[分享]AMI WINBIOS密码提取器（ASM源码）
[原创]AMI WINBIOS密码提取器（ASM源码）
转载：https://bbs.pediy.com/thread-116195.htm
说明：编译环境：RadASM
附：资源文件代码未给出
;●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●
;● AMI WINBIOS密码提取器(Ring3) ●
;● ●
;● 作者:CoCol QQ:1174968967 2010-6 ●
;●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●
.386
.model flat,stdcall
option casemap:none
include KillYou.inc
IDD_DLG equ 1000
IDC_BTN1 equ 1005
IDI_ICON equ 1009
IDA_SYS equ 2000
.data
szDriverPath2 db "%SystemRoot%\system32\drivers\SafeComs360.sys",0
szDriverName db "SafeComs360",0
_Table db 2h dup('?'),'1','2','3','4','5','6','7','8','9','0'
db 4h dup('?'),'Q','W','E','R','T','Y','U','I','O','P'
db 4h dup('?'),'A','S','D','F','G','H','J','K','L'
db 5h dup('?'),'Z','X','C','V','B','N','M'
db 14h dup('?'),'g','h','i','?','d','e','f','?','a','b','c','o'
db 0adh dup('?'),0
_Cram db 80h,7h dup(0)
_Pwd db 7h dup(0)
.data?
hInstance dd ?
dwBytesReturned dd ?
szDriverPath db 260 dup(?)
.code
SearchTable proc pTable:dword,dbNum:byte
local Asicc:byte
pushad
mov ebx,pTable
mov al,dbNum
xlat
mov Asicc,al
popad
mov al,Asicc
ret
SearchTable endp
Decryption proc dbFrontByte:byte,dbBehindByte:byte,pTable:dword
local Asicc:byte
pushad
xor dl,dl
mov al,byte ptr dbFrontByte
mov ah,byte ptr dbBehindByte
De1:mov ch,al
and ch,0c3h
jp De2
stc
jmp De3
De2:clc
De3:rcr al,1
inc dl
cmp al,ah
jnz De1
invoke SearchTable,pTable,dl
mov Asicc,al
popad
mov al,Asicc
ret
Decryption endp
Crack proc
pushad
mov esi,offset _Cram
mov edi,offset _Pwd
mov bl,byte ptr[esi]
Cra:inc esi
mov bh,byte ptr[esi]
cmp bh,0
jz Disp
invoke Decryption,bl,bh,offset _Table
mov [edi],al
inc edi
mov bl,bh
jmp Cra
Disp:invoke MessageBox,NULL,offset _Pwd ,$CTA0("提取到的本机BIOS密码 "),MB_ICONINFORMATION+MB_OK
popad
ret
Crack endp
;--------------------------------------------------------------------------------------
;函数:StartSerivice
;参数说明:No
;功能:启动服务
;--------------------------------------------------------------------------------------
StartSerivice proc
local hSCM:dword
local hService:dword
pushad
invoke OpenSCManager,0,0,SC_MANAGER_ALL_ACCESS
.if eax
mov hSCM,eax
invoke CreateService,hSCM,addr szDriverName,addr szDriverName,\
SERVICE_ALL_ACCESS,SERVICE_KERNEL_DRIVER,SERVICE_DEMAND_START,\
SERVICE_ERROR_NORMAL,addr szDriverPath,0,0,0,0,0
.if eax
mov hService,eax
.else
invoke OpenService,hSCM,addr szDriverName,SERVICE_ALL_ACCESS
.if eax
mov hService,eax
.else
invoke CloseServiceHandle,hSCM
invoke MessageBox,0,$CTA0("初始化失败..."),0,16
invoke ExitProcess,hInstance
.endif
.endif
invoke StartService,hService,0,0
invoke CloseServiceHandle,hService
invoke CloseServiceHandle,hSCM
.endif
invoke DeleteFile,offset szDriverPath
ret
popad
StartSerivice endp
;--------------------------------------------------------------------------------------
;函数:CreateSys
;参数说明:hinstance：程序句柄、dwResID：资源ID、dwFilePath：生成文件路径
;功能:释放驱动程序
;--------------------------------------------------------------------------------------
CreateSys proc hinstance:dword,dwResID:dword,dwFilePath:dword
local hResInfo:dword
local dwResSize:dword
local lpRes:dword
local hFile:dword
pushad
invoke FindResource,hinstance,dwResID,RT_RCDATA
.if eax
mov hResInfo,eax
invoke SizeofResource,hinstance,hResInfo
mov dwResSize,eax
invoke LoadResource,hinstance,hResInfo
.if eax
mov lpRes,eax
invoke SetFileAttributes,dwFilePath,FILE_ATTRIBUTE_NORMAL
invoke CreateFile,dwFilePath,GENERIC_WRITE,FILE_SHARE_READ,NULL,OPEN_ALWAYS,FILE_ATTRIBUTE_NORMAL,NULL
mov hFile,eax
invoke SetFilePointer,hFile,NULL,NULL,FILE_BEGIN
invoke _lwrite,hFile,lpRes,dwResSize
invoke SetFileAttributes,dwFilePath,FILE_ATTRIBUTE_NORMAL or FILE_ATTRIBUTE_SYSTEM or FILE_ATTRIBUTE_HIDDEN
invoke _lclose,hFile
.endif
.endif
popad
ret
CreateSys endp
;--------------------------------------------------------------------------------------
;函数:StartSetRam
;参数说明:No
;功能:连接服务并发送控制代码到驱动
;--------------------------------------------------------------------------------------
StartGetRam proc
local hDevice:dword
pushad
invoke CreateFile,$CTA0("\\\\.\\SetCmosRam"),GENERIC_READ + GENERIC_WRITE,0,NULL,OPEN_EXISTING,0,NULL
.if eax!=INVALID_HANDLE_VALUE
mov hDevice,eax
invoke DeviceIoControl,hDevice,GET_CMOS_RAM,NULL,0,(offset _Cram)+1,sizeof _Cram ,addr dwBytesReturned,NULL
.if (eax!=0)&&(dwBytesReturned!=0)
call Crack
invoke CloseHandle,hDevice
jmp Exit
.else
invoke MessageBox, NULL, $CTA0("启动失败,尝试重新运行本程序.."), $CTA0("错误"), MB_OK + MB_ICONSTOP
jmp Exit
.endif
.endif
invoke MessageBox, NULL, $CTA0("打开服务失败.."),$CTA0("错误"), MB_OK + MB_ICONSTOP
Exit:
popad
ret
StartGetRam endp
;--------------------------------------------------------------------------------------
;函数:WndProc
;参数说明:hWnd：uMsg：wParam：lParam
;功能:窗体事件过程
;--------------------------------------------------------------------------------------
WndProc proc hWnd:HWND, uMsg:UINT, wParam:WPARAM, lParam:LPARAM
pushad
.if uMsg == WM_CLOSE
invoke EndDialog, hWnd, 0
.elseif uMsg == WM_INITDIALOG
invoke LoadIcon,hInstance,IDI_ICON
invoke SendMessage,hWnd,WM_SETICON,ICON_BIG,eax
invoke ExpandEnvironmentStrings,offset szDriverPath2,offset szDriverPath,260
invoke CreateSys,hInstance,IDA_SYS,offset szDriverPath
invoke StartSerivice
.elseif uMsg == WM_COMMAND
mov eax, wParam
mov edx, eax
shr edx, 16
movzx eax, ax
.if edx == BN_CLICKED
.if eax == IDC_BTN1
invoke StartGetRam
invoke ExitProcess,hInstance
.endif
.endif
.else
mov eax, FALSE
ret
.endif
mov eax, TRUE
ret
WndProc endp
;**************************************************************************************
; 程序入口:
;**************************************************************************************
@Start:
invoke GetModuleHandle, NULL
mov hInstance, eax
invoke DialogBoxParam, eax,IDD_DLG, 0, WndProc, 0
invoke ExitProcess, eax
end @Start
;●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●
;● AMI WINBIOS密码提取器(驱动) ●
;● ●
;● 作者:CoCol QQ:1174968967 2010-6 ●
;●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●
.386
.model flat, stdcall
option casemap:none
include IoCmosRam.inc
.const
CCOUNTED_UNICODE_STRING "\\Device\\DevCMOS",g_usDeviceName,4
CCOUNTED_UNICODE_STRING "\\??\\SetCmosRam",g_usSymbolicLinkName,4
.data
Buff1 db 8h dup (0)
.code
;--------------------------------------------------------------------------------------
;函数:DriverUnload
;功能:卸载例程
;--------------------------------------------------------------------------------------
DriverUnload proc pDriverObject:PDRIVER_OBJECT
pushad
invoke IoDeleteSymbolicLink,addr g_usSymbolicLinkName
mov eax,pDriverObject
invoke IoDeleteDevice,(DRIVER_OBJECT PTR [eax]).DeviceObject
popad
ret
DriverUnload endp
;--------------------------------------------------------------------------------------
;函数:DispatchCreateClose
;功能:处理RP_MJ_CREATE、IRP_MJ_CREATE例程
;--------------------------------------------------------------------------------------
DispatchCreateClose proc pDeviceObject:PDEVICE_OBJECT,pIrp:PIRP
pushad
mov eax,pIrp
assume eax:ptr _IRP
mov [eax].IoStatus.Status,STATUS_SUCCESS
and [eax].IoStatus.Information,0
assume eax:nothing
fastcall IofCompleteRequest,pIrp,IO_NO_INCREMENT
popad
mov eax,STATUS_SUCCESS
ret
DispatchCreateClose endp
;--------------------------------------------------------------------------------------
;函数:DispatchControl
;功能:处理IRP_MJ_DEVICE_CONTROL例程
;--------------------------------------------------------------------------------------
DispatchControl proc uses esi edi pDeviceObject:PDEVICE_OBJECT, pIrp:PIRP
local status:NTSTATUS
local dwBytesReturned:DWORD ;实际返回的字节数
and dwBytesReturned, 0
mov esi, pIrp
assume esi:ptr _IRP
IoGetCurrentIrpStackLocation esi
mov edi, eax
assume edi:ptr IO_STACK_LOCATION
.if [edi].Parameters.DeviceIoControl.IoControlCode == GET_CMOS_RAM
.if [edi].Parameters.DeviceIoControl.OutputBufferLength >= 6h
mov eax,[esi].AssociatedIrp.SystemBuffer
pushad
push eax
mov edi,offset Buff1
mov ecx,6h
mov dl,38h
Get:mov al,dl
out 70h,al
nop
nop
in al,71h
mov byte ptr[edi],al
inc dl
inc edi
loop Get
sti
push offset Buff1
pop esi
pop edi
mov ecx,6h
rep movsb
popad
mov dwBytesReturned, 6h
mov status, STATUS_SUCCESS
.else
mov status, STATUS_BUFFER_TOO_SMALL
.endif
.else
mov status, STATUS_INVALID_DEVICE_REQUEST
.endif
assume edi:nothing
push status
pop [esi].IoStatus.Status
push dwBytesReturned
pop [esi].IoStatus.Information
assume esi:nothing
fastcall IofCompleteRequest, pIrp, IO_NO_INCREMENT
mov eax, status
ret
DispatchControl endp
;--------------------------------------------------------------------------------------
;函数:DriverEntry
;功能:驱动入口
;--------------------------------------------------------------------------------------
.code INIT
DriverEntry proc pDriverObject:PDRIVER_OBJECT,pusRegistryPath:PUNICODE_STRING
local Status:NTSTATUS
local pDeviceObject:PDEVICE_OBJECT
pushad
mov Status,STATUS_DEVICE_CONFIGURATION_ERROR
invoke IoCreateDevice,pDriverObject,NULL,addr g_usDeviceName,FILE_DEVICE_UNKNOWN,NULL,FALSE,addr pDeviceObject
.if eax==STATUS_SUCCESS
invoke IoCreateSymbolicLink,addr g_usSymbolicLinkName,addr g_usDeviceName
.if eax==STATUS_SUCCESS
mov eax,pDriverObject
assume eax:ptr DRIVER_OBJECT
mov [eax].MajorFunction[IRP_MJ_CREATE*(sizeof PVOID)],offset DispatchCreateClose
mov [eax].MajorFunction[IRP_MJ_CLOSE*(sizeof PVOID)],offset DispatchCreateClose
mov [eax].MajorFunction[IRP_MJ_DEVICE_CONTROL*(sizeof PVOID)],offset DispatchControl
mov [eax].DriverUnload,offset DriverUnload
mov Status,STATUS_SUCCESS
assume eax:nothing
.else
invoke IoDeleteDevice,pDeviceObject
.endif
.endif
popad
mov eax,Status
ret
DriverEntry endp
end DriverEntry