[转帖]2000/xp下读硬盘序列号[汇编]

游侠无极限

我可没这个水平 ' ^3 O& V1 `" {.686p . r0 c. a( X% v* G.model flat, stdcall option casemap :none ; case sensitive 0 ^5 z- y& H0 q0 J) \& `; ######################################################################### , J" E. Y! }7 winclude \masm32\include\windows.inc ) y! c2 R4 C3 O) M, Rinclude \masm32\include\user32.inc include \masm32\include\kernel32.inc include \masm32\include\advapi32.inc " D4 q4 I; J9 n) j3 D6 Q1 R# ? includelib \masm32\lib\user32.lib includelib \masm32\lib\kernel32.lib 9 c. N3 T* I, Q" }includelib \masm32\lib\advapi32.lib DEBUG = TRUE HMODULE typedef dword NTSTATUS typedef dword PACL typedef dword 4 p0 {# U# o3 V& c; QPSECURITY_DESCRIPTOR typedef dword , V0 V+ Z. s* t# e OBJ_INHERIT=2 1 Z9 \& E, v8 z3 ^( nOBJ_PERMANENT=10h OBJ_EXCLUSIVE=20h OBJ_CASE_INSENSITIVE=40h OBJ_OPENIF=80h 1 v, `: D9 [9 r- ]% q& j; ?5 q6 ?OBJ_OPENLINK =100h OBJ_KERNEL_HANDLE=200 / T; D8 p( P( TOBJ_VALID_ATTRIBUTES=3F2h ; v% H8 `% L& ^2 C Y. h8 YSE_KERNEL_OBJECT = 6 2 J! V, g0 A0 ~! Y$ w x. e( ZGRANT_ACCESS =1 4 e: q$ D5 I7 u) GNO_INHERITANCE =0 * z- A$ b) E$ p7 R3 [, q5 vTRUSTEE_IS_NAME=1 , A. w# g; k2 `' w$ P! ^! @. oTRUSTEE_IS_USER=1 STATUS_SUCCESS =0 STATUS_ACCESS_DENIED =0C0000022h ) C4 O; J/ j7 b# i * k0 o6 K+ P6 Q0 ?7 k2 ySTATUS_ACCESS_VIOLATION equ 0C0000005h STATUS_INFO_LENGTH_MISMATCH equ 0C0000004h 8 z9 s/ Q! W3 g+ iSystemModuleInformation equ 11 PVOID TYPEDEF DWORD UNLONG TYPEDEF DWORD CHAR TYPEDEF BYTE 1 Z3 G! I9 l$ s' U4 ?4 wUNICODE_STRING struct nLength word ? 4 L# C8 I1 ~. A) J MaximumLength word ? # T3 V8 q) l/ i6 r Buffer dword ? 8 Y. `" J, w) [6 w9 e/ XUNICODE_STRING ends : ?! C, t7 P0 _4 W1 X8 m% bOBJECT_ATTRIBUTES struct nLength dword ? 5 N& i) F1 K6 R+ F8 ? RootDirectory HANDLE ? 1 H" C2 e2 K$ r. u# d ObjectName dword ?UNICODE_STRING , Y; e- s, {7 i7 p Attributes dword ?; SecurityDescriptor dword ?; PVOID // Points to type SECURITY_DESCRIPTOR , p/ l9 \2 I( a+ O- R$ d7 q SecurityQualityOfService dword ?VOID // Points to type SECURITY_QUALITY_OF_SERVICE : Y# ]7 J* ~- t, u6 Z1 cOBJECT_ATTRIBUTES ends q% [$ O; z$ @ ! Q8 A, c" X2 q. _; E( N TRUSTEE struct + p% g7 N9 W+ t$ M pMultipleTrustee dword ?TRUSTEE " k* @; I# L$ Y/ O" M- o MultipleTrusteeOperation dword ?; MULTIPLE_TRUSTEE_OPERATION TrusteeForm dword ?;TRUSTEE_FORM 2 t3 {& f. `' q' W TrusteeType dword ?;TRUSTEE_TYPE ptstrName dword ?;LPTSTR TRUSTEE ends - ~1 e+ M0 H# {# q1 J EXPLICIT_ACCESS struct / [$ a+ }' j5 U+ Y/ r( S% ] grfAccessPermissions DWORD ? grfAccessMode dword ? ;ACCESS_MODE . v: c. Q/ M7 C% \ grfInheritance DWORD ? ; 4 [! Z7 Q& ]+ C# s Trustee TRUSTEE <> ; 6 j5 o$ C& |' _4 b8 D1 EEXPLICIT_ACCESS ends 4 K6 h7 a8 L. m8 h1 M- e5 yMyGATE struct ;门结构类型定义 # I7 U$ w8 S& E" V& _ OFFSETL WORD ? ;32位偏移的低16位 ' {$ }: G, @. s SELECTOR WORd ? ;选择子 DCOUNT BYTE ? ;双字计数字段 - a) _$ c/ `' n; e GTYPE BYTE ? ;类型 OFFSETH WORD ? ;32位偏移的高16位 MyGATE ends ) ^# V% j0 m: ^( S @5 P5 h! DIDEINFO struct 8 F5 l, b& ^+ WwGenConfig dw ? ' O7 l* l/ j! T( QwNumCyls dw ?;拄面数 wReserved dw ? wNumHeads dw ?;磁头数 wBytesPerTrack dw ?;每道字节数 $ S, {$ S t2 B5 |wBytesPerSector dw ?;每扇区字节数 wSectorsPerTrack dw ?;每道山区数 wVendorUnique dw 3 dup (?) 6 I. B4 K& p1 {9 csSerialNumber db 20 dup (?);硬盘序列号 & [( l( _8 j0 s/ iwBufferType dw ?; " o' \& r. d) q" E# LwBufferSize dw ?; ;n * 512 wECCSize dw ? sFirmwareRev db 8 dup (?); + b3 S+ W1 U$ B7 w9 b5 qsModelNumber db 40 dup (?) wMoreVendorUnique dw ? wDoubleWordIO dw ? + i; ~5 b% q+ M! u2 ^8 K0 wwCapabilities dw ? wReserved1 dw ? 4 X4 m) P0 f$ l2 g# Q! Y6 PwPIOTiming dw ?; ( T! Z, Q6 P' U) u! wwDMATiming dw ?; ; ?; c% h( j; H& g7 }8 `1 swBS dw ? 7 L/ ]5 c6 R' S% L2 h9 @wNumCurrentCyls dw ?; ; D1 e4 _+ \& H. LwNumCurrentHeads dw ?; - j! g! @! u: C7 P4 WwNumCurrentSectorsPerTrack dw ?; dwCurrentSectorCapacity dd ?; wMultSectorStuff dw ?; dwTotalAddressableSectors dd ?; wSingleWordDMA dw ?; wMultiWordDMA dw ?; bReserved db 128 dup (?) K# _% p9 l; N0 O8 P/ _1 S. PIDEINFO ends ' Z9 E+ t# y" o: G- X7 h! i 3 _+ K; s' Y& R2 \* f) {; m SetPhyscialMemorySectionCanBeWrited proto :dword 9 q" S e: t3 Q5 VMiniMmGetPhysicalAddress proto :dword ENTERRING0 macro 2 \4 P. `- ^+ j: B; \pushad 4 J5 P2 L# }% Ppushfd 1 l7 M( \3 P4 \* H( D kcli * [% T; ^/ E6 ?) b# T- ~mov eax,cr0 ;get rid off readonly protect 3 E) t4 P& G7 h' J( mand eax,0fffeffffh 4 P, }" I% g/ y1 U" Ymov cr0,eax endm 1 h- C" h- c0 u- E : K* P/ w8 f; lLEAVERING0 macro 5 l6 {; v6 G6 J! U; Qmov eax,cr0 ;restore readonly protect ) [) I0 j7 d9 R; dor eax,10000h mov cr0,eax ( ^ q. `; I5 G- f7 Tsti ( J4 Y) B- q" C$ V* e* e) X- G; o: Wpopfd 7 s6 q9 G' E# g: i: ?# {popad retf 7 k& R% H0 Q3 y2 xendm 8 P: C& ~! g- n S, I. e ' ?6 Q5 h ~7 n UNICODE_STR macro str irpc _c,<str> 8 @# Y. [' B- J0 B( |' |db '&_c' # w, L7 D; J, Hdb 0 endm endm 2 Z, e6 B8 j" A; F" B/ |, x8 f .data? ( S7 O0 O' }8 p. @; |: zGdtLimit dw ? o. K/ H) U; w) x/ U& V9 R" C+ X) }GdtAddr dd ? mapAddr dd ? $ V; ?" \" q# r% a2 @5 J; I, u8 u* KOldEsp dd ? ! S& e( N- s: ^6 greaded dw ? ! ]" x# M9 N7 l/ Nbuffer db 512 dup(?) ShowText db 512*3 dup (?) szBuffer db 1024 dup (?) szModelNumber db 41 dup (?) 5 H$ D& i/ [5 G" ]" jszSerialNumber db 21 dup (?) . \5 T# p- X5 i# OszFirmwareRev db 9 dup (?) * l# V8 T$ T% `3 }0 j; ~% H% p stIDEINFO IDEINFO .data align 4 objname dw objnamestr_size,objnamestr_size+2 objnameptr dd 0 ( {2 ^- d. H* g! M! I3 |objnamestr equ this byte 9 K z; E9 ~) r' ^' N7 p% dUNICODE_STR <\Device\PhysicalMemory> objnamestr_size equ $-objnamestr szTitle db 'IDE 硬盘信息',0 szErrInfo db '无法读取硬盘信息',0 : \6 Y9 u. a: ?, _szIDEInfo db '柱面数 : %d',0dh,0ah db '磁头数 : %d',0dh,0ah db '每道扇区数 : %d',0dh,0ah db '缓冲大小 : %d 扇区',0dh,0ah # O9 m, A, x: M2 B8 D2 u/ h db '硬盘型号 : %40s',0dh,0ah , e. s- ]' L _+ g; ]) | db '序列号 : %20s',0dh,0ah db '版本号 : %8s',0 align 4 8 X7 H9 I5 F+ A+ hObjAttr db 24 dup (0) 3 C2 t# V/ Q2 j. A1 N$ c8 Y Callgt dq 0 ;call gate's selff 9 E2 H. k, R0 B; T8 ?2 wCaption db 'Windows XP绝对磁盘读写',0 Digit db '0123456789ABCDEF',0 / \; ]& r V+ m1 O P, A.code / X+ k' w4 L0 F: o: D8 s_ShowBuffer proc ;显示所读出的信息 ;把数据转换成16进制的形式 mov [readed],512 2 I, o! w9 ]& K5 e, e" N# q0 m8 r/ V mov esi,offset buffer ;数据 , G( h- N a8 O( l5 ~" y( R mov edi,offset ShowText ;转换后的数据 * P3 [% O$ m6 T) M mov ebx,offset Digit 8 {- ?1 x! H y xor ecx,ecx xor eax,eax computeAgain: cmp [readed],0 jz endCompute dec [readed] lodsb push eax shr eax,4 ;高4位 xlatb stosb pop eax 6 A7 x* V$ v4 J& S and eax,0fH ;低4位 : r a1 f- d# n& j xlatb + U# P9 a# E& c1 U, {( `; A' L5 o4 O9 o+ E stosb - }4 x$ a1 y% r9 E mov byte ptr[edi],' ' ;空格 inc edi inc ecx 7 U7 u9 `* N/ Z6 X, C cmp ecx,16 ! t, H4 F* b* ^/ B9 T1 U jnz computeAgain * ?2 Y) \* w3 ~& |# K1 G xor ecx,ecx mov byte ptr[edi-1],13 ;回车 jmp computeAgain endCompute: ;显示 . z1 p- G* }# o2 A, U' [ invoke MessageBoxA,NULL,offset ShowText,offset Caption,MB_OK ret ' s, `- d' |3 o! E" q7 Z9 E7 Y_ShowBuffer endp # \. }. J$ i4 n& j" L3 WSetPhyscialMemorySectionCanBeWrited proc uses ebx esi edi hSection:HANDLE - F7 K" X4 v0 h( E0 m! v! Clocal pDacl: PACL local pNewDaclACL % K/ v$ W, d# s7 m m& O- blocal pSD SECURITY_DESCRIPTOR local dwRes:DWORD ; local ea:EXPLICIT_ACCESS ; invoke GetSecurityInfo,hSection,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION, NULL,NULL, addr pDacl,NULL, addr pSD 9 P% V0 k7 W* M% T8 Scmp eax,ERROR_SUCCESS ( }' K$ a M& i7 V" y( Qjz @f jmp OutSet @@: 7 _( U2 d+ v. `. Umov dwRes,eax & e" V* ]* q. N9 L( umov ea.grfAccessPermissions ,SECTION_MAP_WRITE;2 : E: q3 S! F5 \. Gmov ea.grfAccessMode ,GRANT_ACCESS;1 mov ea.grfInheritance,NO_INHERITANCE;0 mov ea.Trustee.pMultipleTrustee,0 mov ea.Trustee.MultipleTrusteeOperation,0 mov ea.Trustee.TrusteeForm,TRUSTEE_IS_NAME;1 . M$ @; i' o8 q% b( Smov ea.Trustee.TrusteeType,TRUSTEE_IS_USER;1 4 q( J5 m4 l1 H, l, p3 f1 Ecall @f db "CURRENT_USER",0 , j& t7 c$ t j& i# z@@: " H& A- w/ p" }6 opop edx 7 | g' s" z6 G( H" gmov ea.Trustee.ptstrName,edx ' _+ q3 B) w% C% vinvoke SetEntriesInAcl,1,addr ea,pDacl,addr pNewDacl cmp eax,ERROR_SUCCESS jz @f ) t1 J3 [4 {& ?jmp OutSet @@: " x h& [& M+ u: |$ I Hinvoke SetSecurityInfo,hSection,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION, NULL,NULL,pNewDacl,NULL OutSet: cmp pSD,0 jz @f % s& |- u$ F+ \9 d3 Ninvoke LocalFree,pSD @@: 8 H4 t5 {8 q& l2 J# rcmp pNewDacl,0 ! O' \( F- r3 c+ fjz @f invoke LocalFree,pNewDacl @@: ret SetPhyscialMemorySectionCanBeWrited endp MiniMmGetPhysicalAddress proc virtualaddress:dword mov eax,virtualaddress , v4 j5 w6 y$ n1 K% q& I cmp eax,80000000h jb @f cmp eax,0a0000000h jae @f 6 R; r- B; U: v F* x and eax,1FFFF000h ret 2 v* M0 T! y o$ i @@: ) B" O' M [" u- e% r2 X) M; F mov eax,0 6 l3 O$ {/ E: X' M8 a, S ret MiniMmGetPhysicalAddress endp 2 v/ h7 k/ H( ^4 Q* p p( h( ] ExecRing0Proc proc 0 A( t) o6 H, V$ w+ ~local tmpSel:dword 6 ?# E; E8 D# O2 ]! T4 xlocal setcg:dword local BaseAddress:dword local NtdllMod :dword ; t( Q4 R( Z5 U1 l6 {( H, Tlocal hSection:HANDLE local status:NTSTATUS " ]) a, o+ Q" g) d- \* t9 hlocal objectAttributes:OBJECT_ATTRIBUTES 8 D' w9 K6 K% Y& p. I( i Llocal objName:UNICODE_STRING mov status,STATUS_SUCCESS; sgdt GdtLimit " g- C' Z0 h/ winvoke MiniMmGetPhysicalAddress,GdtAddr mov mapAddr,eax test eax,eax & a, q+ L: N- m% Rjz Exit1 call @f db "Ntdll.dll",0 2 |( m: j2 Z% Z; y6 h1 v@@: ' Z8 U* q/ z$ Q2 {9 m& dcall LoadLibraryA mov NtdllMod,eax + a+ V; f5 q7 h! V! g& ^ lea edx,objnamestr $ H. m$ z1 P& P5 l' h1 Q2 z5 }% Qmov objnameptr,edx lea edi,ObjAttr and di,0fffch ;align to 4 bytes,or ZwOpenSection will fail push edi ;edi->ObjAttr push 24 ;length of <\Device\PhysicalMemory> pop ecx push ecx xor eax,eax % h( F3 O- I5 [rep stosb ;put ObjAttr with 0 , z8 ~! l' r- Q, b; Opop ecx ' w7 p* h, c6 f: {: q8 U- {( |: |9 Lpop edi 2 u# A2 J1 i: R" {+ Omov esi,edi stosd ) U* L* z8 B/ K1 g0 Rmov dword ptr[esi],ecx stosd 1 s" w; [ Y: k( Clea eax,[edx-8] ;eax->objname stosd ;ObjAddr(18h,00,00,00,00,00,00,00,offset objname,40,02,00,00,dd 2 dup(0) mov dword ptr [edi],240h / c$ y1 p; X3 ]; zcall @f db "ZwOpenSection",0 @@: 0 \& r S. C) v \) Ypush NtdllMod 2 B) b1 b) ^/ ?! g' _1 e, `call GetProcAddress 9 i4 ?1 {' G/ O1 u/ `0 n: [mov ebx,eax ;ebx=ZwOpenSection $ C# V6 c, t+ B7 I0 `$ ?0 s ; S: H# Y+ `) R9 X5 Cpush esi ;esi->ObjAttr push SECTION_MAP_READ or SECTION_MAP_WRITE 3 |8 ]- c$ q3 tlea edi,hSection . T, h7 Y. w. P! spush edi ;edi->hSection call eax ;ZwOpenSection(&hSection,SECTION_MAP_READ or SECTION_MAP_WRITE,ObjAttr) $ W: d3 c& `( t9 u" Q4 F v 6 U% K4 X" \0 E- F4 Z+ ?* jmov status,eax / l: w/ n" |- L. d* vcmp status,STATUS_ACCESS_DENIED jnz AccessPermit ! z5 H& j) _" H9 d) C% Imov eax,ebx + T* \( p: _( \: ?4 K% j p push esi push READ_CONTROL or WRITE_DAC push edi call eax ' {* T3 m7 z3 ?8 a7 i, P mov status,eax * A* B5 D0 Z3 N7 p" Tinvoke SetPhyscialMemorySectionCanBeWrited,hSection , O7 W0 W2 P3 v4 a$ Y( A! r 8 \8 A+ J. g$ ^+ |4 dcall @f db "ZwClose",0 @@: push NtdllMod call GetProcAddress 0 O- ^6 `# o! j; N7 z% H& b) z, s push hSection # h: j* n b% `8 y, t- Gcall eax ;zwClose hSection mov eax,ebx ' U6 v% @( e# U K% G! d 4 g+ l2 \) y3 k& K$ |push esi ' ?, n3 b; x- F6 W% N/ Z' y/ vpush SECTION_MAP_READ or SECTION_MAP_WRITE ' x/ ]$ D) l ^4 ?8 D7 y ^+ klea edi,hSection push edi call eax 8 l! w) v( X) G( lmov status ,eax 9 `$ G: r# y4 J3 S;status =ZwOpenSection(&hSection,SECTION_MAP_WRITE|SECTION_MAP_WRITE,&objectAttributes); + ^4 i& T, I0 a6 |, U6 E/ k# ?AccessPermit: * V1 [; v0 R* R% j: ^6 n4 `cmp status ,STATUS_SUCCESS 4 o, o* S6 z: o: {; e9 I$ Fjz @f ( z# w+ E% g, {" y;printf("Error Open PhysicalMemory Section Object,Status:%08X\n",status); ;return 0; 0 F4 O& G$ D" Y& K: t. |! tmov eax,0 # J. ?: X+ L1 o' t6 Z6 jret @@: 6 n) s2 b, E/ l0 Wmovzx eax,word ptr[GdtLimit] " }! q2 }* _' n9 i* m5 ]1 E. xinc eax invoke MapViewOfFile,hSection, FILE_MAP_READ or FILE_MAP_WRITE, 0, mapAddr, eax ( v1 p* ]* m) H( }; r. X, U+ dmov BaseAddress,eax cmp BaseAddress,0 ; L8 R. I9 r; u/ [+ b; K3 h5 tjnz @f ;printf("Error MapViewOffile:"); rintWin32Error(GetLastError()); return 0; mov eax,0 ret ( H) X7 u0 G h) _2 [% _4 B@@: : c4 G8 n0 |! Emov esi,eax ;esi->gdt base - |" m4 ~7 s4 h3 g4 z* B' amov ecx,3e0h mov eax,GdtAddr .if dword ptr [esi+ecx+2]!=0ec0003e8h . f# i+ q6 |* emov byte ptr [esi],0c3h L4 M6 I* ], E) x9 O2 j" E , N2 ~+ Y; ^" C4 E! \7 |mov word ptr [esi+ecx],ax $ d+ d: a# x; e! j% l* dshr eax,16 ) @) N' ]# M3 o" _/ S0 Bmov word ptr [esi+ecx+6],ax mov dword ptr [esi+ecx+2],0ec0003e8h mov dword ptr [esi+ecx+8],0000ffffh mov dword ptr [esi+ecx+12],00cf9a00h .endif mov setcg,TRUE * p+ u9 i- ]) e q! {cmp setcg,0 7 ?6 n3 \0 U5 [jnz ChangeOK 3 A9 m1 ~. U; N! P1 X/ ~call @f db "ZwClose",0 ( {, _/ U) n8 Q@@: push NtdllMod b! T. i% |& }% M8 ^" O4 X" Wcall GetProcAddress push hSection call eax 6 W8 ~" V0 {$ v- |8 P! C3 Cxor eax,eax ret " h: j! h8 U( X% Z" dChangeOK: ! Z/ [4 Z6 I( Tand dword ptr Callgt,0 $ c; l/ q* B7 a" O$ x9 rxor eax,eax mov ax,3e0h or al,3h mov word ptr [Callgt+4],ax 0 ]" H5 |* W6 C+ X;farcall[2]=((short)((ULONG)cg-(ULONG)BaseAddress))|3; //Ring 3 callgate; lea eax,_Ring0Proc ;invoke VirtualLock,eax,seglen test eax,eax jnz @f xor eax,eax 9 s) _' c8 G/ q" ]8 z& ~ f( mret @@: invoke GetCurrentThread invoke SetThreadPriority,eax,THREAD_PRIORITY_TIME_CRITICAL invoke Sleep,0 5 p' H( I. D4 |call fword ptr [Callgt] ;use callgate to Ring0! 7 P. J+ s$ h' U7 G* [: t# M4 K E;_asm call fword ptr [farcall] _Ring0Proc: ; Ring0 code here.. ( F1 ]% y# c4 _; x1 Umov eax,esp ;save ring0 esp mov esp,[esp+4];->ring3 esp , u4 S- \. m7 ~/ n8 W4 E8 @& \push eax + I2 B3 t: g( n0 n mov ebx,offset stIDEINFO assume ebx:ptr IDEINFO % ^4 ^3 y* d/ C' y. Q% A! V;******************************************************************** ; 等待硬盘就绪 ;******************************************************************** mov ecx,10000h mov dx,01f7h @@: 7 _+ J) e5 `! Q, M0 V in al,dx cmp al,50h jz @F 1 {* }( ?. f$ u) }3 B2 x% Q loop @B ) x I* p8 m( ?8 O) c& B. q jmp _II_TimeOut @@: ;******************************************************************** ; k3 q# V2 P# S; 发送命令 ; 如果向主控制发送命令，则端口为 1f0h-1f7h ; 如果向副控制发送命令，则端口为 170h-177h 4 P1 \3 w8 U8 T* f; 1f6h 如果要检测的设备为该IDE接口的主（MASTER）设备， ; 那么发送 a0，如果为从那么发送 b0 ; 1f7h 如果要检测的设备为 ATA 设备那么发送 ec ; 如果为 ATAPI 设备那么发送 a1 2 k& y* s% m' A* [ p1 r; Z;******************************************************************** mov al,0a0h ;Drive 0,Head 0 / ~8 Y, t0 u; A3 J1 W3 } mov dx,01f6h ;Drive and head port out dx,al F1 x. F4 F) P. H/ A mov al,0ech inc dx ;Command port 3 \7 r' K3 Y% W! E$ j( g' w out dx,al : Q" j& q9 S$ w! ]% g9 h" W7 j( D2 D;******************************************************************** ; 等待硬盘就绪 5 _* U5 R* e( l4 P: V;******************************************************************** - _. Q0 Y4 b4 G2 T8 e mov ecx,10000h @@: ; e; C+ n% N$ g) G! y! } in al,dx;1f7 (r-status register) cmp al,58h;(driver is ready ,and seek complete) jz @F loop @B jmp _II_TimeOut @@: ;******************************************************************** 7 v; Y8 e' @! Y5 p+ l; e1 S; 将返回信息读回 ; 注意一定要读满 100h 个字长 , W8 ]1 U5 c7 O d;******************************************************************** cld ( z8 \. {' P' J0 D I mov edx,01f0h;data port - data comes in and out here mov edi,ebx % ^. W! E' Z! a/ V8 t0 e b mov ecx,0100h ! R& a0 U' N6 c- G2 j rep insw 5 P* q0 U2 i5 ^8 v;******************************************************************** 6 Y! E, L" @. G' J; 返回的信息中，型号、序列号、版本号为字形式 0 u: [0 l/ H6 q) m; 需要整理到字符串的形式 8 {8 w# t0 B! M+ I;******************************************************************** lea esi,[ebx].sSerialNumber mov edi,esi mov ecx,10 @@: 9 s* F- ^6 v% ?% C/ J1 f$ m lodsw 3 }7 V( R) a/ s+ G" N8 R8 W, k xchg ah,al stosw loop @B ( U9 U2 P# W% p: Y lea esi,[ebx].sFirmwareRev - R; V% X7 \1 r+ C* e mov edi,esi mov ecx,24 @@: 9 M- E! g' m2 K/ f lodsw 0 i9 g" J0 C- m xchg ah,al stosw 6 u% F0 w( u6 x loop @B ' I( _) N, M+ f7 O6 D_II_TimeOut: $ O( n: C( T5 a; m: f( F7 Iassume ebx:nothing . ?& d5 z8 V5 d5 qpop esp ;restore ring0 esp $ R' X0 @# ^1 vpush offset Ring3 retf Ring0CodeLen=$-_Ring0Proc Ring3: invoke GetCurrentThread invoke SetThreadPriority,eax,THREAD_PRIORITY_NORMAL ;invoke VirtualUnlock,Entry,seglen ; t7 j2 E) Y+ S+ A" K call @f $ M E3 D$ ?) r% c6 wdb "ZwClose",0 @@: push NtdllMod / A9 A+ j, m/ `% k/ Ycall GetProcAddress push hSection call eax , }" H4 Q5 H' ]6 M; ?mov eax,TRUE 8 W& c* {9 i$ e& M) A+ G) b& @4 uret % V9 l; N5 i% e2 j3 O! SExecRing0Proc endp * R3 t B5 E, n, Z* w# W7 O6 E0 c8 nmain: assume fs:nothing push offset MySEH - ]* B* y- P4 R5 L1 s4 v x& _push fs:[0] $ |; B2 `* F1 ]1 \6 a0 Q- jmov fs:[0],esp ' R& ^" V4 b: Lmov OldEsp,esp mov ax,ds ;if Win9x? / ?3 C E; F1 Q0 Q+ ttest ax,4 jnz Exit1 invoke ExecRing0Proc 5 j5 n- b% ]6 n: g .if stIDEINFO.wNumCyls 8 F: { G3 B- y# B' l) n4 k9 P lea esi,stIDEINFO.sModelNumber + y3 P( Q2 D7 E' B mov edi,offset szModelNumber mov ecx,sizeof stIDEINFO.sModelNumber . ~8 ]! K& k$ ]* _) s- D rep movsb lea esi,stIDEINFO.sSerialNumber + H0 x% {, ^) N0 l8 \+ e5 n mov edi,offset szSerialNumber * r& T/ m4 G3 e0 r# c mov ecx,sizeof stIDEINFO.sSerialNumber rep movsb 0 j' N# V/ H" `* L' r( d3 r lea esi,stIDEINFO.sFirmwareRev mov edi,offset szFirmwareRev mov ecx,sizeof stIDEINFO.sFirmwareRev - d8 j% M8 z) G rep movsb movzx eax,stIDEINFO.wNumCyls movzx ebx,stIDEINFO.wNumHeads movzx ecx,stIDEINFO.wSectorsPerTrack . G: X9 W& ^' z5 i5 S movzx edx,stIDEINFO.wBufferSize invoke wsprintf,addr szBuffer,addr szIDEInfo, eax,ebx,ecx,edx, addr szModelNumber, addr szSerialNumber, addr szFirmwareRev & e3 \5 E4 G5 G- E( [$ a2 m8 T mov eax,offset szBuffer ' M j+ h' E2 d.else % g% y8 u- a8 [( S7 }5 x mov eax,offset szErrInfo .endif @@: : g9 O1 x$ {8 M% vinvoke MessageBox,NULL,eax,addr szTitle,MB_ICONINFORMATION or MB_OK Exit1: pop fs:[0] 9 d# L' F6 G0 d& f* J/ C6 |add esp,4 2 u x* A( O- A g- s2 b" vinvoke ExitProcess,0 MySEH : mov esp,OldEsp ) i$ ^2 I2 s3 A5 p; l7 r% Gpop fs:[0] $ o" k D5 y/ G$ n) Cadd esp,4 invoke ExitProcess,-1 end main ( W* a+ O% y. m& _

[此贴子已经被作者于2003-11-2 18:14:02编辑过]

6 M, Y* n: S& Y0 l

呵呵，ExecRing0Proc 这段程序甚妙，先得到gdt，然后构造一个调用门call gate's ,使程序从用户模式(ring 3)进入内核模式(ring 0)。进入内核模式之后，就可以没有限制地对系统干任何勾当。这段程序确实为高手所为，在下佩服得紧。
至于读硬盘序列号之类，只不过是在内核模式下的一个I/O应用罢了。
" p- Y9 e7 F4 }/ _: {( {其实在NT/2000下读取硬盘序列号只要打开\\.\PhysicalDriveX(X:设备号0~26）设备，然后用DeviceIoControl()就可以读取了，不需要绕ring0这么一个大圈子

这个程序也可以C语言实现，不过中间必须嵌入几条汇编的指令，如sgdt GdtLimit
但还是用c来写更方便，例如：
call @f
db "ZwOpenSection",0
@@:
push NtdllMod
: t' X, r3 l  Z- ?3 }$ {1 F: hcall GetProcAddress
mov ebx,eax ;ebx=ZwOpenSection
push esi ;esi->ObjAttr
1 r1 J9 D1 x8 k6 k# l8 dpush SECTION_MAP_READ or SECTION_MAP_WRITE
lea edi,hSection
  M# ^% c; S) F# q- V' V1 I7 Fpush edi ;edi->hSection
4 e7 s2 z" k* s0 M& Jcall eax ;
! w7 V0 k5 j* u+ m
+ C; P! J5 r3 }5 d# T/ k/ h% ?7 y: I用c的话只要一句就可以了
ZwOpenSection(&hSection,SECTION_MAP_READ or SECTION_MAP_WRITE,ObjAttr)；
因此懂汇编，然后用C/C++编程，是成为高手的捷径

$ N2 C, C8 k' ~" D4 G

[此贴子已经被作者于2003-11-3 16:46:50编辑过]

firelinux

win32位汇编，真的很不错，业余的时间，全都投进去了

唐明

要能有台机器试一下多好，学汇编还从没想过去ring0，也感觉没哪个必要。
现在闲着真相试试。这片文章我在家保存了有快一年了。不用感觉可惜了。一直停着不用，我都快忘了那些曾经那些依稀的记忆了。水能给我一台电脑，我力马高喊：有你这么富的吗？

很久以前的一段代码

游侠无极限

很久以前?
不是吧,这个是 轻描淡写 编程论坛的斑竹写的

看到过的。