VC6下编译进Ring0代码的疑惑收藏

现在的位置: 首页 > 综合 > 正文

RSS

VC6下编译进Ring0代码的疑惑收藏

2013年03月27日 ⁄ 综合 ⁄ 共 12473字 ⁄ 字号小中大 ⁄ 评论关闭

文章目录

VC6下编译进Ring0代码的疑惑收藏

新一篇: 破解-超级俄罗斯方块1.11（Super Rumble Cube） | 旧一篇: 破解-SourceFormatX256cn

VC6下编译进Ring0代码的疑惑,操作系统XPSP2,CPU:AMD3000+。现象，VC6总会优化代码，编译出来的代码不是想要的。

代码如下：

// tt.cpp : Defines the entry point for the application.
//

#include "stdafx.h"

#define _X86_

#include <windows.h>
#include <stdio.h>
#include <aclapi.h>
#include <conio.h>
#include <windef.h>
#include <shellapi.h>

typedef long NTSTATUS;
typedef unsigned short USHORT;
#define NT_SUCCESS(Status) ((NTSTATUS)(Status) >= 0)
#define OBJ_INHERIT 0x00000002L
#define OBJ_PERMANENT 0x00000010L
#define OBJ_EXCLUSIVE 0x00000020L
#define OBJ_CASE_INSENSITIVE 0x00000040L
#define OBJ_OPENIF 0x00000080L
#define OBJ_OPENLINK 0x00000100L
#define OBJ_KERNEL_HANDLE 0x00000200L
#define OBJ_VALID_ATTRIBUTES 0x000003F2L

typedef struct _UNICODE_STRING {
	USHORT Length;
	USHORT MaximumLength;
	
#ifdef MIDL_PASS
	[size_is(MaximumLength / 2), length_is((Length) / 2) ] USHORT * Buffer;
#else // MIDL_PASS
	PWSTR Buffer;
#endif // MIDL_PASS
} UNICODE_STRING;

typedef UNICODE_STRING *PUNICODE_STRING;
typedef const UNICODE_STRING *PCUNICODE_STRING;
#define UNICODE_NULL ((WCHAR)0) // winnt

typedef struct _OBJECT_ATTRIBUTES {
	ULONG Length;
	HANDLE RootDirectory;
	PUNICODE_STRING ObjectName;
	ULONG Attributes;
	PVOID SecurityDescriptor; // Points to type SECURITY_DESCRIPTOR
	PVOID SecurityQualityOfService; // Points to type SECURITY_QUALITY_OF_SERVICE
} OBJECT_ATTRIBUTES;

typedef OBJECT_ATTRIBUTES *POBJECT_ATTRIBUTES;

#define InitializeObjectAttributes( p, n, a, r, s ) { /
	(p)->Length = sizeof( OBJECT_ATTRIBUTES );/
	(p)->RootDirectory = r; /
	(p)->Attributes = a;/
	(p)->ObjectName = n;/
	(p)->SecurityDescriptor = s;/
	(p)->SecurityQualityOfService = NULL; /
}

extern "C"
typedef VOID (*pRtlInitUnicodeString)( PUNICODE_STRING DestinationString,PCWSTR SourceString);

extern "C"
typedef NTSTATUS (*pZwOpenSection)(OUT PHANDLE SectionHandle,IN ACCESS_MASK DesiredAccess,IN POBJECT_ATTRIBUTES ObjectAttributes);

extern "C" 
typedef NTSTATUS (*pZwClose)(IN HANDLE Handle);

static const HINSTANCE NTDLLHANDLE=(HINSTANCE)0x7c920000; //ntdll.dll加载的位置可以用GetModuleHandle获取

#define STATUS_SUCCESS ((NTSTATUS)0x00000000L) // ntsubauth
#define STATUS_ACCESS_DENIED ((NTSTATUS)0xC0000022L)
//#pragma comment(lib,"C://NTDDK//libfre//i386//ntdll.lib")


#define ENTERRING0 _asm pushad /
	_asm pushf /
_asm cli

#define LEAVERING0 _asm popf /
	_asm popad /
_asm retf

typedef struct gdtr {
	unsigned short Limit;
	unsigned short BaseLow;
	unsigned short BaseHigh;
} Gdtr_t, *PGdtr_t;

typedef struct {
	unsigned short offset_0_15;
	unsigned short selector;
	
	unsigned char param_count : 4;
	unsigned char some_bits : 4;
	
	unsigned char type : 4;
	unsigned char app_system : 1;
	unsigned char dpl : 2;
	unsigned char present : 1;
	
	unsigned short offset_16_31;
} CALLGATE_DESCRIPTOR;


void PrintWin32Error( DWORD ErrorCode )
{
	LPVOID lpMsgBuf;
	
	FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM, NULL, ErrorCode, MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), (LPTSTR) &lpMsgBuf, 0, NULL);
	printf("%s/n", lpMsgBuf );
	LocalFree( lpMsgBuf );
}

ULONG MiniMmGetPhysicalAddress(ULONG virtualaddress)
{
	if(virtualaddress<0x80000000||virtualaddress>=0xA0000000)
		return 0;
	return virtualaddress&0x1FFFF000;
}

VOID SetPhyscialMemorySectionCanBeWrited(HANDLE hSection)
{
	PACL pDacl=NULL;
	PACL pNewDacl=NULL;
	PSECURITY_DESCRIPTOR pSD=NULL;
	DWORD dwRes;
	EXPLICIT_ACCESS ea;
	
	if(dwRes=GetSecurityInfo(hSection,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION, NULL,NULL,&pDacl,NULL,&pSD) != ERROR_SUCCESS)
	{
		printf( "GetSecurityInfo Error %u/n", dwRes );
		goto CleanUp;
	}
	
	ZeroMemory(&ea, sizeof(EXPLICIT_ACCESS));
	ea.grfAccessPermissions = SECTION_MAP_WRITE;
	ea.grfAccessMode = GRANT_ACCESS;
	ea.grfInheritance= NO_INHERITANCE;
	ea.Trustee.TrusteeForm = TRUSTEE_IS_NAME;
	ea.Trustee.TrusteeType = TRUSTEE_IS_USER;
	ea.Trustee.ptstrName = "CURRENT_USER";
	
	if(dwRes=SetEntriesInAcl(1,&ea,pDacl,&pNewDacl)!=ERROR_SUCCESS)
	{
		printf( "SetEntriesInAcl %u/n", dwRes );
		goto CleanUp;
	}
	
	if(dwRes=SetSecurityInfo(hSection,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION,NULL,NULL,pNewDacl,NULL)!=ERROR_SUCCESS)
	{
		printf("SetSecurityInfo %u/n",dwRes);
		goto CleanUp;
	}
	
CleanUp:
	
	if(pSD)
		LocalFree(pSD);
	if(pNewDacl)
		LocalFree(pSD);
}
#define RING0PROC void __declspec (naked)

BOOL ExecRing0Proc(ULONG Entry,ULONG seglen)
{
	Gdtr_t gdt;
	__asm sgdt gdt;
	
	ULONG mapAddr=MiniMmGetPhysicalAddress(gdt.BaseHigh<<16U|gdt.BaseLow);
	if(!mapAddr) return 0;
	
	HANDLE hSection=NULL;
	NTSTATUS status;
	OBJECT_ATTRIBUTES objectAttributes;
	UNICODE_STRING objName;
	CALLGATE_DESCRIPTOR *cg;
	
	status = STATUS_SUCCESS;
	
	pRtlInitUnicodeString RtlInitUnicodeString;
	pZwOpenSection ZwOpenSection;
	pZwClose ZwClose;
	
	RtlInitUnicodeString=(pRtlInitUnicodeString)GetProcAddress(NTDLLHANDLE,"RtlInitUnicodeString");
	ZwOpenSection=(pZwOpenSection)GetProcAddress(NTDLLHANDLE,"ZwOpenSection");
	ZwClose=(pZwClose)GetProcAddress(NTDLLHANDLE,"ZwClose");
	
	RtlInitUnicodeString(&objName,L"//Device//PhysicalMemory");
	InitializeObjectAttributes(&objectAttributes, &objName, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, (PSECURITY_DESCRIPTOR) NULL);
	status = ZwOpenSection(&hSection,SECTION_MAP_READ|SECTION_MAP_WRITE,&objectAttributes);
	
	//if(status == STATUS_ACCESS_DENIED) //这个地方就一直加强改写才行！
	{
		status = ZwOpenSection(&hSection,READ_CONTROL|WRITE_DAC,&objectAttributes);
		SetPhyscialMemorySectionCanBeWrited(hSection);
		ZwClose(hSection);
		status = ZwOpenSection(&hSection,SECTION_MAP_READ|SECTION_MAP_WRITE,&objectAttributes);
	}
	
	if(status != STATUS_SUCCESS)
	{
		printf("Error Open PhysicalMemory Section Object,Status:%08X/n",status);
		return 0;
	}
	
	PVOID BaseAddress;
	BaseAddress=MapViewOfFile(hSection,
		FILE_MAP_READ|FILE_MAP_WRITE,
		0,
		mapAddr, //low part
		(gdt.Limit+1));
	if(!BaseAddress)
	{
		printf("Error MapViewOfFile:");
		PrintWin32Error(GetLastError());
		return 0;
	}
	
	BOOL setcg=FALSE;
	
	for(cg=(CALLGATE_DESCRIPTOR *)((ULONG)BaseAddress+(gdt.Limit&0xFFF8));(ULONG)cg>(ULONG)BaseAddress;cg--)
		if(cg->type == 0){
			cg->offset_0_15 = LOWORD(Entry);
			cg->selector = 8;
			cg->param_count = 0;
			cg->some_bits = 0;
			cg->type = 0xC; // 386 call gate
			cg->app_system = 0; // A system descriptor
			cg->dpl = 3; // Ring 3 code can call
			cg->present = 1;
			cg->offset_16_31 = HIWORD(Entry);
			
			setcg=TRUE;
			break;
		}
		
		if(!setcg){
			ZwClose(hSection);
			return 0;
		}
		char *msg=new char[1000];
		sprintf(msg,"BaseAddress=%x/thSection=%x/tmapAddr=%x",BaseAddress,hSection,mapAddr);
		MessageBox(NULL,msg,NULL,NULL);
		delete [] msg;
		short farcall[3];
		
		farcall[2]=((short)((ULONG)cg-(ULONG)BaseAddress))|3; //Ring 3 callgate;
		if(!VirtualLock((PVOID)Entry,seglen))
		{
			printf("Error VirtualLock:");
			PrintWin32Error(GetLastError());
			return 0;
		}
		
		SetThreadPriority(GetCurrentThread(),THREAD_PRIORITY_TIME_CRITICAL);
		Sleep(0);
		
		_asm call fword ptr [farcall];
		
		MessageBox(NULL,"com",NULL,NULL);
		SetThreadPriority(GetCurrentThread(),THREAD_PRIORITY_NORMAL);
		
		VirtualUnlock((PVOID)Entry,seglen);
		
		//Clear callgate
		*(ULONG *)cg=0;
		*((ULONG *)cg+1)=0;
		ZwClose(hSection);
		MessageBox(NULL,"com2",NULL,NULL);
		return TRUE;
}

struct _RING0DATA
{
	DWORD mcr0,mcr2,mcr3;
	unsigned short BaseMemory;
	unsigned short ExtendedMemory;
}r0Data;

RING0PROC Ring0Proc1()
{
	ENTERRING0;
	_asm {
		mov eax, cr0
			mov r0Data.mcr0, eax;
		mov eax, cr2
			mov r0Data.mcr2, eax;
		mov eax, cr3
			mov r0Data.mcr3, eax;
	}
	LEAVERING0;
}

RING0PROC Ring0Proc2()
{
	ENTERRING0;
	_outp( 0x70, 0x15 );
	
	_asm
	{
		mov ax,0
			in al,71h
			mov r0Data.BaseMemory,ax
	}
	
	_outp( 0x70, 0x16 );
	r0Data.BaseMemory += _inp(0x71) << 8;
	_outp( 0x70, 0x17 );
	r0Data.ExtendedMemory = _inp( 0x71 );
	_outp( 0x70, 0x18 );
	r0Data.ExtendedMemory += _inp(0x71) << 8;
	LEAVERING0;
}



int Freq;
RING0PROC BeepOn()
{
	ENTERRING0;
	
    BYTE b;
	
    if ((Freq >= 20) && (Freq <= 20000))
    {
        Freq = 1193181 / Freq;
        b = _inp(0x61);
        if ((b & 3) == 0)
		{
			_outp(0x61, (BYTE) (b | 3));
			_outp(0x43, 0xb6);
		}
        _outp(0x42, (BYTE) Freq);
        _outp(0x42, (BYTE) (Freq >> 8));
    };
	
	LEAVERING0;
};

RING0PROC BeepOff()
{
	ENTERRING0;
	
    BYTE b;
	
    b= (_inp(0x61) & 0xfc);
    _outp(0x61, b);
	
	LEAVERING0;
};


int APIENTRY WinMain(HINSTANCE hInstance,
                     HINSTANCE hPrevInstance,
                     LPSTR     lpCmdLine,
                     int       nCmdShow)
{
	ZeroMemory(&r0Data,sizeof(struct _RING0DATA));
	VirtualLock((PVOID)&r0Data,sizeof(struct _RING0DATA));
	ExecRing0Proc((ULONG)Ring0Proc1,0x100);
	ExecRing0Proc((ULONG)Ring0Proc2,0x100);
	VirtualUnlock((PVOID)&r0Data,sizeof(struct _RING0DATA));
	
	char* msg=new char[100];
	sprintf(msg,"CR0 = %x/tCR2 = %x/tCR3 = %x/t", r0Data.mcr0,r0Data.mcr2,r0Data.mcr3);
	MessageBox(NULL,msg,NULL,NULL);
	
	delete [] msg;
	Freq=5000;
	
	ExecRing0Proc((ULONG)BeepOn,0x100);
	Sleep(1000);
	Freq=3000;
	ExecRing0Proc((ULONG)BeepOn,0x100);
	Sleep(1000);
	ExecRing0Proc((ULONG)BeepOff,0x100);
	MessageBox(NULL,"com3",NULL,NULL);
	return 0;
}

    进Ring0的功能是正确的，问题出现在VC6汇编Sleep,MessageBox这样的函数时，把Sleep，MessageBox调用
地址写在ESI，EDI寄存器内。如主过程：

	ZeroMemory(&r0Data,sizeof(struct _RING0DATA));
	VirtualLock((PVOID)&r0Data,sizeof(struct _RING0DATA));
	ExecRing0Proc((ULONG)Ring0Proc1,0x100);
	ExecRing0Proc((ULONG)Ring0Proc2,0x100);
	VirtualUnlock((PVOID)&r0Data,sizeof(struct _RING0DATA));
	
	char* msg=new char[100];
	sprintf(msg,"CR0 = %x/tCR2 = %x/tCR3 = %x/t", r0Data.mcr0,r0Data.mcr2,r0Data.mcr3);
	MessageBox(NULL,msg,NULL,NULL);
	
	delete [] msg;
	Freq=5000;
	
	ExecRing0Proc((ULONG)BeepOn,0x100);
	Sleep(1000);
	Freq=3000;
	ExecRing0Proc((ULONG)BeepOn,0x100);
	Sleep(1000);
	ExecRing0Proc((ULONG)BeepOff,0x100);
	MessageBox(NULL,"com3",NULL,NULL);
	return 0;


汇编后成为：
	004014A0  /___FCKpd___2nbsp; 33C0          XOR EAX,EAX                              ;  tt.00400000
004014A2  |.  56            PUSH ESI
004014A3  |.  A3 287A4000   MOV DWORD PTR DS:[407A28],EAX
004014A8  |.  57            PUSH EDI
004014A9  |.  A3 2C7A4000   MOV DWORD PTR DS:[407A2C],EAX
004014AE  |.  6A 10         PUSH 10
004014B0  |.  A3 307A4000   MOV DWORD PTR DS:[407A30],EAX
004014B5  |.  68 287A4000   PUSH tt.00407A28
004014BA  |.  A3 347A4000   MOV DWORD PTR DS:[407A34],EAX
004014BF  |.  FF15 18604000 CALL DWORD PTR DS:[<&KERNEL32.VirtualLoc>;  kernel32.VirtualLock
004014C5  |.  68 00010000   PUSH 100
004014CA  |.  68 D0134000   PUSH tt.004013D0
004014CF  |.  E8 7CFCFFFF   CALL tt.00401150
004014D4  |.  68 00010000   PUSH 100
004014D9  |.  68 F0134000   PUSH tt.004013F0
004014DE  |.  E8 6DFCFFFF   CALL tt.00401150
004014E3  |.  83C4 10       ADD ESP,10
004014E6  |.  6A 10         PUSH 10                                  ; /Size = 10 (16.)
004014E8  |.  68 287A4000   PUSH tt.00407A28                         ; |Address = tt.00407A28
004014ED  |.  FF15 30604000 CALL DWORD PTR DS:[<&KERNEL32.VirtualUnl>; /VirtualUnlock
004014F3  |.  6A 64         PUSH 64
004014F5  |.  E8 56010000   CALL tt.00401650
004014FA  |.  8B0D 307A4000 MOV ECX,DWORD PTR DS:[407A30]
00401500  |.  8B15 2C7A4000 MOV EDX,DWORD PTR DS:[407A2C]
00401506  |.  8BF0          MOV ESI,EAX
00401508  |.  A1 287A4000   MOV EAX,DWORD PTR DS:[407A28]
0040150D  |.  51            PUSH ECX
0040150E  |.  52            PUSH EDX
0040150F  |.  50            PUSH EAX
00401510  |.  68 88714000   PUSH tt.00407188                         ;  ASCII "CR0 = %x CR2 = %x CR3 = %x "
00401515  |.  56            PUSH ESI
00401516  |.  E8 E3000000   CALL tt.004015FE
0040151B  |.  8B3D D8604000 MOV EDI,DWORD PTR DS:[<&USER32.MessageBo>;  USER32.MessageBoxA
00401521  |.  83C4 18       ADD ESP,18
00401524  |.  6A 00         PUSH 0                                   ; /Style = MB_OK|MB_APPLMODAL
00401526  |.  6A 00         PUSH 0                                   ; |Title = NULL
00401528  |.  56            PUSH ESI                                 ; |Text
00401529  |.  6A 00         PUSH 0                                   ; |hOwner = NULL
0040152B  |.  FFD7          CALL EDI                                 ; /MessageBoxA
0040152D  |.  56            PUSH ESI
0040152E  |.  E8 C0000000   CALL tt.004015F3
00401533  |.  68 00010000   PUSH 100
00401538  |.  68 40144000   PUSH tt.00401440
0040153D  |.  C705 207A4000>MOV DWORD PTR DS:[407A20],1388
00401547  |.  E8 04FCFFFF   CALL tt.00401150
0040154C  |.  8B35 20604000 MOV ESI,DWORD PTR DS:[<&KERNEL32.Sleep>] ;  kernel32.Sleep
00401552  |.  83C4 0C       ADD ESP,0C
00401555  |.  68 E8030000   PUSH 3E8                                 ; /Timeout = 1000. ms
0040155A  |.  FFD6          CALL ESI                                 ; /Sleep
0040155C  |.  68 00010000   PUSH 100
00401561  |.  68 40144000   PUSH tt.00401440
00401566  |.  C705 207A4000>MOV DWORD PTR DS:[407A20],0BB8
00401570  |.  E8 DBFBFFFF   CALL tt.00401150
00401575  |.  83C4 08       ADD ESP,8
00401578  |.  68 E8030000   PUSH 3E8
0040157D  |.  FFD6          CALL ESI                                 ;!!!这是调用Sleep，错误！
0040157F  |.  68 00010000   PUSH 100
00401584  |.  68 90144000   PUSH tt.00401490
00401589  |.  E8 C2FBFFFF   CALL tt.00401150
0040158E  |.  83C4 08       ADD ESP,8
00401591  |.  6A 00         PUSH 0
00401593  |.  6A 00         PUSH 0
00401595  |.  68 80714000   PUSH tt.00407180                         ;  ASCII "com3"
0040159A  |.  6A 00         PUSH 0
0040159C  |.  FFD7          CALL EDI                                 ；!!!这是调用MessageBox，错误！
0040159E  |.  5F            POP EDI
0040159F  |.  33C0          XOR EAX,EAX
004015A1  |.  5E            POP ESI
004015A2  /.  C2 1000       RETN 10

每当Call完 401150，返回后，与只用用户态函数调用不同，寄存器的值都会改变！！！而VC6的编译，无论是优化速度，优化大小，禁止优化，都不能避免类似错误。

有什么办法解决这个问题呢？

我想可以用函数指针，通过指针来调用，不会出错，但是这样也太繁了。
哪位大侠有更好的解决办法啊？

发表于 @ 2006年05月17日 13:11:00|评论(1)|编辑

新一篇: 破解-超级俄罗斯方块1.11（Super Rumble Cube） | 旧一篇: 破解-SourceFormatX256cn

#suxiaojack 发表于2007-10-25 14:31:08 IP: 211.94.164.*: 应该是没有申明NTAPI调用方式引起的堆栈问题。

【上篇】ArcEngine中拓扑的使用
【下篇】日本手机开发——DoCoMo手机，表单get提交，action的url的参数丢失

作者: keil

该日志由 keil 于11年前发表在综合分类下，最后更新于 2013年03月27日.
转载请注明: VC6下编译进Ring0代码的疑惑收藏 | 学步园 +复制链接

抱歉!评论已关闭.

学步园

VC6下编译进Ring0代码的疑惑收藏

新一篇: 破解-超级俄罗斯方块1.11（Super Rumble Cube） | 旧一篇: 破解-SourceFormatX256cn

新一篇: 破解-超级俄罗斯方块1.11（Super Rumble Cube） | 旧一篇: 破解-SourceFormatX256cn

评论

作者: keil

书签

最新文章New

本站推荐

返回首页