//少花点时间在加密上,多用点时间完善软件。
98下可以直接用形如 StrPas(PChar(Ptr($FFFF5))) 取得,2000下因为权限的问题,不能直接访问
下面的程序可以直接读取物理内存,取出相应的信息
unit Main;
interface
uses
Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
Dialogs, Aclapi, Accctrl, StdCtrls;
type
TMainForm = class(TForm)
InfoMemo: TMemo;
btGetInfo: TButton;
procedure FormCreate(Sender: TObject);
procedure FormDestroy(Sender: TObject);
procedure btGetInfoClick(Sender: TObject);
private
{ Private declarations }
public
{ Public declarations }
end;
PUnicodeString = ^TUnicodeString;
TUnicodeString = packed record
Length: Word;
MaximunLength: Word;
Buffer: PWideChar;
end;
NTSTATUS = Integer;
PObjectAttributes = ^TObjectAttributes;
TObjectAttributes = packed record
Length: DWORD;
RootDirectory: THandle;
ObjectName: PUnicodeString;
Attributes: DWORD;
SecurityDescriptor: PSecurityDescriptor;
SecurityQualityOfService: PSecurityQualityOfService;
end;
TZwOpenSection = function(var SectionHandle: THandle; DesireAccess: ACCESS_MASK;
var ObjectAttributes: TObjectAttributes): NTSTATUS; stdcall;
TZwClose = procedure(SectionHandle: THandle); stdcall;
TRtlInitUnicodeString = procedure(var DestinationString: TUnicodeString;
vSourceString: WideString); stdcall;
const
STATUS_SUCCESS = NTSTATUS(0);
STATUS_INVALID_HANDLE = NTSTATUS($C0000008);
STATUS_ACCESS_DENIED = NTSTATUS($C0000022);
OBJ_INHERIT = $00000002;
OBJ_PERMANENT = $00000010;
OBJ_EXCLUSIVE = $00000020;
OBJ_CASE_INSENSITIVE = $00000040;
OBJ_OPENIF = $00000080;
OBJ_OPENLINK = $00000100;
OBJ_KERNEL_HANDLE = $00000200;
OBJ_VALID_ATTRIBUTES = $000003F2;
ObjectPhysicalMemoryDeviceName = '/Device/Physicalmemory';
NTDLL = 'ntdll.dll';
var
ZwOpenSection: TZwOpenSection;
ZwClose: TZwClose;
RtlInitUnicodeString: TRtlInitUnicodeString;
var
MainForm: TMainForm;
NtLayer: HMODULE;
implementation
{$R *.dfm}
function NT_SUCCESS(var Status: LongInt): Boolean;
begin
Result:=LongInt(Status) >= 0;
end;
procedure InitializeObjectAttributes(var p: TObjectAttributes; n: PUnicodeString;
a: DWORD; r: THandle; s: PSecurityDescriptor);
begin
p.Length:=SizeOf(TObjectAttributes);
p.RootDirectory:=r;
p.Attributes:=a;
p.ObjectName:=n;
p.SecurityDescriptor:=s;
p.SecurityQualityOfService:=Nil;
end;
function SetPhysicalMemorySectionCanBeWrited(hSection: THandle): Boolean;
var
pDacl: PACL;
pNewDacl: PACL;
pSD: PPSECURITY_DESCRIPTOR;
dwRes: Cardinal;
ea: EXPLICIT_ACCESS_A;
label CleanUp;
begin
Result:=False;
pDacl:=Nil;
pNewDacl:=Nil;
pSD:=Nil;
dwres:=GetSecurityInfo(hSection,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION,nil,
nil,@pDacl,nil,pSD);
try
if dwres<>ERROR_SUCCESS then
Exit;
FillChar(ea,SizeOf(EXPLICIT_ACCESS),0);
ea.grfAccessPermissions:=SECTION_MAP_WRITE;
ea.grfAccessMode:=GRANT_ACCESS;
ea.grfInheritance:=NO_INHERITANCE;
ea.Trustee.TrusteeForm:=TRUSTEE_IS_NAME;
ea.Trustee.TrusteeType:=TRUSTEE_IS_USER;
ea.Trustee.ptstrName:='CURRENT_USER';
SetEntriesInAcl(1,@ea,Nil,pNewDacl);
dwRes:=SetSecurityInfo(hSection,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION,
Nil,Nil,pNewDacl,Nil);
if dwRes=ERROR_SUCCESS then
Exit;
Result:=True;
finally
if pSD<>Nil then
LocalFree(Cardinal(pSD^));
if pNewDacl<>Nil then
LocalFree(Cardinal(pSD^));
end;
end;
function OpenPhysicalMemory(ReadOrNot: Boolean): THandle;
var
Status: NTSTATUS;
PhysMem: THandle;
PhysMemString: TUnicodeString;
Attributes: TObjectAttributes;
SectionAttrib: Integer;
PhysMemName: WideString;
begin
Result:=0;
PhysMemName:=ObjectPhysicalMemoryDeviceName;
RtlInitUnicodeString(PhysMemString,PhysMemName);
InitializeObjectAttributes(Attributes,@PhysMemString,OBJ_CASE_INSENSITIVE
or OBJ_KERNEL_HANDLE,0,Nil);
if ReadOrNot then
SectionAttrib:=SECTION_MAP_READ
else
SectionAttrib:=SECTION_MAP_READ or SECTION_MAP_WRITE;
Status:=ZwOpenSection(PhysMem,SectionAttrib,Attributes);
if not ReadOrNot then
begin
if Status=STATUS_ACCESS_DENIED then
begin
Status:=ZwOpenSection(PhysMem,READ_CONTROL or WRITE_DAC,Attributes);
SetPhysicalMemorySectionCanBeWrited(PhysMem);
ZwClose(PhysMem);
Status:=ZwOpenSection(PhysMem,SectionAttrib,Attributes);
end;
end;
if not NT_SUCCESS(Status) then
Exit;
Result:=PhysMem;
end;
function MapPhysicalMemory(ReadOrNot: Boolean; PhysicalMemory: THandle;
Address: DWORD; Length: DWORD; var VirtualAddress: PChar): Boolean;
var
Access: Cardinal;
begin
if ReadOrNot then
Access:=FILE_MAP_READ
else
Access:=FILE_MAP_READ or FILE_MAP_WRITE;
VirtualAddress:=MapViewOfFile(PhysicalMemory,Access,0,Address,Length);
Inc(DWORD(VirtualAddress),Address Mod $1000);
Result:=True;
end;
procedure UnMapPhysicalMemory(Address: Pointer);
begin
UnMapViewOfFile(Address);
end;
function LocateNtdllEntryPoints: Boolean;
begin
NtLayer:=GetModuleHandle(NTDLL);
if NtLayer=0 then
begin
SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
Result:=False;
Exit;
end
else
begin
if not Assigned(ZwOpenSection) then
ZwOpenSection:=GetProcAddress(NtLayer,'ZwOpenSection');
if not Assigned(ZwClose) then
ZwClose:=GetProcAddress(NtLayer,'ZwClose');
if not Assigned(RtlInitUnicodeString) then
RtlInitUnicodeString:=GetProcAddress(NtLayer,'RtlInitUnicodeString');
end;
Result:=True;
end;
function ReadWritePhyMem(Address: DWORD; Length: DWORD; Buffer: PChar;
ReadOrNot: Boolean = True): Boolean;
var
PhysMem: THandle;
vAddress: PChar;
begin
Result:=False;
if not Assigned(ZwOpenSection) then
Exit;
PhysMem:=OpenPhysicalMemory(ReadOrNot);
if PhysMem=0 then
Exit;
if not MapPhysicalMemory(ReadOrNot,PhysMem,Address,Length,vAddress) then
Exit;
try
if ReadOrNot then
Move(vAddress^,Buffer^,Length)
else
Move(Buffer^,vAddress^,Length);
Result:=True;
except
on E: Exception do
MessageBox(Application.Handle,PChar('缓冲区长度不足或内存跨段。'#13+
'每个内存段为 4KB 的整数倍,每次读写不能跨越多个不同的内存段。'),
'错误',MB_ICONERROR+MB_OK+MB_SYSTEMMODAL);
end;
UnMapPhysicalMemory(vAddress);
ZwClose(PhysMem);
end;
procedure TMainForm.FormCreate(Sender: TObject);
begin
if not LocateNtdllEntryPoints then
begin
MessageBox(Application.Handle,'无法加载 NTDLL.dll!','错误',MB_ICONERROR+
MB_OK+MB_SYSTEMMODAL);
Close;
end;
end;
procedure TMainForm.FormDestroy(Sender: TObject);
begin
FreeLibrary(NtLayer);
end;
procedure TMainForm.btGetInfoClick(Sender: TObject);
var
Buffer: PChar;
Length: Integer;
i: Integer;
begin
with InfoMemo do
begin
Clear;
Length:=$30;
GetMem(Buffer,Length);
try
if ReadWritePhyMem($FE061,Length,Buffer) then
Lines.Add('BIOS 版本: '+StrPas(Buffer));
finally
FreeMem(Buffer);
end;
Length:=$FF;
GetMem(Buffer,Length);
try
if ReadWritePhyMem($FE091,Length,Buffer) then
Lines.Add('BIOS 版权信息: '+StrPas(Buffer));
finally
FreeMem(Buffer);
end;
Length:=$B;
GetMem(Buffer,Length);
try
if ReadWritePhyMem($FFFF5,Length,Buffer) then
Lines.Add('BIOS 日期: '+StrPas(Buffer));
finally
FreeMem(Buffer);
end;
Length:=$FF;
GetMem(Buffer,Length);
try
if ReadWritePhyMem($FE0C1,Length,Buffer) then
Lines.Add('名称: '+StrPas(Buffer));
finally
FreeMem(Buffer);
end;
Length:=$FF;
GetMem(Buffer,Length);
try
if ReadWritePhyMem($FEC71,Length,Buffer) then
Lines.Add('主板序列号: '+StrPas(Buffer));
finally
FreeMem(Buffer);
end;
Lines.Add('');
Length:=$E;
GetMem(Buffer,Length);
try
if ReadWritePhyMem($400,Length,Buffer) then
begin
for i:=0 to 3 do
Lines.Add(Format('串口 %d 输入/输出范围: %x',[i+1,PWORD(@Buffer[i*2])^]));
Lines.Add('');
for i:=0 to 2 do
Lines.Add(Format('并口 %d 输入/输出范围: %x',[i+1,PWORD(@Buffer[8+i*2])^]));
end;
finally
FreeMem(Buffer);
end;
end;
end;
end.