[转帖]2000/xp下读硬盘序列号[汇编]

游侠无极限

我可没这个水平 " |/ D- B: O8 Z.686p .model flat, stdcall option casemap :none ; case sensitive 1 u" n$ s4 d6 O7 j7 E% ] Q; ######################################################################### include \masm32\include\windows.inc ; R. p5 S+ F# a7 }. K0 _- hinclude \masm32\include\user32.inc include \masm32\include\kernel32.inc include \masm32\include\advapi32.inc 3 P. I. r7 k( v' t : j& g" C8 \) Y( {0 iincludelib \masm32\lib\user32.lib : d$ T5 U `- ]5 Lincludelib \masm32\lib\kernel32.lib $ m Y) L N! k8 n$ y% u- t5 jincludelib \masm32\lib\advapi32.lib DEBUG = TRUE 6 D9 p9 I& e4 G* P0 Z% X5 eHMODULE typedef dword NTSTATUS typedef dword PACL typedef dword PSECURITY_DESCRIPTOR typedef dword 0 _- ?2 V3 S! {+ L# zOBJ_INHERIT=2 OBJ_PERMANENT=10h OBJ_EXCLUSIVE=20h OBJ_CASE_INSENSITIVE=40h 0 D9 r* p _' i/ ]0 ^) Y% x- ^OBJ_OPENIF=80h ( b) w6 j+ J& k! y6 o" x, f9 SOBJ_OPENLINK =100h " z7 _5 @' r- W L- j# t. pOBJ_KERNEL_HANDLE=200 OBJ_VALID_ATTRIBUTES=3F2h SE_KERNEL_OBJECT = 6 GRANT_ACCESS =1 5 u2 Q2 A- W# T5 Y) d! b" |NO_INHERITANCE =0 7 M N; _4 T( d& t* F. ~TRUSTEE_IS_NAME=1 3 C: l+ e& ]2 }2 ^% ETRUSTEE_IS_USER=1 STATUS_SUCCESS =0 6 p8 F/ f4 [4 v. O) F: P0 Q5 V7 f; PSTATUS_ACCESS_DENIED =0C0000022h STATUS_ACCESS_VIOLATION equ 0C0000005h + p4 n; D! ~6 I' `; MSTATUS_INFO_LENGTH_MISMATCH equ 0C0000004h 6 d3 z7 W' e+ R: y" @* \9 HSystemModuleInformation equ 11 ' ^: N1 L; g4 Y" g4 ?9 RPVOID TYPEDEF DWORD : k/ z: B3 B3 x' EUNLONG TYPEDEF DWORD " ~" o& |, ~) d3 b, {9 sCHAR TYPEDEF BYTE # _: K( @- \. {* X7 e1 x# r: Z 3 V, ]% B w& c* E/ KUNICODE_STRING struct 6 ?' s- X0 [# ?5 f# M8 h3 L nLength word ? MaximumLength word ? Buffer dword ? UNICODE_STRING ends 1 \) N% u/ p& f' qOBJECT_ATTRIBUTES struct nLength dword ? * _9 w& n9 s8 ~* p- O' q RootDirectory HANDLE ? ObjectName dword ?UNICODE_STRING 4 d9 u. i: r/ v1 S6 B/ F# U Attributes dword ?; SecurityDescriptor dword ?; PVOID // Points to type SECURITY_DESCRIPTOR 7 n$ h" u {# H8 q5 z. \' { SecurityQualityOfService dword ?VOID // Points to type SECURITY_QUALITY_OF_SERVICE OBJECT_ATTRIBUTES ends 8 r/ h5 k' q' L! ]7 CTRUSTEE struct pMultipleTrustee dword ?TRUSTEE MultipleTrusteeOperation dword ?; MULTIPLE_TRUSTEE_OPERATION TrusteeForm dword ?;TRUSTEE_FORM / i8 k3 Q( T, \( G& | TrusteeType dword ?;TRUSTEE_TYPE ptstrName dword ?;LPTSTR TRUSTEE ends EXPLICIT_ACCESS struct 2 p) x4 V9 `1 ?9 b grfAccessPermissions DWORD ? grfAccessMode dword ? ;ACCESS_MODE 6 E5 j" S/ L. d* `+ _1 t( s: u grfInheritance DWORD ? ; $ i) W) N3 F4 }5 c f5 s. Z( G" ^ Trustee TRUSTEE <> ; EXPLICIT_ACCESS ends MyGATE struct ;门结构类型定义 . `/ V$ N: i2 O* ^9 y4 ?, ~0 F6 H OFFSETL WORD ? ;32位偏移的低16位 SELECTOR WORd ? ;选择子 DCOUNT BYTE ? ;双字计数字段 3 r1 N- ^8 `6 v3 \. w1 T GTYPE BYTE ? ;类型 - g( Z/ A5 d5 J3 n( }1 x OFFSETH WORD ? ;32位偏移的高16位 + W9 A9 @# Q! a6 W2 ~' z; WMyGATE ends ' _1 C5 b5 c/ P' ZIDEINFO struct 3 O$ x( R% T( wwGenConfig dw ? . L. q" Q5 o- C8 A- ^/ O1 A! z+ ]wNumCyls dw ?;拄面数 ' [+ j# B* ^9 _. I% ~, }3 AwReserved dw ? ; `( y v$ D+ b. t! `) }! ]wNumHeads dw ?;磁头数 3 u" J& O- q% z) y2 Q rwBytesPerTrack dw ?;每道字节数 wBytesPerSector dw ?;每扇区字节数 wSectorsPerTrack dw ?;每道山区数 6 c5 \8 I* L: Z+ Y- S( r6 l, J3 ewVendorUnique dw 3 dup (?) ; ?2 I- E4 ~8 b6 FsSerialNumber db 20 dup (?);硬盘序列号 ; g. B3 T- E! t+ j, j f4 e+ WwBufferType dw ?; wBufferSize dw ?; ;n * 512 ( d$ |0 ]/ e9 [5 A, ]7 U3 zwECCSize dw ? sFirmwareRev db 8 dup (?); sModelNumber db 40 dup (?) wMoreVendorUnique dw ? " o$ W# h- a9 i+ z: r4 c2 mwDoubleWordIO dw ? ) [5 b- J# }! [4 mwCapabilities dw ? wReserved1 dw ? wPIOTiming dw ?; wDMATiming dw ?; 0 q# j. ~: E7 \, E' R+ d8 EwBS dw ? 0 H! u, ` ^- s1 r' U7 n$ Z/ D) o; LwNumCurrentCyls dw ?; t* E2 K8 Y+ E% h- cwNumCurrentHeads dw ?; 9 h; W" P8 ?+ b; x" UwNumCurrentSectorsPerTrack dw ?; 8 I( D6 C* p( H/ F G1 U' AdwCurrentSectorCapacity dd ?; ; }) U: O* C3 G' s I- y- B7 swMultSectorStuff dw ?; 6 }: g, f7 ^1 A+ OdwTotalAddressableSectors dd ?; * j( Y0 B# y+ {( W! ZwSingleWordDMA dw ?; 9 q" A8 s5 ]& F2 BwMultiWordDMA dw ?; bReserved db 128 dup (?) 5 r# B/ T$ {9 p UIDEINFO ends % m" m' H$ k. j& }, Y- |1 } 4 p1 T5 f" A( \# L* d& e! H1 y: RSetPhyscialMemorySectionCanBeWrited proto :dword MiniMmGetPhysicalAddress proto :dword & r. o8 u% S0 x- X7 _8 iENTERRING0 macro pushad ! b1 E+ X' g+ W2 J" ^* D" K* Zpushfd . q; W3 o1 |1 h/ ?& d3 ]cli : \+ } ^' t6 Amov eax,cr0 ;get rid off readonly protect ! b# ^0 W3 L9 Yand eax,0fffeffffh ' E& F; s' l: G0 m3 J5 Cmov cr0,eax endm 3 l% q: W' q, o1 D H, T ) m) r- C1 y1 E: k. ?3 LLEAVERING0 macro 3 F* t" s6 U4 }. e2 `4 n% amov eax,cr0 ;restore readonly protect or eax,10000h 5 ^1 U0 A3 [ K% V; L/ jmov cr0,eax sti 0 |+ d; ~- x7 V( |3 R) e$ ~" M& Vpopfd popad 6 Z) Y9 Z& M q4 @ ~$ ?$ \3 b) Nretf endm ' X. K% _; V8 L5 [$ B, I4 C4 [UNICODE_STR macro str irpc _c,<str> db '&_c' db 0 endm ) \, O# }* ]4 ?2 C3 I1 `8 uendm $ v4 n9 X5 t+ t2 _: Y1 P. P + v8 f7 V( [/ T.data? * C/ y$ f& R: a C3 zGdtLimit dw ? GdtAddr dd ? 9 t& e% r" i$ ]4 }6 _* o: O. G( h! Y mapAddr dd ? OldEsp dd ? 3 n; ~8 ]6 B, H4 w x9 E3 _ - m: d9 T0 _9 O: O4 Q/ areaded dw ? buffer db 512 dup(?) ShowText db 512*3 dup (?) szBuffer db 1024 dup (?) szModelNumber db 41 dup (?) 8 X6 j+ B4 `7 SszSerialNumber db 21 dup (?) szFirmwareRev db 9 dup (?) $ u: O9 o, k( \4 \5 M8 r3 _2 M5 N stIDEINFO IDEINFO * m. [- _0 c" w" l! ~+ _.data align 4 objname dw objnamestr_size,objnamestr_size+2 $ P! {* b: |! @; w' qobjnameptr dd 0 objnamestr equ this byte UNICODE_STR <\Device\PhysicalMemory> objnamestr_size equ $-objnamestr 3 x0 f& v0 m; `6 o( Y- d0 aszTitle db 'IDE 硬盘信息',0 0 a& k9 z9 m! i; NszErrInfo db '无法读取硬盘信息',0 & w8 Z/ G. @9 ^1 s9 \ KszIDEInfo db '柱面数 : %d',0dh,0ah db '磁头数 : %d',0dh,0ah db '每道扇区数 : %d',0dh,0ah db '缓冲大小 : %d 扇区',0dh,0ah db '硬盘型号 : %40s',0dh,0ah - L/ U* N& a) L& B6 w4 f# z db '序列号 : %20s',0dh,0ah / ] L% ?) f5 B( |, x) P: E, m: v8 k db '版本号 : %8s',0 5 }% B4 ~& E( N; O$ F5 M - p8 H- ?1 @: p. {$ a1 r2 [align 4 + b% x: x) j/ v: s- k/ pObjAttr db 24 dup (0) Callgt dq 0 ;call gate's selff Caption db 'Windows XP绝对磁盘读写',0 Digit db '0123456789ABCDEF',0 .code _ShowBuffer proc ;显示所读出的信息 ;把数据转换成16进制的形式 mov [readed],512 mov esi,offset buffer ;数据 . F, q1 n$ a9 X9 g9 ] mov edi,offset ShowText ;转换后的数据 : R: ]. ?$ Q0 }8 S/ h mov ebx,offset Digit 0 N( X/ W T7 H5 K& Y- T xor ecx,ecx 0 P# r7 ~8 ?" E! ^( J) x xor eax,eax & y1 Y3 ]7 _+ ^% Z' y8 vcomputeAgain: , v. t$ ~; m3 y i cmp [readed],0 jz endCompute dec [readed] ( u" k/ x% s7 H( A. D: S/ B lodsb push eax 3 Z* w9 w+ K0 K& J' C# w. W shr eax,4 ;高4位 . R6 b) G, c( n xlatb " v% b2 y1 R! g stosb 3 h8 m3 T) G& }+ Z- x' b* n pop eax ' J0 f. F9 B* [; S6 H( Z and eax,0fH ;低4位 xlatb 6 ]/ a/ ]7 W' c U& i( @ stosb mov byte ptr[edi],' ' ;空格 inc edi inc ecx cmp ecx,16 jnz computeAgain xor ecx,ecx 6 T) T$ b% s. f2 V. G; K mov byte ptr[edi-1],13 ;回车 ' o3 e0 o# e9 C1 K jmp computeAgain endCompute: / T r$ m* u% ~5 \$ f" ]' B ;显示 invoke MessageBoxA,NULL,offset ShowText,offset Caption,MB_OK ) S! i ^" o# V0 ]; T ret _ShowBuffer endp / J0 f. C; [5 Y [+ w2 q# ~ ! l2 V ?" _2 Z, q0 }+ z! L. iSetPhyscialMemorySectionCanBeWrited proc uses ebx esi edi hSection:HANDLE local pDacl: PACL local pNewDaclACL local pSD SECURITY_DESCRIPTOR local dwRes:DWORD ; local ea:EXPLICIT_ACCESS ; 6 ]' _$ ]& N4 S# B5 Q, [% Binvoke GetSecurityInfo,hSection,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION, NULL,NULL, addr pDacl,NULL, addr pSD 5 a( L3 F/ d: `! fcmp eax,ERROR_SUCCESS jz @f jmp OutSet ! N! v- G, B8 a7 t@@: " Y+ P. U' K. X4 Z( Qmov dwRes,eax mov ea.grfAccessPermissions ,SECTION_MAP_WRITE;2 mov ea.grfAccessMode ,GRANT_ACCESS;1 mov ea.grfInheritance,NO_INHERITANCE;0 mov ea.Trustee.pMultipleTrustee,0 $ h4 p" X: d& ?0 umov ea.Trustee.MultipleTrusteeOperation,0 : a, F' n6 x" s/ q c! Rmov ea.Trustee.TrusteeForm,TRUSTEE_IS_NAME;1 mov ea.Trustee.TrusteeType,TRUSTEE_IS_USER;1 call @f db "CURRENT_USER",0 % f/ Q {2 F/ v: d3 E6 A@@: pop edx mov ea.Trustee.ptstrName,edx invoke SetEntriesInAcl,1,addr ea,pDacl,addr pNewDacl + L& l3 \, W& p0 b4 Z4 ?; ~0 Hcmp eax,ERROR_SUCCESS _: T) z/ p1 T6 D. D& B8 x% yjz @f ( \) `! _- i+ N3 A3 Mjmp OutSet @@: * k5 \1 ~& t; l3 g7 i4 P3 Pinvoke SetSecurityInfo,hSection,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION, NULL,NULL,pNewDacl,NULL OutSet: 3 ]( Z6 \9 n L" x4 V0 Lcmp pSD,0 E; y3 `. o% \) p6 j( M+ n5 {0 sjz @f invoke LocalFree,pSD ! M" Q; l' g( A" F@@: cmp pNewDacl,0 6 E1 V. N/ f; h. l+ X9 K6 ~; A+ _jz @f 0 O/ b! M4 W) f) V4 u9 d, Iinvoke LocalFree,pNewDacl @@: $ Y, M, K$ h$ O) @. t8 Tret SetPhyscialMemorySectionCanBeWrited endp # L; k: k- e- D0 h # C% Z2 S9 m: k6 S$ M _% jMiniMmGetPhysicalAddress proc virtualaddress:dword mov eax,virtualaddress cmp eax,80000000h $ }/ ?; \& u- n, _ jb @f cmp eax,0a0000000h jae @f 5 `1 v: J! w# }5 U h and eax,1FFFF000h ! D+ L J0 t1 ~/ q% A ret $ m3 D; B* w0 G$ I @@: % l$ w6 x9 v, ]" X4 z! r. A mov eax,0 ' F0 z2 }) f) u# d. C& s ret MiniMmGetPhysicalAddress endp ExecRing0Proc proc ; e7 h- C6 v% D M. \local tmpSel:dword " @) t# i6 k. R5 T+ o' Llocal setcg:dword local BaseAddress:dword . ]& ~: K: q' \4 j- u0 o( H' [2 T i! w Llocal NtdllMod :dword 3 k1 `$ M: k/ dlocal hSection:HANDLE - S% a- D t$ j# A7 r+ ~local status:NTSTATUS local objectAttributes:OBJECT_ATTRIBUTES local objName:UNICODE_STRING " U! G- N( o1 m/ _9 dmov status,STATUS_SUCCESS; sgdt GdtLimit + w5 ^1 l5 {0 O& finvoke MiniMmGetPhysicalAddress,GdtAddr mov mapAddr,eax & L( D3 Z C+ o ktest eax,eax jz Exit1 call @f * G, b$ ~6 Y( j, `2 ^, ~9 Gdb "Ntdll.dll",0 @@: call LoadLibraryA mov NtdllMod,eax 4 x% t. C' T J6 o: {lea edx,objnamestr mov objnameptr,edx % a$ M; O" c. Y5 olea edi,ObjAttr # m, ]2 ^# f/ d4 _( {% @5 U) F1 }and di,0fffch ;align to 4 bytes,or ZwOpenSection will fail push edi ;edi->ObjAttr push 24 ;length of <\Device\PhysicalMemory> ) @* c3 m& B; S" Ppop ecx 4 o% n" W: Y) [; G5 Fpush ecx xor eax,eax ) m: {) T1 R- Y5 D$ Irep stosb ;put ObjAttr with 0 0 w/ {3 \& c+ a8 b) Dpop ecx ) i. L" ~; b* b& o" n+ Opop edi mov esi,edi 2 H) t4 p ~+ z' R# {7 a+ o. U& qstosd - A' O( X; s9 S, }8 m* ^7 ~mov dword ptr[esi],ecx * L! L. m8 u: m8 [$ v0 d Istosd 3 q- u8 V1 o; plea eax,[edx-8] ;eax->objname stosd ;ObjAddr(18h,00,00,00,00,00,00,00,offset objname,40,02,00,00,dd 2 dup(0) : X3 I* w; }. _ i" nmov dword ptr [edi],240h 1 b$ _+ |- Q& `0 Rcall @f 9 U0 t0 [/ f w4 Rdb "ZwOpenSection",0 * L. p0 q3 k8 V1 V@@: - S1 Y, e0 _3 o8 Spush NtdllMod call GetProcAddress mov ebx,eax ;ebx=ZwOpenSection push esi ;esi->ObjAttr ' Z5 Y+ X/ V# \" H a' `push SECTION_MAP_READ or SECTION_MAP_WRITE O: ]5 a6 W) ]/ w, z Ulea edi,hSection " d- Z, B; P$ Z! epush edi ;edi->hSection call eax ;ZwOpenSection(&hSection,SECTION_MAP_READ or SECTION_MAP_WRITE,ObjAttr) + T3 P- W5 H* \8 v4 [ + _( p& m8 \. g, ~9 z% t/ kmov status,eax cmp status,STATUS_ACCESS_DENIED / F9 v0 k/ d$ ^jnz AccessPermit mov eax,ebx ) k2 Y6 u% S, y" R" l ( g, y8 D$ H. R8 `6 Tpush esi push READ_CONTROL or WRITE_DAC push edi ; s" u; j& ^7 {call eax 1 `4 d. Y0 Y3 m; ~ / v6 X9 {' U+ A6 C) {( y2 w1 ymov status,eax 6 ?9 v2 {7 v8 `4 A4 k9 d5 s. H( Sinvoke SetPhyscialMemorySectionCanBeWrited,hSection 8 ~, f) V$ i% h. w$ ]) ^6 V3 h call @f : z, `& r. e( B) B# d2 O3 @; y* n2 Rdb "ZwClose",0 @@: push NtdllMod : u; q$ P9 _& e( k x3 h$ D5 }call GetProcAddress . p* k3 M4 {. T; L+ f" C W! @ : G: W3 q4 v2 L& f1 @$ x: Bpush hSection call eax ;zwClose hSection ! p8 U" ?6 y5 a: M' i7 u- p$ ~ / Q( \& n- m/ X2 O" S' K% ~3 N5 y8 Kmov eax,ebx push esi # C; v' ?/ I# |& Apush SECTION_MAP_READ or SECTION_MAP_WRITE lea edi,hSection push edi 1 P. v8 ^& V) }1 ccall eax ! B! I: p' P: n, ~0 R5 d% j) Qmov status ,eax ;status =ZwOpenSection(&hSection,SECTION_MAP_WRITE|SECTION_MAP_WRITE,&objectAttributes); AccessPermit: cmp status ,STATUS_SUCCESS - Z2 S: _( D# z0 ?9 Fjz @f ;printf("Error Open PhysicalMemory Section Object,Status:%08X\n",status); * }8 u1 a! ~! Z9 ~+ j ]! b- F% @$ G;return 0; ' H0 R4 F9 Z4 y& A( N7 [1 amov eax,0 { ~+ i+ w5 X; ?: W' p Dret @@: movzx eax,word ptr[GdtLimit] inc eax % p* I8 d! z6 O/ }) V3 W1 Uinvoke MapViewOfFile,hSection, FILE_MAP_READ or FILE_MAP_WRITE, 0, mapAddr, eax : v& T4 g/ n5 t$ Omov BaseAddress,eax ) R8 e ?9 ^/ }8 s4 m' I0 V$ ~9 pcmp BaseAddress,0 jnz @f ;printf("Error MapViewOffile:"); rintWin32Error(GetLastError()); return 0; mov eax,0 ret 5 \4 J7 `; c# ~( t1 Q0 U$ m+ e- y4 O4 {@@: mov esi,eax ;esi->gdt base - M) G; B, Y, ^8 P+ C! rmov ecx,3e0h ; m- Q3 u- G0 x; X3 X4 Umov eax,GdtAddr .if dword ptr [esi+ecx+2]!=0ec0003e8h mov byte ptr [esi],0c3h ( o2 L, S; _$ ^6 u 6 @5 v. E6 }9 ]mov word ptr [esi+ecx],ax shr eax,16 mov word ptr [esi+ecx+6],ax ! H. _% N1 J; T! \& Cmov dword ptr [esi+ecx+2],0ec0003e8h mov dword ptr [esi+ecx+8],0000ffffh 8 m8 c) Y! ^* e7 @; E- H( ?- |mov dword ptr [esi+ecx+12],00cf9a00h .endif mov setcg,TRUE ' Y9 y$ g9 k6 h# s g4 R5 l2 }cmp setcg,0 8 \9 R+ x. @# p7 f8 gjnz ChangeOK ; g8 o# m" n! A6 M! \call @f db "ZwClose",0 1 F$ x- C( \9 o1 Q@@: * u6 T$ `" l" opush NtdllMod call GetProcAddress push hSection call eax xor eax,eax ret 3 _# i2 x# M, z7 S5 G pChangeOK: and dword ptr Callgt,0 ( L) u+ _' g5 e# o% E* E" Z' f- Yxor eax,eax 7 o: V# R v- s" }mov ax,3e0h 9 O: P; @/ }$ o5 p9 ior al,3h mov word ptr [Callgt+4],ax ;farcall[2]=((short)((ULONG)cg-(ULONG)BaseAddress))|3; //Ring 3 callgate; * Q0 y2 D' C% N# l3 U, }lea eax,_Ring0Proc ;invoke VirtualLock,eax,seglen test eax,eax jnz @f xor eax,eax ret @@: f$ t- u: @4 _1 H7 o0 ^invoke GetCurrentThread ' v1 j8 n; r3 u: k1 `invoke SetThreadPriority,eax,THREAD_PRIORITY_TIME_CRITICAL ; _8 [" w7 ~5 @ Z8 \ ! R' G: p, n! r4 C. B* r9 w C1 ninvoke Sleep,0 0 S+ L$ {. r- W- l4 Hcall fword ptr [Callgt] ;use callgate to Ring0! ;_asm call fword ptr [farcall] , e5 \' t8 |2 S% f8 q$ |/ b" k_Ring0Proc: ; Ring0 code here.. ; m/ l8 w2 ^( c/ Y" }+ \8 Wmov eax,esp ;save ring0 esp mov esp,[esp+4];->ring3 esp push eax mov ebx,offset stIDEINFO assume ebx:ptr IDEINFO ; ]3 j7 f& k8 \! E4 `5 ~" J;******************************************************************** 6 f0 u! V) ~ x4 n; 等待硬盘就绪 & I7 f% p( ]* s7 |2 c9 B;******************************************************************** 4 I0 P7 H0 W* @1 q+ o% {) b mov ecx,10000h mov dx,01f7h @@: 3 F7 t$ Y3 P3 S& c7 V2 X( E- { in al,dx cmp al,50h ; A, Y! p7 n& N+ d jz @F loop @B jmp _II_TimeOut @@: ;******************************************************************** ; 发送命令 ; 如果向主控制发送命令，则端口为 1f0h-1f7h & a+ @- \4 a2 `+ N$ z) ~7 M; 如果向副控制发送命令，则端口为 170h-177h 8 T3 ^& R! F( g& }6 T% {7 D, J; 1f6h 如果要检测的设备为该IDE接口的主（MASTER）设备， # Y3 }! D6 e1 p/ S. z- a; 那么发送 a0，如果为从那么发送 b0 ; 1f7h 如果要检测的设备为 ATA 设备那么发送 ec ; 如果为 ATAPI 设备那么发送 a1 ;******************************************************************** mov al,0a0h ;Drive 0,Head 0 mov dx,01f6h ;Drive and head port / C9 O0 S% f( N6 |% U5 Z# }) N$ H out dx,al ( r v' r- Q5 @% d9 t% ~$ w! |0 v mov al,0ech inc dx ;Command port 4 l/ M0 v* ~; w/ r- { out dx,al ;******************************************************************** & n& f9 i- M, @* O7 x1 f; 等待硬盘就绪 Y! D& X- U/ o0 Q;******************************************************************** mov ecx,10000h 6 g, r _ B% n) [( s/ ~: w @@: 4 M+ n( r4 a. w% w0 _% \ in al,dx;1f7 (r-status register) cmp al,58h;(driver is ready ,and seek complete) jz @F loop @B jmp _II_TimeOut ! d- |9 R2 f$ V: I4 m& L @@: ;******************************************************************** ; 将返回信息读回 ; 注意一定要读满 100h 个字长 ;******************************************************************** cld mov edx,01f0h;data port - data comes in and out here mov edi,ebx mov ecx,0100h R6 I. Z8 ~4 ^2 N4 R+ y' {. T. I rep insw ;******************************************************************** ; 返回的信息中，型号、序列号、版本号为字形式 9 f8 n5 `9 r# K2 \1 B% d; 需要整理到字符串的形式 ;******************************************************************** ' f/ f i0 I# e `3 |: u- W, _ lea esi,[ebx].sSerialNumber - N1 o, e A( e+ J) @+ L4 ~3 G mov edi,esi mov ecx,10 @@: 6 u: M5 r- M. {: @2 L Q lodsw : k3 N( T- ~- o xchg ah,al 1 j. U% y: r! D stosw loop @B & D8 g' `1 R7 l" i2 }0 k lea esi,[ebx].sFirmwareRev mov edi,esi mov ecx,24 + c4 u) O" w. x' Y0 R' s @@: " U- L- y/ Z" a9 v" s" F* ] lodsw xchg ah,al stosw ) l* ?, r) G) Q% ] loop @B _II_TimeOut: assume ebx:nothing - h8 d. Z! S- @- E6 t pop esp ;restore ring0 esp push offset Ring3 # J) R- o" x* q6 zretf Ring0CodeLen=$-_Ring0Proc . S+ K9 P7 K' iRing3: invoke GetCurrentThread invoke SetThreadPriority,eax,THREAD_PRIORITY_NORMAL ' z, l2 v8 X, g7 X, N p- N ' @ \. l5 H; I: ]! h;invoke VirtualUnlock,Entry,seglen call @f ; }$ P( `8 a4 [; f* x; V4 ?: Odb "ZwClose",0 @@: push NtdllMod call GetProcAddress 5 A) P9 O4 c$ I' X+ Epush hSection ' B8 u/ O$ ~$ F3 K# @call eax mov eax,TRUE ret ExecRing0Proc endp ( D9 I% a! @! b2 F' F0 s main: 2 V5 p4 p) d- l$ _) H2 Q5 \assume fs:nothing push offset MySEH - p8 T$ @& k G8 @& {push fs:[0] : R4 O! i2 P2 f6 w+ d0 K) amov fs:[0],esp mov OldEsp,esp mov ax,ds ;if Win9x? ; d t& ^- G" l& W) `# Utest ax,4 ; K7 w* y c/ k5 c3 A' { ejnz Exit1 invoke ExecRing0Proc ' s" C b0 a) ~. I$ V* | ) f* M& n' H2 | x1 \% T.if stIDEINFO.wNumCyls " x3 O* u7 \9 n) D lea esi,stIDEINFO.sModelNumber mov edi,offset szModelNumber mov ecx,sizeof stIDEINFO.sModelNumber rep movsb 0 A x- h$ }5 H* p, `# ` lea esi,stIDEINFO.sSerialNumber mov edi,offset szSerialNumber 1 J$ O# q5 O4 Z mov ecx,sizeof stIDEINFO.sSerialNumber ^6 C, ^' a4 }5 X( R2 `$ Z rep movsb 8 j: P0 x- f. v& y8 t5 J lea esi,stIDEINFO.sFirmwareRev mov edi,offset szFirmwareRev mov ecx,sizeof stIDEINFO.sFirmwareRev ! O _1 L1 v0 E6 U rep movsb movzx eax,stIDEINFO.wNumCyls movzx ebx,stIDEINFO.wNumHeads # W7 R* p: h8 |" @ movzx ecx,stIDEINFO.wSectorsPerTrack ( j8 K" s. n' n3 X! o movzx edx,stIDEINFO.wBufferSize invoke wsprintf,addr szBuffer,addr szIDEInfo, eax,ebx,ecx,edx, addr szModelNumber, addr szSerialNumber, addr szFirmwareRev mov eax,offset szBuffer .else . I% p" B% g' X/ r1 i8 l ~3 s/ p mov eax,offset szErrInfo .endif ( Y7 G5 E6 G1 {2 }" o@@: : L+ ^: F- j7 G' x. W8 _& ~invoke MessageBox,NULL,eax,addr szTitle,MB_ICONINFORMATION or MB_OK Exit1: ( @ i* H/ M! v2 Y Tpop fs:[0] / g' t" |( m: y# ?( j6 Yadd esp,4 invoke ExitProcess,0 4 u- g, x3 u. X/ D/ F- IMySEH : ! v, U) B4 F; q' j8 nmov esp,OldEsp pop fs:[0] ) t8 u7 W: a( y8 D- {add esp,4 / q0 s% F' E4 e9 d2 `, Winvoke ExitProcess,-1 end main 5 ~0 A" Q2 c5 X6 y3 A

[此贴子已经被作者于2003-11-2 18:14:02编辑过]

$ m9 o( c+ h0 ~, ~: x

呵呵，ExecRing0Proc 这段程序甚妙，先得到gdt，然后构造一个调用门call gate's ,使程序从用户模式(ring 3)进入内核模式(ring 0)。进入内核模式之后，就可以没有限制地对系统干任何勾当。这段程序确实为高手所为，在下佩服得紧。
至于读硬盘序列号之类，只不过是在内核模式下的一个I/O应用罢了。
8 L" G4 _' }& B& e. I; O其实在NT/2000下读取硬盘序列号只要打开\\.\PhysicalDriveX(X:设备号0~26）设备，然后用DeviceIoControl()就可以读取了，不需要绕ring0这么一个大圈子

这个程序也可以C语言实现，不过中间必须嵌入几条汇编的指令，如sgdt GdtLimit
但还是用c来写更方便，例如：
call @f
; O4 G9 g- A9 F# W& S( w* Odb "ZwOpenSection",0
@@:
+ }& [# d; a5 d" q, c8 Opush NtdllMod
call GetProcAddress
mov ebx,eax ;ebx=ZwOpenSection
2 }7 ~, a; {) d5 x4 g  lpush esi ;esi->ObjAttr
. _& z$ q9 E3 I4 K( ~3 ?push SECTION_MAP_READ or SECTION_MAP_WRITE
lea edi,hSection
push edi ;edi->hSection
call eax ;
% o$ Y, d) N+ s5 g- @
; E. ]  F1 t; E/ o# M用c的话只要一句就可以了
: R4 K2 O/ y" r' K; v" ~5 NZwOpenSection(&hSection,SECTION_MAP_READ or SECTION_MAP_WRITE,ObjAttr)；
因此懂汇编，然后用C/C++编程，是成为高手的捷径
, E+ r$ {# |  \; D
& t  K6 C; m- d/ I) u7 s2 w8 c

[此贴子已经被作者于2003-11-3 16:46:50编辑过]

firelinux

win32位汇编，真的很不错，业余的时间，全都投进去了

唐明

要能有台机器试一下多好，学汇编还从没想过去ring0，也感觉没哪个必要。
* ~4 L; ?4 W. U! }6 s  ~现在闲着真相试试。这片文章我在家保存了有快一年了。不用感觉可惜了。一直停着不用，我都快忘了那些曾经那些依稀的记忆了。水能给我一台电脑，我力马高喊：有你这么富的吗？

很久以前的一段代码

游侠无极限

很久以前?
& F2 |0 Z7 E: Z) {2 d不是吧,这个是 轻描淡写 编程论坛的斑竹写的

看到过的。