贴段98下相同功能的代码 (1千字)
//随便用汇编写了点代码，懒的解释，功能同2000下读取boisvoid* ptrmem=malloc(0xffff);
_asm
{
PUSHAD
PUSH 0
SIDT [ESP-2]
POP EDI ; EDI -> IDT base
ADD EDI, 32 ; EDI -> target Int Entry
MOV ECX,[EDI+4]
MOV CX, WORD PTR [EDI] ; ECX -> original Int Handler
mov ESI,offset pNewIntHandler ; ESI -> new Int Handler
; make the Int Handler address point to pNewIntHandler
MOV [EDI], SI
SHR ESI, 16
MOV [EDI+6], SI
INT 4 ; "call" hooked interrupt
; restore the original Int Handler address
MOV [EDI], CX
SHR ECX, 16
MOV [EDI+6], CX
POPAD
jmp ring0_out
pNewIntHandler:
PUSHAD
MOV ECX,0FFFFh
MOV EAX,0F0000h
MOV EBX,ptrmem
CONTINUE:
MOV DL,SS:[EAX]
MOV [EBX],DL
INC EBX
INC EAX
DEC ECX
JNZ CONTINUE
POPAD
iretd
ring0_out:
}
另外
我发现每次2000启动后1408-140a偏移处代码都不一样
搜寻相异处
1. C:\pll20001.tmp: 65,535 字节
2. C:\pll2000.tmp: 65,535 字节
1408: 90 E9
1409: 47 3E
140A: E8 A8
3 差别 发现。
为什么会变化呢？有知道这几个字节的意思的兄弟么？
pll621
