首页
社区
课程
招聘
逆向工程 - 取 CPU 信息
2004-11-17 20:03 8760

逆向工程 - 取 CPU 信息

2004-11-17 20:03
8760
前几天破解了一个软件, 软件的算法倒没什么, 不过学会了取 CPU 和 Harddisk 信息,  网上搜索一下, 取 Harddisk 信息的程序网上有, 取 CPU 信息的也有, 但没下面详细, 所以写了个 C++ 程序, 演示一下 嵌入汇编 和 CPUID 指令.  有兴趣的大侠可以跟一下 CPUZ 这类软件, 学到更多东西.


#include <windows.h> 
#include <iostream.h> 
#include <stdio.h> 

int main()
{
	char OEMString[13];
	char Company[64];

	int iEAXValue,iEBXValue,iECXValue,iEDXValue;
	
	_asm {
			mov eax,0
			cpuid
			mov DWORD PTR OEMString,	ebx
			mov DWORD PTR OEMString+4,	edx
			mov DWORD PTR OEMString+8,	ecx
		}
	
	OEMString[12]=0;


	if      ( !strcmp(OEMString, "GenuineIntel"))   strcpy(Company, "Intel Corporation");
	else if ( !strcmp(OEMString, "UMC UMC UMC "))   strcpy(Company, "United Microelectronics Corp.");
	else if ( !strcmp(OEMString, "AuthenticAMD"))   strcpy(Company, "Advanced Micro Devices");
	else if ( !strcmp(OEMString, "AMD ISBETTER"))   strcpy(Company, "Advanced Micro Devices");
	else if ( !strcmp(OEMString, "CyrixInstead"))   strcpy(Company, "Cyrix Corp., VIA Inc.");
	else if ( !strcmp(OEMString, "NexGenDriven"))   strcpy(Company, "NexGen Inc., Advanced Micro Devices");
	else if ( !strcmp(OEMString, "CentaurHauls"))   strcpy(Company, "IDT\\Centaur, Via Inc.");
	else if ( !strcmp(OEMString, "RiseRiseRise"))   strcpy(Company, "Rise");
	else if ( !strcmp(OEMString, "GenuineTMx86"))   strcpy(Company, "Transmeta");
	else if ( !strcmp(OEMString, "TransmetaCPU"))   strcpy(Company, "Transmeta");
	else if ( !strcmp(OEMString, "Geode By NSC"))   strcpy(Company, "National Semiconductor");

	cout<< "This CPU's OEM String is:"<< OEMString<< endl;
	cout<< "The cpu is product by "<<Company<<endl;
	
	_asm {
			mov eax,1
			cpuid
			mov iEAXValue,eax
			mov iEBXValue,ebx
			mov iECXValue,ecx
			mov iEDXValue,edx
		}

	int iCPUType  =(0x0000F000 & iEAXValue) >> 12;
	int iCPUFamily=(0x00000F00 & iEAXValue) >> 8;
	int iCPUModel =(0x000000F0 & iEAXValue) >> 4;
	int iCPUStep  =(0x0000000F & iEAXValue);
    
	cout << "CPU Type is: "     <<iCPUType   <<endl;
	cout << "CPU Family is: "   <<iCPUFamily <<endl;
	cout << "CPU Model is: "    <<iCPUModel  <<endl;
	cout << "CPU Stepping is: " <<iCPUStep   <<endl;
	
	char Specification[49];
	
	_asm {
			mov eax,0x80000002
			cpuid
			mov DWORD PTR Specification,	eax
			mov DWORD PTR Specification+4,	ebx
			mov DWORD PTR Specification+8,	ecx
			mov DWORD PTR Specification+12,	edx
		}

	_asm {
			mov eax,0x80000003
			cpuid
			mov DWORD PTR Specification+16,	eax
			mov DWORD PTR Specification+20,	ebx
			mov DWORD PTR Specification+24,	ecx
			mov DWORD PTR Specification+28,	edx
		}

	_asm {
			mov eax,0x80000004
			cpuid
			mov DWORD PTR Specification+32,	eax
			mov DWORD PTR Specification+36,	ebx
			mov DWORD PTR Specification+40,	ecx
			mov DWORD PTR Specification+44,	edx
		}

    Specification[48]=0;
    
	cout << "CPU Specification is:" <<Specification <<endl;

	getchar();
	return 0;
}


我的运行结果:

This CPU's OEM String is:AuthenticAMD
The cpu is product by Advanced Micro Devices
CPU Type is:0
CPU Family is:6
CPU Model is:10
CPU Stepping is:0
CPU Specification is:AMD Athlon(tm) XP 3200+

[培训]内核驱动高级班,冲击BAT一流互联网大厂工 作,每周日13:00-18:00直播授课

收藏
点赞7
打赏
分享
最新回复 (12)
雪    币: 12198
活跃值: (3352)
能力值: ( LV15,RANK:1565 )
在线值:
发帖
回帖
粉丝
AloneWolf 3 2004-11-17 20:56
2
0
呵呵...支持一下.以前还真没取过CpuID...:D
雪    币: 339
活跃值: (1510)
能力值: ( LV13,RANK:970 )
在线值:
发帖
回帖
粉丝
nbw 24 2004-11-17 22:10
3
0
{ Assembly function to get CPU type including Pentium and later }
push DS
{ First check for an 8086 CPU }
{ Bits 12-15 of the FLAGS register are always set on the }
{ 8086 processor. }
pushf { save EFLAGS }
pop bx { store EFLAGS in BX }
mov ax,0fffh { clear bits 12-15 }
and ax,bx { in EFLAGS }
push ax { store new EFLAGS value on stack }
popf { replace current EFLAGS value }

pushf { set new EFLAGS }
pop ax { store new EFLAGS in AX }
and ax,0f000h { if bits 12-15 are set, then CPU }
cmp ax,0f000h { is an 8086/8088 }
mov ax, i8086CPU { turn on 8086/8088 flag }
je @@End_CpuType

{ 80286 CPU check }
{ Bits 12-15 of the FLAGS register are always clear on the }
{ 80286 processor. }
{ Commented out because 'pop ax' crashes it to the DOS prompt when running }
{ with a Delphi form on some Machines.}
{ or bx,0f000h } { try to set bits 12-15 }

{ push bx }
{ popf }
{ pushf }
{ pop ax } { This crashes Delphi programs on some machines }
{ and ax,0f000h } { if bits 12-15 are cleared, CPU=80286 }
{ mov ax, i286CPU } { turn on 80286 flag }
{ jz @@End_CpuType }

{ To test for 386 or better, we need to use 32 bit instructions,
but the 16-bit Delphi assembler does not recognize the 32 bit opcodes
or operands. Instead, use the 66H operand size prefix to change

each instruction to its 32-bit equivalent. For 32-bit immediate
operands, we also need to store the high word of the operand immediately
following the instruction. The 32-bit instruction is shown in a comment
after the 66H instruction.
}

{ i386 CPU check }
{ The AC bit, bit #18, is a new bit introduced in the EFLAGS }
{ register on the i486 DX CPU to generate alignment faults. }
{ This bit can not be set on the i386 CPU. }

db 66h { pushfd }
pushf
db 66h { pop eax }
pop ax { get original EFLAGS }
db 66h { mov ecx, eax }
mov cx,ax { save original EFLAGS }
db 66h { xor eax,40000h }
xor ax,0h { flip AC bit in EFLAGS }

dw 0004h
db 66h { push eax }
push ax { save for EFLAGS }
db 66h { popfd }
popf { copy to EFLAGS }
db 66h { pushfd }
pushf { push EFLAGS }
db 66h { pop eax }
pop ax { get new EFLAGS value }
db 66h { xor eax,ecx }
xor ax,cx { can't toggle AC bit, CPU=Intel386 }
mov ax, i386CPU { turn on 386 flag }
je @@End_CpuType

{ i486 DX CPU / i487 SX MCP and i486 SX CPU checking }
{ Checking for ability to set/clear ID flag (Bit 21) in EFLAGS }
{ which indicates the presence of a processor }
{ with the ability to use the CPUID instruction. }

db 66h { pushfd }
pushf { push original EFLAGS }
db 66h { pop eax }
pop ax { get original EFLAGS in eax }
db 66h { mov ecx, eax }
mov cx,ax { save original EFLAGS in ecx }
db 66h { xor eax,200000h }
xor ax,0h { flip ID bit in EFLAGS }
dw 0020h
db 66h { push eax }
push ax { save for EFLAGS }
db 66h { popfd }
popf { copy to EFLAGS }
db 66h { pushfd }
pushf { push EFLAGS }
db 66h { pop eax }
pop ax { get new EFLAGS value }
db 66h { xor eax, ecx }
xor ax, cx

mov ax, i486CPU { turn on i486 flag }
je @@End_CpuType { if ID bit cannot be changed, CPU=486 }
{ without CPUID instruction functionality }

{ Execute CPUID instruction to determine vendor, family, }
{ model and stepping. The use of the CPUID instruction used }
{ in this program can be used for B0 and later steppings }
{ of the P5 processor. }
db 66h { mov eax, 1 }
mov ax, 1 { set up for CPUID instruction }
dw 0
db 66h { cpuid }
db 0Fh { Hardcoded opcode for CPUID instruction }
db 0a2h
db 66h { and eax, 0F00H }
and ax, 0F00H { mask everything but family }

dw 0
db 66h { shr eax, 8 }
shr ax, 8 { shift the cpu type down to the low byte }
sub ax, 1 { subtract 1 to map to TCpuType }

@@End_CpuType:
pop ds

这段Code comes from Intel
雪    币: 236
活跃值: (48)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
sixfor 2004-11-17 23:01
4
0
呵呵,多谢啦,正好有需要
雪    币: 85496
活跃值: (198820)
能力值: (RANK:10 )
在线值:
发帖
回帖
粉丝
linhanshi 2004-11-17 23:22
5
0
支持!!!
雪    币: 226
活跃值: (115)
能力值: ( LV8,RANK:130 )
在线值:
发帖
回帖
粉丝
skyXnet 3 2004-11-18 11:05
6
0
这些指令好像在80x86汇编中有涉及到
雪    币: 61
活跃值: (160)
能力值: ( LV9,RANK:170 )
在线值:
发帖
回帖
粉丝
pendan2001 4 2004-11-18 11:16
7
0
支持!!!;)
雪    币: 201
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
珊珊 2004-11-18 11:39
8
0
我也是学计算机的,我也学过汇编语言和C++可我什么也不懂,受够了,大学生活好无聊呀
雪    币: 323
活跃值: (579)
能力值: ( LV12,RANK:450 )
在线值:
发帖
回帖
粉丝
springkang[DFCG 11 2004-11-18 11:43
9
0
高手的作品当然要收藏了!:p
多谢simonzh2000,nbw二位高手!
雪    币: 390
活跃值: (707)
能力值: ( LV12,RANK:650 )
在线值:
发帖
回帖
粉丝
firstrose 16 2004-11-18 12:19
10
0
在ralf brown的中断大全里有检测cpu的相关信息,很值得参考。
雪    币: 241
活跃值: (160)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
xiluoyou 2004-11-18 12:48
11
0
楼主是VC下编译的吗?我用DEV-C++无法通过!:(
雪    币: 396
活跃值: (1078)
能力值: ( LV9,RANK:970 )
在线值:
发帖
回帖
粉丝
simonzh2000 24 2004-11-18 13:42
12
0
最初由 xiluoyou 发布
楼主是VC下编译的吗?我用DEV-C++无法通过!:(


我用 VC6.

DEV-C++ 支持 CPUID 指令吗?
雪    币: 245
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
binglan212 2004-11-18 20:21
13
0
不支持内嵌汇编指令。用c写几条垃圾语句,然后用OD改

我还是喜欢VC++
游客
登录 | 注册 方可回帖
返回