小弟刚学会逆向于是逆了WinFlash.sys部分程序，大牛来帮忙看看和指教
部分反汇编程序如下：
NTSTATUS DisplayDispatchWrite( PDEVICE_OBJECT DeviceObj, PIRP pIrp)
.text:000104B4 ; =============== S U B R O U T I N E =======================================
.text:000104B4
.text:000104B4 ; Attributes: bp-based frame
.text:000104B4
.text:000104B4 ; int __stdcall sub_104B4(int, PVOID Irp)
.text:000104B4 sub_104B4 proc near ; DATA XREF: start+15o
.text:000104B4
.text:000104B4 var_C = dword ptr -0Ch
.text:000104B4 var_8 = dword ptr -8
.text:000104B4 var_4 = dword ptr -4
.text:000104B4 Irp = dword ptr 0Ch
.text:000104B4
.text:000104B4 push ebp
.text:000104B5 mov ebp, esp
.text:000104B7 sub esp, 0Ch
.text:000104BA push ebx
.text:000104BB push esi
.text:000104BC push edi
.text:000104BD mov edi, [ebp+Irp]
.text:000104C0 xor edx, edx
.text:000104C2 mov ebx, 22202Ch
.text:000104C7 mov eax, [edi+60h]
.text:000104CA mov esi, [edi+0Ch]
.text:000104CD mov [edi+18h], edx
.text:000104D0 mov [edi+1Ch], edx
.text:000104D3 mov ecx, [eax+0Ch]
.text:000104D6 cmp ecx, ebx
.text:000104D8 ja loc_10612
.text:000104DE jz loc_105F3
.text:000104E4 add ebx, 0FFFFFFE8h
.text:000104E7 cmp ecx, ebx
.text:000104E9 ja loc_10595
.text:000104EF jz loc_10582
.text:000104F5 mov ebx, ecx
.text:000104F7 sub ebx, 222000h
.text:000104FD jz short loc_10542
.text:000104FF push 4
.text:00010501 pop ecx
.text:00010502 sub ebx, ecx
.text:00010504 jz short loc_10534
.text:00010506 sub ebx, ecx
.text:00010508 jz short loc_1051F
.text:0001050A sub ebx, 8
.text:0001050D jnz loc_1070B
.text:00010513 mov eax, [esi]
.text:00010515 mov dword_10964, eax
.text:0001051A jmp loc_1070B
.text:0001051F ; ---------------------------------------------------------------------------
.text:0001051F
.text:0001051F loc_1051F: ; CODE XREF: sub_104B4+54j
.text:0001051F mov al, [esi]
.text:00010521 push esi
.text:00010522 push eax
.text:00010523 call sub_10722
.text:00010528 mov dword ptr [edi+1Ch], 10h
.text:0001052F jmp loc_1070B
.text:00010534 ; ---------------------------------------------------------------------------
.text:00010534
.text:00010534 loc_10534: ; CODE XREF: sub_104B4+50j
.text:00010534 mov ax, [esi]
.text:00010537 mov word_10960, ax
.text:0001053D jmp loc_1070B
.text:00010542 ; ---------------------------------------------------------------------------
.text:00010542
.text:00010542 loc_10542: ; CODE XREF: sub_104B4+49j
.text:00010542 mov ebx, [eax+4]
.text:00010545 mov eax, [esi]
.text:00010547 xor ecx, ecx
.text:00010549 push 1 ; CacheType
.text:0001054B push ebx ; NumberOfBytes
.text:0001054C push ecx
.text:0001054D push eax ; PhysicalAddress
.text:0001054E call ds:MmMapIoSpace
.text:00010554 mov [ebp+Irp], eax
.text:00010557 xor eax, eax
.text:00010559 test ebx, ebx
.text:0001055B jbe short loc_10570
.text:0001055D push 4
.text:0001055F pop ecx
.text:00010560
.text:00010560 loc_10560: ; CODE XREF: sub_104B4+BAj
.text:00010560 mov edx, [ebp+Irp]
.text:00010563 mov edx, [eax+edx]
.text:00010566 add eax, ecx
.text:00010568 mov [esi], edx
.text:0001056A add esi, ecx
.text:0001056C cmp eax, ebx
.text:0001056E jb short loc_10560
.text:00010570
.text:00010570 loc_10570: ; CODE XREF: sub_104B4+A7j
.text:00010570 push ebx ; NumberOfBytes
.text:00010571 push [ebp+Irp] ; BaseAddress
.text:00010574 call ds:MmUnmapIoSpace
.text:0001057A mov [edi+1Ch], ebx
.text:0001057D jmp loc_1070B
.text:00010582 ; ---------------------------------------------------------------------------
.text:00010582
.text:00010582 loc_10582: ; CODE XREF: sub_104B4+3Bj
.text:00010582 mov eax, dword_10964
.text:00010587 mov [esi], eax
.text:00010589 mov dword ptr [edi+1Ch], 4
.text:00010590 jmp loc_1070B
.text:00010595 ; ---------------------------------------------------------------------------
.text:00010595
.text:00010595 loc_10595: ; CODE XREF: sub_104B4+35j
.text:00010595 mov eax, ecx
.text:00010597 sub eax, 222018h
.text:0001059C jz short loc_105D6
.text:0001059E push 4
.text:000105A0 pop ecx
.text:000105A1 sub eax, ecx
.text:000105A3 jz short loc_105BF
.text:000105A5 sub eax, ecx
.text:000105A7 jnz loc_1070B
.text:000105AD push dword ptr [esi+4]
.text:000105B0 mov eax, [esi]
.text:000105B2 push eax
.text:000105B3 call sub_1075A
.text:000105B8 mov [esi], eax
.text:000105BA jmp loc_10693
.text:000105BF ; ---------------------------------------------------------------------------
.text:000105BF
.text:000105BF loc_105BF: ; CODE XREF: sub_104B4+EFj
.text:000105BF push dword_10964
.text:000105C5 push esi
.text:000105C6 call sub_107D0
.text:000105CB mov [esi], eax
.text:000105CD add dword_10964, 10h
.text:000105D4 jmp short loc_10606
.text:000105D6 ; ---------------------------------------------------------------------------
.text:000105D6
.text:000105D6 loc_105D6: ; CODE XREF: sub_104B4+E8j
.text:000105D6 push dword_10964
.text:000105DC push esi
.text:000105DD call sub_10790
.text:000105E2 push 10h
.text:000105E4 pop eax
.text:000105E5 add dword_10964, eax
.text:000105EB mov [edi+1Ch], eax
.text:000105EE jmp loc_1070B
.text:000105F3 ; ---------------------------------------------------------------------------
.text:000105F3
.text:000105F3 loc_105F3: ; CODE XREF: sub_104B4+2Aj
.text:000105F3 mov ax, [esi]
.text:000105F6 mov [ebp+var_4], eax
.text:000105F9 mov dx, word ptr [ebp+var_4]
.text:000105FD in al, dx
.text:000105FE mov byte ptr [ebp+Irp+3], al
.text:00010601 mov al, byte ptr [ebp+Irp+3]
.text:00010604 mov [esi], al
.text:00010606
.text:00010606 loc_10606: ; CODE XREF: sub_104B4+120j
.text:00010606 mov dword ptr [edi+1Ch], 1
.text:0001060D jmp loc_1070B
.text:00010612 ; ---------------------------------------------------------------------------
.text:00010612
.text:00010612 loc_10612: ; CODE XREF: sub_104B4+24j
.text:00010612 mov eax, ecx
.text:00010614 sub eax, 222030h
.text:00010619 jz loc_106F7
.text:0001061F push 4
.text:00010621 pop ecx
.text:00010622 sub eax, ecx
.text:00010624 jz loc_106DF
.text:0001062A sub eax, ecx
.text:0001062C jz loc_106C9
.text:00010632 sub eax, ecx
.text:00010634 jz short loc_106B1
.text:00010636 sub eax, ecx
.text:00010638 jz short loc_1069C
.text:0001063A sub eax, ecx
.text:0001063C jz short loc_10668
.text:0001063E sub eax, ecx
.text:00010640 jnz loc_1070B
.text:00010646 mov ax, [esi+4]
.text:0001064A push eax
.text:0001064B mov al, [esi+3]
.text:0001064E push eax
.text:0001064F mov al, [esi+2]
.text:00010652 push eax
.text:00010653 mov al, [esi+1]
.text:00010656 push eax
.text:00010657 mov al, [esi]
.text:00010659 push eax
.text:0001065A call sub_10888
.text:0001065F and dword ptr [edi+1Ch], 0
.text:00010663 jmp loc_1070B
.text:00010668 ; ---------------------------------------------------------------------------
.text:00010668
.text:00010668 loc_10668: ; CODE XREF: sub_104B4+188j
.text:00010668 mov al, [esi]
.text:0001066A mov byte ptr [ebp+var_C], al
.text:0001066D mov al, [esi+1]
.text:00010670 mov byte ptr [ebp+var_8], al
.text:00010673 mov al, [esi+2]
.text:00010676 mov byte ptr [ebp+var_4], al
.text:00010679 mov al, [esi+3]
.text:0001067C mov byte ptr [ebp+Irp], al
.text:0001067F push [ebp+Irp]
.text:00010682 push [ebp+var_4]
.text:00010685 push [ebp+var_8]
.text:00010688 push [ebp+var_C]
.text:0001068B call sub_1085E
.text:00010690 mov [esi], ax
.text:00010693
.text:00010693 loc_10693: ; CODE XREF: sub_104B4+106j
.text:00010693 mov dword ptr [edi+1Ch], 2
.text:0001069A jmp short loc_1070B
.text:0001069C ; ---------------------------------------------------------------------------
.text:0001069C
.text:0001069C loc_1069C: ; CODE XREF: sub_104B4+184j
.text:0001069C push P ; P
.text:000106A2 call ds:ExFreePool
.text:000106A8 and P, 0
.text:000106AF jmp short loc_1070B
.text:000106B1 ; ---------------------------------------------------------------------------
.text:000106B1
.text:000106B1 loc_106B1: ; CODE XREF: sub_104B4+180j
.text:000106B1 push 206B6444h ; Tag
.text:000106B6 push 1000h ; NumberOfBytes
.text:000106BB push edx ; PoolType
.text:000106BC call ds:ExAllocatePoolWithTag
.text:000106C2 mov P, eax
.text:000106C7 jmp short loc_1070B
.text:000106C9 ; ---------------------------------------------------------------------------
.text:000106C9
.text:000106C9 loc_106C9: ; CODE XREF: sub_104B4+178j
.text:000106C9 mov ax, [esi]
.text:000106CC mov [ebp+var_4], eax
.text:000106CF mov eax, [esi+2]
.text:000106D2 mov [ebp+Irp], eax
.text:000106D5 mov dx, word ptr [ebp+var_4]
.text:000106D9 mov eax, [ebp+Irp]
.text:000106DC out dx, eax
.text:000106DD jmp short loc_1070B
.text:000106DF ; ---------------------------------------------------------------------------
.text:000106DF
.text:000106DF loc_106DF: ; CODE XREF: sub_104B4+170j
.text:000106DF mov ax, [esi]
.text:000106E2 mov [ebp+var_4], eax
.text:000106E5 mov dx, word ptr [ebp+var_4]
.text:000106E9 in eax, dx
.text:000106EA mov [ebp+Irp], eax
.text:000106ED mov eax, [ebp+Irp]
.text:000106F0 mov [esi], eax
.text:000106F2 mov [edi+1Ch], ecx
.text:000106F5 jmp short loc_1070B
.text:000106F7 ; ---------------------------------------------------------------------------
.text:000106F7
.text:000106F7 loc_106F7: ; CODE XREF: sub_104B4+165j
.text:000106F7 mov ax, [esi]
.text:000106FA mov [ebp+var_4], eax
.text:000106FD mov al, [esi+2]
.text:00010700 mov byte ptr [ebp+Irp+3], al
.text:00010703 mov dx, word ptr [ebp+var_4]
.text:00010707 mov al, byte ptr [ebp+Irp+3]
.text:0001070A out dx, al
.text:0001070B
.text:0001070B loc_1070B: ; CODE XREF: sub_104B4+59j
.text:0001070B ; sub_104B4+66j ...
.text:0001070B mov esi, [edi+18h]
.text:0001070E xor dl, dl ; PriorityBoost
.text:00010710 mov ecx, edi ; Irp
.text:00010712 call ds:IofCompleteRequest
.text:00010718 mov eax, esi
.text:0001071A pop edi
.text:0001071B pop esi
.text:0001071C pop ebx
.text:0001071D leave
.text:0001071E retn 8
.text:0001071E sub_104B4 endp
.text:0001071E
小弟逆向结果如下：
struct DATA1
{
union
{
struct
{
short s1;//+0
short s2;//+2
};
struct
{
char str[5];//+0
};
ULONG d;//+0
ULONG d1;//+0x4
}
};
NTSTATUS DisplayDispatchWrite( PDEVICE_OBJECT DeviceObj, PIRP pIrp)
{
static int dword_10964;
static short word_10960;
static PCHAR str;
DATA1* p=(DATA1*)pIrp->AssociatedIrp.SystemBuffer;
PIO_STACK_LOCATION Irpsp=IoGetCurrentIrpStackLocation(pIrp);
pIrp->IoStatus.Status=0;
pIrp->IoStatus.Information=0;
ULONG cod=(ULONG)Irpsp->Parameters.DeviceIoControl.IoControlCode;
switch(cod)
{//104E4
case 0x222010: //if(cod==0x222010))
{//10513
dword_10964=p->d;
break;
}
case 0x222008: //if(cod==0x222008)
{//1051F
call 10722(0xFF&((int)p->str[0]),p);
pIrp->IoStatus.Information=0x10;
break;
}
case 0x222004: //if(cod==0x222004)
{//10534
word_10960=p->s1;
break;
}
case 0x222000: //if(cod==0x222000)
{//10542
PULONG pu=MmMapIoSpace(p->d,0,(int)Irpsp->Parameters.DeviceIoControl);
if(Irpsp->Parameters.DeviceIoControl)
{//1055D
PULONG pu2=(PULONG)p;
for(int i=0;i<Irpsp->Parameters.DeviceIoControl;i+=4)
{
pu2=*pu;
pu2++;
}
}
//10570
MmUnmapIoSpace(pu,Irpsp->Parameters.DeviceIoControl);
break;
}
case (0xFFFFFFE8+0x22202C): //if(cod==(0xFFFFFFE8+0x22202C))
{ //10582
p->d=dword_10964;
pIrp->IoStatus.Information=0x4;
break;
}
case 0x222020: //if(cod==0x222020)
{//105AD
p->d=call 1075A(p->d,p->d1);
pIrp->IoStatus.Information=2;
break;
}
case 0x22201C: //if(cod==0x22201C)
{//105BF
p->d=call 107D0(p,dword_10964);
dword_10964+=0x10;
pIrp->IoStatus.Information=1;
break;
}
case 0x222018: //if(cod==0x222018)
{//105D6
call 10790(p,dword_10964);
pIrp->IoStatus.Information=dword_10964+=0x10;
break;
}
case 0x22202C: //if(cod==0x22202C)
{//105F3
__asm{
mov al,p->str[0];
mov dx,p->s1;
in al, dx;
}
pIrp->IoStatus.Information=1;
break;
}
case 0x222030: //if(0x222030==cod)
{//106F7
__asm{
mov dx,p->s1;
mov al,p->str[2];
out dx,al;
}
break;
}
case 0x222034: //if(0x222034==cod)
{//1061F
//106DF
__asm{
mov dx,p->s1;
mov eax,p->s2 & 0xFFFF;
in eax,dx;
}
pIrp->IoStatus.Information=4;
break;
}
case 0x222038: //if(0x222038==cod)
{//1062A
//106C9
__asm{
mov dx,p->s1;
mov eax,p->s2 & 0xFFFF;
out dx, eax;
}
break;
}
case 0x22203C: //if(0x22203C==cod)
{//10632
//106B1
str=ExAllocatePoolWithTag(0,0x1000,0x206B6444);
break;
}
case 0x222040: //if(0x222040==cod)
{//10636
//1069C
ExFreePool(str);
str=0;
break;
}
case 0x222044: //if(0x222044==cod)
{//1063A
//10668
p->str1=(short)call 1085E((int)(p->str[0]&0xFF),(int)(p->str[1]&0xFF),(int)(p->str[2]&0xFF),(int)(p->str[3]&0xFF));
pIrp->IoStatus.Information=2;
break;
}
case 0x222048: //if(0x222048==cod)
{//1063E
//10646
call 10888(0xFF&((int)p->str[0]),0xFF&((int)p->str[1]),0xFF&((int)p->str[2]),0xFF&((int)p->str[3]),0xFF&((int)p->str[4]));
pIrp->IoStatus.Information=0;
break;
}
}
IofCompleteRequest(pIrp,0);
return pIrp->IoStatus.Status;
}
请大牛指教，不甚感激。
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
