杀毒软件源代码c语言,分享一病毒源代码，破坏MBR，危险！！仅供学习参考，勿运行（vc++2010已编译通过）...

[绝对爆料]NTRing3级下使用API直接读写硬盘【原创】

--------------------------------------------------------------------------------

相信此贴一出，NT下的操作硬盘软件会满天飞，试问，如果简简单单使用一个API函数就可以读写硬盘，还会有人抱着Windows的DDK去编驱动吗?

而今Windows对各类资源的保护可以说是无孔不入，Windows 为实现其可靠性，严格将系统划分为内核模式与用户模式，在i386系统中分别对应CPU的Ring0与Ring3级别，在Ring3级下执行的程序是不可能直接访问到硬件的。就以读写硬盘的扇区来说吧，在9X下还可以使用INT中断来读取，但是在NT下只有进入了Ring0级才可对硬盘进行操作，而进入Ring0级的方法有:设备驱动程序，中断门，调用门等等。但是今天我们要说的是在NT下Ring3级下使用API直接读写扇区。如果不相信请跟我来!

今天API函数的主角就是CreateFile。看到这里大家有可能想拿鸡蛋扔我了，CreateFile怎么能和硬盘有关系呢。起初我也难以相信，就像我大一学习C语言时，老师告诉我fprintf,printf都是向一个文件进行输出时，我在台下也想扔他。但事实确实如此，Windows将所以的资源都看成文件，无论是真正存储在硬盘上的文件还是硬件(硬盘，显示器等)。在这里不得不佩服Windows的创新理念，文件管理一向是Windows的核心之一。在这里我是没有能力给大家讲述文件管理的，我们打开Win32Help找到CreateFile：

HANDLE CreateFile(

LPCTSTR lpFileName,  // pointer to name of the file

DWORD dwDesiredAccess,  // access (read-write) mode

DWORD dwShareMode,  // share mode

LPSECURITY_ATTRIBUTES lpSecurityAttributes,  // pointer to security attributes

DWORD dwCreationDistribution,  // how to create

DWORD dwFlagsAndAttributes,  // file attributes

HANDLE hTemplateFile   // handle to file with attributes to copy

);

大家注意第一个参数的说明：

lpFileName

Points to a null-terminated string that specifies the name of the object (file, pipe, mailslot, communications resource, disk device, console, or directory) to create or open.

If *lpFileName is a path, there is a default string size limit of MAX_PATH characters. This limit is related to how the CreateFile function parses paths.

Windows NT: You can use paths longer than MAX_PATH characters by calling the wide (W) version of CreateFile and prepending "\\?\" to the path. The "\\?\" tells the function to turn off path parsing. This lets you use paths that are nearly 32,000 Unicode characters long. You must use fully-qualified paths with this technique. This also works with UNC names. The "\\?\" is ignored as part of the path. For example, "\\?\C:\myworld\private" is seen as "C:\myworld\private", and "\\?\UNC\tom_1\hotstuff\coolapps" is seen as "\\tom_1\hotstuff\coolapps".

上面的意思大概是说"\\?\"可以引用路径(英语垃圾，大家最好自己看)。

尤其是下面的这一段：

Disk Devices

Windows NT: You can use the CreateFile function to open a disk drive or a partition on a disk drive. The function returns a handle to the disk device; that handle can be used with the DeviceIOControl function. The following requirements must be met in order for such a call to succeed:

The caller must have administrative privileges for the operation to succeed on a hard disk drive.

The lpFileName string should be of the form \\.\PHYSICALDRIVEx to open the hard disk x. Hard disk numbers start at zero.For example:

String              Meaning

\\.\PHYSICALDRIVE2      Obtains a handle to the third physical drive on the user's computer.

The lpFileName string should be \\.\x: to open a floppy drive x or a partition x on a hard disk.For example:

String  Meaning

\\.\A:  Obtains a handle to drive A on the user's computer.

\\.\C:  Obtains a handle to drive C on the user's computer.

没有骗大家吧，上面说如果你拥有管理员权限，那么lpFileName ＝＝\\.\PHYSICALDRIVE2就是表示打开第三块硬盘，\\.\PHYSICALDRIVE0指的就是第一块硬盘了。lpFileName ＝＝\\.\C:就是打开C盘了。并且返回的句柄还可以用于DeviceIOControl函数，相信大家看到这里应该放下手中的鸡蛋了吧。

由此可以管中窥豹Windows文件管理这个核心是多么的强大。希望对大家有所帮助。

{另附上一段演示读硬盘第一扇区 保存为 Project1.dpr WinXP+Delphi7编译通过}

program Project1;

uses

Windows, Messages, SysUtils, Classes, Graphics, Controls, Forms, Dialogs,

StdCtrls, ExtCtrls;

{$R *.RES}

const

BytesPerSector =512;

SectorCount =1;

SectorStart =0;

drive ='\\.\PHYSICALDRIVE0';

var

str :string;

p :pchar;

i :Cardinal;

hDeviceHandle :Thandle;

begin

hDeviceHandle := CreateFile(drive, GENERIC_READ,

FILE_SHARE_READ OR FILE_SHARE_WRITE, nil, OPEN_EXISTING,0, 0);

if (hDeviceHandle <> INVALID_HANDLE_VALUE) then

begin

p:=allocmem(SectorCount*BytesPerSector);

FileSeek(hDevicehandle,SectorStart*BytesPerSector,0);

if FileRead(hDevicehandle,p[0],SectorCount*BytesPerSector)<>SectorCount*BytesPerSector then

raise exception.create('读取错误');

str:='';

for i:=0 to 512-1 do

begin

if i mod 16=0 then

str:=str+format('0x%.8x ',[i]);

str:=str+format('  %.2x',[integer(p[i])]);

if i mod 16=15 then

str:=str+#13#10;

end;

ShowMessage( str);

freemem(p,SectorCount*BytesPerSector);

closehandle(hDeviceHandle);

end;

end.

{END}

很久以前的东西了 附文章一篇有兴趣可以学习学习