下载ring0.bat...
Kmdkit推荐的方法是把汇编源程序写成批处理bat文件,以天杀的ring0.sys为例
把下面的代码存成ring0.bat
;@echo off
;goto make
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
.586P;保护模式
.modelflat,stdcall
optioncasemap:none
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
includemasm32includew2k tddk.inc
;中断相关 数据 结构
IDT_REGSTRUCT
limitWORD?
baseDWORD?
IDT_REGENDS
;中断描述符
INT_DESCRIPTORSTRUCT
offs0_15WORD?
selWORD?
paramcntBYTE?
attrsBYTE?
offs16_31WORD?
INT_DESCRIPTORENDS
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;代码段
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
.code
szBufferdb16dup(0)
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
MyIntFuncproc
pushedx
calleax
iretd
MyIntFuncendp
;====================================================================
AddMyIntprocusesedi
local@IDT
sidtszBuffer
movedi,(IDT_REGptr[szBuffer]).base
addedi,21h*8
;使用Int21中断,该中断在Win2k下没有使用
;cli
moveax,offsetMyIntFunc
mov[edi],ax
shreax,16
mov[edi+6],ax;设置入口地址
mov[edi+2],cs;设置段地址
;设置Ring3可以访问
movWORDptr[edi+4],0EE00h
;sti
ret
AddMyIntendp
;====================================================================
WdmUnloadprocDriverObject:DWORD
local@IDT
sidtszBuffer
movedi,(IDT_REGptr[szBuffer]).base
addedi,21h*8
xoreax,eax
mov[edi],ax
mov[edi+6],ax;设置入口地址
mov[edi+2],ax;设置段地址
movWORDptr[edi+4],ax
ret
WdmUnloadendp
;====================================================================
DriverEntryprocDriverObj:DWORD,RegistryPath:DWORD
moveax,DriverObj
assumeeax:ptrDRIVER_OBJECT
mov[eax].DriverUnload,offsetWdmUnload
assumeeax:nothing
invokeAddMyInt
xoreax,eax
ret
DriverEntryendp
Kmdkit推荐的方法是把汇编源程序写成批处理bat文件,以天杀的ring0.sys为例
把下面的代码存成ring0.bat
;@echo off
;goto make
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
.586P;保护模式
.modelflat,stdcall
optioncasemap:none
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
includemasm32includew2k tddk.inc
;中断相关 数据 结构
IDT_REGSTRUCT
limitWORD?
baseDWORD?
IDT_REGENDS
;中断描述符
INT_DESCRIPTORSTRUCT
offs0_15WORD?
selWORD?
paramcntBYTE?
attrsBYTE?
offs16_31WORD?
INT_DESCRIPTORENDS
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;代码段
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
.code
szBufferdb16dup(0)
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
MyIntFuncproc
pushedx
calleax
iretd
MyIntFuncendp
;====================================================================
AddMyIntprocusesedi
local@IDT
sidtszBuffer
movedi,(IDT_REGptr[szBuffer]).base
addedi,21h*8
;使用Int21中断,该中断在Win2k下没有使用
;cli
moveax,offsetMyIntFunc
mov[edi],ax
shreax,16
mov[edi+6],ax;设置入口地址
mov[edi+2],cs;设置段地址
;设置Ring3可以访问
movWORDptr[edi+4],0EE00h
;sti
ret
AddMyIntendp
;====================================================================
WdmUnloadprocDriverObject:DWORD
local@IDT
sidtszBuffer
movedi,(IDT_REGptr[szBuffer]).base
addedi,21h*8
xoreax,eax
mov[edi],ax
mov[edi+6],ax;设置入口地址
mov[edi+2],ax;设置段地址
movWORDptr[edi+4],ax
ret
WdmUnloadendp
;====================================================================
DriverEntryprocDriverObj:DWORD,RegistryPath:DWORD
moveax,DriverObj
assumeeax:ptrDRIVER_OBJECT
mov[eax].DriverUnload,offsetWdmUnload
assumeeax:nothing
invokeAddMyInt
xoreax,eax
ret
DriverEntryendp
http://www.56.com/p89/v_MTI0ODU1NTM0.html |
http://www.56.com/p82/v_MTI0ODU1NjE1.html |
http://www.56.com/p36/v_MTI0ODU1NjU3.html |
http://www.56.com/p73/v_MTI0ODU1Njk0.html |
http://www.56.com/p30/v_MTI0ODU1NzM5.html |
http://www.56.com/p77/v_MTI0ODU1Nzg2.html |
http://www.56.com/p31/v_MTI0ODU1ODI4.html |
http://www.56.com/p72/v_MTI0ODU1ODY5.html |
http://www.56.com/p36/v_MTI0ODU1OTIx.html |
http://www.56.com/p57/v_MTI0ODU1OTQy.html |
http://www.56.com/p30/v_MTI0ODU2MDAz.html |
http://www.56.com/p78/v_MTI0ODU2MDUx.html |
http://www.56.com/p41/v_MTI0ODU2MTAy.html |
http://www.56.com/p29/v_MTI0ODU2MTc4.html |
http://www.56.com/p82/v_MTI0ODU2MjMx.html |
http://www.56.com/p40/v_MTI0ODU2Mjc3.html |
http://www.56.com/p93/v_MTI0ODU2MzMw.html |
http://www.56.com/p55/v_MTI0ODU2Mzgw.html |
http://www.56.com/p29/v_MTI0ODU2NDQy.html |
http://www.56.com/p77/v_MTI0ODU2NDkw.html |
http://www.56.com/p31/v_MTI0ODU2NTMy.html |
http://www.56.com/p79/v_MTI0ODU2NTgw.html |
http://www.56.com/p65/v_MTI0ODU2NzQy.html |
http://www.56.com/p41/v_MTI0ODU2ODA2.html |
http://www.56.com/p17/v_MTI0ODU2ODcw.html |
http://www.56.com/p68/v_MTI0ODU2OTIx.html |
http://www.56.com/p37/v_MTI0ODU2OTc4.html |
http://www.56.com/p89/v_MTI0ODU3MDMw.html |
http://www.56.com/p89/v_MTI0ODU3MTE4.html |
http://www.56.com/p54/v_MTI0ODU3MTcx.html |
http://www.56.com/p32/v_MTI0ODU3MjM3.html |
http://www.56.com/p98/v_MTI0ODU3MzAz.html |
http://www.56.com/p67/v_MTI0ODU3MzYw.html |
http://www.56.com/p29/v_MTI0ODU3NDEw.html |
http://www.56.com/p56/v_MTI0ODU3NTI1.html |
http://www.56.com/p59/v_MTI0ODU3NjE2.html |
http://www.56.com/p37/v_MTI0ODU3Njgy.html |
http://www.56.com/p36/v_MTI0ODU3NzY5.html |
http://www.56.com/p80/v_MTI0ODU3ODEz.html |
http://www.56.com/p81/v_MTI0ODU3OTAy.html |
http://j.renren.com/album/1308211143499717194 |
http://j.renren.com/album/1308211144140700223 |
http://j.renren.com/album/1308211144277908860 |
http://j.renren.com/album/1308211144477059926 |
http://j.renren.com/album/1308211145001299068 |
http://j.renren.com/album/1308211145153868635 |
http://j.renren.com/album/1308211145267091880 |
http://j.renren.com/album/1308211145391797021 |
http://j.renren.com/album/1308211145551496277 |
http://j.renren.com/album/1308211146099580557 |
http://j.renren.com/album/1308211146268678625 |
http://j.renren.com/album/1308211146480258043 |
http://j.renren.com/album/1308211147045427845 |
http://j.renren.com/album/1308211147153231057 |
http://j.renren.com/album/1308211147295725711 |
http://j.renren.com/album/1308211147458911246 |
http://j.renren.com/album/1308211148164489251 |
http://j.renren.com/album/1308211148440778335 |
http://j.renren.com/album/1308211149067919726 |
http://j.renren.com/album/1308211149260990724 |
http://j.renren.com/album/1308210942289161150 |
http://j.renren.com/album/1308210942545942286 |
http://j.renren.com/album/1308210943113153616 |
http://j.renren.com/album/1308210943324233194 |
http://j.renren.com/album/1308210943482577750 |
http://j.renren.com/album/1308210944078962414 |
http://j.renren.com/album/1308210944258234050 |
http://j.renren.com/album/1308210944536211600 |
http://j.renren.com/album/1308210945377994557 |
http://j.renren.com/album/1308210946000290113 |
http://j.renren.com/album/1308210946231810773 |
http://j.renren.com/album/1308210946454306373 |
http://j.renren.com/album/1308210947029807745 |
http://j.renren.com/album/1308210947226620833 |
http://j.renren.com/album/1308210947500998159 |
http://photo.163.com/q/6646839/?mid=174327044 |
http://photo.163.com/q/6646836/?mid=174327044 |
http://photo.163.com/q/6646832/?mid=174327044 |
http://photo.163.com/q/6646828/?mid=174327044 |
http://photo.163.com/q/6646823/?mid=174327044 |
http://photo.163.com/q/6646815/?mid=174327044 |
http://photo.163.com/q/6646809/?mid=174327044 |
http://photo.163.com/q/6646802/?mid=174327044 |
http://photo.163.com/q/6646789/?mid=174327044 |
http://photo.163.com/q/6646779/?mid=174327044 |
http://photo.163.com/q/6654337/?mid=174322057 |
http://photo.163.com/q/6654328/?mid=174322057 |
http://photo.163.com/q/6654319/?mid=174322057 |
http://photo.163.com/q/6654309/?mid=174322057 |
http://photo.163.com/q/6654296/?mid=174322057 |
http://photo.163.com/q/6654285/?mid=174322057 |
http://photo.163.com/q/6654277/?mid=174322057 |