fasm Ke386SetIoAccessMap

最新推荐文章于 2022-07-05 18:43:45 发布

G_Spider

最新推荐文章于 2022-07-05 18:43:45 发布

阅读量1.5k

点赞数

分类专栏： Win32/64汇编

本文链接：https://blog.csdn.net/G_Spider/article/details/11882233

版权

Win32/64汇编专栏收录该内容

63 篇文章 1 订阅

订阅专栏

nt!Ke386SetIoAccessMap:
804f8160 8bff            mov     edi,edi
804f8162 55              push    ebp
804f8163 8bec            mov     ebp,esp
804f8165 57              push    edi
804f8166 8b7d08          mov     edi,dword ptr [ebp+8]  ;MapNumber
804f8169 83ff01          cmp     edi,1
804f816c 7759            ja      nt!Ke386SetIoAccessMap+0x67 (804f81c7)
804f816e 85ff            test    edi,edi
804f8170 7455            je      nt!Ke386SetIoAccessMap+0x67 (804f81c7)
804f8172 53              push    ebx
804f8173 56              push    esi
804f8174 ff158c864d80    call    dword ptr [nt!_imp__KeRaiseIrqlToSynchLevel (804d868c)]
804f817a 8ad8            mov     bl,al
804f817c 3ea120f0dfff    mov     eax,dword ptr ds:[0FFDFF020h]
804f8182 8bd0            mov     edx,eax
804f8184 b800f0dfff      mov     eax,0FFDFF000h
804f8189 69ff24200000    imul    edi,edi,2024h              ;sizeof.KiIoAccessMap
804f818f 8b4040          mov     eax,dword ptr [eax+40h]    ;TSS
804f8192 8b750c          mov     esi,dword ptr [ebp+0Ch]
804f8195 8dbc0764e0ffff  lea     edi,[edi+eax-1F9Ch]
804f819c b900080000      mov     ecx,800h
804f81a1 f3a5            rep movs dword ptr es:[edi],dword ptr [esi]
804f81a3 8b4204          mov     eax,dword ptr [edx+4]
804f81a6 8b4844          mov     ecx,dword ptr [eax+44h]
804f81a9 b800f0dfff      mov     eax,0FFDFF000h
804f81ae 668b4930        mov     cx,word ptr [ecx+30h]
804f81b2 8b4040          mov     eax,dword ptr [eax+40h]
804f81b5 66894866        mov     word ptr [eax+66h],cx
804f81b9 8acb            mov     cl,bl
804f81bb ff151c874d80    call    dword ptr [nt!_imp_KfLowerIrql (804d871c)]
804f81c1 5e              pop     esi
804f81c2 b001            mov     al,1
804f81c4 5b              pop     ebx
804f81c5 eb02            jmp     nt!Ke386SetIoAccessMap+0x69 (804f81c9)
804f81c7 32c0            xor     al,al
804f81c9 5f              pop     edi
804f81ca 5d              pop     ebp
804f81cb c20800          ret     8

fasm:

proc Ke386SetIoAccessMap uses esi edi, MapNumber, IopmBuffer
    xor     eax,eax
    mov     edi,[MapNumber]
    cmp     edi,IOPM_COUNT
    ja      .exit                               ;FALSE
    test    edi,edi
    jz      .exit                               ;FALSE
    call    [KeRaiseIrqlToSynchLevel]
    push    eax
    ;--------------------------------------------
    mov     eax,[kpcr.TSS]                      ;KPCR->TSS
    mov     edx,eax
    lea     edi,[eax+KTSS.IoMaps.IoMap]         ;KPCR->TSS->KiIoAccessMap[0]->IoMap
    mov     esi,[IopmBuffer]
    mov     ecx,IOPM_SIZE/4                     ;=8192/4 IOPM_SIZE
    rep     movsd
    
    mov     eax,[kpcr.Prcb]                     ;KPCR->Prcb
    mov     eax,[eax+KPRCB.CurrentThread]       ;KPCR->Prcb->CurrentThread
    mov     eax,[eax+KTHREAD.ApcState.Process]  ;KPCR->Prcb->CurrentThread->ApcState.Process
    mov     ax ,[eax+KPROCESS.IopmOffset]
    mov     [edx+KTSS.IoMapBase],ax             ;KPCR->TSS->IoMapBase = IopmOffset
    ;--------------------------------------------
    pop     ecx
    call    [KfLowerIrql]                       ;cl
    mov     al,1                                ;TRUE
.exit:
    ret
endp

在winxp 和win2003上测试效果: