|
请问有谁能帮忙把这段C语言程序转换成AutoIT
// ReadBIOS.cpp : 定义应用程序的入口点。
//
#include "stdafx.h"
#include "ReadBIOS.h"
#define MAX_LOADSTRING 100
typedef struct _UNICODE_STRING {
USHORT Length;//长度
USHORT MaximumLength;//最大长度
PWSTR Buffer;//缓存指针,访问物理内存时,此处指向UNICODE字符串"\device\physicalmemory"
} UNICODE_STRING,*PUNICODE_STRING;
typedef struct _OBJECT_ATTRIBUTES {
ULONG Length;//长度 18h
HANDLE RootDirectory;// 00000000
PUNICODE_STRING ObjectName;//指向对象名的指针
ULONG Attributes;//对象属性00000040h
PVOID SecurityDescriptor; // Points to type SECURITY_DESCRIPTOR,0
PVOID SecurityQualityOfService; // Points to type SECURITY_QUALITY_OF_SERVICE,0
} OBJECT_ATTRIBUTES;
typedef OBJECT_ATTRIBUTES *POBJECT_ATTRIBUTES;
typedef DWORD (__stdcall *ZWOS)(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES);
typedef DWORD (__stdcall *ZWMV)(HANDLE,HANDLE,PVOID,ULONG,ULONG,PLARGE_INTEGER,PSIZE_T,DWORD,ULONG,ULONG);
typedef DWORD (__stdcall *ZWUMV)(HANDLE,PVOID);
// 此代码模块中包含的函数的前向声明:
int main()
{
HACCEL hAccelTable;
UNICODE_STRING struniph;
OBJECT_ATTRIBUTES obj_ar;
ZWOS ZWopenS;
ZWMV ZWmapV;
ZWUMV ZWunmapV;
HANDLE hSection;
HMODULE hinstLib;
DWORD ba;
LARGE_INTEGER so;
so.LowPart=0x000F0000;//物理内存的基址,就是f000:0000
so.HighPart=0x00000000;
SIZE_T ssize;
ssize=0xffff;
wchar_t strPH[30]=L"\\device\\physicalmemory";
FILE *f1;
// 初始化全局字符串
//变量初始化
ba=0;//联系后的基址将在这里返回
struniph.Buffer=strPH;
struniph.Length=0x2c;//注意大小是按字节算
struniph.MaximumLength =0x2e;//也是字节
obj_ar.Attributes =64;//属性
obj_ar.Length =24;//OBJECT_ATTRIBUTES类型的长度
obj_ar.ObjectName=&struniph;//指向对象的指针
obj_ar.RootDirectory=0;
obj_ar.SecurityDescriptor=0;
obj_ar.SecurityQualityOfService =0;
//读入ntdll.dll,得到函数地址
hinstLib = LoadLibrary("ntdll.dll");
ZWopenS=(ZWOS)GetProcAddress(hinstLib,"ZwOpenSection");
ZWmapV=(ZWMV)GetProcAddress(hinstLib,"ZwMapViewOfSection");
ZWunmapV=(ZWUMV)GetProcAddress(hinstLib,"ZwUnmapViewOfSection");
//调用函数,对物理内存进行映射
ZWopenS(&hSection,4,&obj_ar);
ZWmapV((HANDLE)hSection,(HANDLE)0xffffffff,&ba,0,ssize,&so,&ssize,1,0,2);
printf("%s",(void*)ba);
f1=fopen("BIOS.MEM","wb+");
fwrite((void*)ba,ssize,1,f1);
fclose(f1);
return 0;
} |
|