Der Code ist für 2000/XP.
Code: Alles auswählen
.386
.model flat, stdcall
option casemap:none
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
; I N C L U D E F I L E S
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
;für Test
include \masm32\include\windows.inc
include \masm32\include\kernel32.inc
include \masm32\include\user32.inc
include \masm32\include\debug.inc
includelib \masm32\lib\user32.lib
includelib \masm32\lib\kernel32.lib
includelib \masm32\lib\debug.lib
;include \masm32\include\w2k\ntdef.inc
include \masm32\include\w2k\ntstatus.inc
include \masm32\include\w2k\ntdll.inc
includelib \masm32\lib\w2k\ntdll.lib
IFNDEF UNICODE_STRING
UNICODE_STRING STRUCT
_Length WORD ? ; len of string in bytes (not chars)
MaximumLength WORD ? ; len of Buffer in bytes (not chars)
Buffer PWSTR ? ; pointer to string
UNICODE_STRING ENDS
PUNICODE_STRING typedef PTR UNICODE_STRING
ENDIF
UNICODE_NULL equ 0
OBJECT_ATTRIBUTES STRUCT ; sizeof = 18h
dwLength DWORD ? ; original name Length
RootDirectory HANDLE ?
ObjectName PUNICODE_STRING ?
Attributes DWORD ?
SecurityDescriptor PVOID ? ; Points to type SECURITY_DESCRIPTOR
SecurityQualityOfService PVOID ? ; Points to type SECURITY_QUALITY_OF_SERVICE
OBJECT_ATTRIBUTES ENDS
.data
MsgCaption db "Iczelion's tutorial no.2",0
MsgBoxText db "Win32 Assembly is Great!",0
KeyHandle dd 0
Disposition dd 0
LSA_Unicode dw 512,514,0,0
COUNTED_ANSI_STRING dw 0,0,0,0
ANSI db "\Registry\Machine\Software\Mister Root",0
ACCESS_RIGHTS dd 196633
Unicode db 518 dup(?)
.data?
POBJECT_ATTRIBUTES OBJECT_ATTRIBUTES <>
;::::::::::::::::::::::::::::: ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
; C O D E
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
.code
start:
invoke RtlInitAnsiString,addr COUNTED_ANSI_STRING,addr ANSI
PrintDec eax," Rückgabe von RtlInitAnsiString "
lea ecx,COUNTED_ANSI_STRING
mov ax,[ecx+0]
PrintDec ax," Länge des Strings "
mov ax,[ecx+2]
PrintDec ax," Länge des Bereichs "
mov eax,[ecx+4]
PrintStringByAddr eax
lea ecx,LSA_Unicode
lea eax,Unicode
mov [ecx+4],eax
invoke RtlAnsiStringToUnicodeString,addr LSA_Unicode,addr COUNTED_ANSI_STRING,0
PrintDec eax," Rückgabe von RtlAnsiStringToUnicodeString "
lea ecx,LSA_Unicode
mov ax,[ecx+0]
PrintDec ax," Länge des Strings "
mov ax,[ecx+2]
PrintDec ax," Länge des Bereichs "
mov eax,[ecx+4]
PrintDec eax," Adresse des Unicode-Strings "
mov POBJECT_ATTRIBUTES.dwLength,24
mov POBJECT_ATTRIBUTES.RootDirectory,NULL
lea ecx,LSA_Unicode
mov POBJECT_ATTRIBUTES.ObjectName,ecx
mov POBJECT_ATTRIBUTES.Attributes,64
mov POBJECT_ATTRIBUTES.SecurityDescriptor,NULL
mov POBJECT_ATTRIBUTES.SecurityQualityOfService,NULL
lea ecx,POBJECT_ATTRIBUTES
PrintDec ecx," Adresse der Object_Attributes Struktur"
lea eax,LSA_Unicode
PrintDec eax," Adresse der LSA_Unicode Struktur "
mov [ecx+8],eax
invoke ZwOpenKey,addr KeyHandle,ACCESS_RIGHTS,addr POBJECT_ATTRIBUTES
;invoke ZwCreateKey,addr KeyHandle,ACCESS_RIGHTS,addr POBJECT_ATTRIBUTES,0,0,0,addr Disposition
PrintDec eax," Rückgabe von ZwOpenKey "
PrintDec KeyHandle,"Handle des Schlüssels "
invoke ZwClose,KeyHandle
PrintDec eax," Rückgabe von ZwClose"
invoke MessageBox, NULL,addr MsgBoxText, addr MsgCaption, MB_OK
invoke ExitProcess,0
end start
