IoCompleteRequest深入学习之一
2009-06-15 16:07
375 查看
lkd> u IoCompleteRequest
nt!IoCompleteRequest:
804f04e2 8bff mov edi,edi
804f04e4 55 push ebp
804f04e5 8bec mov ebp,esp
804f04e7 8a550c mov dl,byte ptr [ebp+0Ch]
804f04ea 8b4d08 mov ecx,dword ptr [ebp+8]
804f04ed ff1504c85480 call dword ptr [nt!pIofCompleteRequest (8054c804)]
804f04f3 5d pop ebp
804f04f4 c20800 ret 8
逆向为c:
VOID IoCompleteRequest( IN PIRP Irp,
IN CCHAR PriorityBoost )
{
pIofCompleteRequest(Irp,PriorityBoost);
}
可以看出pIofCompleteRequest 是一个函数指针. 我们看看这个函数指针的值是804f15d2 .
lkd> dd 8054c804
8054c804 804f15d2 804f0d12 804ef3dc 00000000
8054c814 00000000 00000000 00000000 00000000
因此我们继续看看804f15d2 的汇编码,
lkd> uf 804f15d2
nt!IopfCompleteRequest:
804f15d2 8bff mov edi,edi
804f15d4 55 push ebp
804f15d5 8bec mov ebp,esp
804f15d7 83ec10 sub esp,10h
804f15da 53 push ebx
804f15db 56 push esi
804f15dc 8bf1 mov esi,ecx ;IN PIRP Irp
804f15de 8a4e23 mov cl,byte ptr [esi+23h] ;cl = Irp->CurrentLocation
804f15e1 8955f8 mov dword ptr [ebp-8],edx ;PriorityBoost
804f15e4 8a5622 mov dl,byte ptr [esi+22h] ; dl = Irp->StackCount
804f15e7 33db xor ebx,ebx
804f15e9 fec2 inc dl
804f15eb 3aca cmp cl,dl
804f15ed 57 push edi
804f15ee 895df4 mov dword ptr [ebp-0Ch],ebx
804f15f1 0f8f91020000 jg nt!IopfCompleteRequest+0x2b6 (804f1888)
nt!IopfCompleteRequest+0x25:
804f15f7 66833e06 cmp word ptr [esi],6 ;Irp->Type
804f15fb 0f8587020000 jne nt!IopfCompleteRequest+0x2b6 (804f1888)
//从这里开始循环
nt!IopfCompleteRequest+0x2f:
804f1601 8b7e60 mov edi,dword ptr [esi+60h];
;edi = Irp->Tail.Overlay.CurrentStackLocation
804f1604 fec1 inc cl ;Irp->CurrentLocation++
804f1606 3aca cmp cl,dl
804f1608 8d4724 lea eax,[edi+24h]
; eax 指向下一个IO_STACK_LOCATION
804f160b 884e23 mov byte ptr [esi+23h],cl ;Irp->CurrentLocation
804f160e 894660 mov dword ptr [esi+60h],eax
;Irp->Tail.Overlay.CurrentStackLocation++
804f1611 0f8fab000000 jg nt!IopfCompleteRequest+0xf0 (804f16c2)
nt!IopfCompleteRequest+0x45:
804f1617 83c703 add edi,3
;edi = Irp->Tail.Overlay.CurrentStackLocation.Control
nt!IopfCompleteRequest+0x48:
804f161a 8a17 mov dl,byte ptr [edi]
; dl = Irp->Tail.Overlay.CurrentStackLocation.Control
804f161c 80e201 and dl,1
804f161f 395e18 cmp dword ptr [esi+18h],ebx ;Irp->IoStatus ebx = 0
804f1622 8855ff mov byte ptr [ebp-1],dl
804f1625 885621 mov byte ptr [esi+21h],dl ;Irp->PendingReturned
804f1628 8a17 mov dl,byte ptr [edi]
;dl = Irp->Tail.Overlay.CurrentStackLocation. Control
804f162a 7c07 jl nt!IopfCompleteRequest+0x61 (804f1633)
nt!IopfCompleteRequest+0x5a:
804f162c f6c240 test dl,40h
804f162f 7510 jne nt!IopfCompleteRequest+0x6f (804f1641)
nt!IopfCompleteRequest+0x5f:
804f1631 eb04 jmp nt!IopfCompleteRequest+0x65 (804f1637)
nt!IopfCompleteRequest+0x61:
804f1633 84d2 test dl,dl
;dl = Irp->Tail.Overlay.CurrentStackLocation. Control
804f1635 780a js nt!IopfCompleteRequest+0x6f (804f1641)
nt!IopfCompleteRequest+0x65:
804f1637 385e24 cmp byte ptr [esi+24h],bl ;Irp->Cancel
804f163a 7444 je nt!IopfCompleteRequest+0xae (804f1680)
nt!IopfCompleteRequest+0x6a:
804f163c f6c220 test dl,20h
;dl = Irp->Tail.Overlay.CurrentStackLocation. Control
804f163f 743f je nt!IopfCompleteRequest+0xae (804f1680)
nt!IopfCompleteRequest+0x6f:
804f1641 885ffe mov byte ptr [edi-2],bl ;前面edi + 3,这里再调整回来。
804f1644 885fff mov byte ptr [edi-1],bl
804f1647 881f mov byte ptr [edi],bl
804f1649 895f01 mov dword ptr [edi+1],ebx
804f164c 895f05 mov dword ptr [edi+5],ebx
804f164f 895f09 mov dword ptr [edi+9],ebx
804f1652 895f0d mov dword ptr [edi+0Dh],ebx
804f1655 895f15 mov dword ptr [edi+15h],ebx
804f1658 8a4622 mov al,byte ptr [esi+22h] ;Irp->StackCount
804f165b fec0 inc al
804f165d 384623 cmp byte ptr [esi+23h],al ;Irp->CurrentLocation
804f1660 7504 jne nt!IopfCompleteRequest+0x94 (804f1666)
nt!IopfCompleteRequest+0x90:
804f1662 33c0 xor eax,eax
804f1664 eb06 jmp nt!IopfCompleteRequest+0x9a (804f166c)
nt!IopfCompleteRequest+0x94:
804f1666 8b4660 mov eax,dword ptr [esi+60h];
;eax= Irp->Tail.Overlay.CurrentStackLocation.
804f1669 8b4014 mov eax,dword ptr [eax+14h]
;eax = Irp->Tail.Overlay.CurrentStackLocation.DeviceObject
nt!IopfCompleteRequest+0x9a:
804f166c ff771d push dword ptr [edi+1Dh]
; Irp->Tail.Overlay.CurrentStackLocation.Context
804f166f 56 push esi
804f1670 50 push eax
804f1671 ff5719 call dword ptr [edi+19h]
; Irp->Tail.Overlay.CurrentStackLocation.CompletionRoutine
804f1674 3d160000c0 cmp eax,0C0000016h
804f1679 752a jne nt!IopfCompleteRequest+0xd3 (804f16a5)
nt!IopfCompleteRequest+0xa9: ;退出
804f167b 5f pop edi
804f167c 5e pop esi
804f167d 5b pop ebx
804f167e c9 leave
804f167f c3 ret
nt!IopfCompleteRequest+0xae:
804f1680 385dff cmp byte ptr [ebp-1],bl
804f1683 7409 je nt!IopfCompleteRequest+
4000
0xbc (804f168e)
nt!IopfCompleteRequest+0xb3:
804f1685 3a4e22 cmp cl,byte ptr [esi+22h];Irp->StackCount
804f1688 7f04 jg nt!IopfCompleteRequest+0xbc (804f168e)
nt!IopfCompleteRequest+0xb8:
804f168a 80480301 or byte ptr [eax+3],1
nt!IopfCompleteRequest+0xbc: //清零
804f168e 885ffe mov byte ptr [edi-2],bl
804f1691 885fff mov byte ptr [edi-1],bl
804f1694 881f mov byte ptr [edi],bl
804f1696 895f01 mov dword ptr [edi+1],ebx
804f1699 895f05 mov dword ptr [edi+5],ebx
804f169c 895f09 mov dword ptr [edi+9],ebx
804f169f 895f0d mov dword ptr [edi+0Dh],ebx
804f16a2 895f15 mov dword ptr [edi+15h],ebx
nt!IopfCompleteRequest+0xd3:
804f16a5 83466024 add dword ptr [esi+60h],24h //循环步长
804f16a9 8b4660 mov eax,dword ptr [esi+60h]
804f16ac 83c724 add edi,24h
804f16af fe4623 inc byte ptr [esi+23h] ;Irp->CurrentLocation
804f16b2 8a5622 mov dl,byte ptr [esi+22h];Irp->StackCount
804f16b5 8a4e23 mov cl,byte ptr [esi+23h]
804f16b8 fec2 inc dl
804f16ba 3aca cmp cl,dl
804f16bc 0f8e58ffffff jle nt!IopfCompleteRequest+0x48 (804f161a) //回跳
//前面是一个循环。
nt!IopfCompleteRequest+0xf0:
804f16c2 f6460808 test byte ptr [esi+8],8 ;Irp->Flags
804f16c6 7428 je nt!IopfCompleteRequest+0x11e (804f16f0)
nt!IopfCompleteRequest+0xf6:
804f16c8 8b7e0c mov edi,dword ptr [esi+0Ch]
; Irp->AssociatedIrp.MasterIrp
804f16cb 6a0a push 0Ah
804f16cd 8d570c lea edx,[edi+0Ch]
804f16d0 59 pop ecx
804f16d1 e814310000 call nt!IopInterlockedDecrementUlong (804f47ea)
804f16d6 56 push esi
804f16d7 8bd8 mov ebx,eax
804f16d9 e85c2d0000 call nt!IopFreeIrpAndMdls (804f443a)
804f16de 83fb01 cmp ebx,1
804f16e1 7598 jne nt!IopfCompleteRequest+0xa9 (804f167b) ;退出
nt!IopfCompleteRequest+0x111:
804f16e3 8a55f8 mov dl,byte ptr [ebp-8]
804f16e6 8bcf mov ecx,edi
804f16e8 ff1504c85480 call dword ptr [nt!pIofCompleteRequest (8054c804)]
804f16ee eb8b jmp nt!IopfCompleteRequest+0xa9 (804f167b) ;退出
nt!IopfCompleteRequest+0x11e:
804f16f0 817e1804010000 cmp dword ptr [esi+18h],104h ;Irp->IoStatus
804f16f7 7521 jne nt!IopfCompleteRequest+0x148 (804f171a)
nt!IopfCompleteRequest+0x127:
804f16f9 8b461c mov eax,dword ptr [esi+1Ch]
804f16fc 83f801 cmp eax,1
804f16ff 7619 jbe nt!IopfCompleteRequest+0x148 (804f171a)
nt!IopfCompleteRequest+0x12f:
804f1701 3d030000a0 cmp eax,0A0000003h
804f1706 750b jne nt!IopfCompleteRequest+0x141 (804f1713)
nt!IopfCompleteRequest+0x136:
804f1708 8b4654 mov eax,dword ptr [esi+54h];
;Irp->Tail.Overlay.AuxiliaryBuffer
804f170b 8945f4 mov dword ptr [ebp-0Ch],eax
804f170e 895e54 mov dword ptr [esi+54h],ebx
804f1711 eb07 jmp nt!IopfCompleteRequest+0x148 (804f171a)
nt!IopfCompleteRequest+0x141:
804f1713 c74618790200c0 mov dword ptr [esi+18h],0C0000279h ;Irp->IoStatus
nt!IopfCompleteRequest+0x148:
804f171a 8b4654 mov eax,dword ptr [esi+54h]
;Irp->Tail.Overlay.AuxiliaryBuffer
804f171d 3bc3 cmp eax,ebx
804f171f 740a je nt!IopfCompleteRequest+0x159 (804f172b)
nt!IopfCompleteRequest+0x14f:
804f1721 53 push ebx ;
804f1722 50 push eax ;eax = Irp->Tail.Overlay.AuxiliaryBuffer
804f1723 e8be360500 call nt!ExFreePoolWithTag (80544de6)
804f1728 895e54 mov dword ptr [esi+54h],ebx
nt!IopfCompleteRequest+0x159:
804f172b 8b4608 mov eax,dword ptr [esi+8] ;Irp->Flags
804f172e 66a90204 test ax,402h
804f1732 747b je nt!IopfCompleteRequest+0x1dd (804f17af)
nt!IopfCompleteRequest+0x162:
804f1734 66a94004 test ax,440h
804f1738 53 push ebx //KeSetEvent 参数1
804f1739 7449 je nt!IopfCompleteRequest+0x1b2 (804f1784)
nt!IopfCompleteRequest+0x169:
804f173b 8b4e18 mov ecx,dword ptr [esi+18h] ;Irp->IoStatus
804f173e 83e042 and eax,42h
804f1741 8bf8 mov edi,eax
804f1743 8b4628 mov eax,dword ptr [esi+28h] ;eax = Irp->UserIosb
804f1746 8908 mov dword ptr [eax],ecx
804f1748 8b4e1c mov ecx,dword ptr [esi+1Ch]
;ecx = Irp->IoStatus.Information
804f174b 894804 mov dword ptr [eax+4],ecx
804f174e 0fbe45f8 movsx eax,byte ptr [ebp-8]
804f1752 50 push eax //KeSetEvent 参数2
804f1753 ff762c push dword ptr [esi+2Ch] ;Irp->UserEvent KeSetEvent 参数3
804f1756 e8db870000 call nt!KeSetEvent (804f9f36)
804f175b 3bfb cmp edi,ebx
804f175d 0f8418ffffff je nt!IopfCompleteRequest+0xa9 (804f167b) ;退出
nt!IopfCompleteRequest+0x191:
804f1763 3b35801d5580 cmp esi,dword ptr [nt!IopReserveIrpAllocator (80551d80)]
804f1769 750e jne nt!IopfCompleteRequest+0x1a7 (804f1779)
nt!IopfCompleteRequest+0x199:
804f176b ff75f8 push dword ptr [ebp-8] //KeInitializeApc 参数
804f176e 56 push esi
804f176f e886310000 call nt!IopFreeReserveIrp (804f48fa)
804f1774 e902ffffff jmp nt!IopfCompleteRequest+0xa9 (804f167b) ;退出
nt!IopfCompleteRequest+0x1a7:
804f1779 56 push esi
804f177a e84bdcffff call nt!IoFreeIrp (804ef3ca)
804f177f e9f7feffff jmp nt!IopfCompleteRequest+0xa9 (804f167b) ;退出
nt!IopfCompleteRequest+0x1b2:
804f1784 0fbe4626 movsx eax,byte ptr [esi+26h] ;Irp->ApcEnvironment
804f1788 53 push ebx
804f1789 53 push ebx
804f178a 53 push ebx
804f178b 6882424f80 push offset nt!IopCompletePageWrite (804f4282)
804f1790 50 push eax
804f1791 ff7650 push dword ptr [esi+50h] ;Irp->Tail.Overlay.Thread
804f1794 8d7e40 lea edi,[esi+40h] ; Irp->Tail.Apc
804f1797 57 push edi
804f1798 e835a20000 call nt!KeInitializeApc (804fb9d2)
804f179d 0fbe45f8 movsx eax,byte ptr [ebp-8]
804f17a1 50 push eax
804f17a2 53 push ebx
804f17a3 53 push ebx
nt!IopfCompleteRequest+0x1d2:
804f17a4 57 push edi
804f17a5 e88aa20000 call nt!KeInsertQueueApc (804fba34)
804f17aa e9ccfeffff jmp nt!IopfCompleteRequest+0xa9 (804f167b) ;退出
nt!IopfCompleteRequest+0x1dd:
804f17af 8b7e04 mov edi,dword ptr [esi+4] ;Irp->MdlAddress
804f17b2 eb08 jmp nt!IopfCompleteRequest+0x1ea (804f17bc)
nt!IopfCompleteRequest+0x1e2:
804f17b4 57 push edi ;edi = Irp->MdlAddress
804f17b5 e888590100 call nt!MmUnlockPages (80507142)
804f17ba 8b3f mov edi,dword ptr [edi] ;mdl = mdl->Next;
nt!IopfCompleteRequest+0x1ea:
804f17bc 3bfb cmp edi,ebx ;edi = Irp->MdlAddress ,ebx = 0
804f17be 75f4 jne nt!IopfCompleteRequest+0x1e2 (804f17b4)
nt!IopfCompleteRequest+0x1ee: //这里
804f17c0 f6460908 test byte ptr [esi+9],8 ;Irp->Flags低字高位
804f17c4 742a je nt!IopfCompleteRequest+0x21e (804f17f0)
nt!IopfCompleteRequest+0x1f4:
804f17c6 385e21 cmp byte ptr [esi+21h],bl ;Irp->PendingReturned
804f17c9 7525 jne nt!IopfCompleteRequest+0x21e (804f17f0)
nt!IopfCompleteRequest+0x1f9:
804f17cb 817e1804010000 cmp dword ptr [esi+18h],104h;Irp->IoStatus
804f17d2 0f85a3feffff jne nt!IopfCompleteRequest+0xa9 (804f167b) ;退出
nt!IopfCompleteRequest+0x206:
804f17d8 817e1c030000a0 cmp dword ptr [esi+1Ch],0A0000003h
804f17df 0f8596feffff jne nt!IopfCompleteRequest+0xa9 (804f167b) ;退出
nt!IopfCompleteRequest+0x213:
804f17e5 8b45f4 mov eax,dword ptr [ebp-0Ch]
804f17e8 894654 mov dword ptr [esi+54h],eax
804f17eb e98bfeffff jmp nt!IopfCompleteRequest+0xa9 (804f167b) ;退出
nt!IopfCompleteRequest+0x21e:
804f17f0 385e24 cmp byte ptr [esi+24h],bl ;Irp->Cancel
804f17f3 8b7e64 mov edi,dword ptr [esi+64h]
;Irp->Tail.Overlay.OriginalFileObject
804f17f6 897df0 mov dword ptr [ebp-10h],edi
804f17f9 752e jne nt!IopfCompleteRequest+0x257 (804f1829)
nt!IopfCompleteRequest+0x229:
804f17fb 0fbe4626 movsx eax,byte ptr [esi+26h]
804f17ff 53 push ebx
804f1800 53 push ebx
804f1801 53 push ebx
804f1802 6852635780 push offset nt!IopAbortRequest (80576352)
804f1807 68aa4a4f80 push offset nt!IopCompleteRequest (804f4aaa)
804f180c 50 push eax
804f180d ff7650 push dword ptr [esi+50h]
804f1810 8d7e40 lea edi,[esi+40h]
804f1813 57 push edi
804f1814 e8b9a10000 call nt!KeInitializeApc (804fb9d2)
804f1819 0fbe45f8 movsx eax,byte ptr [ebp-8]
804f181d 50 push eax
804f181e ff75f4 push dword ptr [ebp-0Ch]
804f1821 ff75f0 push dword ptr [ebp-10h]
804f1824 e97bffffff jmp nt!IopfCompleteRequest+0x1d2 (804f17a4)
nt!IopfCompleteRequest+0x257:
804f1829 ff1514874d80 call dword ptr [nt!_imp__KeRaiseIrqlToDpcLevel (804d8714)]
804f182f 8ac8 mov cl,al
804f1831 8b4650 mov eax,dword ptr [esi+50h]
804f1834 3bc3 cmp eax,ebx
804f1836 884dff mov byte ptr [ebp-1],cl
804f1839 743b je nt!IopfCompleteRequest+0x2a4 (804f1876)
nt!IopfCompleteRequest+0x269:
804f183b 0fbe4e26 movsx ecx,byte ptr [esi+26h]
804f183f 53 push ebx
804f1840 53 push ebx
804f1841 53 push ebx
804f1842 6852635780 push offset nt!IopAbortRequest (80576352)
804f1847 68aa4a4f80 push offset nt!IopCompleteRequest (804f4aaa)
804f184c 51 push ecx
804f184d 50 push eax
804f184e 8d7e40 lea edi,[esi+40h]
804f1851 57 push edi
804f1852 e87ba10000 call nt!KeInitializeApc (804fb9d2)
804f1857 0fbe45f8 movsx eax,byte ptr [ebp-8]
804f185b 50 push eax
804f185c ff75f4 push dword ptr [ebp-0Ch]
804f185f ff75f0 push dword ptr [ebp-10h]
804f1862 57 push edi
804f1863 e8cca10000 call nt!KeInsertQueueApc (804fba34)
804f1868 8a4dff mov cl,byte ptr [ebp-1]
804f186b ff151c874d80 call dword ptr [nt!_imp_KfLowerIrql (804d871c)]
804f1871 e905feffff jmp nt!IopfCompleteRequest+0xa9 (804f167b) ;退出
nt!IopfCompleteRequest+0x2a4:
804f1876 ff151c874d80 call dword ptr [nt!_imp_KfLowerIrql (804d871c)]
804f187c 57 push edi
804f187d 56 push esi
804f187e e80b2b0000 call nt!IopDropIrp (804f438e)
804f1883 e9f3fdffff jmp nt!IopfCompleteRequest+0xa9 (804f167b) ;退出
nt!IopfCompleteRequest+0x2b6:
804f1888 53 push ebx
804f1889 53 push ebx
804f188a 68630d0000 push 0D63h
804f188f 56 push esi
804f1890 6a44 push 44h
804f1892 e88d830000 call nt!KeBugCheckEx (804f9c24)
804f1897 cc int 3
nt!IoCompleteRequest:
804f04e2 8bff mov edi,edi
804f04e4 55 push ebp
804f04e5 8bec mov ebp,esp
804f04e7 8a550c mov dl,byte ptr [ebp+0Ch]
804f04ea 8b4d08 mov ecx,dword ptr [ebp+8]
804f04ed ff1504c85480 call dword ptr [nt!pIofCompleteRequest (8054c804)]
804f04f3 5d pop ebp
804f04f4 c20800 ret 8
逆向为c:
VOID IoCompleteRequest( IN PIRP Irp,
IN CCHAR PriorityBoost )
{
pIofCompleteRequest(Irp,PriorityBoost);
}
可以看出pIofCompleteRequest 是一个函数指针. 我们看看这个函数指针的值是804f15d2 .
lkd> dd 8054c804
8054c804 804f15d2 804f0d12 804ef3dc 00000000
8054c814 00000000 00000000 00000000 00000000
因此我们继续看看804f15d2 的汇编码,
lkd> uf 804f15d2
nt!IopfCompleteRequest:
804f15d2 8bff mov edi,edi
804f15d4 55 push ebp
804f15d5 8bec mov ebp,esp
804f15d7 83ec10 sub esp,10h
804f15da 53 push ebx
804f15db 56 push esi
804f15dc 8bf1 mov esi,ecx ;IN PIRP Irp
804f15de 8a4e23 mov cl,byte ptr [esi+23h] ;cl = Irp->CurrentLocation
804f15e1 8955f8 mov dword ptr [ebp-8],edx ;PriorityBoost
804f15e4 8a5622 mov dl,byte ptr [esi+22h] ; dl = Irp->StackCount
804f15e7 33db xor ebx,ebx
804f15e9 fec2 inc dl
804f15eb 3aca cmp cl,dl
804f15ed 57 push edi
804f15ee 895df4 mov dword ptr [ebp-0Ch],ebx
804f15f1 0f8f91020000 jg nt!IopfCompleteRequest+0x2b6 (804f1888)
nt!IopfCompleteRequest+0x25:
804f15f7 66833e06 cmp word ptr [esi],6 ;Irp->Type
804f15fb 0f8587020000 jne nt!IopfCompleteRequest+0x2b6 (804f1888)
//从这里开始循环
nt!IopfCompleteRequest+0x2f:
804f1601 8b7e60 mov edi,dword ptr [esi+60h];
;edi = Irp->Tail.Overlay.CurrentStackLocation
804f1604 fec1 inc cl ;Irp->CurrentLocation++
804f1606 3aca cmp cl,dl
804f1608 8d4724 lea eax,[edi+24h]
; eax 指向下一个IO_STACK_LOCATION
804f160b 884e23 mov byte ptr [esi+23h],cl ;Irp->CurrentLocation
804f160e 894660 mov dword ptr [esi+60h],eax
;Irp->Tail.Overlay.CurrentStackLocation++
804f1611 0f8fab000000 jg nt!IopfCompleteRequest+0xf0 (804f16c2)
nt!IopfCompleteRequest+0x45:
804f1617 83c703 add edi,3
;edi = Irp->Tail.Overlay.CurrentStackLocation.Control
nt!IopfCompleteRequest+0x48:
804f161a 8a17 mov dl,byte ptr [edi]
; dl = Irp->Tail.Overlay.CurrentStackLocation.Control
804f161c 80e201 and dl,1
804f161f 395e18 cmp dword ptr [esi+18h],ebx ;Irp->IoStatus ebx = 0
804f1622 8855ff mov byte ptr [ebp-1],dl
804f1625 885621 mov byte ptr [esi+21h],dl ;Irp->PendingReturned
804f1628 8a17 mov dl,byte ptr [edi]
;dl = Irp->Tail.Overlay.CurrentStackLocation. Control
804f162a 7c07 jl nt!IopfCompleteRequest+0x61 (804f1633)
nt!IopfCompleteRequest+0x5a:
804f162c f6c240 test dl,40h
804f162f 7510 jne nt!IopfCompleteRequest+0x6f (804f1641)
nt!IopfCompleteRequest+0x5f:
804f1631 eb04 jmp nt!IopfCompleteRequest+0x65 (804f1637)
nt!IopfCompleteRequest+0x61:
804f1633 84d2 test dl,dl
;dl = Irp->Tail.Overlay.CurrentStackLocation. Control
804f1635 780a js nt!IopfCompleteRequest+0x6f (804f1641)
nt!IopfCompleteRequest+0x65:
804f1637 385e24 cmp byte ptr [esi+24h],bl ;Irp->Cancel
804f163a 7444 je nt!IopfCompleteRequest+0xae (804f1680)
nt!IopfCompleteRequest+0x6a:
804f163c f6c220 test dl,20h
;dl = Irp->Tail.Overlay.CurrentStackLocation. Control
804f163f 743f je nt!IopfCompleteRequest+0xae (804f1680)
nt!IopfCompleteRequest+0x6f:
804f1641 885ffe mov byte ptr [edi-2],bl ;前面edi + 3,这里再调整回来。
804f1644 885fff mov byte ptr [edi-1],bl
804f1647 881f mov byte ptr [edi],bl
804f1649 895f01 mov dword ptr [edi+1],ebx
804f164c 895f05 mov dword ptr [edi+5],ebx
804f164f 895f09 mov dword ptr [edi+9],ebx
804f1652 895f0d mov dword ptr [edi+0Dh],ebx
804f1655 895f15 mov dword ptr [edi+15h],ebx
804f1658 8a4622 mov al,byte ptr [esi+22h] ;Irp->StackCount
804f165b fec0 inc al
804f165d 384623 cmp byte ptr [esi+23h],al ;Irp->CurrentLocation
804f1660 7504 jne nt!IopfCompleteRequest+0x94 (804f1666)
nt!IopfCompleteRequest+0x90:
804f1662 33c0 xor eax,eax
804f1664 eb06 jmp nt!IopfCompleteRequest+0x9a (804f166c)
nt!IopfCompleteRequest+0x94:
804f1666 8b4660 mov eax,dword ptr [esi+60h];
;eax= Irp->Tail.Overlay.CurrentStackLocation.
804f1669 8b4014 mov eax,dword ptr [eax+14h]
;eax = Irp->Tail.Overlay.CurrentStackLocation.DeviceObject
nt!IopfCompleteRequest+0x9a:
804f166c ff771d push dword ptr [edi+1Dh]
; Irp->Tail.Overlay.CurrentStackLocation.Context
804f166f 56 push esi
804f1670 50 push eax
804f1671 ff5719 call dword ptr [edi+19h]
; Irp->Tail.Overlay.CurrentStackLocation.CompletionRoutine
804f1674 3d160000c0 cmp eax,0C0000016h
804f1679 752a jne nt!IopfCompleteRequest+0xd3 (804f16a5)
nt!IopfCompleteRequest+0xa9: ;退出
804f167b 5f pop edi
804f167c 5e pop esi
804f167d 5b pop ebx
804f167e c9 leave
804f167f c3 ret
nt!IopfCompleteRequest+0xae:
804f1680 385dff cmp byte ptr [ebp-1],bl
804f1683 7409 je nt!IopfCompleteRequest+
4000
0xbc (804f168e)
nt!IopfCompleteRequest+0xb3:
804f1685 3a4e22 cmp cl,byte ptr [esi+22h];Irp->StackCount
804f1688 7f04 jg nt!IopfCompleteRequest+0xbc (804f168e)
nt!IopfCompleteRequest+0xb8:
804f168a 80480301 or byte ptr [eax+3],1
nt!IopfCompleteRequest+0xbc: //清零
804f168e 885ffe mov byte ptr [edi-2],bl
804f1691 885fff mov byte ptr [edi-1],bl
804f1694 881f mov byte ptr [edi],bl
804f1696 895f01 mov dword ptr [edi+1],ebx
804f1699 895f05 mov dword ptr [edi+5],ebx
804f169c 895f09 mov dword ptr [edi+9],ebx
804f169f 895f0d mov dword ptr [edi+0Dh],ebx
804f16a2 895f15 mov dword ptr [edi+15h],ebx
nt!IopfCompleteRequest+0xd3:
804f16a5 83466024 add dword ptr [esi+60h],24h //循环步长
804f16a9 8b4660 mov eax,dword ptr [esi+60h]
804f16ac 83c724 add edi,24h
804f16af fe4623 inc byte ptr [esi+23h] ;Irp->CurrentLocation
804f16b2 8a5622 mov dl,byte ptr [esi+22h];Irp->StackCount
804f16b5 8a4e23 mov cl,byte ptr [esi+23h]
804f16b8 fec2 inc dl
804f16ba 3aca cmp cl,dl
804f16bc 0f8e58ffffff jle nt!IopfCompleteRequest+0x48 (804f161a) //回跳
//前面是一个循环。
nt!IopfCompleteRequest+0xf0:
804f16c2 f6460808 test byte ptr [esi+8],8 ;Irp->Flags
804f16c6 7428 je nt!IopfCompleteRequest+0x11e (804f16f0)
nt!IopfCompleteRequest+0xf6:
804f16c8 8b7e0c mov edi,dword ptr [esi+0Ch]
; Irp->AssociatedIrp.MasterIrp
804f16cb 6a0a push 0Ah
804f16cd 8d570c lea edx,[edi+0Ch]
804f16d0 59 pop ecx
804f16d1 e814310000 call nt!IopInterlockedDecrementUlong (804f47ea)
804f16d6 56 push esi
804f16d7 8bd8 mov ebx,eax
804f16d9 e85c2d0000 call nt!IopFreeIrpAndMdls (804f443a)
804f16de 83fb01 cmp ebx,1
804f16e1 7598 jne nt!IopfCompleteRequest+0xa9 (804f167b) ;退出
nt!IopfCompleteRequest+0x111:
804f16e3 8a55f8 mov dl,byte ptr [ebp-8]
804f16e6 8bcf mov ecx,edi
804f16e8 ff1504c85480 call dword ptr [nt!pIofCompleteRequest (8054c804)]
804f16ee eb8b jmp nt!IopfCompleteRequest+0xa9 (804f167b) ;退出
nt!IopfCompleteRequest+0x11e:
804f16f0 817e1804010000 cmp dword ptr [esi+18h],104h ;Irp->IoStatus
804f16f7 7521 jne nt!IopfCompleteRequest+0x148 (804f171a)
nt!IopfCompleteRequest+0x127:
804f16f9 8b461c mov eax,dword ptr [esi+1Ch]
804f16fc 83f801 cmp eax,1
804f16ff 7619 jbe nt!IopfCompleteRequest+0x148 (804f171a)
nt!IopfCompleteRequest+0x12f:
804f1701 3d030000a0 cmp eax,0A0000003h
804f1706 750b jne nt!IopfCompleteRequest+0x141 (804f1713)
nt!IopfCompleteRequest+0x136:
804f1708 8b4654 mov eax,dword ptr [esi+54h];
;Irp->Tail.Overlay.AuxiliaryBuffer
804f170b 8945f4 mov dword ptr [ebp-0Ch],eax
804f170e 895e54 mov dword ptr [esi+54h],ebx
804f1711 eb07 jmp nt!IopfCompleteRequest+0x148 (804f171a)
nt!IopfCompleteRequest+0x141:
804f1713 c74618790200c0 mov dword ptr [esi+18h],0C0000279h ;Irp->IoStatus
nt!IopfCompleteRequest+0x148:
804f171a 8b4654 mov eax,dword ptr [esi+54h]
;Irp->Tail.Overlay.AuxiliaryBuffer
804f171d 3bc3 cmp eax,ebx
804f171f 740a je nt!IopfCompleteRequest+0x159 (804f172b)
nt!IopfCompleteRequest+0x14f:
804f1721 53 push ebx ;
804f1722 50 push eax ;eax = Irp->Tail.Overlay.AuxiliaryBuffer
804f1723 e8be360500 call nt!ExFreePoolWithTag (80544de6)
804f1728 895e54 mov dword ptr [esi+54h],ebx
nt!IopfCompleteRequest+0x159:
804f172b 8b4608 mov eax,dword ptr [esi+8] ;Irp->Flags
804f172e 66a90204 test ax,402h
804f1732 747b je nt!IopfCompleteRequest+0x1dd (804f17af)
nt!IopfCompleteRequest+0x162:
804f1734 66a94004 test ax,440h
804f1738 53 push ebx //KeSetEvent 参数1
804f1739 7449 je nt!IopfCompleteRequest+0x1b2 (804f1784)
nt!IopfCompleteRequest+0x169:
804f173b 8b4e18 mov ecx,dword ptr [esi+18h] ;Irp->IoStatus
804f173e 83e042 and eax,42h
804f1741 8bf8 mov edi,eax
804f1743 8b4628 mov eax,dword ptr [esi+28h] ;eax = Irp->UserIosb
804f1746 8908 mov dword ptr [eax],ecx
804f1748 8b4e1c mov ecx,dword ptr [esi+1Ch]
;ecx = Irp->IoStatus.Information
804f174b 894804 mov dword ptr [eax+4],ecx
804f174e 0fbe45f8 movsx eax,byte ptr [ebp-8]
804f1752 50 push eax //KeSetEvent 参数2
804f1753 ff762c push dword ptr [esi+2Ch] ;Irp->UserEvent KeSetEvent 参数3
804f1756 e8db870000 call nt!KeSetEvent (804f9f36)
804f175b 3bfb cmp edi,ebx
804f175d 0f8418ffffff je nt!IopfCompleteRequest+0xa9 (804f167b) ;退出
nt!IopfCompleteRequest+0x191:
804f1763 3b35801d5580 cmp esi,dword ptr [nt!IopReserveIrpAllocator (80551d80)]
804f1769 750e jne nt!IopfCompleteRequest+0x1a7 (804f1779)
nt!IopfCompleteRequest+0x199:
804f176b ff75f8 push dword ptr [ebp-8] //KeInitializeApc 参数
804f176e 56 push esi
804f176f e886310000 call nt!IopFreeReserveIrp (804f48fa)
804f1774 e902ffffff jmp nt!IopfCompleteRequest+0xa9 (804f167b) ;退出
nt!IopfCompleteRequest+0x1a7:
804f1779 56 push esi
804f177a e84bdcffff call nt!IoFreeIrp (804ef3ca)
804f177f e9f7feffff jmp nt!IopfCompleteRequest+0xa9 (804f167b) ;退出
nt!IopfCompleteRequest+0x1b2:
804f1784 0fbe4626 movsx eax,byte ptr [esi+26h] ;Irp->ApcEnvironment
804f1788 53 push ebx
804f1789 53 push ebx
804f178a 53 push ebx
804f178b 6882424f80 push offset nt!IopCompletePageWrite (804f4282)
804f1790 50 push eax
804f1791 ff7650 push dword ptr [esi+50h] ;Irp->Tail.Overlay.Thread
804f1794 8d7e40 lea edi,[esi+40h] ; Irp->Tail.Apc
804f1797 57 push edi
804f1798 e835a20000 call nt!KeInitializeApc (804fb9d2)
804f179d 0fbe45f8 movsx eax,byte ptr [ebp-8]
804f17a1 50 push eax
804f17a2 53 push ebx
804f17a3 53 push ebx
nt!IopfCompleteRequest+0x1d2:
804f17a4 57 push edi
804f17a5 e88aa20000 call nt!KeInsertQueueApc (804fba34)
804f17aa e9ccfeffff jmp nt!IopfCompleteRequest+0xa9 (804f167b) ;退出
nt!IopfCompleteRequest+0x1dd:
804f17af 8b7e04 mov edi,dword ptr [esi+4] ;Irp->MdlAddress
804f17b2 eb08 jmp nt!IopfCompleteRequest+0x1ea (804f17bc)
nt!IopfCompleteRequest+0x1e2:
804f17b4 57 push edi ;edi = Irp->MdlAddress
804f17b5 e888590100 call nt!MmUnlockPages (80507142)
804f17ba 8b3f mov edi,dword ptr [edi] ;mdl = mdl->Next;
nt!IopfCompleteRequest+0x1ea:
804f17bc 3bfb cmp edi,ebx ;edi = Irp->MdlAddress ,ebx = 0
804f17be 75f4 jne nt!IopfCompleteRequest+0x1e2 (804f17b4)
nt!IopfCompleteRequest+0x1ee: //这里
804f17c0 f6460908 test byte ptr [esi+9],8 ;Irp->Flags低字高位
804f17c4 742a je nt!IopfCompleteRequest+0x21e (804f17f0)
nt!IopfCompleteRequest+0x1f4:
804f17c6 385e21 cmp byte ptr [esi+21h],bl ;Irp->PendingReturned
804f17c9 7525 jne nt!IopfCompleteRequest+0x21e (804f17f0)
nt!IopfCompleteRequest+0x1f9:
804f17cb 817e1804010000 cmp dword ptr [esi+18h],104h;Irp->IoStatus
804f17d2 0f85a3feffff jne nt!IopfCompleteRequest+0xa9 (804f167b) ;退出
nt!IopfCompleteRequest+0x206:
804f17d8 817e1c030000a0 cmp dword ptr [esi+1Ch],0A0000003h
804f17df 0f8596feffff jne nt!IopfCompleteRequest+0xa9 (804f167b) ;退出
nt!IopfCompleteRequest+0x213:
804f17e5 8b45f4 mov eax,dword ptr [ebp-0Ch]
804f17e8 894654 mov dword ptr [esi+54h],eax
804f17eb e98bfeffff jmp nt!IopfCompleteRequest+0xa9 (804f167b) ;退出
nt!IopfCompleteRequest+0x21e:
804f17f0 385e24 cmp byte ptr [esi+24h],bl ;Irp->Cancel
804f17f3 8b7e64 mov edi,dword ptr [esi+64h]
;Irp->Tail.Overlay.OriginalFileObject
804f17f6 897df0 mov dword ptr [ebp-10h],edi
804f17f9 752e jne nt!IopfCompleteRequest+0x257 (804f1829)
nt!IopfCompleteRequest+0x229:
804f17fb 0fbe4626 movsx eax,byte ptr [esi+26h]
804f17ff 53 push ebx
804f1800 53 push ebx
804f1801 53 push ebx
804f1802 6852635780 push offset nt!IopAbortRequest (80576352)
804f1807 68aa4a4f80 push offset nt!IopCompleteRequest (804f4aaa)
804f180c 50 push eax
804f180d ff7650 push dword ptr [esi+50h]
804f1810 8d7e40 lea edi,[esi+40h]
804f1813 57 push edi
804f1814 e8b9a10000 call nt!KeInitializeApc (804fb9d2)
804f1819 0fbe45f8 movsx eax,byte ptr [ebp-8]
804f181d 50 push eax
804f181e ff75f4 push dword ptr [ebp-0Ch]
804f1821 ff75f0 push dword ptr [ebp-10h]
804f1824 e97bffffff jmp nt!IopfCompleteRequest+0x1d2 (804f17a4)
nt!IopfCompleteRequest+0x257:
804f1829 ff1514874d80 call dword ptr [nt!_imp__KeRaiseIrqlToDpcLevel (804d8714)]
804f182f 8ac8 mov cl,al
804f1831 8b4650 mov eax,dword ptr [esi+50h]
804f1834 3bc3 cmp eax,ebx
804f1836 884dff mov byte ptr [ebp-1],cl
804f1839 743b je nt!IopfCompleteRequest+0x2a4 (804f1876)
nt!IopfCompleteRequest+0x269:
804f183b 0fbe4e26 movsx ecx,byte ptr [esi+26h]
804f183f 53 push ebx
804f1840 53 push ebx
804f1841 53 push ebx
804f1842 6852635780 push offset nt!IopAbortRequest (80576352)
804f1847 68aa4a4f80 push offset nt!IopCompleteRequest (804f4aaa)
804f184c 51 push ecx
804f184d 50 push eax
804f184e 8d7e40 lea edi,[esi+40h]
804f1851 57 push edi
804f1852 e87ba10000 call nt!KeInitializeApc (804fb9d2)
804f1857 0fbe45f8 movsx eax,byte ptr [ebp-8]
804f185b 50 push eax
804f185c ff75f4 push dword ptr [ebp-0Ch]
804f185f ff75f0 push dword ptr [ebp-10h]
804f1862 57 push edi
804f1863 e8cca10000 call nt!KeInsertQueueApc (804fba34)
804f1868 8a4dff mov cl,byte ptr [ebp-1]
804f186b ff151c874d80 call dword ptr [nt!_imp_KfLowerIrql (804d871c)]
804f1871 e905feffff jmp nt!IopfCompleteRequest+0xa9 (804f167b) ;退出
nt!IopfCompleteRequest+0x2a4:
804f1876 ff151c874d80 call dword ptr [nt!_imp_KfLowerIrql (804d871c)]
804f187c 57 push edi
804f187d 56 push esi
804f187e e80b2b0000 call nt!IopDropIrp (804f438e)
804f1883 e9f3fdffff jmp nt!IopfCompleteRequest+0xa9 (804f167b) ;退出
nt!IopfCompleteRequest+0x2b6:
804f1888 53 push ebx
804f1889 53 push ebx
804f188a 68630d0000 push 0D63h
804f188f 56 push esi
804f1890 6a44 push 44h
804f1892 e88d830000 call nt!KeBugCheckEx (804f9c24)
804f1897 cc int 3
相关文章推荐
- IoCompleteRequest深入学习之二
- js_html_input中autocomplete="off"在chrom中失效的解决办法 使用JS模拟锚点跳转 js如何获取url参数 C#模拟httpwebrequest请求_向服务器模拟cookie发送 实习期学到的技术(一) LinqPad的变量比较功能 ASP.NET EF 使用LinqPad 快速学习Linq
- IoCompleteRequest函数
- IoCompleteRequest routine
- [转]IoCompleteRequest函数源码
- socket.io学习教程之深入学习篇(三)
- IoCompleteRequest
- swoole深入学习 5. AsyncIO 异步IO
- IoCompleteRequest的实现逻辑
- [转]对内核函数IoCompleteRequest的分析
- 深入学习请求响应(三)---request的应用
- 基于 Django1.10 文档的深入学习(14)—— Request and response objects 之 HttpResponse objects
- 深入学习Java IO关闭
- Java深入学习之 IO
- 对内核函数IoCompleteRequest的分析
- IO阻塞与非阻塞,同步与异步学习笔记
- 深入学习微框架:Spring Boot
- 深入Java集合学习系列:HashMap的实现原理
- 学习 XMLHTTPRequest 和 AJAX
- 从 prototype.js 深入学习 javascript 的面向对象特性