📄 pcidppublic.asm
字号:
TITLE C:\Kernel2000\pcidppublic.c
.386P
include listing.inc
if @Version gt 510
.model FLAT
else
_TEXT SEGMENT PARA USE32 PUBLIC 'CODE'
_TEXT ENDS
_DATA SEGMENT DWORD USE32 PUBLIC 'DATA'
_DATA ENDS
CONST SEGMENT DWORD USE32 PUBLIC 'CONST'
CONST ENDS
_BSS SEGMENT DWORD USE32 PUBLIC 'BSS'
_BSS ENDS
$$SYMBOLS SEGMENT BYTE USE32 'DEBSYM'
$$SYMBOLS ENDS
$$TYPES SEGMENT BYTE USE32 'DEBTYP'
$$TYPES ENDS
_TLS SEGMENT DWORD USE32 PUBLIC 'TLS'
_TLS ENDS
; COMDAT _RtlConvertLongToLargeInteger@4
_TEXT SEGMENT PARA USE32 PUBLIC 'CODE'
_TEXT ENDS
; COMDAT _PCIDPGetDriverVersion@12
_TEXT SEGMENT PARA USE32 PUBLIC 'CODE'
_TEXT ENDS
; COMDAT _PCIDPMapBaseRegs@20
_TEXT SEGMENT PARA USE32 PUBLIC 'CODE'
_TEXT ENDS
; COMDAT _PCIDPUnMap@16
_TEXT SEGMENT PARA USE32 PUBLIC 'CODE'
_TEXT ENDS
; COMDAT _PCIDPMapDMAMem@16
_TEXT SEGMENT PARA USE32 PUBLIC 'CODE'
_TEXT ENDS
; COMDAT _PCIDPCancelMapDMA@16
_TEXT SEGMENT PARA USE32 PUBLIC 'CODE'
_TEXT ENDS
; COMDAT _PCIDPUnMapDMA@16
_TEXT SEGMENT PARA USE32 PUBLIC 'CODE'
_TEXT ENDS
; COMDAT _PCIDPGetPCIRegs@20
_TEXT SEGMENT PARA USE32 PUBLIC 'CODE'
_TEXT ENDS
; COMDAT _PCIDPSetPCIRegs@20
_TEXT SEGMENT PARA USE32 PUBLIC 'CODE'
_TEXT ENDS
; COMDAT _PCIDPRegisterInterrupt@20
_TEXT SEGMENT PARA USE32 PUBLIC 'CODE'
_TEXT ENDS
; COMDAT _PCIDPUnregisterInterrupt@16
_TEXT SEGMENT PARA USE32 PUBLIC 'CODE'
_TEXT ENDS
FLAT GROUP _DATA, CONST, _BSS
ASSUME CS: FLAT, DS: FLAT, SS: FLAT
endif
PUBLIC _PCIDPGetDriverVersion@12
; COMDAT _PCIDPGetDriverVersion@12
_TEXT SEGMENT
_Irp$ = 8
_IoBuffer$ = 12
_OutputBufferLength$ = 16
_PCIDPGetDriverVersion@12 PROC NEAR ; COMDAT
; 28 :
; 29 : // Define variables.
; 30 : NTSTATUS NTStatus;
; 31 : PPCIDP00_GET_VERSION_RECV IoOutput;
; 32 :
; 33 : // Initialize variables.
; 34 : IoOutput = (PPCIDP00_GET_VERSION_RECV)IoBuffer;
; 35 :
; 36 : // Check for adequate output buffer space.
; 37 : if(OutputBufferLength >= sizeof(PCIDP00_GET_VERSION_RECV)){
mov eax, DWORD PTR _Irp$[esp-4]
push 4
pop ecx
cmp DWORD PTR _OutputBufferLength$[esp-4], ecx
jb SHORT $L8426
push esi
; 38 : NTStatus = STATUS_SUCCESS;
; 39 : IoOutput->Version = 0x20020218;
mov esi, DWORD PTR _IoBuffer$[esp]
xor edx, edx
mov DWORD PTR [esi], 537002520 ; 20020218H
; 40 : Irp->IoStatus.Information = sizeof(PCIDP00_GET_VERSION_RECV);
mov DWORD PTR [eax+28], ecx
pop esi
; 41 : }
; 42 :
; 43 : else
jmp SHORT $L8429
$L8426:
; 44 : NTStatus = STATUS_INVALID_BUFFER_SIZE;
mov edx, -1073741306 ; c0000206H
$L8429:
; 45 :
; 46 : Irp->IoStatus.Status = NTStatus;
mov DWORD PTR [eax+24], edx
; 47 : }
ret 12 ; 0000000cH
_PCIDPGetDriverVersion@12 ENDP
_TEXT ENDS
PUBLIC _PCIDPMapBaseRegs@20
EXTRN __imp__RtlInitUnicodeString@8:NEAR
EXTRN __imp__ObReferenceObjectByHandle@24:NEAR
EXTRN __imp__ZwClose@4:NEAR
EXTRN __imp__ZwOpenSection@12:NEAR
EXTRN __imp__ZwMapViewOfSection@40:NEAR
; COMDAT _PCIDPMapBaseRegs@20
; File c:\kernel2000\pcidppublic.c
_TEXT SEGMENT
$SG8483 DB '\', 00H, 'D', 00H, 'e', 00H, 'v', 00H, 'i', 00H, 'c', 00H
DB 'e', 00H, '\', 00H, 'P', 00H, 'h', 00H, 'y', 00H, 's', 00H, 'i'
DB 00H, 'c', 00H, 'a', 00H, 'l', 00H, 'M', 00H, 'e', 00H, 'm', 00H
DB 'o', 00H, 'r', 00H, 'y', 00H, 00H, 00H
_DeviceObject$ = 8
_Irp$ = 12
_IoBuffer$ = 16
_InputBufferLength$ = 20
_OutputBufferLength$ = 24
_LengthOut$ = 20
_VirtualAddress$ = 8
_PhysicalMemoryUnicodeString$ = -28
_ObjectAttributes$ = -52
_SectionOffset$ = -20
_NTStatus$ = -4
_PhysicalMemoryHandle$ = -8
_PhysicalMemorySection$ = -12
_PCIDPMapBaseRegs@20 PROC NEAR ; COMDAT
; 59 : ){
push ebp
mov ebp, esp
sub esp, 52 ; 00000034H
; 60 :
; 61 : // Define variables.
; 62 : ULONG PCIAddress;
; 63 : ULONG Length;
; 64 : ULONG LengthOut;
; 65 : ULONG BusNumber;
; 66 : ULONG VirtualAddress;
; 67 : ULONG MappedLength;
; 68 : ULONG MapIndex;
; 69 : UNICODE_STRING PhysicalMemoryUnicodeString;
; 70 : OBJECT_ATTRIBUTES ObjectAttributes;
; 71 : BOOLEAN HALStatus;
; 72 : PHYSICAL_ADDRESS LongLength;
; 73 : PHYSICAL_ADDRESS FullPCIAddress;
; 74 : PHYSICAL_ADDRESS FullPCIAddressEnd;
; 75 : PHYSICAL_ADDRESS FullLogicalAddress;
; 76 : PHYSICAL_ADDRESS FullLogicalAddressEnd;
; 77 : PHYSICAL_ADDRESS SectionOffset;
; 78 : NTSTATUS NTStatus;
; 79 : HANDLE PhysicalMemoryHandle;
; 80 : PVOID PhysicalMemorySection;
; 81 : ULONG MemorySpace;
; 82 : ULONG MemorySpaceEnd;
; 83 : PPCIDP00_MAP_BASE_REGS_SEND IoInput;
; 84 : PPCIDP00_MAP_BASE_REGS_RECV IoOutput;
; 85 : PPCIDP_EXTENSION ObjExt;
; 86 :
; 87 : // Initialize variables.
; 88 : NTStatus = STATUS_SUCCESS;
; 89 : PhysicalMemoryHandle = NULL;
; 90 : PhysicalMemorySection = NULL;
; 91 : MemorySpace = 0;
; 92 : MemorySpaceEnd = 0;
; 93 : IoInput = (PPCIDP00_MAP_BASE_REGS_SEND)IoBuffer;
; 94 : IoOutput = (PPCIDP00_MAP_BASE_REGS_RECV)IoBuffer;
; 95 : ObjExt = (PPCIDP_EXTENSION)DeviceObject->DeviceExtension;
mov eax, DWORD PTR _DeviceObject$[ebp]
push ebx
xor ebx, ebx
; 96 :
; 97 : // Make sure the buffer lengths are of sufficient size to handle
; 98 : // the transactions.
; 99 : if((InputBufferLength < sizeof(PCIDP00_MAP_BASE_REGS_SEND)) ||
; 100 : (OutputBufferLength < sizeof(PCIDP00_MAP_BASE_REGS_RECV))){
cmp DWORD PTR _InputBufferLength$[ebp], 8
push esi
mov esi, DWORD PTR [eax+40]
push edi
mov DWORD PTR _NTStatus$[ebp], ebx
mov DWORD PTR _PhysicalMemoryHandle$[ebp], ebx
mov DWORD PTR _PhysicalMemorySection$[ebp], ebx
jb $L8475
push 12 ; 0000000cH
pop edx
cmp DWORD PTR _OutputBufferLength$[ebp], edx
jb $L8475
; 102 : goto ExitA;
; 103 : }
; 104 :
; 105 : // Check for a valid Base Address Register index and that its value
; 106 : // is zero or one, currently, the only supported registers.
; 107 : if(IoInput->RegNumber > 1){
mov edi, DWORD PTR _IoBuffer$[ebp]
push 1
pop eax
mov ecx, DWORD PTR [edi]
cmp ecx, eax
jbe SHORT $L8819
; 108 : NTStatus = STATUS_INVALID_PARAMETER;
mov DWORD PTR _NTStatus$[ebp], -1073741811 ; c000000dH
; 109 : goto ExitA;
jmp $ExitA$8477
$L8819:
; 110 : }
; 111 :
; 112 : // First check to see if the address is for I/O space. If it is, we
; 113 : // can't map it. Just return the I/O Address so the application can
; 114 : // use an I/O access driver to read and write from this space.
; 115 : if(IoInput->RegNumber == 1){
jne SHORT $L8480
; 116 : IoOutput->IOSpace = 1;
mov DWORD PTR [edi+8], eax
; 117 : IoOutput->Length = ObjExt->IOAccessLength;
mov eax, DWORD PTR [esi+20]
mov DWORD PTR [edi+4], eax
; 118 : IoOutput->Address = (ULONG)ObjExt->IOAccess.LowPart;
mov eax, DWORD PTR [esi+8]
mov DWORD PTR [edi], eax
; 119 : Irp->IoStatus.Information = sizeof(PCIDP00_MAP_BASE_REGS_RECV);
mov eax, DWORD PTR _Irp$[ebp]
mov DWORD PTR [eax+28], edx
; 120 : goto ExitA;
jmp $ExitA$8477
$L8480:
; 121 : }
; 122 :
; 123 : // Create the full path name for the physical memory object.
; 124 : RtlInitUnicodeString(
; 125 : IN &PhysicalMemoryUnicodeString,
; 126 : IN L"\\Device\\PhysicalMemory"
; 127 : );
lea eax, DWORD PTR _PhysicalMemoryUnicodeString$[ebp]
push OFFSET FLAT:$SG8483
push eax
call DWORD PTR __imp__RtlInitUnicodeString@8
; 128 :
; 129 : // Initialize the physical memory object attributes.
; 130 : InitializeObjectAttributes(
; 131 : OUT &ObjectAttributes, // Object attributes structure
; 132 : IN &PhysicalMemoryUnicodeString, // Full path name of the object
; 133 : IN OBJ_CASE_INSENSITIVE, // Object attribute
; 134 : IN (HANDLE) NULL, // Root directory is N/A
; 135 : IN (PSECURITY_DESCRIPTOR) NULL // Security descriptor is N/A
; 136 : );
lea eax, DWORD PTR _PhysicalMemoryUnicodeString$[ebp]
mov DWORD PTR _ObjectAttributes$[ebp], 24 ; 00000018H
mov DWORD PTR _ObjectAttributes$[ebp+8], eax
; 137 :
; 138 : // Get a handle to the physical memory object.
; 139 : NTStatus = ZwOpenSection(
; 140 : OUT &PhysicalMemoryHandle, // Handle to the physical memory object
; 141 : IN SECTION_ALL_ACCESS, // Allow full access to the memory
; 142 : IN &ObjectAttributes // Object attributes structure
; 143 : );
lea eax, DWORD PTR _ObjectAttributes$[ebp]
push eax
lea eax, DWORD PTR _PhysicalMemoryHandle$[ebp]
push 983071 ; 000f001fH
push eax
mov DWORD PTR _ObjectAttributes$[ebp+4], ebx
mov DWORD PTR _ObjectAttributes$[ebp+12], 64 ; 00000040H
mov DWORD PTR _ObjectAttributes$[ebp+16], ebx
mov DWORD PTR _ObjectAttributes$[ebp+20], ebx
call DWORD PTR __imp__ZwOpenSection@12
; 144 : if(NTStatus != STATUS_SUCCESS) goto ExitA;
cmp eax, ebx
mov DWORD PTR _NTStatus$[ebp], eax
jne $ExitA$8477
; 145 :
; 146 : // Validate access on the object's handle and get a pointer to the object's
; 147 : // body.
; 148 : NTStatus = ObReferenceObjectByHandle(
; 149 : IN PhysicalMemoryHandle,
; 150 : IN SECTION_ALL_ACCESS,
; 151 : IN (POBJECT_TYPE) NULL,
; 152 : IN KernelMode,
; 153 : OUT &PhysicalMemorySection,
; 154 : OUT (POBJECT_HANDLE_INFORMATION) NULL
; 155 : );
lea eax, DWORD PTR _PhysicalMemorySection$[ebp]
push ebx
push eax
push ebx
push ebx
push 983071 ; 000f001fH
push DWORD PTR _PhysicalMemoryHandle$[ebp]
call DWORD PTR __imp__ObReferenceObjectByHandle@24
; 156 : if(NTStatus != STATUS_SUCCESS) goto ExitB;
cmp eax, ebx
mov DWORD PTR _NTStatus$[ebp], eax
jne SHORT $ExitB$8498
; 157 :
; 158 : // Translate the address from a PCI address to a system logical address.
; 159 : // Initialize the PCI full physical addresses that will be translated.
; 160 : //FullPCIAddress.HighPart = 0;
; 161 : //FullPCIAddress.LowPart = ObjExt->BaseAddresses[IoInput->RegNumber];
; 162 : //FullPCIAddressEnd = RtlLargeIntegerAdd (
; 163 : // IN FullPCIAddress,
; 164 : // IN RtlConvertUlongToLargeInteger(IoInput->Length)
; 165 : //);
; 166 :
; 167 : // Translate the full PCI physical addresses into corresponding full system
; 168 : // logical addresses.
; 169 : //NTStatus = STATUS_ACCESS_DENIED;
; 170 : //HALStatus = HalTranslateBusAddress(
; 171 : // IN PCIBus, // bus type
; 172 : // IN ObjExt->BusNumber, // bus number
; 173 : // IN FullPCIAddress, // bus address
; 174 : // IN &MemorySpace, // I/O or memory space
; 175 : // OUT &FullLogicalAddress // system logical address
; 176 : //);
; 177 : //if(HALStatus == FALSE) goto ExitB;
; 178 :
; 179 : //HALStatus = HalTranslateBusAddress(
; 180 : // IN PCIBus, // bus type
; 181 : // IN ObjExt->BusNumber, // bus number
; 182 : // IN FullPCIAddressEnd, // bus address
; 183 : // IN &MemorySpaceEnd, // I/O or memory space
; 184 : // OUT &FullLogicalAddressEnd // system logical address
; 185 : //);
; 186 : // if(HALStatus == FALSE) goto ExitB;
; 187 :
; 188 : // Calculate the length of the memory to be mapped.
; 189 : //LongLength = RtlLargeIntegerSubtract(
; 190 : // IN FullLogicalAddressEnd,
; 191 : // IN FullLogicalAddress
; 192 : //);
; 193 : //Length = LongLength.LowPart;
; 194 : //LengthOut = LongLength.LowPart;
; 195 : Length = ObjExt->MemoryAccessLength;
mov eax, DWORD PTR [esi+16]
; 196 : LengthOut = ObjExt->MemoryAccessLength;
; 197 :
; 198 : // Now map the system logical address in this process' virtual address
; 199 : // space.
; 200 : VirtualAddress = 0;
mov DWORD PTR _VirtualAddress$[ebp], ebx
mov DWORD PTR _LengthOut$[ebp], eax
; 201 : //SectionOffset = FullLogicalAddress;
; 202 : SectionOffset = ObjExt->MemoryAccess;
mov ecx, DWORD PTR [esi]
mov DWORD PTR _SectionOffset$[ebp], ecx
mov ecx, DWORD PTR [esi+4]
mov DWORD PTR _SectionOffset$[ebp+4], ecx
; 203 :
; 204 : NTStatus = ZwMapViewOfSection(
; 205 : IN PhysicalMemoryHandle, //section handle
; 206 : IN (HANDLE) -1, //process handle
; 207 : IN OUT (PVOID*)&VirtualAddress, //base address (virtual address)
; 208 : IN 0L, //zero bits
; 209 : IN Length, //commit size
; 210 : IN OUT &SectionOffset, //section offset
; 211 : IN OUT &LengthOut, //view size
; 212 : IN ViewShare, //inherit disposition (0)
; 213 : IN 0, //allocation type
; 214 : IN PAGE_READWRITE | PAGE_NOCACHE //protect
; 215 : );
push 516 ; 00000204H
push ebx
lea ecx, DWORD PTR _LengthOut$[ebp]
push 1
push ecx
lea ecx, DWORD PTR _SectionOffset$[ebp]
push ecx
push eax
lea eax, DWORD PTR _VirtualAddress$[ebp]
push ebx
push eax
push -1
push DWORD PTR _PhysicalMemoryHandle$[ebp]
call DWORD PTR __imp__ZwMapViewOfSection@40
; 216 :
; 217 : // Mapping the section above rounded the logical address down to
; 218 : // the nearest 64 K boundary. Now return a virtual address pointing
; 219 : // to our request area by adding in the offset from the beginning
; 220 : // of the section.
; 221 : if(NTStatus == STATUS_SUCCESS){
cmp eax, ebx
mov DWORD PTR _NTStatus$[ebp], eax
jne SHORT $ExitB$8498
; 222 : IoOutput->IOSpace = 0;
; 223 : //IoOutput->Address = VirtualAddress +
; 224 : // ((ULONG)FullLogicalAddress.LowPart - (ULONG)SectionOffset.LowPart);
; 225 : //IoOutput->Length = LengthOut -
; 226 : // ((ULONG)FullLogicalAddress.LowPart - (ULONG)SectionOffset.LowPart);
; 227 : IoOutput->Address = VirtualAddress +
; 228 : ((ULONG)ObjExt->MemoryAccess.LowPart - (ULONG)SectionOffset.LowPart);
mov eax, DWORD PTR _SectionOffset$[ebp]
mov DWORD PTR [edi+8], ebx
mov ecx, DWORD PTR [esi]
sub ecx, eax
add ecx, DWORD PTR _VirtualAddress$[ebp]
mov DWORD PTR [edi], ecx
; 229 : IoOutput->Length = LengthOut -
; 230 : ((ULONG)ObjExt->MemoryAccess.LowPart - (ULONG)SectionOffset.LowPart);
sub eax, DWORD PTR [esi]
add eax, DWORD PTR _LengthOut$[ebp]
mov DWORD PTR [edi+4], eax
; 231 : Irp->IoStatus.Information = sizeof(PCIDP00_MAP_BASE_REGS_RECV);
mov eax, DWORD PTR _Irp$[ebp]
mov DWORD PTR [eax+28], 12 ; 0000000cH
$ExitB$8498:
; 232 : }
; 233 :
; 234 :
; 235 : ExitB:
; 236 : ZwClose(PhysicalMemoryHandle);
push DWORD PTR _PhysicalMemoryHandle$[ebp]
call DWORD PTR __imp__ZwClose@4
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -