[转帖]2000/xp下读硬盘序列号[汇编]

游侠无极限

我可没这个水平 9 y p( {+ d; ~.686p 1 v/ ^7 ]! n* l8 P# O/ H6 K.model flat, stdcall $ ~3 w: J" h# m, a% yoption casemap :none ; case sensitive ; ######################################################################### include \masm32\include\windows.inc include \masm32\include\user32.inc & g2 ?3 X3 y; ^% V( |, C; n% J4 Ainclude \masm32\include\kernel32.inc include \masm32\include\advapi32.inc $ [3 R/ R8 U7 _% V 6 A' v1 ^* Q# f$ s& e6 P3 aincludelib \masm32\lib\user32.lib includelib \masm32\lib\kernel32.lib includelib \masm32\lib\advapi32.lib 3 U; }; q% g! Y- ]' uDEBUG = TRUE 3 ?" ?5 Z4 s3 U6 Q8 n. vHMODULE typedef dword 9 v' Y5 o0 `& I' E" {NTSTATUS typedef dword PACL typedef dword PSECURITY_DESCRIPTOR typedef dword , e& C" `. G) ?; j1 O+ e( o 3 ?: k- s8 U; I# U2 O+ }OBJ_INHERIT=2 OBJ_PERMANENT=10h : S5 s S# m' U; g+ z9 OOBJ_EXCLUSIVE=20h OBJ_CASE_INSENSITIVE=40h ; F1 F# ?8 a3 F: Q' |OBJ_OPENIF=80h * o g5 P0 F" v9 {8 a5 x3 |; @% v8 ~OBJ_OPENLINK =100h OBJ_KERNEL_HANDLE=200 OBJ_VALID_ATTRIBUTES=3F2h SE_KERNEL_OBJECT = 6 ! j7 k0 Y7 W: P. G2 H% M) @- cGRANT_ACCESS =1 NO_INHERITANCE =0 TRUSTEE_IS_NAME=1 TRUSTEE_IS_USER=1 STATUS_SUCCESS =0 . t0 d! t0 @ L7 rSTATUS_ACCESS_DENIED =0C0000022h STATUS_ACCESS_VIOLATION equ 0C0000005h STATUS_INFO_LENGTH_MISMATCH equ 0C0000004h SystemModuleInformation equ 11 PVOID TYPEDEF DWORD - P3 g6 _% E+ m6 X0 }6 o2 u! D" zUNLONG TYPEDEF DWORD CHAR TYPEDEF BYTE / Q6 I% A' c$ u$ ~' x) f2 ~* I$ P UNICODE_STRING struct , O( X" C$ U7 U, t nLength word ? $ H- _2 X6 U4 U! h1 c MaximumLength word ? : I9 X& j. h) u# O2 l3 B Buffer dword ? - R) J4 ?# x6 K4 PUNICODE_STRING ends 2 L' T" }, \8 Y4 Q! S& EOBJECT_ATTRIBUTES struct nLength dword ? RootDirectory HANDLE ? ObjectName dword ?UNICODE_STRING Attributes dword ?; SecurityDescriptor dword ?; PVOID // Points to type SECURITY_DESCRIPTOR & T$ f4 D# D6 o4 v& I* h+ E SecurityQualityOfService dword ?VOID // Points to type SECURITY_QUALITY_OF_SERVICE ) f4 A/ N& Y1 d+ x, n& J( \OBJECT_ATTRIBUTES ends S( {" |: c; n3 F/ _ ( g( s$ F! m& z' B5 ` TRUSTEE struct pMultipleTrustee dword ?TRUSTEE MultipleTrusteeOperation dword ?; MULTIPLE_TRUSTEE_OPERATION 9 J' }: Y, Q1 m" X TrusteeForm dword ?;TRUSTEE_FORM TrusteeType dword ?;TRUSTEE_TYPE ptstrName dword ?;LPTSTR s$ U1 ^5 ]- n; h! i# X- VTRUSTEE ends ' i" v7 q6 Z! ^5 w z; `EXPLICIT_ACCESS struct grfAccessPermissions DWORD ? grfAccessMode dword ? ;ACCESS_MODE grfInheritance DWORD ? ; 6 v3 U- C+ N: L6 j2 {6 v Trustee TRUSTEE <> ; 7 ]9 T- H, H# ?4 A5 d& {0 FEXPLICIT_ACCESS ends 6 A8 e5 e3 T E- h! Y MyGATE struct ;门结构类型定义 9 P+ M6 a5 m/ T+ P OFFSETL WORD ? ;32位偏移的低16位 : w& }4 a7 O7 N* r8 Z* n% ?- G) c S SELECTOR WORd ? ;选择子 DCOUNT BYTE ? ;双字计数字段 5 A, t% X* a2 w# M5 A* @ GTYPE BYTE ? ;类型 OFFSETH WORD ? ;32位偏移的高16位 MyGATE ends 8 r$ s0 d' \9 j5 n3 dIDEINFO struct ) o X6 b& ?7 H# M% OwGenConfig dw ? 0 q3 ]" ?$ z2 d( z* vwNumCyls dw ?;拄面数 wReserved dw ? - t5 q- d& U' S$ ~/ xwNumHeads dw ?;磁头数 wBytesPerTrack dw ?;每道字节数 wBytesPerSector dw ?;每扇区字节数 * ]" u& H' W( x8 rwSectorsPerTrack dw ?;每道山区数 ! ?+ [/ [( h: L* H; j! {wVendorUnique dw 3 dup (?) ; {" v, R7 e& G# ?) r5 NsSerialNumber db 20 dup (?);硬盘序列号 wBufferType dw ?; wBufferSize dw ?; ;n * 512 ! r1 `: N( G/ {) l. K, rwECCSize dw ? sFirmwareRev db 8 dup (?); 6 R7 y' U% E% ~8 PsModelNumber db 40 dup (?) wMoreVendorUnique dw ? wDoubleWordIO dw ? wCapabilities dw ? wReserved1 dw ? wPIOTiming dw ?; wDMATiming dw ?; ' \3 F- \6 z/ EwBS dw ? wNumCurrentCyls dw ?; wNumCurrentHeads dw ?; wNumCurrentSectorsPerTrack dw ?; dwCurrentSectorCapacity dd ?; 2 h1 a: S0 M: U1 t3 ywMultSectorStuff dw ?; dwTotalAddressableSectors dd ?; wSingleWordDMA dw ?; wMultiWordDMA dw ?; bReserved db 128 dup (?) IDEINFO ends ; h9 |) f& `1 S$ V$ f, {8 f * ~" N$ T! Q! m/ cSetPhyscialMemorySectionCanBeWrited proto :dword MiniMmGetPhysicalAddress proto :dword 9 \1 R, @) m% o" S! C/ z4 k6 g 2 X/ q3 r2 K( I7 l# o& K3 zENTERRING0 macro pushad / W- {- u- {1 s: X4 E5 `pushfd 2 z8 [2 X$ v4 E) d ? vcli 0 d. k& y/ z" ], Lmov eax,cr0 ;get rid off readonly protect and eax,0fffeffffh mov cr0,eax % z$ \8 z/ X6 A/ [$ I5 q6 sendm LEAVERING0 macro ( R. o1 Q' e0 j" C! dmov eax,cr0 ;restore readonly protect # m) M3 e h1 x" Aor eax,10000h & K8 j! h6 y: y8 N. Mmov cr0,eax ; U& a% j; U9 ?/ Z) Gsti popfd popad 4 B! i9 m' A6 U# V4 ]# dretf 6 |- m9 e# l8 ?0 Q& g; C: v( rendm 3 H% @; X4 e7 y. D ; ?7 n# o' u; \: } DUNICODE_STR macro str ! I3 M9 H) Q& Q; firpc _c,<str> & x8 G" \3 @8 n ~db '&_c' db 0 4 m8 ~8 p5 Q) C3 b( _1 eendm endm .data? GdtLimit dw ? 6 Z, m) A0 i" i& ~( K: TGdtAddr dd ? mapAddr dd ? OldEsp dd ? 6 L) j* w z4 j$ ]0 x 9 c5 E: |" y* f* freaded dw ? 3 b, ]! ~/ V+ }: w+ a2 Ebuffer db 512 dup(?) 5 o% h# Q2 s2 p4 t9 G0 X4 ~; TShowText db 512*3 dup (?) ! N7 s# V2 h X \0 @8 [4 y, k 6 G3 R$ Z3 i* M) J6 o: y) w; Y1 bszBuffer db 1024 dup (?) 2 Q0 U7 u, e3 k0 d, ]+ R) uszModelNumber db 41 dup (?) ! X$ A6 x8 `2 g1 f: [szSerialNumber db 21 dup (?) szFirmwareRev db 9 dup (?) stIDEINFO IDEINFO .data 0 J& k! C% i7 R: I( _align 4 : w. w5 ~- F. R0 F" Y3 J- y8 _objname dw objnamestr_size,objnamestr_size+2 objnameptr dd 0 6 n0 C' `4 T0 t/ ]objnamestr equ this byte : W2 e8 Y x( l7 g6 h( wUNICODE_STR <\Device\PhysicalMemory> objnamestr_size equ $-objnamestr szTitle db 'IDE 硬盘信息',0 ( H2 e4 y# Y& A; BszErrInfo db '无法读取硬盘信息',0 8 o/ r0 t% |; z$ c7 iszIDEInfo db '柱面数 : %d',0dh,0ah ; H- A3 {+ J6 H, G0 f' F; B; D db '磁头数 : %d',0dh,0ah db '每道扇区数 : %d',0dh,0ah db '缓冲大小 : %d 扇区',0dh,0ah & x% z# h$ R7 r2 h* V db '硬盘型号 : %40s',0dh,0ah db '序列号 : %20s',0dh,0ah db '版本号 : %8s',0 6 C3 \( r# R& p9 X( v, l$ H" C4 k align 4 1 z e) ~# J/ s5 o% yObjAttr db 24 dup (0) . {8 Z# W/ p' H! H( V. s ( C3 v9 m. |5 H8 w# l5 y" l4 iCallgt dq 0 ;call gate's selff ! N' l* I$ v% k0 l1 `- E* y VCaption db 'Windows XP绝对磁盘读写',0 Digit db '0123456789ABCDEF',0 , x2 `3 ?5 o8 E.code _ShowBuffer proc ;显示所读出的信息 ;把数据转换成16进制的形式 mov [readed],512 mov esi,offset buffer ;数据 mov edi,offset ShowText ;转换后的数据 ! K1 v/ G" I% l4 P2 t mov ebx,offset Digit ' d( W2 j0 Y: K0 S, I xor ecx,ecx xor eax,eax computeAgain: cmp [readed],0 ~9 s& ?+ N T! a$ p# I jz endCompute dec [readed] 5 N8 g& O. J- `& y* t lodsb push eax shr eax,4 ;高4位 xlatb 4 C, E9 e6 |7 c" v stosb pop eax & p3 O, d) |3 A. r! f$ O and eax,0fH ;低4位 # z+ A: ~/ y6 ^$ ?6 g- ~4 p" h" l xlatb stosb + d7 z7 j7 E- q. z i mov byte ptr[edi],' ' ;空格 0 m. k U9 ]- x inc edi 0 c( m. e7 Q5 g% M/ L inc ecx cmp ecx,16 jnz computeAgain xor ecx,ecx {& n) u+ F d5 [' T8 I0 b/ m9 R mov byte ptr[edi-1],13 ;回车 p/ y# i8 j1 ^6 H jmp computeAgain & Y9 J z4 J7 @) P% HendCompute: ;显示 invoke MessageBoxA,NULL,offset ShowText,offset Caption,MB_OK ret _ShowBuffer endp 1 y% X4 F$ u; U }SetPhyscialMemorySectionCanBeWrited proc uses ebx esi edi hSection:HANDLE | ?8 A- `5 slocal pDacl: PACL local pNewDaclACL local pSD SECURITY_DESCRIPTOR , r7 e7 w: @$ t% s1 L: E1 n- J' Rlocal dwRes:DWORD ; local ea:EXPLICIT_ACCESS ; 2 n: @( S' O. Q4 p) Qinvoke GetSecurityInfo,hSection,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION, NULL,NULL, addr pDacl,NULL, addr pSD cmp eax,ERROR_SUCCESS jz @f 9 l7 w: j& }& t2 A4 Mjmp OutSet 3 i" Y) O, U3 z3 G8 z+ `@@: mov dwRes,eax - Y2 R p8 B4 l$ e+ a5 p Y- R9 [mov ea.grfAccessPermissions ,SECTION_MAP_WRITE;2 1 R7 h. ^3 U. _2 Q( {6 B* o% Imov ea.grfAccessMode ,GRANT_ACCESS;1 * ]" z; b" ~& J: Imov ea.grfInheritance,NO_INHERITANCE;0 4 H5 u0 c8 w2 K: gmov ea.Trustee.pMultipleTrustee,0 mov ea.Trustee.MultipleTrusteeOperation,0 % E2 i; d2 K2 wmov ea.Trustee.TrusteeForm,TRUSTEE_IS_NAME;1 - `3 b- p1 Y6 k! E# Q# K% ]mov ea.Trustee.TrusteeType,TRUSTEE_IS_USER;1 call @f db "CURRENT_USER",0 1 F, U1 C& u* S7 M2 k( d/ |: }* X@@: 0 {3 Q0 m* k8 y& Gpop edx mov ea.Trustee.ptstrName,edx 6 }) f- ?" P! s3 g+ t# ^invoke SetEntriesInAcl,1,addr ea,pDacl,addr pNewDacl cmp eax,ERROR_SUCCESS jz @f ) n/ C# t+ H, G: N- m* V5 tjmp OutSet @@: * I/ ?4 G6 }9 } V yinvoke SetSecurityInfo,hSection,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION, NULL,NULL,pNewDacl,NULL 1 \& h) N# ]0 XOutSet: cmp pSD,0 jz @f invoke LocalFree,pSD % L+ Q# S! U" _@@: $ f( j3 F5 u/ W9 }' `% Rcmp pNewDacl,0 & m" m1 x% v) w0 Jjz @f invoke LocalFree,pNewDacl 8 F/ E; V) g3 W9 J0 c! A% `@@: d5 P) H7 X% O% Y$ i1 dret " R6 A# C5 u: z' |SetPhyscialMemorySectionCanBeWrited endp MiniMmGetPhysicalAddress proc virtualaddress:dword mov eax,virtualaddress cmp eax,80000000h jb @f cmp eax,0a0000000h jae @f ' A9 d& i) t4 ^6 N+ c and eax,1FFFF000h ret * U4 a4 K. k1 g5 g/ F @@: : b: a0 v7 Q/ }( u5 x) j b mov eax,0 ret MiniMmGetPhysicalAddress endp - H, Y6 F: D* V" ^ C# O8 W ExecRing0Proc proc , G: G9 B r+ p9 Q: Z8 Klocal tmpSel:dword % B5 q5 a+ W3 D2 R6 mlocal setcg:dword local BaseAddress:dword local NtdllMod :dword G& X6 {$ l8 Qlocal hSection:HANDLE 8 `9 f4 G. U( _( _5 V) w7 L5 Flocal status:NTSTATUS local objectAttributes:OBJECT_ATTRIBUTES ( w; a2 s- \) e" S0 m0 \local objName:UNICODE_STRING mov status,STATUS_SUCCESS; sgdt GdtLimit % K$ h0 o5 F8 L: Ninvoke MiniMmGetPhysicalAddress,GdtAddr 8 J& D$ L/ H: W' D2 ]mov mapAddr,eax ' m7 `3 [% B9 v. `test eax,eax jz Exit1 call @f 1 v# R6 D+ H, S# Q/ E2 z1 edb "Ntdll.dll",0 % G7 ^# J8 [& z- L: ]9 K- G@@: - k- Z8 [3 d: N0 e R X5 hcall LoadLibraryA 2 w% u" G1 V; ?6 V; P' o) Y( ]mov NtdllMod,eax lea edx,objnamestr : a: W' \ ^ n) v a. K3 r S& imov objnameptr,edx * o" s8 @0 J8 h/ c2 B9 ulea edi,ObjAttr _: j' |. x2 y) H$ j# Z- `4 Iand di,0fffch ;align to 4 bytes,or ZwOpenSection will fail % s8 Q# h2 x2 j& Lpush edi ;edi->ObjAttr push 24 ;length of <\Device\PhysicalMemory> pop ecx push ecx xor eax,eax rep stosb ;put ObjAttr with 0 pop ecx ' b* }& Y+ _3 c6 y/ dpop edi * L8 Z# m6 S! U/ q; l* \mov esi,edi stosd mov dword ptr[esi],ecx stosd lea eax,[edx-8] ;eax->objname stosd ;ObjAddr(18h,00,00,00,00,00,00,00,offset objname,40,02,00,00,dd 2 dup(0) " J6 `2 J% Y% C2 K- h! mmov dword ptr [edi],240h / Y$ `& g6 ~' |' w: U; u, `, ? + p0 T: Q: q" Z6 R& O' Jcall @f 7 R. m, z/ g9 t1 Ddb "ZwOpenSection",0 @@: " I ^3 O: L( Mpush NtdllMod call GetProcAddress 3 q7 ^; W5 b" F& c4 qmov ebx,eax ;ebx=ZwOpenSection ; T6 K+ [ q, P5 A push esi ;esi->ObjAttr * |5 Z0 B# V: hpush SECTION_MAP_READ or SECTION_MAP_WRITE lea edi,hSection ; l# w+ y' l# N- `+ G+ qpush edi ;edi->hSection 6 O; P, l8 ^, u2 j$ acall eax ;ZwOpenSection(&hSection,SECTION_MAP_READ or SECTION_MAP_WRITE,ObjAttr) ! {. A9 p) a7 ]! p& E W2 k& \' A mov status,eax ~( P3 F& \# j: y9 y' A. B4 dcmp status,STATUS_ACCESS_DENIED # t5 i+ M8 s7 D) [$ D9 ~1 R* Pjnz AccessPermit mov eax,ebx - A/ C3 y) `4 ]6 V2 Ppush esi 6 M5 Y- Z4 o8 apush READ_CONTROL or WRITE_DAC / f0 G* g3 k+ \5 npush edi call eax mov status,eax invoke SetPhyscialMemorySectionCanBeWrited,hSection 1 ?: p3 t( Z; ]$ L* X6 Z v call @f E) C2 w1 K+ f; h/ }% @7 {0 c6 S3 Ydb "ZwClose",0 # f0 i7 f0 S6 @' T, S2 x2 ~@@: push NtdllMod call GetProcAddress / T5 m9 _8 }4 p # q* k) P2 Z7 H. Y7 Ppush hSection 7 S2 ^- q0 f) b. jcall eax ;zwClose hSection mov eax,ebx 6 W+ n/ M* N1 e; h push esi push SECTION_MAP_READ or SECTION_MAP_WRITE & `5 h8 A! p. A9 F- ]lea edi,hSection push edi % ?9 Z6 t" c8 ?! L% Dcall eax mov status ,eax ) e% H( S. K' ~+ d;status =ZwOpenSection(&hSection,SECTION_MAP_WRITE|SECTION_MAP_WRITE,&objectAttributes); AccessPermit: cmp status ,STATUS_SUCCESS & L# m8 h+ j" [/ |$ D- q. mjz @f ;printf("Error Open PhysicalMemory Section Object,Status:%08X\n",status); 7 U3 C' T/ A9 ] j1 R% n3 [+ ^;return 0; mov eax,0 ret @@: # z# g9 }0 J7 F+ K. bmovzx eax,word ptr[GdtLimit] inc eax invoke MapViewOfFile,hSection, FILE_MAP_READ or FILE_MAP_WRITE, 0, mapAddr, eax O' D0 b1 M U2 ]9 [mov BaseAddress,eax 5 m/ q' j* L( Z h1 ?3 Kcmp BaseAddress,0 jnz @f ;printf("Error MapViewOffile:"); rintWin32Error(GetLastError()); return 0; mov eax,0 ret @@: - s" C) ? O9 I! [8 Bmov esi,eax ;esi->gdt base mov ecx,3e0h mov eax,GdtAddr 1 t% Q0 |8 Q, M9 C& S3 j.if dword ptr [esi+ecx+2]!=0ec0003e8h mov byte ptr [esi],0c3h 2 L5 u+ d5 \* B7 N* D0 ] mov word ptr [esi+ecx],ax shr eax,16 % O' y5 r9 v" Fmov word ptr [esi+ecx+6],ax mov dword ptr [esi+ecx+2],0ec0003e8h % Q% P5 t+ }- f& s0 p 9 `0 w, c2 S, z6 I7 N# Imov dword ptr [esi+ecx+8],0000ffffh mov dword ptr [esi+ecx+12],00cf9a00h .endif # J r/ z& ?$ J: |mov setcg,TRUE cmp setcg,0 jnz ChangeOK 4 p$ |( \. o8 b5 H" c- Vcall @f db "ZwClose",0 . g9 X- |9 k& y$ w" W# ~' \4 U2 X% j@@: push NtdllMod call GetProcAddress - W. ^; r5 @. b2 z$ Y, u0 hpush hSection call eax xor eax,eax , T4 F& ?3 }# F; s& Fret ChangeOK: : S& R% W" K* `4 Y* o2 zand dword ptr Callgt,0 xor eax,eax mov ax,3e0h or al,3h , h/ _8 e) O( r7 F; ymov word ptr [Callgt+4],ax ;farcall[2]=((short)((ULONG)cg-(ULONG)BaseAddress))|3; //Ring 3 callgate; ' a; W/ _6 \) j, U- zlea eax,_Ring0Proc ) P5 ?/ v8 j* n# k- r- H) x;invoke VirtualLock,eax,seglen 3 ^" p; O& r- b1 P: qtest eax,eax " j# O* U6 q; G" o4 T' M8 pjnz @f xor eax,eax ret @@: 9 s3 g% }% c/ B7 N5 b4 l& Vinvoke GetCurrentThread : L( ?" g) i4 f6 cinvoke SetThreadPriority,eax,THREAD_PRIORITY_TIME_CRITICAL X" F% C9 E7 j! z: i- v$ P: P 2 Y5 i5 J7 d0 t4 Z: C. kinvoke Sleep,0 call fword ptr [Callgt] ;use callgate to Ring0! % ^, J s$ L7 l2 {;_asm call fword ptr [farcall] $ {8 h5 i9 [3 S) S# I_Ring0Proc: ; Ring0 code here.. ' E+ w* d P" {& Z9 cmov eax,esp ;save ring0 esp 8 H, N; F) M) |3 z. {8 Dmov esp,[esp+4];->ring3 esp push eax mov ebx,offset stIDEINFO 5 [' O! V, i4 N# v8 z { assume ebx:ptr IDEINFO , Z! D6 q. [( u;******************************************************************** 6 h. ` R' p* `. k2 c8 j/ v; 等待硬盘就绪 ;******************************************************************** ; @6 T9 ]/ Y( u; b+ a+ w; Z mov ecx,10000h 8 q# }& A, ] h, V2 J: I mov dx,01f7h @@: # O9 U4 E; a z6 y3 P in al,dx cmp al,50h jz @F + \! R( h4 B7 g. Q+ k# _ loop @B 8 z! t) s0 q7 |- n0 B jmp _II_TimeOut @@: ;******************************************************************** ; 发送命令 : e0 w5 Z' K) v. U9 J; 如果向主控制发送命令，则端口为 1f0h-1f7h 2 U' P4 |; H" ?! M+ x( H) L; 如果向副控制发送命令，则端口为 170h-177h 6 B0 N$ `5 M/ Q! {& G2 ~; 1f6h 如果要检测的设备为该IDE接口的主（MASTER）设备， * T! _$ M$ O+ A- u( q) E; 那么发送 a0，如果为从那么发送 b0 ; 1f7h 如果要检测的设备为 ATA 设备那么发送 ec ! d; @2 L( F s1 H; 如果为 ATAPI 设备那么发送 a1 ;******************************************************************** 1 a5 F% m* D. \- G K2 E mov al,0a0h ;Drive 0,Head 0 9 y( w2 R6 p0 H, }" f: K5 j mov dx,01f6h ;Drive and head port " i8 E3 V1 z% c out dx,al ) L- v& h1 T. Y+ h+ T mov al,0ech / G2 w0 P" Z' o* B8 v+ j* H/ h7 r" J inc dx ;Command port out dx,al ' r3 N8 u' r3 X' Q" W; ]5 q3 x: X;******************************************************************** ; 等待硬盘就绪 ! B b+ p* g$ u4 \7 W7 x2 x% V4 e;******************************************************************** . R7 ?! b: A1 h9 y$ P mov ecx,10000h . b# ^. L3 E4 v2 _ l; f4 ^& W7 C2 U @@: in al,dx;1f7 (r-status register) cmp al,58h;(driver is ready ,and seek complete) 9 y/ n! M' ~" H y jz @F loop @B 7 W8 L: }+ h9 }* G( {! \ jmp _II_TimeOut 2 D! C4 a% N) Z, Q! D" N1 o" z @@: ;******************************************************************** ; 将返回信息读回 2 Z) J9 o( m0 Z( I+ L" j% f; 注意一定要读满 100h 个字长 ' B% C# m* T) ]& ~+ ];******************************************************************** cld $ H- |3 l+ C. B% J- p% J mov edx,01f0h;data port - data comes in and out here mov edi,ebx b7 P4 p' U6 s+ l ?& @ mov ecx,0100h rep insw ;******************************************************************** * \6 Q5 U4 U$ w" T& t7 Z$ s: P; 返回的信息中，型号、序列号、版本号为字形式 ; 需要整理到字符串的形式 ; U; B: G! g7 N8 Q% ], M$ j;******************************************************************** lea esi,[ebx].sSerialNumber mov edi,esi mov ecx,10 : g' B* E5 s/ N# }! m' h9 A8 k: ^ @@: lodsw ( y/ `6 r' I) m& ?+ H xchg ah,al " i# |) \' j0 k, t9 j/ g stosw loop @B 8 m3 ]5 ^5 f% h, E# ? lea esi,[ebx].sFirmwareRev mov edi,esi mov ecx,24 @@: 8 P5 U$ o) ?$ ?1 E6 k7 L; | lodsw " T/ @ o7 {7 v" [( e xchg ah,al 2 e' C' F3 D2 N1 }. I stosw loop @B 7 v, G* E$ R0 `7 d7 u+ i# ?_II_TimeOut: assume ebx:nothing 8 m& h0 Q0 z/ b% Z, Q! Y ; o0 t' w" N( n% tpop esp ;restore ring0 esp / K& d" r7 t. Q3 E% m( r$ l3 v5 cpush offset Ring3 retf Ring0CodeLen=$-_Ring0Proc Ring3: 4 \6 L. X7 E9 t. Yinvoke GetCurrentThread invoke SetThreadPriority,eax,THREAD_PRIORITY_NORMAL # b: Y- M, h0 ?/ U ;invoke VirtualUnlock,Entry,seglen ; Z8 j# x* a; A) \8 \- d& N call @f db "ZwClose",0 . q* i/ S- \" z; t7 c6 h% b@@: push NtdllMod call GetProcAddress push hSection 5 M5 {* K5 a N- ecall eax mov eax,TRUE $ k4 T; S: t4 ^ret + |0 n8 A5 v6 V5 y' Q3 DExecRing0Proc endp 5 B$ |+ M* m' G' e( w9 lmain: assume fs:nothing push offset MySEH push fs:[0] mov fs:[0],esp * B# x/ K7 f% E% D3 b8 v/ S- ?mov OldEsp,esp ) U- c$ B# ]/ b! {4 I3 E; O# Q: u# ~' amov ax,ds ;if Win9x? test ax,4 jnz Exit1 ! L# U* I3 e. y9 s; }( Q! Finvoke ExecRing0Proc # r6 B3 _7 k& N, i$ c .if stIDEINFO.wNumCyls & v# Q! X5 k) l lea esi,stIDEINFO.sModelNumber mov edi,offset szModelNumber ! F' U1 @4 C. L" O mov ecx,sizeof stIDEINFO.sModelNumber rep movsb lea esi,stIDEINFO.sSerialNumber 6 i+ n/ q& K0 V+ ~4 ]* G mov edi,offset szSerialNumber mov ecx,sizeof stIDEINFO.sSerialNumber % K) t0 L: }0 w% n rep movsb lea esi,stIDEINFO.sFirmwareRev ; K, d2 x; e6 I. V7 N0 m mov edi,offset szFirmwareRev 2 C1 Z% ^9 ^; [- p0 Y mov ecx,sizeof stIDEINFO.sFirmwareRev rep movsb 9 q( p0 m+ r7 @4 b. a' F' k6 D- o movzx eax,stIDEINFO.wNumCyls movzx ebx,stIDEINFO.wNumHeads movzx ecx,stIDEINFO.wSectorsPerTrack movzx edx,stIDEINFO.wBufferSize 3 |9 h; L, v( v7 s3 L% E invoke wsprintf,addr szBuffer,addr szIDEInfo, eax,ebx,ecx,edx, addr szModelNumber, addr szSerialNumber, addr szFirmwareRev mov eax,offset szBuffer .else : \' ^$ K; P: D mov eax,offset szErrInfo .endif * C$ J) K0 E% ~9 {4 `( h@@: invoke MessageBox,NULL,eax,addr szTitle,MB_ICONINFORMATION or MB_OK Exit1: 0 a" W3 T! m; X! n' y; ~* ]- a: q* ]pop fs:[0] add esp,4 : s) ?+ T* W" |* z. o9 T& T) finvoke ExitProcess,0 # `5 o% _: h2 `. M$ W6 d MySEH : ( q- _. }6 \- Cmov esp,OldEsp pop fs:[0] % B ]9 @, t7 D. Cadd esp,4 3 J4 f0 }& B4 X( R. c8 g0 c" Dinvoke ExitProcess,-1 end main % S/ `9 o) X$ R" i' J; M

[此贴子已经被作者于2003-11-2 18:14:02编辑过]

呵呵，ExecRing0Proc 这段程序甚妙，先得到gdt，然后构造一个调用门call gate's ,使程序从用户模式(ring 3)进入内核模式(ring 0)。进入内核模式之后，就可以没有限制地对系统干任何勾当。这段程序确实为高手所为，在下佩服得紧。
4 V# C  m& _: k6 D至于读硬盘序列号之类，只不过是在内核模式下的一个I/O应用罢了。
+ C3 |- R$ R' }! z5 D其实在NT/2000下读取硬盘序列号只要打开\\.\PhysicalDriveX(X:设备号0~26）设备，然后用DeviceIoControl()就可以读取了，不需要绕ring0这么一个大圈子
; {% X* x* V) v7 h& w0 _( h4 Q
( p6 e5 X4 R  d5 ^% z这个程序也可以C语言实现，不过中间必须嵌入几条汇编的指令，如sgdt GdtLimit
但还是用c来写更方便，例如：
& n9 w6 E/ |3 W% M8 z6 Scall @f
8 ?7 C- o  V, C7 n, u* i6 o! qdb "ZwOpenSection",0
# k8 G5 J! S& {  M@@:
push NtdllMod
. N! P) Z& y; O& tcall GetProcAddress
5 U* O$ |6 n$ l+ x! Gmov ebx,eax ;ebx=ZwOpenSection
push esi ;esi->ObjAttr
push SECTION_MAP_READ or SECTION_MAP_WRITE
& t: y/ g- `' V( ~( X1 jlea edi,hSection
. a" j  `) |0 E" j- ?0 Mpush edi ;edi->hSection
, Q" ], v  L2 T& K/ {3 \1 Scall eax ;
$ ~/ y) I! L) z) n! F
7 n! D9 J' A: A2 R$ Q8 J& `用c的话只要一句就可以了
, U8 t, v2 R) c9 _7 R% p& FZwOpenSection(&hSection,SECTION_MAP_READ or SECTION_MAP_WRITE,ObjAttr)；
因此懂汇编，然后用C/C++编程，是成为高手的捷径

[此贴子已经被作者于2003-11-3 16:46:50编辑过]

firelinux

win32位汇编，真的很不错，业余的时间，全都投进去了

唐明

要能有台机器试一下多好，学汇编还从没想过去ring0，也感觉没哪个必要。
; K& H4 G1 @5 a2 _现在闲着真相试试。这片文章我在家保存了有快一年了。不用感觉可惜了。一直停着不用，我都快忘了那些曾经那些依稀的记忆了。水能给我一台电脑，我力马高喊：有你这么富的吗？

很久以前的一段代码

游侠无极限

很久以前?
1 x8 A( m$ Y5 X不是吧,这个是 轻描淡写 编程论坛的斑竹写的

看到过的。