffer,addr szIDEInfo, eax,ebx,ecx,edx, addr szModelNumber, addr szSerialNumber, addr szFirmwareRev0 C D) r- W# p @ q/ ?) m
mov eax,offset szBuffer* d8 c3 j( E/ V/ y7 V5 b; ~2 U6 \
.else
, ~( C7 K4 i) g4 B$ S mov eax,offset szErrInfo
4 r1 h2 a* P5 Z7 l. V, O.endif& S' j! J! X0 c; t4 \
@@:
3 _$ N0 M h; r. i9 G# Iinvoke MessageBox,NULL,eax,addr szTitle,MB_ICONINFORMATION or MB_OK1 F- b" s$ R; b
Exit1:
- y" W* J( q6 S: L5 t epop fs:[0]
5 R: V3 z2 n h) ~3 v/ }add esp,4
" ]# o7 ^: ]6 l# k9 m: z4 j& Einvoke ExitProcess,0
1 R$ }) k6 }3 _
9 I3 M$ _/ T9 bMySEH :: v# r9 q- D" U& b0 s) U
mov esp,OldEsp
# U- D2 l. Q! f8 W- j1 Gpop fs:[0]
0 v, I |; A3 ~4 R( a& fadd esp,4, k1 A. Z# R' o$ O1 o0 U& P( D
invoke ExitProcess,-1
1 B# i9 ~8 ^5 v. A" }end main; C, O2 h& }2 G( Y) f6 S
H5 V/ Z% M1 A' G \/ u+ n
[此贴子已经被作者于2003-11-2 18:14:02编辑过] 8 q4 g0 E# N" T
|
|