首页
社区
课程
招聘
逆向工程 - 取 CPU 信息
发表于: 2004-11-17 20:03 9125

逆向工程 - 取 CPU 信息

2004-11-17 20:03
9125

前几天破解了一个软件, 软件的算法倒没什么, 不过学会了取 CPU 和 Harddisk 信息,  网上搜索一下, 取 Harddisk 信息的程序网上有, 取 CPU 信息的也有, 但没下面详细, 所以写了个 C++ 程序, 演示一下 嵌入汇编 和 CPUID 指令.  有兴趣的大侠可以跟一下 CPUZ 这类软件, 学到更多东西.


[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)

收藏
免费 7
支持
分享
最新回复 (12)
雪    币: 13076
活跃值: (4077)
能力值: ( LV15,RANK:1673 )
在线值:
发帖
回帖
粉丝
2
呵呵...支持一下.以前还真没取过CpuID...:D
2004-11-17 20:56
0
雪    币: 339
活跃值: (1510)
能力值: ( LV13,RANK:970 )
在线值:
发帖
回帖
粉丝
3
{ Assembly function to get CPU type including Pentium and later }
push DS
{ First check for an 8086 CPU }
{ Bits 12-15 of the FLAGS register are always set on the }
{ 8086 processor. }
pushf { save EFLAGS }
pop bx { store EFLAGS in BX }
mov ax,0fffh { clear bits 12-15 }
and ax,bx { in EFLAGS }
push ax { store new EFLAGS value on stack }
popf { replace current EFLAGS value }

pushf { set new EFLAGS }
pop ax { store new EFLAGS in AX }
and ax,0f000h { if bits 12-15 are set, then CPU }
cmp ax,0f000h { is an 8086/8088 }
mov ax, i8086CPU { turn on 8086/8088 flag }
je @@End_CpuType

{ 80286 CPU check }
{ Bits 12-15 of the FLAGS register are always clear on the }
{ 80286 processor. }
{ Commented out because 'pop ax' crashes it to the DOS prompt when running }
{ with a Delphi form on some Machines.}
{ or bx,0f000h } { try to set bits 12-15 }

{ push bx }
{ popf }
{ pushf }
{ pop ax } { This crashes Delphi programs on some machines }
{ and ax,0f000h } { if bits 12-15 are cleared, CPU=80286 }
{ mov ax, i286CPU } { turn on 80286 flag }
{ jz @@End_CpuType }

{ To test for 386 or better, we need to use 32 bit instructions,
but the 16-bit Delphi assembler does not recognize the 32 bit opcodes
or operands. Instead, use the 66H operand size prefix to change

each instruction to its 32-bit equivalent. For 32-bit immediate
operands, we also need to store the high word of the operand immediately
following the instruction. The 32-bit instruction is shown in a comment
after the 66H instruction.
}

{ i386 CPU check }
{ The AC bit, bit #18, is a new bit introduced in the EFLAGS }
{ register on the i486 DX CPU to generate alignment faults. }
{ This bit can not be set on the i386 CPU. }

db 66h { pushfd }
pushf
db 66h { pop eax }
pop ax { get original EFLAGS }
db 66h { mov ecx, eax }
mov cx,ax { save original EFLAGS }
db 66h { xor eax,40000h }
xor ax,0h { flip AC bit in EFLAGS }

dw 0004h
db 66h { push eax }
push ax { save for EFLAGS }
db 66h { popfd }
popf { copy to EFLAGS }
db 66h { pushfd }
pushf { push EFLAGS }
db 66h { pop eax }
pop ax { get new EFLAGS value }
db 66h { xor eax,ecx }
xor ax,cx { can't toggle AC bit, CPU=Intel386 }
mov ax, i386CPU { turn on 386 flag }
je @@End_CpuType

{ i486 DX CPU / i487 SX MCP and i486 SX CPU checking }
{ Checking for ability to set/clear ID flag (Bit 21) in EFLAGS }
{ which indicates the presence of a processor }
{ with the ability to use the CPUID instruction. }

db 66h { pushfd }
pushf { push original EFLAGS }
db 66h { pop eax }
pop ax { get original EFLAGS in eax }
db 66h { mov ecx, eax }
mov cx,ax { save original EFLAGS in ecx }
db 66h { xor eax,200000h }
xor ax,0h { flip ID bit in EFLAGS }
dw 0020h
db 66h { push eax }
push ax { save for EFLAGS }
db 66h { popfd }
popf { copy to EFLAGS }
db 66h { pushfd }
pushf { push EFLAGS }
db 66h { pop eax }
pop ax { get new EFLAGS value }
db 66h { xor eax, ecx }
xor ax, cx

mov ax, i486CPU { turn on i486 flag }
je @@End_CpuType { if ID bit cannot be changed, CPU=486 }
{ without CPUID instruction functionality }

{ Execute CPUID instruction to determine vendor, family, }
{ model and stepping. The use of the CPUID instruction used }
{ in this program can be used for B0 and later steppings }
{ of the P5 processor. }
db 66h { mov eax, 1 }
mov ax, 1 { set up for CPUID instruction }
dw 0
db 66h { cpuid }
db 0Fh { Hardcoded opcode for CPUID instruction }
db 0a2h
db 66h { and eax, 0F00H }
and ax, 0F00H { mask everything but family }

dw 0
db 66h { shr eax, 8 }
shr ax, 8 { shift the cpu type down to the low byte }
sub ax, 1 { subtract 1 to map to TCpuType }

@@End_CpuType:
pop ds

这段Code comes from Intel
2004-11-17 22:10
0
雪    币: 236
活跃值: (48)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
4
呵呵,多谢啦,正好有需要
2004-11-17 23:01
0
雪    币: 97697
活跃值: (200819)
能力值: (RANK:10 )
在线值:
发帖
回帖
粉丝
5
支持!!!
2004-11-17 23:22
0
雪    币: 226
活跃值: (115)
能力值: ( LV8,RANK:130 )
在线值:
发帖
回帖
粉丝
6
这些指令好像在80x86汇编中有涉及到
2004-11-18 11:05
0
雪    币: 61
活跃值: (160)
能力值: ( LV9,RANK:170 )
在线值:
发帖
回帖
粉丝
7
支持!!!;)
2004-11-18 11:16
0
雪    币: 201
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
8
我也是学计算机的,我也学过汇编语言和C++可我什么也不懂,受够了,大学生活好无聊呀
2004-11-18 11:39
0
雪    币: 323
活跃值: (589)
能力值: ( LV12,RANK:450 )
在线值:
发帖
回帖
粉丝
9
高手的作品当然要收藏了!:p
多谢simonzh2000,nbw二位高手!
2004-11-18 11:43
0
雪    币: 390
活跃值: (707)
能力值: ( LV12,RANK:650 )
在线值:
发帖
回帖
粉丝
10
在ralf brown的中断大全里有检测cpu的相关信息,很值得参考。
2004-11-18 12:19
0
雪    币: 241
活跃值: (160)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
11
楼主是VC下编译的吗?我用DEV-C++无法通过!:(
2004-11-18 12:48
0
雪    币: 398
活跃值: (1078)
能力值: ( LV9,RANK:970 )
在线值:
发帖
回帖
粉丝
12
最初由 xiluoyou 发布
楼主是VC下编译的吗?我用DEV-C++无法通过!:(


我用 VC6.

DEV-C++ 支持 CPUID 指令吗?
2004-11-18 13:42
0
雪    币: 245
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
13
不支持内嵌汇编指令。用c写几条垃圾语句,然后用OD改

我还是喜欢VC++
2004-11-18 20:21
0
游客
登录 | 注册 方可回帖
返回
//