[转帖]2000/xp下读硬盘序列号[汇编]

游侠无极限

我可没这个水平 $ q) k4 d, V/ D2 E) i. _+ ^.686p / _1 C: I- k% ], H.model flat, stdcall # Z/ P/ ?0 }% y1 a% W7 ioption casemap :none ; case sensitive ; ######################################################################### include \masm32\include\windows.inc & V7 _- f$ h4 }" U; Y: @include \masm32\include\user32.inc 0 f% {2 r$ {& Dinclude \masm32\include\kernel32.inc _* ~+ L" ^; i* R. q ?include \masm32\include\advapi32.inc 7 @* ]6 j3 s; L7 R: Z; X - ~4 C8 Y: p: Z+ sincludelib \masm32\lib\user32.lib 5 O4 ^4 j- ~8 u8 u) Y4 Nincludelib \masm32\lib\kernel32.lib 1 W) U! K% w% |3 ^4 H/ p8 H6 [0 sincludelib \masm32\lib\advapi32.lib ( Y- } ?1 V; h' a, A7 j, s- }4 ODEBUG = TRUE 3 @. u# U9 @" t0 o7 l6 H; [7 N HMODULE typedef dword 0 }& `& j# r- l. a# ~$ L, m+ GNTSTATUS typedef dword 0 `. g' d* Z1 SPACL typedef dword ' {1 ]7 {: Y$ u! k% s0 tPSECURITY_DESCRIPTOR typedef dword ! V; r6 \: W" C OBJ_INHERIT=2 OBJ_PERMANENT=10h OBJ_EXCLUSIVE=20h 4 T2 V( _- b* b' _5 WOBJ_CASE_INSENSITIVE=40h OBJ_OPENIF=80h 4 [* T' X. H% C# P) MOBJ_OPENLINK =100h i- z4 {1 l# i6 }OBJ_KERNEL_HANDLE=200 ) G3 D: E1 i& W1 h$ i% uOBJ_VALID_ATTRIBUTES=3F2h 1 H, v- S f. q' s8 i* U% r- J 3 K3 z6 O$ \6 R) @& ~6 ASE_KERNEL_OBJECT = 6 / |8 Y, m1 d# B$ p0 b$ SGRANT_ACCESS =1 NO_INHERITANCE =0 & Z2 [5 F/ N. N+ m/ m: c, w6 g* L% `TRUSTEE_IS_NAME=1 4 h' n8 ^2 D0 u! JTRUSTEE_IS_USER=1 0 y' ~" p- c3 c8 q7 b5 ASTATUS_SUCCESS =0 * b" w4 T$ U' {4 ]# j" V8 ASTATUS_ACCESS_DENIED =0C0000022h , ~" \- W T( Y& w" ^+ Y+ | STATUS_ACCESS_VIOLATION equ 0C0000005h ' m5 N4 D3 x% f7 e; T9 |0 \; USTATUS_INFO_LENGTH_MISMATCH equ 0C0000004h + \6 ~: J( |: H0 U: oSystemModuleInformation equ 11 % @# i# G% y; C! w9 E: y4 Y" t- kPVOID TYPEDEF DWORD UNLONG TYPEDEF DWORD / _3 x- ^) I u6 D. N2 _CHAR TYPEDEF BYTE 8 }! c" K7 r6 H$ pUNICODE_STRING struct nLength word ? MaximumLength word ? : Y% v7 `7 e( |, O: l' u Buffer dword ? UNICODE_STRING ends / q* m2 O5 j+ u% t$ \! U+ j, U- A# VOBJECT_ATTRIBUTES struct , v( N5 Z1 q a2 h nLength dword ? RootDirectory HANDLE ? ObjectName dword ?UNICODE_STRING ! A5 V; {% }, l2 {# i- _0 i; [+ r Attributes dword ?; SecurityDescriptor dword ?; PVOID // Points to type SECURITY_DESCRIPTOR 7 G8 d$ s x/ f' J SecurityQualityOfService dword ?VOID // Points to type SECURITY_QUALITY_OF_SERVICE * P; v6 A9 Z# k- S9 j" P( F* d" `# p) MOBJECT_ATTRIBUTES ends TRUSTEE struct ! r* U- f$ M. Q) Z, K1 C0 m pMultipleTrustee dword ?TRUSTEE MultipleTrusteeOperation dword ?; MULTIPLE_TRUSTEE_OPERATION 4 q+ @+ p3 `8 T TrusteeForm dword ?;TRUSTEE_FORM TrusteeType dword ?;TRUSTEE_TYPE ptstrName dword ?;LPTSTR . Y6 Q# u8 O- ZTRUSTEE ends * U h+ y* f: v9 VEXPLICIT_ACCESS struct $ w; e8 K) _) o* n grfAccessPermissions DWORD ? 5 @6 X8 E2 R' r3 }" S grfAccessMode dword ? ;ACCESS_MODE grfInheritance DWORD ? ; Trustee TRUSTEE <> ; 5 c' L) i# N' K' A4 x; YEXPLICIT_ACCESS ends 1 L* D) o( V# O: l: z " M D8 X2 F3 K/ S8 YMyGATE struct ;门结构类型定义 8 h \. X4 N9 `; T OFFSETL WORD ? ;32位偏移的低16位 . M4 o/ x# {; J/ C7 t$ c SELECTOR WORd ? ;选择子 DCOUNT BYTE ? ;双字计数字段 # S R6 p* _; e" e) X GTYPE BYTE ? ;类型 OFFSETH WORD ? ;32位偏移的高16位 MyGATE ends % l& y. w; C" G$ C* j7 y; hIDEINFO struct ; O! m: y0 l8 `, E# x$ E$ R K& U) _& kwGenConfig dw ? & J( g2 M1 s* E) g [wNumCyls dw ?;拄面数 wReserved dw ? & m" K) t2 q4 Y; t7 jwNumHeads dw ?;磁头数 $ P8 u: W; t! [0 e$ N! VwBytesPerTrack dw ?;每道字节数 & p: E5 B8 `7 R7 k- |+ G5 JwBytesPerSector dw ?;每扇区字节数 3 i) y1 K w: R% f7 }wSectorsPerTrack dw ?;每道山区数 ' U1 S* d4 q" W6 YwVendorUnique dw 3 dup (?) sSerialNumber db 20 dup (?);硬盘序列号 7 j) L3 {/ f! c! P" w9 V4 ywBufferType dw ?; wBufferSize dw ?; ;n * 512 wECCSize dw ? sFirmwareRev db 8 dup (?); + ?7 Q# k. R" E) \4 j1 t; J5 @sModelNumber db 40 dup (?) $ n N7 `( V1 X( g* ^" swMoreVendorUnique dw ? wDoubleWordIO dw ? wCapabilities dw ? wReserved1 dw ? wPIOTiming dw ?; wDMATiming dw ?; , y: r* T9 a3 O1 F( f5 E& W$ OwBS dw ? wNumCurrentCyls dw ?; wNumCurrentHeads dw ?; wNumCurrentSectorsPerTrack dw ?; # e" [8 }0 F6 CdwCurrentSectorCapacity dd ?; ) O |3 H& U% B- a( BwMultSectorStuff dw ?; dwTotalAddressableSectors dd ?; wSingleWordDMA dw ?; wMultiWordDMA dw ?; bReserved db 128 dup (?) 6 G0 S" J& y) T' ~3 O" FIDEINFO ends 3 b, I! i* S D# k0 u5 }" x/ | ^SetPhyscialMemorySectionCanBeWrited proto :dword 2 J9 ?" }, o7 p4 H m0 h( n0 t$ l3 hMiniMmGetPhysicalAddress proto :dword ' \3 b8 X9 b; y9 J0 r7 ~ ; G# m$ d, j/ y5 ~ENTERRING0 macro pushad pushfd ! D$ d3 ^/ v# F* Y- m; n* Fcli mov eax,cr0 ;get rid off readonly protect ; g/ ]( n' T w* Y+ d2 E, C( b- wand eax,0fffeffffh mov cr0,eax $ o5 k. B& v$ Bendm 0 p5 q/ g& z) V/ [1 L6 h- YLEAVERING0 macro . j0 |, B8 v Z2 smov eax,cr0 ;restore readonly protect 6 E, V: e. t' s) X8 e$ ^9 V( j# Kor eax,10000h mov cr0,eax 4 b" x0 D. E5 g) u+ U psti & H; o4 X; W" f9 Vpopfd ' C b. s; ^# z) tpopad , K5 B, Z0 {2 ^5 V. d, Lretf 0 @ V I# Y1 V& p+ L& eendm 8 x* q2 x- p6 s2 ^ UNICODE_STR macro str irpc _c,<str> 6 o& ^+ \0 U! J/ Udb '&_c' db 0 endm endm - B5 O. C: Z1 Z9 _ ) c% |* S0 Y3 g# M w.data? + y) `: | r0 v0 ZGdtLimit dw ? GdtAddr dd ? % h" U% {0 F+ a2 W" ]9 h* P }$ g$ F. D; Q! U; L2 ZmapAddr dd ? OldEsp dd ? 7 ^- Y$ U# J2 c! \2 T5 H# W! Zreaded dw ? 1 B+ {# s7 }4 f6 \' c! Ebuffer db 512 dup(?) ShowText db 512*3 dup (?) szBuffer db 1024 dup (?) szModelNumber db 41 dup (?) szSerialNumber db 21 dup (?) szFirmwareRev db 9 dup (?) % v$ v R x1 ]$ y. R, G 1 D5 W* @$ l& [8 `. S' ]7 LstIDEINFO IDEINFO 7 E R) r0 k8 x' c: T" R .data 1 x G+ j* A: aalign 4 objname dw objnamestr_size,objnamestr_size+2 3 l Y Z6 \$ _: u2 c0 Fobjnameptr dd 0 . _6 n" S B) q" m* q4 Kobjnamestr equ this byte 3 f7 o7 W& Q3 J* o( B% v1 g1 o( X: N/ MUNICODE_STR <\Device\PhysicalMemory> ) R. G! p4 J* @6 I0 Aobjnamestr_size equ $-objnamestr + t4 {: a. x( v! Y szTitle db 'IDE 硬盘信息',0 4 w8 P t3 { I. f( v2 mszErrInfo db '无法读取硬盘信息',0 " v9 }8 K7 M: I) V' MszIDEInfo db '柱面数 : %d',0dh,0ah db '磁头数 : %d',0dh,0ah db '每道扇区数 : %d',0dh,0ah 9 O* y* s) q% ? b8 q! B db '缓冲大小 : %d 扇区',0dh,0ah db '硬盘型号 : %40s',0dh,0ah db '序列号 : %20s',0dh,0ah , h: { @# b0 c a& G db '版本号 : %8s',0 - e% S6 @' b" x& q: d( Valign 4 ) e& P4 t# @9 n; D6 ?ObjAttr db 24 dup (0) ; v7 e$ S. D: M& }Callgt dq 0 ;call gate's selff U+ N' I$ Y7 ^. Q1 W' N& | NCaption db 'Windows XP绝对磁盘读写',0 $ x% j4 }; L6 }" p; vDigit db '0123456789ABCDEF',0 .code " k# ]8 z% O2 j9 P+ \ x4 u6 T0 {_ShowBuffer proc ;显示所读出的信息 / d* q( f# f0 F3 [+ `: _ ;把数据转换成16进制的形式 5 p6 E$ ^: A) } mov [readed],512 & q4 s* Y& r5 e* ?8 G; a mov esi,offset buffer ;数据 mov edi,offset ShowText ;转换后的数据 0 F, T6 o9 V) _( J/ v1 ~2 D mov ebx,offset Digit * W& y, q! j+ L6 |; \- ~+ l6 j4 ^- Y xor ecx,ecx * Z/ {9 U* K3 D$ k* j* t xor eax,eax 5 c3 \, M& S5 n, {3 bcomputeAgain: cmp [readed],0 jz endCompute dec [readed] 1 r( v0 x |3 M0 b& ` lodsb 8 b, O2 O" e- F push eax shr eax,4 ;高4位 xlatb stosb 0 ^; g. }- e- P8 o. M2 f pop eax 9 ~5 K( A% X: e, O* { and eax,0fH ;低4位 xlatb stosb ( a6 i; H# s2 x0 [ mov byte ptr[edi],' ' ;空格 inc edi inc ecx $ n" Z$ ~7 |5 {' e cmp ecx,16 jnz computeAgain xor ecx,ecx mov byte ptr[edi-1],13 ;回车 / H- K1 Y) V: `( K- m- e7 g jmp computeAgain endCompute: ;显示 invoke MessageBoxA,NULL,offset ShowText,offset Caption,MB_OK " Z( ]9 M2 w( Y; F/ |- H2 z% b7 @0 N ret 0 x6 v3 N) g1 y( p_ShowBuffer endp # j0 m1 ]. N- J$ o* l SetPhyscialMemorySectionCanBeWrited proc uses ebx esi edi hSection:HANDLE local pDacl: PACL local pNewDaclACL local pSD SECURITY_DESCRIPTOR local dwRes:DWORD ; local ea:EXPLICIT_ACCESS ; invoke GetSecurityInfo,hSection,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION, NULL,NULL, addr pDacl,NULL, addr pSD cmp eax,ERROR_SUCCESS jz @f 8 k/ a7 N6 m a( l2 ?jmp OutSet @@: mov dwRes,eax ' x3 P& ~. d5 {mov ea.grfAccessPermissions ,SECTION_MAP_WRITE;2 mov ea.grfAccessMode ,GRANT_ACCESS;1 mov ea.grfInheritance,NO_INHERITANCE;0 v2 [/ F6 e8 V* K' rmov ea.Trustee.pMultipleTrustee,0 mov ea.Trustee.MultipleTrusteeOperation,0 & C, \8 n4 [% i5 w# @mov ea.Trustee.TrusteeForm,TRUSTEE_IS_NAME;1 mov ea.Trustee.TrusteeType,TRUSTEE_IS_USER;1 call @f db "CURRENT_USER",0 @@: * C6 \5 `8 x* H& B6 S* Qpop edx mov ea.Trustee.ptstrName,edx 4 ]2 z4 {5 p2 }6 W8 Uinvoke SetEntriesInAcl,1,addr ea,pDacl,addr pNewDacl 9 `; d# r- Y/ z7 }2 kcmp eax,ERROR_SUCCESS jz @f jmp OutSet @@: m7 [) y% O6 c$ H, Ninvoke SetSecurityInfo,hSection,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION, NULL,NULL,pNewDacl,NULL , X* N8 C, `5 q7 G$ `) ^1 eOutSet: # |, i5 j$ Q" o" A- D. C; G3 Dcmp pSD,0 jz @f * K0 i1 i* j3 P3 y0 N1 finvoke LocalFree,pSD ! u% M5 g8 P/ t) I' X6 v@@: 2 w! r9 _) M: O8 c! S2 Ccmp pNewDacl,0 jz @f " F: R9 ` B; g3 {/ x6 D% Q+ `7 cinvoke LocalFree,pNewDacl @@: ret SetPhyscialMemorySectionCanBeWrited endp ( y& }, i! l" _ 7 v2 a2 U+ d. WMiniMmGetPhysicalAddress proc virtualaddress:dword $ _0 v+ l' _0 o: K2 _/ }8 u4 b9 {0 i mov eax,virtualaddress ( ^& @9 Q! X! Q; y4 r7 N( G7 R cmp eax,80000000h 3 r4 p- `2 W2 J% w3 W jb @f cmp eax,0a0000000h 4 Y- I+ j" |1 x% e/ _8 ~( @6 p- r jae @f and eax,1FFFF000h 3 T) D2 i7 q8 Z4 A0 ]0 {5 u: ^& N ret 6 n. _: V0 T$ P* Y( d- K @@: 4 j. C7 h4 i/ e/ Y mov eax,0 ' w h/ ]1 X+ t M1 [8 G- v ret : v- I7 q5 ^( ]0 `* uMiniMmGetPhysicalAddress endp ExecRing0Proc proc & l# M3 z0 M9 q* O- Z' y Z4 e4 Elocal tmpSel:dword local setcg:dword ' G0 e1 G/ I- ?3 ~+ V3 |local BaseAddress:dword local NtdllMod :dword 8 n; B2 n* ~8 A- j1 f' Plocal hSection:HANDLE ]/ J& }* n9 e, L7 y: glocal status:NTSTATUS - f9 ?; y2 u" l. |( plocal objectAttributes:OBJECT_ATTRIBUTES , p, _# R2 {9 U2 y. f1 ?- Dlocal objName:UNICODE_STRING mov status,STATUS_SUCCESS; sgdt GdtLimit {. f5 q$ [8 ninvoke MiniMmGetPhysicalAddress,GdtAddr mov mapAddr,eax / A, X- r% o3 P8 V: f: I' V" Htest eax,eax jz Exit1 R {. c' x( q2 `% qcall @f db "Ntdll.dll",0 @@: * K3 H, [. {2 h- M) R% d& `call LoadLibraryA mov NtdllMod,eax . u( `+ N+ j2 k: j9 o \$ W lea edx,objnamestr mov objnameptr,edx lea edi,ObjAttr and di,0fffch ;align to 4 bytes,or ZwOpenSection will fail push edi ;edi->ObjAttr push 24 ;length of <\Device\PhysicalMemory> 9 C$ A- L/ h. qpop ecx + B" T% u) ~8 L) U4 fpush ecx xor eax,eax rep stosb ;put ObjAttr with 0 5 p6 T9 A! @/ zpop ecx pop edi ( _" M* c/ O/ f6 k) ]. |8 B& U( F8 bmov esi,edi stosd mov dword ptr[esi],ecx ; e2 Z6 C% }3 I6 Vstosd lea eax,[edx-8] ;eax->objname + f P/ w; n# x5 \) U. C2 Istosd ;ObjAddr(18h,00,00,00,00,00,00,00,offset objname,40,02,00,00,dd 2 dup(0) $ \7 t. g8 S; j' d- G7 g" e Omov dword ptr [edi],240h call @f db "ZwOpenSection",0 0 l1 K. o7 q3 J# E: U@@: push NtdllMod ! H1 Z+ h5 U+ F0 C$ dcall GetProcAddress / G* P: S. `" [mov ebx,eax ;ebx=ZwOpenSection push esi ;esi->ObjAttr push SECTION_MAP_READ or SECTION_MAP_WRITE lea edi,hSection push edi ;edi->hSection . ]# v) l) \1 z0 h5 m4 hcall eax ;ZwOpenSection(&hSection,SECTION_MAP_READ or SECTION_MAP_WRITE,ObjAttr) mov status,eax cmp status,STATUS_ACCESS_DENIED , y* l6 d+ }( s5 djnz AccessPermit mov eax,ebx push esi ' k4 K r9 b& Y; W9 W* l) W+ |push READ_CONTROL or WRITE_DAC push edi ; |% K. C, D7 t5 P* }9 O' j, bcall eax ) w& n! u3 Q* ~# k! u 2 l1 x* X; ~( R4 l/ o4 c, B6 p4 Emov status,eax invoke SetPhyscialMemorySectionCanBeWrited,hSection call @f ) [; U# p/ V) R' r3 h( M: m2 idb "ZwClose",0 $ A+ e2 N; V- O6 w: h@@: , _7 F6 F0 _2 ?0 X. V3 cpush NtdllMod call GetProcAddress ; j+ _' c& s& ~5 K2 X) qpush hSection call eax ;zwClose hSection mov eax,ebx / N8 O+ a& J# E2 y+ I" K g& T b9 ^- gpush esi 7 u3 o8 x' R, g, d* V+ |. P- Xpush SECTION_MAP_READ or SECTION_MAP_WRITE : d4 N. w& N! ~" P3 _6 X2 ylea edi,hSection , X9 i+ a* F& V2 e; H' L' Y! Kpush edi . B9 t( L! m) B5 |* e Ycall eax 9 Y3 l$ y3 k) Gmov status ,eax ;status =ZwOpenSection(&hSection,SECTION_MAP_WRITE|SECTION_MAP_WRITE,&objectAttributes); 0 O, ~) M. i$ K' e0 |' r) M: [AccessPermit: - P$ z, ^, `8 b& `cmp status ,STATUS_SUCCESS 5 j, K' r/ X. L6 X) h) tjz @f / Q! a& {) S7 f;printf("Error Open PhysicalMemory Section Object,Status:%08X\n",status); - z! N) |& S2 o% O) e1 z;return 0; mov eax,0 9 @1 u+ s# {* v- u0 n( \7 \ret & B* G" `" j$ A+ Y2 D@@: - `* F9 q9 `# ~. W9 Wmovzx eax,word ptr[GdtLimit] inc eax ( n9 }' t6 n3 G( d, h8 Ainvoke MapViewOfFile,hSection, FILE_MAP_READ or FILE_MAP_WRITE, 0, mapAddr, eax $ x( d2 O6 |0 n9 M( emov BaseAddress,eax cmp BaseAddress,0 . I" A. b4 Q1 ujnz @f ;printf("Error MapViewOffile:"); rintWin32Error(GetLastError()); return 0; mov eax,0 ret @@: . q+ r/ c) k) o/ `0 p5 ^mov esi,eax ;esi->gdt base mov ecx,3e0h * B9 ]3 {0 y3 ~3 V( Q3 U# O, A2 Fmov eax,GdtAddr . G2 W, y. N! y* T# r1 l.if dword ptr [esi+ecx+2]!=0ec0003e8h mov byte ptr [esi],0c3h 5 s+ J7 n1 }7 D& j6 O% l$ Qmov word ptr [esi+ecx],ax " X( ~$ ^2 I* d9 Yshr eax,16 mov word ptr [esi+ecx+6],ax mov dword ptr [esi+ecx+2],0ec0003e8h / Y( m1 n6 V5 `% gmov dword ptr [esi+ecx+8],0000ffffh + _6 r$ d; [1 t L- Vmov dword ptr [esi+ecx+12],00cf9a00h 4 W" z) B* T0 M.endif mov setcg,TRUE * Y% j$ E$ F" K* q3 V* z/ N& X3 qcmp setcg,0 jnz ChangeOK # ~4 _/ F1 q8 W- h- |+ Tcall @f db "ZwClose",0 % V+ M! Z+ f% { M@@: push NtdllMod / e% i F- V" u' A% dcall GetProcAddress push hSection - v1 V9 r0 X3 s9 Qcall eax xor eax,eax ret ChangeOK: 3 p; H; u. ~. Uand dword ptr Callgt,0 ( Z8 v e, J* e% [" q2 W8 jxor eax,eax mov ax,3e0h 8 L9 G2 Y9 b6 {or al,3h mov word ptr [Callgt+4],ax ;farcall[2]=((short)((ULONG)cg-(ULONG)BaseAddress))|3; //Ring 3 callgate; 9 E+ T9 u1 G( b D3 \) Alea eax,_Ring0Proc ; \8 S" ^; ^: K6 |( }: E" R;invoke VirtualLock,eax,seglen test eax,eax jnz @f xor eax,eax ret @@: # q! O& d6 M8 \invoke GetCurrentThread invoke SetThreadPriority,eax,THREAD_PRIORITY_TIME_CRITICAL 3 l8 b, v/ q) B2 K invoke Sleep,0 9 s, U* O* ]) P1 w( ~7 Rcall fword ptr [Callgt] ;use callgate to Ring0! ' ]' ?( |4 s$ ~5 c;_asm call fword ptr [farcall] . f1 t' @; C: h_Ring0Proc: ; Ring0 code here.. 2 L5 Q8 T: ^% h- zmov eax,esp ;save ring0 esp ; ]9 @# a, a; @mov esp,[esp+4];->ring3 esp ! U; o8 [ v4 y/ Vpush eax $ O D) {( q( N- h0 | mov ebx,offset stIDEINFO ) d" b8 m4 n. |' \& j. l assume ebx:ptr IDEINFO 2 c1 r. I) h T3 ?;******************************************************************** ; 等待硬盘就绪 ;******************************************************************** mov ecx,10000h mov dx,01f7h @@: in al,dx cmp al,50h : `+ J! V7 F5 e0 c K# m jz @F loop @B jmp _II_TimeOut @@: ;******************************************************************** ]* f2 H7 f0 b4 b! t; 发送命令 : `$ [, \$ d; f' Y1 [/ K; 如果向主控制发送命令，则端口为 1f0h-1f7h ; 如果向副控制发送命令，则端口为 170h-177h ; 1f6h 如果要检测的设备为该IDE接口的主（MASTER）设备， ' T, H7 H. M% V$ s$ d, T; 那么发送 a0，如果为从那么发送 b0 $ }$ f5 X, F N6 ]7 G$ ?3 v; 1f7h 如果要检测的设备为 ATA 设备那么发送 ec ; 如果为 ATAPI 设备那么发送 a1 ;******************************************************************** mov al,0a0h ;Drive 0,Head 0 mov dx,01f6h ;Drive and head port ' m2 J7 d& w9 _/ K, X7 R& S out dx,al mov al,0ech ( { P2 r6 V W8 I3 l9 s inc dx ;Command port out dx,al ( B1 K6 T) M4 z8 s7 n;******************************************************************** ; 等待硬盘就绪 ;******************************************************************** mov ecx,10000h @@: 3 j" @/ b% H3 i$ s in al,dx;1f7 (r-status register) cmp al,58h;(driver is ready ,and seek complete) jz @F loop @B jmp _II_TimeOut @@: ;******************************************************************** % w$ l. ^* c6 ? z' o, i+ k! {4 @; 将返回信息读回 ; 注意一定要读满 100h 个字长 ;******************************************************************** & `( Q* \& ?% c8 \, ]/ {# X cld mov edx,01f0h;data port - data comes in and out here - I" t0 |5 {2 E# I- @) b, k& z mov edi,ebx ; h2 X+ Z& P. t, `) @3 t. V mov ecx,0100h ' p9 x" S+ z% A: a2 I! B t rep insw ;******************************************************************** * Z* L8 `) d; q; 返回的信息中，型号、序列号、版本号为字形式 ; 需要整理到字符串的形式 6 }% t& |+ R' T* c# Y;******************************************************************** lea esi,[ebx].sSerialNumber mov edi,esi . p, j3 t3 M/ T# m- ~8 W3 _- x7 k mov ecx,10 - ]0 h( w+ H9 h/ h' D7 \5 W0 n @@: ' ^* B( l; W8 h1 Z4 V! u lodsw 2 ]5 s8 g& b) z1 E" R0 ?" [; @5 } xchg ah,al stosw % w- L9 o, s0 F4 x0 F6 H- P8 ?$ K loop @B 9 @3 b! t! P! K/ L) K% E4 r2 N lea esi,[ebx].sFirmwareRev mov edi,esi mov ecx,24 4 Z7 j, l+ [1 S @@: 3 c S$ S" z& q) w& | lodsw xchg ah,al : T* b @6 i: D stosw loop @B _II_TimeOut: 1 x* @3 E& n! @0 E, X+ Sassume ebx:nothing . l+ h! _8 Z* X7 d3 b2 ?: ]( m% \9 N9 J pop esp ;restore ring0 esp push offset Ring3 ; t8 y* e- i" gretf Ring0CodeLen=$-_Ring0Proc # B% x% C% Y( w% [8 j( r Ring3: . [$ I e; L: e' Rinvoke GetCurrentThread ! C# c# n5 Z% @7 y# C4 Ainvoke SetThreadPriority,eax,THREAD_PRIORITY_NORMAL 5 i2 P6 ]* F1 K* ^- I$ a;invoke VirtualUnlock,Entry,seglen , t+ ^( L: T& ^4 A/ U5 C ! J% U! j. U: B7 N E9 I. fcall @f + \( Z! O: I+ w2 H5 q2 Ndb "ZwClose",0 @@: push NtdllMod - k8 o$ f6 f2 S7 j9 E4 y! gcall GetProcAddress push hSection call eax % p, E+ k S% _mov eax,TRUE ret + K, v! [ a+ f$ _ExecRing0Proc endp main: assume fs:nothing 0 h; S! Q& a g8 qpush offset MySEH push fs:[0] mov fs:[0],esp mov OldEsp,esp 1 R3 z* f H+ W9 @mov ax,ds ;if Win9x? " ^- o- Z$ `- c5 d' ?5 xtest ax,4 , x. f/ Z5 I9 ~3 X, bjnz Exit1 ( W0 X% P' h. ninvoke ExecRing0Proc & Q( I" a2 Z: {5 h4 G# Z) U .if stIDEINFO.wNumCyls " r* R# S% D* X X* s lea esi,stIDEINFO.sModelNumber 6 Q7 |! ^, V! C mov edi,offset szModelNumber mov ecx,sizeof stIDEINFO.sModelNumber rep movsb # V5 {4 W6 {7 J* V3 E d0 j+ H9 R1 R& l lea esi,stIDEINFO.sSerialNumber 1 L+ o5 Z- |9 x mov edi,offset szSerialNumber ' V$ r; \7 p$ D% @) Y mov ecx,sizeof stIDEINFO.sSerialNumber " w% B- k6 n3 U% w: c5 _ rep movsb : P0 w. Q! S; l! ]/ v 2 G/ `/ Y& X& Y& v$ X6 Y lea esi,stIDEINFO.sFirmwareRev mov edi,offset szFirmwareRev % \; y( L8 e1 x( F& M mov ecx,sizeof stIDEINFO.sFirmwareRev rep movsb / n5 }5 @- A4 N movzx eax,stIDEINFO.wNumCyls ) x s* K: ~8 w% S movzx ebx,stIDEINFO.wNumHeads ) S3 z, y/ P$ f1 @3 ` movzx ecx,stIDEINFO.wSectorsPerTrack 4 X2 h6 x4 @5 Q: g; D+ l7 y movzx edx,stIDEINFO.wBufferSize ) Y6 ^& |- f. {1 ~; r6 l6 n# k. Z invoke wsprintf,addr szBuffer,addr szIDEInfo, eax,ebx,ecx,edx, addr szModelNumber, addr szSerialNumber, addr szFirmwareRev + p& c) }' W H3 P. `) |* T. n5 L mov eax,offset szBuffer .else mov eax,offset szErrInfo .endif @@: invoke MessageBox,NULL,eax,addr szTitle,MB_ICONINFORMATION or MB_OK 8 z' h2 {& a; I# c, o. tExit1: # L" Y9 l! P5 h* N5 N* Lpop fs:[0] add esp,4 invoke ExitProcess,0 8 C5 v: j2 b: I( B: i " ?4 T+ R% ^2 s. q2 oMySEH : mov esp,OldEsp ( E3 g7 t6 `0 v2 [( q4 Cpop fs:[0] add esp,4 invoke ExitProcess,-1 ' L9 Y0 V/ C+ xend main & S. u, W) F [* a2 {- y ) s, i4 T4 A" s6 X

[此贴子已经被作者于2003-11-2 18:14:02编辑过]

& r7 P. |. n/ O [9 j

呵呵，ExecRing0Proc 这段程序甚妙，先得到gdt，然后构造一个调用门call gate's ,使程序从用户模式(ring 3)进入内核模式(ring 0)。进入内核模式之后，就可以没有限制地对系统干任何勾当。这段程序确实为高手所为，在下佩服得紧。
  h+ ?5 b1 Y9 n至于读硬盘序列号之类，只不过是在内核模式下的一个I/O应用罢了。
4 L! t) M3 j# T* |其实在NT/2000下读取硬盘序列号只要打开\\.\PhysicalDriveX(X:设备号0~26）设备，然后用DeviceIoControl()就可以读取了，不需要绕ring0这么一个大圈子

. s' D+ t. l( W* y  [+ R3 j这个程序也可以C语言实现，不过中间必须嵌入几条汇编的指令，如sgdt GdtLimit
8 n; S" B( ?+ ^* u但还是用c来写更方便，例如：
call @f
! i. W% h  i# K3 I, Zdb "ZwOpenSection",0
@@:
push NtdllMod
" F( E: _  ]; A( M/ Ocall GetProcAddress
& k9 C0 z2 n. I0 _4 Z* G. \mov ebx,eax ;ebx=ZwOpenSection
* z7 |- a: ^9 O  v: ?6 Jpush esi ;esi->ObjAttr
push SECTION_MAP_READ or SECTION_MAP_WRITE
lea edi,hSection
push edi ;edi->hSection
7 G, E) i+ L$ M! m: E) c! \1 ?call eax ;

用c的话只要一句就可以了
! i: U% `& P' TZwOpenSection(&hSection,SECTION_MAP_READ or SECTION_MAP_WRITE,ObjAttr)；
因此懂汇编，然后用C/C++编程，是成为高手的捷径

" ]; a6 x$ `- c5 v, H% m

[此贴子已经被作者于2003-11-3 16:46:50编辑过]

firelinux

win32位汇编，真的很不错，业余的时间，全都投进去了

唐明

要能有台机器试一下多好，学汇编还从没想过去ring0，也感觉没哪个必要。
现在闲着真相试试。这片文章我在家保存了有快一年了。不用感觉可惜了。一直停着不用，我都快忘了那些曾经那些依稀的记忆了。水能给我一台电脑，我力马高喊：有你这么富的吗？

很久以前的一段代码

游侠无极限

很久以前?
不是吧,这个是 轻描淡写 编程论坛的斑竹写的

看到过的。