參考資訊:
https://wasm.in/
http://four-f.narod.ru/
https://github.com/steward-fu/ddk
main.asm
.386p .model flat, stdcall option casemap:none include c:\masm32\include\w2k\hal.inc include c:\masm32\include\w2k\ntstatus.inc include c:\masm32\include\w2k\ntddk.inc include c:\masm32\include\w2k\ntoskrnl.inc include c:\masm32\include\w2k\ntddkbd.inc include c:\masm32\Macros\Strings.mac includelib c:\masm32\lib\wxp\i386\hal.lib includelib c:\masm32\lib\wxp\i386\ntoskrnl.lib public DriverEntry MAX_THREAD equ 3 .data myLock KSPIN_LOCK 0 pNextDev PDEVICE_OBJECT 0 .const MSG_LOCKING byte "Thread%d, Locking",0 MSG_LOCKED byte "Thread%d, Locked",0 MSG_UNLOCKING byte "Thread%d, Unlocking",0 MSG_UNLOCKED byte "Thread%d, Unlocked",0 .code RunMe proc t : DWORD local c0 : DWORD local c1 : DWORD local oldirql : KIRQL invoke DbgPrint, offset MSG_LOCKING, t invoke KeAcquireSpinLock, offset myLock, addr oldirql invoke DbgPrint, offset MSG_LOCKED, t mov c0, 10000 d0: mov c1, 10000 d1: dec c1 jnz d1 dec c0 jnz d0 invoke DbgPrint, offset MSG_UNLOCKING, t invoke KeReleaseSpinLock, offset myLock, oldirql invoke DbgPrint, offset MSG_UNLOCKED, t ret RunMe endp MyThread proc pParam : DWORD local stTime:LARGE_INTEGER or stTime.HighPart, -1 mov stTime.LowPart, -10000000 invoke KeDelayExecutionThread, KernelMode, FALSE, addr stTime invoke RunMe, pParam invoke PsTerminateSystemThread, STATUS_SUCCESS ret MyThread endp IrpPnp proc pMyDevice : PDEVICE_OBJECT, pIrp : PIRP local szSymName : UNICODE_STRING IoGetCurrentIrpStackLocation pIrp movzx eax, (IO_STACK_LOCATION ptr [eax]).MinorFunction .if eax == IRP_MN_START_DEVICE mov eax, pIrp mov (_IRP ptr [eax]).IoStatus.Status, STATUS_SUCCESS .elseif eax == IRP_MN_REMOVE_DEVICE invoke RtlInitUnicodeString, addr szSymName, $CTW0("\\DosDevices\\MyDriver") invoke IoDeleteSymbolicLink, addr szSymName mov eax, pIrp mov (_IRP ptr [eax]).IoStatus.Status, STATUS_SUCCESS invoke IoDetachDevice, pNextDev invoke IoDeleteDevice, pMyDevice fastcall IofCompleteRequest, pIrp, IO_NO_INCREMENT ret .endif IoSkipCurrentIrpStackLocation pIrp invoke IoCallDriver, pNextDev, pIrp ret IrpPnp endp AddDevice proc pMyDriver : PDRIVER_OBJECT, pPhyDevice : PDEVICE_OBJECT local pMyDevice : PDEVICE_OBJECT local szDevName : UNICODE_STRING local szSymName : UNICODE_STRING invoke RtlInitUnicodeString, addr szDevName, $CTW0("\\Device\\MyDriver") invoke RtlInitUnicodeString, addr szSymName, $CTW0("\\DosDevices\\MyDriver") invoke IoCreateDevice, pMyDriver, 0, addr szDevName, FILE_DEVICE_UNKNOWN, 0, FALSE, addr pMyDevice .if eax == STATUS_SUCCESS invoke IoAttachDeviceToDeviceStack, pMyDevice, pPhyDevice .if eax != NULL push eax pop pNextDev mov eax, pMyDevice or (DEVICE_OBJECT ptr [eax]).Flags, DO_BUFFERED_IO and (DEVICE_OBJECT ptr [eax]).Flags, not DO_DEVICE_INITIALIZING invoke IoCreateSymbolicLink, addr szSymName, addr szDevName .endif .endif ret AddDevice endp Unload proc pMyDriver : PDRIVER_OBJECT ret Unload endp DriverEntry proc pMyDriver : PDRIVER_OBJECT, pMyRegistry : PUNICODE_STRING local cnt : DWORD local hThread : DWORD mov eax, pMyDriver mov (DRIVER_OBJECT ptr [eax]).MajorFunction[IRP_MJ_PNP * (sizeof PVOID)], offset IrpPnp mov (DRIVER_OBJECT ptr [eax]).DriverUnload, offset Unload mov eax, (DRIVER_OBJECT ptr [eax]).DriverExtension mov (DRIVER_EXTENSION ptr [eax]).AddDevice, AddDevice invoke KeInitializeSpinLock, offset myLock mov cnt, 0 th: invoke PsCreateSystemThread, addr hThread, THREAD_ALL_ACCESS, NULL, -1, NULL, offset MyThread, cnt .if eax == STATUS_SUCCESS invoke ZwClose, hThread .endif inc cnt cmp cnt, MAX_THREAD jnz th mov eax, STATUS_SUCCESS ret DriverEntry endp end
使用四顆CPU測試
每次只會有一顆CPU進入執行