fasm Ke386SetIoAccessMap

来源：互联网发布：sql多表联合查询编辑：程序博客网时间：2024/05/16 20:29

nt!Ke386SetIoAccessMap:804f8160 8bff            mov     edi,edi804f8162 55              push    ebp804f8163 8bec            mov     ebp,esp804f8165 57              push    edi804f8166 8b7d08          mov     edi,dword ptr [ebp+8]  ;MapNumber804f8169 83ff01          cmp     edi,1804f816c 7759            ja      nt!Ke386SetIoAccessMap+0x67 (804f81c7)804f816e 85ff            test    edi,edi804f8170 7455            je      nt!Ke386SetIoAccessMap+0x67 (804f81c7)804f8172 53              push    ebx804f8173 56              push    esi804f8174 ff158c864d80    call    dword ptr [nt!_imp__KeRaiseIrqlToSynchLevel (804d868c)]804f817a 8ad8            mov     bl,al804f817c 3ea120f0dfff    mov     eax,dword ptr ds:[0FFDFF020h]804f8182 8bd0            mov     edx,eax804f8184 b800f0dfff      mov     eax,0FFDFF000h804f8189 69ff24200000    imul    edi,edi,2024h              ;sizeof.KiIoAccessMap804f818f 8b4040          mov     eax,dword ptr [eax+40h]    ;TSS804f8192 8b750c          mov     esi,dword ptr [ebp+0Ch]804f8195 8dbc0764e0ffff  lea     edi,[edi+eax-1F9Ch]804f819c b900080000      mov     ecx,800h804f81a1 f3a5            rep movs dword ptr es:[edi],dword ptr [esi]804f81a3 8b4204          mov     eax,dword ptr [edx+4]804f81a6 8b4844          mov     ecx,dword ptr [eax+44h]804f81a9 b800f0dfff      mov     eax,0FFDFF000h804f81ae 668b4930        mov     cx,word ptr [ecx+30h]804f81b2 8b4040          mov     eax,dword ptr [eax+40h]804f81b5 66894866        mov     word ptr [eax+66h],cx804f81b9 8acb            mov     cl,bl804f81bb ff151c874d80    call    dword ptr [nt!_imp_KfLowerIrql (804d871c)]804f81c1 5e              pop     esi804f81c2 b001            mov     al,1804f81c4 5b              pop     ebx804f81c5 eb02            jmp     nt!Ke386SetIoAccessMap+0x69 (804f81c9)804f81c7 32c0            xor     al,al804f81c9 5f              pop     edi804f81ca 5d              pop     ebp804f81cb c20800          ret     8

fasm:

proc Ke386SetIoAccessMap uses esi edi, MapNumber, IopmBuffer    xor     eax,eax    mov     edi,[MapNumber]    cmp     edi,IOPM_COUNT    ja      .exit                               ;FALSE    test    edi,edi    jz      .exit                               ;FALSE    call    [KeRaiseIrqlToSynchLevel]    push    eax    ;--------------------------------------------    mov     eax,[kpcr.TSS]                      ;KPCR->TSS    mov     edx,eax    lea     edi,[eax+KTSS.IoMaps.IoMap]         ;KPCR->TSS->KiIoAccessMap[0]->IoMap    mov     esi,[IopmBuffer]    mov     ecx,IOPM_SIZE/4                     ;=8192/4 IOPM_SIZE    rep     movsd        mov     eax,[kpcr.Prcb]                     ;KPCR->Prcb    mov     eax,[eax+KPRCB.CurrentThread]       ;KPCR->Prcb->CurrentThread    mov     eax,[eax+KTHREAD.ApcState.Process]  ;KPCR->Prcb->CurrentThread->ApcState.Process    mov     ax ,[eax+KPROCESS.IopmOffset]    mov     [edx+KTSS.IoMapBase],ax             ;KPCR->TSS->IoMapBase = IopmOffset    ;--------------------------------------------    pop     ecx    call    [KfLowerIrql]                       ;cl    mov     al,1                                ;TRUE.exit:    retendp

在winxp 和win2003上测试效果: