Assembly -- Reading MBR content in NT

 

; **************************************** **********
; ReadMBROnDiskNT. asm
Function: Read MBR from Windows NT, 2 K, and XP
;
; **************************************** **********
. 386 p
. Model flat, stdcall; flat memory mode
Option casemap: none; case sensitive
; **************************************** ***********
Include \ masm32 \ include \ windows. inc
Include \ masm32 \ include \ user32.inc
Include \ masm32 \ include \ kernel32.inc
Include \ masm32 \ include \ advapi32.inc

Includelib \ masm32 \ lib \ user32.lib
Includelib \ masm32 \ lib \ kernel32.lib
Includelib \ masm32 \ lib \ advapi32.lib

Showerror proto: DWORD
Showbuffer proto

. Data; data segment
Filename db' \. \ physicaldrive0 ', 0; open the first physical hard disk
Align 4; double-font alignment
Readed dd 0; number of bytes actually read
Buffer dB 512 DUP (0); buffer for storing read data
HFile dd 0; handle storage

Caption db 'nt reading/writing physical disks', 0; Caption string
ErrCreate db' file creation error. This program cannot be executed in Win9X! ', 0; error message
ErrRead db' disk reading error! ', 0; error message

Showtext dB 4096*3 DUP (0); string used for display after conversion
Number dB '0123456789abcdef '; hexadecimal number to the data to be used by acⅱ code

. Code; Code segment
Main:
; Create a file
Invoke createfile, offset filename ,\
Generic_read, file_1__read or file_1__write ,\
Null, open_existing, null, null
Mov [hFile], eax
Cmp eax, INVALID_HANDLE_VALUE
Jnz read
Invoke ShowError, offset ErrCreate; error message displayed
Read:; read data
Invoke ReadFile, eax, offset Buffer, 512, offset readed, NULL
Cmp eax, 0
Jnz show
Invoke showerror, offset errread; error message displayed
Show:
Invoke showbuffer; display read content
Invoke closehandle, [hfile]; close the file handle
Invoke ExitProcess, 0; exit
ShowError proc, MESSAGE: DWORD; displays error information and exits
Invoke MessageBoxA, NULL, MESSAGE, offset Caption, MB_ OK
Cmp [hFile], 0
Jz ShowErrorEnd
Invoke CloseHandle, [hFile]; close the handle
ShowErrorEnd:
Invoke ExitProcess, 0; exit
ShowError endp

ShowBuffer proc; display the read information
Convert hexadecimal data into ASCII code
Mov esi, offset Buffer; Data
Mov edi, offset ShowText; converted data
Mov ebx, offset Number
Mov ecx, 0
Xor eax, eax
Again:
Cmp [readed], 0
Jz ConversionEnd
Dec [readed]
Mov al, [esi]
Push eax
Shr eax, 4; 4-digit high
Mov al, [ebx + eax]
Mov byte ptr [edi], al
Inc edi
Pop eax
And eax, 0FH; 4-bit low
Mov al, [ebx + eax]
Mov byte ptr [edi], al
Inc edi
Mov byte ptr [edi], ''; space
Inc edi
Inc esi
Inc ecx
Cmp ecx, 16
Jnz Again
XOR ECx, ECx
MoV byte PTR [edi-1], 13; Is carriage return
JMP again
Conversionend:
; Display the converted string
Invoke messageboxa, null, offset showtext, offset caption, mb_ OK
RET
Showbuffer endp
End main