[转]RING3直接读写磁盘扇区

Tesla.Angela

FROM: http://www.kernelmode.info/forum/viewtopic.php?f=15&t=3677
Author: EP_X0FF

1. #include <windows.h>
   
2. #include "prtl.h"
   
3. 
   
4. #define IOCTL_SCSI_BASE                 FILE_DEVICE_CONTROLLER
   
5. #define FILE_DEVICE_CONTROLLER          0x00000004
   
6. #define IOCTL_ATA_PASS_THROUGH_DIRECT   CTL_CODE(IOCTL_SCSI_BASE, 0x040c, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
   
7. 
   
8. #define ATA_FLAGS_DRDY_REQUIRED         (1 << 0)
   
9. #define ATA_FLAGS_DATA_IN               (1 << 1)
   
10. #define ATA_FLAGS_DATA_OUT              (1 << 2)
    
11. #define ATA_FLAGS_48BIT_COMMAND         (1 << 3)
    
12. #define ATA_FLAGS_USE_DMA               (1 << 4)
    
13. #define ATA_FLAGS_NO_MULTIPLE           (1 << 5)
    
14. 
    
15. typedef struct _ATA_PASS_THROUGH_DIRECT {
    
16.     USHORT Length;
    
17.     USHORT AtaFlags;
    
18.     UCHAR PathId;
    
19.     UCHAR TargetId;
    
20.     UCHAR Lun;
    
21.     UCHAR ReservedAsUchar;
    
22.     ULONG DataTransferLength;
    
23.     ULONG TimeOutValue;
    
24.     ULONG ReservedAsUlong;
    
25.     PVOID DataBuffer;
    
26.     UCHAR PreviousTaskFile[8];
    
27.     UCHAR CurrentTaskFile[8];
    
28. } ATA_PASS_THROUGH_DIRECT, *PATA_PASS_THROUGH_DIRECT;
    
29. 
    
30. #define INBUFFER_SIZE 1024*1024
    
31. 
    
32. int IsFileInfested(LPCTSTR FileName, LPVOID RawData, DWORD BufferSize)
    
33. {
    
34.    ATA_PASS_THROUGH_DIRECT      dio, dioOut;
    
35.    STARTING_VCN_INPUT_BUFFER   base;
    
36.    RETRIEVAL_POINTERS_BUFFER   *ptrs;
    
37.    VOLUME_DISK_EXTENTS         ext;
    
38.    LARGE_INTEGER            ofs, lofs;
    
39.    __int64                  i, k;
    
40. 
    
41.    HANDLE   f = INVALID_HANDLE_VALUE;
    
42.    DWORD   iobytes, SectorsPerCluster = 0, BytesPerSector = 0, c, p = 0;
    
43.    TCHAR   drive[8] = TEXT("\\\\.\\X:\");
    
44.    WORD    DevId[256] = {0};
    
45.    USHORT  AtaFlags;
    
46.    UCHAR   AtaCommand;
    
47. 
    
48.    drive[4] = FileName[0];
    
49.    if ( !GetDiskFreeSpace(&drive[4], &SectorsPerCluster, &BytesPerSector, NULL, NULL) )
    
50.       return -1;
    
51. 
    
52.    ptrs = (RETRIEVAL_POINTERS_BUFFER *)VirtualAlloc(NULL, INBUFFER_SIZE, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
    
53.    while ( ptrs != NULL ) {
    
54.       f = CreateFile(FileName, GENERIC_READ | SYNCHRONIZE, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, NULL, OPEN_EXISTING, 0, NULL);
    
55.       if ( f == INVALID_HANDLE_VALUE )
    
56.          break;
    
57.       base.StartingVcn.QuadPart = 0;
    
58.       if ( !DeviceIoControl(f, FSCTL_GET_RETRIEVAL_POINTERS, &base, sizeof(base), ptrs, INBUFFER_SIZE, &iobytes, NULL) )
    
59.          break;
    
60.       CloseHandle(f);
    
61. 
    
62.       drive[6] = 0;
    
63.       f = CreateFile(drive, GENERIC_READ | SYNCHRONIZE, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, NULL, OPEN_EXISTING, 0, NULL);
    
64.       if ( f == INVALID_HANDLE_VALUE )
    
65.          break;
    
66.       if ( !DeviceIoControl(f, IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS, NULL, 0, &ext, sizeof(ext), &iobytes, NULL) )
    
67.          break;
    
68.       CloseHandle(f);
    
69. 
    
70.       f = CreateFile(TEXT("\\\\.\\PHYSICALDRIVE0"), GENERIC_READ | GENERIC_WRITE | SYNCHRONIZE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL);
    
71.       if ( f == INVALID_HANDLE_VALUE )
    
72.          break;
    
73. 
    
74.       ext.Extents[0].StartingOffset.QuadPart /= BytesPerSector;
    
75.       lofs.QuadPart = 0;
    
76. 
    
77.       memset(&DevId, 0, sizeof(DevId));
    
78.       memset(&dio, 0, sizeof(dio));
    
79.       dio.Length = sizeof(dio);
    
80.       dio.AtaFlags = ATA_FLAGS_DRDY_REQUIRED | ATA_FLAGS_DATA_IN;
    
81.       dio.DataTransferLength = 512;
    
82.       dio.TimeOutValue = 1;
    
83.       dio.DataBuffer = &DevId;
    
84.       dio.CurrentTaskFile[6] = 0xEC;
    
85.       DeviceIoControl(f, IOCTL_ATA_PASS_THROUGH_DIRECT, &dio, sizeof(dio), &dioOut, sizeof(dioOut), &iobytes, NULL);
    
86. 
    
87.       if ((DevId[83] & 0x400) != 0) {
    
88.          AtaCommand = 0x25;
    
89.          AtaFlags = ATA_FLAGS_DRDY_REQUIRED | ATA_FLAGS_USE_DMA | ATA_FLAGS_DATA_IN | ATA_FLAGS_48BIT_COMMAND;
    
90.       } else {
    
91.          AtaCommand = 0xC8;
    
92.          AtaFlags = ATA_FLAGS_DRDY_REQUIRED | ATA_FLAGS_USE_DMA | ATA_FLAGS_DATA_IN;
    
93.       }
    
94. 
    
95. 
    
96.       for (c=0; c<ptrs->ExtentCount; c+=1) {
    
97.          ofs.QuadPart = ext.Extents[0].StartingOffset.QuadPart + (ptrs->Extents[c].Lcn.QuadPart*SectorsPerCluster);
    
98.          k = ptrs->Extents[c].NextVcn.QuadPart - lofs.QuadPart;
    
99. 
    
100.          if ( p+(BytesPerSector*SectorsPerCluster) > BufferSize )
     
101.             break;
     
102. 
     
103.          for (i=0; i<k; i+=1) {
     
104.             if ( p+(BytesPerSector*SectorsPerCluster) > BufferSize )
     
105.                break;
     
106.             lofs.QuadPart = ofs.QuadPart + i*SectorsPerCluster;
     
107. 
     
108.             memset(&dio, 0, sizeof(dio));
     
109.             dio.Length = sizeof(dio);
     
110.             dio.AtaFlags = AtaFlags;
     
111.             dio.DataTransferLength = BytesPerSector*SectorsPerCluster;
     
112.             dio.TimeOutValue = 1;
     
113.             dio.DataBuffer = ((LPBYTE)RawData)+p;
     
114. 
     
115.             dio.PreviousTaskFile[2] = (lofs.QuadPart >> 24) & 0xff;
     
116.             dio.PreviousTaskFile[3] = (lofs.QuadPart >> 32) & 0xff;
     
117.             dio.PreviousTaskFile[4] = (lofs.QuadPart >> 40) & 0xff;
     
118. 
     
119.             dio.CurrentTaskFile[1] = (UCHAR)SectorsPerCluster;
     
120.             dio.CurrentTaskFile[2] = lofs.QuadPart & 0xff;
     
121.             dio.CurrentTaskFile[3] = (lofs.QuadPart >> 8) & 0xff;
     
122.             dio.CurrentTaskFile[4] = (lofs.QuadPart >> 16) & 0xff;
     
123.             
     
124.             if (AtaCommand == 0xC8) {
     
125.                dio.CurrentTaskFile[5] = 0x40 | ((lofs.QuadPart >> 24) & 0x0f);
     
126.             } else {
     
127.                dio.CurrentTaskFile[5] = 0x40;
     
128.             }
     
129.             
     
130.             dio.CurrentTaskFile[5] = 0x40;
     
131. 
     
132.             dio.CurrentTaskFile[6] = AtaCommand;
     
133.             DeviceIoControl(f, IOCTL_ATA_PASS_THROUGH_DIRECT, &dio, sizeof(dio), &dioOut, sizeof(dioOut), &iobytes, NULL);
     
134.             p+=(BytesPerSector*SectorsPerCluster);
     
135.          }
     
136.          lofs.QuadPart = ptrs->Extents[c].NextVcn.QuadPart;
     
137.       }
     
138.       CloseHandle(f);
     
139. 
     
140.       VirtualFree(ptrs, 0, MEM_RELEASE);
     
141.       return 0;
     
142.    }
     
143. 
     
144.    if ( f != INVALID_HANDLE_VALUE )
     
145.       CloseHandle(f);
     
146.    if ( ptrs != NULL )
     
147.       VirtualFree(ptrs, 0, MEM_RELEASE);
     
148.    return -1;
     
149. }
     
150. 
     
151. #define sFileName TEXT("C:\\WINDOWS\\system32\\drivers\\fltmgr.sys")
     
152. 
     
153. void main()
     
154. {
     
155.    LPVOID buffer;
     
156.    HANDLE   f;
     
157.    DWORD   iobytes, fsize = 0;
     
158. 
     
159.    
     
160. 
     
161.    f = CreateFile(sFileName, GENERIC_READ | SYNCHRONIZE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL);
     
162.    if ( f != INVALID_HANDLE_VALUE ) {
     
163.       fsize = GetFileSize(f, NULL);
     
164.       CloseHandle(f);
     
165.    }
     
166. 
     
167.    buffer = VirtualAlloc(NULL, fsize, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
     
168.    memset(buffer, 0xcc, fsize);
     
169. 
     
170.    IsFileInfested(sFileName, buffer, fsize);
     
171.    f = CreateFile(TEXT("Z:\\TEMP\\4321.dmp"), GENERIC_READ | GENERIC_WRITE | SYNCHRONIZE, FILE_SHARE_READ, NULL, CREATE_ALWAYS, 0, NULL);
     
172.    if (f != INVALID_HANDLE_VALUE) {
     
173.       WriteFile(f, buffer, fsize, &iobytes, NULL);
     
174.       CloseHandle(f);
     
175.    }
     
176.    Sleep(0);
     
177. }

复制代码

但EP_X0FF表示：Do you understrand with current hardware + newest Windows installed in EFI mode all legacy BIOS bootkits are no longer work? And after few years computers with BIOS you can only see in the scrapyard?

andylau004

顶。

0xAA55

翻译过来就是：现在的硬件＋最新的Windows在EFI模式下，所有的BIOS bootkit将不再有效你造吗？几年后，你只能在废料厂找到有BIOS的电脑。（他说的BIOS指的是Legacy方式引导的电脑。）

但事实上还是有无数国人在“坚持”使用XP。