新官上任~送大家点东西(之一,删除自己的代码)

Kevin_qing 2001-08-03 11:53:53
//98,2000下通过
//nt/2000下面的删除代码方法来自陆麟(lu0)的文章,再此表示感谢

#pragma optimize( "", off )
/*NOTE fun_AfterDelSelf MUST BE memory allocate by HeapAlloc or VirtualAlloc,and you should free it your self.
,can't use normal callback function(which data on diskdrive,and can't access it after we delete ourself
*/

int DeleteSelf(void * fun_AfterDelSelf)//
{
typedef int (WINAPI *PFClose)(LPVOID);
OSVERSIONINFO os_info;
os_info.dwOSVersionInfoSize=sizeof(os_info);
LPVOID pBuffer=NULL;
PFClose pClose;
PFClose pDelete;
char fn[4096];
HINSTANCE hins=GetModuleHandle(NULL);
GetModuleFileName(NULL,fn,4096);
if(!GetVersionEx(&os_info))
 return false;

switch(os_info.dwPlatformId)
{
case VER_PLATFORM_WIN32_NT:
 __try{
  while(CloseHandle((HANDLE)4));
 }__except(1){
 }
 CloseHandle((HANDLE)4);
 pClose=PFClose(UnmapViewOfFile);
 break;
case VER_PLATFORM_WIN32_WINDOWS:
 pClose=PFClose(FreeLibrary);
 break;
default:
 return false;
}
pDelete=PFClose(DeleteFile);
pBuffer=VirtualAlloc(NULL,4096,MEM_COMMIT,PAGE_EXECUTE_READWRITE);
__asm{
 call _delete_end
}
 __asm{
_test_close:
 push hins
 call [pClose]
 or eax,eax
 jz _test_close
 lea eax,fn
 push eax
 call [pDelete]
 mov eax,fun_AfterDelSelf
 or eax,eax
 jz _Exit_Process
 call eax
_Exit_Process:
 push 0
 push MEM_RELEASE
 push 0
 push pBuffer
 
 push ExitProcess
 push VirtualFree
 ret
}
_delete_end:
__asm{
 pop ebx
 push 128
 push ebx
 push [pBuffer]
 call memcpy
 jmp pBuffer
}
return 0;
}
#pragma optimize( "", on )
...全文
272 31 打赏 收藏 举报
写回复
31 条回复
切换为时间正序
当前发帖距今超过3年,不再开放新的回复
发表回复
MSVCer 2002-02-18
我祝贺的怎么没有了?
  • 打赏
  • 举报
回复
zhanghanzhi 2001-10-07
那位大哥做个例子,我看不明白,自卑啊!!!
  • 打赏
  • 举报
回复
Anaki 2001-08-20
bookmark
  • 打赏
  • 举报
回复
NewComeMan 2001-08-08
有点意思,不过看不懂,占个位,以后慢慢看吧。
  • 打赏
  • 举报
回复
Kevin_qing 2001-08-08
没有人看老~~~~~
结帐
  • 打赏
  • 举报
回复
wjyasd 2001-08-03
gz and up!
  • 打赏
  • 举报
回复
panda_w 2001-08-03
To All & Kevin_qing :
请看此贴子:http://www.csdn.net/expert/topic/221/221019.shtm
  • 打赏
  • 举报
回复
roadman 2001-08-03

两只斑竹都在, 做好笔记先。

Kevin_qing VS panda_w !!! :)

  • 打赏
  • 举报
回复
lz_0618 2001-08-03
学习
  • 打赏
  • 举报
回复
panda_w 2001-08-03
俺也整理了一些东东,但是没有试过:
下面的代码由Gary Nebbett写就.Gary Nebbett乃是WINDOWS NT/2000 NATIVE API REFERENCE的作者.乃NT系统一等一的高手.下面就分析一些他的这段代码.
这段代码在PROCESS没有结束前就将启动PROCESS的EXE文件删除了.
int main(int argc, char *argv[])
{
HMODULE module = GetModuleHandle(0);
CHAR buf[MAX_PATH];
GetModuleFileName(module, buf, sizeof buf);
CloseHandle(HANDLE(4));
__asm {
lea eax, buf
push 0
push 0
push eax
push ExitProcess
push module
push DeleteFile
push UnmapViewOfFile
ret
}
return 0;
}
现在,我们先看一下堆栈中的东西
偏移 内容
24 0
20 0
16 offset buf
12 address of ExitProcess
8 module
4 address of DeleteFile
0 address of UnmapViewOfFile
调用RET返回到了UnmapViewOfFile,也就是栈里的偏移0所指的地方.当进入UnmapViewOfFile的流程时,栈里见到的是返回地址DeleteFile和HMODUL module.也就是说调用完毕后返回到了DeleteFile的入口地址.当返回到DeleteFile时,看到了ExitProcess的地址,也就是返回地址.和参数EAX,而EAX则是buffer.buffer存的是EXE的文件名.由GetModuleFileName(module, buf, sizeof buf)返回得到.执行了DeleteFile后,就返回到了ExitProcess的函数入口.并且参数为0而返回地址也是0.0是个非法地址.如果返回到地址0则会出错.而调用ExitProcess则应该不会返回.
这段代码的精妙之处在于:
1.如果有文件的HANDLE打开,文件删除就会失败,所以,CloseHandle(HANDLE(4));是十分巧妙的一手.HANDLE4是OS的硬编码,对应于EXE的IMAGE.在缺省情况下,OS假定没有任何调用会关闭IMAGE SECTION的HANDLE,而现在,该HANDLE被关闭了.删除文件就解除了文件对应的一个句柄.
2.由于UnmapViewOfFile解除了另外一个对应IMAGE的HANDLE,而且解除了IMAGE在内存的映射.所以,后面的任何代码都不可以引用IMAGE映射地址内的任何代码.否则就OS会报错.而现在的代码在UnmapViewOfFile后则刚好没有引用到任何IMAGE内的代码.
3.在ExitProcess之前,EXE文件就被删除了.也就是说,进程尚在,而主线程所在的EXE文件已经没了.(WINNT/9X都保护这些被映射到内存的WIN32 IMAGE不被删除.)

Gary Nebbett果然是WIN系列平台的顶尖高手之一.能写出如此代码.独辟蹊径啊:)
  • 打赏
  • 举报
回复
ahr 2001-08-03
呵呵~~
  • 打赏
  • 举报
回复
panda_w 2001-08-03
哇,嘿嘿!可惜
  • 打赏
  • 举报
回复
xlqin 2001-08-03
不用来盆冷水吧
  • 打赏
  • 举报
回复
m_leaner 2001-08-03
我也来了。做了新官,不要马上就腐败吗?代码收下。谢谢!
  • 打赏
  • 举报
回复
xlqin 2001-08-03
我来凑热闹
  • 打赏
  • 举报
回复
Kevin_qing 2001-08-03
要糖没有,杀虫剂要不要?
  • 打赏
  • 举报
回复
bearyi 2001-08-03
push
  • 打赏
  • 举报
回复
蝈蝈俊 2001-08-03
^&^

我是来讨糖的

  • 打赏
  • 举报
回复
jiagh 2001-08-03
收下了!
有了新官,总是有些好处的~~~~
  • 打赏
  • 举报
回复
seesi 2001-08-03
同感同感。
大家要不要起哄啊???





谁??~~~~………………??
?谁砸我???????

  • 打赏
  • 举报
回复
加载更多回复(11)
相关推荐
下面这个模块是我使用易语言时写补丁最常用的一个模块(当然很多也是抄的),一开始我觉得bug肯定会很多,放出去肯定又会坑很多人,后来我发现坑坑更健康,当你明白一个东西的优缺之后,你才会更好的选择你所需要的。所以呢,现在模块开源了,希望对某些朋友有参考意义或者说使用价值吧。 声明:大家使用过程中发现任何问题都不要来问我,请自己想办法解决。我现在已经完全放弃易语言了,改用VC++了。 以下是全部接口: 模块名称:sunflover.ec 作者:by sunflover 版本:2015.2 自己收集的一些常用函数,方便写补丁。 @备注: 自己收集的一些常用函数 ------------------------------ .版本 2 .子程序 Ansi2Unicode, 字节集, 公开, 将Ansi码转换为Unicode码 (返回转换后的字节集) .参数 Ansi, 文本型, , 欲转换的Ansi文本 .子程序 AntiDebug, 逻辑型, 公开, 这个没啥用,效果差;可放在程序运行的第一个函数 被调试返回真 .子程序 AntiODMenu, 逻辑型, 公开, 这个效果较好,推荐用这个;找到OD相关句柄返回真, 此函数枚举窗口通过菜单名来 判定是否OD窗口。 .子程序 AntiStrongOD, 逻辑型, 公开, 这个效果还行,检测带有驱动的 OD调试器 此函数专门对付 StrongOD 插件 .参数 判断OD运行状态, 逻辑型, 可空, 此参数作用: 发现OD驱动时 —是否检测OD运行状态作为返回值基础 ,默认判断运行状态 .子程序 Bin2Dec, 整数型, 公开, 字节集到整数 .参数 Bin, 字节集 .子程序 Bin2Hex, 文本型, 公开, 字节集到十六进制文本 .参数 字节集, 字节集 .子程序 Bin2Hex1, 文本型, 公开, 文本型->文本型 .参数 Bin, 文本型 .子程序 BinXor, 字节集, 公开, 字节集异或 .参数 需异或的字节集, 字节集, , 返回的字节集 .参数 参与异或的字节集, 字节集 .子程序 Dec2Hex, 文本型, 公开, 十到十六 .参数 十进制转换数据, 长整数型 .子程序 GetAPIAddress, 整数型, 公开, 失败返回0 .参数 模块名, 文本型, , 如"user32.dll","kernel32.dll" .参数 API, 文本型, , 如“CreateWindowExA” .子程序 Hex2Bin, 字节集, 公开, 十六进制文本到字节集 .参数 原文, 文本型 .子程序 Hex2Bin1, 文本型, 公开, 文本型->文本型 .参数 Hex, 文本型 .子程序 Hex2Dec, 整数型, 公开, 十六到十 .参数 十六进制转换数据, 文本型 .子程序 InjectDll, 逻辑型, 公开, 向目标进程中注入一个指定 Dll 模块文件;注入成功返回 true, 注入失败则返回 false,CreateRemoteThread法 .参数 进程ID, 整数型, , 进程PID .参数 DLL文件名, 文本型, , 欲注入的DLL名称 .子程序 InjectDLL1, 逻辑型, 公开, SuspendThread,shellcode,SetEip .参数 PID, 整数型 .参数 DLL路径, 文本型 .子程序 InjectDLL2, 逻辑型, 公开, code cave,与InjectDLL1同 .参数 进程ID, 整数型 .参数 DLL文件名, 文本型 .子程序 inline_patch, 逻辑型, 公开, 失败返回假,成功返回真;适合patch尚未运行的加壳或不加壳的可执行文件 .参数 文件名, 文本型, , 文件全路径 .参数 模块名, 文本型, , 如"user32.dll" .参数 API, 文本型, , 如“CreateWindowExA” .参数 地址, 整数型, , 如Hex2Dec (“00401000”) .参数 数据, 字节集, , 如 Hex2Bin (“90909090”) .子程序 inline_patch_Pro, 逻辑型, 公开, 失败返回假,成功返回真;适合patch尚未运行的加壳不加壳的可执行文件,需要补丁的数据较多时建议使用这个,在子程序中打补丁 .参数 文件名, 文本型, , 文件全路径 .参数 模块名, 文本型, , 如"user32.dll" .参数 API, 文本型, , 如“CreateWindowExA” .参数 子程序指针, 子程序指针, , 如&子程序1 .子程序 inline_patch_Pro1, 逻辑型, 公开, 失败返回假,成功返回真;适合patch尚未运行的加壳或不加壳的可执行文件,解码时机判断是选用VirtualProtect;如果壳检测到了,自行换用inline_patch或inline_patch_Pro .参数 文件名, 文本型, , 文件全路径 .参数 子程序指针, 子程序指针, , 如&子程序1 .参数 地址, 整数型, 可空, 如Hex2Dec (“00401000”),用来判断是否解码完成;如果没壳,就空着 .子程序 inline_patch1, 逻辑型, 公开, patch尚未运行的,没加壳的程序,并运行它 .参数 文件名, 文本型, , 文件全路径 .参数 地址, 整数型, , 如Hex2Dec (“00401000”) .参数 数据, 字节集, , 如 Hex2Bin (“90909090”) .子程序 InlinePatch, 逻辑型, 公开, 失败返回假,成功返回真;适合patch尚未运行的加壳不加壳的可执行文件,需要补丁的数据较多时建议使用这个,在子程序中打补丁 .参数 文件名, 文本型, , 文件全路径,如"D:\test.exe" .参数 运行参数, 文本型, 可空, 可空,没有参数则留空,大多数情况没有参数;有参数时填写,如"-s" .参数 模块名, 文本型, , 如"user32.dll" .参数 API, 文本型, , 如“CreateWindowExA” .参数 API中断次数, 整数型, 可空, 可空,有些时候需要计次,根据需要填写;一般留空即可,留空表示中断第一次,就开始补丁 .参数 补丁子程序, 子程序指针, , 如&子程序1 .参数 寄存器结构体, context_, 参考 可空, 可空,CONTEXT,返回寄存器结构体,方便写补丁函数;这个属于高级功能,看不懂的话就留空吧 .参数 进程信息结构体, PROCESS_INFORMATION, 参考 可空, 可空,PROCESS_INFORMATION,返回进程信息结构体,方便写补丁函数;这个属于高级功能,看不懂的话就留空吧 .子程序 OpenProcessPro, 整数型, 公开, 返回句柄权限是完全访问 .参数 PID, 整数型 .子程序 OpenThreadPro, 整数型, 公开, 返回句柄权限是完全访问 .参数 进程ID, 整数型 .子程序 Unicode2Ansi, 文本型, 公开, 将Unicode码转换为Ansi码 (返回转换后的文本) .参数 Unicode, 字节集, , 欲转换的Unicode字节集 .子程序 UnInjectDLL1, 逻辑型, 公开, SuspendThread,shellcode,SetEip .参数 PID, 整数型 .参数 DLL路径, 文本型 .子程序 UnInjectDLL2, 逻辑型, 公开, 远程时钟卸载dll .参数 参数_窗口句柄, 整数型, , FindWindow(字符 (0),“计算器”) .参数 参数_DLL路径, 文本型, , '可以是DLL全路径也可以只是DLL名称 .子程序 超级延时, , 公开, 高精度延时,cpu占用低,窗口不卡死,一次最大可延时几年 (无返回值) .参数 延时间隔, 整数型, , 1000微秒 = 1毫秒 ; 1000毫秒 = 1秒 .参数 延时单位, 整数型, 可空, 可空:毫秒 0 毫秒 1 微秒 2 秒 3 分 4 小时 5 天 .子程序 打开保存文件对话框, 文本型, 公开, 未提示 是否有重复的文件存在 自己注意一下 .参数 窗口句柄, 整数型, 可空, 调用处窗口句柄 .参数 窗口标题, 文本型, 可空, 对话框窗口标题 .参数 过滤器, 文本型, 可空, 格式:“MP3文件(*.mp3)|*.mp3|媒体文件(*.mpg)|*.mpg” .参数 初始路径, 文本型, 可空, 可以被省略。如果本参数被省略,默认从“我的文档”开始。否则,请给出盘符,如“d:” .子程序 打开多文件对话框, 文本型, 公开, 如果多选文件,返回文件路径以“;”(半角分号)分隔。失败或取消返回空文本。 .参数 窗口句柄, 整数型, 可空, 调用处窗口句柄 .参数 窗口标题, 文本型, 可空, 对话框窗口标题 .参数 过滤器, 文本型, 可空, 格式:“MP3文件(*.mp3)|*.mp3|媒体文件(*.mpg)|*.mpg” .参数 初始路径, 文本型, 可空, 可以被省略。如果本参数被省略,默认从“我的文档”开始。否则,请给出盘符,如“d:” .参数 窗口风格, 整数型, 可空, 可以被省略。如果本参数被省略,默认为 0 。位置值从 0 开始。从0-11之间,可以设置多种窗口风格。0.工具栏、只读选择框-未选中;1.工具栏、只读选择框-选中;2.工具栏;3.工具栏、只读选择框-未选中,帮助按钮;4.工具栏、只读选择框-选中,帮助按钮;5.工具栏,帮助按钮;6.普通风格、只读选择框-未选中;7.普通风格、只读选择框-选中;8.普通风格;9.普通风格、只读选择框-未选中,帮助按钮;10.普通风格、只读选择框-选中,帮助按钮;11.普通风格、帮助按钮。 .子程序 读内存字节集, 字节集, 公开, 从内存中读取字节集数据(返回字节集,失败返回0字节长度的空字节集) .参数 进程ID, 整数型, , 进程ID .参数 地址, 整数型, , 内存地址 .参数 长度, 整数型, , 欲读取内存数据的长度 .子程序 复制文件夹, 逻辑型, 公开, 可复制文件,也可复制目录。成功返回真,失败返回假。 .参数 被复制的文件或目录, 文本型 .参数 复制到的位置, 文本型 .子程序 恢复进程, 逻辑型, 公开 .参数 PID, 整数型 .子程序 结束进程, 逻辑型, 公开 .参数 进程ID, 整数型 .子程序 进程取ID, 整数型, 公开, 取指定进程的进程ID(返回第一个进程ID,失败返回空信息) .参数 进程名, 文本型, , 程序进程名(不区分大小写!) .子程序 进程是否存在1, 逻辑型, 公开 .参数 进程ID, 整数型 .子程序 进程是否存在2, 逻辑型, 公开 .参数 进程名, 文本型 .子程序 蓝屏, , 公开, 惩罚破解者函数 。 在确定当前程序被调试后 可使用此函数让系统蓝屏。 慎重使用! .子程序 内存补丁, 逻辑型, 公开, 根据进程名补丁内存,patch已经运行的可执行文件 .参数 进程名, 文本型, , '完整的文件名,注意大小写 .参数 地址, 文本型, , 需patch地址,如“00401000” .参数 代码, 文本型, , 被替换的代码,如“90909090” .子程序 内存补丁1, 逻辑型, 公开, 根据进程ID补丁内存,patch已经运行的可执行文件 .参数 进程ID, 整数型, , 要补丁的进程ID .参数 地址, 文本型, , 需patch地址,如“00401000” .参数 代码, 文本型, , 被替换的代码,如“90909090” .子程序 内存搜索, 整数型, 公开, 某些情况,需提升权限(返回结果数目,失败返回0),返回搜索到的数目 .参数 进程ID, 整数型, , 进程ID .参数 搜索内容, 字节集, , 欲搜索的内容 其他类型-需自行转换为字节集类型 .参数 结果数组, 整数型, 参考 数组, 用来保存搜索的结果 .子程序 取汇编指令长度, 整数型, 公开, 返回指定进程指定地址处的首条汇编指令的长度。注:计算方法使用的是LDX32 .参数 进程ID, 整数型, , 进程ID .参数 地址, 整数型, , 指令地址,如Hex2Dec("00401000") .子程序 取寄存器值, 文本型, 公开, 适用于明码读码,运行到地址处读真码;如 取寄存器值(文件名,"user32.dll",“CreateWindowExA”,Hex2Dec (“00401000”),“Eax”) .参数 文件名, 文本型, , 文件全路径 .参数 模块名, 文本型, , 如"user32.dll" .参数 API, 文本型, , 如“CreateWindowExA”,这里主要为了解码时机 .参数 地址, 整数型, , 如Hex2Dec (“00401000”) .参数 寄存器, 文本型, , 可选Dr0-Dr7,Eax,Ecx,Ebx,Edx,Ebp,Esp,Eip,Edi,Esi,SegGs,SegFs,SegEs,SegDs,SegCs,EFlags,Esp,SegSs .子程序 取进程主线程, 整数型, 公开, 失败返回0 .参数 进程ID, 整数型 .子程序 取路径目录, 文本型, 公开, 返回一个文件所在目录,如"C:\Program Files\WinRAR\WinRAR.exe",返回"C:\Program Files\WinRAR" .参数 路径, 文本型, , 如"C:\Program Files\WinRAR\WinRAR.exe" .子程序 取路径文件名, 文本型, 公开, 根据文件路径获取文件名 .参数 路径, 文本型, , 文件完整路径 .子程序 取线程起始地址, 整数型, 公开, 失败返回0 .参数 参数_dwThreadId, 整数型 .子程序 去除空格, 文本型, 公开 .参数 文本, 文本型 .子程序 设置颜色对话框, 逻辑型, 公开, 例如:如果真 (设置颜色对话框 (取窗口句柄 (), j));编辑框1.文本颜色 = 到整数 (j)。 .参数 窗口句柄, 整数型 .参数 返回_颜色, 文本型, , 返回的颜色~~需要传回整数 .子程序 申请内存Pro, 整数型, 公开, 成功返回申请的首地址,失败返回0;申请的内存可读可写可执行 .参数 进程ID, 整数型, , .参数 申请内存大小, 整数型 .子程序 释放内存Pro, 逻辑型, 公开 .参数 进程ID, 整数型, , .参数 内存地址, 整数型 .子程序 特征码模糊搜索, 整数型, 公开, 最多支持三段通配符如“68 00 00 00 40 ?? ?? ?? ?? ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 12 34 ?? ?? ?? ?? 85 69” .参数 进程ID, 整数型, , 进程ID .参数 特征码, 文本型, , 十六进制文本,如“68 00 00 00 40 ?? ?? ?? ?? ?? ?? ?? ?? 50 E8” .参数 结果数组, 整数型, 参考 数组, 用来保存搜索的结果 .参数 偏移, 整数型, 可空, 默认为0 .参数 起始地址, 文本型, 可空, 默认为“00400000” .参数 结束地址, 文本型, 可空, 默认为“00800000” .子程序 提升进程权限, 逻辑型, 公开 .参数 目标进程, 整数型, 可空 .参数 权限类别, 文本型, 可空, 默认为“SeDebugPrivilege”;可选“SeDebugPrivilege”,“SeShutdownPrivilege”,“SeRestorePrivilege”,“SeBackupPrivilege” .子程序 写内存字节集, 逻辑型, 公开, 往内存中写入字节集数据(成功返回真,失败返回假);注:内部有VirtualProtectEx处理 .参数 进程ID, 整数型, , 进程ID .参数 地址, 整数型, , 内存地址 .参数 数据, 字节集, , 写入数据 如果为其它数据类型,可以用 到字节集() 将数据转换为字节集 .参数 写入长度, 整数型, 可空, 默认为全部数据,(参考: 1字节型 2短整数型 4长整数型,小数型,指针 8长整数型,双精度小数型,日期时间型) .子程序 移动文件夹, 逻辑型, 公开, 可移动文件,也可移动目录。成功返回真,失败返回假。 .参数 被移动的文件或目录, 文本型 .参数 移动到的位置, 文本型 .子程序 隐藏进程, 逻辑型, 公开, hide.dll,会被误报,大家看着处理 .参数 进程ID, 整数型 .子程序 暂停进程, 逻辑型, 公开 .参数 PID, 整数型 .子程序 终止进程Pro, , 公开, 终止进程,终止所有指定进程 .参数 进程名, 文本型, , 程序进程名(不区分大小写!) .子程序 终止线程, 逻辑型, 公开, 成功返回真 失败返回假 .参数 参数_线程ID, 整数型 .数据类型 context_, 公开, 公开 .成员 ContextFlags, 整数型 .成员 Dr0, 整数型 .成员 Dr1, 整数型 .成员 Dr2, 整数型 .成员 Dr3, 整数型 .成员 Dr4, 整数型 .成员 Dr5, 整数型 .成员 Dr6, 整数型 .成员 Dr7, 整数型 .成员 ControlWord, 整数型 .成员 StatusWord, 整数型 .成员 TagWord, 整数型 .成员 ErrorOffset, 整数型 .成员 ErrorSelector, 整数型 .成员 DataOffset, 整数型 .成员 DataSelector, 整数型 .成员 RegisterArea, 字节型, , "72" .成员 Cr0NpxState, 整数型 .成员 SegGs, 整数型 .成员 SegFs, 整数型 .成员 SegEs, 整数型 .成员 SegDs, 整数型 .成员 Edi, 整数型 .成员 Esi, 整数型 .成员 Ebx, 整数型 .成员 Edx, 整数型 .成员 Ecx, 整数型 .成员 Eax, 整数型 .成员 Ebp, 整数型 .成员 Eip, 整数型 .成员 SegCs, 整数型 .成员 EFlags, 整数型 .成员 Esp, 整数型 .成员 SegSs, 整数型 .成员 reserve, 字节型, , "512" .数据类型 FLOATING_SAVE_AREA, 公开 .成员 ControlWord, 整数型 .成员 StatusWord, 整数型 .成员 TagWord, 整数型 .成员 ErrorOffset, 整数型 .成员 ErrorSelector, 整数型 .成员 DataOffset, 整数型, , , ; .成员 DataSelector, 整数型 .成员 RegisterArea, 字节型, , "80" .成员 Cr0NpxState, 整数型 .数据类型 LuID, 公开 .成员 lowpart, 整数型 .成员 highpart, 整数型 .数据类型 MEMORY_BASIC_INFORMATION, 公开 .成员 BaseAddress, 整数型 .成员 AllocationBase, 整数型 .成员 AllocattionProtect, 整数型 .成员 RegionSize, 整数型 .成员 State, 整数型 .成员 Protect, 整数型 .成员 Type, 整数型 .数据类型 MODULEENTRY32, 公开, MODULEENTRY32 .成员 dwSize, 整数型, , , dwSize .成员 th32ModuleID, 整数型, , , th32ModuleID .成员 th32ProcessID, 整数型, , , th32ProcessID .成员 GlblcntUsage, 整数型, , , GlblcntUsage .成员 ProccntUsage, 整数型, , , ProccntUsage .成员 modBaseAddr, 整数型, , , modBaseAddr .成员 modBaseSize, 整数型, , , modBaseSize .成员 hModule, 整数型, , , hModule .成员 szModule, 字节型, , "256", 模块名称 .成员 szExePath, 字节型, , "260", 文件路径 .数据类型 PROCESS_BASIC_INFORMATION, 公开 .成员 ExitStatus, 整数型 .成员 PebBaseAddress, 整数型 .成员 AffinityMask, 整数型 .成员 BasePriority, 整数型 .成员 UniqueProcessId, 整数型 .成员 InheritedFromUniqueProcessId, 整数型 .数据类型 PROCESS_INFORMATION, 公开 .成员 hProcess, 整数型 .成员 hThread, 整数型 .成员 dwProcessId, 整数型 .成员 dwThreadId, 整数型 .数据类型 SECURITY_ATTRIBUTES, 公开, , SECURITY_ATTRIBUTES .成员 nLength, 整数型 .成员 lpSecurityDescriptor, 整数型 .成员 bInheritHandle, 整数型 .数据类型 SHFILEOPSTRUCT, 公开 .成员 句柄, 整数型 .成员 wFunc, 整数型 .成员 pFrom, 字节集 .成员 pTo, 字节集 .成员 fFlags, 短整数型 .成员 fAnyOperationsAborted, 整数型 .成员 hNameMappings, 整数型 .成员 lpszProgressTitle, 文本型 .数据类型 STARTUPINFO, 公开 .成员 cb, 整数型 .成员 lpReserved, 文本型 .成员 lpDesktop, 文本型 .成员 lpTitle, 文本型 .成员 dwX, 整数型 .成员 dwY, 整数型 .成员 dwXSize, 整数型 .成员 dwYSize, 整数型 .成员 dwXCountChars, 整数型 .成员 dwYCountChars, 整数型 .成员 dwFillAttribute, 整数型 .成员 dwFlags, 整数型 .成员 wShowWindow, 短整数型 .成员 cbReserved2, 短整数型 .成员 lpReserved2, 整数型 .成员 hStdInput, 整数型 .成员 hStdOutput, 整数型 .成员 hStdError, 整数型 .数据类型 STARTUPINFO1, 公开 .成员 cb, 整数型 .成员 lpReserved, 整数型 .成员 lpDesktop, 整数型 .成员 lpTitle, 整数型 .成员 dwX, 整数型 .成员 dwY, 整数型 .成员 dwXSize, 整数型 .成员 dwYSize, 整数型 .成员 dwXCountChars, 整数型 .成员 dwYCountChars, 整数型 .成员 dwFillAttribute, 整数型 .成员 dwFlags, 整数型 .成员 wShowWindow, 短整数型 .成员 cbReserved2, 短整数型 .成员 lpReserved2, 字节型 .成员 hStdInput, 整数型 .成员 hStdOutput, 整数型 .成员 hStdError, 整数型 .数据类型 THREADENTRY32, 公开 .成员 dwsize, 整数型 .成员 cntUsage, 整数型 .成员 th32ThreadID, 整数型 .成员 th32OwnerProcessID, 整数型 .成员 tpBasePri, 长整数型 .成员 tpDeltaPri, 长整数型 .成员 dwFlags, 整数型 .数据类型 窗口句柄类, 公开 .成员 句柄, 整数型 .成员 标题, 文本型 .成员 类名, 文本型 .数据类型 打开文件名, 公开, OPENFILENAME .成员 结构大小, 整数型, , , lStructSize .成员 窗口句柄, 整数型, , , hwndOwner .成员 实例句柄, 整数型, , , hInstance .成员 过滤器, 字节集, , , lpstrFilter .成员 自定义过滤器, 文本型, , , lpstrCustomFilter .成员 自定义过滤器最大长度, 整数型, , , nMaxCustFilter .成员 过滤器索引, 整数型, , , nFilterIndex .成员 文件名, 字节集, , , lpstrFile .成员 文件名最大长度, 整数型, , , nMaxFile .成员 文件标题, 文本型, , , lpstrFileTitle .成员 文件标题最大长度, 整数型, , , nMaxFileTitle .成员 初始目录, 文本型, , , lpstrInitialDir .成员 标题, 文本型, , , lpstrTitle .成员 标志, 整数型, , , flags .成员 文件偏移量, 整数型, , , nFileOffset .成员 文件扩展名, 整数型, , , nFileExtension .成员 默认扩展名, 文本型, , , lpstrDefExt .成员 自定义数据, 整数型, , , lCustData .成员 回调函数地址, 整数型, , , lpfnHook .成员 模板名, 文本型, , , lpTemplateName .数据类型 函数信息, 公开 .成员 模块索引, 整数型 .成员 ThunkRav, 文本型 .成员 Thunk偏移, 文本型 .成员 Thunk值, 文本型 .成员 序数, 文本型 .成员 名称, 文本型 .数据类型 寄存器, 公开 .成员 标记, 整数型 .成员 dr0, 整数型 .成员 dr1, 整数型 .成员 dr2, 整数型 .成员 dr3, 整数型 .成员 dr6, 整数型 .成员 dr7, 整数型 .成员 FloatSave, FLOATING_SAVE_AREA .成员 seggs, 整数型 .成员 segfs, 整数型 .成员 seges, 整数型 .成员 segds, 整数型 .成员 edi, 整数型 .成员 esi, 整数型 .成员 ebx, 整数型 .成员 edx, 整数型 .成员 ecx, 整数型 .成员 eax, 整数型 .成员 ebp, 整数型 .成员 eip, 整数型 .成员 SegCs, 整数型 .成员 eflags, 整数型 .成员 esp, 整数型 .成员 SegSs, 整数型 .数据类型 进程信息, 公开, 进程信息 .成员 dwSize, 整数型 .成员 cntUsage, 整数型 .成员 进程ID, 整数型 .成员 th32DefaultHeapID, 整数型 .成员 th32ModuleID, 整数型 .成员 cntThreads, 整数型 .成员 th32ParentProcessID, 整数型 .成员 pcPriClassBase, 整数型 .成员 dwFlags, 整数型 .成员 进程名称, 字节型, , "256" .数据类型 逻辑字体, 公开, $(a)LOGFONT .成员 高度, 整数型, , , lfHeight .成员 宽度, 整数型, , , lfWidth .成员 控制摆, 整数型, , , lfEscapement .成员 定方位, 整数型, , , lfOrientation .成员 加粗, 整数型, , , lfWeight .成员 斜体, 字节型, , , lfItalic .成员 下划线, 字节型, , , lfUnderline .成员 删除线, 字节型, , , lfStrikeOut .成员 零碎工作组合, 字节型, , , lfCharSet .成员 出自精确, 字节型, , , lfOutPrecision .成员 修剪精确, 字节型, , , lfClipPrecision .成员 性质, 字节型, , , lfQuality .成员 间距, 字节型, , , lfPitchAndFamily .成员 字体名称, 字节型, , "32", 用LF_FACESIZE,lfFaceName? .数据类型 色盒, 公开 .成员 lStructsize, 整数型 .成员 hwndOwner, 整数型 .成员 hInstance, 整数型 .成员 rgbResult, 整数型 .成员 lpCustColors, 文本型, , , 可以指定16个数组,也可以不用指定,但无论用否,必须传址 .成员 flags, 整数型 .成员 lCustData, 整数型 .成员 lpfnHook, 子程序指针 .成员 lpTemplateName, 文本型 .数据类型 设定执行文件信息, 公开, SHELLEXECUTEINFO .成员 结构大小, 整数型, , , cbSize .成员 标志, 整数型, , , fMask .成员 窗口句柄, 整数型, , , hwnd .成员 操作命令, 文本型, , , lpVerb .成员 文件名, 文本型, , , lpFile .成员 应用程序参数, 文本型, , , lpParameters .成员 目录, 文本型, , , lpDirectory .成员 显示标志, 整数型, , , nShow .成员 实例句柄, 整数型, , , hInstApp .成员 项目标识符列表结构指针, 整数型, , , lpIDList .成员 文件类别, 文本型, , , lpClass .成员 热键句柄, 整数型, , , hkeyClass .成员 热键, 整数型, , , dwHotKey .成员 图标句柄, 整数型, , , hIcon .成员 进程句柄, 整数型, , , hProcess .数据类型 文件夹信息, 公开, BROWSEINFO .成员 窗口句柄, 整数型, , , hOwner .成员 根目录, 整数型, , , pidlRoot .成员 显示名称, 文本型, , , pszDisplayName .成员 标题, 文本型, , , lpszTitle .成员 标志, 整数型, , , ulFlags .成员 回调函数地址, 整数型, , , lpfn .成员 回调函数参数, 整数型, , , lParam .成员 图像索引, 整数型, , , iImage .数据类型 项目标识符列表, 公开, ITEMIDLIST .成员 结构大小, 整数型, , , cb .成员 标识符长度, 字节型, , "255", abID .数据类型 选择字体, 公开, CHOOSEFONT .成员 结构大小, 整数型, , , lStructSize .成员 窗口句柄, 整数型, , , hwndOwner,caller's window handle .成员 设备场景句柄, 整数型, , , hDC,printer DC/IC or NULL .成员 字体结构指针, 整数型, , , lpLogFont‘ptr. to a LOGFONT struct .成员 大小, 整数型, , , iPointSize,10 * size in points of selected font .成员 标志, 整数型, , , flags,enum. type flags .成员 颜色值, 整数型, , , rgbColors,returned text color .成员 自定义数据, 整数型, , , lCustData,data passed to hook fn. .成员 回调函数地址, 整数型, , , lpfnHook,ptr. to hook function .成员 模板名称, 文本型, , , lpTemplateName,custom template name .成员 实例句柄, 整数型, , , hInstance,instance handle of.EXE that contains cust. dlg. template .成员 字体风格, 文本型, , , lpszStyle,return the style field here must be LF_FACESIZE(32) or bigger .成员 字体类型, 短整数型, , , nFontType,same value reported to the EnumFonts,call back with the extra FONTTYPE_ bits added .成员 空白队列, 短整数型 .成员 最小尺寸, 整数型 .成员 最大尺寸, 整数型 .数据类型 字体信息, 公开 .成员 名称, 文本型 .成员 大小, 整数型 .成员 颜色, 整数型 .成员 类型, 整数型 .成员 斜体, 整数型 .成员 下划线, 整数型 .程序集 IATHOOK类, , 公开 .子程序 APIAddr, 整数型, 公开, '此方法放在IATHOOK后调用方可成功,失败返回0 .子程序 IATHook, 逻辑型, 公开, 完事后注意调用IATUnHook .参数 进程ID, 整数型, 可空, '为空表示自身进程 .参数 模块名, 文本型, , 需加后缀,如“user32.dll” .参数 函数名, 文本型, , 注意大小写,如“MessageBoxA” .参数 新地址, 整数型, , 到整数 (&HookCallBack) .子程序 IATUnHook, 逻辑型, 公开, 与IATHOOK参数完全相同 .参数 进程ID, 整数型, 可空, 为空表示本进程 .参数 模块名, 文本型, , 需加后缀,如“user32.dll” .参数 函数名, 文本型, , 注意大小写,如“MessageBoxA” .参数 地址, 整数型, , 与IATHOOK最后一个参数相同 .程序集 PE类, , 公开, 获取可执行程序入口,附加数据; .子程序 GetEntryPoint, 整数型, 公开, 获取的是OEP,即EP+imagebase .参数 全文件路径, 文本型, , 要处理的文件全路径 .子程序 overlay, 字节集, 公开, 获取PE文件的附加数据 .参数 全文件路径, 文本型, , 要处理的文件全路径 .程序集 超级解压类, , 公开, 调用7z解压文件,支持7z,zip,rar等压缩文件的带密码解压 .子程序 超级解压, 逻辑型, 公开, 解压压缩文件,支持rar,zip,7z等等压缩文件的解压,支持带密码解压 .参数 待解压文件, 文本型, , 欲解压的文件的全路径 .参数 解压到的目录, 文本型, , 欲解压到的路径 .参数 解压密码, 文本型, 可空, 解压所用密码,没有密码就不填 .程序集 汇编类, , 公开, 用于辅助生成shellcode,返回值都是字节集 .子程序 add_eax_char, 字节集, 公开, 占用3个字节,char值在0-127之间,返回汇编指令对应的字节集 .参数 char, 字节型, , add eax,1,参数为1,注意进制;16进制,请用Hex2Dec(Hex)转换 .子程序 add_eax_Num, 字节集, 公开, 占用5个字节,返回汇编指令对应的字节集 .参数 Num, 整数型, , add eax,8,参数为8,注意进制;16进制,请用Hex2Dec(Hex)转换 .子程序 add_esp_char, 字节集, 公开, 占用3个字节,char值在0-127之间,返回汇编指令对应的字节集 .参数 char, 字节型, , add esp,8,参数为8,注意进制;16进制,请用Hex2Dec(Hex)转换 .子程序 call, 字节集, 公开, 占用5个字节,call转换,返回汇编指令对应的字节集,此处为十进制,想用16进制,请自行转换;示例:call (Hex2Dec (“402000”), Hex2Dec (“401000”)) .参数 call到的地址, 整数型, , 00401000 call 00402000,参数为00402000 .参数 call所在的地址, 整数型, , 00401000 call 00402000,参数为00401000 .子程序 call_API, 字节集, 公开, 占用5个字节,如00401000 call MessageBoxA .参数 call所在地址, 整数型, , 自行转换,Hex2Dec("00401000") .参数 lpProcName, 文本型, , 如MessageBoxA .参数 hModule, 文本型, , 如user32.dll .子程序 call_API_FF15, 字节集, 公开, 占用6个字节,如00401000 call MessageBoxA .参数 lpProcName, 文本型, , 如MessageBoxA .参数 hModule, 文本型, , 如user32.dll .子程序 call_eax, 字节集, 公开, 占用2个字节,返回汇编指令对应的字节集 .子程序 call_FF15, 字节集, 公开, 占用6个字节,call转换,返回汇编指令对应的字节集,此处为十进制,想用16进制,请自行转换;示例:call (Hex2Dec (“402000”)) .参数 call到的地址, 整数型, , 00401000 call 00402000,参数为00402000 .子程序 jmp, 字节集, 公开, 占用5个字节,jmp转换,返回汇编指令对应的字节集,此处为十进制,想用16进制,请自行转换;jmp (Hex2Dec (“402000”), Hex2Dec (“401000”)) .参数 jmp_to, 整数型, , 00401000 jmp 00402000,参数为00402000 .参数 jmp_from, 整数型, , 00401000 jmp 00402000,参数为00401000 .子程序 jmp_FF25, 字节集, 公开, 占用6个字节,jmp转换,返回汇编指令对应的字节集,此处为十进制,想用16进制,请自行转换;jmp (Hex2Dec (“402000”)) .参数 jmp_to, 整数型, , 00401000 jmp 00402000,参数为00402000 .子程序 mov_eax_Num, 字节集, 公开, 占用5个字节,返回汇编指令对应的字节集 .参数 Num, 整数型, , 自己注意进制,mov eax,401000,参数为Hex2Dec(“401000”) .子程序 nop, 字节集, 公开, 占用个字节,返回汇编指令对应的字节集 .子程序 popad, 字节集, 公开, 占用1个字节,返回汇编指令对应的字节集 .子程序 popfd, 字节集, 公开, 占用1个字节,返回汇编指令对应的字节集 .子程序 push_char, 字节集, 公开, 占用2个字节,char值在0-127之间,返回汇编指令对应的字节集 .参数 char, 字节型, , push 8,参数为8,注意进制;16进制,请用Hex2Dec(Hex)转换 .子程序 push_eax, 字节集, 公开, 占用1个字节,返回汇编指令对应的字节集 .子程序 push_ebp, 字节集, 公开, 占用1个字节,返回汇编指令对应的字节集 .子程序 push_ebx, 字节集, 公开, 占用1个字节,返回汇编指令对应的字节集 .子程序 push_ecx, 字节集, 公开, 占用1个字节,返回汇编指令对应的字节集 .子程序 push_edi, 字节集, 公开, 占用1个字节,返回汇编指令对应的字节集 .子程序 push_edx, 字节集, 公开, 占用1个字节,返回汇编指令对应的字节集 .子程序 push_esi, 字节集, 公开, 占用1个字节,返回汇编指令对应的字节集 .子程序 push_esp, 字节集, 公开, 占用1个字节,返回汇编指令对应的字节集 .子程序 push_Num, 字节集, 公开, 占用5个字节,返回汇编指令对应的字节集 .参数 Num, 整数型, , push 401000,参数为Hex2Dec(401000),注意进制;16进制,请用Hex2Dec(Hex)转换 .子程序 pushad, 字节集, 公开, 占用1个字节,将通用寄存器的内容压入堆栈;返回汇编指令对应的字节集 .子程序 pushfd, 字节集, 公开, 占用1个字节,本指令可以把标志寄存器的内容保存到堆栈中去;返回汇编指令对应的字节集 .子程序 retn, 字节集, 公开, 占用1个字节,返回汇编指令对应的字节集 .子程序 retn_n, 字节集, 公开, 占用3个字节,返回汇编指令对应的字节集 .参数 n, 短整数型, , retn 3,参数填3,注意进制;16进制,请用Hex2Dec(Hex)转换 .子程序 xor_eax_eax, 字节集, 公开, 占用2个字节,返回汇编指令对应的字节集 .子程序 xor_ebx_ebx, 字节集, 公开, 占用2个字节,返回汇编指令对应的字节集 .子程序 xor_ecx_ecx, 字节集, 公开, 占用2个字节,返回汇编指令对应的字节集 .子程序 xor_edi_edi, 字节集, 公开, 占用2个字节,返回汇编指令对应的字节集 .子程序 xor_edx_edx, 字节集, 公开, 占用2个字节,返回汇编指令对应的字节集 .子程序 xor_esi_esi, 字节集, 公开, 占用2个字节,返回汇编指令对应的字节集 .程序集 内存DLL注入类, , 公开, 可能还有问题 .子程序 取DLL函数地址, 整数型, 公开, 返回已经注入到指定进程内的DLL的函数地址。失败返回0。 .参数 DLL函数名, 文本型, , 区分大小写。 .子程序 是否已注入, 逻辑型, 公开, 已注入返回真,未注入返回假。 .子程序 卸载DLL, 逻辑型, 公开, 卸载已经注入的内存中的DLL,成功返回真,失败返回假.(最好不要卸载,卸载的话被注入的进程很容易崩溃) .子程序 执行DLL函数, 整数型, 公开, 执行已经注入到指定进程内的DLL的函数,成功返回所执行的函数的地址,失败返回0。 .参数 DLL函数名, 文本型, , 区分大小写。 .参数 等待函数执行完毕, 逻辑型, 可空, 默认为假,为真则函数执行完毕后本函数才返回。 .参数 返回值, 整数型, 参考 可空, 如果上一个参数为真,则可提供一个变量保存被执行的DLL函数的返回值。 .参数 线程句柄, 整数型, 参考 可空, 可提供变量保存函数执行线程的句柄,不需要请留空.接收了句柄记得不用时要关闭. .参数 参数1, 整数型, 可空, 可提供给被执行函数最多10个参数(理论上支持无限个,自己看着改吧)不需要的请留空。 .参数 参数2, 整数型, 可空, 非整数型参数需传递变量的内存数据指针,该指针必须是在目标进程内的。 .参数 参数3, 整数型, 可空, 提供的参数请与所执行的函数的参数个数一致,否则被注入的进程绝对会崩溃! .参数 参数4, 整数型, 可空 .参数 参数5, 整数型, 可空 .参数 参数6, 整数型, 可空 .参数 参数7, 整数型, 可空 .参数 参数8, 整数型, 可空 .参数 参数9, 整数型, 可空 .参数 参数10, 整数型, 可空 .子程序 注入DLL, 整数型, 公开, 成功返回DLL的模块句柄,失败或已注入返回0。 .参数 进程句柄, 整数型, , 句柄必须拥有对被注入进程的完全操作权限。注入后如果没有其他用处可以关闭该句柄。 .参数 DLL数据, 字节集 .程序集 取机器码类, , 公开, 获取硬件信息,硬盘等等 .子程序 取3段机器码, 文本型, 公开, 获取3段32位机器码,如1111111111-2222222222-3333333333 .参数 bios, 逻辑型, 可空, 填 假 表示此段全为0,可空,默认为真 .参数 HardDisk, 逻辑型, 可空, 填 假 表示此段全为0,可空,默认为真 .参数 MAC, 逻辑型, 可空, 填 假 表示此段全为0,可空,默认为真 .子程序 取4段机器码, 文本型, 公开, 获取4段23位机器码,如11111-22222-33333-44444 .参数 bios, 逻辑型, 可空, 填 假 表示此段全为0,可空,默认为真 .参数 HardDisk, 逻辑型, 可空, 填 假 表示此段全为0,可空,默认为真 .参数 Video, 逻辑型, 可空, 填 假 表示此段全为0,可空,默认为真 .参数 MAC, 逻辑型, 可空, 填 假 表示此段全为0,可空,默认为真 .DLL命令 _窗口是否可见, 整数型, "user32", "IsWindowVisible", 公开, 判断窗口是否可见 如窗口可见则返回TRUE(非零) .参数 窗口句柄, 整数型, , 要测试的那个窗口的句柄 .DLL命令 AdjustTokenPrivileges, 逻辑型, "advapi32.dll", "AdjustTokenPrivileges", 公开 .参数 TokenHandle, 整数型 .参数 DisableAllPrivileges, 整数型 .参数 NewState, , 传址 .参数 BufferLength, 整数型 .参数 PreviousState, , 传址 .参数 ReturnLength, 整数型, 传址 .DLL命令 API_IsDebuggerPresent, 整数型, "kernel32.dll", "IsDebuggerPresent", 公开 .DLL命令 CallNextHookEx, 整数型, "user32.dll", "CallNextHookEx", 公开 .参数 hhk, 整数型, , 钩子句柄 .参数 nCode, 整数型, , 钩子类型 .参数 wParam, 整数型 .参数 LPARAM, 整数型 .DLL命令 CloseHandle, 整数型, "kernel32.dll", "CloseHandle", 公开, 关闭一个内核对象。其中包括文件、文件映射、进程、线程、安全和同步对象等。涉及文件处理时,这个函数通常与vb的close命令相似。应尽可能的使用close,因为它支持vb的差错控制。注意这个函数使用的文件句柄与vb的文件编号是完全不同的 非零表示成功,零表示失败。会设置GetLastError .参数 对象句柄, 整数型, , 欲关闭的一个对象的句柄; .DLL命令 CreateFileA, 整数型, "kernel32.dll", "CreateFileA", 公开, , 成功返回文件句柄,失败返回0 .参数 打开文件名, 文本型, , lpFileName,要打开的文件的名字 .参数 访问权限, 整数型, , dwDesiredAccess,访问权限 .参数 共享方式, 整数型, , dwShareMode,共享方式 .参数 安全特性, SECURITY_ATTRIBUTES, 传址, lpSecurityAttributes,安全特性信息 .参数 创建方式, 整数型, , dwCreationDisposition,创建方式 .参数 文件属性, 整数型, , dwFlagsAndAttributes,参见相关帮助 .参数 从文件复制文件属性, 整数型, , hTemplateFile,参见相关帮助 .DLL命令 CreateProcess, 整数型, "kernel32.dll", "CreateProcessA", 公开, CreateProcess(编辑框1.内容, “”, 0, 0, 0, 4, 0, 取运行目录(), si, pi) .参数 lpApplicationName, 文本型 .参数 lpCommandLine, 文本型 .参数 lpProcessAttributes, 整数型 .参数 lpThreadAttributes, 整数型 .参数 bInheritHandles, 整数型 .参数 dwCreationFlags, 整数型, , 0正常,4挂起,3调试,6调试挂起 .参数 lpEnvironment, 整数型 .参数 lpCurrentDriectory, 文本型 .参数 lpStartupInfo, STARTUPINFO, 传址 .参数 lpProcessInformation, PROCESS_INFORMATION, 传址 .DLL命令 CreateRemoteThread, 整数型, "kernel32", "CreateRemoteThread", 公开, 在另一进程中建立线索 .参数 hProcess, 整数型 .参数 lpThreadAttributes, 整数型 .参数 dwStackSize, 整数型 .参数 lpStartAddress, 整数型 .参数 lpParameter, 整数型 .参数 dwCreationFlags, 整数型 .参数 lpThreadId, 整数型, 传址 .DLL命令 CreateToolhelp32Snapshot, 整数型, "kernel32.dll", "CreateToolhelp32Snapshot", 公开, 返回快照后的句柄 .参数 快照标志, 整数型, , 进程=15,线程=4,DLL=8,堆= .参数 进程标识符, 整数型, , lProcessID 欲照快照的进程标识符 .DLL命令 DuplicateHandle, 整数型, "kernel32", "DuplicateHandle", 公开, 复制对象句柄 .参数 hSourceProcessHandle, 整数型 .参数 hSourceHandle, 整数型 .参数 hTargetProcessHandle, 整数型 .参数 lpTargetHandle, 整数型, 传址 .参数 dwDesiredAccess, 整数型 .参数 bInheritHandle, 整数型 .参数 dwOptions, 整数型 .DLL命令 ExitProcess, 整数型, "kernel32.dll", "ExitProcess", 公开, , .参数 进程句柄, 整数型, , 填0即可 .DLL命令 FindWindow, 整数型, "user32.dll", "FindWindowA", 公开, FindWindow,寻找窗口列表中第一个符合指定条件的顶级窗口 .参数 窗口类名, 文本型, , lpClassName,参见相关帮助,字符 (0) .参数 窗口文本, 文本型, , lpWindowName,参见相关帮助 .DLL命令 GetClassName, 整数型, "user32.dll", "GetClassNameA", 公开, 为指定的窗口取得类名 以字节数表示的类名长度;排除最后的空中止字符。零表示出错。会设置GetLastError .参数 句柄, 整数型, , 欲获得类名的那个窗口的句柄 .参数 文本, 文本型, , 随同类名载入的缓冲区。预先至少必须分配nMaxCount+1个字符 .参数 文本长度, 整数型, , 由lpClassName提供的缓冲区长度; .DLL命令 GetCurrentProcess, 整数型, "kernel32.dll", "GetCurrentProcess", 公开 .DLL命令 GetCurrentProcessId, 整数型, "kernel32.dll", "GetCurrentProcessId", 公开 .DLL命令 GetExitCodeThread, 整数型, , "GetExitCodeThread", 公开, 取线程返回值 .参数 hThread, 整数型 .参数 lpExitCode, 整数型, 传址 .DLL命令 GetModuleHandleA, 整数型, "kernel32.dll", "GetModuleHandleA", 公开, , 获取一个应用程序或动态链接库的模块句柄 如执行成功成功,则返回模块句柄。零表示失败。会设置GetLastError .参数 lpModuleName, 文本型, , lpModuleName,指定模块名,这通常是与模块的文件名相同的一个名字。例如,NOTEPAD.EXE程序的模块文件名就叫作NOTEPAD .DLL命令 GetProcAddress, 整数型, "kernel32.dll", "GetProcAddress", 公开, , .参数 hModule, 整数型, , hModule .参数 lpProcName, 文本型, , lpProcName .DLL命令 GetThreadContext, 逻辑型, "kernel32", "GetThreadContext", 公开 .参数 hThreadId, 整数型 .参数 线程环境, context_ .DLL命令 GetThreadContext1, 逻辑型, "kernel32", "GetThreadContext", 公开 .参数 线程句柄, 整数型 .参数 寄存器, 寄存器 .DLL命令 GetWindow, 整数型, "user32", "GetWindow", 公开, 获得一个窗口的句柄,该窗口与某源窗口有特定的关系 由wCmd决定的一个窗口的句柄。如没有找到相符窗口,或者遇到错误,则返回零值。会设置GetLastError .参数 源窗口, 整数型, , 源窗口 .参数 关系, 整数型, , 指定结果窗口与源窗口的关系,它们建立在下述常数基础上:;GW_CHILD:寻找源窗口的第一个子窗口;GW_HWNDFIRST:为一个源子窗口寻找第一个兄弟(同级)窗口,或寻找第一个顶级窗口;GW_HWNDLAST:为一个源子窗口寻找最后一个兄弟(同级)窗口,或寻找最后一个顶级窗口;GW_HWNDNEXT:为源窗口寻找下一个兄弟窗口;GW_HWNDPREV:为源窗口寻找前一个兄弟窗口;GW_OWNER:寻找窗口的所有者; .DLL命令 GetWindowText, 整数型, "user32.dll", "GetWindowTextA", 公开, 取得一个窗体的标题(caption)文字,或者一个控件的内容(在vb里使用:使用vb窗体或控件的caption或text属性) 复制到lpString的字串长度;不包括空中止字符。会设置GetLastError .参数 句柄, 整数型, , 欲获取文字的那个窗口的句柄 .参数 文本, 文本型, , 预定义的一个缓冲区,至少有cch+1个字符大小;随同窗口文字载入 .参数 文本长度, 整数型, , lp缓冲区的长度; .DLL命令 GetWindowTextLength, 整数型, "user32", "GetWindowTextLengthA", 公开, 调查窗口标题文字或控件内容的长短(在vb里使用:直接使用vb窗体或控件的caption或text属性) 字串长度,不包括空中止字符 .参数 hwnd, 整数型, , 想调查文字长度的窗口的句柄; .DLL命令 GetWindowThreadProcessId, 整数型, "user32.dll", "GetWindowThreadProcessId", 公开, GetWindowThreadProcessId,获取与指定窗口关联在一起的一个线程和进程标识符 .参数 窗口句柄, 整数型, , hwnd,指定窗口句柄 .参数 进程标识符, 整数型, 传址, lpdwProcessId,指定一个变量,用于装载拥有那个窗口的一个进程的标识符 .DLL命令 KillTimer, 整数型, "user32.dll", "KillTimer", 公开 .参数 窗口句柄, 整数型, , hwnd .参数 事件标识符, 整数型, , nIDEvent .DLL命令 LoadLibraryA, 整数型, "kernel32.dll", "LoadLibraryA", 公开, , 载入指定的动态链接库,并将它映射到当前进程使用的地址空间 .参数 动态链接库名称, 文本型, , lpLibFileName,指定要载入的动态链接库的名称 .DLL命令 LookupPrivilegeValueA, 逻辑型, "advapi32.dll", "LookupPrivilegeValueA", 公开 .参数 lpSystemName, 文本型 .参数 lpName, 文本型 .参数 lpLuid, LuID, 传址 .DLL命令 Module32First, 整数型, "kernel32.dll", "Module32First", 公开 .参数 hSnapshot, 整数型, , hSnapshot .参数 模块进程结构, MODULEENTRY32, 传址 .DLL命令 Module32Next, 整数型, "kernel32.dll", "Module32Next", 公开 .参数 hSnapshot, 整数型, , hSnapshot .参数 模块进程结构, MODULEENTRY32, 传址 .DLL命令 OpenProcess, 整数型, "kernel32.dll", "OpenProcess", 公开, kernel32.dll .参数 访问级别, 整数型, , 2035711完全访问 .参数 子进程继承, 逻辑型, , 0为子进程继承 .参数 进程ID, 整数型, , 要打开的进程标识 .DLL命令 OpenProcessToken, 整数型, "advapi32.dll", "OpenProcessToken", 公开 .参数 ProcessHandle, 整数型 .参数 DesiredAccess, 整数型 .参数 TokenHandle, 整数型, 传址 .DLL命令 OpenThread, 整数型, "kernel32.dll", "OpenThread", 公开 .参数 dwDesiredAccess, 整数型 .参数 bInheritHandle, 逻辑型 .参数 dwThreadId, 整数型 .DLL命令 Process32First, 整数型, "kernel32.dll", "Process32First", 公开, 取进程快照第一个进程信息返回内存指针 .参数 快照句柄, 整数型 .参数 进程信息, 进程信息 .DLL命令 Process32Next, 整数型, "kernel32.dll", "Process32Next", 公开 .参数 快照句柄, 整数型 .参数 进程信息, 进程信息 .DLL命令 ReadProcessMemory, 整数型, "kernel32.dll", "ReadProcessMemory", 公开, 在进程中读内存数据 地址1048576 .参数 进程句柄, 整数型, , 欲读取的进程句柄(可用OpenProcess函数得到) .参数 地址, 整数型, , 读取的起始地址 .参数 返回内容, 字节集, 传址, 返回的数据,其类型可设为整数、文本和字节集 .参数 长度, 整数型, , 一次读取的字节长度(读取的字节数4) .参数 实际长度, 整数型, 传址, 实际读取的字节长度 .DLL命令 RegOpenKeyExA, 整数型, , "RegOpenKeyExA", 公开, 打开注册表项 .参数 hKey, 整数型 .参数 lpSubKey, 文本型 .参数 ulOptions, 整数型 .参数 samDesired, 整数型 .参数 phkResult, 整数型, 传址 .DLL命令 ResumeThread, 整数型, "kernel32.dll", "ResumeThread", 公开, 开始暂停的线程 .参数 线程句柄, 整数型 .DLL命令 RtlMoveMemory, 整数型, , "RtlMoveMemory", 公开 .参数 lpvDest, 整数型, 传址 .参数 lpvSource, 整数型 .参数 cbCopy, 整数型 .DLL命令 SetThreadContext, 逻辑型, "kernel32", "SetThreadContext", 公开 .参数 hThreadId, 整数型 .参数 线程环境, context_ .DLL命令 SetThreadContext1, 逻辑型, "kernel32", "SetThreadContext", 公开 .参数 线程句柄, 整数型 .参数 寄存器, 寄存器 .DLL命令 SetTimer, 整数型, "user32.dll", "SetTimer", 公开 .参数 窗口句柄, 整数型, , hwnd .参数 事件标识符, 整数型, , nIDEvent .参数 时钟周期, 整数型, , uElapse .参数 回调函数地址, 整数型, , lpTimerFunc .DLL命令 SetWindowsHookEx, 整数型, "user32.dll", "SetWindowsHookExA", 公开 .参数 钩子类型, 整数型 .参数 处理函数入口, 整数型 .参数 函数所在模块, 整数型 .参数 目标线程ID, 整数型 .DLL命令 SHFileOperation, 整数型, "Shell32.dll", "SHFileOperationA", 公开 .参数 文件参数, SHFILEOPSTRUCT .DLL命令 SuspendThread, 整数型, , "SuspendThread", 公开 .参数 线程句柄, 整数型 .DLL命令 TerminateProcess, 整数型, "kernel32.dll", "TerminateProcess", 公开, 成功返回非零 .参数 进程句柄, 整数型 .参数 退出代码, 整数型, , 传入0 .DLL命令 TerminateThread, 逻辑型, "kernel32", "TerminateThread", 公开 .参数 hThread, 整数型 .参数 dwExitCode, 整数型 .DLL命令 Thread32First, 逻辑型, "kernel32.dll", "Thread32First", 公开 .参数 hSnapshot, 整数型 .参数 lpte, THREADENTRY32, 传址 .DLL命令 Thread32Next, 逻辑型, "kernel32.dll", "Thread32Next", 公开 .参数 hSnapshot, 整数型 .参数 lpte, THREADENTRY32, 传址 .DLL命令 VirtualAllocEx, 整数型, "kernel32.dll", "VirtualAllocEx", 公开, 成功返回分配内存的首地址,失败返回0 .参数 hProcess, 整数型, , 申请内存所在的进程句柄 .参数 lpAddress, 整数型, , 填0 .参数 dwSize, 整数型, , 欲分配的内存大小 .参数 flAllocationType, 整数型, , 填4096,MEM_COMMI .参数 flProtect, 整数型, , 填64,可读可写,可执行 .DLL命令 VirtualFreeEx, 整数型, "kernel32.dll", "VirtualFreeEx", 公开 .参数 hProcess, 整数型 .参数 lpAddress, 整数型 .参数 dwSize, 整数型, , 填0 .参数 dwFreeType, 整数型, , 填32768 .DLL命令 VirtualProtect, 整数型, "kernel32.dll", "VirtualProtect", 公开, 成功返回非0,失败返回0 .参数 起始地址, 整数型, , lpAddress .参数 长度, 整数型, , dwSize .参数 新保护权限, 整数型, , 可读写权限(PAGE_READWRITE)=4;PAGE_EXECUTE_READWRITE=64 .参数 旧保护权限, 整数型, 传址, 保存旧属性的结构变量地址 .DLL命令 VirtualProtectEx, 整数型, "kernel32.dll", "VirtualProtectEx", 公开, 成功返回非0,失败返回0 .参数 hprocess, 整数型, , 要修改内存的进程句柄 .参数 起始地址, 整数型, , lpAddress .参数 长度, 整数型, , dwSize .参数 新保护权限, 整数型, , 可读写权限(PAGE_READWRITE)=4 .参数 旧保护权限, 整数型, 传址, 保存旧属性的结构变量地址 .DLL命令 VirtualQueryEx, 整数型, "kernel32.dll", "VirtualQueryEx", 公开 .参数 hProcess, 整数型 .参数 lpAddress, 整数型 .参数 info, MEMORY_BASIC_INFORMATION, 传址 .参数 dwLength, 整数型 .DLL命令 VMProtectBegin, , "VMProtectSDK32.lib", "_VMProtectBegin@4", 公开, 功能:设置开始标记 .参数 MarkerName, 文本型, 传址, 标记名 .DLL命令 VMProtectBeginMutation, , "VMProtectSDK32.lib", "_VMProtectBeginMutation@4", 公开, 功能:设置[变异]标记 .参数 MarkerName, 文本型, 传址, 标记名 .DLL命令 VMProtectBeginUltra, , "VMProtectSDK32.lib", "_VMProtectBeginUltra@4", 公开, 功能:设置[虚拟+变异]标记 .参数 MarkerName, 文本型, 传址 .DLL命令 VMProtectBeginUltraLockByKey, , "VMProtectSDK32.lib", "_VMProtectBeginUltraLockByKey@4", 公开 .参数 MarkerName, 文本型, 传址, 标记名 .DLL命令 VMProtectBeginVirtualization, , "VMProtectSDK32.lib", "_VMProtectBeginVirtualization@4", 公开, 功能:设置[虚拟]标记 .参数 MarkerName, 文本型, 传址, 标记名 .DLL命令 VMProtectBeginVirtualizationLockByKey, , "VMProtectSDK32.lib", "_VMProtectBeginVirtualizationLockByKey@4", 公开 .参数 MarkerName, 文本型, 传址 .DLL命令 VMProtectDecryptStringA, 整数型, "VMProtectSDK32.lib", "_VMProtectDecryptStringA@4", 公开, 功能:加密Ansi字符串常量,返回加密后的字符串指针 .参数 char, 文本型, 传址, 提供Ansi字符串常量 .DLL命令 VMProtectDecryptStringW, 整数型, "VMProtectSDK32.lib", "_VMProtectDecryptStringW@4", 公开, 功能:加Unicode字符串,返回加密后的字符串指针 .参数 wchar_t, 文本型, 传址, 提供Unicode字符串常量 .DLL命令 VMProtectEnd, , "VMProtectSDK32.lib", "_VMProtectEnd@0", 公开, 功能:设置与虚拟/变异等功能配对的结束标记 .DLL命令 VMProtectIsDebuggerPresent, 逻辑型, "VMProtectSDK32.lib", "_VMProtectIsDebuggerPresent@4", 公开, 功能:检测调试器是否存在 .参数 CheckKernelMode, 逻辑型, , 是否检测KernelMode调试器.为假,则检测user-mode调试器,例如OllyDBG, WinDBG等..为真,则同时检测user-mode和KernelMode(包括SoftICE, Syser等...)调试器, .DLL命令 VMProtectIsValidImageCRC, 逻辑型, "VMProtectSDK32.lib", "_VMProtectIsValidImageCRC@0", 公开, 功能:检测程序内存没有没有被改变 .DLL命令 VMProtectIsVirtualMachinePresent, 逻辑型, "VMProtectSDK32.lib", "_VMProtectIsVirtualMachinePresent@0", 公开, 功能:检测程序是否运行在虚拟机,比如VMware, Virtual PC, VirtualBox, Sandboxie等... .DLL命令 WaitForSingleObject, 整数型, "kernel32.dll", "WaitForSingleObject", 公开 .参数 hHandle, 整数型 .参数 dwMilliseconds, 整数型, , 填-1 .DLL命令 WriteProcessMemory, 逻辑型, "kernel32.dll", "WriteProcessMemory", 公开 .参数 进程句柄, 整数型 .参数 开始写入进址, 整数型, , 内存地址 .参数 写入数值数据, 字节集, 传址, 数据指针 .参数 写入长度, 整数型, , 长度 .参数 实际写入长度, 整数型, , 实际写出长度0 .DLL命令 取文本指针, 整数型, "kernel32", "lstrcpyn", 公开, 感谢海洋老师的例程 .参数 变量, , 传址, 一定要传址 .参数 变量, , 传址, 一定要传址.重复一次,骗骗Windows:) .参数 保留, 整数型, , 0 .图片 SE_PROTECT_END, 公开, 置入代码 (#SE_PROTECT_END)'结束标记 .图片 SE_PROTECT_START, 公开, 置入代码 (#SE_PROTECT_START)'默认保护 .图片 SE_PROTECT_START_MUTATION, 公开, 置入代码 (#SE_PROTECT_START_MUTATION)'乱序变形 .图片 SE_PROTECT_START_ULTRA, 公开, 置入代码 (#SE_PROTECT_START_ULTRA)'乱序+虚拟 .图片 SE_PROTECT_START_VIRTUALIZATION, 公开, 置入代码 (#SE_PROTECT_START_VIRTUALIZATION)'虚拟 .图片 SE_UNPROTECT_END, 公开, 置入代码 (#SE_UNPROTECT_END)'屏蔽特定代码的乱序和混淆 .图片 SE_UNPROTECT_START, 公开, 置入代码 (#SE_UNPROTECT_START)'屏蔽特定代码的乱序和混淆 .图片 VMProtect_Begin, 公开, 置入代码 (#VMProtect_Begin) 'VMP保护开始标志 .图片 VMProtect_End, 公开, 置入代码 (#VMProtect_End) 'VMP保护结束标志
Hook API Lib 0.5.rar Hook API Lib 0.51.rar /* ////////////////////////////////////////////////////////////////////////// HookApi 0.5 thanks to xIkUg ,sucsor by 海风月影[RCT] , eIcn#live.cn 2008.04.15 ////////////////////////////////////////////////////////////////////////// //更新内容 2008.04.15 0.5 1,重新写了Stub,换了一种模式,使hook更加自由,将hookbefore和hookafter合并 HookProc的定义方式与以前有所不同: HookProc的函数类型和原来的api一样,只是参数比原API多2个 DWORD WINAPI HookProc(DWORD RetAddr ,__pfnXXXX pfnXXXX, ...); //参数比原始的API多2个参数 RetAddr //调用api的返回地址 pfnXXX //类型为__pfnXXXX,待hook的api的声明类型,用于调用未被hook的api 详见My_LoadLibraryA 原始的LoadLibraryA的声明是: HMODULE WINAPI LoadLibraryA( LPCSTR lpLibFileName ); 那么首先定义一下hook的WINAPI的类型 typedef HMODULE (WINAPI __pfnLoadLibraryA)(LPCTSTR lpFileName); 然后hookproc的函数声明如下: HMODULE WINAPI My_LoadLibraryA(DWORD RetAddr, __pfnLoadLibraryA pfnLoadLibraryA, LPCTSTR lpFileName ); 比原来的多了2个参数,参数位置不能颠倒,在My_LoadLibraryA中可以自由的调用未被hook的pfnLoadLibraryA 也可以调用系统的LoadLibraryA,不过要自己在hookproc中处理好重入问题 另外,也可以在My_LoadLibraryA中使用UnInstallHookApi()函数来卸载hook,用法如下: 将第二个参数__pfnLoadLibraryA pfnLoadLibraryA强制转换成PHOOKENVIRONMENT类型,使用UnInstallHookApi来卸载 例如: UnInstallHookApi((PHOOKENVIRONMENT)pfnLoadLibraryA); 至于以前版本的HookBefore和HookAfter,完全可以在自己的HookProc里面灵活使用了 2,支持卸载hook InstallHookApi()调用后会返回一个PHOOKENVIRONMENT类型的指针 需要卸载的时候可以使用UnInstallHookApi(PHOOKENVIRONMENT pHookEnv)来卸载 在HookProc中也可以使用UnInstallHookApi来卸载,参数传入HookProc中的第二个参数 ★★注意: 1,如果在HookProc中自己不调用API(pfnXXXXX()),那么返回后,Stub是不会调用的,切记! 2,当HookProc中使用UnInstallHookApi卸载完后就不能用第二个参数来调用API了(pfnXXXX()),切记! 2008.04.15 0.41 1,前面的deroko的LdeX86 有BUG,678b803412 会算错 换了一个LDX32,代码更少,更容易理解 2,修复了VirtualProtect的一个小BUG 0.4以前 改动太大了,前面的就不写了 */ #include #include #include "HookApi.h" BYTE JMPGate[5] = { 0xE9, 0x00, 0x00, 0x00, 0x00 // JMP XXXXXXXX }; ////////////////////////////////////////////////////////////////////////// //另一个LDX32 #define C_ERROR 0xFFFFFFFF #define C_PREFIX 0x00000001 #define C_66 0x00000002 #define C_67 0x00000004 #define C_DATA66 0x00000008 #define C_DATA1 0x00000010 #define C_DATA2 0x00000020 #define C_DATA4 0x00000040 #define C_MEM67 0x00000080 #define C_MEM1 0x00000100 #define C_MEM2 0x00000200 #define C_MEM4 0x00000400 #define C_MODRM 0x00000800 #define C_DATAW0 0x00001000 #define C_FUCKINGTEST 0x00002000 #define C_TABLE_0F 0x00004000 DWORD table_1[256] = { /* 00 */ C_MODRM /* 01 */, C_MODRM /* 02 */, C_MODRM /* 03 */, C_MODRM /* 04 */, C_DATAW0 /* 05 */, C_DATAW0 /* 06 */, 0 /* 07 */, 0 /* 08 */, C_MODRM /* 09 */, C_MODRM /* 0A */, C_MODRM /* 0B */, C_MODRM /* 0C */, C_DATAW0 /* 0D */, C_DATAW0 /* 0E */, 0 /* 0F */, C_TABLE_0F /* 10 */, C_MODRM /* 11 */, C_MODRM /* 12 */, C_MODRM /* 13 */, C_MODRM /* 14 */, C_DATAW0 /* 15 */, C_DATAW0 /* 16 */, 0 /* 17 */, 0 /* 18 */, C_MODRM /* 19 */, C_MODRM /* 1A */, C_MODRM /* 1B */, C_MODRM /* 1C */, C_DATAW0 /* 1D */, C_DATAW0 /* 1E */, 0 /* 1F */, 0 /* 20 */, C_MODRM /* 21 */, C_MODRM /* 22 */, C_MODRM /* 23 */, C_MODRM /* 24 */, C_DATAW0 /* 25 */, C_DATAW0 /* 26 */, C_PREFIX /* 27 */, 0 /* 28 */, C_MODRM /* 29 */, C_MODRM /* 2A */, C_MODRM /* 2B */, C_MODRM /* 2C */, C_DATAW0 /* 2D */, C_DATAW0 /* 2E */, C_PREFIX /* 2F */, 0 /* 30 */, C_MODRM /* 31 */, C_MODRM /* 32 */, C_MODRM /* 33 */, C_MODRM /* 34 */, C_DATAW0 /* 35 */, C_DATAW0 /* 36 */, C_PREFIX /* 37 */, 0 /* 38 */, C_MODRM /* 39 */, C_MODRM /* 3A */, C_MODRM /* 3B */, C_MODRM /* 3C */, C_DATAW0 /* 3D */, C_DATAW0 /* 3E */, C_PREFIX /* 3F */, 0 /* 40 */, 0 /* 41 */, 0 /* 42 */, 0 /* 43 */, 0 /* 44 */, 0 /* 45 */, 0 /* 46 */, 0 /* 47 */, 0 /* 48 */, 0 /* 49 */, 0 /* 4A */, 0 /* 4B */, 0 /* 4C */, 0 /* 4D */, 0 /* 4E */, 0 /* 4F */, 0 /* 50 */, 0 /* 51 */, 0 /* 52 */, 0 /* 53 */, 0 /* 54 */, 0 /* 55 */, 0 /* 56 */, 0 /* 57 */, 0 /* 58 */, 0 /* 59 */, 0 /* 5A */, 0 /* 5B */, 0 /* 5C */, 0 /* 5D */, 0 /* 5E */, 0 /* 5F */, 0 /* 60 */, 0 /* 61 */, 0 /* 62 */, C_MODRM /* 63 */, C_MODRM /* 64 */, C_PREFIX /* 65 */, C_PREFIX /* 66 */, C_PREFIX+C_66 /* 67 */, C_PREFIX+C_67 /* 68 */, C_DATA66 /* 69 */, C_MODRM+C_DATA66 /* 6A */, C_DATA1 /* 6B */, C_MODRM+C_DATA1 /* 6C */, 0 /* 6D */, 0 /* 6E */, 0 /* 6F */, 0 /* 70 */, C_DATA1 /* 71 */, C_DATA1 /* 72 */, C_DATA1 /* 73 */, C_DATA1 /* 74 */, C_DATA1 /* 75 */, C_DATA1 /* 76 */, C_DATA1 /* 77 */, C_DATA1 /* 78 */, C_DATA1 /* 79 */, C_DATA1 /* 7A */, C_DATA1 /* 7B */, C_DATA1 /* 7C */, C_DATA1 /* 7D */, C_DATA1 /* 7E */, C_DATA1 /* 7F */, C_DATA1 /* 80 */, C_MODRM+C_DATA1 /* 81 */, C_MODRM+C_DATA66 /* 82 */, C_MODRM+C_DATA1 /* 83 */, C_MODRM+C_DATA1 /* 84 */, C_MODRM /* 85 */, C_MODRM /* 86 */, C_MODRM /* 87 */, C_MODRM /* 88 */, C_MODRM /* 89 */, C_MODRM /* 8A */, C_MODRM /* 8B */, C_MODRM /* 8C */, C_MODRM /* 8D */, C_MODRM /* 8E */, C_MODRM /* 8F */, C_MODRM /* 90 */, 0 /* 91 */, 0 /* 92 */, 0 /* 93 */, 0 /* 94 */, 0 /* 95 */, 0 /* 96 */, 0 /* 97 */, 0 /* 98 */, 0 /* 99 */, 0 /* 9A */, C_DATA66+C_MEM2 /* 9B */, 0 /* 9C */, 0 /* 9D */, 0 /* 9E */, 0 /* 9F */, 0 /* A0 */, C_MEM67 /* A1 */, C_MEM67 /* A2 */, C_MEM67 /* A3 */, C_MEM67 /* A4 */, 0 /* A5 */, 0 /* A6 */, 0 /* A7 */, 0 /* A8 */, C_DATA1 /* A9 */, C_DATA66 /* AA */, 0 /* AB */, 0 /* AC */, 0 /* AD */, 0 /* AE */, 0 /* AF */, 0 /* B0 */, C_DATA1 /* B1 */, C_DATA1 /* B2 */, C_DATA1 /* B3 */, C_DATA1 /* B4 */, C_DATA1 /* B5 */, C_DATA1 /* B6 */, C_DATA1 /* B7 */, C_DATA1 /* B8 */, C_DATA66 /* B9 */, C_DATA66 /* BA */, C_DATA66 /* BB */, C_DATA66 /* BC */, C_DATA66 /* BD */, C_DATA66 /* BE */, C_DATA66 /* BF */, C_DATA66 /* C0 */, C_MODRM+C_DATA1 /* C1 */, C_MODRM+C_DATA1 /* C2 */, C_DATA2 /* C3 */, 0 /* C4 */, C_MODRM /* C5 */, C_MODRM /* C6 */, C_MODRM+C_DATA66 /* C7 */, C_MODRM+C_DATA66 /* C8 */, C_DATA2+C_DATA1 /* C9 */, 0 /* CA */, C_DATA2 /* CB */, 0 /* CC */, 0 /* CD */, C_DATA1+C_DATA4 /* CE */, 0 /* CF */, 0 /* D0 */, C_MODRM /* D1 */, C_MODRM /* D2 */, C_MODRM /* D3 */, C_MODRM /* D4 */, 0 /* D5 */, 0 /* D6 */, 0 /* D7 */, 0 /* D8 */, C_MODRM /* D9 */, C_MODRM /* DA */, C_MODRM /* DB */, C_MODRM /* DC */, C_MODRM /* DD */, C_MODRM /* DE */, C_MODRM /* DF */, C_MODRM /* E0 */, C_DATA1 /* E1 */, C_DATA1 /* E2 */, C_DATA1 /* E3 */, C_DATA1 /* E4 */, C_DATA1 /* E5 */, C_DATA1 /* E6 */, C_DATA1 /* E7 */, C_DATA1 /* E8 */, C_DATA66 /* E9 */, C_DATA66 /* EA */, C_DATA66+C_MEM2 /* EB */, C_DATA1 /* EC */, 0 /* ED */, 0 /* EE */, 0 /* EF */, 0 /* F0 */, C_PREFIX /* F1 */, 0 // 0xF1 /* F2 */, C_PREFIX /* F3 */, C_PREFIX /* F4 */, 0 /* F5 */, 0 /* F6 */, C_FUCKINGTEST /* F7 */, C_FUCKINGTEST /* F8 */, 0 /* F9 */, 0 /* FA */, 0 /* FB */, 0 /* FC */, 0 /* FD */, 0 /* FE */, C_MODRM /* FF */, C_MODRM }; // table_1 DWORD table_0F[256] = { /* 00 */ C_MODRM /* 01 */, C_MODRM /* 02 */, C_MODRM /* 03 */, C_MODRM /* 04 */, -1 /* 05 */, -1 /* 06 */, 0 /* 07 */, -1 /* 08 */, 0 /* 09 */, 0 /* 0A */, 0 /* 0B */, 0 /* 0C */, -1 /* 0D */, -1 /* 0E */, -1 /* 0F */, -1 /* 10 */, -1 /* 11 */, -1 /* 12 */, -1 /* 13 */, -1 /* 14 */, -1 /* 15 */, -1 /* 16 */, -1 /* 17 */, -1 /* 18 */, -1 /* 19 */, -1 /* 1A */, -1 /* 1B */, -1 /* 1C */, -1 /* 1D */, -1 /* 1E */, -1 /* 1F */, -1 /* 20 */, -1 /* 21 */, -1 /* 22 */, -1 /* 23 */, -1 /* 24 */, -1 /* 25 */, -1 /* 26 */, -1 /* 27 */, -1 /* 28 */, -1 /* 29 */, -1 /* 2A */, -1 /* 2B */, -1 /* 2C */, -1 /* 2D */, -1 /* 2E */, -1 /* 2F */, -1 /* 30 */, -1 /* 31 */, -1 /* 32 */, -1 /* 33 */, -1 /* 34 */, -1 /* 35 */, -1 /* 36 */, -1 /* 37 */, -1 /* 38 */, -1 /* 39 */, -1 /* 3A */, -1 /* 3B */, -1 /* 3C */, -1 /* 3D */, -1 /* 3E */, -1 /* 3F */, -1 /* 40 */, -1 /* 41 */, -1 /* 42 */, -1 /* 43 */, -1 /* 44 */, -1 /* 45 */, -1 /* 46 */, -1 /* 47 */, -1 /* 48 */, -1 /* 49 */, -1 /* 4A */, -1 /* 4B */, -1 /* 4C */, -1 /* 4D */, -1 /* 4E */, -1 /* 4F */, -1 /* 50 */, -1 /* 51 */, -1 /* 52 */, -1 /* 53 */, -1 /* 54 */, -1 /* 55 */, -1 /* 56 */, -1 /* 57 */, -1 /* 58 */, -1 /* 59 */, -1 /* 5A */, -1 /* 5B */, -1 /* 5C */, -1 /* 5D */, -1 /* 5E */, -1 /* 5F */, -1 /* 60 */, -1 /* 61 */, -1 /* 62 */, -1 /* 63 */, -1 /* 64 */, -1 /* 65 */, -1 /* 66 */, -1 /* 67 */, -1 /* 68 */, -1 /* 69 */, -1 /* 6A */, -1 /* 6B */, -1 /* 6C */, -1 /* 6D */, -1 /* 6E */, -1 /* 6F */, -1 /* 70 */, -1 /* 71 */, -1 /* 72 */, -1 /* 73 */, -1 /* 74 */, -1 /* 75 */, -1 /* 76 */, -1 /* 77 */, -1 /* 78 */, -1 /* 79 */, -1 /* 7A */, -1 /* 7B */, -1 /* 7C */, -1 /* 7D */, -1 /* 7E */, -1 /* 7F */, -1 /* 80 */, C_DATA66 /* 81 */, C_DATA66 /* 82 */, C_DATA66 /* 83 */, C_DATA66 /* 84 */, C_DATA66 /* 85 */, C_DATA66 /* 86 */, C_DATA66 /* 87 */, C_DATA66 /* 88 */, C_DATA66 /* 89 */, C_DATA66 /* 8A */, C_DATA66 /* 8B */, C_DATA66 /* 8C */, C_DATA66 /* 8D */, C_DATA66 /* 8E */, C_DATA66 /* 8F */, C_DATA66 /* 90 */, C_MODRM /* 91 */, C_MODRM /* 92 */, C_MODRM /* 93 */, C_MODRM /* 94 */, C_MODRM /* 95 */, C_MODRM /* 96 */, C_MODRM /* 97 */, C_MODRM /* 98 */, C_MODRM /* 99 */, C_MODRM /* 9A */, C_MODRM /* 9B */, C_MODRM /* 9C */, C_MODRM /* 9D */, C_MODRM /* 9E */, C_MODRM /* 9F */, C_MODRM /* A0 */, 0 /* A1 */, 0 /* A2 */, 0 /* A3 */, C_MODRM /* A4 */, C_MODRM+C_DATA1 /* A5 */, C_MODRM /* A6 */, -1 /* A7 */, -1 /* A8 */, 0 /* A9 */, 0 /* AA */, 0 /* AB */, C_MODRM /* AC */, C_MODRM+C_DATA1 /* AD */, C_MODRM /* AE */, -1 /* AF */, C_MODRM /* B0 */, C_MODRM /* B1 */, C_MODRM /* B2 */, C_MODRM /* B3 */, C_MODRM /* B4 */, C_MODRM /* B5 */, C_MODRM /* B6 */, C_MODRM /* B7 */, C_MODRM /* B8 */, -1 /* B9 */, -1 /* BA */, C_MODRM+C_DATA1 /* BB */, C_MODRM /* BC */, C_MODRM /* BD */, C_MODRM /* BE */, C_MODRM /* BF */, C_MODRM /* C0 */, C_MODRM /* C1 */, C_MODRM /* C2 */, -1 /* C3 */, -1 /* C4 */, -1 /* C5 */, -1 /* C6 */, -1 /* C7 */, -1 /* C8 */, 0 /* C9 */, 0 /* CA */, 0 /* CB */, 0 /* CC */, 0 /* CD */, 0 /* CE */, 0 /* CF */, 0 /* D0 */, -1 /* D1 */, -1 /* D2 */, -1 /* D3 */, -1 /* D4 */, -1 /* D5 */, -1 /* D6 */, -1 /* D7 */, -1 /* D8 */, -1 /* D9 */, -1 /* DA */, -1 /* DB */, -1 /* DC */, -1 /* DD */, -1 /* DE */, -1 /* DF */, -1 /* E0 */, -1 /* E1 */, -1 /* E2 */, -1 /* E3 */, -1 /* E4 */, -1 /* E5 */, -1 /* E6 */, -1 /* E7 */, -1 /* E8 */, -1 /* E9 */, -1 /* EA */, -1 /* EB */, -1 /* EC */, -1 /* ED */, -1 /* EE */, -1 /* EF */, -1 /* F0 */, -1 /* F1 */, -1 /* F2 */, -1 /* F3 */, -1 /* F4 */, -1 /* F5 */, -1 /* F6 */, -1 /* F7 */, -1 /* F8 */, -1 /* F9 */, -1 /* FA */, -1 /* FB */, -1 /* FC */, -1 /* FD */, -1 /* FE */, -1 /* FF */, -1 }; // table_0F #pragma comment(linker, "/SECTION:HookStub,RW") #define NAKED __declspec(naked) #define ALLOCATE(x1) __declspec(allocate(#x1)) #define ALLOCATE_HookStub ALLOCATE(HookStub) #define ReloCationForADDR(x1,delta) ((DWORD(&x1) + delta)) #define ReloCationForDWORD(x1,delta) (*(LPDWORD(DWORD(&x1) + delta))) #define ReloCataonForTCHAR(x1,delta) (LPCTSTR(DWORD(&x1) + delta)) #define ReloCationForLP(x1,delta) (__##x1(ReloCationForDWORD(x1,delta))) #pragma code_seg("HookStub") #pragma optimize("",off) ALLOCATE_HookStub HOOKENVIRONMENT pEnv={0}; NAKED DWORD GetDelta() { __asm { call next next: pop eax sub eax,offset next ret } } NAKED void NewStub() { __asm { jmp next back: _emit 0xE9 NOP NOP NOP NOP next: push [esp] push [esp] push eax //保存一下Stub中唯一使用到的EAX call GetDelta lea eax,[eax+pEnv] mov dword ptr [esp+0xC],eax pop eax //恢复EAX jmp back } } NAKED DWORD GetEndAddr() { __asm { call next next: pop eax sub eax,5 ret } } #pragma optimize("",off) #pragma code_seg() DWORD __stdcall GetOpCodeSize(BYTE* iptr0) { BYTE* iptr = iptr0; DWORD f = 0; prefix: BYTE b = *iptr++; f |= table_1[b]; if (f&C_FUCKINGTEST) if (((*iptr)&0x38)==0x00) // ttt f=C_MODRM+C_DATAW0; // TEST else f=C_MODRM; // NOT,NEG,MUL,IMUL,DIV,IDIV if (f&C_TABLE_0F) { b = *iptr++; f = table_0F[b]; } if (f==C_ERROR) { //printf("error in X\n",b); return C_ERROR; } if (f&C_PREFIX) { f&=~C_PREFIX; goto prefix; } if (f&C_DATAW0) if (b&0x01) f|=C_DATA66; else f|=C_DATA1; if (f&C_MODRM) { b = *iptr++; BYTE mod = b & 0xC0; BYTE rm = b & 0x07; if (mod!=0xC0) { if (f&C_67) // modrm16 { if ((mod==0x00)&&(rm==0x06)) f|=C_MEM2; if (mod==0x40) f|=C_MEM1; if (mod==0x80) f|=C_MEM2; } else // modrm32 { if (mod==0x40) f|=C_MEM1; if (mod==0x80) f|=C_MEM4; if (rm==0x04) rm = (*iptr++) & 0x07; // rm<-sib.base if ((rm==0x05)&&(mod==0x00)) f|=C_MEM4; } } } // C_MODRM if (f&C_MEM67) if (f&C_67) f|=C_MEM2; else f|=C_MEM4; if (f&C_DATA66) if (f&C_66) f|=C_DATA2; else f|=C_DATA4; if (f&C_MEM1) iptr++; if (f&C_MEM2) iptr+=2; if (f&C_MEM4) iptr+=4; if (f&C_DATA1) iptr++; if (f&C_DATA2) iptr+=2; if (f&C_DATA4) iptr+=4; return iptr - iptr0; } PHOOKENVIRONMENT __stdcall InstallHookApi(PCHAR DllName,PCHAR ApiName,PVOID HookProc) { HMODULE DllHandle; PVOID ApiEntry; int ReplaceCodeSize; DWORD oldpro; DWORD SizeOfStub; DWORD delta; DWORD RetSize =0; PHOOKENVIRONMENT pHookEnv; if (HookProc == NULL) { return NULL; } DllHandle = GetModuleHandle(DllName); if (DllHandle == NULL) DllHandle = LoadLibrary(DllName); if (DllHandle == NULL) return NULL; ApiEntry = GetProcAddress(DllHandle,ApiName); if (ApiEntry == NULL) return NULL; ReplaceCodeSize = GetOpCodeSize((BYTE*)ApiEntry); while (ReplaceCodeSize < 5) ReplaceCodeSize += GetOpCodeSize((BYTE*)((DWORD)ApiEntry + (DWORD)ReplaceCodeSize)); if (ReplaceCodeSize > 16) return NULL; SizeOfStub = GetEndAddr()-(DWORD)&pEnv; pHookEnv = (PHOOKENVIRONMENT)VirtualAlloc(NULL,SizeOfStub,MEM_COMMIT,PAGE_READWRITE); memset((void*)&pEnv,0x90,sizeof(pEnv)); CopyMemory(pHookEnv,(PVOID)&pEnv,SizeOfStub); CopyMemory((void*)pHookEnv,(void*)&pEnv,sizeof(pEnv.savebytes)); CopyMemory(pHookEnv->savebytes,ApiEntry,ReplaceCodeSize); pHookEnv->OrgApiAddr = ApiEntry; pHookEnv->SizeOfReplaceCode = ReplaceCodeSize; pHookEnv->jmptoapi[0]=0xE9; *(DWORD*)(&pHookEnv->jmptoapi[1]) = (DWORD)ApiEntry + ReplaceCodeSize - ((DWORD)pHookEnv->jmptoapi + 5); //patch api if (!VirtualProtect(ApiEntry,ReplaceCodeSize,PAGE_EXECUTE_READWRITE,&oldpro)) return FALSE; delta = (DWORD)pHookEnv - (DWORD)&pEnv; *(DWORD*)(&JMPGate[1]) = ((DWORD)NewStub + delta) - ((DWORD)ApiEntry + 5); WriteProcessMemory(GetCurrentProcess(), ApiEntry, JMPGate, sizeof(JMPGate),&RetSize); if (!VirtualProtect(ApiEntry,ReplaceCodeSize,oldpro,&oldpro)) return FALSE; //写入变量 *(DWORD*)((DWORD)NewStub + delta + 3) = (DWORD)HookProc - ((DWORD)NewStub + delta + 3 + 4); return pHookEnv; } BOOL __stdcall UnInstallHookApi(PHOOKENVIRONMENT pHookEnv) { DWORD oldpro; DWORD RetSize; //如果内存不存在了,则退出 if(IsBadReadPtr((const void*)pHookEnv,sizeof(HOOKENVIRONMENT))) return FALSE; if(!VirtualProtect(pHookEnv->OrgApiAddr,pHookEnv->SizeOfReplaceCode,PAGE_EXECUTE_READWRITE,&oldpro)) return FALSE; WriteProcessMemory(GetCurrentProcess(),pHookEnv->OrgApiAddr,pHookEnv->savebytes,pHookEnv->SizeOfReplaceCode,&RetSize); if(!VirtualProtect(pHookEnv->OrgApiAddr,pHookEnv->SizeOfReplaceCode,oldpro,&oldpro)) return FALSE; VirtualFree((LPVOID)pHookEnv,0,MEM_RELEASE); return TRUE; } //定义下面这行可以作为演示使用 //#define TEST_MAIN #ifdef TEST_MAIN BOOL IsMe = FALSE; //先定义一下要hook的WINAPI typedef HMODULE (WINAPI __pfnLoadLibraryA)(LPCTSTR lpFileName); HMODULE WINAPI My_LoadLibraryA(DWORD RetAddr, __pfnLoadLibraryA pfnLoadLibraryA, LPCTSTR lpFileName ) { HMODULE hLib; //需要自己处理重入和线程安全问题 if (!IsMe) { IsMe = TRUE; MessageBoxA(NULL,lpFileName,"test",MB_ICONINFORMATION); hLib = LoadLibrary(lpFileName);//这里调用的是系统的,已经被hook过的 IsMe = FALSE; //这里是卸载Hook,这里卸载完就不能用pfnLoadLibraryA来调用了 UnInstallHookApi((PHOOKENVIRONMENT)pfnLoadLibraryA); return hLib; } return pfnLoadLibraryA(lpFileName);//这里调用非hook的 } int main() { DWORD RetSize =0; DWORD dwThreadId; HANDLE hThread; PHOOKENVIRONMENT pHookEnv; pHookEnv = InstallHookApi("Kernel32.dll", "LoadLibraryA", My_LoadLibraryA); LoadLibrary("InjectDll.dll"); MessageBoxA(NULL,"Safe Here!!!","Very Good!!",MB_ICONINFORMATION); UnInstallHookApi(pHookEnv);//由于HookProc中卸载过了,所以这里的卸载就无效了 MessageBoxA(NULL,"UnInstall Success!!!","Good!!",MB_ICONINFORMATION); return 0; } #endif
Changes in 2.4.6 (February 22, 2011): Brief summary : - Support more host OS to run on: - Include win64 native binary in the release. - Fixed failures on big endian hosts. - BIOS: Support for up to 2M ROM BIOS images. - GUI: select mouse capture toggle method in .bochsrc. - Ported most of Qemu's 'virtual VFAT' block driver (except runtime write support, but plus FAT32 suppport) - Added write protect option for floppy drives. - Bugfixes / improved internal debugger + instrumentation. Detailed change log : - CPU and internal debugger - Implemented Process Context ID (PCID) feature - Implemented FS/GS BASE access instructions support (according to document from http://software.intel.com/en-us/avx/) - Rewritten from scratch SMC detection algorithm - Implemented fine-grained SMC detection (on 128 byte granularity) - Bugfixes for CPU emulation correctness and stability - Fixed failures on Big Endian hosts ! - Print detailed page walk information and attributes in internal debugger 'page' command - Updated/Fixed instrumentation callbacks - Configure and compile - Bochs now can be compiled as native Windows x86-64 application (tested with Mingw gcc 4.5.1 and Microsoft Visual Studio Express 2010) - Added ability to configure CPUID stepping through .bochsrc. The default stepping value is 3. - Added ability to disable MONITOR/MWAIT support through .bochsrc CPUID option. The option is available only if compiled with --enable-monitor-mwait configure option. - Determine and select max physical address size automatically at configure time: - 32-bit physical address for 386/486 guests - 36-bit physical address for PSE-36 enabled Pentium guest - 40-bit physical address for PAE enabled P6 or later guests - Update config.guess/config.sub scripts to May 2010 revisions. - Update Visual Studio 2008 project files in build/win32/vs2008ex-workspace.zip - Added Bochs compilation timestamp after Bochs version string. - GUI and display libraries (Volker) - Added new .bochsrc option to select mouse capture toggle method. In addition to the default Bochs method using the CTRL key and the middle mouse button there are now the choices: - CTRL+F10 (like DOSBox) - CTRL+ALT (like QEMU) - F12 (replaces win32 'legacyF12' option) - display library 'x' now uses the desktop size for the maximum guest resolution - ROM BIOS - Support for up to 2M ROM BIOS images - I/O Devices - 3 new 'pseudo device' plugins created by plugin separation (see below) - Fixes for emulated DHCP in eth_vnet (patch from @SF tracker) - Added support for VGA graphics mode with 400 lines (partial fix for SF bug #2948724) - NE2K: Fixed "send buffer" command issue on big endian hosts - USB - converted common USB code plus devices to the new 'usb_common' plugin Now the USB device classes no longer exist twice if both HC plugins are loaded. - added 'pseudo device' in common USB code for the device creation. This makes the HCs independent from the device specific code. - USB MSD: added support for disk image modes (like ATA disks) - USB printer: output file creation failure now causes a disconnect - re-implemented "options" parameter for additional options of connected devices (currently only used to set the speed reported by device and to specify an alternative redolog file of USB MSD disk image modes) - hard drive - new disk image mode 'vvfat' - ported the read-only part of Qemu's 'virtual VFAT' block driver - additions: configurable disk geometry, FAT32 support, read MBR and/or boot sector from file, volatile write support using hdimage redolog_t class, optional commit support on Bochs exit, save/restore file attributes, 1.44 MB floppy support, set file modification date/time - converted the complete hdimage stuff to the new 'hdimage' plugin - new hdimage method get_capabilities() that can return special flags - vmware3, vmware4 and vvfat classes now return HDIMAGE_HAS_GEOMETRY flag - other disk image modes by default return HDIMAGE_AUTO_GEOMETRY if cylinder value is set to 0 - multiple sector read/write support for some image modes - new log prefix "IMG" for hdimage messages - floppy - added write protect option for floppy drives (based on @SF patch by Ben Lunt) - vvfat support - bugfix: close images on exit - SB16 - converted the sound output module stuff to the new 'soundmod' plugin - SF patches applied [3164945] hack to compile under WIN64 by Darek Mihocka and Stanislav [3164073] Fine grain SMC invalidation by Stanislav [1539417] write protect for floppy drives by Ben Lunt [2862322] fixes for emulated DHCP in eth_vnet - these S.F. bugs were closed/fixed [2588085] Mouse capture [3140332] typo in mf3/ps2 mapping of BX_KEY_CTRL_R [3111577] No "back" option in log settings [3108422] Timing window in NE2K emulation [3084390] Bochs won't load floppy plugin right on startup [3043174] Docbook use of '_' build failure [3085140] Ia_arpl_Ew_Rw definition of error [3078995] ROL/ROR/SHL/SHR modeling wrong when dest reg is 32 bit [2864794] BX_INSTR_OPCODE in "cpu_loop" causes crash in x86_64 host [2884071] [AIX host] prefetch: EIP [00010000] > CS.limit [0000ffff] [3053542] 64 bit mode: far-jmp instruction is error [3011112] error compile vs2008/2010 with X2APIC [3002017] compile error with vs 2010 [3009767] guest RFLAGS.IF blocks externel interrupt in VMX guest mode [2964655] VMX not enabled in MSR IA32_FEATURE_CONTROL [3005865] IDT show bug [3001637] CMOS MAP register meaning error [2994370] Cannot build with 3DNow support - these S.F. feature requests were closed/implemented [1510142] Native Windows XP x64 Edition binary [1062553] select mouse (de)activation in bochsrc [2930633] legacy mouse capture key : not specific enough [2930679] Let user change mouse capture control key [2803538] Show flags for pages when using "info tab" ------------------------------------------------------------------------- Changes in 2.4.5 (April 25, 2010): Brief summary : - Major configure/cpu rework allowing to enable/disable CPU options at runtime through .bochsrc (Stanislav) - Bugfixes for CPU emulation correctness and stability - Implemented X2APIC extensions (Stanislav) - Implemented Intel VMXx2 extensions (Stanislav) - Extended VMX capability MSRs, APIC Virtualization, X2APIC Virtualization, Extended Page Tables (EPT), VPID, Unrestricted Guests, new VMX controls. - Implemented PCLMULQDQ AES instruction - Extended Bochs internal debugger functionality - USB HP DeskJet 920C printer device emulation (Ben Lunt) Detailed change log : - Configure rework - Deprecate --enable-popcnt configure option. POPCNT instruction will be enabled automatically iff SSE4_2 is supported (like in hardware). - Make --ignore-bad-msrs runtime option in .bochsrc. Old --ignore-bad-msrs configure option is deprecated and should not be used anymore. - Enable changing part of CPU functionality at runtime through .bochsrc. - Now you could enable/disable any of SSEx/AES/MOVBE/SYSENTER_SYSEXIT/XSAVE instruction sets using new CPUID option in .bochsrc. - When x86-64 support is compiled in, you could enable/disable long mode 1G pages support without recompile using new CPUID option in .bochsrc. Configure options: --enable-mmx, --enable-sse, --enable-movbe, --enable-xsave, --enable-sep, --enable-aes, --enable-1g-pages are deprecated and should not be used anymore. - Local APIC configure option --enable-apic is deprecated and should not be used anymore. The LAPIC option now automatically determined from other configure options. XAPIC functionality could be enabled using new CPUID .bochsrc option. - Changed default CPU configuration (generated by configure script with default options) to BX_CPU_LEVEL=6 with SSE2 enabled. - CPU - Implemented PCLMULQDQ AES instruction - Implemented X2APIC extensions / enable extended topology CPUID leaf (0xb), in order to enable X2APIC configure with --enable-x2apic - Implemented Intel VMXx2 extensions: - Enabled extended VMX capability MSRs - Implemented VMX controls for loading/storing of MSR_PAT and MSR_EFER - Enabled/Implemented secondary proc-based vmexec controls: - Implemented APIC virtualization - Implemented Extended Page Tables (EPT) mode - Implemented Descriptor Table Access VMEXIT control - Implemented RDTSCP VMEXIT control - Implemented Virtualize X2APIC mode control - Implemented Virtual Process ID (VPID) - Implemented WBINVD VMEXIT control - Implemented Unrestricted Guest mode In order to enable emulation of VMXx2 extensions configure with --enable-vmx=2 option (x86-64 must be enabled) - Bugfixes for CPU emulation correctness - Fixed Bochs crash when accessing the first byte above emulated memory size - Internal Debugger - Introduced range read/write physical watchpoints - Allow reloading of segment registers from internal debugger - Improved verbose physical memory access tracing - BIOS - Fix MTRR configuration (prevented boot of modern Linux kernels) - Fix interrupt vectors for INT 60h-66h (reserved for user interrupt) by setting them to zero - Fix BIOS INT13 function 08 when the number of cylinders on the disk = 1 - I/O Devices - USB HP DeskJet 920C printer device emulation (Ben Lunt) - Misc - Updated Bochs TESTFORM to version 0.5 - SF patches applied [2864402] outstanding x2apic patches by Stanislav [2960379] Fix build with -Wformat -Werror=format-security by Per Oyvind Karlsen [2938273] allow instrumentation to change execute by Konrad Grochowski [2926072] Indirection operators in expressions by Derek Peschel [2914433] makesym.perl misses symbols by John R. Jackson [2908481] USB Printer by Ben Lunt - these S.F. bugs were closed/fixed [2861662] dbg_xlate_linear2phy needs to be updated [2956217] INT13 AH=8 returns wrong values when cylinders=1 [2981161] Allow DMA transfers to continue when CPU is in HALT state [2795115] NX fault could be missed [2964824] bad newline sequence in aspi-win32.h [913419] configure options and build process needs some work [2938398] gdbstub compile error with x86_64 enabled [2734455] shutdown/reset type 05 should reinit the PICs [1921294] extended memory less than 1M wrong size [1947249] BX_USE_EBDA_TABLES and MP table placement [1933859] BX_USE_EBDA_TABLES and memory overlapping [2923680] "help dregs" is a syntax error [2919661] CPU may fail to do 16bit near call [2790768] Memory corruption with SMP > 32, Panic BIOS Keyboard Error [2902118] interrupts vectors 0x60 to 67 should be NULL ! [2912502] Instruction Pointer behaving erratically [2901047] Bochs crashed, closed by guest os [2905385] Bochs crash [2901481] Instruction SYSRET and SS(PL) [2900632] Broken long mode RETF to outer priviledge with null SS [1429011] Use bx_phyaddr_t for physaddr vars and bx_adress for lin adr - these S.F. feature requests were closed/implemented [2955911] RPM preuninstall scriptlet removes /core [2947863] don't abort on unrecognised options [2878861] numerics in the disassembler output [2900619] make more CPU state changeable ------------------------------------------------------------------------- Changes in 2.4.2 (November 12, 2009): - CPU and internal debugger - VMX: Implemented TPR shadow VMEXIT - Bugfixes for CPU emulation correctness (mostly for VMX support). - Bugfixes and updates for Bochs internal debugger - On SMP system stepN command now affects only current processor - Memory - Bugfixes for > 32-bit physical address space. - Allow to emulate more physical memory than host actually could or would like to allocate. For more details look for new .bochsrc 'memory' option. - Cleanup configure options - All paging related options now will be automatically determined according to --enable-cpu-level option. Related configure options --enable-global-pages, --enable-large-pages, --enable-pae, --enable-mtrr are deprecated now. Only 1G paging option still remaining unchanged. - Deprecate --enable-daz configure option. Denormals-are-zeros MXCSR control will be enabled automatically iff SSE2 is supported (like in hardware). - Deprecate --enable-vme configure option, now it will be supported iff CPU_LEVEL >= 5 (like in hardware). - I/O Devices - Bugfixes for 8254 PIT, VGA, Cirrus-Logic SVGA, USB UCHI - SF patches applied [2817840] Make old_callback static by Mark Marshall [2874004] fix for VMWRITE instruction by Roberto Paleari [2873999] fix CS segment type during fast syscall invocation by Roberto Paleari [2864389] Debugger gui maximize on startup by Thomas Nilsen [2817868] Rework loops in the memory code by Mark Marshall [2812948] PIT bug by Derek - these S.F. bugs were closed/fixed [2833504] GUI debugger bug-about GDT display [2872244] BIOS writes not allowed value to MTRR MSR causing #GP [2885383] SDL GUI memory leak [2872290] compilation in AIX5.3 ML10 failes [2867904] crash with cirrus bx_vga_c::mem_write [2851495] BIOS PCI returns with INT flag = 0 [2860333] vista 64 guest STOP 109 (GDT modification) [2849745] disassembler bug for 3DNow and SSE opcodes [1066748] Wrong registers values after #RESET, #INIT [2836893] Regression: Windows XP installer unable to format harddrive [2812239] VMX: VM-Exit: Incorrect instruction length on software int [2814130] bx_debug lex/yacc files incorrectly generated [2813199] MP Tables Missing From BIOS [2824093] VMX exception bug [2811909] VMX : CS Access-rights Type.Accessed stays 0 [2810571] Compile Errors on OSX [2823749] GCC regression or VM_EXIT RDMSR/WRMSR bug [2815929] Vista/XP64 unnecessary panic [2803519] Wrong example in man page bochsrc - these S.F. feature requests were closed/implemented [422766] Large Memory configurations [1311287] Idea for a better GUI [455971] USB support [615363] debugger shortcut for repeat last cmd ------------------------------------------------------------------------- Changes in 2.4.1 (June 7, 2009): - Fixed bunch of CPUID issues - Bochs is now able to install and boot 64-bit Windows images! (special thanks to Mark Ebersole for his patch) - Several bugfixes in CPU emulation (mostly for x87 instructions) - Fixed two critical deadlock bugs in the Win32 gui (patches from @SF tracker) - Fixes related to the 'show ips' feature - removed conflicting win32-specific alarm() functions ('win32' and 'sdl' gui) - feature now works in wx on win32 - Added support for gdb stub on big endian machine (patch by Godmar Back) - Rewritten obsolete hash_map code in dbg symbols module (patch from @SF) - BIOS: implemented missing INT 15h/89h (patch by Sebastian Herbszt) ------------------------------------------------------------------------- Changes in 2.4 (May 3, 2009): Brief summary : - Added graphical Bochs debugger frontend for most of the supported platforms. - Thanks for Chourdakis Michael and Bruce Ewing. - Many new CPU features in emulation - Support for > 32 bit physical address space and configurable MSRs - VMX, 1G pages in long mode, MOVBE instruction - Bugfixes for CPU emulation correctness, debugger and CPU instrumentation. - New config interface 'win32config' with start and runtime menu - USB: added OHCI support, external hub and cdrom - Added user plugin interface support. Detailed change log : - CPU and internal debugger - Support for VMX hardware emulation in Bochs CPU, to enable configure with --enable-vmx option Nearly complete VMX implementation, with few exceptions: - Dual-monitor treatment of SMIs and SMM not implemented yet - NMI virtualization, APIC virtualization not implemented yet - VMENTER to not-active state not supported yet - No advanced features like Extended Page Tables or VPID - Support for configurable MSR registers emulation, to enable configure with --enable-configurable-msrs option Look for configuration example in .bochsrc and msrs.def - Support new Intel Atom(R) MOVBE instruction, to enable configure with --enable-movbe option - Support for 1G pages in long mode, to enable configure with --enable-1g-pages option - Support for > 32 bit physical address space in CPU. Up to 36 bit could be seen in legacy mode (PAE) and up to 40 bit in x86-64 mode. Still support the same amount of the physical memory in the memory object, so system with > 4Gb of RAM yet cannot be emulated. To enable configure with --enable-long-phy-address option. - Implemented modern BIOSes mode limiting max reported CPUID function to 3 using .bochsrc CPU option. The mode is required in order to correctly install and boot WinNT. - Added ability to configure CPUID vendor/brand strings through .bochsrc (patch from @SF by Doug Reed). - Many bugfixes for CPU emulation correctness (both x86 and x86-64). - Updated CPU instrumentation callbacks. - Fixed Bochs internal debugger breakpoints/watchpoints handling. - Configure and compile - Added ability to choose Bochs log file name and Bochs debugger log file name from Bochs command line (using new -log and -dbglog options) - Removed Peter Tattam's closed source external debugger interface from the code. - Removed --enable-guest2host-tlb configure option. The option is always enabled for any Bochs configuration. - Removed --enable-icache configure option. The option is always enabled for any Bochs configuration. Trace cache support still remains optional and could be configured off. - Added configure option to compile in GUI frontend for Bochs debugger, to enable configure with --enable-debugger-gui option. The GUI debugger frontend is enabled by default with Bochs debugger. - Removed --enable-port-e9-hack configure option. The feature now could be configured at runtime through .bochsrc. - Added configure option to enable/disable A20 pin support. Disabling the A20 pin support slightly speeds up the emulation. - reduced dependencies between source files for faster code generation - BIOS - Added S3 (suspend to RAM) ACPI state to BIOS (patch by Gleb Natapov) - Implemented MTRR support in the bios (patches by Avi Kivity and Alex Williamsion with additions by Sebastian Herbszt) - Bug fixes - I/O Devices - Added user plugin support - remaining devices converted to plugins: pit, ioapic, iodebug - added 'plugin_ctrl' bochsrc option to control the presence of optional device plugins without a separate option. By default all plugins are enabled. - added register mechanism for removable mouse and keyboard devices - Hard drive / cdrom - PACKET-DMA feature now supported by all ATAPI commands - ATAPI command 0x1A added (based on the Qemu implementation) - sb16 - Added ALSA sound support on Linux (PCM/MIDI output) - FM synthesizer now usable with MIDI output (simple piano only) - Fixed OPL frequency to MIDI note translation - Fixed MIDI output command - keyboard - added keyboard controller commands 0xCA and 0xCB - USB - USB code reorganized to support more HC types and devices - added USB OHCI support written by Ben Lunt - added external USB hub support (initial code ported from Qemu) - added USB cdrom support (SCSI layer ported from Qemu) - added status bar indicators to show data transfer - VGA - VBE video memory increased to 16 MB - implemented changeable VBE LFB base address (PCI only, requires latest BIOS and VGABIOS images) - I/O APIC - implemented I/O APIC device hardware reset - Config interface - new config interface 'win32config' with start and runtime menu is now the default on Windows ('textconfig' is still available) - win32 device config dialogs are now created dynamicly from a parameter list (works like the wx ParamDialog) - changes in textcofig and the wx ParamDialog for compatibility with the new win32 dialog behaviour - Bochs param tree index keys are case independent now - some other additions / bugfixes in the simulator interface code - Misc - updated LGPL'd VGABIOS to version 0.6c - Updated Bochs TESTFORM to version 0.4 - SF patches applied [2784858] IO Handler names are not compared properly [2712569] Legacy bios serial data buffer timeout bug by grybranix [2655090] 64 bit BSWAP with REX.W broken by M. Eby [2645919] CR8 bug when reading by M. Eby [1895665] kvm: bios: add support to memory above the pci hole by Izik Eidus [2403372] rombios: check for valid cdrom before using it by Sebastian [2307269] acpi: handle S3 by Sebastian [2354134] TAP networking on Solaris/Sparc repaired [2144692] The scsi device can not complete its writing data command by naiyue [1827082] [PATCH] Configurable CPU vendor by Marcel Sondaar [2217229] Panic on EBDA overflow in rombios32 by Sebastian [2210194] Log pci class code by Sebastian [1984662] red led for disk write and titlebar mod by ggbsf [2142955] Fix for monitor/mwait by Doug Gibson [2137774] Patch to fix bug: cdrom: read_block: lseek returned error by Gabor Olah [2134642] Fix scan_to_scanascii table for F11 and F12 by Ben Guthro & Steve Ofsthun [2123036] sdl fullscreen fix by ggbsf [2073039] Remove CMOS accsess from AML code by Gleb Natapov [2072168] smbios: add L1-L3 cache handle to processor information by Sebastian [2055416] bochsrc cpu options for cpuid vendor and brand string by Doug Reed [2035278] rombios: Fix return from BEV via retf by Sebastian [2035260] rombios: El Torito load segment fix by Sebastian [2031978] Fix VMware backdoor command 0Ah by Jamie Lokier [2015277] Remove obsolete comment about DATA_SEG_DEFS_HERE hack by Sebastian [2011268] Set new default format and unit only if both are supported by Sebastian [2001919] gdbstub: fix qSupported reply by Sebastian [2001912] gdbstub: enclose packet data by apostrophes by Sebastian [1998071] fix missing SIGHUP and SIGQUIT with term ui on mingw by Sebastian [1998063] fix wrong colors with term ui by Sebastian [1995064] Compile fix needed for --enable-debugger and gcc 4.3 by Hans de Goede [1994564] Fix typo in RDMSR BX_MSR_MTRRFIX16K_A0000 by Sebastian [1994396] Change hard_drive_post #if by Sebastian [1993235] TESTFORM email address update by Sebastian [1992322] PATCH: fix compilation of bochs 2.3.7 on bigendian machines by Hans de Goede [1991280] Shutdown status code 0Ch handler by Sebastian [1990108] Shutdown status code 0Bh handler by Sebastian [1988907] Shutdown status code 0Ah handler by Sebastian [1984467] two typos in a release! (2.3.7) [1981505] Init PIIX4 PCI to ISA bridge and IDE by Sebastian - these S.F. bugs were closed/fixed [2784148] an integer overflow BUG of Bochs-2.3.7 source code [2695273] MSVC cpu.dsp failure in 2.3.7.zip [616114] Snapshot/Copy crash on Win2K [2628318] 'VGABIOS-latest' bug [1945055] can't 'make install' lastest bochs on loepard [2031993] Mac OS X Makefile bug [1843199] install error on mac osx [2710931] Problem compiling both instrumentation and debugger [2617003] ExceptionInfo conflicts with OS X api [2609432] stepping causes segfault (CVS) [2605861] compile error with --enable-smp [1757068] current cvs(Jul19, 07) failed to boot smp [2426271] cannot get correct symbol entry [2471982] VGA character height glitches [1659659] wrong behaviour a20 at boot [1998027] minwg + --with-term + --with-out-win32 = link failure [1871936] bochs-2.3.6 make fails on wx.cc [1684666] info idt for long mode [2105989] could not read() hard drive image file at byte 269824 [1173093] Debugger totally not supports x86-64 [1803018] new win32debug dialog problems [2141679] windows vcc build broken [2162824] latest cvs fails to compile [2164506] latest bochs fails to start [2129223] MOV reg16, SS not working in real mode due to dead code [2106514] RIS / startrom.com install ALMOST works [2123358] SMP (HTT): wbinvd executed by CPU1 crashes CPU0 [2002758] Arch Linux: >>PANIC<< ATAPI command with zero byte count [2026501] El Torito incorrect boot segment:offset [2029758] BEV can return via retf instead of int 18h [2010173] x command breaks after one error about x/s or x/i [1830665] harddrv PANIC: ATAPI command with zero byte count [1985387] fail to make using gcc4 with --enable-debugger [1990187] testform feedback [1992138] Misspell in cpu/ia_opcodes.h - these S.F. feature requests were closed/implemented [2175153] Update MSVC project files [658800] front end program and bios [1883370] Make cd and floppy images more usable [422783] change floppy size without restarting [2552685] param tree names should be case insensitive [1214659] PC Speaker emu turnoff. Plugin Controll. [1977045] support 40 bit physical address [1506385] Intel Core Duo VT features [1429015] Support for user plugins [1488136] debugger access to floppy controller [1363136] Full debugger SMP and 64 bit support [2068304] Support for ACPI [431032] debugger "x" command [423420] profiling ideas (SMF) [445342] Add FM support? [928439] alsa ------------------------------------------------------------------------- Changes in 2.3.7 (June 3, 2008): Brief summary : + More optimizations in CPU code - Bochs 2.3.7 is more than 2x faster than Bochs 2.3.5 build ! - Implemented LBA48 support in BIOS - Added memory access tracing for Bochs internal debugger - Implemented Intel(R) XSAVE/XRSTOR and AES instruction set extensions - Many fixes in CPU emulation and internal debugger - MenuetOS64 floppy images booting perfect again ! - updated LGPL'd VGABIOS to version 0.6b Detailed change log : - CPU - Support of XSAVE/XRSTOR CPU extensions, to enable configure with --enable-xsave option - Support of AES CPU extensions, to enable configure with --enable-aes option - Fixed Bochs failure on RISC host machines with BxRepeatSpeedups optimization enabled - Implemented SYSENTER/SYSEXIT instructions in long mode - More than 100 bugfixes for CPU emulation correctness (both x86 and x86-64) - MenuetOS64 floppy images booting perfect again ! - Updated CPU instrumentation callbacks - Bochs Internal Debugger and Disassembler - Added memory access tracing for Bochs internal debugger, enable by typing 'trace-mem on' in debugger command line - Many bug fixes in Bochs internal debugger and disassembler - System BIOS (Volker) - Implemented LBA48 support - Added generation of SSDT ACPI table that contains definitions for available processors - Added RTC device to ACPI DSDT table - Added implementation of SMBIOS - I/O devices (Volker) - VGA - Implemented screen disable bit in sequencer register #1 - Implemented text mode cursor blinking - Serial - new serial modes 'pipe-server' and 'pipe-client' for win32 - new serial mode 'socket-server' - Configure and compile - Fixed configure bug with enabling of POPCNT instruction, POPCNT instruction should be enabled by default when SSE4.2 is enabled. - Removed --enable-magic-breakpoint configure option. The option is automatically enabled if Bochs internal debugger is compiled in. It is still possible to turn on/off the feature through .bochsrc. - Allow boot from network option in .bochsrc - Added Bochs version info for Win32 - Display libraries - implemented text mode character blinking in some guis - improved 'X' gui runtime dialogs - SF patches applied [1980833] Fix shutdown status code 5h handler by Kevin O'Connor [1928848] "pipe" mode for serial port (win32 only) by Eugene Toder [1956843] Set the compatible pci interrupt router back to PIIX by Sebastian [1956366] Do not announce C2 & C3 cpu power state support by Igor Lvovsky [1921733] support for LBA48 by Robert Millan [1938185] Fix link problem with --enable-debugger by Sebastian [1938182] Makefile.in - use @IODEV_LIB_VAR@ by Sebastian [1928945] fix for legacy rombios - e820 map and ACPI_DATA_SIZE by Sebastian [1925578] rombios32.c - fix ram_size in ram_probe for low memory setup by Sebastian [1908921] rombios32.c - move uuid_probe() call by Sebastian [1928902] improvements to load-symbols by Eugene Toder [1925568] PATCH: msvc compilation by Eugene Toder [1913150] rombios.c - e820 cover full size if memory <= 16 mb by Alexander van Heukelum [1919804] rombios.c - fix and add #ifdef comments by Sebastian [1909782] rombios.c - remove segment values from comment by Sebastian [1908918] SMBIOS - BIOS characteristics fix by Sebastian [1901027] BIOS boot menu support (take 3) [1902579] rombios32.c - define pci ids by Sebastian [1859447] Pass segment:offset to put_str and introduce %S by Sebastian [1889057] rombios.c - boot failure message by Sebastian [1891469] rombios.c - print BEV product string by Sebastian [1889851] Win32 version information FILEVERSION for bochs.exe by Sebastian [1889042] rombios.c - fix comment by Sebastian [1881500] bochsrc, allow boot: network by Sebastian [1880755] Win32 version information for bochs.exe by Sebastian [1880471] SMBIOS fix type 0 by Sebastian [1878558] SMBIOS fixes by Sebastian [1864692] SMBIOS support by Filip Navara [1865105] Move bios_table_area_end to 0xcc00 by Sebastian [1875414] Makefile.in - change make use by Sebastian [1874276] Added instrumentation for sysenter/sysexit by Lluis [1873221] TLB page flush: add logical address to instrumentation by Lluis [1830626] lba32 support by Samuel Thibault [1861839] Move option rom scan after floppy and hard drive post by Sebastian [1838283] Early vga bios init by Sebastian [1838272] rom_scan range parameter by Sebastian [1864680] Save CPUID signature by Filip Navara - these S.F. bugs were closed [1976171] Keyboard missing break code for enter (0x9C) [666433] physical read/write breakpoint sometimes fails [1744820] info gdt and info idt shows the entire tables [1755652] graphics: MenuetOS64 shows black screen [1782207] Windows Installer malfunction, Host=Linux, Guest=Win98SE [1697762] OS/2 Warp Install Failed [1952548] String to char * warnings [1940714] SYSENTER/SYSEXIT doesn't work in long mode [1422342] SYSRET errors [1923803] legacy rombios - e820 map and ACPI_DATA_SIZE [1936132] Link problem with --enable-debugger & --enable-disasm [1934477] Linear address wrap is not working [1424984] virtual machine freezes in Bochs 2.2.6 [1902928] with debugger cpu_loop leaves CPU with unstable state [1898929] Bochs VESA BIOS violates specs (banks == 1) [1569256] bug in datasegment change in long mode [1830662] ACPI: no DMI BIOS year, acpi=force is required [1868806] VGA blink enable & screen disable [1875721] Bit "Accessed" in LDT/GDT descriptors & #PF [1874124] bx_Instruction_c::ilen() const [1873488] bochs-2.3.6 make fails on dbg_main.cc - these S.F. feature requests were implemented [1422769] SYSENTER/SYSEXIT support in x86-64 mode [1847955] Version information for bochs(dbg).exe [939797] SMBIOS support ------------------------------------------------------------------------- Changes in 2.3.6 (December 24, 2007): Brief summary : + More than 25% emulation speedup vs Bochs 2.3.5 release! - Thanks to Darek Mihocka (http://www.emulators.com) for providing patches and ideas that made the speedup possible! + Up to 40% speedup vs Bochs 2.3.5 release with trace cache optimization! - Lots of bugfixes in CPU emulation - Bochs benchmarking support - Added emulation of Intel SSE4.2 instruction set Detailed change log : - CPU - Added emulation of SSE4.2 instruction set, to enable use --enable-sse=4 --enable-sse-extension configure options to enable POPCNT instruction only use configure option --enable-popcnt - Implemented MTRR emulation, to enable use --enable-mtrr configure option. MTRRs is enabled by default when cpu-level >= 6. - Implemented experimental MONITOR/MWAIT support including optimized MWAIT CPU state and hardware monitoring of physical address range, to enable use --enable-monitor-mwait configure option. - Removed hostasm optimizations, after Bochs rebenchmarking it was found that the feature bringing no speedup or even sometimes slows down emulation! - Merged trace cache optimization patch, the trace cache optimization is enabled by default when configure with --enable-all-optimizations option, to disable trace cache optimization configure with --disable-trace-cache - Many minor bugfixes in CPU emulation (both ia32 and x86-64) - Updated CPU instrumentation callbacks - Bochs Internal Debugger and Disassembler - Many fixes in Bochs internal debugger and disassembler, some debugger interfaces significantly changed due transition to the param tree architecture - Added support for restoring of the CPU state from external file directly from Bochs debugger - Configure and compile - Renamed configure option --enable-4meg-pages to --enable-large-pages. The option enables page size extensions (PSE) which refers to 2M pages as well. - Removed --enable-save-restore configure option, save/restore feature changed to be one of the basic Bochs features and compiled by default for all configurations. - Added new Bochs benchmark mode. To run Bochs in benchmark mode execute it with new command line option 'bochs -benchmark time'. The emulation will be automatically stopped after 'time' millions of emulation cycles executed. - Another very useful option for benchmarking of Bochs could be enabled using new 'print_timestamps' directive from .bochsrc: print_timestamps: enable=1 - Added --enable-show-ips option to all configuration scripts used to build release binaries, so all future releases will enjoy IPS display. - Enable alignment check in the CPU and #AC exception by default for --cpu-level >= 4 (like in real hardware) - SF patches applied [1491207] Trace Cache Speedup patch by Stanislav [1857149] Define some IPL values by Sebastian [1850183] Get memory access mode in BX_INSTR_LIN_READ by Lluis Vilanova [1841421] pic: keep slave_pic.INT and master_pic.IRQ_in bit 2 in sync by Russ Cox [1841420] give segment numbers in exception logs by Russ Cox [1801696] Allow Intel builds on Mac OS X [1830658] Fix >32GB disk banner by Samuel Thibault [1813314] Move #define IPL_* and typedef ipl_entry by Sebastian [1809001] Save PnP Option ROM Product Name string in IPL Boot Table by Sebastian [1821242] Fix for #1801285, Niclist.exe broken by Sebastian [1819567] Code warning cleanup [1816162] Update comment on bios_printf() by Sebastian [1811139] Trivial Fix when BX_PCIBIOS and BX_ROMBIOS32 not defined by Myles Watson [1811190] Improve HD recognition and CD boot by Myles Watson [1811860] Implement %X in bios_printf by Sebastian [1809649] printf %lx %ld %lu by Myles Watson [1809651] move BX_SUPPORT_FLOPPY by Myles Watson [1809652] dpte and Int13DPT fixes by Myles Watson [1809669] clip cylinders to 16383 in hard drive by Myles Watson [1799903] Build BIOS on amd64 by Robert Millan [1799877] Fix for parallel build (make -j2) by Robert Millan - these S.F. bugs were closed [1837354] website bug: View the Source link broken [1801268] Reset from real mode no longer working [1843250] Using forward slashes gives invalid filename [1823446] BIOS bug, local APIC #0 not detected [1801285] Niclist.exe broken [1364472] breakpoints sometimes don't work [994451] breakpoint bug [1801295] NSIS installer vs Windows Notepad [1715328] Unreal mode quirk [1503972] debugger doesn't debug first instruction on exception [1069071] div al, byte ptr [ds:0x7c18] fails to execute [1800080] Wrong "BX_MAX_SMP_THREADS_SUPPORTED" assertion - these S.F. feature requests were implemented [1662687] Download for Win32-exe with x64 Mode and debugging [604221] Debugger command: query lin->phys mapping ------------------------------------------------------------------------- Changes in 2.3.5 (September 16, 2007): Brief summary : - Critical problems fixed for x86-64 support in CPU and Bochs internal debugger - ACPI support - The release compiled with x86-64 and ACPI - Hard disk emulation supports ATA-6 (LBA48 addressing, UDMA modes) - Added emulation of Intel SSE4.1 instruction set Detailed change log : - CPU - Fixed critical bug with 0x90 opcode (NOP) handling in x86-64 mode - implied stack references where the stack address is not in canonical form should causes a stack exception (#SS) - Added emulation of SSE4.1 instruction set (Stanislav) - Do not save and restore XMM8-XMM15 registers when not in x86-64 mode - Fixed zero upper 32-bit part of GPR in x86-64 mode - CMOV_GdEd should zero upper 32-bit part of GPR register even if the 'cmov' condition was false ! - Implemented CLFLUSH instruction, report non-zero cache size in CPUID - Fixed PUSHA/POPA instructions behavior in real mode - Fixed detection of inexact result by FPU - Fixed denormals-are-zero (DAZ) handling by SSE convert instructions - Implemented Misaligned Exception Mask support for SSE (MXCSR[17]) - Implemented Alignment Check in the CPU and #AC exception, to enable use --enable-alignment-check configure option - General - 2nd simulation support in wxBochs now almost usable (simulation cleanup code added and memory leaks fixed) - Configure and compile - several fixes for MacOSX, OpenBSD and Solaris 10 - enable save/restore feature by default for all configurations - reorganized SSE configure options to match Intel(R) Programming Reference Manual, new option introduced for SSE extensions enabling. To enable Intel Core Duo 2 new instructions use --enable-sse=3 --enable-sse-extension enabling of SSE4.1 (--enable-sse=4) will enable SSE3 extensions as well - removed old PIT, always use new PIT written by Greg Alexander, removed configure option --enable-new-pit - I/O devices (Volker) - Floppy - partial non-DMA mode support (patch by John Comeau) - Hard drive / cdrom - hard disk emulation now supports ATA-6 (LBA48 addressing, UDMA modes) - VMWare version 4 disk image support added (patch by Sharvil Nanavati) - PCI - initial support for the PIIX4 ACPI controller - Serial - added support for 3-button mouse with Mousesystems protocol - USB - experimental USB device change support added - rewrite of the existing USB devices code - new USB devices 'disk' and 'tablet' (ported from the Qemu project) - Bochs internal debugger - fixed broken debugger "rc file" option (execute debugger command from file) - implementation of a gui frontend ("windebug") for win32 started - gdbstub now accepts connection from any host - several documentation updates - a lot of disasm and internal debugger x86_64 support fixes - Configuration interface - fixes and improvements to the save state dialog handling - Display libraries - text mode color handling improved in some guis - win32 fullscreen mode (patch by John Comeau) - System BIOS (Volker) - 32-bit PM BIOS init code for ACPI, PCI, SMP and SMM (initial patches by Fabrice Bellard) - PCI BIOS function "find class code" implemented - SF patches applied [1791000] 15h 8600h is reading the wrong stack frame by Sebastian [1791016] rombios32.c, ram_probe(), BX_INFO missing value by Sebastian [1786429] typo in bochsrc.5 by Sebastian [1785204] Extend acpi_build_table_header to accept a revision number by Sebastian [1766536] Partial Patch for Bug Report 1549873 by Ben Lunt [1763578] ACPI Table Revision 0 -> 1 [1642490] implement alignment check and #AC exception by Stanislav Shwartsman [1695652] [PATCH] .pcap pktlog and vnet PXE boot by Duane Voth [1741153] Add expansion-ROM boot support to the ROMBIOS [1734159] Implemented INT15h, fn 0xC2 (mouse), subfn 3, set resolution [1712970] bios_printf %s fix [1573297] PUSHA/POPA real mode fix by Stanislav Shwartsman [1641816] partial support for non-DMA access to floppy by John Comeau [1624032] shows where write outside of memory occurred by John Comeau [1607793] allow fullscreen when app requests it by John Comeau [1603013] Bugfix for major NOP problem on x64 by mvysin [1600178] Make tap and tuntap compile on OpenBSD by Jonathan Gray [1149659] improve gdbstub network efficiency by Avi Kivity [1554502] Trivial FPU exception handling fix - these S.F. bugs were closed [1316008] Double faults when it shouldn't - gcc 4.0.2 [1787289] broken ABI for redolog class when enable-compressed-hd [1787500] tftp_send_optack not 64bit clean [1264540] Security issue with Bochs website [1767217] Debugger Faults including ud2 [1729822] Various security issues in io device emulation [1675202] mptable hosed (bad entry count in header) [1197141] 'make install' installs to bad location [1157623] x86Solaris10 cannot recoginize ACPI RSD PTR [1768254] large HDD in Bochs/bximage [1496157] Windows Vista Beta2 dosn't boot [1755915] Illegal Hard Disk Signature Output [1717790] info gdt and info idt scrolls away, too long result [1726640] Debugger displays incorrect segment for mov instruction [1719156] Typo in misc_mem.cpp [1715270] Debugger broken in/beyond 2.3 [1689107] v8086 mode priviledge check failed [1704484] A few checks when CPU_LEVEL < 4 [1678395] Problem with zero sector... [876990] SA-RTL OS fails on PIC configuration [1673582] save/restore didn't restore simulation correctly [1586662] EDD int 13h bug, modify eax [666618] POP_A Panic in DOS EMU [1001485] panic: not enough bytes on stack [1667336] delay times an order of magnitude slow [1665601] crash disassembling bootcode [1657065] CVS sources won't compile [1653805] bochs's gdbstub uses incorrect protocol [1640737] ASM sti command frezzes guest OS [1636439] latest CVS sources don't compile under Cygwin [1634357] disasm incorrect (no sign ext) displacement in 64-bit mode [1376453] pcidev segfaults bochs [1180890] IOAPIC in BOCHS - WinXP 64 in MP version [1597528] 2.3 fails to compile on amd64 [1526255] FLD1 broken when compaling with gcc 4.0.x [1597451] eth_fbsd is broken under FreeBSD [1571949] Bochs will not compile under Solaris [1500216] Bochs fails to boot BeOs CD [1458339] bochs-2.2.6 WinXP Binary ACPI error installing FreeBSD 6.0 [1440011] patches needed for FreeBSD 6.0 to compile Bochs [431674] some devices don't have a prefix [458150] QNX demo disk crashes with new pit [818322] Bochs 2.1 cvs: OS/2 - read verify on non disk [906840] KBD: bogus scan codes generated in set 3 [1005053] No keyboard codes translation [1109374] Problem with Scancodeset 2 [1572345] Bochs won't continue [1568153] Bochs looks for (and loads?) unspecified display libraries [1563462] Errors in /iodev/harddrv.h [1562172] TLB_init() fails to initialize priv_check array if USE_TLB 0 [1385303] debugger crashes after panic [1438227] crc.cpp missing in bx_debug version 2.2.6 [1501825] debugger crashes on to high input [1420959] Memory leak + buffer overflow in Bochs debugger [1553289] Error in Dis-assembler [542464] I cannot use FLAT [1548270] Bochs won't die with its pseudo terminal [1545588] roundAndPackFloatx80 does not detect round up correctly ------------------------------------------------------------------------- Changes in 2.3 (August 27, 2006): Brief summary : - limited save/restore support added (config + log options, hardware state) - configuration parameter handling rewritten to a parameter tree - lots of cpu and internal debugger fixes - hard disk geometry autodetection now supported by most of the image types - hard disk emulation now supports ATA-3 (multiple sector transfers) - VBE memory size increased to 8MB and several VGA/VBE fixes - updated LGPL'd VGABIOS to version 0.6a Detailed change log : - CPU and internal debugger fixes - Fixed bug in FSTENV instruction (Stanislav Shwartsman) - Recognize #XF exception (19) when SSE is enabled - Fixed bug in PSRAW/PSRAD MMX and SSE instructions - Save and restore RIP/RSP only for FAULT-type exceptions, not for traps - Correctly decode, disassemble and execute multi-byte NOP '0F F1' opcode - Raise A20 line after system reset (Stanislav Shwartsman) - Implemented SMI and NMI delivery (APIC) and handling in CPU (Stanislav) - Experimental implementation of System Management Mode (Stanislav) - Added emulation of SSE3E instructions (Stanislav Shwarstman) - Save and restore FPU opcode, FIP and FDP in FXSAVE/FRSTOR instructions - Fixed bug in MOVD_EdVd opcode (always generated #UD exception) - Fixed critical issue, Bochs was not supporting > 16 bit LDT.LIMIT values - Many fixes in Bochs internal debugger and disassembler - CPU x86-64 fixes - Fixed SYSRET instruction implementation - Fixed bug in CALL/JMP far through 64-bit callgate in x86-64 mode - Correctly decode, disassemble and execute 'XCHG R8, rAX' instruction - Correctly decode and execute 'BSWAP R8-R15' instructions - Fixed ENTER and LEAVE instructions in x86-64 mode (Stanislav) - Fixed CR4 exception condition (No Name) - Fixed x86 debugger to support x86-64 mode (Stanislav) - APIC and SMP - Support for Dual Core and Intel(R) HyperThreading Technology. Now you could choose amount of cores per processor and amount of HT threads per core from .bochsrc for SMP simulation (Stanislav Shwartsman) - Allow to control SMP quantum value through .bochsrc CPU option parameter. Previous Bochs versions used hardcoded quantum=5 value. - Fixed interrupt priority bug in service_local_apic() - Fixed again reading of APIC IRR/ISR/TMR registers. Finally it becomes fully correct :-) - Configure and compile - Moved configure time --enable-reset-on-triple-fault option to runtime, the 'cpu' option in .bochsrc is extended and the old configure option is deprecated (Stanislav Shwartsman) - Removed --enable-pni configure option, to compile with PNI use --enable-sse=3 instead (Stanislav Shwartsman) - enable SEP (SYSENTER/SYSEXIT) support by default for Penitum II+ processor emulation (i.e. if cpu-level >= 6 and MMX is enabled) - general - Limited save/restore support added. The state of CPU, memory and all devices can be saved now (state of harddisk images not handled yet). - Fixed several memory leaks - configuration interface - Configuration parameter handling rewritten to a parameter tree. This is required for dynamic menus/dialogs, user-defined options and save/restore. - Support for user-defined bochsrc options added - help support at the parameter prompt in textconfig added - I/O devices (Volker) - Floppy - partial sector transfers fixed - Hard drive / cdrom - several fixes to the IDE register behaviour (e.g. in case of a channel with only one drive connected) - fixed data alignment of 'growing' hard drive images (sharing images between Windows and Linux now possible) - disk geometry autodetection now supported by most of the image types (unsupported: external, dll and compressed modes) - multi sector read/write commands implemented - hard disk now reporting ATA-3 supported - ATAPI 'inquiry' now returns a unique device name - Keyboard - reset sent to keyboard has no effect on the 8042 (scancode translation) - PCI - forward PIRQ register changes to the I/O APIC (if present) - attempt to fix and update the emulation part of 'pcidev' (untested) - VGA - VBE memory size increased to 8MB and several VBE fixes - VGA memory read access fixed (bit plane access and read mode) - VGA memory is now a part of the common video memory - System BIOS (Volker) - enable interrupts before executing INT 19h - fixed ATA device detection in case of one drive only connected to controller - improved INT 15h function AX=E820h - real mode PCI BIOS now returns IRQ routing information (function 0Eh) - keyboard LED flags handling fixed and improved - fixed handling of extended keys in INT 09h - Updated LGPL'd VGABIOS to version 0.6a - SF patches applied [1340111] fixes and updates to usb support by Ben Lunt [1539420] minor addition to pci_usb code by Ben Lunt [1455958] call/jmp through call gate in 64-bit mode [1433107] PATCH: fix compile with wxwindows 2.6 (unicode / utf8) by jwrdegoede [1386671] Combined dual core and hyper-threading patch - these S.F. bugs were closed [833927] TTD: System Error TNT.40025: Unexpected processor exception [789230] Sending code that shows lock up when setting idt [909670] Problems with Symantec Ghost [1540241] include missing in osdep.cc [1539373] Incorrect disasm for "mov moffset,bla" in 64bit [1538419] incorrect disassembly of [rip+disp] with rex.b [1535432] shift+cursor key maps to a digit [1504891] Knoopix 5.0.1 error [1424355] bochs-2.2.6 ata failure in windoze 98se [1533979] wrong disassembly of IN instruction [620059] paste won't stop [1164904] status bar doesn't show num/caps/scroll lock status [1061720] ATA Support level for HD [1522196] Broken CHANGES link in main page [1438415] crash if screen scrolled downwards [778441] Shouldn't interrupts be enable after BIOS? [1514949] I got a problem with the 8253 timer [1513544] disasm of 0xec (in AL,DX) returns ilen of 2 instead of 1 [1508947] APIC interrupt priority checking and interrupt delivery [766286] Debugger halts after any GPF exception [639143] va_list is not a pointer on linuxppc [1501815] debugger examines memory over page-boundary wrong [1503978] movsb/w/d doesn't work when direction is stored [1499405] WinPCap has changed URL hosting [1498519] APIC IRR bits not set while interrupts disabled [1498193] Bochs segfaults on LTR instruction [787140] Guest2HostTLB optimization bug [1492070] instrument stop [1487772] No SEP on P4 [1488335] Growing hard disk images severe interoperability errors! [1076312] Shadow RAM and TLB [1282249] The real i440FX chipset Award bios hangs [1479763] mistake "mov ax,[es:di]" for "mov ax,[ds:di]" [1453575] Misconfigured floppy DMA transfers do not terminate. [1460068] Incorrect handling for the Options Menu Item [910203] bochs-2.1.1 wx.lo failed [1438654] PANIC when trying to run install-amd64-minimal-2005.0.iso [1458320] compile hdimage.h fails [1455880] bochs-2.2.6,2: make error on FreeBSD [696890] Network wouldn't run under W2k hosting MSDOS [673391] SMP timer problems [1291059] wxWindows GUI on non-windows/configure issue [1356450] bochs 2.2.1 errors-omittions [1178017] Win98 guest cannot receive network packets from host [1076315] a20_mask after restarting [1436323] real hw does not panic when bad Ib in CMPSS_VssWssIb [1435269] cdrom_amigaos is not compilable [1433314] disasm issues [1170614] relative jumps/calls wrong in debugger [758121] user might get confused when interrupt handler invoked [1170622] You cannot toggle OFF "show" flags [1406387] JMP instruction should display absolute address [1428813] PANIC: ROM address space out of range [1426288] DR-DOSs EMM386 problem [1412036] Bochs cannot recognize PCI NIC correctly [435115] dbg: modebp broken and no docs [1419366] disasm cs:eip does not work anymore [1419393] SSE's #XF exception -> "exception(19): bad vector" [1419429] disassembly of "260f6f00" show DS: instead of ES: prefix [1417583] Interrupt behaviour changed from 2.2.1 to 2.2.5 [1418281] 'push' (6A) incorrectly disassembled [1417791] FLDENV generating exception when real hw does not. [1264583] OS/2 1.1 doesn't run ------------------------------------------------------------------------- Changes in 2.2.6 (January 29, 2006): - First major SMP release ! - several APIC and I/O APIC fixes make SMP Bochs booting Windows NT4.0 or Knoppix 4.0.2 without noapic kernel option in SMP configuration. - critical APIC timer bug fixed - obsolete SMP BIOS images removed (MP tables created dynamicaly) - determine number of processors in SMP configuration through .bochsrc new .bochsrc option 'CPU' allows to choose number of processors to emulate - new configure option --enable-smp to configure Bochs for SMP support, the old --enable-processors=N option is deprecated - CPU and internal debugger fixes - enabled #PCE bit in CR4 register, previosly setting of this bit generated #GP(0) fault - enabled LAHF/SAHF instructions in x86-64 mode - fixed bug in PMULUDQ SSE2 instruction - fixes in Bochs debugger - Configure and compile - enable VME (virtual 8086 mode extensions) by default if cpu-level >= 5 - enable Bochs disassembler by default for all configurations - win32 installer script improvements - ips parameter moved to new 'CPU' option - show IPS value in status bar if BX_SHOW_IPS is enabled - Other - several fixes in the hard drive, keyboard, timer, usb and vga code - new user button shortcut "bksl" (backslash) - updated Bochs instrumentation examples - user and development documentation improved ------------------------------------------------------------------------- Changes in 2.2.5 (December 30, 2005): Brief summary : - added virtual 8086 mode extensions (VME) implementation - several fixes/improvements in x86-64 emulation, debugger and disassembler - new serial mode 'socket' connects a network socket - IDE busmaster DMA feature for harddisks and cdroms completed and enabled - many improvements in Bochs emulated I/O devices (e.g. floppy, cdrom) - Updated LGPL'd VGABIOS to version 0.5d Detailed change log : - CPU - fixed XMM registers restore in FXRSTOR instruction (Andrej Palkovsky) - print registers dump to the log if tripple fault occured - fixed PANIC in LTR instruction (Stanislav) - added virtual 8086 mode extensions (VME) implementation, to enable configure with --enable-vme (Stanislav) - flush caches and TLBs when executing WBINVD and INVD instructions - do not modify segment limit and AR bytes when modifying segment register in real mode (support for unreal mode) - fixed init/reset values for LDTR and TR registers - reimplemented hardware task switching mechanism (Stanislav) - generate #GP(0) when fetching instruction cross segment boundary - CPU (x86-64) (Stanislav Shwartsman) - implemented call_far/ret_far/jmp_far instructions in long mode - fixed IRET operation in long mode - fixed bug prevented setting of NXE/FFXSR bits in MSR.EFER register - implemented RDTSCP instruction - do not check CS.limit when prefetching instructions in long mode - fixed masked write instructions (MASKMOVQ/MASKMOVDQU) in long mode - fetchdecode fixes for x86-64 - APIC - Fixed bug in changing local APIC id (Stanislav) - Fixed reading of IRR/ISR/TMR registers (patch by wmrieker) - Implemented spurious interrupt register (Stanislav, patch by wmrieker) - Fixed interrupt delivery bug (anonymous #SF patch) - Correctly implemented ESR APIC register (Stanislav) - Bochs debugger - Fixed bug in bochs debugger caused breakpoints doesn't fire sometimes (Alexander Krisak) - watchpoints in device memory fixed (Nickolai Zeldovich) - new debug interface to access Bochs CPU general purpose registers with support for x86-64 - Disassembler (Stanislav Shwartsman) - Fixed disassembly for FCOMI/FUCOMI instructions - Full x86-64 support in disassembler. The disassembler module extended to support x86-64 extensions. Still limited by Bochs debugger which is not supporting x86-64 at all ;( - I/O devices (Volker) - general - memory management prepared for large BIOS images (up to 512k) - slowdown timer sleep rate fixed (now using 1 msec on all platforms) - some device specific parameter handlers moved into the device code - serial - new serial mode 'socket' connects a network socket (#SF patch by Andrew Backer) - hard drive / cdrom - assign a unique serial number to each drive (fixes harddrive detection problems with Linux kernels 2.6.x: "ignoring undecoded slave") - geometry autodetection for 'flat' hard disk images added. Works with images created with bximage (heads = 16, sectors per track = 63) - ATAPI command 'read cd' implemented, some other commands improved - cdrom read block function now tries up to 3 times before giving up - emulation of raw cdrom reads added, some other lowlevel cdrom fixes - IDE busmaster DMA feature for harddisks and cdroms completed and enabled - disk image size limit changed from 32 to 127 GB - split ATA/ATAPI emulation code and image handling code - floppy - fixes for OS/2 (patch by Robin Kay) - disk change line behaviour fixed (initial patch by Ben Lunt) - end-of-track (EOT) condition handling implemented - more accurate timing for read/write data and format track commands using a motor speed of 300 RPM - timing of recalibrate and seek commands now depends on the step rate, date rate and the steps to do - floppy controller type changed to 82077AA - cmos - RTC 12-hour and binary mode implemented - number of CMOS registers changed from 64 to 128 - bochsrc option 'cmosimage' improved - save cmos image on exit if enabled - speaker - simple speaker support for OS X added (patch by brianonn@telus.net) - pci - BeOS boot failure fix in the PCI IDE code - don't register i/o and memory regions during PCI probe - vga - memory allocation for vga extensions fixed - usb - some bugfixes by Ben Lunt (mouse and keypad are usable now) - networking modules - VDE networking module now enabled on Linux - display libraries - general - new syntax for the userbutton shortcut string and more keys supported - win32 - fixed keycode generation for right alt/ctrl/shift keys - runtime dialog is now a property sheet - x11 - simple dialog boxes for the "ask" and "user shortcut" feature implemented - Slovenian keymap added (contributed by Mitja Ursic) - configuration interface - ask dialog is now enabled by default for win32, wx and x display libraries - bochsrc option floppy_command_delay is obsolete now (floppy timing now based on hardware specs) - floppy image size detection now available in the whole config interface - some device specific parameter handlers moved into the device code - calculate BIOS ROM start address from image if not specified - System BIOS (Volker) - PCI i/o and memory base address initialization added - several keyboard interrupt handler fixes (e.g. patch by japheth) - several floppy fixes (e.g. OS/2 works with patch by Robin Kay) - some more APM functions added - Updated LGPL'd VGABIOS to version 0.5d - generate SMP specific tables dynamicly by the Bochs memory init code - SF patches applied [1389776] Disk sizes over 64 Gbytes by Andrzej Zaborowski [1359162] disasm support for x86-64 by Stanislav Shwartsman [857235] task priority and other APIC bugs, etc by wmrieker [1359011] build breaks for 386 + debugger + disasm by shirokuma [1352761] Infinite loop when trying to debug a triple exception [1311170] small APIC bug fix (interrupt sent to the wrong CPU) [1309763] Watchpoints don't work in device memory by Nickolai Zeldovich [1294930] change line status on floppy by Ben Lunt [1282033] SSE FXRESTORE not working correctly by Ondrej Palkovsky [816979] wget generalizations by Lyndon Nerenberg [1214886] No more pageWriteStamp / unified icache by H. Johansson [1107945] com->socket redirection support by Andrew Backer - these S.F. bugs were closed [669180] win95 install : unknown SET FEATURES subcommand 0x03 [1346692] bochs 2.2.1 VGA BIOS error [1354963] floppy in KolibriOS [1378204] error: bochs-2.2.1, --enable-sb16, --disable-gameport [1368412] VDE problems in BOCHS [533446] CPU and APIC devices appear twice [1000796] bximage fails to create image of specified size [1170793] Quarterdeck QEMM doesn't work [923704] Multiple opcode prefixes don't reflect Trap 13 [1166392] DocBook/documentation issues [1368239] broken grater than 4GB size of sparse type hd image [1365830] i386 compile breaks on paging [427550] Incomplete IRETD implementation [1215081] MSVC workspace STILL not fixed [736279] Jump to Task [1356488] FD change fail & occur error [957615] [CPU ] prefetch: RIP > CS.limit [1353866] not booting linux-2.6.14 [1351667] load32bitOSImage does not work with --enable-x86-debugger [1217476] Incorrect (?) handling of segment registers in real mode [1184711] OS2 DOS crash [2.2.pre2] [624330] support for disks > 32GiB [1348368] bochs 2.2.1 bximage error [1342081] Configuration Menu option failed [1138616] OS/2 Warp 4 hangs when booting [1049840] mouse and video conflict [1164570] Unable to perform Fedora Core 4 test 1 installation [1183201] Windows 2000 (MSDN build 2150?) does not completely install [1194284] Can't boot from CD-ROM (Windows NT) [962969] Windows NT crashes while trying to intall them. [1054594] WinXP install halts (redo) [1153107] Windows XP fails with BSOD on 'vga' [938518] Win XP installation fails [645420] getHostMemAddr vetoed direct read [1179985] MS XENIX: >>PANIC<< VGABIOS panic at vgabios.c, line 0 [1329600] WBINVD and INVD should flush caches and TLB [638924] eliminate BX_USE_CONFIG_INTERFACE [1048711] Funny behaviour with CTRL [1288450] keyboard BIOS error [1310706] Keyboard - about key SHIFT [1295981] Ubuntu 5.04 Live-CD won't boot in Bochs [879047] APIC timer behavior different before reset and after [1188506] I still can't install the german Windows XP! [1301847] Windows XP dosn't boot - FXRSTOR problem ? [661259] does not boot QNX under WinX [924412] Keyboard lock states all whacked [681127] MIPSpro compiler (IRIX) is allergic to ^M [1285923] BIOS keyboard handler [516639] ATA controller revisited... [657918] does not boot BeOS under WinX [649245] BeOS CD locks halfway on boot [1094385] Attachment for bug 1090339 (beos failure) [1183196] BeOS 4.5 developer CD does not install [1090339] BeOS fails to boot [639484] panics when int 13 is called [711701] divide by zero [704295] ATAPI/BIOS call missing [682856] hard drive problems [627691] Cursor keys problem [588011] keyboard not working [542260] os/2 warp crashes with floppy handling [1273878] SB16 doesn't work in pure DOS [542254] OS/2 FDC driver dies [1099610] Windows 98 SE Does not install [875479] cr3 problem on task switch [731423] NE2000 causing PANIC on Win2K detection [1156155] bochs fails to boot plan9 iso [1251979] --enable-cpu-level=3 should assume --without-fpu [1257538] Interupt 15h 83h - set wait event interval [658396] Panic for DR DOS emm386 [679339] /? doesn't divulge Bochs command-line syntax [1167016] call/jump/return_protected doesn't support x86-64 [1252432] Mac OS X compile bug [881442] Bochs 2.1 PANIC when loading DOS Turbo Pascal protected mode [1249324] Boch2.2.1 Buffer Overfollow in void bx_local_apic_c::init () [1197144] 'make install' has dependency on wget [1079595] LTR:386TSS: loading tr.limit < 103 [1244070] Compilation Error in gui/rfb.cc [761707] CPU error when trying to start Privateer [517281] Crash running Privateer in DOS... ------------------------------------------------------------------------- Changes in 2.2.1 (July 8, 2005): - Fixed several compilation warnings and errors for different platforms (Volker) - Fixed FPU tag word restore in FXRSTOR instruction (Stanislav) - Added missing scancodes for F11 and F12 to BIOS translation table (Volker) - Bochs disassembler bugfixes (h.johansson) - About 5% emulation speed improvement (h.johansson) - Handle writing of zero to APIC timer initial count register (Stanislav) - Enable Idle-Hack for 'TERM' GUI (h.johansson) - Reduced overhead of BX_SHOW_IPS option to minimum. Now every simulation could run with --enable-show-ips without significant performance penalty. (Stanislav) - Fixed pcipnic register access (Volker) - Limited write support for TFTP server in 'vnet' networking module added (Volker) - Changed some timing defaults to more useful values (Volker) - WinXP/2003 style common controls now supported (Vitaly Vorobyov) - Updated LGPL'd VGABIOS to version 0.5c (Volker) - Added new BX_INSTR_HLT callback to instrumentation (Stanislav) ------------------------------------------------------------------------- Changes in 2.2 (May 28, 2005): Brief summary : - New floating point emulator based on SoftFloat floating point emulation library. - improved x86-64 emulation - Cirrus SVGA card emulation added - status bar with indicators for keyboard, floppy, cdrom and disk (gui dependant) - many improvements in Bochs emulated I/O devices (e.g. PCI subsystem) Detailed change log : - CPU - fixes for booting OS/2 by Dmitri Froloff - fixed v8086 priveleged instruction processing bug (was also reported by LightCone Aug 7 2003) - exception process bug (was reported by Diego Henriquez Sat Nov 15 01:16:51 CET 2003) - segment validation with IRET instruction - CS segment not present exception processing with IRET - several fixes by Kevin Lawton - add MSVC host asm instructions (patch by suzu) - fixed bug in HADDPD/HSUBP
发帖
VC/MFC

1.6w+

社区成员

VC/MFC相关问题讨论
社区管理员
  • 基础类社区
  • Web++
  • encoderlee
加入社区
帖子事件
创建了帖子
2001-08-03 11:53
社区公告

        VC/MFC社区版块或许是CSDN最“古老”的版块了,记忆之中,与CSDN的年龄几乎差不多。随着时间的推移,MFC技术渐渐的偏离了开发主流,若干年之后的今天,当我们面对着微软的这个经典之笔,内心充满着敬意,那些曾经的记忆,可以说代表着二十年前曾经的辉煌……
        向经典致敬,或许是老一代程序员内心里面难以释怀的感受。互联网大行其道的今天,我们期待着MFC技术能够恢复其曾经的辉煌,或许这个期待会永远成为一种“梦想”,或许一切皆有可能……
        我们希望这个版块可以很好的适配Web时代,期待更好的互联网技术能够使得MFC技术框架得以重现活力,……