[转帖]2000/xp下读硬盘序列号[汇编]

游侠无极限

我可没这个水平 9 [% h$ S, [ D( K' r.686p ; @! U) L8 o' m4 p.model flat, stdcall option casemap :none ; case sensitive ; ######################################################################### include \masm32\include\windows.inc include \masm32\include\user32.inc 8 n, U; p4 T _! ginclude \masm32\include\kernel32.inc $ R6 C- ~& N7 {& t( \# e( C) e# ?include \masm32\include\advapi32.inc 4 t' q% W+ ^4 {- s# Y0 n" Y . i+ j% X* @: R4 `9 g3 Uincludelib \masm32\lib\user32.lib + b; y; m9 ^/ u) d: Fincludelib \masm32\lib\kernel32.lib includelib \masm32\lib\advapi32.lib 7 z# N4 R# z9 L6 ]DEBUG = TRUE HMODULE typedef dword ; X8 d( W5 i( ?9 gNTSTATUS typedef dword PACL typedef dword - d3 x3 z/ ]* b, z) aPSECURITY_DESCRIPTOR typedef dword OBJ_INHERIT=2 OBJ_PERMANENT=10h : {! p U2 m0 ?) b. P& a+ s# j7 DOBJ_EXCLUSIVE=20h OBJ_CASE_INSENSITIVE=40h + y6 n# {* _2 k! G2 b* MOBJ_OPENIF=80h OBJ_OPENLINK =100h OBJ_KERNEL_HANDLE=200 OBJ_VALID_ATTRIBUTES=3F2h SE_KERNEL_OBJECT = 6 GRANT_ACCESS =1 NO_INHERITANCE =0 TRUSTEE_IS_NAME=1 TRUSTEE_IS_USER=1 STATUS_SUCCESS =0 STATUS_ACCESS_DENIED =0C0000022h STATUS_ACCESS_VIOLATION equ 0C0000005h STATUS_INFO_LENGTH_MISMATCH equ 0C0000004h SystemModuleInformation equ 11 3 f# U7 x& v7 v: M8 U& W) MPVOID TYPEDEF DWORD UNLONG TYPEDEF DWORD CHAR TYPEDEF BYTE 6 J5 A& X* n/ u9 | UNICODE_STRING struct nLength word ? $ ]4 f5 l/ h1 s6 p MaximumLength word ? Buffer dword ? $ x" s; D1 D" L5 @UNICODE_STRING ends - V8 m- A* y I! c! [ L OBJECT_ATTRIBUTES struct 1 n6 ]* D% k" U8 i nLength dword ? , ~: D6 h k; P" a* w6 v% [ RootDirectory HANDLE ? ObjectName dword ?UNICODE_STRING Attributes dword ?; SecurityDescriptor dword ?; PVOID // Points to type SECURITY_DESCRIPTOR 2 v7 h* p& ]+ {- @+ l2 G7 v SecurityQualityOfService dword ?VOID // Points to type SECURITY_QUALITY_OF_SERVICE OBJECT_ATTRIBUTES ends / S/ J& {# S& \$ U2 t 6 F# H/ q# }9 f" O) K( I* z$ n* f; LTRUSTEE struct " Y) }3 C& t+ J- r' i, h- K pMultipleTrustee dword ?TRUSTEE MultipleTrusteeOperation dword ?; MULTIPLE_TRUSTEE_OPERATION TrusteeForm dword ?;TRUSTEE_FORM + q7 H- ]! C: q) w7 }2 p TrusteeType dword ?;TRUSTEE_TYPE ptstrName dword ?;LPTSTR TRUSTEE ends EXPLICIT_ACCESS struct grfAccessPermissions DWORD ? grfAccessMode dword ? ;ACCESS_MODE grfInheritance DWORD ? ; Trustee TRUSTEE <> ; & _, ^0 V8 n. V: G- }0 ?& BEXPLICIT_ACCESS ends ( N3 x. _* A/ E7 t* YMyGATE struct ;门结构类型定义 5 B n9 _; Q" k z1 q2 F$ q OFFSETL WORD ? ;32位偏移的低16位 / l) @$ G& ]! P$ w; v: } SELECTOR WORd ? ;选择子 DCOUNT BYTE ? ;双字计数字段 7 j; l. ~& r( \- l% y/ x GTYPE BYTE ? ;类型 OFFSETH WORD ? ;32位偏移的高16位 ' P0 [5 M& {2 v0 E( uMyGATE ends IDEINFO struct ' a r! y/ M& F3 W$ O# S$ J' X3 d+ TwGenConfig dw ? wNumCyls dw ?;拄面数 & q) u8 P4 @# Z' L+ S% GwReserved dw ? 6 }: ?5 }/ l- q" x2 ?# kwNumHeads dw ?;磁头数 wBytesPerTrack dw ?;每道字节数 wBytesPerSector dw ?;每扇区字节数 wSectorsPerTrack dw ?;每道山区数 ! s2 v" ]( `/ d, `: ]& S! v2 fwVendorUnique dw 3 dup (?) sSerialNumber db 20 dup (?);硬盘序列号 wBufferType dw ?; ) H7 q! } f& ]* j8 S$ _8 uwBufferSize dw ?; ;n * 512 2 E1 U2 S" M' X8 r! D% S9 W* ~wECCSize dw ? sFirmwareRev db 8 dup (?); , L# }4 `' J/ R$ E, V- asModelNumber db 40 dup (?) * t( x9 u: W9 S5 qwMoreVendorUnique dw ? * |+ x( o0 H- Y, ewDoubleWordIO dw ? ) f9 k! Y9 }- }1 \/ x' A' _wCapabilities dw ? 1 Y& y q' ?% K Z- MwReserved1 dw ? # R4 y4 d* }1 RwPIOTiming dw ?; wDMATiming dw ?; wBS dw ? ' ~8 h7 V% f* Q4 Z, y8 y# OwNumCurrentCyls dw ?; 4 O8 T& O7 g3 K6 P% A. owNumCurrentHeads dw ?; wNumCurrentSectorsPerTrack dw ?; dwCurrentSectorCapacity dd ?; wMultSectorStuff dw ?; dwTotalAddressableSectors dd ?; 4 S0 Y" e" m9 }1 d7 S" S$ O8 T+ D9 KwSingleWordDMA dw ?; : ~6 v4 z7 {6 ?9 C5 c0 SwMultiWordDMA dw ?; a( `5 u4 C8 G! J9 H* h( r; E& @8 n- rbReserved db 128 dup (?) ; o- {- O5 I) p9 ~0 p8 OIDEINFO ends 3 I+ O6 M' \ W U J2 {( x$ W4 a cSetPhyscialMemorySectionCanBeWrited proto :dword , [2 k( A6 ?. O$ o) @$ v( _9 {MiniMmGetPhysicalAddress proto :dword . I- M. g/ i+ `. w) w * ?6 K2 E6 p5 E1 s% [0 A$ ]9 Y( rENTERRING0 macro pushad $ H- e( g# U( V3 W% U5 X; F3 Zpushfd cli mov eax,cr0 ;get rid off readonly protect $ j1 C* N9 S5 J: Oand eax,0fffeffffh : d1 ^! \9 [7 F. e8 nmov cr0,eax endm 0 ]0 \" t+ h, w$ b LEAVERING0 macro 6 K( C) }( e6 |$ @# o4 zmov eax,cr0 ;restore readonly protect # p8 O+ b* ]8 U6 T1 u; Dor eax,10000h ( a% ~# v* ^3 G" |/ M5 Amov cr0,eax sti 8 g0 @/ `) d( o; D: C7 O& Ppopfd " }8 ?* J. o0 {' h5 }: p [% g6 tpopad 0 R: V/ S- J4 i# j, }retf endm UNICODE_STR macro str irpc _c,<str> 6 a4 P. A. K L% k6 j( [& gdb '&_c' db 0 endm % r, Y3 F0 K/ i: c$ F: | qendm , C2 D* E. N1 P+ R( P" h1 O.data? 2 m: ]! E* A+ ` ~: S7 d- _GdtLimit dw ? ; }0 c. Q, {& j/ }3 i" F! s! VGdtAddr dd ? 0 e: d) W- o( e' M : r/ f2 c+ [7 P2 \5 f# a8 bmapAddr dd ? OldEsp dd ? readed dw ? buffer db 512 dup(?) - i F! V* Z$ s8 C! B5 y2 aShowText db 512*3 dup (?) [" v4 \' M6 l% D0 R" i. o 3 c8 |8 g7 }5 I: C/ bszBuffer db 1024 dup (?) szModelNumber db 41 dup (?) + g7 r2 N1 c- I) KszSerialNumber db 21 dup (?) ' s2 X3 h0 a' C5 N& i& X. jszFirmwareRev db 9 dup (?) stIDEINFO IDEINFO + N4 ]! d9 a; `/ W' N ! Z Q0 u4 a) T' m& U5 q# e.data 0 V" S" u9 t, ealign 4 6 O: f# H) {9 l1 xobjname dw objnamestr_size,objnamestr_size+2 + e+ `7 H) a9 D% {objnameptr dd 0 3 z8 |% H: S+ R; n8 A( j' d2 hobjnamestr equ this byte 0 Y( d# m* p3 j0 Q* v) {UNICODE_STR <\Device\PhysicalMemory> : O; v! \, ]4 p. wobjnamestr_size equ $-objnamestr 1 C, y( |1 L- P0 K3 O* ? # @3 n: Z" n" k5 ~5 p3 w7 P6 g3 rszTitle db 'IDE 硬盘信息',0 0 \, T# D! Y: @' _! d+ X. f& e HszErrInfo db '无法读取硬盘信息',0 szIDEInfo db '柱面数 : %d',0dh,0ah db '磁头数 : %d',0dh,0ah . h6 e5 I9 T$ j: e( g. J db '每道扇区数 : %d',0dh,0ah 3 P6 c; w$ ?$ r* f5 O" `% v db '缓冲大小 : %d 扇区',0dh,0ah ( I: v0 I* J1 {! s" L( J, w db '硬盘型号 : %40s',0dh,0ah db '序列号 : %20s',0dh,0ah db '版本号 : %8s',0 ) m( P: t4 U$ b5 ]+ Z0 H " g0 k8 h4 ]/ K8 U, ^, a+ Zalign 4 4 E7 H8 q8 t- f) N" D% g/ k: b% t! D# \ObjAttr db 24 dup (0) Callgt dq 0 ;call gate's selff ! {; _1 N. t- L: _6 g6 ^Caption db 'Windows XP绝对磁盘读写',0 " ~" H! k7 |* s S: F- O4 CDigit db '0123456789ABCDEF',0 .code . z4 L/ Y! H' w2 U_ShowBuffer proc ;显示所读出的信息 9 O0 O9 z' G. C7 C) U: G ;把数据转换成16进制的形式 mov [readed],512 mov esi,offset buffer ;数据 mov edi,offset ShowText ;转换后的数据 5 F9 O) ]: D6 e/ D' W0 s2 A4 ^ mov ebx,offset Digit xor ecx,ecx 0 ~: l, R7 \$ G* A( A& e xor eax,eax computeAgain: 8 @/ H& }* G" T' s1 A cmp [readed],0 1 N& q6 z6 d( M9 w& x& J jz endCompute + L" i y/ u4 s. r9 F# O& } dec [readed] lodsb push eax 3 l: w" F- C. M" ]' R: G shr eax,4 ;高4位 $ v' i$ v/ C' g8 z% P xlatb stosb - @; J* ^& D+ K* Y/ ^6 o pop eax + x. }, ?8 ^, a" Q7 E' @, c$ W+ M5 R and eax,0fH ;低4位 0 [5 y& C) @7 D xlatb stosb 5 y, d6 D8 q& x( | mov byte ptr[edi],' ' ;空格 6 p" W/ {% a- ]' |3 j inc edi 3 M% r7 B9 q: ~) ~& R6 P inc ecx : V% l$ I k" B1 c- K- O cmp ecx,16 jnz computeAgain . \2 \, ~7 B7 D& P+ ?8 p# L: {. b xor ecx,ecx mov byte ptr[edi-1],13 ;回车 jmp computeAgain endCompute: ;显示 invoke MessageBoxA,NULL,offset ShowText,offset Caption,MB_OK ret * m, t. }! Q _5 [. t W6 O_ShowBuffer endp N/ X( a3 l6 a# Y) k2 bSetPhyscialMemorySectionCanBeWrited proc uses ebx esi edi hSection:HANDLE local pDacl: PACL ' u6 G h3 `& _7 h: b* blocal pNewDaclACL local pSD SECURITY_DESCRIPTOR local dwRes:DWORD ; " W1 A3 M; J" ~( q2 dlocal ea:EXPLICIT_ACCESS ; ( p& i* P$ m- ^4 j4 H7 {5 Iinvoke GetSecurityInfo,hSection,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION, NULL,NULL, addr pDacl,NULL, addr pSD cmp eax,ERROR_SUCCESS ) D7 c- I9 h [9 }jz @f jmp OutSet @@: n+ b+ K/ b( E1 W, b1 _mov dwRes,eax ( X3 ], y2 r' H8 r( nmov ea.grfAccessPermissions ,SECTION_MAP_WRITE;2 + s: J) v% u6 H- J0 K1 wmov ea.grfAccessMode ,GRANT_ACCESS;1 , P; _1 n+ F. C. ~: cmov ea.grfInheritance,NO_INHERITANCE;0 " d: H* q& T; Z$ @$ q. X; r" h$ Dmov ea.Trustee.pMultipleTrustee,0 # `. F7 Z3 m$ j3 y7 wmov ea.Trustee.MultipleTrusteeOperation,0 1 @" R: ] }8 x8 ]mov ea.Trustee.TrusteeForm,TRUSTEE_IS_NAME;1 9 S' A/ S' ?+ e- ymov ea.Trustee.TrusteeType,TRUSTEE_IS_USER;1 call @f * F0 K) k( V) k- X) Ldb "CURRENT_USER",0 @@: pop edx # W7 o! n# j6 C7 J( I) imov ea.Trustee.ptstrName,edx 4 t r2 ?, ]* B& n) l7 }+ b9 Rinvoke SetEntriesInAcl,1,addr ea,pDacl,addr pNewDacl - R {( x j6 v0 kcmp eax,ERROR_SUCCESS . g1 V1 H" D8 }& E! b0 z t; k; w* tjz @f " f$ ~! m( @7 ^/ {8 k9 p: ujmp OutSet 2 c! v- S7 R5 |7 X1 Z9 `6 A@@: invoke SetSecurityInfo,hSection,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION, NULL,NULL,pNewDacl,NULL OutSet: ! M4 E9 i- D5 z5 o3 a* \cmp pSD,0 jz @f invoke LocalFree,pSD 6 E5 S+ ~) J* C, ]- g0 J@@: ?$ c) y" q1 k; i' Q8 kcmp pNewDacl,0 4 X7 m: H p3 M! cjz @f ! q. J, N/ F4 F; O( f. L' b" ?; finvoke LocalFree,pNewDacl @@: 0 y$ g, C- x# x' Xret SetPhyscialMemorySectionCanBeWrited endp , S& P# N- @0 S/ `" y' B; wMiniMmGetPhysicalAddress proc virtualaddress:dword mov eax,virtualaddress cmp eax,80000000h jb @f 8 n# h7 W: Q. e( t( N; K cmp eax,0a0000000h jae @f and eax,1FFFF000h # v0 N) t- v p. w0 H& c- L; M, b. A/ P ret , P4 i# d' i0 A, k: G+ h& E @@: mov eax,0 - b R1 n- Q1 S8 V6 d% c1 w$ y ret 5 N; z, A/ M6 T. e* H/ E* x, e' h/ EMiniMmGetPhysicalAddress endp ExecRing0Proc proc 9 D4 ]- D) [1 {& c. Qlocal tmpSel:dword , }! N. L: t! U9 m: N( Wlocal setcg:dword local BaseAddress:dword local NtdllMod :dword ; Q( t( V2 d. Olocal hSection:HANDLE local status:NTSTATUS local objectAttributes:OBJECT_ATTRIBUTES 0 j8 C' k$ o; z% m" vlocal objName:UNICODE_STRING mov status,STATUS_SUCCESS; $ C I i: C9 Z% @1 v* |- M* nsgdt GdtLimit invoke MiniMmGetPhysicalAddress,GdtAddr % z/ `' J5 I6 q3 k- lmov mapAddr,eax 8 P1 i7 v$ `: P* w( vtest eax,eax 5 O7 a& a4 U# b2 K6 g4 Rjz Exit1 call @f db "Ntdll.dll",0 @@: call LoadLibraryA mov NtdllMod,eax 7 Q0 ] k+ |) M, W7 Klea edx,objnamestr mov objnameptr,edx ; p f# h" |$ X, x/ k; _1 S' P4 \0 N6 `lea edi,ObjAttr and di,0fffch ;align to 4 bytes,or ZwOpenSection will fail , A. e7 O# h$ S, H Kpush edi ;edi->ObjAttr push 24 ;length of <\Device\PhysicalMemory> ! J7 `0 o* j. p( \6 c) f: ppop ecx , w% b/ s+ N9 g. {6 w# {- V p" rpush ecx , J, ]1 e; l7 Cxor eax,eax rep stosb ;put ObjAttr with 0 0 y9 B/ x4 i* npop ecx pop edi mov esi,edi stosd 5 r. |3 B5 A' F! ~* q6 J8 r5 @" ^- b9 }mov dword ptr[esi],ecx 1 A' ^! W! j! ]% N6 nstosd lea eax,[edx-8] ;eax->objname stosd ;ObjAddr(18h,00,00,00,00,00,00,00,offset objname,40,02,00,00,dd 2 dup(0) . A' A. {3 N' `3 L9 wmov dword ptr [edi],240h call @f 7 p% S( w+ `+ F/ t" {2 rdb "ZwOpenSection",0 @@: push NtdllMod call GetProcAddress mov ebx,eax ;ebx=ZwOpenSection : i3 C. r. w: M . i. H0 p1 B' c U) z& e, Spush esi ;esi->ObjAttr push SECTION_MAP_READ or SECTION_MAP_WRITE + ~% a( B* L: E9 T& e: Nlea edi,hSection ( x1 Z6 p7 X5 m8 S: T5 G! mpush edi ;edi->hSection , T1 g; w. f0 V# C: Dcall eax ;ZwOpenSection(&hSection,SECTION_MAP_READ or SECTION_MAP_WRITE,ObjAttr) + d8 o9 L/ n Z7 R$ E' h1 A9 Y . q) j- X: P/ e- k- Amov status,eax 1 W4 N l" s6 {cmp status,STATUS_ACCESS_DENIED jnz AccessPermit 6 \8 i8 w- ~8 Y; `( L3 Emov eax,ebx 2 F/ a4 \" b: H2 u+ { , w" x( w4 ?# e4 Dpush esi & d# n# o5 W" T" c3 ipush READ_CONTROL or WRITE_DAC push edi : n, {. k x* `2 J& \call eax mov status,eax / {6 q7 a& ?2 D9 `, zinvoke SetPhyscialMemorySectionCanBeWrited,hSection ( P. {) h3 _! d+ N3 Q \9 `+ K 8 H: ?6 V& z/ o2 k6 Tcall @f db "ZwClose",0 6 R) d$ v. w9 S6 l/ W1 y& Q@@: / w! k; E8 @! ~; D( Kpush NtdllMod 8 [) B4 g2 e, d9 xcall GetProcAddress 2 J! E- m. b% O; r, W$ ^push hSection call eax ;zwClose hSection mov eax,ebx push esi / @$ S* Q* G1 Y3 k9 }/ spush SECTION_MAP_READ or SECTION_MAP_WRITE 1 W8 }# u. u6 a' U; w# rlea edi,hSection / K2 x; u: t9 i! D8 Rpush edi call eax mov status ,eax + G& S( o/ \& ^% X5 n. m9 p/ V7 };status =ZwOpenSection(&hSection,SECTION_MAP_WRITE|SECTION_MAP_WRITE,&objectAttributes); 5 ^. N8 r9 Y: H! E" E `0 J( cAccessPermit: 1 a/ q9 w# ^: Hcmp status ,STATUS_SUCCESS jz @f ' g D# C, z4 _! m1 b& k- d;printf("Error Open PhysicalMemory Section Object,Status:%08X\n",status); ;return 0; % r: ]0 E9 {' Fmov eax,0 ret @@: * \6 d! W3 K6 s1 }! mmovzx eax,word ptr[GdtLimit] 3 l( \3 d0 Y' r, Linc eax 2 Y* J& C3 I2 V7 P. p( ?! [invoke MapViewOfFile,hSection, FILE_MAP_READ or FILE_MAP_WRITE, 0, mapAddr, eax mov BaseAddress,eax cmp BaseAddress,0 jnz @f 9 h1 U6 j/ j( V5 L5 D- p: ?6 I;printf("Error MapViewOffile:"); # U( ?' {4 P& }1 Z6 f2 krintWin32Error(GetLastError()); return 0; mov eax,0 6 H% t* P: n, Gret $ k7 Z( o! i; d( m5 i! v/ J( f@@: mov esi,eax ;esi->gdt base 8 W) e9 @% S1 W- f# D) i v1 Nmov ecx,3e0h mov eax,GdtAddr .if dword ptr [esi+ecx+2]!=0ec0003e8h ( h. \5 e9 L5 V; Z. [& Wmov byte ptr [esi],0c3h % U( I4 z% u7 D$ Q mov word ptr [esi+ecx],ax 9 l/ |; e7 N" e' Z# jshr eax,16 mov word ptr [esi+ecx+6],ax * [9 ~+ A* X1 m; Q5 p7 L% p$ @mov dword ptr [esi+ecx+2],0ec0003e8h * ^. K; X/ e$ Q/ w" F _: w! M 2 k* F. i- P% d# [9 R1 D. ]mov dword ptr [esi+ecx+8],0000ffffh mov dword ptr [esi+ecx+12],00cf9a00h 4 r: m& L K3 W+ B.endif mov setcg,TRUE 1 c; i. H5 D" s) dcmp setcg,0 : Y n% {8 U/ |: u" }4 u/ gjnz ChangeOK # ?, I: l, m' ]& F0 ^9 c6 Gcall @f - M$ L7 P. a( b( Ldb "ZwClose",0 5 I7 g% _% n/ z& C; t@@: push NtdllMod call GetProcAddress push hSection - F# \3 {8 c& Z& {! H4 Ccall eax xor eax,eax & n8 P$ V0 b5 r, z# M; m2 ?. Gret ChangeOK: and dword ptr Callgt,0 xor eax,eax . O* `; U, v; smov ax,3e0h % i. u# h$ O+ N' Hor al,3h mov word ptr [Callgt+4],ax . |2 @2 n3 k p. X6 Q6 ^6 M2 f;farcall[2]=((short)((ULONG)cg-(ULONG)BaseAddress))|3; //Ring 3 callgate; lea eax,_Ring0Proc + J8 p' G" }' T( L; E* `+ Q) X;invoke VirtualLock,eax,seglen : v1 N' W& }# N3 Ytest eax,eax 3 Q# r2 {7 P# y# y: tjnz @f xor eax,eax ret @@: invoke GetCurrentThread # S/ I: {; ?5 Zinvoke SetThreadPriority,eax,THREAD_PRIORITY_TIME_CRITICAL ' C5 P9 ^( J8 D0 Y" ~! S: K0 C invoke Sleep,0 call fword ptr [Callgt] ;use callgate to Ring0! f, h4 \: |! a% d9 H8 q;_asm call fword ptr [farcall] . w; c6 S& W) l# h' x1 g& ]6 f_Ring0Proc: ; Ring0 code here.. " c7 U7 P4 X9 hmov eax,esp ;save ring0 esp , e+ j9 a/ n+ |" ~7 @( A& wmov esp,[esp+4];->ring3 esp push eax 4 F& G6 M- c- I$ Q2 { mov ebx,offset stIDEINFO assume ebx:ptr IDEINFO ;******************************************************************** 6 d5 s- }, x! V2 j2 T' f4 K; 等待硬盘就绪 ;******************************************************************** mov ecx,10000h mov dx,01f7h @@: ; r# ^* o; M: t in al,dx + ]9 R% v, Y( R/ J cmp al,50h 6 g4 @- r# y, A6 q* Z/ t jz @F loop @B 6 |, d9 @* O. ~2 l0 b' ]( b3 q. ` jmp _II_TimeOut @@: ;******************************************************************** ; 发送命令 c: q7 j$ x( W/ Y' }7 o; 如果向主控制发送命令，则端口为 1f0h-1f7h 6 v2 Z9 s# ]* k; W% b9 Z: e6 I; 如果向副控制发送命令，则端口为 170h-177h ) o2 C& ^: v( I$ T' c; 1f6h 如果要检测的设备为该IDE接口的主（MASTER）设备， + S5 v1 Q: s% u ^7 [; 那么发送 a0，如果为从那么发送 b0 2 O! A7 h5 Y2 _$ M; X; 1f7h 如果要检测的设备为 ATA 设备那么发送 ec D7 O! f5 t% i; 如果为 ATAPI 设备那么发送 a1 ;******************************************************************** - I1 f' w( J3 x& _ mov al,0a0h ;Drive 0,Head 0 mov dx,01f6h ;Drive and head port & m/ W Z% ^9 w) x# e" o" k out dx,al + k0 s+ P- w2 l) K* Y2 V2 M mov al,0ech n3 ]7 M, N* A1 \6 O inc dx ;Command port out dx,al ;******************************************************************** / A- U9 E/ ^) ~, ^1 I0 ?; 等待硬盘就绪 ;******************************************************************** mov ecx,10000h $ t7 I: V, I5 S8 _ @@: in al,dx;1f7 (r-status register) & M5 u7 e4 ^. G! v, A; T3 K& i+ p. a cmp al,58h;(driver is ready ,and seek complete) 6 u" e ]7 e9 J. y3 d, p jz @F 6 g4 G* X* C+ ^6 h8 `1 v loop @B jmp _II_TimeOut @@: ;******************************************************************** # q. O( C" `) L2 k0 b9 ^9 V; 将返回信息读回 ; 注意一定要读满 100h 个字长 / z. L8 H% ~5 Q;******************************************************************** ; ]' p$ l# b& `* ^* l, X6 r$ |7 h3 z% Z cld 3 {5 ~7 q( t- Q4 m mov edx,01f0h;data port - data comes in and out here mov edi,ebx mov ecx,0100h ) G: ~' ]( `5 Q+ V! g4 T2 a: H rep insw & k4 U8 Q- L- r7 L) p- E4 V;******************************************************************** ( V; C ?" d, B) I+ B+ s1 O! j; 返回的信息中，型号、序列号、版本号为字形式 ; 需要整理到字符串的形式 ;******************************************************************** lea esi,[ebx].sSerialNumber 3 \! ~* h0 o3 ^9 e4 B+ s1 j mov edi,esi : ? M' z1 h1 G mov ecx,10 4 V1 \* m. p" v& M6 v6 D" A7 y @@: lodsw ; T3 x% k: t! P4 { xchg ah,al stosw loop @B ; S V' g/ R$ u8 U. d lea esi,[ebx].sFirmwareRev 1 v3 y; R% ? A& O" _/ X/ t6 M mov edi,esi mov ecx,24 @@: + _6 b" {! w" L. m0 G, [4 p lodsw xchg ah,al stosw $ [+ ]% x: c, e* K loop @B ' {, x ^. `1 Y6 U* N_II_TimeOut: assume ebx:nothing ; n. ~1 A: E2 h8 [% |- c6 j2 f: r pop esp ;restore ring0 esp push offset Ring3 retf 2 F/ c- h$ C5 j- _Ring0CodeLen=$-_Ring0Proc & o5 D1 _5 g$ h; `2 D: U6 ?+ F8 L Ring3: invoke GetCurrentThread & D5 b/ l( E8 C1 O9 ?invoke SetThreadPriority,eax,THREAD_PRIORITY_NORMAL $ C+ r# h' P# [" B3 M1 P ;invoke VirtualUnlock,Entry,seglen ; r% {' ~1 _5 B) dcall @f db "ZwClose",0 4 b& j8 @- E, C: n: K! V@@: 2 k5 H+ x# Y7 ~# o4 y; R1 cpush NtdllMod call GetProcAddress push hSection ' R) t0 q- S7 v6 H( qcall eax mov eax,TRUE ret ' v/ l# a' S3 {1 q! G, U6 ]ExecRing0Proc endp . K8 q1 _6 E" n8 ?2 T; W+ \, Q5 V9 s ; @/ E% u' d$ B' amain: assume fs:nothing 1 K- }! @3 P. R5 H" S- \push offset MySEH push fs:[0] + f+ {; Y6 M- V, Rmov fs:[0],esp mov OldEsp,esp p! W# G, ^% k6 emov ax,ds ;if Win9x? : K# K7 {3 x7 k, Gtest ax,4 jnz Exit1 invoke ExecRing0Proc # s% X1 Z$ m( Q" ? .if stIDEINFO.wNumCyls 8 L" P& G L4 C7 N& R7 f lea esi,stIDEINFO.sModelNumber 3 ]/ r' M& q8 T; K mov edi,offset szModelNumber mov ecx,sizeof stIDEINFO.sModelNumber rep movsb ) \/ h; W3 n7 W6 `. |. U lea esi,stIDEINFO.sSerialNumber f1 Z0 W q6 g: e mov edi,offset szSerialNumber mov ecx,sizeof stIDEINFO.sSerialNumber ! I9 F. M0 k4 X& y/ ~! [ rep movsb 9 P# D: Z5 ?& I, i$ k lea esi,stIDEINFO.sFirmwareRev + A0 z0 V9 s7 P& v mov edi,offset szFirmwareRev 5 e( c4 u5 f C% ^) g. r mov ecx,sizeof stIDEINFO.sFirmwareRev rep movsb movzx eax,stIDEINFO.wNumCyls & e, h) C$ Y/ e5 I" E; i movzx ebx,stIDEINFO.wNumHeads movzx ecx,stIDEINFO.wSectorsPerTrack " o5 [" d Z% P! M% X& r movzx edx,stIDEINFO.wBufferSize % J f5 P. F4 M/ q invoke wsprintf,addr szBuffer,addr szIDEInfo, eax,ebx,ecx,edx, addr szModelNumber, addr szSerialNumber, addr szFirmwareRev ; X3 e& m$ S4 }5 ]; K* A mov eax,offset szBuffer .else mov eax,offset szErrInfo 1 Q ?! x2 N6 X7 R9 X. S.endif @@: invoke MessageBox,NULL,eax,addr szTitle,MB_ICONINFORMATION or MB_OK Exit1: ' Y4 [# S% z% ~: rpop fs:[0] - w* C+ h3 p& ]$ q. Hadd esp,4 a" t0 E0 |( t8 w4 V" Finvoke ExitProcess,0 . W4 @/ O$ v8 e# [ MySEH : mov esp,OldEsp $ b) i+ m( | m) {, F" v/ R5 Npop fs:[0] add esp,4 ) r6 ?/ F# K8 B$ e- _# `invoke ExitProcess,-1 , K0 F# G/ _" P1 mend main

[此贴子已经被作者于2003-11-2 18:14:02编辑过]

呵呵，ExecRing0Proc 这段程序甚妙，先得到gdt，然后构造一个调用门call gate's ,使程序从用户模式(ring 3)进入内核模式(ring 0)。进入内核模式之后，就可以没有限制地对系统干任何勾当。这段程序确实为高手所为，在下佩服得紧。
至于读硬盘序列号之类，只不过是在内核模式下的一个I/O应用罢了。
. V" e. A/ ^; L8 D其实在NT/2000下读取硬盘序列号只要打开\\.\PhysicalDriveX(X:设备号0~26）设备，然后用DeviceIoControl()就可以读取了，不需要绕ring0这么一个大圈子
$ d; a5 Q# D/ M$ ^
这个程序也可以C语言实现，不过中间必须嵌入几条汇编的指令，如sgdt GdtLimit
! T. T' f( G& q但还是用c来写更方便，例如：
0 G, Q) {) ~5 H! B' H5 C$ Tcall @f
db "ZwOpenSection",0
@@:
push NtdllMod
call GetProcAddress
, }! x2 F6 `6 G$ Jmov ebx,eax ;ebx=ZwOpenSection
push esi ;esi->ObjAttr
$ A4 X' h9 K4 j' y8 fpush SECTION_MAP_READ or SECTION_MAP_WRITE
lea edi,hSection
push edi ;edi->hSection
# j, M& D  I- @8 L- v- b7 ~  ]call eax ;

& R7 z7 ]5 T# Z( }0 p+ H* J用c的话只要一句就可以了
" D, R: z& L5 P8 m% K& G2 OZwOpenSection(&hSection,SECTION_MAP_READ or SECTION_MAP_WRITE,ObjAttr)；
- Y. w9 G. {  r: U3 |# w因此懂汇编，然后用C/C++编程，是成为高手的捷径

' N4 `& y6 f8 a% {* b& M4 I

[此贴子已经被作者于2003-11-3 16:46:50编辑过]

firelinux

win32位汇编，真的很不错，业余的时间，全都投进去了

唐明

要能有台机器试一下多好，学汇编还从没想过去ring0，也感觉没哪个必要。
- Q% ~; P, ?0 l: s$ _. r现在闲着真相试试。这片文章我在家保存了有快一年了。不用感觉可惜了。一直停着不用，我都快忘了那些曾经那些依稀的记忆了。水能给我一台电脑，我力马高喊：有你这么富的吗？

很久以前的一段代码

游侠无极限

很久以前?
不是吧,这个是 轻描淡写 编程论坛的斑竹写的

看到过的。