delphi 随意将函数执行权限提高到Ring0源代码

//随意将函数执行权限提高到Ring0源代码
//Windows 2K以上的操作系统，
//用途: 提供超级简单使用的APIrocessRing0()，
//可将delphi中的任意函数由原來的Ring3权限提升到系统的最高级别Ring 0,
//这样我们就可以随意对系统的I/O进行操作了。

//===================WinRing.pas===========================
unit WinRing;

interface
uses Windows,WinSvc,Dialogs,Forms;
Type
TRingData = Record
AdjRing0Entry:ULONG ;
RegData:array[..] of ULONG;
end;

TRing0Proc = Procedure;StdCall;

procedure OpenWinRing;
function CloseDriver:boolean;
procedure ProcessRing0(Ring0Proc: TRing0Proc);StdCall;

const
DRIVER = 'WINRING';

implementation
var
DriverHandle: THandle;
Ring: TRingData;
RetByteWord;
OSVersion: byte;

Function WINRING_Access:Cardinal;
Begin
Result:=(($) shl ) or (($) shl );
End;

Procedure _WinRing;
Begin
DeviceIoControl(DriverHandle,WINRING_Access,@Ring,
sizeof(Ring),@Ring,sizeof(Ring),retbyte,Nil);
End;

function BuildDriverService:boolean;
var
scHandle, srvHandle: SC_Handle;
achar;
begin
Result:=False;
scHandle:=OpenSCManager(Nil,Nil,SC_MANAGER_ALL_ACCESS);
if (scHandle<>) then
Begin
srvHandle:=OpenService(scHandle,DRIVER,SERVICE_ALL_ACCESS);
if (srvHandle=) then
begin
srvHandle:=CreateService(
scHandle,
DRIVER,
DRIVER,
SERVICE_ALL_ACCESS,
SERVICE_KERNEL_DRIVER,
SERVICE_DEMAND_START,
SERVICE_ERROR_NORMAL,
'.\WINRING.sys',
Nil,Nil,Nil,nil,nil);
end;
if (srvHandle<>) then
Begin
A:='';
StartService(srvHandle,,A);
CloseServiceHandle(srvHandle);
CloseServiceHandle(scHandle);
Result:= true;
End;
end;
end;

function OpenDriver:Boolean;
begin
if (BuildDriverService) then
begin
DriverHandle:=CreateFile(
'\\.\'+DRIVER,
GENERIC_READ or GENERIC_WRITE,
,
nil,
OPEN_EXISTING,
,
);

Result:=(DriverHandle<>INVALID_HANDLE_VALUE);
end else
Result:=False;
end;

function DeleteDriverService:boolean;
var
srvStatus: TServiceStatus;
scHandle,srvHandle: SC_HANDLE;
begin
scHandle:=OpenSCManager(Nil,Nil,SC_MANAGER_ALL_ACCESS);
if (scHandle<>) then
begin
srvHandle:=OpenService(scHandle,DRIVER,SERVICE_ALL_ACCESS);
if (srvHandle<>) then
begin
ControlService(srvHandle,SERVICE_CONTROL_STOP,srvStatus);
DeleteService(srvHandle);
end;
CloseServiceHandle(srvHandle);
CloseServiceHandle(scHandle);
Result:=true;
end Else
Result:=False;
end;

function CloseDriver:boolean;
begin
CloseHandle(DriverHandle);
Result:=DeleteDriverService;
end;

procedure OpenWinRing;
begin
OSVersion := LOBYTE(LOWORD(GetVersion));
if (OSVersion<>) then
begin
if (not OpenDriver) then
begin
ShowMessage('Driver not ready!!!');
CloseDriver;
Application.Terminate;
end;
end;
end;

procedure SaveAllReg;stdcall;
Begin
Asm
push eax
mov eax, offset Ring.RegData
mov [eax][], ebx
mov [eax][], ecx
mov [eax][], edx
mov [eax][], esi
mov [eax][], edi
mov [eax][], ebp
mov ebx, eax
pop eax
mov [ebx], eax
End;
end;

procedure ProcessRing0(Ring0Proc: TRing0Proc);StdCall;
var
retbyteWORD;
Label ADJRing0,ADJRing;
Begin
SaveAllReg();
Asm
Mov Ring.AdjRing0Entry, offset ADJRing0
End;
DeviceIoControl(DriverHandle,WINRING_Access,
@Ring, sizeof(Ring), @Ring, sizeof(Ring), retbyte, Nil);
Asm
jmp ADJRing
ADJRing0:
mov eax, [esp+]
End;
Ring0Proc;
Asm
Ret
ADJRing:
End;
end;

end.

//===================Unit1.pas==========
复制内容到剪贴板代码:

unit Unit1;

interface

uses
Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
Dialogs,WinRing, StdCtrls, ExtCtrls;

type
TForm1 = class(TForm)
Button1: TButton;
Timer1: TTimer;
procedure Button1Click(Sender: TObject);
procedure FormClose(Sender: TObject; var Action: TCloseAction);
procedure Timer1Timer(Sender: TObject);
private
{ Private declarations }
public
{ Public declarations }
end;

var
Form1: TForm1;
Timer:Array[..] Of Byte;
V:Integer;

implementation

{$R *.dfm}

procedure TForm1.Button1Click(Sender: TObject);
begin
OpenWinRing;
end;

procedure TForm1.FormClose(Sender: TObject; var Action: TCloseAction);
begin
CloseDriver;
end;

Procedure Test;StdCall;
Var
Val1,Index:Byte;
I:Integer;
Begin
Asm
cli
End;
for i:= to  Do Begin
Index:=i*;
asm
mov al, Index
out $, al
in al, $
mov Val1, al
End;
Timer:=Val1;
End;
Asm
sti
End;
End;

procedure TForm1.Timer1Timer(Sender: TObject);
begin
ProcessRing0(Test);
Form1.Caption:=Format('%2x,%2x,%2x',[Timer[],Timer[],Timer[]]);
end;
end.