?? gdtdump.bat
字號:
;@echo off
;goto make
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
;
; Global Descriptor Table Dumper - Let you browse Global Descriptor Table content.
;
; To understand it better read
; IA-32 Intel Architecture Software Developer抯 Manual
; Volume 3 : System Programming Guide
;
; Written by Four-F (four-f@mail.ru)
;
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
.386
.model flat, stdcall
option casemap:none
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
; I N C L U D E F I L E S
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
include \masm32\include\windows.inc
include \masm32\include\kernel32.inc
include \masm32\include\user32.inc
include \masm32\include\advapi32.inc
include \masm32\include\comctl32.inc
include \masm32\include\gdi32.inc
includelib \masm32\lib\kernel32.lib
includelib \masm32\lib\user32.lib
includelib \masm32\lib\advapi32.lib
includelib \masm32\lib\comctl32.lib
includelib \masm32\lib\gdi32.lib
include \masm32\include\winioctl.inc
include \masm32\Macros\Strings.mac
include ..\common.inc
include gdt.inc
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
; S T R U C T U R E S
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
; F U N C T I O N S P R O T O T Y P E S
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
DlgProc proto :HWND, :UINT, :WPARAM, :LPARAM
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
; M A C R O S
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
$invoke MACRO vars:VARARG
invoke vars
EXITM <eax>
ENDM
date MACRO
local pos, month
;; Day
pos = 1
% FORC chr, @Date
IF (pos EQ 4) OR (pos EQ 5)
db "&chr"
ENDIF
pos = pos + 1
ENDM
;; Month
pos = 1
% FORC chr, @Date
IF (pos EQ 1)
month TEXTEQU @SubStr(%@Date, 1 , 2)
IF month EQ 01
db " Jan "
ELSEIF month EQ 02
db " Feb "
ELSEIF month EQ 03
db " Mar "
ELSEIF month EQ 04
db " Apr "
ELSEIF month EQ 05
db " May "
ELSEIF month EQ 06
db " Jun "
ELSEIF month EQ 07
db " Jul "
ELSEIF month EQ 08
db " Aug "
ELSEIF month EQ 09
db " Sep "
ELSEIF month EQ 10
db " Oct "
ELSEIF month EQ 11
db " Nov "
ELSEIF month EQ 12
db " Dec "
ENDIF
ENDIF
pos = pos + 1
ENDM
;; Year
db "20"
pos = 1
% FORC chr, @Date
IF (pos EQ 7) OR (pos EQ 8)
db "&chr"
ENDIF
pos = pos + 1
ENDM
ENDM
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
; E Q U A T E S
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
IDD_MAIN equ 1000
IDE_GDT equ 1001
IDM_ABOUT equ 2000
IDI_ICON equ 3000
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
; R E A D O N L Y D A T A
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
.const
g_szAppName db "Global Descriptor Table Dumper", 0
szAbout db "About...", 0
szWrittenBy db "Global Descriptor Table Dumper v1.1", 0Ah, 0Dh
db "Built on "
date
db 0Ah, 0Dh, 0Ah, 0Dh
db "Written by Four-F <four-f@mail.ru>", 0
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
; U N I N I T I A L I Z E D D A T A
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
.data?
g_hInstance HINSTANCE ?
g_hDlg HWND ?
g_hwndEditGdt HWND ?
g_hFontOld HFONT ?
g_hFontNew HFONT ?
g_pBuffer LPVOID ?
g_cbBytesReturned DWORD ?
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
; C O D E
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
.code
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
; PrintGdtDump
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
PrintGdtDump proc uses esi edi ebx
local buffer[256]:CHAR
local dwSelector:DWORD
invoke GetProcessHeap
invoke HeapAlloc, eax, HEAP_NO_SERIALIZE + HEAP_ZERO_MEMORY, 1000h * 10
.if eax == NULL
ret
.endif
mov edi, eax
mov esi, g_pBuffer
invoke wsprintf, addr buffer, $CTA0("Global Descriptor Table\nBase: %08X Limit: %08X\n"), dword ptr [esi], dword ptr [esi][4]
invoke lstrcpy, edi, addr buffer
CTA "\nBase\t
?? 快捷鍵說明
復制代碼
Ctrl + C
搜索代碼
Ctrl + F
全屏模式
F11
切換主題
Ctrl + Shift + D
顯示快捷鍵
?
增大字號
Ctrl + =
減小字號
Ctrl + -