[转帖]2000/xp下读硬盘序列号[汇编]

游侠无极限

我可没这个水平 ) M7 D; V/ a. J) Y.686p ) s! v( K. l0 k8 y$ H, {$ { P.model flat, stdcall option casemap :none ; case sensitive 7 Y8 k; a4 C7 b; \) ?4 `1 C* \' a# X; ######################################################################### include \masm32\include\windows.inc include \masm32\include\user32.inc include \masm32\include\kernel32.inc include \masm32\include\advapi32.inc q+ b5 R: M+ o) }; b- d , t2 B; ` E5 f2 o; j9 P- Zincludelib \masm32\lib\user32.lib 3 n; L0 }- g. a5 m' W6 Eincludelib \masm32\lib\kernel32.lib includelib \masm32\lib\advapi32.lib DEBUG = TRUE + v: c) W2 @$ S$ x- N HMODULE typedef dword ) C7 n9 V# j$ Y, V- {: aNTSTATUS typedef dword % ~; y7 e% H: lPACL typedef dword " U7 P' c/ x3 R$ `6 lPSECURITY_DESCRIPTOR typedef dword + G- j. F5 I/ h OBJ_INHERIT=2 OBJ_PERMANENT=10h % u5 S# U9 f3 g* ?/ E& h! T% p* ^4 uOBJ_EXCLUSIVE=20h 8 a8 V+ |; G% l% E) O5 yOBJ_CASE_INSENSITIVE=40h OBJ_OPENIF=80h 0 x7 B; }$ M4 T. V d; BOBJ_OPENLINK =100h OBJ_KERNEL_HANDLE=200 " p/ S, l& w3 ]+ vOBJ_VALID_ATTRIBUTES=3F2h - m- o3 E6 v) d2 \* D* ~ # j$ k8 g( P3 k+ J! t8 e% jSE_KERNEL_OBJECT = 6 GRANT_ACCESS =1 NO_INHERITANCE =0 TRUSTEE_IS_NAME=1 TRUSTEE_IS_USER=1 + V$ ~( K$ e" |# E7 b7 ?" v" Z4 ISTATUS_SUCCESS =0 3 \6 C- s+ w/ c5 ZSTATUS_ACCESS_DENIED =0C0000022h STATUS_ACCESS_VIOLATION equ 0C0000005h : _9 `1 G$ \& {STATUS_INFO_LENGTH_MISMATCH equ 0C0000004h SystemModuleInformation equ 11 PVOID TYPEDEF DWORD ! [3 z) ]0 K. P$ _3 d" {; a, g; qUNLONG TYPEDEF DWORD 4 F$ _/ c6 d: ^9 a3 M; o2 KCHAR TYPEDEF BYTE " [* @4 W! ? v7 h$ D- @; X n6 k UNICODE_STRING struct + h4 Z5 n5 r/ ~4 G; n* c nLength word ? MaximumLength word ? Buffer dword ? 9 F- _- S# |. x( ^* G; v3 @4 Q' HUNICODE_STRING ends B4 h& ~) X4 ]; V- G" v* K2 y OBJECT_ATTRIBUTES struct nLength dword ? RootDirectory HANDLE ? 1 Y8 |& }' _, Q$ y ObjectName dword ?UNICODE_STRING Attributes dword ?; 0 _$ w Q) p( ?! Y SecurityDescriptor dword ?; PVOID // Points to type SECURITY_DESCRIPTOR SecurityQualityOfService dword ?VOID // Points to type SECURITY_QUALITY_OF_SERVICE ; J) q' p8 v$ ]OBJECT_ATTRIBUTES ends , X9 I& h8 c& ^8 K+ S. z 3 J t: _2 t3 R% f+ _5 [# }TRUSTEE struct & Y: N3 P6 M X1 t" S, | pMultipleTrustee dword ?TRUSTEE . M: [/ e+ y- p: ? MultipleTrusteeOperation dword ?; MULTIPLE_TRUSTEE_OPERATION TrusteeForm dword ?;TRUSTEE_FORM TrusteeType dword ?;TRUSTEE_TYPE 5 H& }; O3 g9 R ptstrName dword ?;LPTSTR TRUSTEE ends 4 g2 k8 C1 k" Q. Y4 g% n( G EXPLICIT_ACCESS struct " b7 ~0 x) M8 H) u grfAccessPermissions DWORD ? grfAccessMode dword ? ;ACCESS_MODE grfInheritance DWORD ? ; Trustee TRUSTEE <> ; 0 j' I8 P: r2 u7 S6 h, e. |EXPLICIT_ACCESS ends ! L) _* e/ b4 I2 t1 @, r* g( q# F7 q) ~ MyGATE struct ;门结构类型定义 ' X/ A' f9 Q& u9 a7 I. m& i OFFSETL WORD ? ;32位偏移的低16位 6 b6 i8 [( m/ }& j1 R" ~ SELECTOR WORd ? ;选择子 x" D& @- c& V b `7 Z2 @ DCOUNT BYTE ? ;双字计数字段 GTYPE BYTE ? ;类型 m' ?) p1 d- X- D" K( l OFFSETH WORD ? ;32位偏移的高16位 MyGATE ends : l2 O; Z) {. @4 D2 M IDEINFO struct wGenConfig dw ? * v9 j k w }; F' i7 k6 FwNumCyls dw ?;拄面数 wReserved dw ? % W2 K, e( E, M9 SwNumHeads dw ?;磁头数 wBytesPerTrack dw ?;每道字节数 8 g( V( i+ K# n$ CwBytesPerSector dw ?;每扇区字节数 : w3 q/ l I' X6 w" CwSectorsPerTrack dw ?;每道山区数 wVendorUnique dw 3 dup (?) sSerialNumber db 20 dup (?);硬盘序列号 wBufferType dw ?; + D4 Y7 ?9 O! K/ }/ h* z2 L3 xwBufferSize dw ?; ;n * 512 wECCSize dw ? sFirmwareRev db 8 dup (?); 8 B- S0 N+ `4 F, u! f. t7 Q6 I9 [% \sModelNumber db 40 dup (?) wMoreVendorUnique dw ? 5 c* s6 s/ G1 m4 ^1 \! ZwDoubleWordIO dw ? wCapabilities dw ? wReserved1 dw ? wPIOTiming dw ?; wDMATiming dw ?; 2 A0 m" b- z; TwBS dw ? 9 J3 Q% b; K% f0 i! x. q) SwNumCurrentCyls dw ?; wNumCurrentHeads dw ?; 3 {% v# X& D% ]: s9 V. ~- b( WwNumCurrentSectorsPerTrack dw ?; / J: n: p5 H0 gdwCurrentSectorCapacity dd ?; $ E1 I& l1 c& Y% Y: o) f' ^wMultSectorStuff dw ?; dwTotalAddressableSectors dd ?; wSingleWordDMA dw ?; 0 \$ j4 N. D6 |0 X, MwMultiWordDMA dw ?; bReserved db 128 dup (?) : f- d& ^+ I/ o: YIDEINFO ends - G$ B* _3 L. l. y: ?- Q 4 q8 Z' i$ D3 {/ KSetPhyscialMemorySectionCanBeWrited proto :dword . o* G/ |' [5 O7 h; d4 EMiniMmGetPhysicalAddress proto :dword . t1 J, e# m' J4 N! g! t + l2 q6 {6 A3 W3 n3 P3 G$ M! F, A( YENTERRING0 macro ! v) L/ p4 r' i7 n8 ]pushad pushfd cli mov eax,cr0 ;get rid off readonly protect 7 K' s2 T% J \and eax,0fffeffffh , D# n) i; l. \/ o1 o1 Gmov cr0,eax endm LEAVERING0 macro mov eax,cr0 ;restore readonly protect 1 S* o- N6 o) W z0 Aor eax,10000h ! S# |6 D+ C0 \- w9 {! Xmov cr0,eax sti ! [& A( _7 F% F% z. S7 Vpopfd popad / T# L& U" F g7 B `retf endm 7 H1 x' @6 j/ | UNICODE_STR macro str ' s4 R6 l# l' D9 L: o$ r" D2 sirpc _c,<str> db '&_c' 3 m, _; y! _: q3 `+ bdb 0 endm 4 M* O. c, ? _) z7 dendm ) v: J8 _: ]! G' M, }$ L .data? GdtLimit dw ? GdtAddr dd ? ) W4 Q" D. E3 U7 }. p+ n2 lmapAddr dd ? 1 W: {' R: h9 m$ DOldEsp dd ? / Q: T6 f4 m" r/ H- u0 yreaded dw ? buffer db 512 dup(?) ShowText db 512*3 dup (?) szBuffer db 1024 dup (?) szModelNumber db 41 dup (?) szSerialNumber db 21 dup (?) 6 n3 J# u x5 C' ?szFirmwareRev db 9 dup (?) 0 v! x, S1 t- k% f$ u7 M2 { ) C+ c3 S: X3 P( r. D. }- ?$ ^stIDEINFO IDEINFO 5 m' U! ` X, u/ F ) D0 U: q2 t: l$ I! {0 }.data : {6 j6 q7 v5 n/ b8 R4 o/ I/ q+ nalign 4 objname dw objnamestr_size,objnamestr_size+2 $ [% `% q. V+ v6 Tobjnameptr dd 0 objnamestr equ this byte UNICODE_STR <\Device\PhysicalMemory> objnamestr_size equ $-objnamestr ) t0 _& c: O; ?; r 2 }9 u( w2 \" _szTitle db 'IDE 硬盘信息',0 szErrInfo db '无法读取硬盘信息',0 szIDEInfo db '柱面数 : %d',0dh,0ah db '磁头数 : %d',0dh,0ah db '每道扇区数 : %d',0dh,0ah & N, B8 J3 w" L; h* I+ x! J db '缓冲大小 : %d 扇区',0dh,0ah 5 b* f; B) `6 \# U0 { db '硬盘型号 : %40s',0dh,0ah db '序列号 : %20s',0dh,0ah / O0 W+ \: T: q) H- @% m1 V: o8 ^ db '版本号 : %8s',0 , A1 r2 O/ _) M7 l2 I; ?7 galign 4 ObjAttr db 24 dup (0) - \; d$ \: W( h* F d! y( F Callgt dq 0 ;call gate's selff Caption db 'Windows XP绝对磁盘读写',0 , d3 a8 P! i, e7 Z; Q5 yDigit db '0123456789ABCDEF',0 ( k' r" E: O/ L2 V* D.code % d5 G' v0 h4 y$ H4 `; I_ShowBuffer proc ;显示所读出的信息 9 t1 x' \! D e7 a8 I/ z4 O- P ;把数据转换成16进制的形式 2 J6 Z8 N+ P. O mov [readed],512 mov esi,offset buffer ;数据 mov edi,offset ShowText ;转换后的数据 mov ebx,offset Digit & X! P7 _6 Z( V$ ^ _0 c xor ecx,ecx 1 H4 U3 N. x% t* O xor eax,eax 9 s. l1 }4 p" E1 CcomputeAgain: 4 P7 ~8 R5 f- L- D cmp [readed],0 jz endCompute dec [readed] lodsb 4 y+ {$ B3 Q# Y' K6 ` push eax shr eax,4 ;高4位 xlatb 8 y- M- x4 z" X: a+ X( w. i, ` stosb pop eax 3 L- u% B+ x# h/ i. j6 ?+ L and eax,0fH ;低4位 % }8 B; R1 z$ ~2 p5 R0 n xlatb stosb mov byte ptr[edi],' ' ;空格 6 g' @* V% u! h+ u1 O inc edi - J! ^/ Y9 H/ Q7 s inc ecx 4 P' r9 k7 D2 `3 A/ T cmp ecx,16 jnz computeAgain ) H& t; x6 z8 ?: A- K xor ecx,ecx mov byte ptr[edi-1],13 ;回车 : a x1 O5 g2 @. d3 M( _8 G0 c7 I3 W jmp computeAgain endCompute: ;显示 - y# `$ K7 ~0 ?) I1 r' W: w" @ invoke MessageBoxA,NULL,offset ShowText,offset Caption,MB_OK ! t% D3 ]- l3 C3 [0 ?* V7 Q ret : L4 N8 w/ p* ^ I4 j! D. s( c& __ShowBuffer endp SetPhyscialMemorySectionCanBeWrited proc uses ebx esi edi hSection:HANDLE local pDacl: PACL - q2 `8 p X# r: G+ Z. D- V( dlocal pNewDaclACL local pSD SECURITY_DESCRIPTOR local dwRes:DWORD ; local ea:EXPLICIT_ACCESS ; invoke GetSecurityInfo,hSection,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION, NULL,NULL, addr pDacl,NULL, addr pSD 4 _2 r. Y' h* E, q# ocmp eax,ERROR_SUCCESS jz @f jmp OutSet @@: mov dwRes,eax mov ea.grfAccessPermissions ,SECTION_MAP_WRITE;2 - x. ?! u7 o$ ^) Y* ]+ tmov ea.grfAccessMode ,GRANT_ACCESS;1 mov ea.grfInheritance,NO_INHERITANCE;0 mov ea.Trustee.pMultipleTrustee,0 1 m7 X% v* ^8 O Q& v0 L' `3 E* Kmov ea.Trustee.MultipleTrusteeOperation,0 0 `8 d6 ~2 a9 d# q' umov ea.Trustee.TrusteeForm,TRUSTEE_IS_NAME;1 % D! I+ F3 r% a3 k4 E; N2 wmov ea.Trustee.TrusteeType,TRUSTEE_IS_USER;1 call @f db "CURRENT_USER",0 @@: 3 p, O0 g% {( h$ |- E7 }pop edx 4 v' @/ w. Q1 e. }" Umov ea.Trustee.ptstrName,edx : G: k$ t8 A' p% B) e/ `invoke SetEntriesInAcl,1,addr ea,pDacl,addr pNewDacl cmp eax,ERROR_SUCCESS . w' y5 C1 K, O y. E: H3 m; N. L% Ajz @f + J# P8 p$ [$ _% W* Xjmp OutSet ; ^' H J v- j@@: invoke SetSecurityInfo,hSection,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION, NULL,NULL,pNewDacl,NULL 6 g9 f* S+ ]- xOutSet: cmp pSD,0 / y) t- u; h* a& s, x4 ijz @f m! Z: L7 z" j# t* P) Ninvoke LocalFree,pSD @@: cmp pNewDacl,0 jz @f invoke LocalFree,pNewDacl @@: 0 C( S1 Q6 B5 k1 z9 M8 S" sret SetPhyscialMemorySectionCanBeWrited endp MiniMmGetPhysicalAddress proc virtualaddress:dword ' [! ?/ _2 ~1 G% Q% U: d O F Y mov eax,virtualaddress cmp eax,80000000h jb @f cmp eax,0a0000000h # r, w7 t! L# c/ N. t6 Y jae @f and eax,1FFFF000h ret $ ?. i% d+ n! c, k/ } @@: 9 e) L* X* c/ c% p. o, G, j$ Y mov eax,0 ' j3 e# }4 ]+ f2 k, n2 v ret 6 t, J3 U, L) v" P. _% fMiniMmGetPhysicalAddress endp " F1 W$ D) h2 A# sExecRing0Proc proc local tmpSel:dword local setcg:dword ) [: H* s( U& i, O- \* wlocal BaseAddress:dword , _6 n g; K; s0 flocal NtdllMod :dword local hSection:HANDLE local status:NTSTATUS local objectAttributes:OBJECT_ATTRIBUTES local objName:UNICODE_STRING ! f1 d9 w Z# x( d/ @mov status,STATUS_SUCCESS; sgdt GdtLimit invoke MiniMmGetPhysicalAddress,GdtAddr 6 n& x0 {! t- Ymov mapAddr,eax test eax,eax jz Exit1 call @f db "Ntdll.dll",0 @@: 6 H) c: p; I! A3 kcall LoadLibraryA mov NtdllMod,eax 7 K( J! Q6 N" X: W% ~; Jlea edx,objnamestr mov objnameptr,edx lea edi,ObjAttr % Q" q3 i7 F+ \% `8 z) vand di,0fffch ;align to 4 bytes,or ZwOpenSection will fail 5 U: O! C1 W( ]" M# c y& vpush edi ;edi->ObjAttr % r1 m0 e; o7 t6 Jpush 24 ;length of <\Device\PhysicalMemory> pop ecx ; ]! h8 k0 r: l' N8 D9 ypush ecx / e6 f* o3 P+ @- r# exor eax,eax rep stosb ;put ObjAttr with 0 3 y) ?! q/ M( apop ecx pop edi . F/ A# O" u* d, G3 lmov esi,edi 6 B& D# I% b) Gstosd mov dword ptr[esi],ecx stosd : ?+ s3 {8 f( v! }$ S& h: M: plea eax,[edx-8] ;eax->objname - k$ l/ y1 T% ~0 O& Nstosd ;ObjAddr(18h,00,00,00,00,00,00,00,offset objname,40,02,00,00,dd 2 dup(0) # y5 e3 @: l3 emov dword ptr [edi],240h $ V% E ^0 _" W9 ~call @f db "ZwOpenSection",0 9 \$ h1 [3 l9 y, Q- X, v@@: . N/ a, d5 z; ]/ n; d; h, k. } ^/ Epush NtdllMod call GetProcAddress & z9 w( p+ u5 l4 B& g$ F: vmov ebx,eax ;ebx=ZwOpenSection push esi ;esi->ObjAttr 6 _& w. R! q4 G! T5 ]1 epush SECTION_MAP_READ or SECTION_MAP_WRITE 0 m( l- U0 v5 k! x0 flea edi,hSection push edi ;edi->hSection 9 b7 t+ q' g: ^call eax ;ZwOpenSection(&hSection,SECTION_MAP_READ or SECTION_MAP_WRITE,ObjAttr) 5 G8 x4 r& K& O2 p2 d mov status,eax # [" |$ O3 l! _. U/ Z: gcmp status,STATUS_ACCESS_DENIED jnz AccessPermit 8 d1 D" J: }' L) G3 e1 X9 g! V. @mov eax,ebx 1 b1 O' i/ \/ ^! x- Zpush esi push READ_CONTROL or WRITE_DAC 5 C/ R y9 W! L4 I7 Ypush edi + c3 ^# s/ M- x5 K& m! V* r" acall eax & F+ x& ~$ }; G" z! `; n4 n+ ] mov status,eax invoke SetPhyscialMemorySectionCanBeWrited,hSection : [% Q) A2 d5 N+ R% c: I$ H 6 a, R- |1 \- F* Z4 t- r0 ~call @f db "ZwClose",0 + }0 N7 B% [9 t5 ~( Y& f7 ~@@: / S" D# u4 b3 X9 ?; ?push NtdllMod call GetProcAddress ! j; q, v3 n) y0 t# dpush hSection call eax ;zwClose hSection " Z. j& h; n6 F" w mov eax,ebx * B) f. D: m& V8 Q : `" h6 P7 w! H$ rpush esi push SECTION_MAP_READ or SECTION_MAP_WRITE 3 }8 y' I% |) s9 O) E; N- n. Llea edi,hSection push edi call eax mov status ,eax ;status =ZwOpenSection(&hSection,SECTION_MAP_WRITE|SECTION_MAP_WRITE,&objectAttributes); AccessPermit: cmp status ,STATUS_SUCCESS jz @f ;printf("Error Open PhysicalMemory Section Object,Status:%08X\n",status); ;return 0; mov eax,0 # l% t) d3 J) F+ Fret 1 }) ]0 A7 |" ~0 [$ x@@: - J% r/ g% l- G3 j4 i ~) mmovzx eax,word ptr[GdtLimit] 3 O8 B4 n' l8 Q7 z' y6 linc eax invoke MapViewOfFile,hSection, FILE_MAP_READ or FILE_MAP_WRITE, 0, mapAddr, eax mov BaseAddress,eax ; r) a: d0 c$ J A' D! z! {# K+ {cmp BaseAddress,0 ; @0 i# D7 r- d7 njnz @f ;printf("Error MapViewOffile:"); - W7 F) F" @! a- N7 h1 VrintWin32Error(GetLastError()); return 0; mov eax,0 7 y- s3 f+ G" n3 iret @@: mov esi,eax ;esi->gdt base mov ecx,3e0h ! @- e. @+ D, lmov eax,GdtAddr .if dword ptr [esi+ecx+2]!=0ec0003e8h mov byte ptr [esi],0c3h mov word ptr [esi+ecx],ax * \4 Y0 |. o1 b( X, |* Tshr eax,16 9 S6 k [/ c, F; nmov word ptr [esi+ecx+6],ax - {! E# |8 d7 I( L! x5 Tmov dword ptr [esi+ecx+2],0ec0003e8h mov dword ptr [esi+ecx+8],0000ffffh mov dword ptr [esi+ecx+12],00cf9a00h .endif 5 c. q6 b) d8 f! v% [ mov setcg,TRUE % X; q1 V! e( Y" Ycmp setcg,0 . n# u" o; q/ {, J$ r" j* vjnz ChangeOK call @f db "ZwClose",0 @@: push NtdllMod + c& J3 |" t) K I: t9 Scall GetProcAddress : `; j3 U# h4 d& w Xpush hSection call eax / e3 C! G- b8 H* j& J- u: Jxor eax,eax ' X% z U' s! J8 H7 e0 yret ChangeOK: 6 r4 K. j/ N1 ] ?# Y: ~( t# b' B. Sand dword ptr Callgt,0 xor eax,eax mov ax,3e0h or al,3h mov word ptr [Callgt+4],ax ;farcall[2]=((short)((ULONG)cg-(ULONG)BaseAddress))|3; //Ring 3 callgate; lea eax,_Ring0Proc ;invoke VirtualLock,eax,seglen test eax,eax , ` o5 B$ G; W/ J& A6 n) Njnz @f xor eax,eax 9 N# D4 p) S' G$ {! `& ] uret @@: ! b' w9 L( {# \5 A: T$ Tinvoke GetCurrentThread invoke SetThreadPriority,eax,THREAD_PRIORITY_TIME_CRITICAL & A. @" A" w2 V- N s' |" h; G9 S) O6 l ! {8 j c( I. S$ O+ u( ~% [invoke Sleep,0 call fword ptr [Callgt] ;use callgate to Ring0! G, e' b o+ {/ G;_asm call fword ptr [farcall] _Ring0Proc: ; Ring0 code here.. ( M) V9 |, s; u. c: e! }mov eax,esp ;save ring0 esp / Q& ~) D/ _ qmov esp,[esp+4];->ring3 esp push eax mov ebx,offset stIDEINFO 1 b2 M7 C6 y2 g9 I0 j U+ Q assume ebx:ptr IDEINFO 7 I- d. G) ?/ f9 B6 D% D;******************************************************************** : K9 c, R, r9 v0 z* Y" |" y- {' [; 等待硬盘就绪 / f! t2 V4 S) K& H( i9 s5 u6 Y- };******************************************************************** mov ecx,10000h & G% o4 U% z5 o4 e mov dx,01f7h + g+ r; ]# C1 s4 z4 B/ `$ A, Z @@: ( I# Q) w7 M- }# i; e7 ]3 } in al,dx ) e2 z" i; p9 D7 |, l cmp al,50h jz @F loop @B jmp _II_TimeOut : Z! U: a; |7 }2 B/ y4 B @@: ;******************************************************************** ; 发送命令 0 Q6 P6 ]* A" u$ L; 如果向主控制发送命令，则端口为 1f0h-1f7h ; 如果向副控制发送命令，则端口为 170h-177h ! Z/ O4 {+ J5 ?0 K; 1f6h 如果要检测的设备为该IDE接口的主（MASTER）设备， ; 那么发送 a0，如果为从那么发送 b0 ; 1f7h 如果要检测的设备为 ATA 设备那么发送 ec ; 如果为 ATAPI 设备那么发送 a1 ! w% ~6 C8 s9 ~) i3 `;******************************************************************** mov al,0a0h ;Drive 0,Head 0 7 \0 b7 X" b2 o" E" M mov dx,01f6h ;Drive and head port out dx,al ' B0 n9 n2 {8 a3 x; l mov al,0ech inc dx ;Command port 7 @$ u6 ?$ U; E& g' C; `3 Z out dx,al ( _. A, b2 t* }8 u; \;******************************************************************** " g3 N c4 d9 c B, Y; 等待硬盘就绪 ;******************************************************************** # h% ?( C% P( g+ Q. v+ c mov ecx,10000h @@: ; T. Q5 O% } J$ Z0 @' t in al,dx;1f7 (r-status register) cmp al,58h;(driver is ready ,and seek complete) jz @F / j4 V, \% g! Z loop @B 0 E+ Y* g0 r( [/ D( H9 x jmp _II_TimeOut ' x# E* g0 F( R. O! W/ Z @@: ;******************************************************************** ; 将返回信息读回 " B6 g# I/ K$ c; 注意一定要读满 100h 个字长 ;******************************************************************** cld mov edx,01f0h;data port - data comes in and out here mov edi,ebx : e W4 |, M# `0 G( ] mov ecx,0100h rep insw ;******************************************************************** " A% y+ W* `* E! V; 返回的信息中，型号、序列号、版本号为字形式 + E: m- z( ^# {4 c; 需要整理到字符串的形式 ;******************************************************************** lea esi,[ebx].sSerialNumber mov edi,esi b2 P- z, C& ]( P3 _: b mov ecx,10 @@: / V8 b' j* Q+ \ lodsw xchg ah,al w4 ]1 A; U. d L stosw ) U. G% }* h# C, l loop @B 7 C( r4 c5 W' v4 e; g$ w3 h , ^7 @3 k% V$ ^6 W# s# E) q& G lea esi,[ebx].sFirmwareRev - F! l. ~4 e9 j4 f% S: [8 N mov edi,esi ( k j! z- C9 W+ H8 d mov ecx,24 - X/ S+ ~+ j# \! [/ A* n5 X3 O$ _ @@: # S8 ]. P% A, k P lodsw . N: u& I& ^# O' F3 g: M xchg ah,al stosw 1 B. x; B5 D/ o& t, R& g loop @B , N, ?2 Q$ R2 \" b+ @: t, x' l$ c_II_TimeOut: 8 Z- z& Q( k, H$ T8 k3 xassume ebx:nothing L! B; W0 ^1 ?/ A8 Z9 a 1 N( Z. [5 M- Q9 ~- x# Rpop esp ;restore ring0 esp 6 b" _. U" Z A! W+ \, bpush offset Ring3 $ K. I W' T6 f% u9 y- K+ ?2 [retf Ring0CodeLen=$-_Ring0Proc 7 k t; _& m% e3 @- B7 z% t! kRing3: / j& e8 K1 v, Y J; O6 minvoke GetCurrentThread O" [8 h# F1 r% U& H4 cinvoke SetThreadPriority,eax,THREAD_PRIORITY_NORMAL 5 a; A' p6 z8 H* J, q ;invoke VirtualUnlock,Entry,seglen ( J( M# g* D4 J' A% [7 n ; _8 \; T: J: k) {" @call @f db "ZwClose",0 @@: push NtdllMod call GetProcAddress push hSection call eax mov eax,TRUE ) T7 ^& A+ z$ c' X7 Cret ) u' m0 C3 c. X+ `% r; P; zExecRing0Proc endp ) }3 k$ |; P( D1 W6 I4 V7 e9 zmain: assume fs:nothing push offset MySEH push fs:[0] mov fs:[0],esp # N8 U1 i; }9 |- g6 K8 o) B$ Emov OldEsp,esp mov ax,ds ;if Win9x? 4 g5 J K2 I: s6 n, j# P, c* B Jtest ax,4 jnz Exit1 invoke ExecRing0Proc % r- \* o( N u: f4 ]( q# x! i & a- v7 w, k6 d.if stIDEINFO.wNumCyls lea esi,stIDEINFO.sModelNumber # s- v/ O4 R/ |% l3 t mov edi,offset szModelNumber % L) f) L: `# u- E4 h mov ecx,sizeof stIDEINFO.sModelNumber & D6 D, @' g7 s5 i" b% V rep movsb * C" R ^# C3 h$ B: n& H lea esi,stIDEINFO.sSerialNumber mov edi,offset szSerialNumber # t: M/ ]0 C, \' Q4 Y# x; Q mov ecx,sizeof stIDEINFO.sSerialNumber ) p7 W* g! g* _' p o2 q9 U& U rep movsb 4 i3 w1 q) R: |/ [5 H lea esi,stIDEINFO.sFirmwareRev mov edi,offset szFirmwareRev mov ecx,sizeof stIDEINFO.sFirmwareRev rep movsb 0 Y4 A: e9 w- M' m$ a" @9 O. } movzx eax,stIDEINFO.wNumCyls movzx ebx,stIDEINFO.wNumHeads movzx ecx,stIDEINFO.wSectorsPerTrack movzx edx,stIDEINFO.wBufferSize * B }$ j$ {8 t- a) X invoke wsprintf,addr szBuffer,addr szIDEInfo, eax,ebx,ecx,edx, addr szModelNumber, addr szSerialNumber, addr szFirmwareRev " M4 c+ M n" k3 v+ R5 ^7 G mov eax,offset szBuffer .else mov eax,offset szErrInfo .endif @@: 4 Q) }& \( }& ]4 k1 ]/ R; Yinvoke MessageBox,NULL,eax,addr szTitle,MB_ICONINFORMATION or MB_OK 5 R+ l! W& U8 F) W* ~Exit1: pop fs:[0] add esp,4 invoke ExitProcess,0 9 b# M5 w/ C, x6 S6 G. L; R MySEH : mov esp,OldEsp pop fs:[0] 0 \& \5 w: b6 q/ x' Yadd esp,4 & q& V$ [, _5 E- F7 J( q) s! ainvoke ExitProcess,-1 - k) u4 Q! r3 u4 D3 g* ]6 wend main

[此贴子已经被作者于2003-11-2 18:14:02编辑过]

( V' r9 x8 H+ ]0 i) r7 C* \

呵呵，ExecRing0Proc 这段程序甚妙，先得到gdt，然后构造一个调用门call gate's ,使程序从用户模式(ring 3)进入内核模式(ring 0)。进入内核模式之后，就可以没有限制地对系统干任何勾当。这段程序确实为高手所为，在下佩服得紧。
至于读硬盘序列号之类，只不过是在内核模式下的一个I/O应用罢了。
2 M# S# @- t" O+ `. M$ W" Y- r7 z- H其实在NT/2000下读取硬盘序列号只要打开\\.\PhysicalDriveX(X:设备号0~26）设备，然后用DeviceIoControl()就可以读取了，不需要绕ring0这么一个大圈子
8 q2 t5 x4 t# |  E
7 P$ `) x& U3 a/ i/ n: B6 R这个程序也可以C语言实现，不过中间必须嵌入几条汇编的指令，如sgdt GdtLimit
4 L3 m3 v+ G$ U: c1 I但还是用c来写更方便，例如：
  y4 ?6 R& m2 M3 ccall @f
db "ZwOpenSection",0
@@:
push NtdllMod
call GetProcAddress
. a; }4 b+ K) r6 @mov ebx,eax ;ebx=ZwOpenSection
push esi ;esi->ObjAttr
0 j5 b6 ?/ N" t1 Gpush SECTION_MAP_READ or SECTION_MAP_WRITE
lea edi,hSection
push edi ;edi->hSection
call eax ;
  c2 }% B6 b8 B
0 Q! m+ O6 Y( j/ `# B8 C用c的话只要一句就可以了
( n' I4 ~* x( zZwOpenSection(&hSection,SECTION_MAP_READ or SECTION_MAP_WRITE,ObjAttr)；
因此懂汇编，然后用C/C++编程，是成为高手的捷径

[此贴子已经被作者于2003-11-3 16:46:50编辑过]

firelinux

win32位汇编，真的很不错，业余的时间，全都投进去了

唐明

要能有台机器试一下多好，学汇编还从没想过去ring0，也感觉没哪个必要。
现在闲着真相试试。这片文章我在家保存了有快一年了。不用感觉可惜了。一直停着不用，我都快忘了那些曾经那些依稀的记忆了。水能给我一台电脑，我力马高喊：有你这么富的吗？

很久以前的一段代码

游侠无极限

很久以前?
" D6 b: K( D7 J5 ], P) D/ j$ x不是吧,这个是 轻描淡写 编程论坛的斑竹写的

看到过的。