驱动程序的编译和连接

下载ring0.bat...
Kmdkit推荐的方法是把汇编源程序写成批处理bat文件，以天杀的ring0.sys为例
把下面的代码存成ring0.bat

;@echo off
;goto make
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
.586P;保护模式
.modelflat,stdcall
optioncasemap:none
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
includemasm32includew2k tddk.inc
;中断相关 数据 结构
IDT_REGSTRUCT
limitWORD?
baseDWORD?
IDT_REGENDS

;中断描述符
INT_DESCRIPTORSTRUCT
offs0_15WORD?
selWORD?
paramcntBYTE?
attrsBYTE?
offs16_31WORD?
INT_DESCRIPTORENDS

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;代码段
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
.code
szBufferdb16dup(0)
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
MyIntFuncproc
pushedx
calleax
iretd
MyIntFuncendp

;====================================================================
AddMyIntprocusesedi
local@IDT

sidtszBuffer
movedi,(IDT_REGptr[szBuffer]).base
addedi,21h*8

;使用Int21中断,该中断在Win2k下没有使用
;cli
moveax,offsetMyIntFunc
mov[edi],ax
shreax,16
mov[edi+6],ax;设置入口地址
mov[edi+2],cs;设置段地址
;设置Ring3可以访问
movWORDptr[edi+4],0EE00h
;sti

ret
AddMyIntendp
;====================================================================
WdmUnloadprocDriverObject:DWORD
local@IDT

sidtszBuffer
movedi,(IDT_REGptr[szBuffer]).base
addedi,21h*8
xoreax,eax
mov[edi],ax
mov[edi+6],ax;设置入口地址
mov[edi+2],ax;设置段地址
movWORDptr[edi+4],ax

ret
WdmUnloadendp
;====================================================================
DriverEntryprocDriverObj:DWORD,RegistryPath:DWORD


moveax,DriverObj
assumeeax:ptrDRIVER_OBJECT
mov[eax].DriverUnload,offsetWdmUnload
assumeeax:nothing
invokeAddMyInt

xoreax,eax
ret
DriverEntryendp

http://www.56.com/p89/v_MTI0ODU1NTM0.html

http://www.56.com/p82/v_MTI0ODU1NjE1.html

http://www.56.com/p36/v_MTI0ODU1NjU3.html

http://www.56.com/p73/v_MTI0ODU1Njk0.html

http://www.56.com/p30/v_MTI0ODU1NzM5.html

http://www.56.com/p77/v_MTI0ODU1Nzg2.html

http://www.56.com/p31/v_MTI0ODU1ODI4.html

http://www.56.com/p72/v_MTI0ODU1ODY5.html

http://www.56.com/p36/v_MTI0ODU1OTIx.html

http://www.56.com/p57/v_MTI0ODU1OTQy.html

http://www.56.com/p30/v_MTI0ODU2MDAz.html

http://www.56.com/p78/v_MTI0ODU2MDUx.html

http://www.56.com/p41/v_MTI0ODU2MTAy.html

http://www.56.com/p29/v_MTI0ODU2MTc4.html

http://www.56.com/p82/v_MTI0ODU2MjMx.html

http://www.56.com/p40/v_MTI0ODU2Mjc3.html

http://www.56.com/p93/v_MTI0ODU2MzMw.html

http://www.56.com/p55/v_MTI0ODU2Mzgw.html

http://www.56.com/p29/v_MTI0ODU2NDQy.html

http://www.56.com/p77/v_MTI0ODU2NDkw.html

http://www.56.com/p31/v_MTI0ODU2NTMy.html

http://www.56.com/p79/v_MTI0ODU2NTgw.html

http://www.56.com/p65/v_MTI0ODU2NzQy.html

http://www.56.com/p41/v_MTI0ODU2ODA2.html

http://www.56.com/p17/v_MTI0ODU2ODcw.html

http://www.56.com/p68/v_MTI0ODU2OTIx.html

http://www.56.com/p37/v_MTI0ODU2OTc4.html

http://www.56.com/p89/v_MTI0ODU3MDMw.html

http://www.56.com/p89/v_MTI0ODU3MTE4.html

http://www.56.com/p54/v_MTI0ODU3MTcx.html

http://www.56.com/p32/v_MTI0ODU3MjM3.html

http://www.56.com/p98/v_MTI0ODU3MzAz.html

http://www.56.com/p67/v_MTI0ODU3MzYw.html

http://www.56.com/p29/v_MTI0ODU3NDEw.html

http://www.56.com/p56/v_MTI0ODU3NTI1.html

http://www.56.com/p59/v_MTI0ODU3NjE2.html

http://www.56.com/p37/v_MTI0ODU3Njgy.html

http://www.56.com/p36/v_MTI0ODU3NzY5.html

http://www.56.com/p80/v_MTI0ODU3ODEz.html

http://www.56.com/p81/v_MTI0ODU3OTAy.html

http://j.renren.com/album/1308211143499717194

http://j.renren.com/album/1308211144140700223

http://j.renren.com/album/1308211144277908860

http://j.renren.com/album/1308211144477059926

http://j.renren.com/album/1308211145001299068

http://j.renren.com/album/1308211145153868635

http://j.renren.com/album/1308211145267091880

http://j.renren.com/album/1308211145391797021

http://j.renren.com/album/1308211145551496277

http://j.renren.com/album/1308211146099580557

http://j.renren.com/album/1308211146268678625

http://j.renren.com/album/1308211146480258043

http://j.renren.com/album/1308211147045427845

http://j.renren.com/album/1308211147153231057

http://j.renren.com/album/1308211147295725711

http://j.renren.com/album/1308211147458911246

http://j.renren.com/album/1308211148164489251

http://j.renren.com/album/1308211148440778335

http://j.renren.com/album/1308211149067919726

http://j.renren.com/album/1308211149260990724

http://j.renren.com/album/1308210942289161150

http://j.renren.com/album/1308210942545942286

http://j.renren.com/album/1308210943113153616

http://j.renren.com/album/1308210943324233194

http://j.renren.com/album/1308210943482577750

http://j.renren.com/album/1308210944078962414

http://j.renren.com/album/1308210944258234050

http://j.renren.com/album/1308210944536211600

http://j.renren.com/album/1308210945377994557

http://j.renren.com/album/1308210946000290113

http://j.renren.com/album/1308210946231810773

http://j.renren.com/album/1308210946454306373

http://j.renren.com/album/1308210947029807745

http://j.renren.com/album/1308210947226620833

http://j.renren.com/album/1308210947500998159

http://photo.163.com/q/6646839/?mid=174327044

http://photo.163.com/q/6646836/?mid=174327044

http://photo.163.com/q/6646832/?mid=174327044

http://photo.163.com/q/6646828/?mid=174327044

http://photo.163.com/q/6646823/?mid=174327044

http://photo.163.com/q/6646815/?mid=174327044

http://photo.163.com/q/6646809/?mid=174327044

http://photo.163.com/q/6646802/?mid=174327044

http://photo.163.com/q/6646789/?mid=174327044

http://photo.163.com/q/6646779/?mid=174327044

http://photo.163.com/q/6654337/?mid=174322057

http://photo.163.com/q/6654328/?mid=174322057

http://photo.163.com/q/6654319/?mid=174322057

http://photo.163.com/q/6654309/?mid=174322057

http://photo.163.com/q/6654296/?mid=174322057

http://photo.163.com/q/6654285/?mid=174322057

http://photo.163.com/q/6654277/?mid=174322057