nt!Ke386SetIoAccessMap:
804f8160 8bff mov edi,edi
804f8162 55 push ebp
804f8163 8bec mov ebp,esp
804f8165 57 push edi
804f8166 8b7d08 mov edi,dword ptr [ebp+8] ;MapNumber
804f8169 83ff01 cmp edi,1
804f816c 7759 ja nt!Ke386SetIoAccessMap+0x67 (804f81c7)
804f816e 85ff test edi,edi
804f8170 7455 je nt!Ke386SetIoAccessMap+0x67 (804f81c7)
804f8172 53 push ebx
804f8173 56 push esi
804f8174 ff158c864d80 call dword ptr [nt!_imp__KeRaiseIrqlToSynchLevel (804d868c)]
804f817a 8ad8 mov bl,al
804f817c 3ea120f0dfff mov eax,dword ptr ds:[0FFDFF020h]
804f8182 8bd0 mov edx,eax
804f8184 b800f0dfff mov eax,0FFDFF000h
804f8189 69ff24200000 imul edi,edi,2024h ;sizeof.KiIoAccessMap
804f818f 8b4040 mov eax,dword ptr [eax+40h] ;TSS
804f8192 8b750c mov esi,dword ptr [ebp+0Ch]
804f8195 8dbc0764e0ffff lea edi,[edi+eax-1F9Ch]
804f819c b900080000 mov ecx,800h
804f81a1 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
804f81a3 8b4204 mov eax,dword ptr [edx+4]
804f81a6 8b4844 mov ecx,dword ptr [eax+44h]
804f81a9 b800f0dfff mov eax,0FFDFF000h
804f81ae 668b4930 mov cx,word ptr [ecx+30h]
804f81b2 8b4040 mov eax,dword ptr [eax+40h]
804f81b5 66894866 mov word ptr [eax+66h],cx
804f81b9 8acb mov cl,bl
804f81bb ff151c874d80 call dword ptr [nt!_imp_KfLowerIrql (804d871c)]
804f81c1 5e pop esi
804f81c2 b001 mov al,1
804f81c4 5b pop ebx
804f81c5 eb02 jmp nt!Ke386SetIoAccessMap+0x69 (804f81c9)
804f81c7 32c0 xor al,al
804f81c9 5f pop edi
804f81ca 5d pop ebp
804f81cb c20800 ret 8
fasm:
proc Ke386SetIoAccessMap uses esi edi, MapNumber, IopmBuffer
xor eax,eax
mov edi,[MapNumber]
cmp edi,IOPM_COUNT
ja .exit ;FALSE
test edi,edi
jz .exit ;FALSE
call [KeRaiseIrqlToSynchLevel]
push eax
;--------------------------------------------
mov eax,[kpcr.TSS] ;KPCR->TSS
mov edx,eax
lea edi,[eax+KTSS.IoMaps.IoMap] ;KPCR->TSS->KiIoAccessMap[0]->IoMap
mov esi,[IopmBuffer]
mov ecx,IOPM_SIZE/4 ;=8192/4 IOPM_SIZE
rep movsd
mov eax,[kpcr.Prcb] ;KPCR->Prcb
mov eax,[eax+KPRCB.CurrentThread] ;KPCR->Prcb->CurrentThread
mov eax,[eax+KTHREAD.ApcState.Process] ;KPCR->Prcb->CurrentThread->ApcState.Process
mov ax ,[eax+KPROCESS.IopmOffset]
mov [edx+KTSS.IoMapBase],ax ;KPCR->TSS->IoMapBase = IopmOffset
;--------------------------------------------
pop ecx
call [KfLowerIrql] ;cl
mov al,1 ;TRUE
.exit:
ret
endp
在winxp 和win2003上测试 效果: