masm32-kernel-programming/KmdKit18/examples/simple/NtBuild/NtBuild.asm at main · therealdreg/masm32-kernel-programming · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
.386
.model flat, stdcall
option casemap:none

;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
;                                  I N C L U D E   F I L E S
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

include \masm32\include\windows.inc

include \masm32\include\kernel32.inc
include \masm32\include\user32.inc
include \masm32\include\advapi32.inc

includelib \masm32\lib\kernel32.lib
includelib \masm32\lib\user32.lib
includelib \masm32\lib\advapi32.lib

include \masm32\Macros\Strings.mac

include \masm32\include\winioctl.inc

include common.inc

;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
;                              U N I N I T I A L I Z E D  D A T A
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

.data?
g_hSCManager		HANDLE	?
g_hService			HANDLE	?
g_acDriverPath		CHAR	MAX_PATH dup(?)
g_ss				SERVICE_STATUS <>

;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
;                                       C O D E
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

.code

DisplayNtBuild proc uses ebx

local abyBuffer[DATA_SIZE]:BYTE
local acBuffer[32]:CHAR
local dwNumberOfBytesRead:DWORD
local hDevice:HANDLE

	mov ebx, INVALID_HANDLE_VALUE			; assume driver is not installed

	; Driver will receive IRP_MJ_CREATE
	invoke CreateFile, $CTA0("\\\\.\\NtBuild"), GENERIC_READ, FILE_SHARE_READ, NULL, \
						OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL
	.if eax != INVALID_HANDLE_VALUE
		mov hDevice, eax
		xor ebx, ebx						; Driver installed

		; Driver will receive IRP_MJ_READ
		invoke ReadFile, hDevice, addr abyBuffer, DATA_SIZE, addr dwNumberOfBytesRead, NULL

		.if ( eax != 0 ) && ( dwNumberOfBytesRead == DATA_SIZE )
			mov ecx, dword ptr abyBuffer
			mov edx, ecx
			shr ecx, 28
			and edx, 3FFFh
			.if cl == 0Fh
				mov ecx, $CTA0("Free")
			.elseif cl == 0Ch
				mov ecx, $CTA0("Checked")
			.else
				mov ecx, $CTA0("??")
			.endif
			invoke wsprintf, addr acBuffer, $CTA0("%s build %u"), ecx, edx
			invoke MessageBox, NULL, addr acBuffer, $CTA0("Windows Build Info"), MB_OK + MB_ICONINFORMATION
		.else
			invoke MessageBox, NULL, $CTA0("Can't send control code to driver."), NULL, MB_OK + MB_ICONSTOP
		.endif
		; Driver will receive IRP_MJ_CLOSE
		invoke CloseHandle, hDevice
	.endif

	mov eax, ebx
	ret

DisplayNtBuild endp

;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
;
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

start:

	invoke DisplayNtBuild

	.if eax == INVALID_HANDLE_VALUE
		; Driver is not installed. Let's do it.

		; Open a handle to the SC Manager database
		invoke OpenSCManager, NULL, NULL, SC_MANAGER_ALL_ACCESS
		.if eax != NULL
			mov g_hSCManager, eax

			push eax
			invoke GetFullPathName, $CTA0("NtBuild.sys"), sizeof g_acDriverPath, addr g_acDriverPath, esp
	    	pop eax

			; Install service
			invoke CreateService, g_hSCManager, $CTA0("NtBuild"), $CTA0("OS Build Fetcher"), \
				SERVICE_START + SERVICE_STOP + DELETE, SERVICE_KERNEL_DRIVER, SERVICE_DEMAND_START, \
				SERVICE_ERROR_IGNORE, addr g_acDriverPath, NULL, NULL, NULL, NULL, NULL
			.if eax != NULL
				mov g_hService, eax

				; Driver's DriverEntry procedure will be called
				invoke StartService, g_hService, 0, NULL
				.if eax != 0
					invoke DisplayNtBuild
					.if eax == INVALID_HANDLE_VALUE
						invoke MessageBox, NULL, $CTA0("Device is not present."), NULL, MB_OK + MB_ICONSTOP
					.endif
					; DriverUnload proc in our driver will be called
					invoke ControlService, g_hService, SERVICE_CONTROL_STOP, addr g_ss
				.else
					invoke MessageBox, NULL, $CTA0("Can't start driver."), NULL, MB_OK + MB_ICONSTOP
				.endif
				invoke DeleteService, g_hService
				invoke CloseServiceHandle, g_hService
			.else
				invoke MessageBox, NULL, $CTA0("Can't register driver."), NULL, MB_OK + MB_ICONSTOP
			.endif
			invoke CloseServiceHandle, g_hSCManager
		.else
			invoke MessageBox, NULL, $CTA0("Can't connect to Service Control Manager."), NULL, MB_OK + MB_ICONSTOP
		.endif
	.endif

	invoke ExitProcess, 0

;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
;
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

end start