锘??xml version="1.0" encoding="utf-8" standalone="yes"?> 閿洏浣滀負璁$畻鏈虹殑涓昏杈撳叆璁懼錛屾槸澶ч儴鍒嗚緭鍏ヤ俊鎭殑涓昏鏉ユ簮錛屼絾鏄垜浠瘡澶╀粠閿洏杈撳叆鐨勪俊鎭畨鍏ㄥ悧錛熼殢鐫浜掕仈緗戠殑鏅強錛屽悇縐嶇綉緇滃簲鐢ㄤ篃鏄眰鍑轟笉絀鳳紝鐢靛瓙璐墿錛岀綉涓婅亰澶╃瓑絳夌瓑絳夛紝姣忓ぉ鎴戜滑閮戒細鍦ㄥ悇縐嶇▼搴忎笂杈撳叆鍚勫紡鍚勬牱寰楀垎瀵嗙爜鍟婄敤鎴峰悕鍟婇摱琛屽崱鍙峰晩錛屼綘璁や負榪欎簺縐樺瘑瀹夊叏鍚楋紵閭d綅鍚屽瑕佽浜嗭細”娌′簨鍟婏紝涓嶉兘鏄湁淇濇姢鎺柦鍚楋紝鍍忎粈涔?/span>QQ鐨勫彿縐版棤鎳堝彲鍑葷殑nprotect鎶鏈紝緗戦摱涔熸湁鍚勭瀹夊叏鎻掍歡錛屾病浜嬬殑錛?/span>” “鍛靛懙錛岀湡鐨勫儚浠栦滑璇寸殑閭f懇瀹夊叏鍚楋紝閭e彲涓嶄竴瀹氾紝娌℃湁浠涔堟槸緇濆鐨?/span>”錛屼笅闈㈡垜浠氨鏉ョ湅鐪嬮敭鐩樼殑縐樺瘑錛岀湅鐪嬮粦瀹滑鏄浣曡褰曚綘鐨勯敭鐩樻搷浣滅殑錛屼互鍙婃垜浠濡備綍鎶靛盡榪欎簺鐚ョ悙鐨勬敾鍑繪柟寮忋?/span> 涓.閿洏鐨勭‖浠舵ā鍨?/span> 鍏跺疄閿洏搴旇綆楁槸璁$畻鏈轟腑鏈綆鍗曠殑璁懼浜嗭紝鍦ㄦ垜浠嬌鐢ㄧ殑鏅氱殑璁$畻鏈虹郴緇熶腑錛屼笌閿洏鏈夊叧鐨勭‖浠惰鐧戒簡涔熷氨鏄袱涓姱鐗囷紝i8048鍜?/span>i8042 銆?/span>i8042涔熷氨鏄?/span>intel8042,浣嶄簬涓繪澘涓?/span>,CPU閫氳繃IO绔彛涓?/span>i8042閫氫俊,i8042璐熻矗璇誨彇閿洏鎸夐敭鐨勬壂鎻忓悧鎴栨槸鍙戦佷釜涓敭鐩樺懡浠?/span>.i8048,瀹冩槸浣嶄簬閿洏涓殑,鏄皢閿洏涓婄殑鎸夐敭杞崲鎴愭墍璋撶殑鎵弿鐮佺殑錛岀劧鍚庝紶閫佺粰i8042銆傚懙鍛碉紝灝辨槸榪欐湯綆鍗曚釜涓滆タ銆備笂闈㈣鐨勯兘鏄瘮杈冭佺殑璁$畻鏈虹殑緇撴瀯浜嗭紝鐜板湪榪欎簺鑺墖閮介泦鎴愬埌鍗楁ˉ鑺墖緇勯噷闈㈠幓浜嗭紝涓嶈繃鍘熺悊榪樻槸榪欐牱鐨勩?/span> 褰撴垜浠寜涓嬩竴涓敭涓庢姮璧風殑鏃跺欓兘浼氳Е鍙戦敭鐩樼殑涓柇錛屽湪鑰佹棭鐨勮綆楁満涓兘鏄噰鐢ㄤ袱鐗?/span>i8259A鑺墖綰ц仈鏉ョ鐞嗕腑鏂殑錛岄敭鐩樻寕鍦ㄤ富鐗囩殑IRQ1寮曡剼涓婏紝褰撴湁鎸夐敭鎸変笅鎴栨姮璧鋒槸浼氬紩鍙戠‖浠朵腑鏂紝鐒跺悗浼氳皟鐢ㄧ浉搴旂殑涓柇澶勭悊紼嬪簭榪涜澶勭悊. 鍦ㄥ疄妯″紡涓庝繚鎶ゆā寮忎笅瀵逛簬涓柇鐨勫鐞嗘槸涓嶅悓鐨勩傚湪瀹炴ā寮忎笅鎴戝氨涓嶈浜嗭紝涔熻涓嶇殑浜嗭紝鑷繁鐪嬬湅寰満鍘熺悊銆傚湪淇濇姢妯″紡涓嬫槸閲囩敤IDT瀵逛腑鏂繘琛岀鐞嗙殑錛屽湪IDT涓槸鍚勭鍚勬牱鐨勯棬鍟婏紝鍟ヤ腑鏂棬錛岄櫡闃遍棬錛岃皟鐢ㄩ棬鍟婄瓑絳夌瓑絳夛紝瀵逛簬閿洏涓柇鍦?/span>XP涓嬪搴旂殑鏄?/span>0X31鍙蜂腑鏂湇鍔★紝浣嗕篃鏈夌殑XP瀵瑰簲鐨勪簨0x93錛屽師鍥犳垜涔熶笉澶槑鐧斤紝鍙嶆鍦ㄦ垜鐨勭郴緇熶笂鏄?/span>0x31鍙楓?/span> 濂戒簡鏃㈢劧閮藉凡緇忛兘璋冪敤涓柇澶勭悊紼嬪簭浜嗭紝閭d箞鍦ㄧ粡榪囦竴緋誨垪澶嶆潅鐨勫鐞嗘渶緇堟垜浠氨鍙互鍦ㄥ簲鐢ㄥ眰涓婅垝鑸掓湇鏈嶇殑鐢?/span>WORD鎵撳瓧浜嗐?/span> 濂戒簡錛岀‖浠惰繖鍧楀氨璇村埌榪欙紝涓嬮潰鐢ㄥ埌浜嗙浉鍏崇殑鎴戜滑鍦ㄨ銆?/span> 浜?/span>.鐚ョ悙鐨勯敭鐩樿褰曞櫒 瀵逛簬閭d簺鐩楀彿鐨勬墍璋撶殑榛戝鎴戞槸寰堜笉榻跨殑錛岃繖閲屾垜浠鎺㈣涓浜涚獌鍙栭敭鐩樹俊鎭殑鏂規硶騫朵笉鏄洿浜嗗啓涓敭鐩樿褰曠殑鐩楀彿紼嬪簭錛屾垜浠彧鏄珯鍦ㄦ敾闃插绔嬬粺涓鐨勮搴︽潵鐪嬪悇寮忕洍鍙鋒墜孌碉紝騫剁粰鍑虹浉鍏崇殑闃插盡鎺柦. 鎴戠煡閬撶殑涓浜涚洍鍙風殑鎵嬫涔熶笉澶氾紝鑰屼笖閮芥槸涓浜涙瘮杈冩櫘閬嶇殑鎵嬫硶錛屾湁浜涗篃閮芥槸鐖風埛杈堢殑鎶鏈簡錛屼笉榪囩幇鍦ㄨ繕鏄緢濂界敤錛屽ソ澶氱洍鍙風殑榪樻槸鐢ㄨ繖浜涘湡鏋湡鐐墦鎵撴墦鎵撳姭… WINDOWS緋葷粺鏄垎涓哄簲鐢ㄥ眰涓庡唴鏍稿眰鐨勶紝浠?/span>CPU鐨勮搴︾湅灝辨槸RING3涓?/span>RING0銆傚簲鐢ㄥ眰鏄彈綆″埗鐨勶紝涓嶅彲榪涜绔彛IO錛屼笉鍙墽琛岀壒鏉冩寚浠わ紝闄愬埗澶氬銆傚唴鏍稿氨涓嶈浜嗭紝鎯沖共鍢涘氨騫插惂銆?/span> 鎴戜篃鏄寜鐓у簲鐢ㄥ眰涓庡唴鏍鎬袱涓眰闈㈣繘琛岃璁虹殑銆傚ソ浜嗗簾璇濆お澶氫簡錛岃繘鍏ユ棰樺惂. 1.鐖風埛杈堢殑WM_GETTEXT娑堟伅鑾峰彇瀵嗙爜 鐢ㄨ繃MFC鐨勯兘鐭ラ亾瀵嗙爜妗嗗惂錛屽氨閭d釜******鐨勬瀛愶紝浠栧叾瀹炴槸涓枃鏈鍙笉榪囨槸鍔犱簡瀵嗙爜灞炴ц屽凡錛屾湰璐ㄤ笂榪樻槸鏂囨湰妗嗐傚浜庢枃鏈鎴戜滑灝卞彲浠ラ氳繃瀵瑰叾鍙戦侊擠錛伎錛э譏錛達即錛ワ幾錛存秷鎭潵鑾峰彇瀵嗙爜鐨勩備笉榪囪繕鏈夌偣闂錛屽湪WIN98緋誨垪涓繖鏍峰氨OK浜嗭紝浣嗘槸NT鍚庯紝浣犺灝辨槸瀵圭潃瀵嗙爜妗嗗ぇ鍠?/span>WM_GETTEXT鏄病鐢ㄧ殑錛屽瘑鐮佹浼氳:“浣犲張涓嶆槸鎴戜滑瀹墮噷鐨勶紝鎴戝嚟鍟ユ妸瀵嗙爜鍛婁綘鍟?#8220;.鍏跺疄榪欐槸璺熸搷浣滅郴緇熸湁鍏崇殑錛屽湪WIN98涓嬫墍鐢ㄧ殑榪涚▼鏄叡浜竴涓?/span>4GB鐨勮櫄鎷熷唴瀛樼殑錛岄偅涓氨娌′粈涔堜綘鐨勬垜鐨勪簡錛屾墍鏈夌殑閮芥槸澶у鍏辨湁鐨勶紝鎵浠ヤ竴涓繘紼嬪鍙︿竴涓繘紼嬪彂閫佷竴涓?/span>WM_GETEXT娑堟伅錛屽簲涓哄ぇ瀹墮兘鏄嚜宸變漢鎵浠ュ瘑鐮佸氨鍛婁綘浜嗐備絾鏄埌浜?/span>NT鍚庡悇涓繘紼嬪氨闂瑰垎瀹朵簡錛屾瘡涓繘紼嬬嫭浜?/span>4GB鐨勮櫄鎷熷唴瀛橈紝鍚勪釜榪涚▼涔嬮棿鏄簰鐩擱殧紱葷殑錛屾墍浠ュ氨娌′漢鐞嗕綘浜嗐?/span> 鎴戜滑瑕侀噰鐢ㄤ簺鐗規畩鐨勬墜孌墊墠鑳芥垚鍔熴備篃灝辨槸瑕佹妸浣犵殑閭f鍙戦?/span>WM_GETTEXT娑堟伅鐨勪唬鐮佺Щ鍒扮洰鏍囪繘紼嬩腑鍘繪墽琛岋紝鏂規硶榪樻槸鏈夌殑錛屾垜浣跨敤鐨勮繙紼嬬嚎紼嬫妧鏈紝涔熷氨鏄皢涓涓姛鑳芥ā鍧楄濡傚埌鐩爣榪涚▼涓劧鍚庢墽琛岋紝榪欐牱灝?/span>OK浜嗐傚浜庡浣曡繘琛岀嚎紼嬫敞鍏ワ紝鏂規硶寰堝錛?/span>google涓涓嬪氨鍙互浜嗐?/span> 鍘熺悊灝辨槸榪欐牱寰堢畝鍗曪紝闂灝卞湪鎬庢牱鍦ㄧ洰鏍囪繘紼嬩腑鍘繪墽琛屼唬鐮侊紝榪欑鏂規硶灝辮鍒拌繖鎶娿?/span> 2.灞犲か鐨勯挬瀛?/span> 鍛靛懙錛岀帺榪?/span>dota鍚楋紝瀵瑰氨鏄睜澶敤鐨勯挬瀛愶紝鍦?/span>windows涓悓鏍鋒湁閽╁瓙錛岃屼笖涔熸槸鐩稿綋鐨勭妧鍒┿?/span> 浣跨敤閽╁瓙鐩稿綋鐨勭畝鍗曪紝灝變竴涓?/span>API鍑芥暟 SetWindowsHookEx錛屼笉榪囧唴娑靛緢涓板瘜錛屽湪windows涓嬪瓨鍦ㄥ悇寮忓悇鏍風殑閽╁瓙錛屾秷鎭挬瀛愶紝榧犳爣閽╁瓙錛岄敭鐩橀挬瀛愶紝鏃ュ織閽╁瓙錛岀瓑絳夛紝鍏蜂綋鐨勭湅鐪?/span>MSDN錛岃繖浜涢挬瀛愬悇鏈夊悇鐨勭敤閫旓紝瀵逛簬榛戝浠潵璇翠富瑕佷細鐢ㄥ埌娑堟伅閽╁瓙錛岄敭鐩橀挬瀛愪笌鏃ュ織閽╁瓙錛岃繖浜涢挬瀛愰兘鍙互鐢ㄦ潵鐩戞帶閿洏錛屼笅闈㈠垎鍒潵璇?/span>. (1)寰鏃ラ粍鑺?/span>鈥?/span>閿洏閽╁瓙 涓嶈榪鋒亱鍝ワ紝鍝ュ彧鏄釜浼犺銆?/span> ------涓鑴戞畫鍎跨璇?/span> 閿洏閽╁瓙鍦ㄥ綋騫村彲鏄浉褰撶殑杈夌厡錛屽湪閭d釜Rootkit榪樹笉鏄緢鐩涜鐨勫勾浠o紝鍚勭鐩楀彿杞歡 鍑犱箮鎬繪槸鍜屼粬鑱旂郴鍦ㄤ竴璧風殑錛屽彧涓嶈繃榪欏嚑騫寸敱浜庢墍璋撶殑涓誨姩闃插盡鏉杞殑鍑虹幇錛岃繖縐嶆妧鏈墠鎱㈡參鐨勬秷澶?/span>. 閿洏閽╁瓙鍒嗕負鍏ㄥ眬閽╁瓙涓庡眬閮ㄩ挬瀛愩傞敭鐩橀挬瀛愬畨瑁呬箣鍚庡彲浠ユ埅鑾鋒墍榪涚▼鐨勯敭鐩樹俊鎭傚眬閮ㄩ挬瀛愬彧鍙互鎴幏瀹夎綰跨▼鐨勯敭鐩樹俊鎭傛棦鐒惰鐩楀彿鍚楋紝褰撶劧鏄?/span>IC鍗★紝IQ鍗$粺緇熷憡璇夋垜瀵嗙爜錛岃澶ч潰縐拻緗戯紝灝辮瀹夎鍏ㄥ眬閽╁瓙銆?/span> 閿洏閽╁瓙涔熷垎涓轟袱縐嶏細鏅氱殑閿洏閽╁瓙涓庝綆綰ч敭鐩橀挬瀛愩傚浜庤繖涓ょ閽╁瓙鐨勫尯鍒垜鑷繁鍦ㄧ紪紼嬩腑鎬葷粨鐨勬槸錛氫綆綰ч敭鐩橀挬瀛愬彲浠ユ埅鑾蜂竴浜涚郴緇熸寜閿紝姣斿Windows鍋ワ紝浣嗘槸鏅氱殑灝變笉琛屼簡銆傛垜鏇劇粡鍐欎簡涓帺Dota鏃跺睆钄?/span>Windows鍋ョ殑鐢ㄧ殑鏄綆綰ч挬瀛愶紝鏅氱殑涓嶈.濡傛灉鍙槸鎷︽埅涓竴鑸殑鎸夐敭涓ょ閽╁瓙鏃犳墍璋撲簡. 鍏蜂綋鐨勭紪紼嬪緢綆鍗?/span>:璋冪敤SetWindwosHookEx鍑芥暟,鍙傛暟灝卞~鍏?/span> WH_KEYBORAD錛堟櫘閫氶挬瀛愶級鎴栬?/span>WH_KEYBOARD_LL錛堜綆綰ч挬瀛愶級錛岀劧鍚庡啓涓挬瀛愮殑鍥炶皟鍑芥暟錛屽湪鍥炶皟鍑芥暟閲岄潰灝卞彲浠ヨ幏鍙栨寜閿殑铏氭嫙閿爜浜嗭紝鍦ㄨ铏氭嫙閿爜緇忚繃澶勭悊灝卞緱鍒版垜浠兂瑕佺殑浜?/span>. 鍐嶆彁涓鐐瑰氨鏄叧浜?/span>SHIFT閿姸鎬佷笌Caps涓?/span>Num鐘舵佺殑媯嫻嬶紝鍙璋冪敤GetKeyState鍑芥暟灝卞彲浠ヤ簡錛屽叿浣撶殑涓嶈浜嗭紝鑷繁鐪?/span>MSDN鍚с?/span> 錛?/span>2錛夌鏋楄箠寰?/span>鈥?/span>鏃ュ織閽╁瓙 鏃ュ織閽╁瓙鏄敤鏉ユ嫤鎴緭鍏ュ埌緋葷粺娑堟伅闃熷垪涓殑杈撳叆娑堟伅鐨勯挬瀛愶紝閿洏娑堟伅鏃㈢劧灞炰簬杈撳叆娑堟伅錛岄偅灝卞嬀浣忓惂銆?/span> 鐢ㄦ硶涔熸槸so easy錛岃皟鐢?/span>SetWindwosHookEx鍑芥暟浼犻?/span>WH_JOURNALRECORD鍙傛暟緇欎粬,鍦ㄤ粬鐨勫洖璋冨嚱鏁伴噷闈㈡湁涓寚鍚?/span>EVENTMSG鐨勬寚閽堬紝緇撴瀯濡備笅錛?/span> typedef struct { UINT message; UINT paramL; UINT paramH; DWORD time; HWND hwnd; } EVENTMSG, *PEVENTMSG; 鎴戜滑鍙嫤鎴?/span>message ==WM_KEYDOWN鐨勬秷鎭紝灝辨槸鎸夐敭鎸変笅鐨勬秷鎭暒錛岀劧鍚?/span>paramL&0x000000FF鐨勫煎氨鏄櫄鎷熼敭鐮侊紝鍓╀笅鐨勫拰閿洏閽╁瓙灝變竴鏍蜂簡錛屼笉璇翠簡錛屼笅涓鑺傚惂銆?/span> 錛?/span>3錛夊畬緹庣殑涓栫晫---涓嫳鏂囪褰曠殑娑堟伅閽╁瓙 鍒扮洰鍓嶄負姝㈡垜浠褰曞埌寰楅兘鍙槸浜?/span> abc123榪欎簺鐨勫瓧姣嶆暟瀛楋紝閭d綅灝忔湅鍙嬭璇翠簡錛屾垜瑕佺煡閬撲粬鍦ㄧ綉涓婄殑鑱婂ぉ鍐呭錛岃鍚楋紵娑堟伅閽╁瓙灝辯珯鍑烘潵浜?/span>,”no problem,璁板綍涓枃淇烘嬁鎵嬪晩 娑堟伅閽╁瓙錛岃鍚嶇煡鎰忥紝鑲畾鏄敤鏉ヨ繃婊ゆ秷鎭殑銆傛垜浠厛鏉ヤ簡瑙d竴涓蹇?/span>”IME””. 銆IME 鏄緭鍏ユ硶緙栬緫鍣?/span>(Input Method Editor) 鐨勮嫳鏂囩緝鍐?/span>(IME)錛屽畠鏄竴縐嶄笓闂ㄧ殑搴旂敤紼嬪簭錛岀敤鏉ヨ緭鍏ヤ唬琛ㄤ笢浜氬湴鍖轟功闈㈣璦鏂囧瓧鐨勪笉鍚屽瓧絎︺?/span> 璇寸櫧浜?/span>,鎴戜滑騫蟲椂杈撳叆姹夊瓧鏃跺叾瀹為兘鏄窡榪欎釜IME鎵撲氦閬撶殑銆?/span>IME涔熸槸浼氬彂鍑哄緢澶氱殑娑堟伅鐨勶紝濡?/span> WM_IME_CHAR WM_IME_COMPOSITION WM_IME_COMPOSITIONFULL WM_IME_CONTROL WM_IME_ENDCOMPOSITION WM_IME_KEYDOWN WM_IME_KEYUP WM_IME_NOTIFY WM_IME_REQUEST WM_IME_SELECT WM_IME_SETCONTEXT WM_IME_STARTCOMPOSITION 鎴戜滑鐜板湪涓昏鍏沖績涓涓秷鎭?/span>WM_IME_COMPOSITION錛屽氨鏄綋瑕佹嫾鍑轟竴涓瓧鐨勬椂鍊欎細鍙戝嚭榪欎釜娑堟伅.錛屽茍涓斿壇鍙傛暟涓?/span>GCS_RESULTSTR鐨勬椂鍊欙紝灝辮鏄庤緭鍏ュ畬浜嗭紝鍙互灝嗘嫾鍑虹殑鍙ュ瓙璇誨嚭鏉ヤ簡錛岃繖灝卞緱鍒頒簡姹夊瓧浜?/span>.,涓嬮潰涓哄弬鑰冧唬鐮?/span>: /* this code from ZWELL 鑾峰緱杈撳叆娉曞鐞嗗悗鐨勫瓧絎︿覆 */ if(pmsg->message==WM_IME_COMPOSITION){ DWORD dwSize; char lpstr[128]; if(pmsg->lParam & GCS_RESULTSTR){ //鍏堣幏鍙栧綋鍓嶆鍦ㄨ緭鍏ョ殑紿楀彛鐨勮緭鍏ユ硶鍙ユ焺 hIMC = ImmGetContext(hWnd); if(!hIMC) return 0; // 鍏堝皢ImmGetCompositionString鐨勮幏鍙栭暱搴﹁涓?/span>0鏉ヨ幏鍙栧瓧絎︿覆澶у皬. dwSize = ImmGetCompositionString(hIMC, GCS_RESULTSTR, NULL, 0); // 緙撳啿鍖哄ぇ灝忚鍔犱笂瀛楃涓茬殑NULL緇撴潫絎﹀ぇ灝?/span>, // 鑰冭檻鍒?/span>UNICODE dwSize += sizeof(WCHAR); memset(lpstr, 0, sizeof(lpstr)); // 鍐嶈皟鐢ㄤ竴嬈?/span>.ImmGetCompositionString鑾峰彇瀛楃涓?/span> ImmGetCompositionString(hIMC, GCS_RESULTSTR, lpstr, dwSize); //鐜板湪lpstr閲岄潰鍗蟲槸杈撳叆鐨勬眽瀛椾簡銆備綘鍙互澶勭悊lpstr,褰撶劧涔熷彲浠ヤ繚瀛樹負鏂囦歡... //MessageBox(NULL, lpstr, lpstr, MB_OK); 鍏跺疄鍦ㄨ緭鍏ユ眽瀛楃殑鏃跺欎篃鏄細鍙戝嚭WM_CHAR涓?/span>WM_KEYDOWN榪欎簺娑堟伅鐨勶紝鍙笉榪?/span>WM_CHAR鐨勫弬鏁頒笌杈撳叆鑻辨枃鏄槸涓嶅悓鐨勩傛眽瀛楃殑杈撳叆瀹為檯涓婃槸涓や釜WM_CHAR錛岀敤鍐呯爜灝卞彲浠ュ垽鏂槸鍚﹁緭鍏ョ殑鏄惁鏄眽瀛楀瓧絎︺傚鏋滄槸錛屾眽瀛椾袱涓瓧鑺傜殑鏈楂樹綅閮芥槸1錛岃繛緇袱嬈″垽鏂氨鍙互鍋氬埌銆傚嵆姣忔鐨?/span>CHAR瀛楃鐨勬渶楂樹綅鏄惁鏄?/span>1錛屽鏋滄槸錛岃浣忚繖涓瓧絎︼紝鐒跺悗褰撲笅CHAR瀛楃鏉ュ埌鏄紝濡傛灉鏈楂樹綅榪樻槸1錛屽氨鍙互灝嗚繖涓や釜瀛楃鍚堟垚姹夊瓧銆傝繖鏍峰氨鍙互璁板綍涓涓眽瀛椾簡銆?/span> 鑷充簬WM_KEYDOWN鍙互鐢ㄦ潵璁板綍闈?/span>ASCII鐨勬寜閿紝鍍?/span>F1鈥擣12錛?/span>TAB錛?/span>ENTER絳夌瓑銆?/span> 榪欐牱灝辨槸涓嫳鏂囧畬緹庣殑閿洏璁板綍浜?/span>. (4)鐢ㄦ償宸磋儭涓鍚?/span>.---搴旂敤灞傜殑鎶楀嚮 搴旂敤灞傞敭鐩樿褰曠殑灝忎紟淇╁氨璇磋繖鍑犵鍚э紙鍛靛懙錛屼亢涔熷氨浼氳繖鍑犵錛?/span>,鏃㈢劧瑕佹敾闃茬粺涓錛岄偅鎴戜滑灝辨潵璋堣皥濡備綍鏉ラ槻寰″惂銆傚湪搴旂敤灞傞槻寰′釜浜烘劅瑙夊緢鏄浮鑲嬬殑錛屽疄鐜頒篃寰堟槸楹葷儲錛屾晥鏋滀篃涓嶅ソ錛屼笉榪囪繕鏄璇村惂錛?/span> 棣栧厛璇磋鍏ㄥ眬閿洏閽╁瓙鍚э紝鍏ㄥ眬閿洏閽╁瓙鏄笉鑳界嫭绔嬪瓨鍦ㄧ殑錛屼粬蹇呴』闄勫姞涓涓姩鎬侀摼鎺ュ簱鏂囦歡錛屽洜涓哄叏灞閽╁瓙鏄鐩戞帶鎵鏈夌殑榪涚▼鐨勶紝鎵浠ヨ繖涓ā鍧楀氨瑕佹敞鍏ュ埌鍏朵粬鐨勮繘紼嬬殑鍦板潃絀洪棿涓幓錛屾墍浠ヨ鍐欎竴涓崟鐙殑妯″潡銆?/span> 鎴戜滑鐭ラ亾鍦?/span>Windows涓嬪姞杞戒竴涓ā鍧楁椂浣跨敤鐨?/span>API鏄?/span>LoadLibrary鍑芥暟錛岃繖涓嚱鏁板唴閮ㄥ張浼氳皟鐢?/span>LoadLibraryEx鍑芥暟錛?/span>windows搴曞眰鏄?/span>UINCODE鐨勶紝鎵浠ュ簲璇ヨ皟鐢ㄧ殑鏄?/span>LoadLibraryExW銆傚鏋滄垜浠啓鐨勬甯哥▼搴忥紝濡傛灉璋冪敤浜?/span>LoadLibrary閭f懇LoadLibraryExW鍑芥暟鐨勮繑鍥炲湴鍧搴旇浣嶄簬Kernel32.dll涓紝鎴栬呮垜浠氨鏄洿鎺ヨ皟鐢ㄤ簡LoadLibraryExW閭f懇榪斿洖鍦板潃搴旇浣嶄簬鎴戜滑鐨勭▼搴忎腑銆備絾鏄鏋滄槸琚浜嗛挬瀛愬悗錛屽綋浣犳寜涓嬩竴涓仴鍚庯紝緋葷粺浼氫笅鎸夐敭鐒︾偣紼嬪簭鐨勫湴鍧絀洪棿涓姞杞介粦瀹㈠啓鐨勯敭鐩樿褰曟ā鍧楋紝璋冪敤鐨勬槸LoadLibraryExW錛岄偅鎽╄繖涓嚱鏁扮殑榪斿洖鍦板潃灝變笉鏄互涓婄殑涓ょ鎯呭喌浜嗭紝緇忔垜鏄疄楠屾槸浣嶄簬user32.dll涓傚搱鍝堬紝鏍規嵁榪欎竴鐐規垜浠氨鍙互鍒ゆ柇涓涓ā鍧楁槸鍚︿負闈炴硶鍔犺澆妯″潡浜?/span>. 鍘熺悊灝辨槸榪欐牱鍟︺傚叿浣撶殑瀹炵幇瑕佺敤鍒?/span>APIHook鎶鏈簡銆傚湪銆?/span>Windwos鏍稿績緙栫▼銆嬩腑鏈夌畝緇嶇殑銆傚彲浠?/span>HOOKIAT涔熷彲浠?/span>InLineHook錛屾垜鐢ㄧ殑鏄?/span>InLineHokk錛屽湪鑷繁鍐欑殑HOOk鍑芥暟涓鍏堣幏鍙?/span>[ESP]鐨勫鹼紝榪欎釜灝辨槸榪斿洖鍊間簡錛屽叿浣撲負浠涔堝簲璇ラ兘鏄庣櫧鍚э紝涓嶆槑鐧藉氨鎵炬湰姹囩紪涔﹀ソ濂借ˉ琛ュ惂銆傞偅鎽╁氨鎷胯繖涓繑鍥炲煎幓姣旇緝灝卞彲浠ヤ簡銆傜畝鍗曞惂銆傘?/span> 褰撶劧瀵逛簬HOOKAPI浣犱篃鍙互鐢ㄥ井杞殑閭d釜Hook搴擄紝閭e氨鏇寸畝鍗曚簡銆?/span> 鍙兘媯嫻嬫槸涓嶅鐨勶紝澶鍔ㄤ簡錛屾垜浠簲璇ヤ富鍔ㄥ嚭鍑匯?/span> Windows涓嬬殑閽╁瓙閫昏緫涓婃槸涓涓摼鐘剁殑錛屼竴涓郴緇熶腑鍙互瀹夎寰堝鐨勯挬瀛愶紝榪欎簺閽╁瓙浼氬艦鎴愪竴涓挬瀛愰摼錛屽厛瑁呯殑閽╁瓙鍦ㄦ渶鍓嶅ご錛屽墠闈㈢殑閽╁瓙閫氳繃璋冪敤CallNextHookEx鍑芥暟灝嗕俊鎭紶緇欏悗闈㈢殑閽╁瓙錛屽涓嶄笉璋冪敤榪欎釜鍑芥暟閭f懇閾懼瓙灝辨柇浜嗭紝鍚庨潰鐨勯挬瀛愭案榪滀簰鎯犺幏鍙栦俊鎭?/span> 濂戒簡錛岃仾鏄庣殑浣犱竴瀹氭兂鍒頒簡銆傚錛屾垜浠笉寰涓嬩紶閫掍俊鎭紝鎴戜滑鑷繁澶勭悊錛岃涓嬮潰鐨勯挬瀛愮灙鐫鐪肩潃鎬ュ幓鍚с?/span> 鍏蜂綋鍋氭硶涓猴細鎴戜滑鍦ㄦ垜浠殑紼嬪簭涓涓婂眬閮ㄩ挬瀛愶紝鍦ㄥ眬閮ㄩ挬瀛愮殑鍥炶皟鍑芥暟涓垜浠埅鑾鋒寜閿秷鎭紝鎴戜滑鑷繁瀛樿搗鏉ワ紝鐒跺悗鍐嶇粰瀵嗙爜妗嗗彂涓亣娑堟伅錛屾瘮濡傛寜涓嬩簡A鍋ワ紝鎴戜滑鐢ㄦ垜浠殑灞閮ㄩ挬瀛愭埅鑾蜂簡A鍋ユ秷鎭紝鎴戜滑淇濆瓨璧鋒潵錛岀劧鍚庢垜浠粰瀵嗙爜妗嗗彂涓亣娑堟伅錛岋紝灝辮鎴戜滑鎺ュ彈鍒頒簡涓?/span>B鍋ワ紝鐒跺悗璁╀笉璋冪敤閭d釜CallNextHookEx鍑芥暟錛岃屾槸鐩存帴榪斿洖1錛岃繖鏍蜂笅闈㈢殑閽╁瓙灝?/span>game over 浜?/span>. 濂戒簡錛屽簲鐢ㄥ眰鐨勯敭鐩樼洃鎺т笌鍙嶇洃鎺у氨璇磋繖浜涘惂錛岀敱浜庢潃姣掕蔣浠剁殑鍙戝睍錛岀壒鍒槸鎵璋撶殑鐗?/span>X涓誨姩闃插盡鐨勫嚭鐜幫紝榪欎簺閮藉凡榪涗簡鍘嗗彶鐨勫瀮鍦懼爢浜嗭紝鐜板湪鏄?/span>RootKit鐨勬椂浠o紝鎵撳姭涔熻璁蹭笌鏃朵勘榪涳紝涓嬮潰鎴戜滑灝辨潵鐪嬬湅ring0涓嬬殑閿洏璁板綍鐨勬墜孌靛惂銆?/span> 3.鏂扮殑鎴樺満錛屾柊鐨勬垬鏂?/span>鈥攔ootkit鐨勭柉鐙?/span> 浜洪兘鏄睘椹寸殑錛屼笉鎵撲笉閫兼槸涓嶄細璧扮殑. ----------淇虹殑涓浣嶈佸笀璇寸殑 鍦?/span>ring3涓嬬尌鐞愰粦瀹滑鐨勫畨閫歌琚潃杞墦鐮翠簡錛岀敓瀛樿繕鏄浜°傚綋鐒舵槸瑕佺敓瀛樹笅鍘諱簡錛屾庢病鍔烇紵”TMD,鍙嶄簡錛屾垜浠鍜屾潃杞鐫騫?/span>”銆傛父鎴忚鍒欒鏀瑰彉浜嗐傘傞粦瀹㈣蔣浠朵笉鍦ㄦ槸鍙仛鑰侀紶琚潃杞繖鍙ぇ鐚埌澶勬挼榪欒窇錛岃侀紶瑕佸悆鐚暒銆?/span> 4.涓涓煩----閿洏榪囨護椹卞姩 鏃㈢劧鍒頒簡鍐呮牳鐨勯鍦幫紝閭f垜浠氨鏉ョ湅鐪嬪湪鍐呮牳涓槸濡備綍澶勭悊鎸夐敭娑堟伅鐨勶紝鎴戜滑浠庢寜涓嬩竴涓仴鍒版垜浠湪WORD鐪嬪埌榪欎釜瀛楁瘝錛岀┒绔熷彂鐢熶簡浠涔?/span>,涓嬮潰鏄綉涓婅鐨?/span>: /*寮曠敤鑷?/span>: http://hi.baidu.com/buzztiger/blog/item/a851712b 鍐欒繃windows紼嬪簭鐨勪漢閮界煡閬擄紝win32紼嬪簭鏄熀浜庢秷鎭┍鍔ㄧ殑錛屽叾涓氨鏈夐敭鐩樻秷鎭紝榪欎釜娑堟伅鍏跺疄鏄?/span>csrss.exe榪欎釜榪涚▼鍙戦佺粰搴旂敤紼嬪簭鐨勶紝鑰屽湪搴旂敤紼嬪簭涓垜浠彲浠ヤ嬌鐢?/span>setWindowsHook鐨勬柟娉曟潵鑾峰緱閿洏娑堟伅錛屼粠鑰屽疄鐜版敼閿晩錛屾崟鎹夌敤鎴鋒寜閿唴瀹廣傞偅涔?/span>csrss.exe榪欎釜榪涚▼鐨勯敭鐩樻秷鎭槸鎬庝箞鏉ョ殑鍛紵鍘熸潵csrss.exe涓湁涓?/span>win32!RawInputThread榪欎釜綰跨▼錛岃繖涓嚎紼嬮氳繃涓涓?/span>GUID錛屽嵆GUID_CLASS_KEYBOARD錛?/span>DEFINE_GUID(GUID_CLASS_KEYBOARD, 0x884b96c3, 0x56ef, 0x11d1, 0xbc, 0x8c, 0x00, 0xa0, 0xc9, 0x14, 0x05, 0xdd)鏉ヨ幏寰楅敭鐩樿澶囨爤涓?/span>PDO鐨勭鍙烽摼鎺ュ悕銆?/span>win32!RawInputThread鎵ц鍒?/span>win32k!openDevice錛岃皟鐢?/span>zwCreateFile鎵撳紑璁懼錛岀劧鍚庤皟鐢?/span>zwReadFile涓庨敭鐩橀┍鍔ㄩ氫俊浜嗐傚畠浼氬垱寤轟竴涓?/span>IRP_MJREAD鐨?/span>IRP鍙戦佺粰閿洏椹卞姩錛岃岄敭鐩橀┍鍔ㄩ氬父浣胯繖涓?/span>IRP Pending錛岃繖鏍峰畠灝變細涓鐩磋鏀懼湪閭i噷絳夊緟錛岀瓑鏉ユ潵鑷敭鐩樼殑鏁版嵁錛屽嵆win32!RawInputThread榪欎釜綰跨▼涔熶細涓鐩寸瓑寰咃紝絳夊緟榪欎釜璇繪搷浣滅殑瀹屾垚銆傚綋閿洏鏈夐敭鎸変笅鏃惰繖涓?/span>IRP灝嗕細瀹屾垚錛?/span>win32!RawInputThread灝嗗寰楀埌鐨勬暟鎹繘琛屽鐞嗭紝鍒嗗彂緇欏悎閫傜殑榪涚▼錛堥氬父鏄幏寰楃劍鐐圭殑榪涚▼錛夎繖鏃?/span>win32!RawInputThread鍙堜細绔嬪嵆鍐嶈皟鐢?/span>nt!ZwReadFile瑕佹眰璇誨叆鏁版嵁錛屽張寮濮嬩簡涓嬩竴涓瓑寰咃紝鍛ㄨ屽濮?/span> /*寮曠敤緇撴潫*/ 閿洏鐨勯┍鍔ㄦ爤浠庝笂鍒頒笅渚濇涓?/span>:kbdclass.sys---ài8042port.sys---àacpi.sys 鍏朵腑kbdclass.sys涓洪敭鐩樼殑綾婚┍鍔紝涓嶇鏄?/span>PS/2閿洏榪樻槸USB閿洏閮借閫氳繃榪欎竴灞傞┍鍔紝鎵浠ュ湪榪欎竴灞傝繘琛岃繃婊ゅ彲浠ユ湁鍜屽ソ鐨勫吋瀹規с?/span> I8042port.sys涓?/span>PS/2閿洏鐨勭鍙i┍鍔紝榪欎釜鍙PS/2閿洏濂界敤錛?/span>USB閿洏浠栫涓嶄簡鐨勩?/span> 瀵逛簬閿洏鐨勮繃婊ら┍鍔紝鎴戦夋嫨鏄湪kbdclass.sys榪涜榪囨護. 鍏蜂綋鍋氭硶錛?/span> 1.浣跨敤ObReferenceObjectByName鑾峰彇”\\Driver\\Kbdclass”鎵瀵瑰簲鐨勯┍鍔ㄥ璞°?/span> 2.鏋氫婦榪欎釜椹卞姩瀵硅薄涓嬬殑鎵鏈夎澶囷紝騫跺垱寤轟竴涓繃婊よ澶囬檮鍔犱笂鍘?/span>. 3.涓昏澶勭悊IRP_MJ_READ榪欎釜IRP銆傞鍏堣緗竴涓畬鎴愬嚱鏁幫紝鐒跺悗鍚戜笅杞彂姝?/span>IRP銆?/span> 4.鍦ㄥ畬鎴愬嚱鏁頒腑灝卞彲浠ヨ幏鍙栨嬈$殑妗堜歡鐨勬壂鎻忕爜浜嗐?/span> 5.瀵逛簬IRP_MJ_POWER, IRP_MJ_PNP涔熻榪涜澶勭悊. 鍛靛懙錛屽緢綆鍗曞惂錛岄┍鍔ㄥ叆闂ㄧ駭鐨?/span>Hello Wolrd銆?/span> 5.涔懼潳澶ф尓縐?/span>----HOOKIDT涓庢搷綰?/span>APIC 鍦ㄥ墠闈㈡垜浠鍒板湪鎸変笅涓涓敭涓庢姮璧風殑鏃跺欎細瑙﹀彂涓涓‖浠朵腑鏂紝XP涓嬶紝鎿嶄綔緋葷粺鍥炲幓璋冪敤 0x31鎴?/span>0x93涓柇澶勭悊紼嬪簭鍖哄鐞嗐傞偅涔堟垜浠彲涓嶅彲浠ヨ嚜宸卞啓涓涓?/span>ISR鍘繪帴綆¢敭鐩樹腑鏂憿,錛熷綋鐒訛紝鍒繕浜嗭紝鎴戜滑鏄湪鍐呮牳涓幇鍦紝鎴戜滑鏃犳墍涓嶈兘 銆?/span> 鎴戜滑鐭ラ亾鍦ㄤ繚鎶ゆā寮忎笅鏄噰鐢?/span>IDT榪涜涓柇綆$悊鐨勶紝IDT鏄湁璁稿闂ㄧ粍鎴愮殑銆傛瘡涓椃寰楃粨鏋勫涓?/span>: typedef struct IDTEntry { HB_U16 LowOffset ;//鍋忕Щ鐨勪綆16浣?/span> HB_U16 Selector ;//閫夋嫨瀛?/span> HB_U8 Count:5; //鍙傛暟鐨勫弻瀛楄鏁?/span> HB_U8 Reserve:3 ;//淇濈暀涓?/span>0 HB_U8 Type:4 ;//綾誨瀷 HB_U8 DT0:1; //DT=0,緋葷粺孌墊弿榪扮 HB_U8 DPL:2; //DLP HB_U8 P:1; //P浣?/span> HB_U16 HightOffset;//鍋忕Щ鐨勯珮16浣?/span> }IDTEntry,*PIDTEntry; 鍏朵腑Lowoffset涓?/span>HighOffset灝辨瀯鎴愪簡瀹為檯鐨勪腑鏂鐞嗙▼搴忕殑鍦板潃.銆傛垜浠鏋滆嚜宸卞啓涓涓腑鏂鐞嗙▼搴忥紝鐒跺悗淇敼Lowoffset涓?/span>HighOffset錛岃鍏舵寚鍚戞垜浠嚜宸辯殑鍐欑殑閭d釜鍑芥暟涓嶄箙鍙互浜嗗悧.. 鍦ㄦ垜浠嚜宸辯殑閿洏涓柇澶勭悊鍑芥暟涓垜浠彲浠ョ洿鎺ュ皢鏁版嵁浠?/span>i8042鐨勭鍙h鍑猴紝瀛樺偍璧鋒潵錛岀劧鍚庡啀璋冪敤鍘熷厛鐨勭郴緇熼粯璁ょ殑鍑芥暟錛岃繖鏍峰氨紲炰笉鐭ラ涓嶈鐨勮揪鍒扮殑涓嶅彲鍛婁漢鐨勭洰鐨?/span>. 榪樻湁涓縐嶆柟娉曚嬌鐢ㄧ殑鎵嬫浜庢鐩鎬技錛屼篃鏄浛鎹紝涓嶈繃榪欐鏄皢閿洏鐨?/span>IRQ1涓柇鐨勫鐞嗗嚱鏁扮殑涓柇鍚戦噺鏇存敼錛屼笉鍦ㄦ槸鎸囧悜0x31鎴栨槸0x93浜嗭紝鑰屾槸鎸囧悜鍙︿竴涓悜閲?/span>.榪欎釜鍚戦噺鍖呭惈鎴戜滑鑷繁鐨勫鐞嗙▼搴?/span>.錛岃繖灝辨槸APIC鏈哄埗.銆備笉榪囨垜鐨勮繖涓牬絎旇鏈瘮杈冭佷簡錛屾病鏈夎繖涓満鍒訛紝 鎵浠ュ彧鑳界焊涓婅皥鍏典簡.,榪樻槸鍏堢畝緇嶄竴涓?/span>APIC鍚?/span>. APIC鏄彲浠ョ敤浜庡涓牳蹇冪殑CPU鐨勬柊鍨嬩腑鏂帶鍒跺櫒,APIC鐨勪綔鐢ㄧ浉褰撲簬褰撲竴涓?/span>IRQ鍙戠敓鏃訛紝榪欎釜紜歡鍐沖畾灝?/span>IRQ鍙戜釜鍛釜CPU鏍稿績,浠ュ強涓浣曠褰㈠紡鍙戦佺瓑銆?/span>APIC鏄彲緙栫▼鐨勶紝涔熷彲浠ュ皢PS/2閿洏鐨勭‖浠朵腑鏂姹傚彂緇欐煇涓?/span>CPU鏍稿績錛岃璇ユ牳蹇冪殑IDT涓殑鏌愪釜涓柇鍙峰搴旂殑涓柇鏈嶅姟紼嬪簭鏉ュ鐞?/span>. Windows灝?/span>APIC鐨勭郴鍒楀瘎瀛樺櫒鏄犲皠鍒頒簡鍦板潃0xFEC00000鍜?/span>0xFEC00010鐨勪綅緗?/span> 涔熷氨鏄鎴戜滑鍙互閫氳繃緙栫▼鏉ヨ繘琛屼腑鏂殑閲嶅畾浣嶏紝鍏蜂綋鎿嶄綔鐪嬬潃APIC鐨勮鏄庢坊娣繪暟鎹氨鍙互浜嗭紝鍏跺疄鍜?/span>HOOKIDT涓鏍風殑銆傚氨涓嶅璇翠簡. 6.榪旂挒褰掔湡鈥?/span>杞i8042 鏈夋椂鍊欏叾瀹炰竴涓棶棰樼殑瑙e喅鏂規硶騫朵笉鏄湀澶嶆潅灝辮秺寮烘倣錛屾湁鏃跺欑畝鍗曠殑鍦熺殑鎺夋福鐨勬妧鏈弽鑰屾槸鏈紼沖浐鐨?/span> 杞錛岃繖縐嶅彜鑰佺殑鎶鏈紝铏界劧鐢變簬鏁堢巼浣庝笅宸茬粡鏃╁凡琚窐姹幫紝浣嗘槸鎴戜滑闇瑕佺殑姝f槸榪欎釜銆?/span> 閿洏鏄彲浠ラ氳繃緙栫▼鍏抽棴涓柇鐨勶紝浣嗘槸褰撴垜浠寜涓嬩竴涓仴鐨勬椂鍊欙紝閿洏鐨勮緭鍑虹紦鍐插尯涓粛鐒朵細鏈夋壂鎻忕爜濉厖錛屽彧鏄腑鏂叧闂簡錛屾搷浣滅郴緇熷茍涓嶇煡閬撱?/span> 鎴戜滑鐨勫仛娉曟槸錛氶鍏堝叧闂敭鐩樼殑涓柇錛岀劧鍚庨氳繃杞鐨勬柟娉曡鍙栬緭鍑虹鍙g殑妗堜歡鎵弿鐮侊紝鑷繁榪涜涓浜涘鐞嗭紝鐒跺悗鎵撳紑閿洏涓柇錛屽啀灝嗘鎸夐敭閲嶆斁錛岃繖鏍鋒搷浣滅郴緇熶細鑾峰彇榪欎釜鎸夐敭錛岀劧鍚庡湪鍏抽棴涓柇錛屼竴鐩磋繖鏍峰驚鐜笅鍘匯?/span> 鍘熺悊灝辨槸榪欐牱錛岀畝鍗曚篃寰堝彲闈狅紝鎴戞渶緇堢殑瀵嗙爜淇濇姢灝辨槸閲囩敤榪欎釜鏂規鐨勩?/span> 鎴戠殑紼嬪簭鍒嗕簡涓変釜灞傛: 鍥犱負鍦?/span>Ring3涓嬫棤娉曡鍐欑鍙g殑錛屾墍浠ヨ嚜宸卞啓浜嗕釜椹卞姩錛岃礋璐h鍐欑鍙o紝RING3涓婅澆鍐欎釜DLL閫氳繃DeviceIoControl涓庡唴鏍歌繘琛岄氫俊錛屼紶閫掔鍙e湴鍧涓庤緗殑鍊肩瓑淇℃伅,騫跺涓婇潰鐨勫簲鐢ㄧ▼搴忔彁渚涚畝鍗曠殑濡?/span>READ_PORT(ULONG port),榪欐牱鐨勬帴鍙c?/span> 鍦ㄥ簲鐢ㄧ▼搴忎腑錛屽湪瑕佷繚鎶ょ殑瀵嗙爜妗嗚幏鍙栫劍鐐規椂(澶勭悊WM_SETFOCUS娑堟伅),鍒欏叧闂敭鐩樹腑鏂繘琛岃疆璇?/span>,鍦ㄥ競鍖虹劍鐐規椂鍒欐墦寮閿洏涓柇.鍦ㄨ幏鍙栨寜閿悗浣犲彲浠ュ湪紼嬪簭涓褰曚笅鏉ワ紝鍐嶅湪瀵嗙爜妗嗕腑濉厖涓亣鐨勫瘑鐮併?/span> 鐢變簬鏄笉闂存柇鐨勮疆璇㈡墍浠ヤ繚璇佸湪絎竴鏃墮棿鑾峰彇鎵弿鐮侊紝鍦ㄤ笂灞傜殑濡傝繃婊ら┍鍔紝HOOKIDT絳?/span> 榪樻湁搴旂敤灞傚緱鍒伴挬瀛愬暐鐨勶紝緇熺粺澶辨晥錛屽疄璺佃瘉鏄庤繕鏄緢鍙潬鐨勶紝鍙笉榪囪繕涓嶆槸寰堝畬鍠勶紝鐩墠鍙敮鎸?/span>PS/2閿洏錛?/span>USB鐨勮繕涓嶈. 7.鎴戜滑閮?/span>OUT浜?/span>----紜歡閿洏璁板綍鍣?/span> 鏃ラ槻澶滈槻錛屽璐奸毦闃插晩錛岃鏄‖浠朵笂鍋氫簡鎵嬭剼錛岄偅灝辮繖鑳?/span>55555555555…… 鐪嬬湅榪欎釜鐚ョ悙鐨勫浼欏惂…楂樼鎶鍝?/span> 濂戒簡錛岃緇撳熬浜嗭紝鍛靛懙錛岀幇鍦ㄤ綘榪樹俊浣犵殑閿洏鍚楋紵
/*****************************************************************************************/

]]>
鎸囦護鍙敤浜庣壒鏉冪駭 3 鐨勭敤鎴蜂唬鐮佽皟鐢ㄧ壒鏉冪駭 0 鐨勭郴緇熷唴鏍鎬唬鐮侊紝鑰?SYSEXIT 鎸囦護鍒欑敤浜庣壒鏉冪駭 0 鐨勭郴緇熶唬鐮佽繑鍥炵敤鎴風┖闂翠腑銆俿ysenter 鎸?/p>
浠ゅ彲浠ュ湪 3錛?錛? 榪欎笁涓壒鏉冪駭鍒皟鐢紙Linux 涓彧鐢ㄥ埌浜嗙壒鏉冪駭 3錛夛紝鑰?SYSEXIT 鎸囦護鍙兘浠庣壒鏉冪駭 0 璋冪敤銆?/p>
鎵ц sysenter 鎸囦護鐨勭郴緇熷繀欏繪弧瓚充袱涓潯浠訛細1.鐩爣 Ring 0 浠g爜孌靛繀欏繪槸騫沖潶妯″紡錛團lat Mode錛夌殑 4GB 鐨勫彲璇誨彲鎵ц鐨勯潪涓鑷翠唬鐮佹銆?/p>
2.鐩爣 RING0 鍫嗘爤孌靛繀欏繪槸騫沖潶妯″紡錛團lat Mode錛夌殑 4GB 鐨勫彲璇誨彲鍐欏悜涓婃墿灞曠殑鏍堟銆?/p>
鍦?Intel 鐨勬墜鍐屼腑錛岃繕鎻愬埌浜?sysenter/sysexit 鍜?int n/iret 鎸囦護鐨勪竴涓尯鍒紝閭e氨鏄?sysenter/sysexit 鎸囦護騫朵笉鎴愬錛宻ysenter 鎸?/p>
浠ゅ茍涓嶄細鎶?SYSEXIT 鎵闇鐨勮繑鍥炲湴鍧鍘嬫爤錛宻ysexit 榪斿洖鐨勫湴鍧騫朵笉涓瀹氭槸 sysenter 鎸囦護鐨勪笅涓涓寚浠ゅ湴鍧銆傝皟鐢?sysenter/sysexit 鎸囦護
鍦板潃鐨勮煩杞槸閫氳繃璁劇疆涓緇勭壒孌婂瘎瀛樺櫒瀹炵幇鐨勩傝繖浜涘瘎瀛樺櫒鍖呮嫭錛?/p>
SYSENTER_CS_MSR 錛?鐢ㄤ簬鎸囧畾瑕佹墽琛岀殑 Ring 0 浠g爜鐨勪唬鐮佹閫夋嫨絎︼紝鐢卞畠榪樿兘寰楀嚭鐩爣 Ring 0 鎵鐢ㄥ爢鏍堟鐨勬閫夋嫨絎︼紱
SYSENTER_EIP_MSR 錛?鐢ㄤ簬鎸囧畾瑕佹墽琛岀殑 Ring 0 浠g爜鐨勮搗濮嬪湴鍧錛?/p>
SYSENTER_ESP_MSR錛嶇敤浜庢寚瀹氳鎵ц鐨凴ing 0浠g爜鎵浣跨敤鐨勬爤鎸囬拡
榪欎簺瀵勫瓨鍣ㄥ彲浠ラ氳繃 wrmsr 鎸囦護鏉ヨ緗紝鎵ц wrmsr 鎸囦護鏃訛紝閫氳繃瀵勫瓨鍣?edx銆乪ax 鎸囧畾璁劇疆鐨勫鹼紝edx 鎸囧畾鍊肩殑楂?32 浣嶏紝eax 鎸囧畾鍊肩殑
浣?32 浣嶏紝鍦ㄨ緗笂榪板瘎瀛樺櫒鏃訛紝edx 閮芥槸 0錛岄氳繃瀵勫瓨鍣?ecx 鎸囧畾濉厖鐨?MSR 瀵勫瓨鍣紝sysenter_CS_MSR銆乻ysenter_ESP_MSR銆?/p>
sysenter_EIP_MSR 瀵勫瓨鍣ㄥ垎鍒搴?0x174銆?x175銆?x176錛岄渶瑕佹敞鎰忕殑鏄紝wrmsr 鎸囦護鍙兘鍦?Ring 0 鎵ц銆?/p>
榪欓噷榪樿浠嬬粛涓涓壒鎬э紝灝辨槸 Ring0銆丷ing3 鐨勪唬鐮佹鎻忚堪絎﹀拰鍫嗘爤孌墊弿榪扮鍦ㄥ叏灞鎻忚堪絎﹁〃 GDT 涓槸欏哄簭鎺掑垪鐨勶紝榪欐牱鍙渶鐭ラ亾
SYSENTER_CS_MSR 涓寚瀹氱殑 Ring0 鐨勪唬鐮佹鎻忚堪絎︼紝灝卞彲浠ユ帹綆楀嚭 Ring0 鐨勫爢鏍堟鎻忚堪絎︿互鍙?Ring3 鐨勪唬鐮佹鎻忚堪絎﹀拰鍫嗘爤孌墊弿榪扮銆?/p>
鍦?Ring3 鐨勪唬鐮佽皟鐢ㄤ簡 sysenter 鎸囦護涔嬪悗錛孋PU 浼氬仛鍑哄涓嬬殑鎿嶄綔錛?/p>
1錛?灝?SYSENTER_CS_MSR 鐨勫艱杞藉埌 cs 瀵勫瓨鍣?/p>
2錛?灝?SYSENTER_EIP_MSR 鐨勫艱杞藉埌 eip 瀵勫瓨鍣?/p>
3錛?灝?SYSENTER_CS_MSR 鐨勫煎姞 8錛圧ing0 鐨勫爢鏍堟鎻忚堪絎︼級瑁呰澆鍒?ss 瀵勫瓨鍣ㄣ?/p>
4錛?灝?SYSENTER_ESP_MSR 鐨勫艱杞藉埌 esp 瀵勫瓨鍣?/p>
5錛?灝嗙壒鏉冪駭鍒囨崲鍒?Ring0
6錛?濡傛灉 EFLAGS 瀵勫瓨鍣ㄧ殑 VM 鏍囧織琚疆浣嶏紝鍒欐竻闄よ鏍囧織
7錛?寮濮嬫墽琛屾寚瀹氱殑 Ring0 浠g爜
鍦?Ring0 浠g爜鎵ц瀹屾瘯錛岃皟鐢?SYSEXIT 鎸囦護閫鍥?Ring3 鏃訛紝CPU 浼氬仛鍑哄涓嬫搷浣滐細
1錛?灝?SYSENTER_CS_MSR 鐨勫煎姞 16錛圧ing3 鐨勪唬鐮佹鎻忚堪絎︼級瑁呰澆鍒?cs 瀵勫瓨鍣?/p>
2錛?灝嗗瘎瀛樺櫒 edx 鐨勫艱杞藉埌 eip 瀵勫瓨鍣?/p>
3錛?灝?SYSENTER_CS_MSR 鐨勫煎姞 24錛圧ing3 鐨勫爢鏍堟鎻忚堪絎︼級瑁呰澆鍒?ss 瀵勫瓨鍣?/p>
4錛?灝嗗瘎瀛樺櫒 ecx 鐨勫艱杞藉埌 esp 瀵勫瓨鍣?/p>
5錛?灝嗙壒鏉冪駭鍒囨崲鍒?Ring3
6錛?緇х畫鎵ц Ring3 鐨勪唬鐮?/p>
鐢辨鍙煡錛屽湪璋冪敤 SYSENTER 榪涘叆 Ring0 涔嬪墠錛屼竴瀹氶渶瑕侀氳繃 wrmsr 鎸囦護璁劇疆濂?Ring0 浠g爜鐨勭浉鍏充俊鎭紝鍦ㄨ皟鐢?SYSEXIT 涔嬪墠錛岃繕瑕佷繚璇?/p>
瀵勫瓨鍣╡dx銆乪cx 鐨勬紜с?/p>
鏍規嵁 Intel 鐨?CPU 鎵嬪唽錛屾垜浠彲浠ラ氳繃 CPUID 鎸囦護鏉ユ煡鐪?CPU 鏄惁鏀寔 sysenter/sysexit 鎸囦護錛屽仛娉曟槸灝?EAX 瀵勫瓨鍣ㄨ祴鍊?1錛岃皟鐢?
CPUID 鎸囦護錛屽瘎瀛樺櫒 edx 涓 11 浣嶏紙榪欎竴浣嶅悕縐頒負 SEP錛夊氨琛ㄧず鏄惁鏀寔銆傚湪璋冪敤 CPUID 鎸囦護涔嬪悗錛岃繕闇瑕佹煡鐪?CPU 鐨?Family銆丮odel銆?/p>
Stepping 灞炴ф潵紜錛屽洜涓烘嵁縐?Pentium Pro 澶勭悊鍣ㄤ細鎶ュ憡 SEP 浣嗘槸鍗翠笉鏀寔 sysenter/sysexit 鎸囦護銆傚彧鏈?Family 澶т簬絳変簬 6錛孧odel
澶т簬絳変簬 3錛孲tepping 澶т簬絳変簬 3 鐨勬椂鍊欙紝鎵嶈兘紜 CPU 鏀寔 sysenter/sysexit 鎸囦護銆?/p>
/=============================================================================
//鍦╓INDBG涓NTDLL.dll涓殑NtCreateFile鍑芥暟鐨勮皟璇曚俊鎭?br>ntdll!NtCreateFile:
7c92d682 b825000000 mov eax,25h
7c92d687 ba0003fe7f mov edx,offset SharedUserData!SystemCallStub (7ffe0300)
7c92d68c ff12 call dword ptr [edx]
7c92d68e c22c00 ret 2Ch
lkd> dd 7ffe0300
7ffe0300 7c92eb8b 7c92eb94 00000000 00000000
lkd> u 7c92eb8b
ntdll!KiFastSystemCall:
7c92eb8b 8bd4 mov edx,esp
7c92eb8d 0f34 sysenter
/**************************************************************/
SYSENTER綆浠嬪強鐩稿叧渚嬪瓙
鏂囩珷浣滆咃細wowocock1/CVC.GB
;浼楁墍鍛ㄧ煡寰蔣鑷猉P鍚庡紩榪涗簡FASTCALL SYSENTER錛孲YSEXIT鏉ヤ唬鏇縒IN2K涓婭NT2E緋葷粺鏈嶅姟璋冪敤
;鍏朵紭鐐規槸蹇熻屼笖娌℃湁淇濈暀鍫嗘爤鐨勫紑閿錛屼負浜嗕究浜庡ぇ瀹剁悊瑙f垜鍐欎笅闈竴涓湪WIN98涓嬬殑渚嬪瓙
;鏉ヨ鏄庝竴涓嬭繖2鏉℃寚浠ょ殑鐢ㄦ硶銆侷TNEL鐨勬墜鍐屼笂鍏充簬浠栦滑浠嬬粛鐨勫緢璇︾粏錛屾垜綆瑕佽鏄庝竴涓?br>;SYSENTER鏄疘NTEL鑷狿2鍚庡紩榪涚殑蹇熶粠RING3~RING0鐨凢ASTCALL錛屼粠FAMILY 6錛孧ODEL 3錛?br>;STEP 3涔熷氨鏄粠PII300浠ュ悗寮曡繘鐨勶紝榪欎篃鏄負浠涔圵INXP闇瑕丳II300浠ヤ笂鐨勫師鍥犮傚湪浣跨敤SYSENTER
;涔嬪墠蹇呴』瀹氫箟濂絉ING0 CS EIP ESP錛岄氳繃璁劇疆鐩稿簲MSR瀵勫瓨鍣?鐢盬RMSR鎸囦護鏉ヨ瀹氾紙蹇呴』鍦≧ING0灞傛墽琛岋級;
;閫氳繃灝嗙浉搴旂殑瀵勫瓨鍣ㄥ湴鍧鍙鋒斁鍏CX涓紝WRMSR鍙互璁劇疆榪欎簺MSR瀵勫瓨鍣?瀵瑰簲鍏崇郴濡備笅
;SYSENTER_CS_MSR 174H SYSENTER_ESP_MSR 175H SYSENTER_EIP_MSR 176H
;鎵цSYSENTER鎸囦護鐨勭郴緇熷繀欏繪弧瓚?1錛氳漿鎹㈠悗鐨凴ING0浠g爜孌靛繀欏繪槸FLAT錛?GB鐨勫彲璇誨彲鎵ц
;鐨勯潪涓鑷翠唬鐮佹.2:杞崲鍚庣殑RING0鍫嗘爤孌靛繀欏繪槸FLAT錛?GB鐨勫彲璇誨彲鍐欏悜涓婃墿灞曠殑鏁版嵁孌?br>;鐢變簬FASTCALL涓嶄繚瀛樹換浣曡繑鍥炵殑鍦板潃錛屾墍浠ュ湪璋冪敤鍓嶄綘蹇呴』鑷繁璁懼畾濂斤紝RING0浠g爜孌礢ELECTOR
;RING0鍫嗘爤孌礢ELECTOR錛孯ING3浠g爜孌礢ELECTOR錛孯ING3鍫嗘爤孌礢ELECTOR錛屽繀欏誨湪GDT涓繛緇殑鎺掑垪
;鎵浠ュ湪XP涓嬬浉搴旂殑SELECTOR錛屽繀鐒舵槸8H錛?0H錛?BH錛?3H錛屽繀欏誨皢榪斿洖鑷砇ING3 EIP,ESP閫氳繃瀵勫瓨鍣?br>;浼犻掕繘RING0浠ヤ究SYSEXIT榪斿洖浣跨敤錛屽湪SYSEXIT榪斿洖涔嬪墠錛孍DX涓篟ING3 EIP錛孍CX涓篟ING3 ESP
;鑰岀浉搴旂殑CS錛孲S錛屽垯鐢盧ING0 CS鍔犱笂10H錛?8H鏉ヨ繑鍥?br>;RING3~RING0
;1. 瑁呰澆SYSENTER_CS_MSR 鍒癈S 瀵勫瓨鍣?
;2. 瑁呰澆SYSENTER_EIP_MSR鍒?EIP瀵勫瓨鍣ㄣ?
;3. SYSENTER_CS_MSR+8 瑁呰澆鍒癝S瀵勫瓨鍣?
;4.瑁呰澆SYSENTER_ESP_MSR 鍒癊SP瀵勫瓨鍣ㄣ?
;5. 鍒囨崲RING0.
;6. 娓呴櫎 EFLAGS鐨?VM鏍囧織
;7. 鎵цRING0渚嬬▼
;RING0~RING3
;1銆係YSENTER_CS_MSR+16瑁呰澆鍒?CS瀵勫瓨鍣?br>;2. 灝咵DX鐨勫奸佸叆EIP
;3. SYSENTER_CS_MSR+24 瑁呰澆鍒癝S瀵勫瓨鍣?
;4. 灝咵CX鐨勫奸佸叆ESP
;5.鍒囨崲鍥濺ING3
;6. 鎵цEIP澶勭殑RING3鎸囦護
;涓嬮潰鐨勪緥瀛愬湪紺鴻寖鐨勫熀紜涓婂姞浜嗕釜灝廡RICK錛屽氨鏄湪閫氳繃CALLGATE榪汻ING0璁劇疆MSR瀵勫瓨鍣ㄧ殑鍚屾椂
;鍏蟲帀浜嗕綘鏈哄櫒涓婄殑緙撳瓨錛岀劧鍚庝綘鍙互鐪嬬湅鍦ㄦ病鏈夌紦瀛樼殑鎯呭喌涓嬩綘鐨勬劅瑙夊浣曪紝鐒跺悗鐐瑰嚮涓涓?br>;瀵硅瘽妗嗭紝鍒欑粡鐢盨YSENTER鎸囦護榪涘叆RING0璁懼畾濂界殑鍦板潃澶勬仮澶嶄綘CPU緙撳瓨錛屾墍浠ュ埆鎷呭績錛岃繕鏈?br>;娌℃湁緙撳瓨鐨勬椂鍊欎綘鐨勫姩浣滄渶濂芥參涓鐐癸紝涓嶇劧浼氳浣犵瓑鐨勫彂鐤殑錛屽懙鍛點?br>.686p
.model flat,stdcall
option casemap:none
include \masm32\include\windows.inc
include \masm32\include\kernel32.inc
include \masm32\include\user32.inc
includelib \masm32\lib\kernel32.lib
includelib \masm32\lib\user32.lib
sysenter macro
db 0fh,34h
endm
sysexit macro
db 0fh,35h
endm
CR0_CD EQU 040000000h ; Cache Disable bit of CR0
CR0_NW EQU 020000000h ; Not Write-through bit of CR0
.data
Ring0Cs dw 0ffffh,0,09b00h,0cfh
Ring0Ss dw 0ffffh,0,09300h,0cfh
Ring3Cs dw 0ffffh,0,0fb00h,0cfh
Ring3Ss dw 0ffffh,0,0f300h,0cfh
trR dw ?
tssRing0Esp dd ?
GdtLimit dw ?
GdtAddr dd ?
Callgt dq 0 ;call gate’s selff
tmpCs dw ?
szTitle db "CPU info",0
msg db 100 dup (?)
Nightmare db "鍒囨崲鍒板叾浠栫獥鍙o紝灝濆皾娌ACHE鐨勬粙鍛?",0
.code
Start:
mov ax,ds
test ax,4
jz Exit;winnt
xor eax,eax
cpuid
lea edi,msg
xchg eax,ebx
stosd
xchg eax,edx
stosd
xchg eax,ecx
stosd
invoke MessageBoxA,0,addr msg,addr szTitle,0
mov eax,1
cpuid
test edx,800h
jz Exit
mov eax,2
cpuid
SetSel:
sgdt GdtLimit
str word ptr trR ;瀛樺偍浠誨姟瀵勫瓨鍣?br>;-----------------------
; get the tr mes
;-----------------------
movzx esi,trR
add esi,GdtAddr ;ESi鎸囧悜GDT涓璗SS鎻忚堪鍓?br>mov eax,[esi+2]
and eax,0ffffffh
mov ebx,[esi+4]
and ebx,0ff000000h
or eax,ebx ;eax涓繚瀛楾SS鐨勫熀鍦板潃
push dword ptr[eax+4]
pop dword ptr [tssRing0Esp] ;淇濆瓨RING0浣跨敤鐨勫爢鏍堝湴鍧
movzx eax,GdtLimit ;鍦℅DT鐨勬渶鍚庨夊彇鍥涗釜琛ㄧ洰灝嗛璁劇殑4涓弿榪扮瀛樺叆
test al,1
jz @f
inc eax
@@:
sub eax,4*8
mov tmpCs,ax
add eax,GdtAddr
lea esi,Ring0Cs
mov edi,eax
mov ecx,4*8
rep movsb
SetMsr:
;-------------------------------------
; 鍦℅DT涓鎵劇┖鐧借〃欏規潵鍒墮犺皟鐢ㄩ棬
;-------------------------------------
mov esi,GdtAddr
movzx eax,GdtLimit
call Search_XDT
;esi==gdt Base
mov esi,dword ptr GdtAddr
push offset Ring0_SetMsr
pop word ptr [esi+eax+0]
pop word ptr [esi+eax+6] ;Offset
mov word ptr [esi+eax+2],28h
mov word ptr [esi+eax+4],0EC00h ;sel=28h and attribute ->386 call gate!
and dword ptr Callgt,0
mov word ptr [Callgt+4],ax
pushad
call fword ptr [Callgt] ;Ring0!
popad
mov dword ptr [esi+eax+0],0
mov dword ptr [esi+eax+4],0
invoke MessageBoxA,0,addr Nightmare,addr Nightmare,0
lea edx,Exit
mov ecx,esp
sysenter
Exit:
push 00000000h ; Exit program
call ExitProcess
;----------------------------------------------------------------------
Ring0_SetMsr:
mov ecx,174h
movzx eax,tmpCs
wrmsr
inc ecx
mov eax,tssRing0Esp
wrmsr
inc ecx
lea eax,Ring0Ip
wrmsr
mov eax,cr0 ; read CR0
or eax,CR0_CD ; set CD but not NW bit of CR0
mov cr0,eax ; cache is now disabled
wbinvd ; flush and invalidate cache
; the cache is effectively disabled at this point, but memory
; consistency will be maintained. To completely disable cache,
; the following two lines may used as well:
or eax,CR0_NW ; now set the NW bit
mov cr0,eax ; turn off the cache entirely
retf
;----------------------------------------------------------------------
Ring0Ip:
pushad
pushf ; save the flags
cli ; disable interrupts while we do this
mov eax,cr0 ; read CR0
and eax,0dfffffffh ; now set the NW bit
mov cr0,eax ; turn on the cache entirely
and eax,0bfffffffh ; set CD but not NW bit of CR0
mov cr0,eax ; cache is now Ensabled
popf ; restore the flags
mov eax,cr0
mov [esp+4*7],eax
popad
sysexit
;----------------------------------------------------------------------
Search_XDT proc near
;entry esi==Base of Ldt or GDT ;Eax==Limit
pushad
mov ebx,eax
mov eax,8 ; skipping null selector
@@1:
cmp dword ptr [esi+eax+0],0
jnz @@2
cmp dword ptr [esi+eax+4],0
jz @@3
@@2:
add eax,8
cmp eax,ebx
jb @@1 ;if we haven’t found any free GDT entry,
;lets use the last two entries
mov eax,ebx
sub eax,7
@@3:
mov [esp+4*7],eax ; return off in eax
popad
ret
Search_XDT endp
end Start
;=======================================================================================================
1 銆愬師鍒涖憆ootkit hook涔媅鍏璢 -- sysenter Hook
--------------------------------------------------------------------------------
鏍?棰? 銆愬師鍒涖憆ootkit hook涔媅鍏璢 -- sysenter Hook
浣?鑰? combojiang
鏃?闂? 2008-02-26,12:25
閾?鎺? http://bbs.pediy.com/showthread.php?t=60247
鍛靛懙錛屼粖澶╄繖綃囧唴瀹瑰皯錛屾瘮杈冪畝鍗曘?/p>
SYSENETER鏄竴鏉℃眹緙栨寚浠わ紝瀹冩槸鍦≒entium? II 澶勭悊鍣ㄥ強浠ヤ笂澶勭悊鍣ㄤ腑鎻愪緵鐨勶紝鏄揩閫熺郴緇熻皟鐢ㄧ殑涓閮ㄥ垎銆係YSENTER/SYSEXIT榪欏鎸囦護涓撻棬鐢ㄤ簬瀹炵幇蹇熻皟鐢ㄣ傚湪榪欎箣鍓嶆槸閲囩敤INT 0x2E鏉ュ疄鐜扮殑銆侷NT 0x2E鍦ㄧ郴緇熻皟鐢ㄧ殑鏃跺欙紝闇瑕佽繘琛屾爤鍒囨崲鐨勫伐浣溿傜敱浜嶪nterrupt/Exception Handler鐨勮皟鐢ㄩ兘鏄氳繃 call/trap/task榪欎竴綾葷殑gate鏉ュ疄鐜扮殑錛岃繖縐嶆柟寮忎細榪涜鏍堝垏鎹紝騫朵笖緋葷粺鏍堢殑鍦板潃絳変俊鎭敱TSS鎻愪緵銆傝繖縐嶆柟寮忓彲鑳戒細寮曡搗澶氭鍐呭瓨璁塊棶 錛堟潵鑾峰彇榪欎簺鍒囨崲淇℃伅錛夛紝鍥犳錛屼粠PentiumII寮濮嬶紝IA-32寮曞叆浜嗘柊鎸囦護錛歋YSENTER/SYSEXIT銆?鏈変簡榪欎袱鏉℃寚浠わ紝
浠庣敤鎴風駭鍒扮壒鏉冪駭鐨勫爢鏍堜互鍙婃寚浠ゆ寚閽堢殑杞崲錛屽彲浠ラ氳繃榪欎竴鏉℃寚浠ゆ潵瀹炵幇錛屽茍涓旓紝闇瑕佸垏鎹㈠埌鐨勬柊鍫嗘爤鐨勫湴鍧錛屼互鍙婄浉搴旇繃紼嬬殑絎竴鏉℃寚浠ょ殑浣嶇疆錛岄兘鏈変竴緇勭壒孌婂瘎瀛樺櫒鏉ュ疄鐜幫紝榪欑被鐗規畩瀵勫瓨鍣ㄥ湪IA-32涓О涓篗SR(Model Specific Register)銆傝繖閲岀壍娑夊埌3涓壒孌婂瘎瀛樺櫒錛?
SYSENTER_CS_MSR: New code segment selector 0x174
SYSENTER_ESP_MSR: New Stack Pointer 0x175
SYSENTER_EIP_MSR: New Instruction Pointer 0x176
榪欓噷鏍囧嚭鐨?涓?6榪涘埗鏁板垎鍒搴旇繖3涓瘎瀛樺櫒鐨勫湴鍧錛岃鍦板潃鐢ㄤ簬Kernel debug鏃訛紝閫氳繃rdmsr/wrmsr鎸囦護鏉ヨ/鍐欒繖3涓瘎瀛樺櫒銆傛楠ゅ涓嬶細
10.JPG
1. 瑁呰澆SYSENTER_CS_MSR 鍒癈S 瀵勫瓨鍣紝璁劇疆鐩爣浠g爜孌?br>2. 瑁呰澆SYSENTER_EIP_MSR鍒?EIP瀵勫瓨鍣紝璁劇疆鐩爣鎸囦護
3. SYSENTER_CS_MSR+8 瑁呰澆鍒癝S瀵勫瓨鍣?錛岃緗爤孌?br>4. 瑁呰澆SYSENTER_ESP_MSR 鍒癊SP瀵勫瓨鍣紝璁劇疆鏍堝撫
5. 鍒囨崲RING0.
6. 娓呴櫎 EFLAGS鐨?VM鏍囧織
7. 鎵цRING0渚嬬▼
11.JPG
1. SYSENTER_CS_MSR+16瑁呰澆鍒?CS瀵勫瓨鍣?
2. 灝咵DX鐨勫奸佸叆EIP
3. SYSENTER_CS_MSR+24 瑁呰澆鍒癝S瀵勫瓨鍣?
4. 灝咵CX鐨勫奸佸叆ESP
5. 鍒囨崲鍥濺ING3
6. 鎵цEIP澶勭殑RING3鎸囦護
鎴戜滑鍦╳indbg涓彲浠ョ湅鐪嬭繖涓笁涓瘎瀛樺櫒鐨勬儏鍐碉紝榪欎釜鏄垜鏈哄櫒閲岀殑鎯呭喌銆?br>lkd> rdmsr 176
msr[176] = 00000000`8053dad0
lkd> rdmsr 175
msr[175] = 00000000`ba4e0000
lkd> rdmsr 174
msr[174] = 00000000`00000008
鍙互鐪嬪埌錛屾垜鐨勬満鍣ㄩ噷闈㈠綋鍓峉YSENTER_EIP_MSR錛孲YSENTER_ESP_MSR錛孲YSENTER_CS_MSR榪欎笁涓瘎瀛樺櫒鐨勫箋?/p>
鎴戜滑鍦ㄥ井杞叕寮鐨勫唴鏍竁RK涓彂鐜板叧浜庤繖涓変釜瀵勫瓨鍣ㄧ殑璁劇疆錛屽叾涓璖YSENTER_EIP_MSR璁劇疆鐨勫兼槸KiFastCallEntry銆?br>浠g爜濡備笅錛?br>VOID
KiLoadFastSyscallMachineSpecificRegisters(
IN PLONG Context
)
/*++
Routine Description:
Load MSRs used to support Fast Syscall/return. This routine is
run on all processors.
Arguments:
None.
Return Value:
None.
--*/
{
PKPRCB Prcb;
UNREFERENCED_PARAMETER (Context);
if (KiFastSystemCallIsIA32) {
Prcb = KeGetCurrentPrcb();
//
// Use Intel defined way of doing this.
//
WRMSR(MSR_SYSENTER_CS, KGDT_R0_CODE);
WRMSR(MSR_SYSENTER_EIP, (ULONGLONG)(ULONG)KiFastCallEntry);
WRMSR(MSR_SYSENTER_ESP, (ULONGLONG)(ULONG)Prcb->DpcStack);
}
}
鐪嬬湅鎴戠數鑴戠殑鎯呭喌濡備笅錛?br>lkd> rdmsr 176
msr[176] = 00000000`8053dad0
lkd> u 8053dad0
nt!KiFastCallEntry:
8053dad0 b923000000 mov ecx,23h
8053dad5 6a30 push 30h
8053dad7 0fa1 pop fs
8053dad9 8ed9 mov ds,cx
8053dadb 8ec1 mov es,cx
8053dadd 8b0d40f0dfff mov ecx,dword ptr ds:[0FFDFF040h]
8053dae3 8b6104 mov esp,dword ptr [ecx+4]
8053dae6 6a23 push 23h
涓嬮潰鏄痳ootkit.com涓婄殑涓涓緥瀛愶紝榪欎釜渚嬪瓙鏈夌偣涓嶅帤閬擄紝鍦ㄤ綘鍗歌澆鐨勬椂鍊欎細bsod.鎴戠畝鍗曚慨鏀逛簡涓嬶紝璐翠唬鐮佸涓嬶細
#include "ntddk.h"
ULONG d_origKiFastCallEntry; // Original value of ntoskrnl!KiFastCallEntry
VOID OnUnload( IN PDRIVER_OBJECT DriverObject )
{
_asm
{
mov ecx, 0x176
xor edx,edx
mov eax, d_origKiFastCallEntry // Hook function address
wrmsr // Write to the IA32_SYSENTER_EIP register
}
}
// Hook function
__declspec(naked) MyKiFastCallEntry()
{
__asm {
jmp [d_origKiFastCallEntry]
}
}
NTSTATUS DriverEntry( IN PDRIVER_OBJECT theDriverObject, IN PUNICODE_STRING theRegistryPath )
{
theDriverObject->DriverUnload = OnUnload;
__asm {
mov ecx, 0x176
rdmsr // read the value of the IA32_SYSENTER_EIP register
mov d_origKiFastCallEntry, eax
mov eax, MyKiFastCallEntry // Hook function address
wrmsr // Write to the IA32_SYSENTER_EIP register
}
return STATUS_SUCCESS;
}
娉ㄦ剰涓鐐癸紝澶у鐢╳indbg鐨勬椂鍊欙紝閰嶇疆symbol path,濡傚浘錛?br>9.JPG
鍚庨潰璐翠笂涓綃囧爼钀藉ぉ鎵嶅啓鐨勬枃绔犻摼鎺ワ細http://bbs.pediy.com/showthread.php?t=42705錛?br>浠杋nline hook 浜咾iFastCallEntry錛岄噰鐢╠etour鏂瑰紡,鍐欏緱寰堜笉閿欍?
涓婁紶鐨勯檮浠?SysEnterHook.rar (973 瀛楄妭, 743 嬈′笅杞?
;=====================================================================================================================
銆愬師鍒涖戝彟涓縐峴ysenter hook鏂規硶(緇曡繃緇濆ぇ澶氭暟鐨剅ootkit媯嫻嬪伐鍏風殑媯嫻?
--------------------------------------------------------------------------------
鏍?棰? 銆愬師鍒涖戝彟涓縐峴ysenter hook鏂規硶(緇曡繃緇濆ぇ澶氭暟鐨剅ootkit媯嫻嬪伐鍏風殑媯嫻?
浣?鑰? 鍫曡惤澶╂墠
鏃?闂? 2007-04-14,11:09
閾?鎺? http://bbs.pediy.com/showthread.php?t=42705
*****************************************************************************
*鏍囬:銆愬師鍒涖戝彟涓縐峴ysenter hook鏂規硶(緇曡繃緇濆ぇ澶氭暟鐨剅ootkit媯嫻嬪伐鍏風殑媯嫻? *
*浣滆?鍫曡惤澶╂墠 *
*鏃ユ湡:2007騫?鏈?4鍙?nbsp; *
*****************************************************************************
鍏堝簾璇?褰撳垵鏄負浜嗙粫寮NP瀵箂ysenter淇濇姢鑰屾兂鍑烘潵鐨?鍚庢潵鍙戠幇榪濺ootkitUnhooker閮界粫浜?
浠涔堟槸sysenter hook鎴戜篃涓嶇綏鍞嗕簡,涓鑸殑鎷︽埅鏂規硶灝辨槸閫氳繃rdmsr wrmsr 涓や釜鎸囦護鎶婂師鏉ョ殑sysenter鍦板潃鏀規垚鑷繁鐨剆ysenter鍦板潃鏉ュ疄鐜扮殑.榪欑鏂規硶浣跨敤鏂逛究,浣嗘嫻嬩篃寰堝鏄?
榪欓噷浠嬬粛鐨勫彟澶栦竴縐嶆柟娉曚笉鏀瑰彉sysenter鍦板潃,鑰屾槸閫氳繃鐩存帴鍦ㄥ師鏉ysenter鍦板潃閲岄潰鍐欒煩杞唬鐮佹潵瀹炵幇鐨?榪欏疄闄呬笂璺熶竴鑸殑鍑芥暟澶磇nline hook涓鏍?榪欐牱rootkit媯嫻嬪伐鍏峰氨涓嶄細璁や負sysenter宸茬粡鏀瑰彉(瀹為檯涓婁篃鏄病鍙?.
涓鑸殑rootkit媯嫻嬪伐鍏鋒嫻嬪嚱鏁癷nline hook鏄氳繃媯嫻嬮暱璺寵漿鎸囦護0xE9鐨勬潵鍒ゆ柇璺寵漿璺濈鏄笉鏄秴鍑哄嚱鏁版墍鍦ㄧ殑妯″潡鑼冨洿鏉ョ‘瀹氱殑.浣嗘槸瀹炵幇璺寵漿鎴戜滑涔熷彲浠ュ熷姪瀵勫瓨鍣ㄦ垨鍙橀噺(鐢ㄥ彉閲忚煩杞渶瑕佹秹鍙婇噸瀹氫綅闂,楹葷儲.鎵浠ヤ竴鑸敤瀵勫瓨鍣?,榪欐牱璺寵漿鎸囦護灝變笉鏄?xE9浜嗚屾槸0xFF,榪欎釜緇濆ぇ澶氭暟rootkit媯嫻嬪伐鍏鋒槸媯嫻嬩笉鍒扮殑(鍖呮嫭钁楀悕鐨凴ootkitUnhooker,VICE).
鐢變簬鎴戜滑宸茬粡鏀瑰彉浜咾iFastCall鍑芥暟澶?鎵浠ユ垜浠彧鑳芥妸鍘熸潵鐨勫嚱鏁板ご浠g爜鏀懼埌鍙﹀涓涓湴鏂規墽琛?鍔ㄦ佸垎閰嶅唴瀛?褰撶劧濡傛灉涓嶈冭檻鍏煎鎬х‖緙栫爜涔熸病闂),鐒跺悗鍐嶈煩杞洖鏉?榪欓噷浣跨敤浜?涓夌駭璺?,澶ф鏄繖涓牱瀛?
sysenter->KiFastCall
JMP -> MyKiFastCall(榪欓噷榪涜鎷︽埅鎴栦粈涔堢殑)
JMP -> KiFastCall head code (榪欓噷鎵ц鍘熸潵KiFastCall鍑芥暟澶翠唬鐮?
JMP -> KiFastCall + N(宸茬粡鎵ц鎸囦護闀垮害)
///////////////////////////////////////////////////////////////////////////////////////////////////
//鍫曡惤澶╂墠
//2007騫?鏈?4鏃?br>#include<ntddk.h>
#include "OpCodeSize.h"
ULONG uSysenter; //sysenter鍦板潃
UCHAR uOrigSysenterHead[8];//淇濆瓨鍘熸潵鐨勫叓涓瓧鑺傚嚱鏁板ご
PUCHAR pMovedSysenterCode; //鎶婂師鏉ョ殑KiFastCall鍑芥暟澶翠繚瀛樺湪榪欓噷
ULONG i; //璁板綍鏈嶅姟ID
__declspec(naked) void MyKiFastCallEntry(void)
{
__asm{
pop edi //鍥犱負鐢ㄥ埌浜唀di鏉ヨ煩杞?榪欓噷鎭㈠
mov i, eax //寰楀埌鏈嶅姟ID
}
__asm{
pushad
push fs
push 0x30
pop fs
}
DbgPrint("sysenter was hooked! Get service ID:%X",i); //璇佹槑鑷繁瀛樺湪
__asm{
pop fs
popad
jmp pMovedSysenterCode //絎簩璺?璺寵漿鍒板師鏉ョ殑鍑芥暟澶翠唬鐮?
}
}
//////////////////////////////////////////////////////
VOID OnUnload(IN PDRIVER_OBJECT DriverObject)
{
__asm{
cli
mov eax,cr0
and eax,not 10000h
mov cr0,eax
}
memcpy((PVOID)uSysenter,uOrigSysenterHead,8);//鎶婂師鏉ュ嚱鏁板ご鐨勫叓涓瓧鑺傛仮澶?/p>
__asm{
mov eax,cr0
or eax,10000h
mov cr0,eax
sti
}
ExFreePool(pMovedSysenterCode); // 閲婃斁鍒嗛厤鐨勫唴瀛?br> DbgPrint("Unload sysenterHook");
}
////////////////////////////////////////////////////////
VOID HookSysenter()
{
UCHAR cHookCode[8] = { 0x57, //push edi 絎竴璺?浠嶬iFastCall璺沖埌MyKiFastCallEntry.騫剁粫榪噐ootkit媯嫻嬪伐鍏鋒嫻?br> 0xBF,0,0,0,0, //mov edi,0000
0xFF,0xE7}; //jmp edi
UCHAR JmpCode[]={0xE9,0,0,0,0}; //jmp 0000 絎笁璺?浠嶬iFastCall鍑芥暟澶翠唬鐮佽煩杞埌鍘熸潵KiFastCall+N
int nCopyLen = 0;
int nPos = 0;
__asm{
mov ecx,0x176
rdmsr
mov uSysenter,eax //寰楀埌KiFastCallEntry鍦板潃
}
DbgPrint("sysenter:0x%08X",uSysenter);
nPos = uSysenter;
while(nCopyLen<8){ //鎴戜滑瑕佹敼鍐欑殑鍑芥暟澶磋嚦灝戦渶瑕?瀛楄妭 榪欓噷璁$畻瀹為檯闇瑕丆OPY鐨勪唬鐮侀暱搴?鍥犱負鎴戜滑涓嶈兘鎶婁竴鏉″畬鏁寸殑鎸囦護鎵撴柇
nCopyLen += GetOpCodeSize((PVOID)nPos); //鍙傝?
nPos = uSysenter + nCopyLen;
}
DbgPrint("copy code lenght:%d",nCopyLen);
pMovedSysenterCode = ExAllocatePool(NonPagedPool,20);
memcpy(uOrigSysenterHead,(PVOID)uSysenter,8);//澶囦喚鍘熸潵8瀛楄妭浠g爜
*((ULONG*)(JmpCode+1)) = (uSysenter + nCopyLen) - ((ULONG)pMovedSysenterCode + nCopyLen)- 5;//璁$畻璺寵漿鍦板潃
memcpy(pMovedSysenterCode,(PVOID)uSysenter,nCopyLen); //鎶婂師鏉ョ殑鍑芥暟澶存斁鍒版柊鍒嗛厤鐨勫唴瀛?br> memcpy((PVOID)(pMovedSysenterCode + nCopyLen),JmpCode,5); //鎶婅煩杞唬鐮丆OPY涓婂幓
*((ULONG*)(cHookCode+2)) = (ULONG)MyKiFastCallEntry; //HOOK鍦板潃
DbgPrint("Saved sysenter code:0x%08X",pMovedSysenterCode);
DbgPrint("MyKiFastCallEntry:0x%08X",MyKiFastCallEntry);
__asm{
cli
mov eax,cr0
and eax,not 10000h
mov cr0,eax
}
memcpy((PVOID)uSysenter,cHookCode,8);//鎶婃敼鍐欏師鏉ュ嚱鏁板ご
__asm{
mov eax,cr0
or eax,10000h
mov cr0,eax
sti
}
}
NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject,PUNICODE_STRING RegistryPath)
{
DbgPrint("Welcome to sysenterhook.sys");
DriverObject->DriverUnload = OnUnload;
HookSysenter();
return STATUS_SUCCESS;
}
///////////////////////////////////////////////////////////////////////////////////////////////////
浠ヤ笂浠g爜鍦?XP SP2涓枃 + RootkitUnhooker涓嬫祴璇曢氳繃
鍚岀悊 IDT hook涔熷彲浠ョ敤榪欑鏂規硶瀹炵幇,HOOK鐨勫疄璐ㄦ槸鏀瑰彉紼嬪簭嫻佺▼,鏃犺鍦ㄥ摢閲屾敼鍙?br>*************************************************************************************************
鍙傝?, 嫻烽鏈堝獎,銆愬垎浜戣タ瑁ゅ摜鐨?Hook Api Lib 0.2 For C
;http://bbs.pediy.com/showthread.php?p=420864
鎬葷粨涓涓?
瀵逛簬NASM涓嶸C娣峰悎緙栫▼
鍦ˋSM鏂囦歡鐨勫紑澶磋緭鍏?/font>
[bits 32] ;浣跨敤32浣嶆ā寮忕殑澶勭悊鍣?/font>
[section .text] ;text孌? 浠g爜孌?鍙騫跺彲鎵ц
澹版槑浠g爜孌靛茍涓斾唬鐮佹鏄?2浣?搴斾負瀵逛簬VC鐢熸垚鐨凱E鏂囦歡錛屽叾浠g爜鏀懼湪.text鐨勪唬鐮佹鍐?/font>
錛屾暟鎹斁鍦?data鐨勬暟鎹鍐?鎵浠ュ鏋滆瀹氫箟鏁版嵁鐨勮瘽錛岃鍦?data孌靛唴
{涓} 鍦–浠g爜涓皟鐢ㄦ眹緙栫▼搴?/font>
1..濡傛灉閬靛畧C 璋冪敤綰﹀畾
鎵撴瘮鏂規垜浠湪ASM涓疄鐜頒袱涓暟鐩稿姞鐨勫嚱鏁?
_myadd:
push ebp
mov ebp,esp
mov eax,[ebp+8] ;a
mov ebx,[ebp+12] ;b
add eax,ebx
add esp,4
mov esp,ebp
pop ebp
ret
鍦ˋSM鐨勫紑澶村啓涓奼lobal _myadd;
鍦–鏂囦歡涓0鏄庡嚱鏁?nbsp;extern "C" int _cdecl myadd(int a,int b);
鏈涓昏鐨勬槸瑕佸湪ASM鐨勫嚱鏁板悕縐扮殑鍓嶉潰鍔犱笂涓涓?nbsp;_(涓嬪垝綰? ,浣嗘槸鍦–鏂囦歡涓0鏄庣殑鍑芥暟涓嶇敤鍔犱笅鍒掔嚎,騫朵笖涓瀹氳鍔犱笂extern "C",騫朵笖鐢╛cdecl 澹版槑錛岃繖鏍蜂互鍚庡氨鍙互鍦–涓皟鐢ˋSM涓殑鍑芥暟浜嗐?/font>
2.濡傛灉閬靛畧stdcall 璋冪敤綰﹀畾
榪樼敤涓婇潰鐨勯偅涓袱涓暟鐩稿姞鐨勪緥瀛?/font>
_myaddstdcall@8:
push ebp
mov ebp,esp
mov eax,[ebp+8] ;a
mov ebx,[ebp+12] ;b
add eax,ebx
add esp,4
mov esp,ebp
pop ebp
ret 8
鍦ˋSM鏂囦歡鐨勫紑澶村啓涓?nbsp;global _myaddstdcall@8
鍦–鏂囦歡涓0鏄庡嚱鏁?nbsp;extern "C" int _stdcall myaddstdcall(int a,int b);
榪欓噷瑕佹敞鎰忕殑鏄嚱鏁扮殑鍚嶇О闂,涓鑸槸_XXX@N ,涔熷氨鏄湪寮澶村姞涓婁竴涓笅鍒掔嚎,@N涓殑N璺熷弬鏁扮殑澶у皬鏈夊叧緋伙紝鐩墠鎴戠殑鐞嗚В鏄墍鏈夊弬鏁板湪鍫嗘爤涓崰鐢ㄧ殑鎬葷殑澶у皬.浣嗘槸涓嶇‘瀹氾紝鎴戝彧鏄帹嫻嬬殑錛屽鏋滈偅浣嶇煡閬撳叿浣撶殑瑙勫畾涓瀹氳鍛婃垜涓澹板晩銆?/font>
{浜寎 鍦ㄦ眹緙栦腑璋冪敤C涓殑鍑芥暟
1.閬靛畧C璋冪敤綰﹀畾
涓句釜渚嬪瓙:
extern "C" void _cdecl myprint(int a)
{
printf("myprint %d\n",a);
}
鍦ˋSM涓0鏄?nbsp;extern _myprint ,鐒跺悗灝卞彲浠ョ敤 push xxx 錛宑all myprint , add esp ,4 璋冪敤浜?/font>
銆傝娉ㄦ剰鐨勬槸call 璋冪敤瀹屽悗錛屼竴瀹氳鍔犱笂add esp ,X 鏉ュ鉤琛″爢鏍?搴斾負C璋冪敤綰﹀畾瑙勫畾鏄皟鐢ㄨ呭鉤琛″爢鏍?
2.閬靛畧stdcall 璋冪敤綰﹀畾
extern "C" void _stdcall myprintstdcall(int a)
{
printf("myprintstdcall %d\n",a);
}
鍦ˋSM涓0鏄巈xtern _myprintstdcall@4 ,鐒跺悗鐢╬ush xxx ,call _myprintstdcall@4 璋冨姩錛岃繖閲屽氨涓嶇敤鍐嶅姞add esp錛孹浜嗭紝鏈夊嚱鏁版湰韜鉤琛″爢鏍?
灝辮繖浜涗簡錛岄兘鏄釜浜烘葷粨錛岄毦鍏嶆湁涓嶈凍涓庨敊璇紝榪樿澶у鎸囨.
銆愪竴銆?鍦?__asm block涓嬌鐢ㄦ眹緙栬璦
1.鍏抽敭瀛梍_asm璋冪敤鍐呰仈姹囩紪璇彞
鏈変笁縐嶆柟寮忓彲鐢?br>錛?錛塤_asm block 褰㈠紡
渚嬪瓙錛?br>// asm_overview.cpp
// processor: x86
void __declspec(naked) main()
{
// Naked functions must provide their own prolog...
__asm {
push ebp
mov ebp, esp
sub esp, __LOCAL_SIZE
}
// ... and epilog
__asm {
pop ebp
ret
}
}
錛?錛夊皢__asm鏀懼湪姣忓彞姹囩紪鎸囦護鐨勫紑澶?br>渚嬪瓙錛?br>__asm push ebp
__asm mov ebp, esp
__asm sub esp, __LOCAL_SIZE
錛?錛夊簲涓篲_asm 涔熸槸涓涓鍙ュ垎闅旂錛屾墍浠ュ彲浠ュ皢姹囩紪鎸囦護鏀懼湪鍚屼竴琛屼笂
渚嬪瓙錛?br>__asm push ebp __asm mov ebp, esp __asm sub esp, __LOCAL_SIZE
2.鍐呰仈姹囩紪鎸囦護闆?br>VC++緙栬瘧鍣ㄦ敮鎸丳entium 4 鍜?AMD Athlon鐨勬墍鏈夋寚浠わ紝棰濆鐨勮鍏朵粬鐩爣澶勭悊鍣ㄦ敮鎸佺殑鎸囦護
鑳藉琚垱閫犵敤_emit 浼寚浠ゃ?br>闄勶細_emit 浼寚浠よ鏄?br>_emit浼寚浠ょ殑MASM鐨凞B鎸囦護鐩鎬技錛屼綘鑳藉浣跨敤_emit鍦ㄤ唬鐮佹錛坱ext segment錛夌殑褰撳墠浣嶇疆
鍘誨畾涔変竴涓瓧鑺傜殑绔嬪嵆鏁般俖emit 涓嬈″彧鑳藉畾涔変竴涓瓧鑺傦紝騫朵笖浠呬粎鑳藉鍐嶄唬鐮佹錛坱ext segment錛?br>鍐呭畾涔夈?/p>
渚嬪瓙錛?br>#define randasm __asm _emit 0x4A __asm _emit 0x43 __asm _emit 0x4B
.
.
.
__asm {
randasm
}
3.鍐嶅唴鑱旀眹緙栦腑鐨凪ASM琛ㄨ揪寮?br>鍐呰仈姹囩紪鑳藉浣跨敤浠諱綍鐨凪ASM鐨勮〃杈懼紡錛岃兘澶熶嬌浠諱綍鎿嶄綔鏁板拰鎿嶄綔鐮佺殑緇勫悎銆?/p>
4.鍐呰仈姹囩紪涓殑鏁版嵁鎸囦護鍜屾搷浣?br>灝界__asm block鑳藉寮曠敤C/C++鐨勬暟鎹被鍨嬪拰瀵硅薄(object)錛屼絾鏄粬涓嶈兘瀹氫箟鏁版嵁瀵硅薄鐢∕ASM鐨勬寚浠ゅ拰鎿嶄綔,灝ゅ叾錛屼笉鑳戒嬌鐢?/p>
DB,DW,DD,DQ,DT,DF 鎴栬匘UP,THIS銆侻ASM涓粨鏋勪綋鍜岃褰曠被鍨嬩篃鏄笉鍙敤鐨勶紝鍐呰仈姹囩紪涓嶆帴鍙桽TRUC,RECORD,WIDTH,MASK鎿嶄綔.
5.EVEN 鍜?ALIGN 鎸囦護
灝界鍐呰仈姹囩紪涓嶆敮鎸佸ぇ澶氭暟MASM鐨勬寚浠わ紝浣嗘槸鏀寔EVEN 鍜?ALIGN 鎸囦護錛岃繖涓や釜鎸囦護濉厖NOP鍦ㄦ眹緙栦唬鐮佷腑鍘誨鍏舵暟鎹拰鎸囧畾鐨勮竟鐣?榪欐牱鑳藉
CUP鐨勬暟鎹闂洿鍔犻珮鏁?
6.鍐呰仈姹囩紪涓殑MASM瀹忔寚浠?br>鍐呰仈姹囩紪涓嶆敮鎸丮Asm涓殑瀹忔寚浠わ紙MACRO, REPT, IRC, IRP, ENDM錛夋垨鑰呭畯鎿嶄綔絎?<>, !, &, %, .TYPE)銆?/p>
7.鍐呰仈姹囩紪涓殑孌靛紩鐢?br>鍐嶅唴鑱旀眹緙栦腑鎸囧畾涓涓鍙兘閫氳繃瀵勫瓨鍣紝鑰屼笉鑳介氳繃鍚嶅瓧錛堜緥濡傦紝孌靛悕_TEXT鏄笉鍙敤鐨勶級錛屾瓚呰秺蹇呴』鏄懼紡鐨勪嬌鐢ㄥ瘎瀛樺櫒錛屽ES:[BX].
8.鍐呰仈姹囩紪涓殑綾誨瀷鍜屽彉閲忓昂瀵擱棶棰?br>LENGTH, SIZE 鍜?TYPE 鎿嶄綔絎︽湁涓涓檺瀹氱殑鎰忎箟鍐嶅唴鑱旀眹緙栦腑錛屼粬浠笉鑳借浣跨敤鍜孌UP涓璧?鍥犱負鍐嶅唴鑱旀眹緙栦腑涓嶈兘浣跨敤DUP鍛戒護),浣嗘槸鑳藉浣?/p>
鐢ㄤ粬浠幓寰楀埌C/C++鍙橀噺鐨勫昂瀵稿拰綾誨瀷.
*LENGTH 鎿嶄綔絎﹁繑鍥炰竴涓暟緇勭殑鍏冪礌鏁扮洰錛岄潪鏁扮粍鍙橀噺榪斿洖1.
*Size 鎿嶄綔絎﹁繑鍥濩/C++鍙橀噺鐨勫昂瀵革紝涓涓彉閲忕殑灝哄鏄疞ENGTH涓嶵YPE鐩鎬箻鐨勭粨鏋?
*TYPE 鎿嶄綔絎﹁繑鍥濩/C++綾誨瀷鎴栧彉閲忕殑灝哄錛屽鏋滄槸涓涓暟緇勫彉閲忚繑鍥炴暟緇勪腑鍗曚釜鍏冪礌鐨凾YPE.
渚嬪瓙錛?br>int arr[8];
__asm C Size
LENGTH arr sizeof(arr)/sizeof(arr[0]) 8
SIZE arr sizeof(arr) 32
TYPE arr sizeof(arr[0]) 4
9.鍐呰仈姹囩紪鐨勬敞閲婇棶棰?br>鍐峗_asm block 涓彲浠ヤ嬌鐢ㄦ眹緙栬璦鐨勬敞閲?br>渚嬪瓙錛?br>__asm mov ax, offset buff ; Load address of buff
銆愪簩銆?鍐峗_asm block 涓嬌鐢–/C++
姒傝堪錛氬簲涓哄唴鑱旀眹緙栬兘澶熶笌C/C++璇彞娣峰悎浣跨敤錛屼粬姊﹁兘澶熶嬌鐢–/C++鐨勫彉閲忛氳繃鍚嶅瓧,榪樻湁C/C++璇█鐨勫叾浠栧厓绱?
*絎﹀彿錛屽寘鎷爣鍙鳳紝鍙橀噺錛屽嚱鏁板悕.
*甯擱噺錛屽寘鎷鍙峰父閲忓拰鏋氫婦錛坋num錛?br>*瀹忥紝棰勫鐞嗗懡浠?br>*娉ㄩ噴錛堝寘鎷?/**/鍜?/錛?br>*綾誨瀷鍚嶇О
*typedef鍚嶇О錛屼竴鑸兘鍜孭TR鍜孴YPE涓璧蜂嬌鐢ㄦ垨鑰呭幓鎸囧畾緇撴瀯浣撴垨鑱斿悎鎴愬憳
1.鍦?__asm block 涓嬌鐢ㄦ搷浣滅
鍐?__asm block 涓笉鑳戒嬌鐢?C/C++鐗規湁鐨勬搷浣滅錛屼緥濡?lt;<銆侰/C++涓庢眹緙栧叡鐢ㄧ殑鎿嶄綔絎︼紝濡?錛屾槸琚В閲婁負姹囩紪鎿嶄綔絎︺?br>涓句釜渚嬪瓙鏉ヨ錛孾]鎿嶄綔絎﹀湪C璇█閲岃瑙i噴涓烘暟緇勭殑涓嬫爣錛?C鑳藉鑷姩鐨勮漿鎹㈡暟緇勫厓绱犵殑灝哄,瑙i噴涓洪鍦板潃+鍗曚釜鍏冪礌鐨勯暱搴?鏂規嫭鍙峰唴鐨勫?
浣嗘槸鍐峗_asm block涓紝浠栬鐪嬪仛 MASM绱㈠紩鎿嶄綔絎?index operator),瑙i噴涓洪鍦板潃+鏂規嫭鍙蜂腑鐨勫?
涓嬮潰鐨勫疄渚嬫樉紺轟簡浠栦滑鐨勪笉鍚屻?br>int array[10];
__asm mov array[6], bx ; Store BX at array+6 (not scaled)
array[6] = 0; /* Store 0 at array+24 (scaled) */
鑳藉浣跨敤TYPE鎿嶄綔絎﹀幓杈懼埌鍜孋鍚屾牱鐨勬晥鏋?br>__asm mov array[6 * TYPE int], 0 ; Store 0 at array + 24
array[6] = 0; /* Store 0 at array + 24 */
2.浣跨敤C/C++絎﹀彿鍦╛_asm block 涓?br>__asm鍧楄兘澶熷紩鐢?C/C++鍦ㄤ綔鐢ㄥ煙涓殑絎﹀彿錛堝寘鎷彉閲忓悕錛屽嚱鏁板悕錛屾爣鍙?涓嶈兘璋冪敤C++鐨勬垚鍛樺嚱鏁幫級
鍦ㄤ嬌鐢–/C++絎﹀彿鏃舵湁涓浜涢檺鍒?
*姣忔潯姹囩紪璇彞浠呬粎鑳藉鍖呭惈涓涓狢/C++鐨勭鍙楓傚湪LENGTH, TYPE, 鍜?SIZE琛ㄨ揪寮忎腑鍒欏彲浠ヤ嬌鐢ㄥ涓狢/C++絎﹀彿銆?br>*鍦╛_asm block涓嚱鏁板紩鐢ㄥ繀欏誨厛澹版槑銆傚惁鍒欑紪璇戝櫒涓嶈兘鍖哄埆鍦╛_asm block 涓殑鏍囧彿涓庡嚱鏁板悕.
*涓嶈兘浣跨敤涓嶮ASM淇濈暀瀛楃浉鍚岀殑絎﹀彿鍚嶇О錛堟棤璁哄ぇ灝忓啓錛夈?br>*緇撴瀯浣撳拰鑱斿悎綾誨瀷涓嶈兘鍒瘑鍒湪__asm block涓?
3.璁塊棶C/C++鏁版嵁鍦╛_asm block涓?br>鍦ㄥ唴鑱旀眹緙栦腑閫氳繃鍚嶇О璁塊棶C/C++鍙橀噺鏄崄鍒嗘柟渚跨殑銆傚湪__asm block涓兘璁塊棶浠諱綍鍦ㄤ綔鐢ㄥ煙涓鍙楓?br>渚嬪錛屽湪鍏朵綔鐢ㄥ煙涓湁涓涓狢鍙橀噺 var錛?__asm MOV EAX,var 瀛樺偍var鐨勫煎湪EAX涓?/p>
濡傛灉涓涓被錛岀粨鏋勪綋鎴栬呰仈鍚堢粨鏋勭殑鎴愬憳鏄敮涓鐨勶紝鍦╛_asm block涓紩鐢ㄤ粬浠呬粎浣跨敤鎴愬憳鍙橀噺鍚嶏紝
鑰屼笉鐢ㄤ嬌鐢ㄥ彉閲忓悕鎴栬卼ypedef鍚嶅湪.鎿嶄綔絎︿箣鍓嶃傚鏋滄垚鍛樺悕涓嶆槸鍞竴鐨勶紝鏃犺濡備綍錛屽繀欏繪斁緗彉閲忓悕鎴栬卼ypedef鍚嶅湪.鎿嶄綔絎︿箣鍓嶃?br>渚嬪瓙錛?br>// InlineAssembler_Accessing_C_asm_Blocks.cpp
// processor: x86
#include <stdio.h>
struct first_type
{
char *weasel;
int same_name;
};
struct second_type
{
int wonton;
long same_name;
};
int main()
{
struct first_type hal;
struct second_type oat;
__asm
{
lea ebx, hal
mov ecx, [ebx]hal.same_name ; Must use 'hal'
mov esi, [ebx].weasel ; Can omit 'hal'
}
return 0;
}
鍦?__asm block涓兘澶熻闂瓹++ 鐨勬暟鎹垚鍛樿屼笉鐢ㄥ幓閬靛畧璁塊棶闄愬埗錛屼絾鏄笉鑳借皟鐢–++鐨勬垚鍛樺嚱鏁?
4.浣跨敤鍐呰仈姹囩紪鍐欏嚱鏁?br>鐣ャ傛病鍟ュソ璁茬殑錛岀洿鎺ョ湅渚嬪瓙
int power2( int num, int power )
{
__asm
{
mov eax, num ; Get first argument
mov ecx, power ; Get second argument
shl eax, cl ; EAX = EAX * ( 2 to the power of CL )
}
// Return with result in EAX
}
5.浣跨敤鍜屼繚瀛樺瘎瀛樺櫒鍦ㄥ唴鑱旀眹緙栦腑
涓鑸潵璇達紝涓嶅簲璇ュ亣璁懼瘎瀛樺櫒灝嗕細鏈変竴涓寚瀹氱殑鍊煎湪__asm blok鍧楀紑濮嬫椂錛屽瘎瀛樺櫒鐨勫間笉淇濊瘉鍦ㄧ寮浜嗕竴涓猒_asm block鍚庤淇濆瓨,濡傛灉浣犵寮
浜嗕竴涓猘sm鍧楀茍寮濮嬩簡鍙︿竴涓猘sm鍧楋紝涓嶅簲璇ュ簲鐢ㄥ湪涓婁竴涓潡涓繚瀛樺瘎瀛樺櫒鐨勫箋侫n __asm block inherits whatever register values result
from the normal flow of control.
濡傛灉浣跨敤__fastcall璋冪敤綰﹀畾錛岀紪璇戝櫒浼犻掑弬鏁頒嬌鐢ㄥ瘎瀛樺櫒鑰屼笉鏄爢鏍堬紝榪欏彲鑳戒駭鐢熶竴涓棶棰樺湪搴旂敤浜哶_asm block鐨勫嚱鏁頒腑錛屽洜涓哄嚱鏁版棤娉曠煡
閬撻偅涓弬鏁版槸鍦ㄥ瘎瀛樺櫒涓傚鏋滀竴涓嚱鏁版帴鍙楀弬鏁板湪EAX涓紝浣嗘槸榪囧悗鍒珛鍒葷敤鏉ュ瓨鍌ㄥ叾浠栫殑鍊鹼紝閭f懇榪欎釜鍘熷鐨勫弬鏁板氨涓㈠け浜嗐傚茍涓旓紝鍦?/p>
__fastcall綰﹀畾涓紝蹇呴』淇濆瓨ECX瀵勫瓨鍣ㄧ殑鍊箋?br>鍘婚伩鍏嶅姝ょ殑瀵勫瓨鍣ㄥ啿紿侊紝涓嶈浣跨敤__fastcall璋冪敤綰﹀畾涓洪偅浜涘寘鍚玙_asm block鐨勫嚱鏁?濡傛灉浣跨敤/Gr緙栬瘧鍣ㄩ夐」鎸囧畾浜嗗叏灞鐨刜_fastcall綰﹀畾
錛岄偅鎽╁畾涔夋瘡涓寘鍚玙_asm block鐨勫嚱鏁扮敤_stdcall鎴朹_cdecl銆?br>褰撲嬌鐢╛_asm鍘誨啓姹囩紪璇彞鍦–/C++涓紝涓嶉渶瑕佸幓淇濆瓨EAX,EBX,ECX,EDX,ESI,EDI銆傚湪浣跨敤EBX,ESI,EDI鏃訛紝浣犲己榪紪璇戝櫒鍘諱繚瀛樺茍鍥炲榪欎簺瀵勫瓨
鍣ㄧ殑鍊煎湪鍑芥暟鐨勫簭璦涓庣粨灝懼.
涔熷簲璇ヤ繚瀛樹嬌鐢ㄧ殑鍏朵粬瀵勫瓨鍣紙濡侱S,SS,SP,BP,EFLAGS錛夊浜庤繖涓猒_asm block鐨勪綔鐢ㄥ煙.
涔熷簲璇ヤ繚瀛楨SP鍜孍BP闄ら潪浣犳湁鍏朵粬鐨勬敼鍙樹粬浠殑鍘熷洜銆傦紙渚嬪錛屽爢鏍堣漿鎹級
涓嬮潰榪欐涓嶅お濂界炕璇戯紝鑷繁鐪嬪惂錛?br>Some SSE types require eight-byte stack alignment, forcing the compiler to emit dynamic stack-alignment code. To be able to
access both the local variables and the function parameters after the alignment, the compiler maintains two frame pointers.
If the compiler performs frame pointer omission (FPO), it will use EBP and ESP. If the compiler does not perform FPO, it will
use EBX and EBP. To ensure code runs correctly, do not modify EBX in asm code if the function requires dynamic stack
alignment as it could modify the frame pointer. Either move the eight-byte aligned types out of the function, or avoid using
EBX.
娉ㄦ剰:濡傛灉鍦╛_asm block涓敼鍙樹簡鏂瑰悜鏍囧織錛岄氳繃STD,CLD錛岄偅鎽╁氨瑕佷繚瀛樿繖浜涙爣蹇楃殑鍘熷鍊?
6.鍦ㄥ唴鑱旀眹緙栦腑璺寵漿鍒版寚瀹氭爣鍙?br>鍍忎竴鑸殑 C/C++鏍囧彿錛屽湪__asm block鏈夊嚱鏁頒綔鐢ㄥ煙錛堝湪鏁翠釜鍑芥暟涓彲瑙侊紝鑰屼笉浠呬粎鏄湪瀹氫箟鐨刜_asm block涓級,姹囩紪鎸囦護涓巊oto璇彞閮借兘璺沖埌
鏍囧彿澶?
瀹氫箟鍦╛_asm block涓殑鏍囧彿涓嶆槸澶у皬鍐欐晱鎰熺殑錛実oto璇彞涓庢眹緙栨寚浠よ兘澶熷紩鐢ㄦ暣涓爣鍙瘋屼笉鐢ㄨ冭檻澶у皬鍐欍備絾鏄疌/C++浠g爜涓殑鏍囧彿鏄ぇ灝忓啓
鏁忔劅鐨勫綋浣跨敤goto璇彞鏃?浣跨敤姹囩紪璇彞涓嶇敤鑰冭檻澶у皬鍐欓棶棰?
渚嬪瓙錛?br>void func( void )
{
goto C_Dest; /* Legal: correct case */
goto c_dest; /* Error: incorrect case */
goto A_Dest; /* Legal: correct case */
goto a_dest; /* Legal: incorrect case */
__asm
{
jmp C_Dest ; Legal: correct case
jmp c_dest ; Legal: incorrect case
jmp A_Dest ; Legal: correct case
jmp a_dest ; Legal: incorrect case
a_dest: ; __asm label
}
C_Dest: /* C label */
return;
}
int main()
{
}
鍦╛_asm block涓笉瑕佷嬌鐢–搴撶殑鍑芥暟鍚嶄綔涓烘爣鍙峰悕縐般?br> BAD TECHNIQUE: using library function name as label
jne exit
.
.
.
exit:
; More __asm code follows
鍦∕ASM涓紙$錛夌鍙蜂綔涓哄綋鍓嶇殑鍦板潃璁℃暟錛坈urrent location counter錛夈備粬鏄綋鍓嶆鍦ㄨ緙栬瘧鐨勬寚浠ょ殑鏍囧彿.鍦╛_asm block 涓粬鐨勪富瑕佷綔鐢?/p>
鏄幓浣滀負涓涓暱鐨勬潯浠惰煩杞?
jne $+5 ; next instruction is 5 bytes long
jmp farlabel
; $+5
.
.
.
farlabel:
銆愪笁銆?鍦ㄥ唴鑱旀眹緙栦腑璋冪敤C鍑芥暟
涓涓猒_asm block鑳藉璋冪敤C鍑芥暟錛屽寘鎷珻搴撳嚱鏁般備笅闈㈡槸璋冪敤printf鐨勪緥瀛愶細
// InlineAssembler_Calling_C_Functions_in_Inline_Assembly.cpp
// processor: x86
#include <stdio.h>
char format[] = "%s %s\n";
char hello[] = "Hello";
char world[] = "world";
int main( void )
{
__asm
{
mov eax, offset world
push eax
mov eax, offset hello
push eax
mov eax, offset format
push eax
call printf
//clean up the stack so that main can exit cleanly
//use the unused register ebx to do the cleanup
pop ebx
pop ebx
pop ebx
}
}
銆愬洓銆?瀹氫箟__asm block浣滀負瀹?br>C璇█鐨勫畯鎻愪緵浜嗕竴涓畝渚跨殑鏂瑰紡鍘繪彃姹囩紪浠g爜榪涘叆婧愪唬鐮併備絾鏄偅闇瑕侀澶栫殑灝忓績鍥犱負瀹忚鎵╁睍鍒頒竴涓崟鐙殑閫昏緫琛屼笂錛坅 single logical
line錛夛紝鍘誨垱寤烘棤閿欒鐨勫畯錛屽簲閬靛畧涓嬪垪瑙勫垯:
*鐢▄}鍖呭洿__asm block
*鏀綺_asm 鍏抽敭瀛楀湪姣忔潯姹囩紪鎸囦護鐨勫紑澶?br>*浣跨敤鑰佸紡鐨勬敞閲?/**/)浠f浛姹囩紪涓殑娉ㄩ噴(;)鍜屽崟琛屾敞閲?//).
渚嬪瓙:
#define PORTIO __asm \
/* Port output */ \
{ \
__asm mov al, 2 \
__asm mov dx, 0xD007 \
__asm out dx, al \
}
涓涓猒_asm block鍐欑殑瀹忚兘澶熷甫鍙傛暟錛屼絾鏄笉鑳借繑鍥炲鹼紝鍥犳涓嶈浣跨敤榪欐牱鐨勫畯鍦–/C++琛ㄨ揪寮忎腑.
銆愪簲銆?鍐呰仈姹囩紪鐨勪紭鍖栭棶棰?br>__asm block鐨勫瓨鍦ㄤ細瀵逛紭鍖栦駭鐢熶竴浜涘獎鍝嶃傞鍏堬紝緙栬瘧鍣ㄤ笉浼氬皾璇曞幓浼樺寲__asm block涓殑鎸囦護銆傜浜岋紝__asm block浼氬瀵勫瓨鍣ㄥ彉閲忕殑瀛樺偍浜?/p>
鐢熷獎鍝嶏紝緙栬瘧鍣ㄤ細閬垮厤鍘葷櫥璁扮┛瓚奯_asm block鐨勯偅浜涘瘎瀛樺櫒浼氳淇敼鐨勫彉閲?
浠婂ぉ鍦ㄧ綉涓婄湅浜嗕竴綃囧叧浜嶤++铏氬嚱鏁拌〃鐨勬枃绔狅紝璁╂垜瀵笴++鍙堟湁浜嗘洿娣變簡鐨勭悊瑙o紝鏂囩珷閾炬帴錛?a >http://www.51cto.com/art/200712/62673_2.htm
鍦ㄨ繖綃囨枃绔犱腑璁插埌浜嗛氳繃铏氬嚱鏁拌〃璁塊棶縐佹湁鐨勮櫄鍑芥暟鐨勯棶棰橈紝闂灝卞嚭鍦–++鍦ㄨ櫄鍑芥暟琛ㄤ腑淇濆瓨浜嗚櫄鍑芥暟鐨勫湴鍧錛岃岃繖涓湴鍧鍙堝緢鏂逛究鏌ユ壘銆?br>鍦ㄦ瘡涓狢++瀵硅薄瀹炰緥鐨勫紑澶村瓨鍌ㄨ繖榪欎釜瀵硅薄鐨勮櫄鍑芥暟琛ㄧ殑鎸囬拡錛岄氳繃榪欎釜鎸囬拡鍙壘鍒拌櫄鍑芥暟琛紝鍦ㄨ櫄鍑芥暟琛ㄤ腑灝卞瓨鐫铏氬嚱鏁版寚閽堬紝榪欐牱鎴戜滑灝卞彲浠ラ獥榪囩紪璇戝櫒璁塊棶縐佹湁鐨勮櫄鍑芥暟浜嗐?br>
class base

{
private:
virtual void f()
{cout<<"base_f()"<<endl;}
};
class child:public base

{
private:
virtual void f()
{cout<<"child_f()"<<endl;};
void g()
{cout<<"base_g()"<<endl;}
};
void main()

{
typedef void(*Fun)(void);
child b;
Fun pFun;
pFun = (Fun)*((int*)*(int*)(&b));
pFun();
}Bill Joy, 鍓嶄換Sun鐨勯甯瀛﹀錛屽綋騫村湪Berkeley鏃朵富鎸佸紑鍙戜簡鏈鏃╃増鏈殑BSD銆備粬榪樻槸vi鍜宑sh鐨勪綔鑰呫傚綋鐒訛紝Csh Programming Considered Harmful 鏄彟涓涓瘽棰樹箰銆傛嵁璇翠粬鎯崇湅鐪嬭嚜宸辮兘涓嶈兘鍐欎釜鎿嶄綔緋葷粺錛屽氨鍦ㄤ笁澶╅噷鍐欎簡涓嚜宸辯殑Unix, 涔熷氨鏄疊SD鐨勫墠韜傚綋鐒舵槸浼犺浜嗭紝浣嗚凍瑙佷粬鐨勫姛鍔涖傚彟涓涓紶璇存槸錛?980騫村垵鐨勬椂鍊欙紝DARPA璁〣BN鍦˙erkley Unix閲屽姞涓夿BN寮鍙戠殑TCP/IP浠g爜銆備絾褰撴椂榪樻槸鐮旂┒鐢熺殑B浼集鎬掍簡錛屾嫆緇濇妸BBNTCP/IP鍔犲叆BSD錛屽洜涓轟粬瑙夊緱BBN鐨凾CP/IP鍐欏緱 涓嶅ソ銆備簬鏄疊浼集鍑烘墜浜嗭紝绔殑鏄竴綆皝鍠夛紝寰堝揩灝卞啓鍑轟簡楂樻ц兘鐨勪集鍏嬪埄鐗圱CP/IP銆傚綋鏃禕BN鍜孌ARPA絳句簡宸ㄩ鍚堝悓寮鍙慣CP/IPStack錛?璋佺煡浠栦滑鐨勪唬鐮佽繕涓嶅涓涓爺絀剁敓鐨勫ソ銆備簬鏄粬浠紑浼氥傚彧瑙佸綋鏃禕浼集絀夸釜T-shirt鍑虹幇鍦ㄤ細璁(褰撴椂絀縏-shirt涓嶈薄鐜板湪錛岃繕鏄浉褰撴暎婕殑 鍝?銆傚彧瑙丅BN闂細浣犳庝箞鍐欏嚭鏉ョ殑錛熻孊浼集絳旓細綆鍗曪紝浣犺鍗忚錛岀劧鍚庣紪紼嬪氨琛屼簡銆傛渶浠ゅ伓鏅曞掔殑鏄紝B浼集紜曞+姣曚笟 鍚庡喅瀹氬埌宸ヤ笟鐣屽彂灞曪紝浜庢槸灝卞埌浜嗗綋鏃跺彧鏈変竴闂村姙鍏鐨凷un, 鐒跺悗浠栧氨鎶奡parc璁捐鍑?鏉ヤ箰銆傘傘傝薄榪欑杞‖閫氬悆鐨勭墰浜猴紝鎯充笉浣╂湇閮戒笉琛岀殑璇淬傛嵁Bill Joy鐨勫悓浜嬭錛屼竴鑸紑浼氱殑鏃跺橞浼集鎬繪槸鎷夸竴鍫嗘潅蹇楁極涓嶇粡蹇冨湴璇匯備絾寰寰鍦ㄥ叧閿箣澶勶紝B浼集鍙戣█錛岀洿鍒囪瀹籌紝鎻愬嚭 婕備寒鐨勬瀯鎯籌紝璁╁悓浜嬩滑褰誨簳宕╂簝銆傚浜嗭紝浠栬繕鏄疛ava Spec鍜孞INI鐨勪富瑕佷綔鑰呬箣涓銆?/p>
John Carmack John Carmack錛宨d Software鐨刦ounder鍜孡ead Programmer銆備笂涓湀鍜屼竴涓悶鍥懼艦鐨勫笀鍏勮亰澶╋紝浠栫珶鐒朵笉鐭ラ亾John Carmack, 涔熻鍋跺ぇ澶у湴鏅曚簡涓鎶娿備笉榪囦篃璁告悶鐮旂┒鐨勫拰鎼炲疄鎴樼殑澶氬皯鏈変簺闅斿惂銆傛兂蹇呭枩嬈㈢涓浜虹О灝勫嚮娓告垙鐨勯兘鐭ラ亾J鍝ュ摜銆?0騫翠唬鍒濆彧瑕佽兘鍦≒C涓婃悶涓皬鍔ㄧ敾閮借兘璁╀漢 鎯婂徆涓鐣殑鏃跺欙紝J鍝ュ摜灝辨帹鍑轟簡鐭崇牬澶╂儕鐨凜astle Wolfstein, 鐒跺悗鍐嶆帴鍐嶅姳錛宒oom, doomII, Quake...姣忔閮芥妸3-D鎶鏈帹鍒版瀬鑷淬侸鍝ュ摜鐨勭畝鍘嗕笂璇磋嚜宸辯殑涓撻暱鏄?Exhaust 3-D technology"錛岀湡鏄墰浜轟箣璦涓嶆垜嬈虹殑璇淬傚仛J鍝ュ摜榪欐牱鐨勪漢鏄緢騫哥鐨勶紝鍥犱負鍚勫ぇ鍥懼艦鍗″巶瀹朵竴鏈変簡鏂頒駭鍝佸氨瑕佸悜浠?#8220;榪涜礎” 錛屼笉鐒跺鏋滀粬鐨勬父鎴忎笉鏀寔鍝鍗★紝鍝鍗″熀鏈氨浼氬き鎶樹箰銆傚綋鍒滿S鐨凞irect3D涔熷緱鍚彇 浠栫殑鎰忚錛屼慨鏀逛簡涓嶅皯API銆傚綋鐒訛紝J鍝ュ摜鍦ㄧ粨濠氬墠鍗佹暟騫村涓鏃ュ湴姣忓ぉ緙栫▼14灝忔椂浠ヤ笂錛?涔熸槸鍋朵滑鍑′漢鏈涘皹鑾強鐨勩傚浜嗭紝J鍝ュ摜楂樹腑鑲嗕笟(錛?錛屽彲浠ヨ鏄嚜瀛︽垚鎵嶃備笉榪囧憿錛岃皝瑕佺敤榪欎釜渚嬪瓙鏉ヤ負鑷繁瀛︿範涓嶅ソ杈╂姢錛屽氨澶ч敊鐗歸敊浜嗐傞偅 Leonardo Da Vinci榪樻槸鑷鎴愭墠鍛?浜烘槸縐佺敓瀛愶紝涓嶈兘涓婂)銆傛櫘閫氫漢鍜屽ぉ鎵嶈繕鏄湁鍖哄埆鐨勩傚浜嗭紝鍏跺疄鍋朵滑鍙?#8220;杈懼垎濂?#8221;鏄浉褰撲笉瀵圭殑錛屽洜涓篤inci鏄湴鍚嶏紝鑰孌a Vinci灝辨槸浠嶸inci鏉ョ殑浜虹殑鎰忔濄傛崲鍙ヨ瘽璇達紝Leonardo Da Vinci灝辨槸“浠嶸inci鏉ョ殑Leonardo”鐨勬剰鎬濄傚彨鍒漢“Da Vinci”灝變笉鐭ユ墍璋撲箰銆傚棷錛屾壇榪滀簡錛屾墦浣忋?/p>
David Cutler David Cutler錛孷MS鍜學indows NT鐨勯甯璁″笀錛屽幓寰蔣鍓嶅彿縐扮璋鋒渶鐗涚殑kernel寮鍙戝憳銆傚綋鍒濅粬鍜屼粬鐨勬墜涓嬪湪寰蔣涓鍛ㄥ唴鎶婁竴涓叿澶囧熀鏈姛鑳界殑bootable kernel鍐欏嚭鏉ワ紝鐒跺悗璇達細“who can't write an OS in a week?"錛屼篃鏄墰姘斿啿澶╃殑璇淬傞『渚胯涓鍙ワ紝D鐖風埛鍒癗T3.5鏃訛紝綆$悊1500鍚嶅紑鍙戝憳錛岃嚜宸辮繕鍏煎仛璁捐鍜岀紪紼嬶紝涓嶆敼coder鏈壊鍟娿侱鐖風埛澶╃敓鑴?姘旂伀鐖嗭紝鍜屼漢浜夎鏃跺枩嬈㈠弻鎵嬬寷鍑繪瀛愪互澹0鍔褲?-) 鏃ュ父浜よ皥F-word涓嶇鍙c備粬闈㈣瘯縐樹功鏃跺繀闂細"what do you think of the word '****'?" 錛岃鏃犳暟緹庡コ鍒圭窘鑰屽綊銆傜粓浜庢湁涓澶╋紝涓涓悓鏍風伀鐖嗙殑濂抽潰瀵硅繖涓棶棰樿劚鍙h屽嚭錛?That's my favorite word"銆備簬鏄ス琚綍鍙栦箰錛屼負D鐖風埛宸ヤ綔鍒癗T3.5鍙戝竷銆?/p>
Donald E. Knuth Don Knuth銆傞珮鐖風埛鍏跺疄鐢ㄤ笉鐫鍋跺璇淬傚緙栫▼鐨勪笉鐭ラ亾浠栧氨濂藉儚瀛︾墿鐞嗙殑涓嶇煡閬撶墰欏匡紝瀛︽暟瀛︾殑涓嶇煡閬撴鎷夛紝瀛﹂煶涔愮殑涓嶇煡閬撹帿鎵庣壒錛屽Delphi鐨勪笉鐭ュ埌 Anders Hejlsberg錛屾垨鑰呭Linux涓嶇煡閬揕inus Torvalds涓鏍鳳紝涓嶅彲鍘熻皡鍟娿?-)涓轟簡璁╂枃绔犲畬鏁達紝灝卞啀緗楀攩鍑犲彞鍚с傞珮鐖風埛鏈鏃跺氨寮濮嬬粰琛岃鑹茶壊鐨勫叕鍙稿啓鍚勭紼濂囧彜鎬殑緙栬瘧鍣ㄦ專澶栧揩浜嗐備粬鍗栫粰 鍒漢鏃舵敹涓涓ゅ崈緹庡厓錛岄偅浜涘叕鍙告嬁浜哻ode錛屽姞宸ヤ竴涓嬪崠鍑哄幓灝辨槸涓婁竾涓婂崄涓囥備笉榪囦篃娌¤楂樼埛鐖蜂笉鐖借繃錛屽鑰呮湰鑹茬殑璇淬傛兂鎯抽偅鍙槸60騫翠唬鍒濆晩錛?楂樼埛鐖峰啓緙栬瘧鍣ㄥ啓澶氫簡錛岄『甯﹀氨鎼炲嚭浜嗕釜Attribute Grammar鍜孡R(k)錛屽ぇ澶у湴閫犵鍚庝漢鍟娿傝嚦浜庨珮鐖風埛鍦–alTech鐨勭紪紼嬫瘮璧?鏈堿lan Kay寰椾紬澶氶珮楂樻墜鍙傚姞)鎬繪槸絎竴錛屽啓鐨凾ex鍒?6騫村氨code freeze錛岃繕闄勫甫2^n緹庡垎濂栧姳絳夌瓑閮芥槸鑰崇啛鑳借錛屽伓灝變笉楗惰垖涔愩傞『渚胯涓涓嬶紝楂樿佸ぇ鐖鋒槸鏃犲彲浜夎鐨勫啓浣滈珮鎵嬨備粬緇機oncrete Mathematics 鍐欑殑鍓嶈█鍙皳瀛楀瓧閾塊數錛屽牚涓哄墠璦鐨勫吀鑼冦備粬鐨勬妧鏈枃绔犱篃鏄竴緇濓紝鏂囬緇嗚嚧錛岃В閲婄簿褰擄紝鑰屼笖娌℃湁瀛︾┒姘旓紝涓嶅け杞誨揩璺寵劚銆傝寰楀嚑騫村墠璇籆oncrete Mathematics錛屾椂涓嶆椂寮鎬澶х瑧錛岃鑰佸鏋佸叾閮侀椃錛岃寰楁垜nerdy鍒板錛屼笉鍙晳鑽傚叾瀹炲憿錛屽瓙闈為奔錛屽畨鐭ラ奔涔嬩箰錛屾洿涓嶇煡閭e畬鍏ㄦ槸楂樼埛鐖風殑鍔熷姵銆?璇村埌鍐欎綔楂樻墜錛屼笉鑳戒笉鎻怱tephen A. Cook銆備粬鐨勬枃绔犲綋騫村氨琚垜浠殑鍐欎綔鑰佸笀鏋佸姏鎺ㄨ崘錛屽彿縐板吀闆呮枃椋庣殑鏍鋒湰銆傚簱鐖風埛涓澶撮摱鍙戯紝韜潗棰闀匡紝鎬繪槸闈㈠甫璋﹀拰鐨勫井絎戯紝棰囨湁浠欓閬撻錛屾濂藉拰浠栫殑浠欐枃 鐩擱厤鐨勮銆傞珮鐖風埛鍏跺疄榪樻槸寮婧愯繍鍔ㄧ殑鍏堥┍銆傝櫧鐒朵粬娌℃湁璞ichard Stallman閭f牱鍏柟濂旇蛋錛屼絾浠栨崘鐚簡濂藉浣滃搧錛岄兘鍙互鍦ㄧ綉涓婄湅鍒幫紝姣斿钁楀悕鐨凪athematical Writing錛孧MIXWare錛孴he Tex Book絳夛紝鏇翠笉鐢ㄨ瓚充互璁╀粬嫻佽姵鐧句笘鐨凾ex涔愩?/p>
Ken Thompson Ken Thompson錛孋璇█鍓嶈韓B璇█鐨勪綔鑰咃紝Unix鐨勫彂鏄庝漢涔嬩竴(鍙︿竴涓槸Dennis M. Riche鑰佸ぇ錛岃灝婁負DMR)錛孊elle(涓涓帀瀹崇殑鍥介檯璞℃紼嬪簭)鐨勪綔鑰呬箣涓, 鎿嶄綔緋葷粺Plan 9鐨勪富瑕佷綔鑰?鍙︿竴涓槸澶х墰浜篟ob Pike, 鍓嶄笉涔呰google鎸栬蛋浜?銆侹en鐖風埛涔熺畻鏄綆楁満鍘嗗彶涓婂紑澶╄緹鍦扮殑浜虹墿浜嗐?969騫磋繕鏄綆楁満鍙插墠鏃朵唬錛屾櫘閫氫漢閮借涓哄彧鏈夊ぇ鍨嬫満鎵嶈兘榪愯閫氱敤鐨勬搷 浣滅郴緇燂紝灝忓瀷鏈哄彧鏈夐珮灞變話姝㈢殑浠藉効銆傝嚦浜庣敤楂樼駭璇█鏉ュ啓鎿嶄綔緋葷粺錛屾洿鏄瑧璋堛侹en鐖風埛鑷劧涓嶆槸姹犱腑鐗?錛屼簬鏄粬鍜孌MR鎬掍簡錛屽湪1969騫村埌1970闂寸敤姹囩紪鍦≒DP-7涓婂啓鍑轟簡UNIX鐨勭涓涓増鏈備粬浠茍涓嶇煡閬擄紝涓鍦鴻槳杞扮儓鐑堢殑UNIX浼犲鐢辨鎷夊紑浜?搴忓箷銆侹en鐖風埛鍦?971騫村張鎶奤nix鐢–閲嶅啓錛屼簬鏄疌鍦ㄩ殢鍚?0騫存垚灝變簡涓嶇煡澶氬皯璞澃鐨勬ⅵ鎯沖拰鍏夎崳銆侹en鐖風埛榪樻湁孌典匠璇濓細 瑁呬簡UNIX鐨凱DP-11鏈鏃╄瀹夎鍦˙ell Lab閲屼緵澶у鏃ュ父浣跨敤銆傚緢蹇ぇ瀹跺氨鍙戠幇Ken鐖風埛鎬昏兘榪涘叆浠栦滑鐨勫笎鎴鳳紝鑾峰緱鏈楂樻潈闄愩侭ell Lab閲岀殑縐戝瀹墮兘蹇冩瘮澶╅珮錛屽綋鐒惰鎼炲緱閮侀椃鏃犳瘮銆備簬鏄湁楂樻墜鎬掍簡錛岃煩鍑烘潵鍒嗘瀽浜哢NIX浠g爜錛屾壘鍒板悗闂紝淇敼浠g爜錛岀劧鍚庨噸鏂扮紪璇戜簡鏁翠釜UNIX銆傚氨鍦ㄥぇ 瀹墮兘浠ヤ負“榪欎釜涓栫晫娓呭噣浜?#8221;鐨勬椂鍊欙紝浠栦滑鍙戠幇Ken鐖風埛榪樻槸杞昏屾槗涓懼湴鎷垮埌浠栦滑鐨勫笎鎴鋒潈闄愶紝鐧炬濅笉瑙e悗 錛屽彧濂界戶緇儊闂楓傝皝鐭ラ亾榪欎竴閮侀椃錛屽氨閮侀椃浜?4騫達紝鐩村埌Ken鐖風埛閬撳嚭涓腑緙樼敱銆傚師鏉ワ紝浠g爜閲岀殑紜湁鍚庨棬錛屼絾鍚庨棬涓嶅湪Unix浠g爜閲岋紝鑰屽湪緙栬瘧Unix浠?鐮佺殑C緙栬瘧鍣ㄩ噷銆傛瘡嬈緙栬瘧鍣ㄧ紪璇慤NIX鐨勪唬鐮侊紝灝辮嚜鍔ㄧ敓鎴愬悗闂ㄤ唬鐮併傝屾暣涓狟ell Lab鐨勪漢錛岄兘鏄敤Ken鐖風埛鐨凜緙栬瘧鍣ㄣ?/p>
Rob Pike Rob Pike, AT&T Bell Lab鍓峂ember of Technical Staff 錛岀幇鍦╣oogle鐮旂┒鎿嶄綔緋葷粺銆傜綏浼集鏄疷nix鐨勫厛椹憋紝鏄礉灝斿疄楠屽鏈鏃╁拰Ken Thompson浠ュ強Dennis M. Ritche寮鍙慤nix鐨勭寷浜猴紝UTF-8鐨勮璁′漢銆備粬榪樺湪緹庡浗鍚嶅槾David Letterman鐨勬櫄闂磋妭鐩笂闇蹭簡涓灝忚劯錛屼竴鑴告啫鍘氬湴甯竴鑳栧瓙鍚圭墰鎼炴傝鍋朵僵鏈嶄笉宸茬殑鏄紝緗椾集浼繕鏄?980騫村ゥ榪愪細灝勭鐨勯摱鐗屽緱涓匯備粬涔熸槸涓涓哄帀 瀹崇殑涓氫綑澶╂枃瀛﹀錛岃璁$殑鐝堢帥灝勭嚎鏈涜繙闀滃樊鐐硅NASA鐢ㄥ湪鑸ぉ椋炴満涓娿備粬榪樻槸涓ゆ湰緇忓吀錛孴he Unix Programming Environment 鍜?The Practice of Programming 鐨勪綔鑰呬箣涓銆傚鏋滃垵瀛﹁呮兂鍦ㄧ紪紼嬫柟闈㈢簿鐩婃眰綺撅紝瀹炲湪璇ュソ濂借璇昏繖涓ゆ湰涔︺傚畠浠兘鏈変腑鏂囩増鐨勮銆傜綏浼集榪樺啓鍑轟簡Unix涓嬬涓涓熀浜庝綅鍥劇殑紿楀彛緋葷粺錛屽茍涓旀槸 钁楀悕鐨刡lit 緇堢鐨勪綔鑰呫傚綋鐒朵簡錛岀綏浼集榪樻槸鍙風О閿愭剰闈╂柊鐨勬搷浣滅郴緇燂紝Plan9錛岀殑涓昏浣滆呫傚彲鎯滅殑鏄紝Plan9騫舵病鏈夊紩璧峰灝戜漢鐨勬敞鎰忋傜綏浼集涓鎬掍箣涓嬶紝鍐欏嚭浜?鎸亱鍙戣仼鐨勯泟鏂?Systems Software Research is Irrelevant錛岀棝鏂ュ綋涓嬬郴緇熷紑鍙戜笉鎬濊繘鍙栵紝鍥烘鑷皝鐨勫紛鐥呫傝櫧鐒惰繖綃囨枃绔犳槸緗椾集浼惈蹇垮嚭鎵嬶紝棰囨湁鍋忔縺涔嬭瘝錛屼絾紜疄閬撳嚭浜嗙郴緇熷紑鍙戠殑鏃犲錛氬紑鍙戝懆鏈?瓚婃潵瓚婇暱錛屼唬浠瘋秺鏉ヨ秺澶э紝鐢ㄦ埛琚粺涓鍒板皯鏁板嚑涓郴緇熶笂錛岀粨鏋滆秺鏉ヨ秺澶氱殑媧誨姩鏄祴閲忓拰淇ˉ錛岃岀湡姝g殑闈╂柊 瓚婃潵瓚婂皯銆傚氨鍦ㄧ綏浼集閮侀椃涔嬫瀬鐨勬椂鍊欙紝google鐧婚棬姹傝搐鏉ヤ箰銆傚鏋滆鐜板湪榪樻湁涓瀹跺ぇ浼楀叕鍙稿湪涓嶉仐浣欏姏鍦版妸緋葷粺寮鍙戞帹鍚戞瀬鑷寸殑璇濓紝涔熷氨鏄痝oogle 涔愩傞殢渚跨湅鐪媑oogle鐨勬垚鏋滃氨鐭ラ亾浜嗐傚叿鏈夎秴寮哄閿欏拰璐熻澆騫寵 鑳藉姏鐨勫垎甯冨紡鏂囦歡緋葷粺GFS (鐜板湪鑳藉鐢?00,000鍙板粔浠稰C鎼搗涓涓法鍨嬪垎甯冪郴緇燂紝騫朵笖楂樻晥渚垮疁鍦拌繘琛岀鐞嗙殑緋葷粺涔熶笉澶氬搱)錛屽ぇ瑙勬ā鏈哄櫒瀛︿範緋葷粺(鎷煎啓媯鏌ワ紝騫垮憡鍖歸厤錛屾嫾闊蟲悳 瀵匯傘傘傚摢涓兘寰堢墰鐨勮)錛屾洿涓嶇敤璇村鐞嗘搗閲忓茍琛岃綆楃殑鍚勫紡google鏈嶅姟浜嗐俁ob鍦⊿ystem Software Research is Irrelevant閲岃惂鐟熷湴璇寸幇鍦ㄦ病鏈変漢鍐嶅叧蹇冪郴緇熺爺絀剁殑鍓嶆部鎴愭灉浜嗐傛兂涓嶅埌浠栭敊浜嗭紝鍥犱負google鍏沖績銆俫oogle緗戠粶浜嗗ぇ鎵瑰姛鎴愬悕灝辯殑鐗涗漢錛岃繕 鏈夊ぇ閲忓垵鐢熺墰鐘婅埇鍗氬+鍋氬紑鍙戯紝鏄劇劧涓嶆槸娌′簨鑰嶉叿錛岃屾槸鍥犱負瀹冧滑鐨勫紑鍙戞繪槸璇曞浘鍚稿彇緋葷粺鐮旂┒鐨勬渶鏂版垚鏋溿?鎯沖繀Rob Pike鍦╣oogle寰堝垢紱忋傛効浠栧仛鍑烘洿媯掔殑緋葷粺銆?/p>
Dennis M. Ritchie 鏃㈢劧Ken Thompson鏄垜鐨勫伓鍍忥紝鏂伴椈緇勪笂浜虹ОDMR鐨凞ennis M. Ritchie鑷劧涔熸槸錛屾瘯绔熶袱浜哄叡鍚岀紨閫犱簡UNIX錛岃孌ennis鍑犱箮鐙姏鎶奀鎼炲ぇ(褰撶劧錛孋鐨勫墠韜槸B錛岃孊鏄疜en Thompson涓鎵嬪仛鍑烘潵鐨?銆侸 涓や漢1983騫村垎浜浘鐏靛錛屾槸鏈夊彶浠ユ潵灝戞暟鍑犱釜鍥犲伐紼嬮」鐩緱濂栫殑宸ョ▼甯?鏈潵鏄敮涓鐨勪竴瀵瑰効錛屼絾Alan Kay鎵嶅洜涓篠mallTalk寰楀錛屾墍浠ュ氨鎴愪簡鍞簩鐨勪箰) 銆備竴涓漢涓鐢熻兘鍋氬嚭涓涓崜瓚婄殑緋葷粺宸茬粡涓嶆槗錛孌MR鐨凜鍜孶NIX闀跨洓涓嶈“榪?0騫達紝鑷充粖鐢熸満鍕冨媰錛孌MR姝ょ敓鍙互鏃犳喚鐨勮銆侱鐖風埛涔熺畻鏈夊瀛︽笂婧愶細浠栬?鐖稿湪AT&T璐濆皵瀹為獙瀹ゅ伐浣滀簡涓杈堝瓙錛屽茍鍦ㄧ數璺璁℃柟闈㈠崜鏈夋垚灝憋紝榪樺嚭浜嗘湰棰囨湁褰卞搷鐨勪功The Design of Switching Circuits錛屾嵁璇村湪浜ゆ崲鐞嗚鍜岄昏緫璁捐鏂歸潰鏈夌嫭鍒扮殑璁鴻堪銆傚綋鐒訛紝D鐖風埛鍜屼粬鑰佺埜鏄笉鍚屾椂浠g殑浜猴細浠栬佺埜鐨勭爺絀舵垚褰簬鏅朵綋綆″彂鏄庝箣鍓嶏紝鑰孌鐖風埛鐨勫伐浣?紱諱簡鏅朵綋綆″氨鐜╁効涓嶈漿涔愩?-D涓嶈鐪婦鐖風埛鎼炲嚭浜咰錛屽叾瀹炰粬鏈鐖辯殑緙栫▼璇█鏄疉lef錛屽湪Plan9涓婅繍琛岋紝鏀寔騫惰緙栫▼銆侫lef鐨勮娉曞拰C鐩鎬技錛屼絾 鏁版嵁綾誨瀷鍜屾墽琛屾柟寮忛兘鍜孋澶уぇ涓嶅悓銆傝鍒拌璦錛孌鐖風埛瀵瑰悗鏉ヤ漢鏈夐潪甯鎬腑鑲殑寤鴻錛氭姳鐫瀛︿範鐨勭洰鐨勬潵寮鍙戜綘鑷繁鐨勮璦錛屼笉瑕佸唨鏈涗簬瀹冭 浼椾漢鎺ュ彈銆傝繖涓緩璁笉鍏夊璇█寮鍙戞湁鐢紝涔熼傜敤浜庡叾瀹冨ぇ鍨嬬郴緇熺殑寮鍙戙傚埆鐨勪笉璇達紝DMR鍚庢潵棰嗗鑷繁鐨勫洟闃熷湪1995騫村拰1996鍒嗗埆鎺ㄥ嚭浜哖lan9鍜?Inferno鎿嶄綔緋葷粺錛屽張鐢ㄥ灝戜漢鐭ラ亾鍛紵鍏跺疄錛孌鐖風埛褰撳垵涔熸病鎯寵繃C浼氶琛屼笘鐣屻備粬寮鍙慍鐨勫垵琛峰拰 Eric S. Raymond鍦–athedral and Bazaar閲岄槓榪扮殑涓鏍鳳紝灝辨槸瑕佹秷闄よ嚜宸卞鐜版湁宸ュ叿鐨勪笉鐖戒箣澶勩傝皝鐭鐖風埛鏃犲績鎻掓煶錛孋绔熺劧鍙楀埌浼楀紼嬪簭鍛樼殑鐙傜儹鎷ユ埓錛岃繛D鐖風埛鑷繁閮藉ぇ鎯戜笉瑙c傚湪涓嬈?閲囪涓璂鐖風埛璇村ぇ姒傞偅鏄洜涓篊鐨勬娊璞$▼搴︾宸ф棦婊¤凍浜嗙▼搴忓憳鐨勮姹? 鍙堝鏄撳疄鐜般傚綋鐒禖涓搴︽槸Unix涓婄殑閫氱敤璇█涔熸槸鍘熷洜銆備絾涓嶇鎬庝箞璇達紝D鐖風埛瀵圭紪紼嬭璦鍑鴻壊鐨勫緹庢剰璇嗗瀹氫簡C騫夸負嫻佷紶鐨勫熀紜銆傛渶鍚庡叓鍗︿竴涓嬨侱鐖風埛鐨?涓氫綑鐖卞ソ鍜孨BA澶х墰Karl Malone涓鏍鳳細寮鍗¤濺銆備笉榪嘍鐖風埛鏇村枩嬈㈠紑NASCAR錛岃孠M鐙埍宸ㄦ棤闇搞侸 D鐖風埛鑷О蹇冧腑涓嶄緵鍋跺儚錛屽鏋滀竴瀹氳璇翠竴涓紝閭e氨鏄疜en Thompson浜嗐傜幇鍦↘en鐖風埛閫浼戝綋椋炴満鏁欑粌鍘諱簡錛岃孌鐖風埛褰撲簡璐濆皵瀹為獙瀹ょ郴緇熷紑鍙戦儴鐨勫ご錛屾暣鏃ュ繖浜庡紑鏀エ銆備粬淇╁悎浣?0騫達紝灞″薄鍒涢犲巻鍙層傝繖孌典護 浜虹寰鐨勪匠璇濓紝涔熷氨闀跨暀浣犳垜蹇冧腑涔愩侾.S., 寰堝浜洪兘浠ヤ負Brian W. Kernighan鏄疌鐨勪綔鑰呫傚叾瀹濨WK鍙槸鍐欎簡閭f湰緇忓吀K&R C銆傛嵁D鐖風埛璇達紝浠栵紝Ken, 鍜孠ernighan涓変漢涓紝Kernighan鏈鑳藉啓鏂囩珷錛屼粬嬈′箣錛岃孠en鍐欏緱鏈灝戯紱浣嗚鍒扮紪紼嬶紝Ken鐖風埛鎵嶆槸褰撲箣鏃犳劎鐨勮佸ぇ銆?/p>
Edsger Wybe Dijkstra 瀵癸紝灝辨槸E.W. Dijkstra. 涓鎻愬埌EWD錛屽緢澶氫漢灝變細鎯寵搗鎵炬渶鐭礬寰勭殑Dijkstra Algorithm錛屽氨濂藉儚涓鎻愬埌Sir. Tony Hoare錛屽氨鎯寵搗Quick Sort涓鏍楓傚叾瀹炶繖浜涗釜綆楁硶涓嶈繃鏄袱涓墰浜哄湪浠栦滑鑱屼笟鐢熸動涓渶鐞愮鐨勮礎鐚傛瘮濡侱ijkstra綆楁硶錛屾棤闈炴槸鎴寸埛鐖峰湪1956騫翠負浜嗗睍紺烘柊璁$畻鏈?ARMAC鐨勮綆楄兘鍔涳紝鍒濊瘯韜墜鐨勬垚鏋滐紝灞炰簬浠栫殑綆楁硶澶勫コ浣溿傛嵁鎴寸埛鐖瘋嚜榪幫紝浠栨悶鍑烘渶鐭礬寰勭畻娉曠殑鏃跺欒繛綰哥瑪 閮芥病鐢ㄣ傚綋鏃朵粬鍜屼粬鑰佸﹩鍦ㄩ樋濮嗘柉鐗逛腹涓瀹跺挅鍟″巺鐨勯槼鍙頒笂鏅掑お闃沖枬鍜栧暋錛岀獊鐒跺氨鎶婅繖涓畻娉曟兂鍑烘潵涔愩傝屼笖褰撴椂鐨勭畻娉曠爺絀惰繕姣旇緝鍘熷錛岀墰浜轟滑蹇欑潃鐢ㄨ綆楁満鎼炴暟 鍊艱綆楋紝瀵圭鏁g畻娉曚笉灞戜竴欏俱傞偅鏃惰繛涓涓薄鏍風殑涓撴敞浜庣鏁g畻娉曠殑涓撲笟鏈熷垔閮芥病鏈夈傛埓鐖風埛浜庢槸鎺ㄨ繜鍙戣〃榪?涓畻娉曘傜洿鍒?959騫達紝浠栨墠鎶婅繖涓畻娉曞彂琛ㄥ湪Numerische Mathematik鐨勫垱鍒婂彿涓婏紝鏉冧負鎹у満銆?-) EWD鍦ㄥ涓鍩熺墰姘斿啿澶╋紝绔殑鏄悊璁哄拰緙栫▼涓ゆ墜紜殑楂樻墜銆傚彧涓嶈繃浠栫殑寰堝宸ヤ綔姣旇緝娣卞埢錛屽鏍$殑鑰佸厛鐢熶滑瑙夊緱鏈鐢熸帴鍙椾笉浜嗭紝涓嶇粰鏈鐢熻鑰屽凡銆傛埓鐖風埛澶?姒傚洜涓烘渶鐭礬寰勭畻娉曚竴鎴樻垚鍚嶏紝浜庢槸鏈変漢璇蜂粬鍙傚姞鍙︿竴鍙拌綆楁満X1鐨勮璁″伐浣滐紝騫朵笖鎶婅璁″疄鏃朵腑鏂郴緇熺殑 浠誨姟媧劇粰浜嗕粬銆傜幇鍦ㄧ湅鏉ュ疄鏃朵腑鏂篃璁鎬笉綆椾粈涔堬紝浣嗚鐭ュ埌錛孹1鍓嶆牴鏈氨娌℃湁瀹炴椂涓柇鐨勬蹇點傚疄鐜板畠綆鐩村氨鏄竴鍦鴻豹璧屻傛埓鐖風埛璧峰垵榪樹笉鎯呮効錛屼絾緇忎笉浣忛」鐩礋 璐d漢Bram鍜孋arel鐨勮疆鐣?#8220;鍚規崸”錛氭垜浠煡閬撳疄鏃朵腑鏂鎮ㄥ伐浣滃彉寰楅潪甯稿洶闅撅紝浣嗚薄鎮ㄨ繖鏍風殑鐗涗漢鑲?瀹氳兘鍋氬嚭鏉ョ殑璇淬傜粨鏋滄埓鐖風埛琚硸琛g偖寮瑰交搴曞嚮絀匡紝鎺ヤ笅浜嗚繖涓儷鎵嬪北鑺嬨備袱涓夊勾鍚庯紝浠栦笉浠呮悶鍑轟簡瀹炴椂涓柇錛岃繕鍥寸粫榪欎釜鍐欏嚭浜嗚嚜宸辯殑鍗氬+璁烘枃錛岄『鍒╂埓涓婂崥澹?甯姐傝鎴寸埛鐖風湡姝f垚鍚嶇珛涓囩殑榪樻槸鍦╔1涓婂紑鍙戠殑Algo60錛屾渶鏃╃殑楂樼駭璇█涔嬩竴銆傛埓鐖風埛娌℃棩娌″鍦板伐浣?浜?涓湀錛屽氨鎼炲嚭浜咥lgo60錛屼篃鍥犳鑾峰緱浜?972騫寸殑鍥劇伒濂栥傚洜涓篈lgo60錛屾埓鐖風埛鍙戣〃浜嗕竴綃囩煶鐮村ぉ鎯婄殑鏂囩珷錛歊ecursive Programming錛屼簬鏄漢浠墠鐭ラ亾錛屽師鏉ラ珮綰ц璦涔熷彲浠ラ珮鏁堝湴瀹炵幇閫掑綊錛屽師鏉ヤ粠姝や互鍚庯紝鎵鏈夌▼搴忓憳閮戒笉鍙伩鍏嶅湴鍜屾埓鐖風埛鍙戞槑鐨勪竴涓瘝(搴旇璇存槸姒?蹇?鎵撲氦閬擄細鍫嗘爤銆傝屼笖Algo60榪樿鎴寸埛鐖鋒繁鍏ュ湴鎬濊冨閬撶▼搴忚璁$殑闂錛屾渶緇堝彂鏄庝簡姣忎釜緋葷粺紼嬪簭鍛?閮界粫涓嶅紑鐨勬蹇碉細semaphore銆傚綋鐒訛紝鎴寸埛鐖鋒繪槸鎶婁粬鍙戞槑鐨勬蹇典弗鏍煎艦寮忓寲錛屾瀬鍏風瀛﹀鏈壊鐨勮銆傚拰榪欎簺鎴愬氨鎯蟲瘮錛屼粬鎻愬嚭鐨勫悆楗殑鍝插瀹墮棶棰橈紝涔熷氨 娌′粈涔堝ソ璇寸殑浜嗐傝鏉ュソ絎戯紝褰撴椂鐨勫ぇ瀛?蹇樹簡鍝墍浜?榪樻槸瑙夊緱鎴寸埛鐖鋒病鏈夊彈榪囨緇熺殑鏁板璁粌錛屼篃涓嶆槸涓?闂ㄦ悶鏁板煎垎鏋愮殑錛屾墍浠ユ渶鍚庝笉澶儏鎰垮湴緇欎簡浠栦竴涓暀鑱屻傝繖縐嶅皬鎸姌騫朵笉鑳藉Θ紕嶈薄鎴寸埛鐖瘋繖鏍風殑鐗涗漢鍒涢犲巻鍙層備粬涓杈規暀鏁板煎垎鏋?:-D) 錛屼竴杈瑰紑濮嬪紑鍙戜竴涓柊鐨勬搷浣滅郴緇燂紝騫跺煿鍏昏綆楁満縐戝瀹躲傚嚑騫村悗錛孴HE Multiprogramming System妯┖鍑轟笘銆俆HE鏄涓涓敮鎸佹澗鏁h﹀悎錛屾樉寮忓悓姝ョ殑榪涚▼騫剁敱姝や嬌寰椾弗鏍艱瘉鏄庣郴緇熸病鏈夋閿佸彉寰楀鏄撶殑鎿嶄綔緋葷粺銆傚彲鎯滄埓鐖風埛浠昏亴鐨勭郴涓嶈瘑璐э紝榪樺己 琛岃В鏁d簡浠栫殑鐮旂┒灝忕粍(1972騫存埓鐖風埛緇欎粬鐨勭郴涓諱換璇翠粬寰椾簡鍥劇伒濂栵紝緋諱富浠葷殑絎竴鍙嶅簲鏄綘浠悶璁$畻鏈?灝卞枩嬈貢鍙戝)銆傝繖璁╂埓鐖風埛鐩稿綋閮侀椃錛屽緱浜嗘姂閮佺棁銆傚湪鏋佸害閮侀椃涔嬩腑錛屾埓鐖風埛鍐沖畾鐢ㄥ啓浣滄潵娌葷枟鑷繁鐨勬姂閮佺棁銆備簬鏄粡鍏稿氨璇炵敓涔愶細Notes on Structured Programming銆傛埓鐖風埛浠庢琚皧涓虹粨鏋勫寲緙栫▼鐨勫鍩轟漢錛岃屼笖浠栫殑鎶戦儊鐥囦篃琚不濂戒箰銆侲WD澶墰錛岀粨鏋滀粬鐨勬晠浜嬩篃澶銆傚厛鍒拌繖閲屽惂銆?973璧鳳紝浠?鐨勬晠浜嬪氨鍦ㄧ編鍥藉彂鐢熶簡銆?/p>
Anders Hejlsberg錛屽井杞?NET鐨勯甯灦鏋勫笀錛岀紪紼嬭璦璁捐鍜屽疄鐜扮殑欏跺皷楂樻墜銆備粬涓鎵嬪仛鍑轟簡Turbo Pascal, 涔熸槸Delphi,J++(灝ゅ叾鏄疻FC)錛孋#,鍜?NET鐨勪富瑕佷綔鑰呫傝繖浜涗綔鍝佺殑鍚嶅瓧瓚充互涓轟粬绔嬩紶銆備綔涓轟竴涓▼搴忓憳錛屾垜鍦ㄨ繖鏍風殑澶у笀闈㈠墠瀹炲湪鏃犺銆傜敓 瀛愬綋濡侫nders鐨勮銆傛潕緇寸殑<<Borland浼犲>>閲屽凡璇︾粏璁茶堪浜咥nders鐨勪紶濂囨晠浜嬶紝鎴戝氨涓嶇敤璐硅垖浜嗭細