reg.bat

WINXP下的ICE驱动程序源码,驱动程序练习

;@echo off
;goto make

;==============================================================================
;
;  作者：一块三毛钱
;  邮箱：[e-mail]
;  日期：2005.4.30
;
;  安装 SoftICE 插件 ZtsICE
;
;==============================================================================

.386
.model flat, stdcall
option casemap :none

include c:\masm32\include\windows.inc
include c:\masm32\include\kernel32.inc
include c:\masm32\include\advapi32.inc
include c:\masm32\include\masm32.inc
include c:\masm32\macros\strings.mac
includelib c:\masm32\lib\kernel32.lib
includelib c:\masm32\lib\advapi32.lib
includelib c:\masm32\lib\masm32.lib

.data
	lpDependencies	db "ntice",0,0

.code

_Install proc bFlags:DWORD
	LOCAL	hSCManager
	LOCAL	hService
	local	lpFileName[1024]:BYTE

	invoke	OpenSCManager, NULL, NULL, SC_MANAGER_CREATE_SERVICE
	.if eax!=0
		mov	hSCManager, eax
		
		;如果已经有了 ZtsICE 服务，则要先删掉
		invoke	OpenService, hSCManager, $CTA0("ZtsICE"), DELETE
		.if eax!=0
			push	eax
			invoke	DeleteService, eax
			call	CloseServiceHandle
		.endif
		
		.if bFlags
			invoke	GetSystemDirectory, addr lpFileName, sizeof lpFileName
			invoke	lstrcat, addr lpFileName, $CTA0("\\drivers\\ZtsICE.sys")
			invoke	CreateService, hSCManager, $CTA0("ZtsICE"), $CTA0("ZtsICE SoftICE Extension"), \
					SERVICE_START + DELETE, SERVICE_KERNEL_DRIVER, SERVICE_DEMAND_START, \
					SERVICE_ERROR_IGNORE, addr lpFileName, NULL, NULL, addr lpDependencies, NULL, NULL
			.if eax!=0
				mov	hService, eax
				invoke	CloseServiceHandle, hService
			.endif
			invoke	CloseServiceHandle, hSCManager
		.endif
	.endif
	ret
_Install endp

start proc
	push	eax
	invoke	GetCL, 1, esp
	pop	ebx
	shr	ebx, 8
	.if eax==1
		.if ebx=='i' || ebx=='I'
			invoke	_Install, TRUE
			ret
		.elseif ebx=='u' || ebx=='U'
			invoke	_Install, FALSE
			ret
		.endif
	.endif
	invoke	StdOut, $CTA0("不支持的命令行选项\nreg.exe /i|/u\n")
	ret
start endp

end start

:make

set path=%path%;c:\masm32\bin
set appname=reg

ml /nologo /c /coff %appname%.bat
link /nologo /subsystem:console %appname%.obj
del %appname%.obj
echo.
pause