阅读:2864回复:4
usbstor.sys的adddevice例程的IoCreateDevice的调用
今天中午闲的时候用IDA反汇编usbstor.sys,发现它的AddDevice例程调用IoCreateDevice有点奇怪:
PAGE:00011D0A push ebp PAGE:00011D0B mov ebp, esp PAGE:00011D0D lea eax, [ebp+arg_0] PAGE:00011D10 push eax PAGE:00011D11 push 0 PAGE:00011D13 push 80h PAGE:00011D18 push 2Ah PAGE:00011D1A push 0 PAGE:00011D1C push 58h PAGE:00011D1E push [ebp+arg_0] PAGE:00011D21 call ds:IoCreateDevice PAGE:00011D27 test eax, eax PAGE:00011D29 jl short loc_11D95 PAGE:00011D2B mov eax, [ebp+arg_0] PAGE:00011D2E push edi 等同于c程序的调用: IoCreateDevice( DriverObject, sizeof(DriverExtension), 0, FILE_DEVICE_BUS_EXTENDER, FILE_AUTOGENERATED_DEVICE_NAME, FALSE, &(PDEVICE_OBJECT)DriverObject ); 真想不明白,ms 为啥要这么用....?想一想,我觉得向它这么作也不影响什么(效果一样)?但它为什么不用正常的方法哪? |
|