winring.hpp

CMOS数据的写程序

/************************************************************************
* <WinRing.hpp> Ver 1.0
*
* Adjust the privilege of Application from Ring 3 to Ring 0
*
* Caution: 1. WinRing.sys support Win2K/WinXP serial only.
*	   2. Don't use VCL in your procedure that it will be adjusted to Ring 0.
*          3. Don't use any command about Far-Jump.
*
* Copyright by Chun-Hsueh Lin, 03/12/2003
************************************************************************/
#ifndef DRIVER
#define DRIVER	"WINRING"
#endif
#ifndef DEVIO_H
#define DEVIO_H

//===============================================
#ifndef CTL_CODE
#define CTL_CODE( DeviceType, Function, Method, Access ) (                 \
    ((DeviceType) << 16) | ((Access) << 14) | ((Function) << 2) | (Method) \
)
#define METHOD_BUFFERED                 0
#define METHOD_IN_DIRECT                1
#define METHOD_OUT_DIRECT               2
#define METHOD_NEITHER                  3
#define FILE_ANY_ACCESS                 0
#define FILE_READ_ACCESS				( 0x0001 )    // file & pipe
#define FILE_WRITE_ACCESS				( 0x0002 )    // file & pipe
#define FILE_DEVICE_UNKNOWN             0x00000022
#endif

#define WINRING_Access		CTL_CODE(		\
			FILE_DEVICE_UNKNOWN,		\
			0x999,				\
			METHOD_BUFFERED,		\
			FILE_ANY_ACCESS)
#endif

//===============================================
class TRingData
{
public:
	ULONG AdjRing0Entry;
	ULONG RegData[7];
};
//===============================================

HANDLE DriverHandle;

TRingData Ring;
DWORD retbyte;

#define WinRing();	DeviceIoControl(DriverHandle, WINRING_Access, &Ring, sizeof(Ring), &Ring, sizeof(Ring), &retbyte, 0);

bool BuildDriverService()
{
	SC_HANDLE scHandle, srvHandle;
	scHandle=OpenSCManager(0,0,SC_MANAGER_ALL_ACCESS);
	if (!scHandle) 
	{
		return false;
	}
	srvHandle=OpenService(scHandle,DRIVER,SERVICE_ALL_ACCESS);
	if (srvHandle==0)
	{
		char path[MAX_PATH]={0};
		String DriverPath=ExtractFilePath(Application->ExeName)+DRIVER+".sys";
		strcat(path, DriverPath.c_str());
		
		srvHandle=CreateService(
			scHandle,
			DRIVER,
			DRIVER,
			SERVICE_ALL_ACCESS,
			SERVICE_KERNEL_DRIVER,
			SERVICE_DEMAND_START,
			SERVICE_ERROR_NORMAL,
			path,
			0,0,0,0,0);
	}
	if (srvHandle==0)
	  return false;

	StartService(srvHandle,0,0);
	CloseServiceHandle(srvHandle);
	CloseServiceHandle(scHandle);
	return true;
}

//===============================================
bool DeleteDriverService()
{
	SERVICE_STATUS  srvStatus;
	SC_HANDLE scHandle,srvHandle;

	scHandle=OpenSCManager(0,0,SC_MANAGER_ALL_ACCESS);
	if (!scHandle)
	{
		return false;
	}

	srvHandle=OpenService(scHandle,DRIVER,SERVICE_ALL_ACCESS);
	if (srvHandle)
	{
		ControlService(srvHandle,SERVICE_CONTROL_STOP,&srvStatus);

		DeleteService(srvHandle);
	}
	CloseServiceHandle(srvHandle);
	CloseServiceHandle(scHandle);
	return true;
}

//===============================================
bool OpenDriver()
{
	if (!BuildDriverService())
	  return false;
	DriverHandle=CreateFile(
		"\\\\.\\" DRIVER,
		GENERIC_READ|GENERIC_WRITE,
		0,
		0,
		OPEN_EXISTING,
		0,
		0);

	if (DriverHandle==INVALID_HANDLE_VALUE)
	{
		return false;
	}
	return true;
}

//===============================================
bool CloseDriver()
{
	CloseHandle(DriverHandle);
	if (!DeleteDriverService())
	  return false;
	return true;
}

//===============================================
BYTE OSVersion;
void __fastcall (__closure *Ring3ProcName)();

        // Get major version numbers of Windows
        // OSVersion=4 : Win9x serial
        // OSVersion=5 : WinNT serial
//===============================================
void OpenWinRing()
{
        OSVersion = LOBYTE(LOWORD(GetVersion()));
        if (OSVersion!=4)
        {
          if (!OpenDriver())
          {
            ShowMessage("Driver not ready!!!");
            CloseDriver();
            Application->Terminate();
          }
        }
}

//===============================================
void CloseWinRing()
{
        if (OSVersion !=4)
        {
          if (!CloseDriver())
            ShowMessage("Close Driver Fail!");
        }
}

//===============================================
void __fastcall SaveAllReg(void)
{
        asm {
          push eax
          mov eax, offset Ring.RegData
          mov [eax][04], ebx
          mov [eax][08], ecx
          mov [eax][12], edx
          mov [eax][16], esi
          mov [eax][20], edi
          mov [eax][24], ebp
          mov ebx, eax
          pop eax
          mov [ebx], eax}
}

//===============================================
void __fastcall Ring0Proc()
{
        DWORD Adj0Address;
        SaveAllReg();
        #pragma inline
        asm mov Adj0Address, offset ADJRing0
        Ring.AdjRing0Entry=Adj0Address;
        WinRing();
        asm{
          jmp ADJRing3
ADJRing0:
          mov eax, [esp+4]}
        Ring3ProcName();
        asm{
          ret
ADJRing3:}
}

#define ProcessRing0(x) Ring3ProcName=x; Ring0Proc();