【转】RING3直接读写磁盘扇区

0xAA55

FROM: http://www.kernelmode.info/forum/viewtopic.php?f=15&t=3677
Author: EP_X0FF

1. #include <windows.h>
   
2. #include "prtl.h"
   
3. 
   
4. #define IOCTL_SCSI_BASE                 FILE_DEVICE_CONTROLLER
   
5. #define FILE_DEVICE_CONTROLLER          0x00000004
   
6. #define IOCTL_ATA_PASS_THROUGH_DIRECT   CTL_CODE(IOCTL_SCSI_BASE, 0x040c, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
   
7. 
   
8. #define ATA_FLAGS_DRDY_REQUIRED         (1 << 0)
   
9. #define ATA_FLAGS_DATA_IN               (1 << 1)
   
10. #define ATA_FLAGS_DATA_OUT              (1 << 2)
    
11. #define ATA_FLAGS_48BIT_COMMAND         (1 << 3)
    
12. #define ATA_FLAGS_USE_DMA               (1 << 4)
    
13. #define ATA_FLAGS_NO_MULTIPLE           (1 << 5)
    
14. 
    
15. typedef struct _ATA_PASS_THROUGH_DIRECT
    
16. {
    
17.     USHORT Length;
    
18.     USHORT AtaFlags;
    
19.     UCHAR PathId;
    
20.     UCHAR TargetId;
    
21.     UCHAR Lun;
    
22.     UCHAR ReservedAsUchar;
    
23.     ULONG DataTransferLength;
    
24.     ULONG TimeOutValue;
    
25.     ULONG ReservedAsUlong;
    
26.     PVOID DataBuffer;
    
27.     UCHAR PreviousTaskFile[8];
    
28.     UCHAR CurrentTaskFile[8];
    
29. } ATA_PASS_THROUGH_DIRECT, *PATA_PASS_THROUGH_DIRECT;
    
30. 
    
31. #define INBUFFER_SIZE 1024*1024
    
32. 
    
33. int IsFileInfested(LPCTSTR FileName, LPVOID RawData, DWORD BufferSize)
    
34. {
    
35.    ATA_PASS_THROUGH_DIRECT      dio, dioOut;
    
36.    STARTING_VCN_INPUT_BUFFER   base;
    
37.    RETRIEVAL_POINTERS_BUFFER   *ptrs;
    
38.    VOLUME_DISK_EXTENTS         ext;
    
39.    LARGE_INTEGER            ofs, lofs;
    
40.    __int64                  i, k;
    
41. 
    
42.    HANDLE   f = INVALID_HANDLE_VALUE;
    
43.    DWORD   iobytes, SectorsPerCluster = 0, BytesPerSector = 0, c, p = 0;
    
44.    TCHAR   drive[8] = TEXT("\\\\.\\X:\");
    
45.    WORD    DevId[256] = {0};
    
46.    USHORT  AtaFlags;
    
47.    UCHAR   AtaCommand;
    
48. 
    
49.    drive[4] = FileName[0];
    
50.    if ( !GetDiskFreeSpace(&drive[4], &SectorsPerCluster, &BytesPerSector, NULL, NULL) )
    
51.       return -1;
    
52. 
    
53.    ptrs = (RETRIEVAL_POINTERS_BUFFER *)VirtualAlloc(NULL, INBUFFER_SIZE, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
    
54.    while ( ptrs != NULL ) {
    
55.       f = CreateFile(FileName, GENERIC_READ | SYNCHRONIZE, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, NULL, OPEN_EXISTING, 0, NULL);
    
56.       if ( f == INVALID_HANDLE_VALUE )
    
57.          break;
    
58.       base.StartingVcn.QuadPart = 0;
    
59.       if ( !DeviceIoControl(f, FSCTL_GET_RETRIEVAL_POINTERS, &base, sizeof(base), ptrs, INBUFFER_SIZE, &iobytes, NULL) )
    
60.          break;
    
61.       CloseHandle(f);
    
62. 
    
63.       drive[6] = 0;
    
64.       f = CreateFile(drive, GENERIC_READ | SYNCHRONIZE, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, NULL, OPEN_EXISTING, 0, NULL);
    
65.       if ( f == INVALID_HANDLE_VALUE )
    
66.          break;
    
67.       if ( !DeviceIoControl(f, IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS, NULL, 0, &ext, sizeof(ext), &iobytes, NULL) )
    
68.          break;
    
69.       CloseHandle(f);
    
70. 
    
71.       f = CreateFile(TEXT("\\\\.\\PHYSICALDRIVE0"), GENERIC_READ | GENERIC_WRITE | SYNCHRONIZE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL);
    
72.       if ( f == INVALID_HANDLE_VALUE )
    
73.          break;
    
74. 
    
75.       ext.Extents[0].StartingOffset.QuadPart /= BytesPerSector;
    
76.       lofs.QuadPart = 0;
    
77. 
    
78.       memset(&DevId, 0, sizeof(DevId));
    
79.       memset(&dio, 0, sizeof(dio));
    
80.       dio.Length = sizeof(dio);
    
81.       dio.AtaFlags = ATA_FLAGS_DRDY_REQUIRED | ATA_FLAGS_DATA_IN;
    
82.       dio.DataTransferLength = 512;
    
83.       dio.TimeOutValue = 1;
    
84.       dio.DataBuffer = &DevId;
    
85.       dio.CurrentTaskFile[6] = 0xEC;
    
86.       DeviceIoControl(f, IOCTL_ATA_PASS_THROUGH_DIRECT, &dio, sizeof(dio), &dioOut, sizeof(dioOut), &iobytes, NULL);
    
87. 
    
88.       if ((DevId[83] & 0x400) != 0) {
    
89.          AtaCommand = 0x25;
    
90.          AtaFlags = ATA_FLAGS_DRDY_REQUIRED | ATA_FLAGS_USE_DMA | ATA_FLAGS_DATA_IN | ATA_FLAGS_48BIT_COMMAND;
    
91.       } else {
    
92.          AtaCommand = 0xC8;
    
93.          AtaFlags = ATA_FLAGS_DRDY_REQUIRED | ATA_FLAGS_USE_DMA | ATA_FLAGS_DATA_IN;
    
94.       }
    
95. 
    
96. 
    
97.       for (c=0; c<ptrs->ExtentCount; c+=1) {
    
98.          ofs.QuadPart = ext.Extents[0].StartingOffset.QuadPart + (ptrs->Extents[c].Lcn.QuadPart*SectorsPerCluster);
    
99.          k = ptrs->Extents[c].NextVcn.QuadPart - lofs.QuadPart;
    
100. 
     
101.          if ( p+(BytesPerSector*SectorsPerCluster) > BufferSize )
     
102.             break;
     
103. 
     
104.          for (i=0; i<k; i+=1) {
     
105.             if ( p+(BytesPerSector*SectorsPerCluster) > BufferSize )
     
106.                break;
     
107.             lofs.QuadPart = ofs.QuadPart + i*SectorsPerCluster;
     
108. 
     
109.             memset(&dio, 0, sizeof(dio));
     
110.             dio.Length = sizeof(dio);
     
111.             dio.AtaFlags = AtaFlags;
     
112.             dio.DataTransferLength = BytesPerSector*SectorsPerCluster;
     
113.             dio.TimeOutValue = 1;
     
114.             dio.DataBuffer = ((LPBYTE)RawData)+p;
     
115. 
     
116.             dio.PreviousTaskFile[2] = (lofs.QuadPart >> 24) & 0xff;
     
117.             dio.PreviousTaskFile[3] = (lofs.QuadPart >> 32) & 0xff;
     
118.             dio.PreviousTaskFile[4] = (lofs.QuadPart >> 40) & 0xff;
     
119. 
     
120.             dio.CurrentTaskFile[1] = (UCHAR)SectorsPerCluster;
     
121.             dio.CurrentTaskFile[2] = lofs.QuadPart & 0xff;
     
122.             dio.CurrentTaskFile[3] = (lofs.QuadPart >> 8) & 0xff;
     
123.             dio.CurrentTaskFile[4] = (lofs.QuadPart >> 16) & 0xff;
     
124.             
     
125.             if (AtaCommand == 0xC8) {
     
126.                dio.CurrentTaskFile[5] = 0x40 | ((lofs.QuadPart >> 24) & 0x0f);
     
127.             } else {
     
128.                dio.CurrentTaskFile[5] = 0x40;
     
129.             }
     
130.             
     
131.             dio.CurrentTaskFile[5] = 0x40;
     
132. 
     
133.             dio.CurrentTaskFile[6] = AtaCommand;
     
134.             DeviceIoControl(f, IOCTL_ATA_PASS_THROUGH_DIRECT, &dio, sizeof(dio), &dioOut, sizeof(dioOut), &iobytes, NULL);
     
135.             p+=(BytesPerSector*SectorsPerCluster);
     
136.          }
     
137.          lofs.QuadPart = ptrs->Extents[c].NextVcn.QuadPart;
     
138.       }
     
139.       CloseHandle(f);
     
140. 
     
141.       VirtualFree(ptrs, 0, MEM_RELEASE);
     
142.       return 0;
     
143.    }
     
144. 
     
145.    if ( f != INVALID_HANDLE_VALUE )
     
146.       CloseHandle(f);
     
147.    if ( ptrs != NULL )
     
148.       VirtualFree(ptrs, 0, MEM_RELEASE);
     
149.    return -1;
     
150. }
     
151. 
     
152. #define sFileName TEXT("C:\\WINDOWS\\system32\\drivers\\fltmgr.sys")
     
153. 
     
154. void main()
     
155. {
     
156.    LPVOID buffer;
     
157.    HANDLE   f;
     
158.    DWORD   iobytes, fsize = 0;
     
159. 
     
160.    
     
161. 
     
162.    f = CreateFile(sFileName, GENERIC_READ | SYNCHRONIZE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL);
     
163.    if ( f != INVALID_HANDLE_VALUE ) {
     
164.       fsize = GetFileSize(f, NULL);
     
165.       CloseHandle(f);
     
166.    }
     
167. 
     
168.    buffer = VirtualAlloc(NULL, fsize, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
     
169.    memset(buffer, 0xcc, fsize);
     
170. 
     
171.    IsFileInfested(sFileName, buffer, fsize);
     
172.    f = CreateFile(TEXT("Z:\\TEMP\\4321.dmp"), GENERIC_READ | GENERIC_WRITE | SYNCHRONIZE, FILE_SHARE_READ, NULL, CREATE_ALWAYS, 0, NULL);
     
173.    if (f != INVALID_HANDLE_VALUE) {
     
174.       WriteFile(f, buffer, fsize, &iobytes, NULL);
     
175.       CloseHandle(f);
     
176.    }
     
177.    Sleep(0);
     
178. }

复制代码

但EP_X0FF表示：Do you understrand with current hardware + newest Windows installed in EFI mode all legacy BIOS bootkits are no longer work? And after few years computers with BIOS you can only see in the scrapyard?

翻译过来就是：现在的硬件＋最新的Windows在EFI模式下，所有的BIOS bootkit将不再有效你造吗？几年后，你只能在废料厂找到有BIOS的电脑。（他说的BIOS指的是Legacy方式引导的电脑。）

0xAA55

我觉得……现在“坚持”用XP的人还是很多，恐怕完全淘汰Legacy Boot要很久以后喽

stlcours

ring3说明是用户级别的程序？这样也可读写磁盘扇区？

话说谢谢楼主的搬运，不搬运压根不知道有这回事，知道了或许可以自己研究一下～

tx7790

谢谢楼主分享，意思就是UEFI的不起作用了吗？