逆向：Ucoresys.sys （二）

:00011528 55                      push ebp

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:000114C6(C)
|
:00011529 8BEC                    mov ebp, esp
:0001152B 53                      push ebx
:0001152C 56                      push esi
:0001152D 57                      push edi
:0001152E 6808110100              push 00011108
:00011533 33DB                    xor ebx, ebx
:00011535 33F6                    xor esi, esi

* Reference To: ntoskrnl.DbgPrint, Ord:002Dh
                                  |
:00011537 E884060000              Call 00011BC0
:0001153C 59                      pop ecx
:0001153D 8B4D08                  mov ecx, dword ptr [ebp+08]
:00011540 B8F82E00FA              mov eax, FA002EF8
:00011545 3BC8                    cmp ecx, eax
:00011547 0F8722020000            ja 0001176F
:0001154D 0F84E8010000            je 0001173B
:00011553 81F9E02E00FA            cmp ecx, FA002EE0
:00011559 0F848A010000            je 000116E9
:0001155F 81F9E42E00FA            cmp ecx, FA002EE4
:00011565 0F8418010000            je 00011683
:0001156B 81F9E82E00FA            cmp ecx, FA002EE8
:00011571 0F84DE000000            je 00011655

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0001150C(C)
|
:00011577 81F9EC2E00FA            cmp ecx, FA002EEC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0001151A(C)
|
:0001157D 0F8487000000            je 0001160A
:00011583 81F9F02E00FA            cmp ecx, FA002EF0
:00011589 7439                    je 000115C4
:0001158B 81F9F42E00FA            cmp ecx, FA002EF4
:00011591 0F850C020000            jne 000117A3

* Possible StringData Ref from Code Obj ->"GenericDrv.SYS: IoCtl IOCTL_GENERICDRV_PORT_WR"
                                        ->"ITE
"
                                  |
:00011597 6830110100              push 00011130

* Reference To: ntoskrnl.DbgPrint, Ord:002Dh
                                  |
:0001159C E81F060000              Call 00011BC0
:000115A1 395D0C                  cmp dword ptr [ebp+0C], ebx
:000115A4 59                      pop ecx
:000115A5 7413                    je 000115BA
:000115A7 837D1010                cmp dword ptr [ebp+10], 00000010
:000115AB 720D                    jb 000115BA
:000115AD FF750C                  push [ebp+0C]
:000115B0 E89DF6FFFF              call 00010C52
:000115B5 E9BF020000              jmp 00011879

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:000115A5(C), :000115AB(C)
|

* Possible StringData Ref from Code Obj ->"GenericDrv.SYS: Invalid Buffer
"
                                  |
:000115BA 6864110100              push 00011164
:000115BF E9C3020000              jmp 00011887

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00011589(C)
|

* Possible StringData Ref from Code Obj ->"GenericDrv.SYS: IoCtl IOCTL_GENERICDRV_PORT_RE"
                                        ->"AD
"
                                  |
:000115C4 6884110100              push 00011184

* Reference To: ntoskrnl.DbgPrint, Ord:002Dh
                                  |
:000115C9 E8F2050000              Call 00011BC0
:000115CE 395D14                  cmp dword ptr [ebp+14], ebx
:000115D1 59                      pop ecx
:000115D2 742C                    je 00011600
:000115D4 395D0C                  cmp dword ptr [ebp+0C], ebx
:000115D7 7427                    je 00011600
:000115D9 8B4518                  mov eax, dword ptr [ebp+18]
:000115DC 3B4510                  cmp eax, dword ptr [ebp+10]
:000115DF 6A10                    push 00000010
:000115E1 5B                      pop ebx
:000115E2 7404                    je 000115E8
:000115E4 3BC3                    cmp eax, ebx
:000115E6 7218                    jb 00011600

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:000115E2(C)
|
:000115E8 FF750C                  push [ebp+0C]
:000115EB E860F5FFFF              call 00010B50
:000115F0 8BF0                    mov esi, eax
:000115F2 85F6                    test esi, esi
:000115F4 0F85FA020000            jne 000118F4
:000115FA 53                      push ebx
:000115FB FF750C                  push [ebp+0C]
:000115FE EB3F                    jmp 0001163F

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:000115D2(C), :000115D7(C), :000115E6(C)
|

* Possible StringData Ref from Code Obj ->"GenericDrv.SYS: Invalid Buffer
"
                                  |
:00011600 68B8110100              push 000111B8
:00011605 E97D020000              jmp 00011887

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0001157D(C)
|

* Possible StringData Ref from Code Obj ->"GenericDrv.SYS: IoCtl IOCTL_GENERICDRV_UNMAP
"
                                  |
:0001160A 68D8110100              push 000111D8

* Reference To: ntoskrnl.DbgPrint, Ord:002Dh
                                  |
:0001160F E8AC050000              Call 00011BC0
:00011614 8B7D0C                  mov edi, dword ptr [ebp+0C]
:00011617 3BFB                    cmp edi, ebx
:00011619 59                      pop ecx
:0001161A 750A                    jne 00011626

* Possible StringData Ref from Code Obj ->"GenericDrv.SYS: Invalid Buffer
"
                                  |
:0001161C 6808120100              push 00011208
:00011621 E961020000              jmp 00011887

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0001161A(C)
|
:00011626 FF770C                  push [edi+0C]
:00011629 FF37                    push dword ptr [edi]
:0001162B E824FAFFFF              call 00011054

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00011681(U)
|
:00011630 8BF0                    mov esi, eax
:00011632 3BF3                    cmp esi, ebx
:00011634 0F85BA020000            jne 000118F4
:0001163A 6A10                    push 00000010
:0001163C 5B                      pop ebx
:0001163D 53                      push ebx
:0001163E 57                      push edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:000115FE(U)
|
:0001163F 8B451C                  mov eax, dword ptr [ebp+1C]
:00011642 8918                    mov dword ptr [eax], ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0001172C(U)
|
:00011644 FF7514                  push [ebp+14]

* Reference To: ntoskrnl.memmove, Ord:04A3h
                                  |
:00011647 FF15DC020100            Call dword ptr [000102DC]
:0001164D 83C40C                  add esp, 0000000C
:00011650 E99F020000              jmp 000118F4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00011571(C)
|

* Possible StringData Ref from Code Obj ->"GenericDrv.SYS: IoCtl IOCTL_GENERICDRV_PHY_TO_"
                                        ->"VIRTUAL
"
                                  |
:00011655 6828120100              push 00011228

* Reference To: ntoskrnl.DbgPrint, Ord:002Dh
                                  |
:0001165A E861050000              Call 00011BC0
:0001165F 8B7D0C                  mov edi, dword ptr [ebp+0C]
:00011662 3BFB                    cmp edi, ebx
:00011664 59                      pop ecx
:00011665 750A                    jne 00011671

* Possible StringData Ref from Code Obj ->"GenericDrv.SYS: Invalid Buffer
"
                                  |
:00011667 6860120100              push 00011260
:0001166C E916020000              jmp 00011887

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00011665(C)
|
:00011671 57                      push edi
:00011672 8D470C                  lea eax, dword ptr [edi+0C]
:00011675 50                      push eax
:00011676 FF7704                  push [edi+04]
:00011679 FF7708                  push [edi+08]
:0001167C E8E3F7FFFF              call 00010E64
:00011681 EBAD                    jmp 00011630

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00011565(C)
|

* Possible StringData Ref from Code Obj ->"GenericDrv.SYS: IoCtl IOCTL_GENERICDRV_DEALLOC"
                                        ->"_BUFFER
"
                                  |
:00011683 6880120100              push 00011280

* Reference To: ntoskrnl.DbgPrint, Ord:002Dh
                                  |
:00011688 E833050000              Call 00011BC0
:0001168D 8B750C                  mov esi, dword ptr [ebp+0C]
:00011690 3BF3                    cmp esi, ebx
:00011692 59                      pop ecx
:00011693 750A                    jne 0001169F

* Possible StringData Ref from Code Obj ->"GenericDrv.SYS: Invalid Buffer
"
                                  |
:00011695 68B8120100              push 000112B8
:0001169A E9E8010000              jmp 00011887

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00011693(C)
|
:0001169F FF760C                  push [esi+0C]
:000116A2 0FB64618                movzx eax, byte ptr [esi+18]
:000116A6 FF7614                  push [esi+14]
:000116A9 50                      push eax

* Possible StringData Ref from Code Obj ->"***ucIsMDL : %X  ulLow = %X pHandle "
                                        ->": %X
"
                                  |
:000116AA 68D8120100              push 000112D8

* Reference To: ntoskrnl.DbgPrint, Ord:002Dh
                                  |
:000116AF E80C050000              Call 00011BC0
:000116B4 83C410                  add esp, 00000010
:000116B7 807E1800                cmp byte ptr [esi+18], 00
:000116BB 740E                    je 000116CB
:000116BD FF7520                  push [ebp+20]
:000116C0 56                      push esi
:000116C1 E8F6EFFFFF              call 000106BC
:000116C6 E9AE010000              jmp 00011879

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:000116BB(C)
|
:000116CB 8B760C                  mov esi, dword ptr [esi+0C]
:000116CE 56                      push esi

* Possible StringData Ref from Code Obj ->"***pHandle : %X
"
                                  |
:000116CF 6804130100              push 00011304

* Reference To: ntoskrnl.DbgPrint, Ord:002Dh
                                  |
:000116D4 E8E7040000              Call 00011BC0
:000116D9 59                      pop ecx
:000116DA 59                      pop ecx
:000116DB 56                      push esi

* Reference To: ntoskrnl.MmFreeContiguousMemory, Ord:023Dh
                                  |
:000116DC FF1500030100            Call dword ptr [00010300]
:000116E2 33F6                    xor esi, esi
:000116E4 E992010000              jmp 0001187B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00011559(C)
|

* Possible StringData Ref from Code Obj ->"GenericDrv.SYS: IoCtl IOCTL_GENERICDRV_ALLOC_B"
                                        ->"UFFER
"
                                  |
:000116E9 6818130100              push 00011318

* Reference To: ntoskrnl.DbgPrint, Ord:002Dh
                                  |
:000116EE E8CD040000              Call 00011BC0
:000116F3 395D14                  cmp dword ptr [ebp+14], ebx
:000116F6 59                      pop ecx
:000116F7 7438                    je 00011731
:000116F9 395D0C                  cmp dword ptr [ebp+0C], ebx
:000116FC 7433                    je 00011731
:000116FE 8B4518                  mov eax, dword ptr [ebp+18]
:00011701 3B4510                  cmp eax, dword ptr [ebp+10]
:00011704 7405                    je 0001170B
:00011706 83F810                  cmp eax, 00000010
:00011709 7226                    jb 00011731

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00011704(C)
|
:0001170B FF7520                  push [ebp+20]
:0001170E FF750C                  push [ebp+0C]
:00011711 E870EDFFFF              call 00010486
:00011716 8BF0                    mov esi, eax
:00011718 3BF3                    cmp esi, ebx
:0001171A 0F85D4010000            jne 000118F4
:00011720 8B4D1C                  mov ecx, dword ptr [ebp+1C]
:00011723 6A19                    push 00000019
:00011725 58                      pop eax
:00011726 8901                    mov dword ptr [ecx], eax
:00011728 50                      push eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00011763(U)
|
:00011729 FF750C                  push [ebp+0C]
:0001172C E913FFFFFF              jmp 00011644

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:000116F7(C), :000116FC(C), :00011709(C)
|

* Possible StringData Ref from Code Obj ->"GenericDrv.SYS: Invalid Buffer
"
                                  |
:00011731 6850130100              push 00011350
:00011736 E94C010000              jmp 00011887

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0001154D(C)
|

* Possible StringData Ref from Code Obj ->"GenericDrv.SYS: IoCtl IOCTL_GENERICDRV_PORT_DM"
                                        ->"IACCESS
"
                                  |
:0001173B 6870130100              push 00011370

* Reference To: ntoskrnl.DbgPrint, Ord:002Dh
                                  |
:00011740 E87B040000              Call 00011BC0
:00011745 395D0C                  cmp dword ptr [ebp+0C], ebx
:00011748 59                      pop ecx
:00011749 741A                    je 00011765
:0001174B 6A1E                    push 0000001E
:0001174D 5F                      pop edi
:0001174E 397D10                  cmp dword ptr [ebp+10], edi
:00011751 7212                    jb 00011765
:00011753 FF750C                  push [ebp+0C]
:00011756 E81BF3FFFF              call 00010A76
:0001175B 8BF0                    mov esi, eax
:0001175D 8B451C                  mov eax, dword ptr [ebp+1C]
:00011760 8938                    mov dword ptr [eax], edi
:00011762 57                      push edi
:00011763 EBC4                    jmp 00011729

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00011749(C), :00011751(C)
|

* Possible StringData Ref from Code Obj ->"GenericDrv.SYS: Invalid Buffer
"
                                  |
:00011765 68A8130100              push 000113A8
:0001176A E918010000              jmp 00011887

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00011547(C)
|
:0001176F 81F9FC2E00FA            cmp ecx, FA002EFC
:00011775 0F8440010000            je 000118BB
:0001177B 81F9002F00FA            cmp ecx, FA002F00
:00011781 0F840D010000            je 00011894
:00011787 81F9042F00FA            cmp ecx, FA002F04
:0001178D 0F84C8000000            je 0001185B
:00011793 81F9082F00FA            cmp ecx, FA002F08
:00011799 746A                    je 00011805
:0001179B 81F90C2F00FA            cmp ecx, FA002F0C
:000117A1 7415                    je 000117B8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00011591(C)
|

* Possible StringData Ref from Code Obj ->"GenericDrv.SYS:Unknown IoctlCode
"
                                  |
:000117A3 68C8130100              push 000113C8

* Reference To: ntoskrnl.DbgPrint, Ord:002Dh
                                  |
:000117A8 E813040000              Call 00011BC0
:000117AD 59                      pop ecx
:000117AE BE0D0000C0              mov esi, C000000D
:000117B3 E93C010000              jmp 000118F4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:000117A1(C)
|

* Possible StringData Ref from Code Obj ->"IOCTL_WINIO_DISABLEDIRECTIO"
                                  |
:000117B8 68EC130100              push 000113EC

* Reference To: ntoskrnl.DbgPrint, Ord:002Dh
                                  |
:000117BD E8FE030000              Call 00011BC0
:000117C2 391DE01B0100            cmp dword ptr [00011BE0], ebx
:000117C8 59                      pop ecx
:000117C9 0F8425010000            je 000118F4
:000117CF 53                      push ebx

* Reference To: ntoskrnl.IoGetCurrentProcess, Ord:013Ah
                                  |
:000117D0 FF15D8020100            Call dword ptr [000102D8]
:000117D6 50                      push eax

* Reference To: ntoskrnl.Ke386IoSetAccessProcess, Ord:019Fh
                                  |
:000117D7 E8F0030000              Call 00011BCC
:000117DC FF35E01B0100            push dword ptr [00011BE0]
:000117E2 6A01                    push 00000001

* Reference To: ntoskrnl.Ke386SetIoAccessMap, Ord:01A1h
                                  |
:000117E4 E8DD030000              Call 00011BC6
:000117E9 6800200000              push 00002000
:000117EE FF35E01B0100            push dword ptr [00011BE0]

* Reference To: ntoskrnl.MmFreeNonCachedMemory, Ord:023Fh
                                  |
:000117F4 FF15CC020100            Call dword ptr [000102CC]
:000117FA 891DE01B0100            mov dword ptr [00011BE0], ebx
:00011800 E9EF000000              jmp 000118F4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00011799(C)
|

* Possible StringData Ref from Code Obj ->"IOCTL_WINIO_ENABLEDIRECTIO"
                                  |
:00011805 6808140100              push 00011408

* Reference To: ntoskrnl.DbgPrint, Ord:002Dh
                                  |
:0001180A E8B1030000              Call 00011BC0
:0001180F C7042400200000          mov dword ptr [esp], 00002000

* Reference To: ntoskrnl.MmAllocateNonCachedMemory, Ord:0234h
                                  |
:00011816 FF15C8020100            Call dword ptr [000102C8]
:0001181C 8BF8                    mov edi, eax
:0001181E 3BFB                    cmp edi, ebx
:00011820 893DE01B0100            mov dword ptr [00011BE0], edi
:00011826 7429                    je 00011851
:00011828 33C0                    xor eax, eax
:0001182A B900080000              mov ecx, 00000800
:0001182F 6A01                    push 00000001
:00011831 F3                      repz
:00011832 AB                      stosd

* Reference To: ntoskrnl.IoGetCurrentProcess, Ord:013Ah
                                  |
:00011833 FF15D8020100            Call dword ptr [000102D8]
:00011839 50                      push eax

* Reference To: ntoskrnl.Ke386IoSetAccessProcess, Ord:019Fh
                                  |
:0001183A E88D030000              Call 00011BCC
:0001183F FF35E01B0100            push dword ptr [00011BE0]
:00011845 6A01                    push 00000001

* Reference To: ntoskrnl.Ke386SetIoAccessMap, Ord:01A1h
                                  |
:00011847 E87A030000              Call 00011BC6
:0001184C E9A3000000              jmp 000118F4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00011826(C)
|
:00011851 BE9A0000C0              mov esi, C000009A
:00011856 E999000000              jmp 000118F4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0001178D(C)
|

* Possible StringData Ref from Code Obj ->"GenericDrv.SYS: IoCtl IOCTL_GENERICDRV_FIX_CAL"
                                        ->"LGATE
"
                                  |
:0001185B 6824140100              push 00011424

* Reference To: ntoskrnl.DbgPrint, Ord:002Dh
                                  |
:00011860 E85B030000              Call 00011BC0
:00011865 395D0C                  cmp dword ptr [ebp+0C], ebx
:00011868 59                      pop ecx
:00011869 7417                    je 00011882
:0001186B 837D100E                cmp dword ptr [ebp+10], 0000000E
:0001186F 7211                    jb 00011882
:00011871 FF750C                  push [ebp+0C]
:00011874 E8BFEFFFFF              call 00010838

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:000115B5(U), :000116C6(U), :000118B2(U)
|
:00011879 8BF0                    mov esi, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:000116E4(U)
|
:0001187B 8B451C                  mov eax, dword ptr [ebp+1C]
:0001187E 8918                    mov dword ptr [eax], ebx
:00011880 EB72                    jmp 000118F4

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00011869(C), :0001186F(C)
|

* Possible StringData Ref from Code Obj ->"GenericDrv.SYS: Invalid Buffer
"
                                  |
:00011882 685C140100              push 0001145C

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:000115BF(U), :00011605(U), :00011621(U), :0001166C(U), :0001169A(U)
|:00011736(U), :0001176A(U), :000118B9(U), :000118DA(U)
|

* Reference To: ntoskrnl.DbgPrint, Ord:002Dh
                                  |
:00011887 E834030000              Call 00011BC0
:0001188C 59                      pop ecx
:0001188D BE060200C0              mov esi, C0000206
:00011892 EB60                    jmp 000118F4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00011781(C)
|

* Possible StringData Ref from Code Obj ->"GenericDrv.SYS: IoCtl IOCTL_GENERICDRV_FIX_SEL"
                                        ->"ECTOR
"
                                  |
:00011894 687C140100              push 0001147C

* Reference To: ntoskrnl.DbgPrint, Ord:002Dh
                                  |
:00011899 E822030000              Call 00011BC0
:0001189E 395D0C                  cmp dword ptr [ebp+0C], ebx
:000118A1 59                      pop ecx
:000118A2 7410                    je 000118B4
:000118A4 837D100C                cmp dword ptr [ebp+10], 0000000C
:000118A8 720A                    jb 000118B4
:000118AA FF750C                  push [ebp+0C]
:000118AD E8BAEEFFFF              call 0001076C
:000118B2 EBC5                    jmp 00011879

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:000118A2(C), :000118A8(C)
|

* Possible StringData Ref from Code Obj ->"GenericDrv.SYS: Invalid Buffer
"
                                  |
:000118B4 68B4140100              push 000114B4
:000118B9 EBCC                    jmp 00011887

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00011775(C)
|

* Possible StringData Ref from Code Obj ->"GenericDrv.SYS: IoCtl IOCTL_GENERICDRV_GET_VER"
                                        ->"SION
"
                                  |
:000118BB 68D4140100              push 000114D4

* Reference To: ntoskrnl.DbgPrint, Ord:002Dh
                                  |
:000118C0 E8FB020000              Call 00011BC0
:000118C5 8B4514                  mov eax, dword ptr [ebp+14]
:000118C8 3BC3                    cmp eax, ebx
:000118CA 59                      pop ecx
:000118CB 6A06                    push 00000006
:000118CD 59                      pop ecx
:000118CE 750C                    jne 000118DC
:000118D0 394D18                  cmp dword ptr [ebp+18], ecx
:000118D3 7307                    jnb 000118DC

* Possible StringData Ref from Code Obj ->"GenericDrv.SYS: Invalid Buffer
"
                                  |
:000118D5 6808150100              push 00011508
:000118DA EBAB                    jmp 00011887

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:000118CE(C), :000118D3(C)
|
:000118DC 66C7000100              mov word ptr [eax], 0001
:000118E1 66C740020400            mov [eax+02], 0004
:000118E7 66C740040100            mov [eax+04], 0001
:000118ED 8B451C                  mov eax, dword ptr [ebp+1C]
:000118F0 8908                    mov dword ptr [eax], ecx
:000118F2 33F6                    xor esi, esi

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:000115F4(C), :00011634(C), :00011650(U), :0001171A(C), :000117B3(U)
|:000117C9(C), :00011800(U), :0001184C(U), :00011856(U), :00011880(U)
|:00011892(U)
|
:000118F4 5F                      pop edi
:000118F5 8BC6                    mov eax, esi
:000118F7 5E                      pop esi
:000118F8 5B                      pop ebx
:000118F9 5D                      pop ebp
:000118FA C21C00                  ret 001C

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

NTSTATUS __stdcall fun1(POINTER_ALIGNMENT IoControlCode,          //ebp+0x8
                        PVOID SystemBuffer,                       //ebp+0xc
                        ULONG POINTER_ALIGNMENT InputBufferLength,//ebp+0x10
                        PVOID SystemBuffer1,            //ebp+0x14
                        ULONG OutputBufferLength,      //ebp+0x18
                        PULONG irp,                    //ebp+0x1c
                        PVOID DeviceExtension          //ebp+0x20
                        )
{
 int rete=0;
 switch(IoControlCode)
 {
     case 0xFA002EF8:
   {
    DbgPrint("GenericDrv.SYS: IoCtl IOCTL_GENERICDRV_PORT_DM");
    if((SystemBuffer==NULL)||((InputBufferLength < 0x1E)))
    {
     DbgPrint("GenericDrv.SYS: Invalid Buffer");
     return 0xC0000206;
    }
    else
    {
     rete=call 10A76 fun9(SystemBuffer);
     *irp=0x1E;
     memmove(SystemBuffer1,SystemBuffer);//[ebp+14],[ebp+0C]
     return rete;
    }
   }
  case 0xFA002EE0:
   {
    DbgPrint("GenericDrv.SYS: IoCtl IOCTL_GENERICDRV_ALLOC_B");
    if((SystemBuffer1==NULL)||(SystemBuffer==NULL))
    {
     DbgPrint((short*)0x11350);
     return 0xC0000206;
    }
    if(OutputBufferLength==InputBufferLength)
    {
     rete=call 10486 fun8(SystemBuffer,DeviceExtension);
     if(rete==0)
     {
      *irp=0x19;
      memmove(SystemBuffer1,SystemBuffer);//[ebp+14],[ebp+0C]
     }
     return rete;
   }
  case 0xFA002EE4:
   {
    DbgPrint("GenericDrv.SYS: IoCtl IOCTL_GENERICDRV_DEALLOC");
    if(SystemBuffer!=NULL)
    {
     DbgPrint("***ucIsMDL : %X  ulLow = %X pHandle ");
     if(0==*(PCHAR)((ULONG)SystemBuffer+0x18))
     {
      DbgPrint("***pHandle : %X");
      MmFreeContiguousMemory(*(PULONG)((ULONG)SystemBuffer+0xc));
      *irp=0;
      return 0;
     }
     else
     {
      rete=call 106BC fun7(esi,DeviceExtension);
      *irp=0;
      return rete;
     } 
    }
    else
    {
     DbgPrint("GenericDrv.SYS: Invalid Buffer"); 
     return 0xC0000206;
    }
   }
  case 0xFA002EE8:
   {
    DbgPrint("GenericDrv.SYS: IoCtl IOCTL_GENERICDRV_PHY_TO_");
    if(SystemBuffer!=NULL)
    {
     rete=call 10E64 fun6(*(PULONG)((ULONG)SystemBuffer+0x8),
      *(PULONG)((ULONG)SystemBuffer+0x4),
      (ULONG)SystemBuffer+0xc,SystemBuffer);
     if(rete==0)
     {
      *irp=0x10;
      memmove(SystemBuffer1,SystemBuffer);//[ebp+14],edi
     }
     return rete;
    }
   }
  case 0xFA002EEC:
   {
    DbgPrint("GenericDrv.SYS: IoCtl IOCTL_GENERICDRV_UNMAP");
    if(SystemBuffer!=NULL)
    {
     rete=call 0x11054 fun4(*(PULONG)(SystemBuffer),SystemBuffer);
     if(rete==0)
     {
      *irp=0x10;
      memmove(SystemBuffer1,SystemBuffer);//[ebp+14],edi
     }
     return rete;
    }
    else
    {
     DbgPrint("GenericDrv.SYS: Invalid Buffer");
     return 0xC0000206;
    }    
   }
  case 0xFA002EF0:
   {
    DbgPrint("GenericDrv.SYS: IoCtl IOCTL_GENERICDRV_PORT_RE");
    if((NULL==SystemBuffer1)||(NULL==SystemBuffer))
    {
     DbgPrint("GenericDrv.SYS: Invalid Buffer");
     return 0xC0000206;
    }
    if(OutputBufferLength==InputBufferLength)
    {
     rete= call 00010B50 fun3(SystemBuffer);
     if(rete==0)
     {
      *irp=0x10;
      memmove(SystemBuffer1,SystemBuffer);//[ebp+14],[ebp+0C]
     }
     return rete;
    }
   }
  default:
   {
    if(IoControlCode> 0xFA002EF8) 
    {
     switch(IoControlCode)
     {
     case 0xFA002EFC:{
           DbgPrint("GenericDrv.SYS: IoCtl IOCTL_GENERICDRV_GET_VER");
           if((SystemBuffer1!=NULL)||(OutputBufferLength > 0x6))
           { 
          *(short*)(SystemBuffer1)=1;
          *(short*)((ULONG)SystemBuffer1+2)=4;
          *(short*)((ULONG)SystemBuffer1+4)=1;
          *irp=0x6;
          return 0;
           }
           else
           {
            DbgPrint("GenericDrv.SYS: Invalid Buffer");
            return 0xC0000206;
           }  
         }
     case 0xFA002F00:{
                     DbgPrint("GenericDrv.SYS: IoCtl IOCTL_GENERICDRV_FIX_SEL");
            if((SystemBuffer==ebx)||(InputBufferLength<0xc))
            { 
             DbgPrint("GenericDrv.SYS: Invalid Buffer");
             return 0xC0000206;
            }
            else
            {
             rete=call 1076C fun11(SystemBuffer);
             *irp=0;
             return rete;
            }           
         }
     case 0xFA002F04:{
            DbgPrint("GenericDrv.SYS: IoCtl IOCTL_GENERICDRV_FIX_CAL");
            if((SystemBuffer==NULL)||(InputBufferLength<0xe))
            {
             DbgPrint("GenericDrv.SYS: Invalid Buffer");
             return 0xC0000206;
            }
            else
            {
             rete=call 10838 fun10(SystemBuffer);
             *irp=0;
             return rete;
            }  
         }
     case 0xFA002F08:{
            DbgPrint("IOCTL_WINIO_ENABLEDIRECTIO");
            rete=call MmAllocateNonCachedMemory(0x2000);
            *(PULONG)0x11BE=rete;
            if(rete!=0)
            {
             for(int i=0;i<0x800;i++)
             {
              *(PULONG)(rete)=0;
              rete+=4;
             }
             rete=IoGetCurrentProcess();  
             rete=Ke386IoSetAccessProcess(rete,1);
             Ke386SetIoAccessMap(1,*(PULONG)0x11BE0);
             return 0;         
            }
            return 0xC000009A;
         }
     case 0xFA002F0C:{
           {
            DbgPrint("IOCTL_WINIO_DISABLEDIRECTIO");
            if(*(PULONG)0x11BE0!=0)
            {
             rete=IoGetCurrentProcess();
             rete=Ke386IoSetAccessProcess(rete,0);
             Ke386SetIoAccessMap(1,*(PULONG)0x11BE0);
             MmFreeNonCachedMemory(*(PULONG)0x11BE0,2);
             *(PULONG)(0x11BE0)=0;
            }
            return 0;
           }
         }
     default:
      {
          DbgPrint("GenericDrv.SYS:Unknown IoctlCode"); 
       return 0xC000000D;
      }
     }
    }
    if(IoControlCode!=0xFA002EF4) 
    {
     DbgPrint("GenericDrv.SYS:Unknown IoctlCode");
     return 0xC000000D;
    }
    DbgPrint("GenericDrv.SYS: IoCtl IOCTL_GENERICDRV_PORT_WR");
    if((NULL==SystemBuffer)||(InputBufferLength<0x10))
    {
     DbgPrint("GenericDrv.SYS: Invalid Buffer");
     return 0xC0000206;
    }
    rete=call 10C52 fun2(SystemBuffer);
    *irp=0;
    return rete;
   }
 }
}