[转帖]2000/xp下读硬盘序列号[汇编]

游侠无极限

我可没这个水平 , Q' t* i+ n7 d7 C.686p 6 G; N/ u. h1 W r) F- V% M.model flat, stdcall 8 y# ^5 G8 @* eoption casemap :none ; case sensitive ; ######################################################################### 1 e7 \' x% ]7 ], t$ {6 I# Oinclude \masm32\include\windows.inc ! Y4 q" I) l1 l1 f8 S0 m+ Jinclude \masm32\include\user32.inc include \masm32\include\kernel32.inc include \masm32\include\advapi32.inc 1 H/ y$ R k) {" p. N# ^+ } 4 \) A) h: `" F4 ?8 A; x' T0 aincludelib \masm32\lib\user32.lib ( h0 G- N/ J! @, kincludelib \masm32\lib\kernel32.lib includelib \masm32\lib\advapi32.lib DEBUG = TRUE # S! Y0 v* L- G1 j& L- i3 b2 O HMODULE typedef dword NTSTATUS typedef dword PACL typedef dword PSECURITY_DESCRIPTOR typedef dword 4 W, q1 Z/ V0 E! i6 @5 hOBJ_INHERIT=2 # G6 v7 d. @' f+ U5 o! P+ gOBJ_PERMANENT=10h OBJ_EXCLUSIVE=20h * k7 Q; r8 g; ~7 U4 g% EOBJ_CASE_INSENSITIVE=40h OBJ_OPENIF=80h OBJ_OPENLINK =100h OBJ_KERNEL_HANDLE=200 OBJ_VALID_ATTRIBUTES=3F2h 6 J, [& b! I) `% j* u2 t& pSE_KERNEL_OBJECT = 6 8 Z0 d; E" V' R9 KGRANT_ACCESS =1 NO_INHERITANCE =0 ; x0 S2 [% U; |9 }+ [* ?TRUSTEE_IS_NAME=1 TRUSTEE_IS_USER=1 STATUS_SUCCESS =0 ' j" s, q3 I5 }STATUS_ACCESS_DENIED =0C0000022h ! g4 Y8 N/ A3 F7 R6 z ( {# M9 y$ r& D! K/ iSTATUS_ACCESS_VIOLATION equ 0C0000005h : B; E9 A& t# h" o6 RSTATUS_INFO_LENGTH_MISMATCH equ 0C0000004h 4 f9 v3 i, `3 d- ~9 F* {SystemModuleInformation equ 11 $ Y3 L* R+ w& X7 X! ePVOID TYPEDEF DWORD UNLONG TYPEDEF DWORD 8 \6 i$ V, x8 R& s( bCHAR TYPEDEF BYTE 6 v ~- o! t% p5 t UNICODE_STRING struct , D2 N% Z/ y; O5 R5 A& S! x) z nLength word ? 3 @* l8 f! G% |% S( b# d MaximumLength word ? 6 z" P8 e9 D, I8 Z, Y3 d Buffer dword ? UNICODE_STRING ends OBJECT_ATTRIBUTES struct . g/ B6 M8 a8 |4 c& ?) t nLength dword ? 8 u' N, Y+ ^& j& C9 `7 q( k$ } RootDirectory HANDLE ? $ E6 R n; `8 e& I ObjectName dword ?UNICODE_STRING ' B# ]) }3 h, `" M( _8 r Attributes dword ?; " l) b# e2 j4 A SecurityDescriptor dword ?; PVOID // Points to type SECURITY_DESCRIPTOR SecurityQualityOfService dword ?VOID // Points to type SECURITY_QUALITY_OF_SERVICE OBJECT_ATTRIBUTES ends 5 ^) C/ a! [/ V* c$ G0 s5 @TRUSTEE struct 9 {0 h$ \/ x1 B, m' N& y9 m pMultipleTrustee dword ?TRUSTEE MultipleTrusteeOperation dword ?; MULTIPLE_TRUSTEE_OPERATION TrusteeForm dword ?;TRUSTEE_FORM , B$ P% Y3 G1 | TrusteeType dword ?;TRUSTEE_TYPE 7 g3 K6 q, s/ G5 P; e ptstrName dword ?;LPTSTR TRUSTEE ends EXPLICIT_ACCESS struct grfAccessPermissions DWORD ? 4 |. D: R/ h6 @5 h grfAccessMode dword ? ;ACCESS_MODE 9 t& K; e1 N- r5 j# k" Q! O grfInheritance DWORD ? ; Trustee TRUSTEE <> ; & \' t5 X/ a y( w" xEXPLICIT_ACCESS ends $ h7 C- n# |9 e1 z6 |; s MyGATE struct ;门结构类型定义 7 z9 D( a3 Q4 p; ` OFFSETL WORD ? ;32位偏移的低16位 SELECTOR WORd ? ;选择子 DCOUNT BYTE ? ;双字计数字段 6 [/ L8 E2 H$ a GTYPE BYTE ? ;类型 OFFSETH WORD ? ;32位偏移的高16位 " e! j% j" O# y9 IMyGATE ends 8 a& L- l& M4 W2 n, C9 G+ n L, ]& \2 S8 ?# ZIDEINFO struct U4 `8 K' D. b" ~$ m3 `wGenConfig dw ? wNumCyls dw ?;拄面数 . C6 }- B' k# u+ P7 TwReserved dw ? wNumHeads dw ?;磁头数 " [2 o! U2 e% \/ XwBytesPerTrack dw ?;每道字节数 wBytesPerSector dw ?;每扇区字节数 4 u4 ]- x9 f' A, swSectorsPerTrack dw ?;每道山区数 wVendorUnique dw 3 dup (?) ( e t; e: w' f1 b1 UsSerialNumber db 20 dup (?);硬盘序列号 3 ~ x+ b: i9 n8 s1 QwBufferType dw ?; wBufferSize dw ?; ;n * 512 wECCSize dw ? : @6 V, b+ O+ b6 D# q" h+ jsFirmwareRev db 8 dup (?); * X/ ] o- i, h. k& H- d% W" bsModelNumber db 40 dup (?) wMoreVendorUnique dw ? wDoubleWordIO dw ? wCapabilities dw ? $ E7 W/ `! L% q4 b1 JwReserved1 dw ? wPIOTiming dw ?; 3 N6 m8 ]- \. X7 m. UwDMATiming dw ?; wBS dw ? wNumCurrentCyls dw ?; 3 Z7 S# A/ ~$ Y" |8 c7 ]wNumCurrentHeads dw ?; wNumCurrentSectorsPerTrack dw ?; dwCurrentSectorCapacity dd ?; - v+ q- W: L5 X2 @& J# ^wMultSectorStuff dw ?; dwTotalAddressableSectors dd ?; wSingleWordDMA dw ?; $ V- v8 b3 \1 B+ {4 mwMultiWordDMA dw ?; 0 p! T6 [. Z9 r4 ~bReserved db 128 dup (?) . N% e; K4 r& PIDEINFO ends ' N0 `- P! h; d9 K8 d E& ^- {8 GSetPhyscialMemorySectionCanBeWrited proto :dword MiniMmGetPhysicalAddress proto :dword `& \. \1 k" o. @6 ?5 d2 H% @ENTERRING0 macro pushad pushfd ! U! O5 e2 E" d; }' Tcli & Y4 w9 Y, G5 Xmov eax,cr0 ;get rid off readonly protect 2 I5 R9 J7 W4 q ?9 W/ iand eax,0fffeffffh mov cr0,eax endm LEAVERING0 macro mov eax,cr0 ;restore readonly protect 6 f; m: d! G) v9 \, j8 l4 Kor eax,10000h mov cr0,eax + y& q3 s/ E# I- y" Osti popfd & L& i( b5 n4 m: C4 M6 X+ rpopad 9 T* t; I8 l* w2 O$ x7 x8 v, V6 Zretf endm 3 t( Y1 a- o6 x UNICODE_STR macro str % d- P5 v7 o/ _$ x3 ?. A! n" |irpc _c,<str> db '&_c' db 0 2 L6 z0 e+ r$ M+ d; {endm + u. e; Z4 ^) R6 `% U' d" t4 v, Lendm ' l J( V" ^5 m; R# J.data? ' o! G& O* p3 qGdtLimit dw ? : i! c+ }- d/ N! Y6 r5 ?7 X3 W' A" AGdtAddr dd ? * ?+ {# {: Q4 Y) y8 N* n $ X7 a1 A* T2 s" v% m- z# ?mapAddr dd ? 3 D9 L9 r( {0 d) GOldEsp dd ? readed dw ? 9 k/ m$ J3 W8 b1 U; ?buffer db 512 dup(?) ShowText db 512*3 dup (?) 2 r4 W) f! b" S, S+ }2 g szBuffer db 1024 dup (?) szModelNumber db 41 dup (?) szSerialNumber db 21 dup (?) szFirmwareRev db 9 dup (?) stIDEINFO IDEINFO 3 B& a- P1 X0 |+ s! g% `.data align 4 objname dw objnamestr_size,objnamestr_size+2 objnameptr dd 0 3 V" y5 {; @( j; h, m, l$ f" Iobjnamestr equ this byte UNICODE_STR <\Device\PhysicalMemory> $ {) c# Z& D: b8 v) f' Z. {objnamestr_size equ $-objnamestr * \: J$ B1 {1 W. JszTitle db 'IDE 硬盘信息',0 , o6 L) [- w3 r2 tszErrInfo db '无法读取硬盘信息',0 8 S; U4 R. o9 ZszIDEInfo db '柱面数 : %d',0dh,0ah ( D$ P1 R0 K/ k8 K" o6 E9 B db '磁头数 : %d',0dh,0ah ) T) t7 T/ m9 E! @5 i9 t db '每道扇区数 : %d',0dh,0ah db '缓冲大小 : %d 扇区',0dh,0ah db '硬盘型号 : %40s',0dh,0ah db '序列号 : %20s',0dh,0ah $ M/ a7 m: V5 U1 | db '版本号 : %8s',0 . {% L/ a5 I! t# G4 n5 P6 v- ` : b% U: ^) B& Y$ P3 m) j- }8 W& F, nalign 4 ObjAttr db 24 dup (0) $ ]& I6 M+ \3 m& b, m" h2 A; zCallgt dq 0 ;call gate's selff Caption db 'Windows XP绝对磁盘读写',0 Digit db '0123456789ABCDEF',0 - N6 X) F; i: t4 ?! ^.code _ShowBuffer proc ;显示所读出的信息 ' w5 U$ J! e6 P( g5 m: r ;把数据转换成16进制的形式 mov [readed],512 & K2 F) D: w9 w3 K5 `! x Z7 a% y mov esi,offset buffer ;数据 mov edi,offset ShowText ;转换后的数据 & D3 @6 g# B8 B( j8 w% M0 F! [ mov ebx,offset Digit xor ecx,ecx ) l1 ^! f+ ?7 A# z6 y5 n* k xor eax,eax computeAgain: cmp [readed],0 jz endCompute # \ b, d* e, t6 b dec [readed] 5 n M; z- z4 x lodsb : i3 c9 W2 R6 W5 a& C push eax . E7 W! ^0 m4 n. t shr eax,4 ;高4位 xlatb 0 b1 A2 b7 x/ G- r% i( t3 e$ e5 I stosb + p( b u. f/ |' s( T' m% ~ pop eax and eax,0fH ;低4位 xlatb stosb - \1 l9 X- r# J+ U5 b/ p( ^" _ mov byte ptr[edi],' ' ;空格 inc edi ; \* b$ M! f( T+ G inc ecx : m" U% R6 ?5 S2 p6 B cmp ecx,16 5 d% Q# u- G3 S+ y jnz computeAgain xor ecx,ecx mov byte ptr[edi-1],13 ;回车 0 j3 B0 a% t V9 d1 s/ r9 C, z jmp computeAgain v8 r! r% i! f- dendCompute: + |+ j# E) P8 l; g1 @( V3 S# F ;显示 invoke MessageBoxA,NULL,offset ShowText,offset Caption,MB_OK 2 Z/ |# Q9 {, Q6 C ret 5 ^ |. s9 F7 U4 Z1 @: t1 H3 w_ShowBuffer endp $ ?4 ^( |& q: @* k- X2 b6 Y2 JSetPhyscialMemorySectionCanBeWrited proc uses ebx esi edi hSection:HANDLE local pDacl: PACL , s$ u: u$ `, A8 K$ slocal pNewDaclACL * T( N; c. {3 J' hlocal pSD SECURITY_DESCRIPTOR . S U; y& q; [% e: Blocal dwRes:DWORD ; 9 D+ l) v& }! G$ W: u0 vlocal ea:EXPLICIT_ACCESS ; 0 C, u" }0 Z+ S, binvoke GetSecurityInfo,hSection,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION, NULL,NULL, addr pDacl,NULL, addr pSD 9 Q" A/ s9 ~( O S0 E% A* Bcmp eax,ERROR_SUCCESS 7 Y, r5 M. a4 g% c5 Wjz @f jmp OutSet @@: mov dwRes,eax mov ea.grfAccessPermissions ,SECTION_MAP_WRITE;2 mov ea.grfAccessMode ,GRANT_ACCESS;1 : U2 l) u# U8 F( Y% `, emov ea.grfInheritance,NO_INHERITANCE;0 0 r4 J9 _3 e( o1 @' `mov ea.Trustee.pMultipleTrustee,0 1 ~5 W5 v; N. R& smov ea.Trustee.MultipleTrusteeOperation,0 mov ea.Trustee.TrusteeForm,TRUSTEE_IS_NAME;1 ) m( D3 [0 |' k; K9 \6 ~& v Rmov ea.Trustee.TrusteeType,TRUSTEE_IS_USER;1 & R3 V- P6 v5 w0 T2 h8 \call @f ' d" l' S+ d$ _9 f) Udb "CURRENT_USER",0 @@: pop edx 9 z; B7 \/ U/ A5 k. Nmov ea.Trustee.ptstrName,edx invoke SetEntriesInAcl,1,addr ea,pDacl,addr pNewDacl & X" w, N1 N$ Z2 ~" Icmp eax,ERROR_SUCCESS jz @f 5 B5 h5 S% S5 Qjmp OutSet 3 Q0 d! i' n; M9 F@@: + P; N. c# B; o& E Z# Dinvoke SetSecurityInfo,hSection,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION, NULL,NULL,pNewDacl,NULL " L$ |/ t0 n3 K9 Z( T* W. I7 ~OutSet: 7 S1 b% k7 g* E: Xcmp pSD,0 Q: i8 v& |# kjz @f $ v/ x" h) w; M# X% hinvoke LocalFree,pSD 2 u( c4 f, _8 k$ j. ~" g@@: cmp pNewDacl,0 jz @f , k2 I% O5 Q- M7 [invoke LocalFree,pNewDacl @@: 0 K( w: k) Q& a* tret SetPhyscialMemorySectionCanBeWrited endp MiniMmGetPhysicalAddress proc virtualaddress:dword , z6 ?! t2 y8 W1 h- u& C mov eax,virtualaddress cmp eax,80000000h jb @f . ~, y, G9 c( [7 R# |% r7 D cmp eax,0a0000000h jae @f ; T+ |' w3 k/ I. ?. K/ L$ p9 S and eax,1FFFF000h ret " A( U/ a( m# r4 v @@: 7 P- _* z. E! W% v. b0 g- x mov eax,0 ret MiniMmGetPhysicalAddress endp 7 H% I6 i9 l/ C3 IExecRing0Proc proc # r0 }6 d0 j8 x: ?7 k/ Jlocal tmpSel:dword local setcg:dword / A" F4 N) V# \% c& \2 O" L* Wlocal BaseAddress:dword 9 t* l% }! K5 Y- g+ e) G3 n; tlocal NtdllMod :dword local hSection:HANDLE local status:NTSTATUS local objectAttributes:OBJECT_ATTRIBUTES local objName:UNICODE_STRING 7 n* `; f- R4 }4 hmov status,STATUS_SUCCESS; sgdt GdtLimit / t3 ?. ]) I0 R* s) Cinvoke MiniMmGetPhysicalAddress,GdtAddr mov mapAddr,eax # s( c3 L+ n$ n0 z; ]test eax,eax jz Exit1 call @f $ R% ?' f& D9 _+ i# ^( @3 b1 f" Udb "Ntdll.dll",0 @@: ) y6 ^9 g, P$ n5 @8 M/ Q1 T& hcall LoadLibraryA mov NtdllMod,eax 9 |+ s' J# Y ]5 H3 X# `lea edx,objnamestr mov objnameptr,edx lea edi,ObjAttr and di,0fffch ;align to 4 bytes,or ZwOpenSection will fail push edi ;edi->ObjAttr * r0 s0 D' R. spush 24 ;length of <\Device\PhysicalMemory> pop ecx 6 W+ J1 }1 A( dpush ecx xor eax,eax rep stosb ;put ObjAttr with 0 9 a) V* k! T/ bpop ecx / k5 u1 A$ [7 B7 Dpop edi mov esi,edi stosd 9 o P2 I% _( q: N8 r4 umov dword ptr[esi],ecx 0 C; I4 D9 D/ B- F! J$ Kstosd 5 p! a( Y3 M- a' e1 vlea eax,[edx-8] ;eax->objname $ S" }/ {, [6 ]; s! D3 u4 L1 Astosd ;ObjAddr(18h,00,00,00,00,00,00,00,offset objname,40,02,00,00,dd 2 dup(0) mov dword ptr [edi],240h 7 M6 |7 i c! S* I call @f db "ZwOpenSection",0 5 m* ], J3 @6 F* \, W; _* N4 h@@: push NtdllMod call GetProcAddress g# t! y. r8 }) i `) H4 s: l% [mov ebx,eax ;ebx=ZwOpenSection push esi ;esi->ObjAttr push SECTION_MAP_READ or SECTION_MAP_WRITE lea edi,hSection push edi ;edi->hSection call eax ;ZwOpenSection(&hSection,SECTION_MAP_READ or SECTION_MAP_WRITE,ObjAttr) % F( Z+ [, Q4 E. [6 m# W+ Q; lmov status,eax 4 D ]$ ]2 s, lcmp status,STATUS_ACCESS_DENIED jnz AccessPermit mov eax,ebx push esi 2 J- ]% H( `4 ^' U* B: g6 Dpush READ_CONTROL or WRITE_DAC push edi call eax mov status,eax invoke SetPhyscialMemorySectionCanBeWrited,hSection call @f ) X! }6 L# C3 Rdb "ZwClose",0 @@: / x* p) E9 u9 K; opush NtdllMod ; i3 k% S2 N2 H& c/ u/ b& `6 vcall GetProcAddress push hSection , f, H% n# a. x) Bcall eax ;zwClose hSection mov eax,ebx 3 v* {7 \- U% L) j1 [/ `) T ? # B2 c! I7 q! V$ E, N5 L7 }% n& Bpush esi push SECTION_MAP_READ or SECTION_MAP_WRITE & q: R9 B H2 H0 {* p' jlea edi,hSection push edi % N9 c1 Z- [" L/ w( Acall eax % F. }1 h6 P4 F% Vmov status ,eax ' M6 o, U) j3 M/ {9 m# |;status =ZwOpenSection(&hSection,SECTION_MAP_WRITE|SECTION_MAP_WRITE,&objectAttributes); AccessPermit: / r4 |' w# ?3 \: G! j, y9 `cmp status ,STATUS_SUCCESS 2 L: \+ b L* k( D2 n4 J& U3 wjz @f ' p8 l) I$ Z+ J% e: N, o; C% y;printf("Error Open PhysicalMemory Section Object,Status:%08X\n",status); ;return 0; mov eax,0 2 t; k$ J8 k z+ |ret : D( Q6 |: }/ d2 v9 E7 I3 B1 {@@: 2 ^0 @0 `' m5 ]1 _ b6 kmovzx eax,word ptr[GdtLimit] inc eax 0 i# T# J+ H, R0 k/ z- Hinvoke MapViewOfFile,hSection, FILE_MAP_READ or FILE_MAP_WRITE, 0, mapAddr, eax % Q& I9 ?* K! E" E9 S' m" Pmov BaseAddress,eax cmp BaseAddress,0 jnz @f $ i2 W9 N- `6 O6 [- a" L) F( b! F;printf("Error MapViewOffile:"); e k% |% K# v8 a' C/ U- `* urintWin32Error(GetLastError()); return 0; 5 h/ G2 N, Y+ k) B+ T3 J. {# ^mov eax,0 - b1 T. e( t s( ^ret @@: mov esi,eax ;esi->gdt base mov ecx,3e0h - o6 {+ b* ~' D+ \mov eax,GdtAddr .if dword ptr [esi+ecx+2]!=0ec0003e8h |* E1 a1 O3 ~" H' w7 }* k) v' _mov byte ptr [esi],0c3h mov word ptr [esi+ecx],ax + O4 d) v& u: y2 R/ Nshr eax,16 mov word ptr [esi+ecx+6],ax mov dword ptr [esi+ecx+2],0ec0003e8h : f& J/ E' a7 s1 x( l mov dword ptr [esi+ecx+8],0000ffffh # N9 k) y9 B/ Omov dword ptr [esi+ecx+12],00cf9a00h .endif 0 h: ?+ e) @) B# E mov setcg,TRUE . ?$ x) i! N" b; [cmp setcg,0 jnz ChangeOK 8 L8 h! Z! p0 F* D. E* b$ Gcall @f db "ZwClose",0 @@: push NtdllMod call GetProcAddress 6 o! B0 [' [. d+ ^2 M9 Wpush hSection 1 m; S2 W) U4 `9 Z+ `& L& f/ xcall eax # _; ^4 H; ]/ {- d6 Y0 x; Kxor eax,eax ret ChangeOK: and dword ptr Callgt,0 xor eax,eax mov ax,3e0h or al,3h 9 } ]" g: g" \4 F5 d. E: vmov word ptr [Callgt+4],ax 9 }4 h8 E- D* @3 U$ E;farcall[2]=((short)((ULONG)cg-(ULONG)BaseAddress))|3; //Ring 3 callgate; lea eax,_Ring0Proc . x, E6 k9 s. x/ u0 f! N5 A;invoke VirtualLock,eax,seglen test eax,eax jnz @f , J, y5 R- ]0 }6 i9 N! Bxor eax,eax ret @@: / l1 F: ^, b$ Q. Q- l! yinvoke GetCurrentThread o _* f) x Q) a8 winvoke SetThreadPriority,eax,THREAD_PRIORITY_TIME_CRITICAL * ]3 t& J. K* z ?' ainvoke Sleep,0 call fword ptr [Callgt] ;use callgate to Ring0! ( A5 ]: j& U! J: q/ f" T. b8 P4 ]4 ~;_asm call fword ptr [farcall] _Ring0Proc: ; Ring0 code here.. mov eax,esp ;save ring0 esp 1 }, @5 O- c# H( X3 @mov esp,[esp+4];->ring3 esp 7 O4 W3 W w# ` G: u7 tpush eax 3 n" E; F9 e6 |2 l9 D$ F mov ebx,offset stIDEINFO assume ebx:ptr IDEINFO ;******************************************************************** ; 等待硬盘就绪 ;******************************************************************** 4 {: e0 C) _" }) S5 T* i1 i8 U mov ecx,10000h mov dx,01f7h @@: in al,dx cmp al,50h , Z0 g r- S9 a" I9 H' F jz @F 0 a3 x: p3 X+ D$ R. n, i4 i7 e loop @B jmp _II_TimeOut " R# E5 t6 e, T( H1 [ @@: : o* d. M* u M7 N;******************************************************************** ; 发送命令 ; 如果向主控制发送命令，则端口为 1f0h-1f7h ; 如果向副控制发送命令，则端口为 170h-177h 3 S2 l& `" u M# K I; 1f6h 如果要检测的设备为该IDE接口的主（MASTER）设备， , ^" a' N; u* F0 q8 c, G; 那么发送 a0，如果为从那么发送 b0 ; 1f7h 如果要检测的设备为 ATA 设备那么发送 ec + | n ^- D7 |& l' y8 z. h" `; 如果为 ATAPI 设备那么发送 a1 ;******************************************************************** mov al,0a0h ;Drive 0,Head 0 mov dx,01f6h ;Drive and head port out dx,al 8 b0 _3 v& e: V1 t- x3 U5 \' | mov al,0ech inc dx ;Command port 4 R6 P y9 W! G. ~ out dx,al ;******************************************************************** 1 T; y N: L( E; 等待硬盘就绪 3 T$ P% R- n$ ?/ E/ C! ^, F5 g;******************************************************************** mov ecx,10000h @@: in al,dx;1f7 (r-status register) ) G; I y1 q+ a% U5 b5 P5 q L cmp al,58h;(driver is ready ,and seek complete) jz @F loop @B ( c7 a1 p5 q7 X0 B, @, z! S* | jmp _II_TimeOut @@: ;******************************************************************** 9 p7 ]6 g. I$ W6 m; 将返回信息读回 ; 注意一定要读满 100h 个字长 ;******************************************************************** 8 b# i$ c% Z) R$ ?0 Q7 _ cld + i0 W7 z) F, W! b7 ? mov edx,01f0h;data port - data comes in and out here 3 ?; J( D5 z& t: i/ n: n/ N8 U* z mov edi,ebx 0 W, T$ A3 l$ v. Q! d; {5 v9 j mov ecx,0100h rep insw ) N/ X/ h2 R- Y0 Y;******************************************************************** ; 返回的信息中，型号、序列号、版本号为字形式 * B$ L( w* k6 U: q9 W7 l% U/ D) q& c3 O; 需要整理到字符串的形式 ;******************************************************************** lea esi,[ebx].sSerialNumber 3 F& G" Q- W: \ mov edi,esi " z S" ~: g$ d& I! T" @& y" N mov ecx,10 % q( |. F% ]: b- h' d- }) f @@: 9 j9 J$ [3 s7 @/ K lodsw xchg ah,al stosw 4 ^# n8 t' U7 x u0 q loop @B " \+ e5 J' ^5 [$ W ' {. h, ?/ h0 Y9 m: d( p lea esi,[ebx].sFirmwareRev / W. T* V% S9 ~ mov edi,esi mov ecx,24 @@: lodsw % J; A* b, ]! P7 ^ xchg ah,al ' k8 W8 N# J$ \2 i. j stosw loop @B / Y# {7 {- K* |4 e+ x' I/ a" w: M_II_TimeOut: 5 ]7 ~# d; B6 c/ Q' zassume ebx:nothing ( T/ l6 T% Y5 l5 ]/ d% O8 lpop esp ;restore ring0 esp push offset Ring3 ( S/ O- p. @7 P* h( Vretf 5 j( k5 ]- F: j# K2 M' U/ m$ U2 _Ring0CodeLen=$-_Ring0Proc 0 ~3 r9 Y& ?& e* W) d8 ~1 ?6 n/ H Ring3: invoke GetCurrentThread 8 x0 Q2 u5 `' p/ }invoke SetThreadPriority,eax,THREAD_PRIORITY_NORMAL ) @+ i4 @) V& M& Q) Q3 j 1 X) m0 @% D/ w" n0 H;invoke VirtualUnlock,Entry,seglen 7 Z V) N: P/ c; r% \* M" e- o + G" ^: Z9 D/ Z7 |9 Rcall @f 6 Z. X- U: O- g3 k+ d/ Mdb "ZwClose",0 @@: push NtdllMod call GetProcAddress . T9 A( o9 Z, [% \% Upush hSection call eax - L3 H' j8 z8 I" R9 k- k: hmov eax,TRUE ret ExecRing0Proc endp , |% M' g% s( x4 o main: : W' R' f+ B) P( J5 }$ Q" xassume fs:nothing ) } \4 d* D% h1 W+ |. y1 xpush offset MySEH push fs:[0] mov fs:[0],esp . }) e7 u" ?4 E" v4 h1 Kmov OldEsp,esp : L* x( p/ ~* R. T7 N- P- Omov ax,ds ;if Win9x? test ax,4 jnz Exit1 invoke ExecRing0Proc ( z! w" F, \; F/ u2 n ) u9 X% C* e9 }5 a, s.if stIDEINFO.wNumCyls 3 { r) y: z/ B. K1 I3 D0 s9 r lea esi,stIDEINFO.sModelNumber mov edi,offset szModelNumber mov ecx,sizeof stIDEINFO.sModelNumber rep movsb 8 e$ n3 }, H z6 d7 f5 t+ P: ]2 z - w. X D9 p _% J6 J' A O lea esi,stIDEINFO.sSerialNumber mov edi,offset szSerialNumber mov ecx,sizeof stIDEINFO.sSerialNumber 6 H% G8 r( y6 N. C5 r8 R3 Q rep movsb ( X6 m( X) F" a. F6 s9 l 9 C% D) u4 ^! U: l6 K+ I* y lea esi,stIDEINFO.sFirmwareRev + d I$ f7 O8 C/ x9 n# w& Y mov edi,offset szFirmwareRev mov ecx,sizeof stIDEINFO.sFirmwareRev rep movsb 4 O; Z1 j5 t9 i9 X% y movzx eax,stIDEINFO.wNumCyls movzx ebx,stIDEINFO.wNumHeads 3 I8 \0 \* p+ K- O& q8 a movzx ecx,stIDEINFO.wSectorsPerTrack movzx edx,stIDEINFO.wBufferSize / L8 T) ^5 w5 q2 L' }1 H) l invoke wsprintf,addr szBuffer,addr szIDEInfo, eax,ebx,ecx,edx, addr szModelNumber, addr szSerialNumber, addr szFirmwareRev + x1 e* O, H% Y6 K8 k# X: N mov eax,offset szBuffer 9 W/ t* ]" r: o# e- x* [4 Y3 n.else mov eax,offset szErrInfo ; |9 k( H; U$ l% k% z, C" w.endif @@: $ O* P. y7 Q/ I6 G5 @ Oinvoke MessageBox,NULL,eax,addr szTitle,MB_ICONINFORMATION or MB_OK Exit1: pop fs:[0] * n8 ]' h* w9 M: u% r4 w. Aadd esp,4 invoke ExitProcess,0 MySEH : mov esp,OldEsp pop fs:[0] add esp,4 invoke ExitProcess,-1 end main 7 q/ x/ M2 V! l" X9 [" h3 d

[此贴子已经被作者于2003-11-2 18:14:02编辑过]

呵呵，ExecRing0Proc 这段程序甚妙，先得到gdt，然后构造一个调用门call gate's ,使程序从用户模式(ring 3)进入内核模式(ring 0)。进入内核模式之后，就可以没有限制地对系统干任何勾当。这段程序确实为高手所为，在下佩服得紧。
至于读硬盘序列号之类，只不过是在内核模式下的一个I/O应用罢了。
其实在NT/2000下读取硬盘序列号只要打开\\.\PhysicalDriveX(X:设备号0~26）设备，然后用DeviceIoControl()就可以读取了，不需要绕ring0这么一个大圈子
; W& M! u* Y6 l8 o3 \: }
这个程序也可以C语言实现，不过中间必须嵌入几条汇编的指令，如sgdt GdtLimit
但还是用c来写更方便，例如：
  i8 m8 T7 o' n! E* Mcall @f
db "ZwOpenSection",0
9 z! L( c4 v+ I. X4 t@@:
% M$ ], Z: k$ M/ x1 X+ d, I' {push NtdllMod
* g+ i$ ^* O. D( ?; Q! xcall GetProcAddress
mov ebx,eax ;ebx=ZwOpenSection
  |; o4 U6 H9 i5 upush esi ;esi->ObjAttr
( k) W" q5 P1 Rpush SECTION_MAP_READ or SECTION_MAP_WRITE
lea edi,hSection
3 \- U0 `- j' K( v/ |" }7 i# E- n  h8 S. `push edi ;edi->hSection
; U& H/ ]! P, A$ `; q6 l4 \8 f& t7 _call eax ;

用c的话只要一句就可以了
ZwOpenSection(&hSection,SECTION_MAP_READ or SECTION_MAP_WRITE,ObjAttr)；
8 f: j2 _3 N! ]- y- O& N因此懂汇编，然后用C/C++编程，是成为高手的捷径

[此贴子已经被作者于2003-11-3 16:46:50编辑过]

$ L4 W: @+ k6 y+ G( D

firelinux

win32位汇编，真的很不错，业余的时间，全都投进去了

唐明

要能有台机器试一下多好，学汇编还从没想过去ring0，也感觉没哪个必要。
现在闲着真相试试。这片文章我在家保存了有快一年了。不用感觉可惜了。一直停着不用，我都快忘了那些曾经那些依稀的记忆了。水能给我一台电脑，我力马高喊：有你这么富的吗？

很久以前的一段代码

游侠无极限

很久以前?
8 c. b% c* J4 v5 d不是吧,这个是 轻描淡写 编程论坛的斑竹写的

看到过的。