该用户从未签到
|
我可没这个水平
7 Y* i1 b9 D/ r3 k3 s5 f% k.686p; H' g" ~- B3 H# k& i) t7 y
.model flat, stdcall3 f" c5 b0 X' }9 [ K( R T/ \
option casemap :none ; case sensitive4 b( n: i" S3 p
; #########################################################################
: B0 ^3 Q: H5 X, R& m8 Finclude \masm32\include\windows.inc
5 I4 g) ~) p9 u4 D" V1 D9 H; winclude \masm32\include\user32.inc- O. [8 e9 y4 H I3 N
include \masm32\include\kernel32.inc) `7 I% F, c7 E5 a6 N9 K
include \masm32\include\advapi32.inc3 s: s! X6 U0 X* J9 `8 M; V
9 O, @7 V; l! o+ C: ~: Wincludelib \masm32\lib\user32.lib; ?- N$ N9 e& [; ~# r5 m. V7 D" q
includelib \masm32\lib\kernel32.lib
/ E6 l: N9 e/ f' Z3 Hincludelib \masm32\lib\advapi32.lib
2 X8 W1 h8 K5 `2 {DEBUG = TRUE
3 D! S+ r; c5 \! H
% t) M8 `$ Q7 [9 THMODULE typedef dword1 p5 l, G1 y3 v) D' Q' T
NTSTATUS typedef dword
$ a* P; W* a' q: u) HPACL typedef dword
/ z/ ^4 a0 e; @% d$ UPSECURITY_DESCRIPTOR typedef dword4 N( t# U: V$ d, Q. D% z
( | C& d( I8 `, r3 U- D% y; ROBJ_INHERIT=2 # [$ d6 e% p+ X0 {7 v7 z0 S0 \
OBJ_PERMANENT=10h
, z# n. q/ t8 R, O1 XOBJ_EXCLUSIVE=20h
1 t; U1 e4 r& s- Y8 D4 UOBJ_CASE_INSENSITIVE=40h
1 o" |& Z1 I4 p7 sOBJ_OPENIF=80h
1 S8 ]4 c$ z8 F7 H C5 L( G. T5 HOBJ_OPENLINK =100h % w% e; K6 D- u& \) _ L1 Z
OBJ_KERNEL_HANDLE=200
( [* k" S0 {* Q; COBJ_VALID_ATTRIBUTES=3F2h
6 g/ V9 t6 R4 |; o$ u' {3 m6 u, {7 s {# }+ B/ L0 e; K
SE_KERNEL_OBJECT = 69 `0 @- ]; G3 U4 v
GRANT_ACCESS =1
( y0 e3 N( k+ {9 A( V X& ^NO_INHERITANCE =0+ `; j$ K5 P3 \7 J
TRUSTEE_IS_NAME=1( }& [* c1 C5 m& R' M" F2 V+ {
TRUSTEE_IS_USER=17 N' @. H$ R# o, Y: h- X
STATUS_SUCCESS =0 ! n8 ]: i& G( H5 r; _
STATUS_ACCESS_DENIED =0C0000022h
! i [9 C/ q9 v1 N* v2 O1 m A% S5 L6 e
STATUS_ACCESS_VIOLATION equ 0C0000005h
. A w! G2 ]4 f" d; y3 y: A; [STATUS_INFO_LENGTH_MISMATCH equ 0C0000004h; Z6 H; C+ D. v, I" }0 Q4 V- F8 B
SystemModuleInformation equ 11
/ x9 o9 b' q4 @' ]PVOID TYPEDEF DWORD8 i" [, a" q5 ]2 N! B* o
UNLONG TYPEDEF DWORD
4 i% F+ P# @2 D$ S" e% wCHAR TYPEDEF BYTE
, L6 m' C7 V8 Q2 ]) |
) X& z( `! t' Q9 {UNICODE_STRING struct
! R& C1 m; S8 D( ] nLength word ?
3 j5 q, A1 {; H MaximumLength word ? : Y/ b, p9 K9 e/ V! d6 T
Buffer dword ? * w" @ `0 C7 `0 b% G7 p) N! {
UNICODE_STRING ends
" ?4 \0 Z+ `9 ~
8 c: Q0 l+ p! ~6 ~OBJECT_ATTRIBUTES struct * R9 M& M$ L! k# J8 p/ a. R% g3 F
nLength dword ?
) ?" w2 w9 O8 i7 ^1 x3 [ RootDirectory HANDLE ?
4 `, `3 h2 h9 y ObjectName dword ?UNICODE_STRING
5 }8 \. S7 R2 Q& y' @+ P9 G Attributes dword ?;
, y9 A" A) Q3 U/ R8 j" v SecurityDescriptor dword ?; PVOID // Points to type SECURITY_DESCRIPTOR
1 Q0 n1 U( \$ s% `5 H! c SecurityQualityOfService dword ?VOID // Points to type SECURITY_QUALITY_OF_SERVICE
; k6 _0 i: d% U: fOBJECT_ATTRIBUTES ends 5 A% w8 C% e# Y0 ~2 _+ @( ]) R4 v
/ A' I: ~. X1 A& B+ h
7 H. v, g0 O; QTRUSTEE struct
% x- b+ |: K/ }8 M. b9 i, r6 s pMultipleTrustee dword ?TRUSTEE
" @' j$ Y. U; q$ e* A3 g MultipleTrusteeOperation dword ?; MULTIPLE_TRUSTEE_OPERATION ' o5 H$ N% n' X2 ?; `, R
TrusteeForm dword ?;TRUSTEE_FORM
6 e+ ~- @0 p6 A+ D TrusteeType dword ?;TRUSTEE_TYPE
9 s7 M2 L0 ?% v ptstrName dword ?;LPTSTR . g3 R% i- O F1 q6 U; i7 C* _
TRUSTEE ends k: m0 K9 R8 L) x: v
( _4 @! @ b7 Y. H: m6 Q# n4 Z2 `4 a
EXPLICIT_ACCESS struct+ G) ~/ S, a4 w( F4 i
grfAccessPermissions DWORD ?
# k7 d: [* j! O# F grfAccessMode dword ? ;ACCESS_MODE
M1 j, K0 @+ v$ J8 U: c- n grfInheritance DWORD ? ;% M' B5 J& I+ D, E# q9 U* X
Trustee TRUSTEE <> ;
% [7 |: R' W) Y( O2 G) WEXPLICIT_ACCESS ends; B" m' j9 y% Y! q) V
4 q, W1 q3 u' D; H7 X) mMyGATE struct ;门结构类型定义# l7 g, s4 E! O6 C' P+ C+ U
OFFSETL WORD ? ;32位偏移的低16位* t0 \% e# Y" ?, t/ M- `
SELECTOR WORd ? ;选择子! c$ U3 e- v4 t. A, @4 C J
DCOUNT BYTE ? ;双字计数字段- n: b, x% T8 X
GTYPE BYTE ? ;类型
$ q0 @* |' C+ a9 I OFFSETH WORD ? ;32位偏移的高16位
! z t! G1 s* C5 x/ y$ w+ CMyGATE ends
, I7 q0 b0 s- A s, ?; J: {- L
; n& b- B( H: {# T3 T. \IDEINFO struct! l4 t" L Q6 l7 N# s( O- c
wGenConfig dw ?
9 [% i/ Q% \0 R9 i0 OwNumCyls dw ?;拄面数# _3 j( ?# O ?3 o
wReserved dw ?: g5 C* U9 h/ C* b% }3 t
wNumHeads dw ?;磁头数6 e, ^. e. d8 Y
wBytesPerTrack dw ?;每道字节数1 O8 g- y( |1 q7 |
wBytesPerSector dw ?;每扇区字节数
$ C" E( e3 h9 D2 ~wSectorsPerTrack dw ?;每道山区数: O4 e; @4 h" T0 o; z6 Q
wVendorUnique dw 3 dup (?)
d0 A5 \/ A0 I3 p. e+ xsSerialNumber db 20 dup (?);硬盘序列号4 t2 w1 t/ p6 U8 ]. ^: D/ u
wBufferType dw ?;
$ } [$ x8 V6 Q, ] n1 z4 B- }wBufferSize dw ?; ;n * 512
# `! A& D3 S0 nwECCSize dw ?
8 e) N( c# h6 s& x" D9 JsFirmwareRev db 8 dup (?); b: u% ?; s Y$ c) n* ?
sModelNumber db 40 dup (?)
0 Z9 s7 g1 D2 ^% q% u& h7 }wMoreVendorUnique dw ?
) E' X2 k) F) q: b8 L8 ewDoubleWordIO dw ?
- {2 b: P8 J/ x2 TwCapabilities dw ?; [' p l B- g0 P D2 y- Z
wReserved1 dw ?4 b2 {7 q; W$ Q5 F6 `% \4 p! g
wPIOTiming dw ?;
: n2 |: R) }$ L; |" UwDMATiming dw ?;/ v: l) x5 d' v$ w. O3 ~
wBS dw ?
- U8 [; }, A/ I. E) E$ cwNumCurrentCyls dw ?;- f; s, m5 Z. q0 U# \0 _
wNumCurrentHeads dw ?;
) \, Z7 c3 A' [4 X) _( C( Z+ ~6 b; GwNumCurrentSectorsPerTrack dw ?;
. K" ?# e7 T2 [1 ~- MdwCurrentSectorCapacity dd ?;& F' Y9 c/ v: q& }$ p
wMultSectorStuff dw ?;7 G- j/ w" d9 Y2 b
dwTotalAddressableSectors dd ?;: @6 L+ R' H5 a: @+ p7 d* o0 _; l5 e8 \
wSingleWordDMA dw ?;
7 e7 ]: F% y/ ewMultiWordDMA dw ?;
7 Y: l& M4 i7 x6 k# e( ebReserved db 128 dup (?)9 F3 Y8 [5 q0 p/ V
IDEINFO ends# x9 a) l/ L$ I" T8 }& j! _
+ p# m; i3 T+ H* p- J8 R2 _+ D4 u0 m2 {/ ~
SetPhyscialMemorySectionCanBeWrited proto :dword8 g. u) o$ F' s; f# F$ `
MiniMmGetPhysicalAddress proto :dword2 R6 [3 y- A4 k
) a+ }: `9 e4 |ENTERRING0 macro; L F( x9 r7 W+ G/ A) r7 Y1 j
pushad ! P3 v4 ?3 G! @4 v+ |
pushfd
6 q f9 J2 V9 Z+ b4 pcli
% t/ n( s' V! a" m4 K1 @ Pmov eax,cr0 ;get rid off readonly protect
; ]" K# b4 ^ p# s+ D: dand eax,0fffeffffh1 h0 x5 i: n2 n1 _
mov cr0,eax
* Z, i5 g8 s: |6 eendm
! E1 k1 x$ @/ {; P5 Q) A9 Z" w6 {$ x" X! U2 l. Z% e
LEAVERING0 macro; t/ i) \! X, T* v: p8 D
mov eax,cr0 ;restore readonly protect
3 S1 s0 C+ ?. c& I( n7 U5 h2 n ^or eax,10000h+ Y& o4 Z4 o2 R4 X- x8 ^
mov cr0,eax6 y9 w4 w. K4 z. F: I
sti
; [+ D: U+ y) N, n+ cpopfd ; q9 G# @& S) z7 p- h) R
popad
" c. Z1 c" ?# @! z0 fretf' Z. p1 g" a" k0 L0 G, U6 ?
endm
7 p7 Y5 Z( k( w
+ ^# g* K' C3 D- D* F# K
# X. Z' i- ~$ x- y# \/ pUNICODE_STR macro str
; f4 d; v8 a. j7 n7 ]8 r3 ]0 rirpc _c,<str>
5 t7 H0 v1 O; O5 K- l; j- v+ I3 [db '&_c'5 e* B Y" Y6 p( Y2 a
db 0, y- X* X& H7 n# E9 U
endm
: g9 f- d, N+ V- G* U) s+ B4 lendm& E/ g% @8 I- l4 ^/ Z
+ l, _+ [" ?( _* @( J5 I
.data?
: Z; q t8 }2 XGdtLimit dw ?! p9 u3 P7 P1 k) l1 G
GdtAddr dd ?' v5 j. D9 _! z- a( o
, P2 c6 m2 c% n7 i" _. G
mapAddr dd ?
; h) N- Y5 ^8 H6 @9 O& ~' [OldEsp dd ?
9 k; L. T( `; H" Z/ t& F. X5 c6 ~9 v2 j' n
readed dw ?
, ?" c" ?8 n, K9 Sbuffer db 512 dup(?)+ X! v* @% J0 I( [5 b3 X4 c* m& V
ShowText db 512*3 dup (?)* u6 V+ W( p$ x( v
! I9 E5 k; C. g; Q0 ]szBuffer db 1024 dup (?)7 n3 H+ y7 u0 n
szModelNumber db 41 dup (?)
# ?; x& { U" O# m) [* |) {szSerialNumber db 21 dup (?)
+ e) d* R* V3 H# ~( Z; wszFirmwareRev db 9 dup (?), J5 m; o" }4 P; k- K, T- O4 ^
4 S" U8 r$ k& L6 z
stIDEINFO IDEINFO >: g2 J. s: K5 t a; k; G; _$ y
6 @/ R4 e1 o3 \) t8 z9 o.data
2 c" Y2 u# p# |+ \& N% palign 40 Q" q4 n4 y! B8 E9 D" p8 _# s$ V L
objname dw objnamestr_size,objnamestr_size+2 c4 X$ D. r2 l: V! _
objnameptr dd 0( N4 e4 @- U& Y" Q; D# H
objnamestr equ this byte% d8 ?# J7 z/ z( q: t* t |( ^/ h
UNICODE_STR <\Device\PhysicalMemory>
; R* g* t* s, |$ jobjnamestr_size equ $-objnamestr
) V- b6 g7 b; x* M+ [& l' I% V* @; L8 J& M
szTitle db 'IDE 硬盘信息',0
+ B7 A, N0 v4 ^* c; QszErrInfo db '无法读取硬盘信息',0: g R; Y& K6 ?. }
szIDEInfo db '柱面数 : %d',0dh,0ah& L. e: d6 e' M) W1 s8 ]' o
db '磁头数 : %d',0dh,0ah: ]( L/ M) Q; _ f s' b( N6 S! b
db '每道扇区数 : %d',0dh,0ah
' @9 n- W( L; D) l$ K db '缓冲大小 : %d 扇区',0dh,0ah& S7 B7 ?5 l6 W% ~5 n* F
db '硬盘型号 : %40s',0dh,0ah
8 E+ s; Q4 y8 l4 Y1 u" I/ v db '序列号 : %20s',0dh,0ah
( w/ b- ^: T. D db '版本号 : %8s',0! K3 E) `* k/ O
' Y, ^8 x9 c; E. Aalign 4
8 R' E$ T; \. g. C+ JObjAttr db 24 dup (0)
& k4 o6 Y! N* l4 A/ u
5 F2 Y+ ~! R: u) S+ C/ ZCallgt dq 0 ;call gate's selff
w8 F& ^' X( ~' ICaption db 'Windows XP绝对磁盘读写',08 ^0 O9 q8 X( O- ~) ~8 ~
Digit db '0123456789ABCDEF',05 ^$ i; u4 w0 u0 S# Z6 w. T$ \# r/ f
.code
9 b3 `7 g% B9 R8 S# \$ u_ShowBuffer proc ;显示所读出的信息4 I# Q9 d/ H8 t/ W7 \- q" T( p4 z
;把数据转换成16进制的形式
* H* J- t8 N4 D7 G8 s! I8 ^, ~ mov [readed],512
7 _' A4 @$ H( H4 g mov esi,offset buffer ;数据
3 a6 q& D# @0 o mov edi,offset ShowText ;转换后的数据; R# U/ y- S! N7 l1 f
mov ebx,offset Digit7 T+ G. S: ?. p
xor ecx,ecx
/ t5 \+ T+ R. }2 y$ |4 J/ ~ xor eax,eax
% m4 r* q2 k- u0 m4 l- H& YcomputeAgain:
; E8 O# l4 {8 {+ v' J, Z% F cmp [readed],0! H. _2 i5 o K" ]$ ?: R9 b5 H3 t
jz endCompute
9 L7 b" o/ I; e0 T dec [readed]1 j. @/ W" B1 n0 k/ L
lodsb
- F/ l& h% `( o- Z7 I push eax. \. x+ N9 \0 t" B) i
shr eax,4 ;高4位' [& g" a; o9 A3 Y/ T; s& G1 X
xlatb7 F5 u3 ]7 i: v1 {) `7 J" }
stosb- T5 G G' v5 x
pop eax
' Q9 [5 m& N) Q+ J and eax,0fH ;低4位
6 ?5 q! O. C u: U+ N5 }1 ~- d3 I xlatb/ N2 U" L- F/ f+ h0 U
stosb
' k( A% D% j0 J1 I4 C. s, h mov byte ptr[edi],' ' ;空格
) a! Q$ G% _" k inc edi
3 o6 ^+ t' c2 N inc ecx: M5 ^ |' z, J" ~- e2 N9 \+ |
cmp ecx,16- p6 k4 q! ^2 o/ q) t
jnz computeAgain
( a4 n9 d' w, Y' Z8 D o/ `( R0 A xor ecx,ecx
7 p. f4 ^) g. k mov byte ptr[edi-1],13 ;回车
. h) `) ]& ?; E+ T! U, C6 b0 k jmp computeAgain
$ r' n" w) U& p( b- \endCompute:
: I. N- p# u6 M! O+ T2 @% M8 x# W ;显示
! }# ?/ P' A* v6 U invoke MessageBoxA,NULL,offset ShowText,offset Caption,MB_OK# A Q* F& B- E( o7 A, Q! W2 ]" ~
ret$ _+ C* B1 ~( K# x3 V4 g+ E: x% _0 ~
_ShowBuffer endp0 n% H# u) a3 z+ G3 L/ b
3 e8 g6 L2 i4 K
SetPhyscialMemorySectionCanBeWrited proc uses ebx esi edi hSection:HANDLE & f3 C6 x" f& W
local pDacl: PACL 4 @- o; H2 l6 Q$ U, R+ B( w
local pNewDaclACL
4 I* U- V) u. S% S! T; k5 P$ Zlocal pSD SECURITY_DESCRIPTOR ; [' ?/ d: P# M) e& k7 v
local dwRes:DWORD ;: N5 H/ b! R# G, v* z9 V& O
local ea:EXPLICIT_ACCESS ;
$ W' `2 A8 a* W6 s" v* Z' ninvoke GetSecurityInfo,hSection,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION, NULL,NULL, addr pDacl,NULL, addr pSD @& [$ U7 t1 f' Q2 n$ M
cmp eax,ERROR_SUCCESS( I- y3 B8 V/ \; f4 x1 C* O5 l i' t4 B
jz @f
+ K" P" Y @8 G' Sjmp OutSet
+ O; S4 N" n [3 @. F@@:
6 y' w' v9 C# M. @mov dwRes,eax/ X1 U$ {) g! V" g% u
mov ea.grfAccessPermissions ,SECTION_MAP_WRITE;2
9 x' Z, R. V( _& u, Y' s* lmov ea.grfAccessMode ,GRANT_ACCESS;1
s. Y2 Q+ t% G o4 @1 }. J# hmov ea.grfInheritance,NO_INHERITANCE;0 b1 e7 h; \$ Y0 Y8 q8 {. o( r
mov ea.Trustee.pMultipleTrustee,0 B6 o f/ V( T9 Y+ c+ p5 P
mov ea.Trustee.MultipleTrusteeOperation,0
3 p9 q* N% |% w4 b0 Emov ea.Trustee.TrusteeForm,TRUSTEE_IS_NAME;12 Y( D ~& v9 A) Z/ T* M
mov ea.Trustee.TrusteeType,TRUSTEE_IS_USER;1, _. E4 ]# x- X. d% a/ b$ B5 J
call @f
8 d& ?/ N( J6 u5 |7 F# Idb "CURRENT_USER",0' S1 M% V2 o- {, K# P1 r
@@:$ n' f/ d; F9 p' ]9 K* G/ P( p$ E
pop edx& m7 p( i6 c0 l& y
mov ea.Trustee.ptstrName,edx
* X q8 h: n# r! U: R; cinvoke SetEntriesInAcl,1,addr ea,pDacl,addr pNewDacl1 Z; `7 L4 d8 w% E+ I
cmp eax,ERROR_SUCCESS
( _" \% x6 A0 ]4 V; N% cjz @f
* B6 r7 w0 v2 k2 u: n( d8 Y) ?! F' b, @jmp OutSet( P6 n$ H4 c4 {! d
@@:8 w, L3 P n4 D
invoke SetSecurityInfo,hSection,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION, NULL,NULL,pNewDacl,NULL
- M s( V" z$ I; ?2 ]. WOutSet:
8 a1 I2 s' ?3 T ^* qcmp pSD,0+ a J0 }4 a) t& B/ L& r K& R
jz @f3 |4 Q/ {/ l3 B9 a* s
invoke LocalFree,pSD
1 q! b9 y1 \2 u/ w@@:1 p# T& Y0 R7 ^
cmp pNewDacl,0' k* ^0 c, x5 g+ }
jz @f& Z% d! Z, q5 ~
invoke LocalFree,pNewDacl: D/ X$ z4 |3 t
@@:; M+ ^9 J' U( }$ q% n0 y- g% m
ret- n/ c& U: u( H0 a( U! t
SetPhyscialMemorySectionCanBeWrited endp
4 S1 x @6 x; T5 A8 @( U: I M1 P' I( _3 Z) P
MiniMmGetPhysicalAddress proc virtualaddress:dword# R% R' q% {, r
mov eax,virtualaddress
6 {9 T0 e& ]0 i cmp eax,80000000h
/ y+ f0 f' I# b( L5 d jb @f
' u3 O$ {: N, ] b+ ?7 K3 y" a6 g cmp eax,0a0000000h
# F8 W/ J9 g+ N3 t' B: \ jae @f' K( d6 T, p' w+ T( s: h6 h1 c
and eax,1FFFF000h
$ F7 p. ?; Z3 D4 u- r! S ret2 Y$ }, G6 w; o T1 z6 h7 b2 A: R
@@:
4 @# ~+ _- \! z. E- ^& K mov eax,0
0 Z. [, E6 L7 y" ~. t/ T ret
2 w4 c, w# }" }# `/ c5 xMiniMmGetPhysicalAddress endp9 }/ [: t2 ?$ ]. _" i, Q5 d+ z1 ^
& U6 v: k4 v2 a- b) cExecRing0Proc proc
8 N$ }2 S: @% Z# I: Clocal tmpSel:dword
[; _6 [2 a; _" Q% c0 P9 Glocal setcg:dword
0 n$ N" E6 B9 x/ Elocal BaseAddress:dword7 J, K5 @8 N; D% C: w; P
local NtdllMod :dword
2 @! |5 O* n- Q3 R% Ilocal hSection:HANDLE 8 r0 a% Q3 X4 e& l9 n
local status:NTSTATUS9 H3 U: e+ y! y1 Q |
local objectAttributes:OBJECT_ATTRIBUTES
! r8 T; Z% g0 G1 y/ Dlocal objName:UNICODE_STRING+ `, p0 Z3 ]6 c+ z2 c/ O
mov status,STATUS_SUCCESS;
: \. {" L4 E& S7 L& Hsgdt GdtLimit
U* B+ F2 R( q; linvoke MiniMmGetPhysicalAddress,GdtAddr
5 m1 F2 p' P J2 a/ Rmov mapAddr,eax
4 o* O2 U) F& D/ r& K! q5 rtest eax,eax7 v v$ {% X- ^0 _' v
jz Exit1( ~' Q# X8 S: u) @* V" u7 h1 l
call @f
* f' \+ _0 } E$ \% M( E# K* G0 e! ldb "Ntdll.dll",0* K' s4 e- M3 Y( z
@@:9 h- Y: b8 D/ H! x
call LoadLibraryA1 O8 y5 U0 e' B7 }+ L& x
mov NtdllMod,eax
$ ?' r2 W' [+ ^6 m! c# Z% s% I! z# Q7 o1 _# j" A
lea edx,objnamestr
* T6 E" }+ A" y! b4 e) lmov objnameptr,edx1 M5 c4 V+ R1 }) D" b
lea edi,ObjAttr
% d; R( S# x' B; Xand di,0fffch ;align to 4 bytes,or ZwOpenSection will fail
& M1 r0 U; s/ s% x7 u: Dpush edi ;edi->ObjAttr' P* P5 ^/ c9 k( r& C. C" J
push 24 ;length of <\Device\PhysicalMemory>3 h6 z: y- ]: j' W
pop ecx. E3 W/ E2 `6 C/ y/ W6 F# g6 r
push ecx
9 a0 `% p, ~ a& U; A7 bxor eax,eax6 B3 L! n% F3 g5 Q9 m7 F' }
rep stosb ;put ObjAttr with 0
7 m+ t1 D3 _$ j( u) opop ecx' |9 y5 t1 N, N: J
pop edi3 Z0 z. l( L: _0 X+ U8 _, L. t
mov esi,edi8 o7 ~' R7 A2 Y4 r
stosd
% y I6 T; m/ }9 i% Bmov dword ptr[esi],ecx
$ P! F u' ~5 @8 ^* \) [stosd
2 @1 G0 c8 S% k0 O# ?7 Llea eax,[edx-8] ;eax->objname+ Y9 g1 N' L8 N, t3 l3 H
stosd ;ObjAddr(18h,00,00,00,00,00,00,00,offset objname,40,02,00,00,dd 2 dup(0)
& I( F( w" v) O% d# Hmov dword ptr [edi],240h
5 Q+ N8 y8 b7 D0 U) u
+ ^/ X, f, P+ A! D9 wcall @f
- S% V5 X$ W' j& {$ T: ndb "ZwOpenSection",0
r# K) H0 D* y6 W$ l@@:
0 C, x- j) L: z* Y" z; @" {. m; A2 ?push NtdllMod
- Q6 l. Q! r7 W7 s; A2 G( Z, zcall GetProcAddress
2 }9 a# T2 f+ _% ?2 Gmov ebx,eax ;ebx=ZwOpenSection
( @4 k9 f+ Z: b7 a
7 z0 l& b' |- T/ bpush esi ;esi->ObjAttr/ B7 H& |! x3 Y9 Q- {
push SECTION_MAP_READ or SECTION_MAP_WRITE! ^2 l/ h* m0 d* p" h5 l
lea edi,hSection! X J# `6 z- R9 O! }1 D
push edi ;edi->hSection; w7 @) |) P5 o, i+ s
call eax ;ZwOpenSection(&hSection,SECTION_MAP_READ or SECTION_MAP_WRITE,ObjAttr)
K7 K9 T, f* c2 q9 ~8 @% C! l# t) L) u
mov status,eax
$ L2 G- t! `( j5 j" Q C! bcmp status,STATUS_ACCESS_DENIED
4 A. ~; w! o1 Ajnz AccessPermit
& U5 C" l" r* C5 s" imov eax,ebx# l) @+ C) I- y3 i' b7 _! F; ?
9 ?/ t; H- W8 u- f7 u: F1 A
push esi
7 i9 z3 g! h' hpush READ_CONTROL or WRITE_DAC " S& s' H* i7 u6 S b5 S; R
push edi 1 Y) q2 L2 }! J8 ]+ Y+ r0 ^* s: L' q* \
call eax % L" W+ H# D; x* r1 }! G; f: |
" {) A( \/ Y; _7 o2 d8 f: jmov status,eax. ~+ X' E( M5 F' ~+ |# G H
invoke SetPhyscialMemorySectionCanBeWrited,hSection ' z( L/ }0 l/ T* S
6 F3 b: Y/ d2 J/ Z9 c: I
call @f1 C4 R% v- l) b; J: I$ D- f
db "ZwClose",0! W' Z5 S2 `: T; {% g( ?
@@:
: a) H" G+ }* ~" B. mpush NtdllMod6 [' o+ L2 q3 i E
call GetProcAddress
% h( k! J8 F; u* Y0 Z d, \! c+ G0 ?5 Z' ]0 r( i
push hSection
; y9 y3 j* T! G7 ^call eax ;zwClose hSection
1 ?9 i0 n% d; I" ^- ?
: p `3 ~" j2 C8 N4 ]7 m4 tmov eax,ebx: c# R# M' z9 j/ h
% B. N5 p7 E# O, e- D+ R, L _, s
push esi
6 Z) s2 f7 ~- N; x/ @9 f5 }push SECTION_MAP_READ or SECTION_MAP_WRITE
. h& `" ~' f4 O& L* t, ulea edi,hSection
/ U! N$ V9 {8 ]) }! l8 e$ }push edi ) _+ O1 P! i* L( \. k/ `( t) z& C
call eax+ ?) N% t+ }! ?, H3 f
mov status ,eax2 W1 {: q8 o2 j' P2 m& J
;status =ZwOpenSection(&hSection,SECTION_MAP_WRITE|SECTION_MAP_WRITE,&objectAttributes); # Z5 P0 u I, `
AccessPermit: d( Y, H) }* n+ f, \- }
cmp status ,STATUS_SUCCESS : J2 i) T: C4 R2 n2 S
jz @f
) h4 Q2 u7 J5 D+ w0 L c, t;printf("Error Open PhysicalMemory Section Object,Status:%08X\n",status); 1 x5 J( O5 V {+ }
;return 0;
/ b0 C! j- g% g7 k# lmov eax,0. t0 f/ Z* ?0 K# y5 }
ret
- I6 s& |( R W; m9 y' F@@:
" t# F; ]/ O, {movzx eax,word ptr[GdtLimit]. W( { I7 y2 H$ @" P% ^
inc eax' [. G# {/ L6 n* g6 c( Z
invoke MapViewOfFile,hSection, FILE_MAP_READ or FILE_MAP_WRITE, 0, mapAddr, eax
. d j( i0 P# s. C9 f Tmov BaseAddress,eax
8 c: U/ ]2 x; M5 ~% K% ocmp BaseAddress,0# Z D+ C G7 i+ \: ]6 M- S. l4 A
jnz @f6 H% H7 X+ x% N' q- O$ r H; b
;printf("Error MapViewOffile:");
6 J9 d" P/ N) X/ u5 L+ Y! XrintWin32Error(GetLastError()); return 0;
& p0 o. `( C3 x( ?( Mmov eax,04 V- v R. a: p, T
ret& m4 n8 W9 j+ W4 _+ C9 \
@@:
4 U; _3 a6 I) e* t) Z- ]+ Z# ~mov esi,eax ;esi->gdt base' [+ K+ |# y3 c5 X3 `+ h( A
mov ecx,3e0h4 a0 G! f/ e4 @2 B" H" H
mov eax,GdtAddr
( V( @: c- Z4 j6 k% m.if dword ptr [esi+ecx+2]!=0ec0003e8h* J4 Z: X4 I, w5 e* U2 S- ^
mov byte ptr [esi],0c3h
7 a z" B7 R m, L+ X
7 k& J2 P" R" W$ ]" Emov word ptr [esi+ecx],ax+ [' A; _7 F4 `5 D8 J9 }
shr eax,16
/ T8 F4 n- e) Y; t1 Z+ F; Xmov word ptr [esi+ecx+6],ax0 o! ^6 H7 }, v7 E6 K$ z/ u
mov dword ptr [esi+ecx+2],0ec0003e8h( b$ T) m: N0 w5 F! C
5 \# U- _" D; D8 smov dword ptr [esi+ecx+8],0000ffffh
; N, D5 I2 I ^- Cmov dword ptr [esi+ecx+12],00cf9a00h" i# X: [: G {5 N( X7 n8 H
.endif
/ H- G4 U8 I% c+ B: C8 H
2 @$ P) m3 {( e0 omov setcg,TRUE
7 Z7 S$ M5 ?& @3 l O* @- rcmp setcg,0
+ ~/ z i9 |# yjnz ChangeOK
) {: Z) |1 E" Fcall @f; \' P# Q8 w( x8 f; z
db "ZwClose",0
6 J- j& a6 ]2 a: J@@:
& t( d& F! T' [. l- }push NtdllMod
$ v5 G" z3 U' ^% @call GetProcAddress
. w1 S% v2 ^2 S. [" fpush hSection
; v. L' `. S/ |2 Z3 o, Ncall eax! v0 f$ n$ M) F! E
xor eax,eax' M- W9 ^& L5 U7 J
ret
) q" F6 s( {( O, yChangeOK:
. ?$ y8 B1 r6 \, e7 a* H5 Oand dword ptr Callgt,0
2 A/ O0 y( [, j( Q$ E8 P( O* mxor eax,eax* M( j4 o1 z: q( R1 v. Y
mov ax,3e0h2 L0 d4 @0 s! k9 u
or al,3h; p) H2 k+ B8 F) V# z1 X% f6 X
mov word ptr [Callgt+4],ax
3 X& E& `7 r: I' p+ i;farcall[2]=((short)((ULONG)cg-(ULONG)BaseAddress))|3; //Ring 3 callgate;
( Z4 p1 L& P4 \8 S8 o* w# clea eax,_Ring0Proc Y3 I7 g+ l$ X# y
;invoke VirtualLock,eax,seglen
2 z4 `+ @( z/ ?0 y# U+ }0 Ytest eax,eax7 h7 { F5 _6 o+ }" _$ f0 S* q
jnz @f# c9 z& R3 M5 |8 I% J
xor eax,eax
' y2 ^+ w% j7 V+ P/ y0 v2 ~ret* z1 D0 C! N f2 S; k h' ~9 |
@@:1 v. R% l8 V: b% Y1 N
invoke GetCurrentThread
# H' a$ U# o; A1 `( l5 B/ qinvoke SetThreadPriority,eax,THREAD_PRIORITY_TIME_CRITICAL 8 t" n" w3 w5 [5 D9 Y) O% U/ K
1 M- h- a' B S% z3 s) U* w' c
invoke Sleep,0
- w+ }& _4 N$ P+ w5 l2 @: ucall fword ptr [Callgt] ;use callgate to Ring0!7 Y9 Y; [& g$ R7 o. P4 ~
;_asm call fword ptr [farcall]1 N2 U( F: o3 ?3 e, w# ?6 j& g3 `
_Ring0Proc: ; Ring0 code here..
# f$ u0 p4 S) E% b$ |, m0 ?6 Z" }) Lmov eax,esp ;save ring0 esp
+ y$ h; R2 Z. U: Nmov esp,[esp+4];->ring3 esp
" z5 N+ k* f/ W* ppush eax
" X; p& t* g- R& o2 {# n mov ebx,offset stIDEINFO2 Z0 `5 {5 u0 ~3 u
assume ebx:ptr IDEINFO 3 s Y* p" g7 ~. t- t; E
;********************************************************************
; P2 y+ V0 f U- Z/ |; 等待硬盘就绪$ Y$ G0 Q0 _" p" @6 C% J5 a
;********************************************************************( A- f5 T o! F ?
mov ecx,10000h4 x- T) Q' M7 Q% Y
mov dx,01f7h, [ B' p2 _9 |) {% V! n- w) p
@@:4 D, g2 S9 _5 G/ y2 E
in al,dx
" F3 j( k, I& [0 h6 C0 F1 d3 I7 M cmp al,50h. o* m/ g# d5 \& ~* @
jz @F+ I5 N R6 {4 l' L8 [1 ^ J
loop @B8 m& G3 U( ^/ t0 M/ H8 u2 |3 D
jmp _II_TimeOut
, t# G4 E3 C5 ^4 W" }2 W @@:
9 z9 N, F* }/ G' C3 w8 @;********************************************************************
X+ ]: ~- }/ `+ |% M& i4 n; 发送命令
% f- I/ f: ^- F7 y! ?- q; 如果向主控制发送命令,则端口为 1f0h-1f7h- g4 a0 L8 I6 J: k) t
; 如果向副控制发送命令,则端口为 170h-177h8 ?2 P. }' A* z! \9 X
; 1f6h 如果要检测的设备为该IDE接口的主(MASTER)设备,
- z, z$ ^" a) J3 I; 那么发送 a0,如果为从那么发送 b0
, C+ ?9 n4 P' a q5 O. {; 1f7h 如果要检测的设备为 ATA 设备那么发送 ec
# W* D6 a- \' k; 如果为 ATAPI 设备那么发送 a1
! @" O- m" A, G- Z;********************************************************************
* \) h: ^$ u6 S7 i, ?( ?5 ^$ N mov al,0a0h ;Drive 0,Head 0
a2 Q- [- Q; g: C8 O# @ mov dx,01f6h ;Drive and head port
1 c7 N0 y; N) f out dx,al* u& _" u6 Q( h2 {4 `* O3 G
" x/ a; N9 j0 X mov al,0ech 9 L: d6 m) n9 e# H
inc dx ;Command port x b+ f* w. B, b
out dx,al4 _: I* ]- F5 o2 D* V
;********************************************************************$ t& l4 r, M: G* o1 z2 h2 I' g
; 等待硬盘就绪: n/ D0 m% Y C9 g/ N# G
;********************************************************************+ `, q9 k# e2 j; }7 V2 U% `& {
mov ecx,10000h
- U( C1 d8 W# x! _7 ^ @@:
$ b1 y5 T1 n! \3 s& K in al,dx;1f7 (r-status register)0 F! m- E- u- g1 |$ S4 S4 |
cmp al,58h;(driver is ready ,and seek complete)1 U" a8 O- r) s0 ]+ U9 j
jz @F
- b. E8 i% z5 a# V' M5 M loop @B$ i0 q9 U8 w8 G/ K% l# w9 m
jmp _II_TimeOut! K) v: A! i- L+ |, ]* Q0 e
@@:
( j v* q8 ^+ |/ Y0 p;********************************************************************7 E4 s& c f2 l& x
; 将返回信息读回6 X% W+ B) M" _
; 注意一定要读满 100h 个字长
2 Z% H, `( @1 a0 a5 y( v;********************************************************************
2 K- o; H9 e2 r% s- Z cld
3 y# E6 y& S/ I mov edx,01f0h;data port - data comes in and out here& n3 x2 A' x( X
mov edi,ebx
3 n/ |9 \3 T3 N5 S& R mov ecx,0100h' i/ v! c+ f) E! m5 J' V% F
rep insw
1 F# U) s# C4 c! x5 j' Y3 r4 E;********************************************************************
. H3 R9 e: a, t M: k3 J; 返回的信息中,型号、序列号、版本号为字形式0 l* w+ z( e$ W
; 需要整理到字符串的形式: R( g; n; W5 R8 I3 |' u
;********************************************************************
- S& h1 I) B m. j5 Y P2 I U9 C lea esi,[ebx].sSerialNumber
: p6 D4 \! t2 i4 M$ ~/ R9 C: \ mov edi,esi
$ N. z* ~: ~7 I; r3 r mov ecx,10' `1 L$ O8 J2 K# f$ |& a2 D N5 Y3 ~
@@:& c! D5 y& c2 r, O9 G, C/ t: q2 o
lodsw
: c( J2 q! h% `0 P9 }* G xchg ah,al
* _: Y8 M* O+ w" a& f( G! q. q9 o stosw8 `: B- F; t* G* P
loop @B
7 w r+ I1 G! x2 e
' H* @; \ l7 A' q lea esi,[ebx].sFirmwareRev
* |. D# L" ~4 o% I* d/ | mov edi,esi
% i0 o4 o+ t& R6 V mov ecx,24
# g! C2 Z- z* L( c: C8 P Z$ G* b @@: j! b6 }' k7 L4 O: j
lodsw' {+ t" N5 m9 W8 |* q
xchg ah,al4 [0 z: G# J J
stosw$ h- O4 |: H$ f; Z) @+ o" m
loop @B
$ w+ J8 f. A) ]6 q3 S6 ^/ l) e_II_TimeOut:9 z% f8 h' D5 i' ~* J0 z4 K/ \
assume ebx:nothing; y; s9 |" Z7 z6 Y
6 L/ z6 M& ?/ t) D5 {( I
pop esp ;restore ring0 esp
* J; s$ u% n5 U. j# e9 j' |8 f9 e" D& ^push offset Ring3
) V, J9 U6 _1 X! G! T9 j* v6 jretf
" t# m$ `! z; _Ring0CodeLen=$-_Ring0Proc
1 c0 E" ]/ k: t7 p) h2 x( K* E$ |& h# h' U
Ring3:
- c7 k7 ^$ f) linvoke GetCurrentThread* f& ]9 r, }+ q$ b
invoke SetThreadPriority,eax,THREAD_PRIORITY_NORMAL
% T- C1 J/ b1 Q2 q7 O
8 i, d7 h# L+ c: j;invoke VirtualUnlock,Entry,seglen
1 o: k; [, a- s o2 [- Y" n
J5 K' a7 ?6 a" }4 Zcall @f5 [# L. s, c4 C+ V9 @8 l
db "ZwClose",0
# X. R9 I1 U% B& G: h@@:
4 K4 I. k4 ^) w! Spush NtdllMod0 J. C% k$ n4 J" y- b; k; Y1 ~7 n
call GetProcAddress7 K; `! A# m7 [# Y& y* W
push hSection; U: _3 r; r7 m
call eax
6 e% W( L3 t4 {: I5 R3 |mov eax,TRUE, P" j `; l$ L" g
ret# r+ X+ }6 i' Z
ExecRing0Proc endp
) Y. O# e$ h: x* ?9 {1 \9 U! C4 n
) T) o* ?7 q) I7 }* H0 cmain:1 M0 F* p1 t$ M# V! v
assume fs:nothing
5 \* i4 {7 r" vpush offset MySEH
% f! F& l$ C. K2 Q! D$ O9 _push fs:[0]
- w: j" K% ^, d( S3 ?8 Lmov fs:[0],esp1 z. V5 V6 P3 | G& Y9 z$ ^
mov OldEsp,esp
; C& H' O& C1 M) F7 d- Kmov ax,ds ;if Win9x?
+ n: x: _' J' ^test ax,4$ E _& }, s4 k* ^8 |* m5 c
jnz Exit1
1 n1 v& a& [4 L8 X" r$ w5 p) E! r0 Binvoke ExecRing0Proc
; w( v v! ]+ W9 W9 G; ^" m" Z* I9 l' Q# B9 Z# b; o+ U( C/ r
.if stIDEINFO.wNumCyls
% Y; w% K' D" Y7 E L lea esi,stIDEINFO.sModelNumber
( o. _& X. o8 t! h! c mov edi,offset szModelNumber) E4 e* n5 a# j+ b& i j% N; x
mov ecx,sizeof stIDEINFO.sModelNumber% B) H0 X8 Y1 O; Q1 ]$ {
rep movsb
- P- z" y- f& V7 J$ ^9 t
+ [ ]2 _" O8 g! Y8 R lea esi,stIDEINFO.sSerialNumber
$ e* |( f8 U& ] mov edi,offset szSerialNumber
0 d% F8 }1 }) Q9 Z mov ecx,sizeof stIDEINFO.sSerialNumber
! Q# s+ B* }6 o5 o! m9 r H rep movsb( w) ? f4 V5 E3 V2 M
0 [; Y8 w1 P+ l8 Q( S
lea esi,stIDEINFO.sFirmwareRev4 x5 Y. L* F$ J& \& A
mov edi,offset szFirmwareRev! `- E# G2 ]% N3 E
mov ecx,sizeof stIDEINFO.sFirmwareRev( X M! T( b0 X3 c; j# P! Z7 J& J
rep movsb
! B* h, s9 ^# t+ e' r! M) z7 }
- @+ U4 V# y+ p' Y E7 [ movzx eax,stIDEINFO.wNumCyls
: j7 d' b2 ]! m% B/ W' j movzx ebx,stIDEINFO.wNumHeads
/ O, p7 U; I; @3 @, K movzx ecx,stIDEINFO.wSectorsPerTrack
/ W, O; V8 |: Q movzx edx,stIDEINFO.wBufferSize. @; Q5 E1 P! [5 a
invoke wsprintf,addr szBuffer,addr szIDEInfo, eax,ebx,ecx,edx, addr szModelNumber, addr szSerialNumber, addr szFirmwareRev" [4 }' c* z& O* ^) F4 @% D* i
mov eax,offset szBuffer
7 |7 K( Y2 g j B ].else8 ^1 R/ x% p% O, o2 R7 k0 [
mov eax,offset szErrInfo4 K0 ~/ \* p) T
.endif
& {; h! s! z" C8 K5 v2 [1 I@@:
+ f7 e2 ^' t: ]; R: O7 Vinvoke MessageBox,NULL,eax,addr szTitle,MB_ICONINFORMATION or MB_OK: Y4 x5 v, Z7 Y0 P
Exit1:
, e# S* |1 L) k gpop fs:[0]3 p4 W9 g6 N, e: f4 D) f& u* k
add esp,4, X% x/ b; |' }) w9 [
invoke ExitProcess,0
% _" t# L6 P9 A2 _9 S1 S- z+ m9 K `2 o8 j: W
MySEH :7 [) M8 G, X7 x# l
mov esp,OldEsp
. G+ G* U' u( K* ^* }pop fs:[0]4 T) U9 z6 c& u* D3 C* h2 e5 v3 [
add esp,4
1 `, n% a6 c3 |# v. M Pinvoke ExitProcess,-1& }4 `: |% d B( j$ L% l2 j
end main( h+ |9 E9 V" r# K3 [
( ?9 n5 c$ ?* ^1 x* S& k: g [此贴子已经被作者于2003-11-2 18:14:02编辑过]
" J) m* F% b% ~8 e Q |
|