⭐ 欢迎来到虫虫下载站! | 📦 资源下载 📁 资源专辑 ℹ️ 关于我们
⭐ 虫虫下载站

📄 utilrtns.cod

📁 James Antognini和Tom Divine提供的PASSTHRU的编成实例。
💻 COD
📖 第 1 页 / 共 3 页
字号:
; 211  :         //
; 212  :         while (pNdisBfr != NULL)

  00048	83 7d fc 00	 cmp	 DWORD PTR _pNdisBfr$[ebp], 0
  0004c	74 77		 je	 SHORT $L16111

; 213  :         {
; 214  :             PVOID pVa = NULL;

  0004e	c7 45 f0 00 00
	00 00		 mov	 DWORD PTR _pVa$16118[ebp], 0

; 215  :             ULONG BufLen = 0;

  00055	c7 45 f4 00 00
	00 00		 mov	 DWORD PTR _BufLen$16120[ebp], 0

; 216  : 
; 217  :             BufLen = NdisBufferLength(pNdisBfr);

  0005c	8b 55 fc	 mov	 edx, DWORD PTR _pNdisBfr$[ebp]
  0005f	52		 push	 edx
  00060	ff 15 00 00 00
	00		 call	 DWORD PTR __imp__NdisBufferLength@4
  00066	89 45 f4	 mov	 DWORD PTR _BufLen$16120[ebp], eax

; 218  : 
; 219  :             pVa = NdisBufferVirtualAddress(pNdisBfr);

  00069	8b 45 fc	 mov	 eax, DWORD PTR _pNdisBfr$[ebp]
  0006c	50		 push	 eax
  0006d	ff 15 00 00 00
	00		 call	 DWORD PTR __imp__NdisBufferVirtualAddress@4
  00073	89 45 f0	 mov	 DWORD PTR _pVa$16118[ebp], eax

; 220  : 
; 221  :             pPrevNdisBfr = pNdisBfr;

  00076	8b 4d fc	 mov	 ecx, DWORD PTR _pNdisBfr$[ebp]
  00079	89 4d f8	 mov	 DWORD PTR _pPrevNdisBfr$[ebp], ecx

; 222  :             pNdisBfr = pNdisBfr->Next;

  0007c	8b 55 fc	 mov	 edx, DWORD PTR _pNdisBfr$[ebp]
  0007f	8b 02		 mov	 eax, DWORD PTR [edx]
  00081	89 45 fc	 mov	 DWORD PTR _pNdisBfr$[ebp], eax

; 223  :             
; 224  :             if (pVa == NULL)

  00084	83 7d f0 00	 cmp	 DWORD PTR _pVa$16118[ebp], 0
  00088	75 02		 jne	 SHORT $L16122

; 225  :             {
; 226  :                 continue;

  0008a	eb bc		 jmp	 SHORT $L16116
$L16122:

; 227  :             }
; 228  : 
; 229  :             DBGPRINT(("Mdl @ %p.  Va = 0x%p.  Len = 0x%08x.\n", pPrevNdisBfr, pVa, BufLen));

  0008c	68 00 00 00 00	 push	 OFFSET FLAT:$SG16123
  00091	e8 00 00 00 00	 call	 _DbgPrint
  00096	83 c4 04	 add	 esp, 4
  00099	8b 4d f4	 mov	 ecx, DWORD PTR _BufLen$16120[ebp]
  0009c	51		 push	 ecx
  0009d	8b 55 f0	 mov	 edx, DWORD PTR _pVa$16118[ebp]
  000a0	52		 push	 edx
  000a1	8b 45 f8	 mov	 eax, DWORD PTR _pPrevNdisBfr$[ebp]
  000a4	50		 push	 eax
  000a5	68 00 00 00 00	 push	 OFFSET FLAT:$SG16124
  000aa	e8 00 00 00 00	 call	 _DbgPrint
  000af	83 c4 10	 add	 esp, 16			; 00000010H

; 230  :             DumpMem( (CHAR* )pVa, BufLen, TRUE, 1 );                           

  000b2	6a 01		 push	 1
  000b4	6a 01		 push	 1
  000b6	8b 4d f4	 mov	 ecx, DWORD PTR _BufLen$16120[ebp]
  000b9	51		 push	 ecx
  000ba	8b 55 f0	 mov	 edx, DWORD PTR _pVa$16118[ebp]
  000bd	52		 push	 edx
  000be	e8 00 00 00 00	 call	 _DumpMem@16

; 231  :         }

  000c3	eb 83		 jmp	 SHORT $L16116
$L16111:

; 232  : 
; 233  :     } while (FALSE);

  000c5	33 c0		 xor	 eax, eax
  000c7	85 c0		 test	 eax, eax
  000c9	0f 85 69 ff ff
	ff		 jne	 $L16110

; 234  : }

  000cf	8b e5		 mov	 esp, ebp
  000d1	5d		 pop	 ebp
  000d2	c2 04 00	 ret	 4
_e100DumpPkt@4 ENDP
_TEXT	ENDS
PUBLIC	_GetTCPChecksum@16
; Function compile flags: /Odt
;	COMDAT _GetTCPChecksum@16
_TEXT	SEGMENT
_PseudoHdrArr$ = -24
_sum$ = -12
_usPsHdr$ = -8
_pPseudoHdr$ = -4
_pTCPFd$ = 8
_pSrcAddr$ = 12
_pDestAddr$ = 16
_usTCPFd$ = 20
_GetTCPChecksum@16 PROC NEAR				; COMDAT

; 271  : {

  00000	55		 push	 ebp
  00001	8b ec		 mov	 ebp, esp
  00003	83 ec 18	 sub	 esp, 24			; 00000018H

; 272  :  #define JADrvRtnsVer    "1.01"   
; 273  : 
; 274  :  #define lnPseudoHdr 12                               // Size of pseudo-header.
; 275  :  char    PseudoHdrArr[lnPseudoHdr];                   // Pseudo-header.
; 276  :  USHORT  usPsHdr = lnPseudoHdr;                       // Length of pseudo-header.

  00006	66 c7 45 f8 0c
	00		 mov	 WORD PTR _usPsHdr$[ebp], 12 ; 0000000cH

; 277  :  PUSHORT pPseudoHdr = (PUSHORT)PseudoHdrArr;          // Pointer to pseudo-header.

  0000c	8d 45 e8	 lea	 eax, DWORD PTR _PseudoHdrArr$[ebp]
  0000f	89 45 fc	 mov	 DWORD PTR _pPseudoHdr$[ebp], eax

; 278  :  ULONG   sum = 0; 

  00012	c7 45 f4 00 00
	00 00		 mov	 DWORD PTR _sum$[ebp], 0

; 279  : 
; 280  :  // Note:  The one's complement addition done for the TCP datagram and for the pseudo-header is effected
; 281  :  //        with little-endian PUSHORT variables.  Because of the associativity of addition, that produces
; 282  :  //        a good result except that the bytes have to be swapped in the return statement.  (The data
; 283  :  //        being checked-summed are, as always, in network (big-endian) order; eg, if the length of the
; 284  :  //        TCP datagram used in the pseudo-header is 0x95, the value is stored as 0x0095 in memory, not
; 285  :  //        as 0x9500.)
; 286  : 
; 287  :  // Build the pseudo-header field. 
; 288  : 
; 289  :  memcpy(PseudoHdrArr, pSrcAddr, 4);                   // Copy source IP address.

  00019	8b 4d 0c	 mov	 ecx, DWORD PTR _pSrcAddr$[ebp]
  0001c	8b 11		 mov	 edx, DWORD PTR [ecx]
  0001e	89 55 e8	 mov	 DWORD PTR _PseudoHdrArr$[ebp], edx

; 290  :  memcpy(PseudoHdrArr+4, pDestAddr, 4);                // Copy destination IP address.

  00021	8b 45 10	 mov	 eax, DWORD PTR _pDestAddr$[ebp]
  00024	8b 08		 mov	 ecx, DWORD PTR [eax]
  00026	89 4d ec	 mov	 DWORD PTR _PseudoHdrArr$[ebp+4], ecx

; 291  :  PseudoHdrArr[8] = 0;                                 // Set to 0.

  00029	c6 45 f0 00	 mov	 BYTE PTR _PseudoHdrArr$[ebp+8], 0

; 292  :  PseudoHdrArr[9] = IPPROTO_TCP;                       // Set to TCP protocol constant.

  0002d	c6 45 f1 06	 mov	 BYTE PTR _PseudoHdrArr$[ebp+9], 6

; 293  :  pPseudoHdr[5] =                                      // Put length of entire TCP datagram into pseudo-header.
; 294  :    (USHORT)(((usTCPFd&0xFF00)>>8) + ((usTCPFd&0x00FF)<<8));

  00031	0f b7 55 14	 movzx	 edx, WORD PTR _usTCPFd$[ebp]
  00035	81 e2 00 ff 00
	00		 and	 edx, 65280		; 0000ff00H
  0003b	c1 fa 08	 sar	 edx, 8
  0003e	0f b7 45 14	 movzx	 eax, WORD PTR _usTCPFd$[ebp]
  00042	25 ff 00 00 00	 and	 eax, 255		; 000000ffH
  00047	c1 e0 08	 shl	 eax, 8
  0004a	03 d0		 add	 edx, eax
  0004c	8b 4d fc	 mov	 ecx, DWORD PTR _pPseudoHdr$[ebp]
  0004f	66 89 51 0a	 mov	 WORD PTR [ecx+10], dx
$L16144:

; 295  : 
; 296  :  // Do one's complement addition of pseudo-header.
; 297  : 
; 298  :  while(usPsHdr > 0)

  00053	0f b7 55 f8	 movzx	 edx, WORD PTR _usPsHdr$[ebp]
  00057	85 d2		 test	 edx, edx
  00059	7e 24		 jle	 SHORT $L16147

; 299  :    {
; 300  :     sum += *pPseudoHdr++;

  0005b	8b 45 fc	 mov	 eax, DWORD PTR _pPseudoHdr$[ebp]
  0005e	0f b7 08	 movzx	 ecx, WORD PTR [eax]
  00061	8b 55 f4	 mov	 edx, DWORD PTR _sum$[ebp]
  00064	03 d1		 add	 edx, ecx
  00066	89 55 f4	 mov	 DWORD PTR _sum$[ebp], edx
  00069	8b 45 fc	 mov	 eax, DWORD PTR _pPseudoHdr$[ebp]
  0006c	83 c0 02	 add	 eax, 2
  0006f	89 45 fc	 mov	 DWORD PTR _pPseudoHdr$[ebp], eax

; 301  :     usPsHdr -= 2;

  00072	0f b7 4d f8	 movzx	 ecx, WORD PTR _usPsHdr$[ebp]
  00076	83 e9 02	 sub	 ecx, 2
  00079	66 89 4d f8	 mov	 WORD PTR _usPsHdr$[ebp], cx

; 302  :    }

  0007d	eb d4		 jmp	 SHORT $L16144
$L16147:

; 303  : 
; 304  :  // Do one's complement addition of TCP field, except for the last byte if the field length is odd. 
; 305  : 
; 306  :  while(usTCPFd > 1)

  0007f	0f b7 55 14	 movzx	 edx, WORD PTR _usTCPFd$[ebp]
  00083	83 fa 01	 cmp	 edx, 1
  00086	7e 24		 jle	 SHORT $L16148

; 307  :    {
; 308  :     sum += *pTCPFd++;

  00088	8b 45 08	 mov	 eax, DWORD PTR _pTCPFd$[ebp]
  0008b	0f b7 08	 movzx	 ecx, WORD PTR [eax]
  0008e	8b 55 f4	 mov	 edx, DWORD PTR _sum$[ebp]
  00091	03 d1		 add	 edx, ecx
  00093	89 55 f4	 mov	 DWORD PTR _sum$[ebp], edx
  00096	8b 45 08	 mov	 eax, DWORD PTR _pTCPFd$[ebp]
  00099	83 c0 02	 add	 eax, 2
  0009c	89 45 08	 mov	 DWORD PTR _pTCPFd$[ebp], eax

; 309  :     usTCPFd -= 2;

  0009f	0f b7 4d 14	 movzx	 ecx, WORD PTR _usTCPFd$[ebp]
  000a3	83 e9 02	 sub	 ecx, 2
  000a6	66 89 4d 14	 mov	 WORD PTR _usTCPFd$[ebp], cx

; 310  :    }

  000aa	eb d3		 jmp	 SHORT $L16147
$L16148:

; 311  : 
; 312  :  // Add left-over byte, if any.
; 313  : 
; 314  :  if(usTCPFd > 0)

  000ac	0f b7 55 14	 movzx	 edx, WORD PTR _usTCPFd$[ebp]
  000b0	85 d2		 test	 edx, edx
  000b2	7e 0e		 jle	 SHORT $L16149

; 315  :    sum += *(PUCHAR)pTCPFd;

  000b4	8b 45 08	 mov	 eax, DWORD PTR _pTCPFd$[ebp]
  000b7	0f b6 08	 movzx	 ecx, BYTE PTR [eax]
  000ba	8b 55 f4	 mov	 edx, DWORD PTR _sum$[ebp]
  000bd	03 d1		 add	 edx, ecx
  000bf	89 55 f4	 mov	 DWORD PTR _sum$[ebp], edx
$L16149:

; 316  : 
; 317  :  // Fold 32-bit sum to 16 bits (form per offload.h in DDK \e100bex).
; 318  : 
; 319  :  sum = (((sum >> 16) | (sum << 16)) + sum) >> 16;

  000c2	8b 45 f4	 mov	 eax, DWORD PTR _sum$[ebp]
  000c5	c1 e8 10	 shr	 eax, 16			; 00000010H
  000c8	8b 4d f4	 mov	 ecx, DWORD PTR _sum$[ebp]
  000cb	c1 e1 10	 shl	 ecx, 16			; 00000010H
  000ce	0b c1		 or	 eax, ecx
  000d0	03 45 f4	 add	 eax, DWORD PTR _sum$[ebp]
  000d3	c1 e8 10	 shr	 eax, 16			; 00000010H
  000d6	89 45 f4	 mov	 DWORD PTR _sum$[ebp], eax

; 320  : 
; 321  :  // Return one's complement (in little-endian form, by the way).
; 322  : 
; 323  :  return (USHORT)~sum;

  000d9	8b 45 f4	 mov	 eax, DWORD PTR _sum$[ebp]
  000dc	f7 d0		 not	 eax

; 324  : }                                                     // End GetTCPChecksum().

  000de	8b e5		 mov	 esp, ebp
  000e0	5d		 pop	 ebp
  000e1	c2 10 00	 ret	 16			; 00000010H
_GetTCPChecksum@16 ENDP
_TEXT	ENDS
PUBLIC	_GetIPChecksum@8
; Function compile flags: /Odt
;	COMDAT _GetIPChecksum@8
_TEXT	SEGMENT
_cksum$ = -4
_pIPH$ = 8
_usIPHdr$ = 12
_GetIPChecksum@8 PROC NEAR				; COMDAT

; 333  : {

  00000	55		 push	 ebp
  00001	8b ec		 mov	 ebp, esp
  00003	51		 push	 ecx

; 334  :  ULONG cksum = 0;

  00004	c7 45 fc 00 00
	00 00		 mov	 DWORD PTR _cksum$[ebp], 0
$L16160:

; 335  : 
; 336  :  while (usIPHdr > 1)

  0000b	0f b7 45 0c	 movzx	 eax, WORD PTR _usIPHdr$[ebp]
  0000f	83 f8 01	 cmp	 eax, 1
  00012	7e 24		 jle	 SHORT $L16161

; 337  :  {
; 338  :   cksum += *pIPH++;

  00014	8b 4d 08	 mov	 ecx, DWORD PTR _pIPH$[ebp]
  00017	0f b7 11	 movzx	 edx, WORD PTR [ecx]
  0001a	8b 45 fc	 mov	 eax, DWORD PTR _cksum$[ebp]
  0001d	03 c2		 add	 eax, edx
  0001f	89 45 fc	 mov	 DWORD PTR _cksum$[ebp], eax
  00022	8b 4d 08	 mov	 ecx, DWORD PTR _pIPH$[ebp]
  00025	83 c1 02	 add	 ecx, 2
  00028	89 4d 08	 mov	 DWORD PTR _pIPH$[ebp], ecx

; 339  :   usIPHdr -= sizeof(USHORT);

  0002b	0f b7 55 0c	 movzx	 edx, WORD PTR _usIPHdr$[ebp]
  0002f	83 ea 02	 sub	 edx, 2
  00032	66 89 55 0c	 mov	 WORD PTR _usIPHdr$[ebp], dx

; 340  :  }

  00036	eb d3		 jmp	 SHORT $L16160
$L16161:

; 341  : 
; 342  :  cksum = (((cksum >> 16) | (cksum << 16)) + cksum) >> 16;

  00038	8b 45 fc	 mov	 eax, DWORD PTR _cksum$[ebp]
  0003b	c1 e8 10	 shr	 eax, 16			; 00000010H
  0003e	8b 4d fc	 mov	 ecx, DWORD PTR _cksum$[ebp]
  00041	c1 e1 10	 shl	 ecx, 16			; 00000010H
  00044	0b c1		 or	 eax, ecx
  00046	03 45 fc	 add	 eax, DWORD PTR _cksum$[ebp]
  00049	c1 e8 10	 shr	 eax, 16			; 00000010H
  0004c	89 45 fc	 mov	 DWORD PTR _cksum$[ebp], eax

; 343  : 
; 344  :  return (USHORT)~cksum;

  0004f	8b 45 fc	 mov	 eax, DWORD PTR _cksum$[ebp]
  00052	f7 d0		 not	 eax

; 345  : }                                                     // End GetIPChecksum().

  00054	8b e5		 mov	 esp, ebp
  00056	5d		 pop	 ebp
  00057	c2 08 00	 ret	 8
_GetIPChecksum@8 ENDP
_TEXT	ENDS
END

⌨️ 快捷键说明

复制代码 Ctrl + C
搜索代码 Ctrl + F
全屏模式 F11
切换主题 Ctrl + Shift + D
显示快捷键 ?
增大字号 Ctrl + =
减小字号 Ctrl + -