.486
locals
jumps

WM_COMMAND           EQU	0111h
WM_CLOSE             EQU	0010h
WM_DESTROY           EQU	0002h

.Model Flat ,StdCall

o equ offset

extrn exitprocess:PROC
extrn RtlZeroMemory:PROC
extrn MessageBoxA:PROC
extrn WriteFile:PROC
extrn CloseHandle :PROC
extrn SetFilePointer:PROC
extrn CreateFileA:PROC
extrn SetDlgItemtextA:PROC
extrn lstrlen:PROC
extrn SendDlgItemMessageA:PROC
extrn lstrcat:PROC
extrn GetDlgItemTextA:PROC
extrn _wsprintfA:PROC
extrn SendMessageA:PROC
extrn GetModuleHandleA:PROC
extrn DialogBoxParamA:PROC

extrn OpenSCManagerW:PROC
extrn CreateServiceW:PROC
extrn StartServiceA:PROC
extrn CreateFileW:PROC
extrn GetCurrentDirectoryW:PROC
extrn CloseServiceHandle:PROC
extrn DeleteService:PROC
extrn OpenServiceW:PROC
extrn ControlService:PROC

extrn DeviceIoControl:PROC
extrn CreateProcessA:PROC
extrn Sleep:PROC

include dbg.inc


;:driver ring0.sys
;Start    Size     DrvSect  pDrvExt  DrvInit  DrvStaIo DrvUnld  Name
;F41E2000 000005A0 FF8D58C8 81635FD8 F41E22B0 00000000 F41E23BB ring0.sys
;AddDevice        : 00000000
;DeviceObject*    : 8115CB50
;Flags            : 00000012 DRVO_LEGACY_DRIVER
;HardwareDatabase : \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM
;FastIoDispatch*  : 00000000
;IRP_MJ_CREATE                       at 8:F41E233B
;IRP_MJ_CLOSE                        at 8:F41E233B
;IRP_MJ_DEVICE_CONTROL               at 8:F41E235D








.data


bytesrw dd 0
titlef  db 'Sys Load',0
msgf    db 'INT 1 Modified, OK to unload',0

kmd_path   db 400h dup (0)
Buffer     db 400h dup (0)

k_service       dd 0
driver_handle   dd 0
started_service dd 0
service_manager dd 0

kmd_name                        dw '\','r','i','n','g','0','.','s','y','s',0,0
driver_display_name             dw 'r','i','n','g','0',' ','m','o','d','u','l','e','-','y','a','t','e','s',0,0
driver_id                       dw '\','\','.','\','r','i','n','g','0',0,0
lengthofnames                   equ offset $ - offset kmd_name

myinput db 2000h dup (?)

failf db 'something went wrong',0
_hInst dd 0
wndhandle dd 0

DLG1 EQU 400

.code

main:


;-----------------------------------------------------------

        call GetModuleHandleA,0
        mov  _hInst,eax         
		
        Push 0                   
        Push offset dlg1Proc    
        Push 0                  
        Push DLG1               
        Push _hInst             
        Call DialogBoxParamA    
        
        Call ExitProcess,0      

;-----------------------------------------------------------

dlg1Proc proc uses ebx edi esi, _hwind:DWORD, wmsg:DWORD, wparama:DWORD, lparama:DWORD
		cmp [wmsg], 0110h ; WM_INITDIALOG
		jz  init
		cmp [wmsg], WM_COMMAND   
        jz  events               
        cmp [wmsg], WM_CLOSE     
        jz  kill_it             
        cmp [wmsg], WM_DESTROY   
        jz  kill_it              
		
        xor eax,eax
end_it:
        ret


kill_it:
    call unloaddriver,0AAAAAAAAh
	Call Exitprocess,0        ;Kill The Dialogbox
	
	

events:

	    cmp [wparama], 5555    
        jz  load_drv 
		
        cmp [wparama], 6666  
        jz  unloaddriver
		     
				        
        xor eax,eax
        jmp end_it

;-----------------------------------------------------------

init:

mov eax,_hwind
mov [wndhandle],eax

mov eax,_hwind
mov [LBHANDLE],eax


ret


load_drv:

         push    offset kmd_path
         push    400h
         call    GetCurrentDirectoryW
         mov     edi,offset kmd_path
         shl     eax,1
         add     edi,eax
         mov     esi,offset kmd_name
         mov     ecx,lengthofnames ;30
         rep     movsb

         push    0f003fh 
         push    0
         push    0
         call    OpenSCManagerW
         mov     [service_manager],eax

         push    0                       ; password
         push    0                       ; service start name
         push    0                       ; dependancies
         push    0                       ; tag id
         push    0                       ; load order group
         push    offset kmd_path         ; binary path name
         push    1                       ; error control code
         push    3                       ; start type      - should be 01?
         push    1                       ; service type
         push    0f01ffh                 ; desired access
         push    offset driver_display_name ; offset kmd_name+2       ; display name
         push    offset kmd_name+2       ; service name
         push    eax                     ; scmanager handle
         call    CreateServiceW
         test    eax,eax
         jz      ERROR_LDR

         mov     [started_service],eax

         push    0
         push    0
         push    eax
         call    StartServiceA

         test    eax,eax
         jz      ERROR_LDR

over_start_service:

         push    0
         push    0
         push    3 
         push    0
         push    3 
         push    0c0000000h
         push    offset driver_id
         call    CreateFileW
         cmp     eax,-1
         jz      ERROR_LDR

         mov     [driver_handle],eax
         mov     eax,1


 call dl1
 db 'Driver Loaded',0
 dl1:
 call dbg_string
  call dbg_allout,1


          mov     dword ptr [myinput],'DRXA'  ; DRX Activate
          call    DeviceIoControl,[driver_handle],10h,o myinput,10h,o myinput,10h,o bytesrw,0

ret

ERROR_LDR:
 call ess1
 db 'Driver Error; Retry',0
 ess1:
 call dbg_string
 call dbg_allout,1

 call unloaddriver,0AAAAAAAAh


ret




		  

;---------------------------------------------
unloaddriver:

          mov     dword ptr [myinput],'DRXO'  ; DRX Off
          call    DeviceIoControl,[driver_handle],10h,o myinput,10h,o myinput,10h,o bytesrw,0
		  call    sleep,80 ; let interrupt clear dr7

         push    [driver_handle]
         call    CloseHandle


         push    0f003fh 
         push    0
         push    0
         call    OpenSCManagerW
         mov     [service_manager],eax

         push    0f01ffh
         push    offset kmd_name+2
         push    [service_manager]
         call    OpenServiceW

         test    eax,eax
         jz      quitunload


         mov     [k_service],eax
         mov     esi,eax

         push    offset buffer
         push    1
         push    eax
         call    ControlService

         push    [k_service]
         call    DeleteService
         push    [k_service]
         call    CloseServiceHandle
         push    [service_manager]
         call    CloseServiceHandle
         push    [service_manager]
         call    DeleteService
         push    [started_service]
         call    DeleteService
         push    [started_service]
         call    CloseServiceHandle
quitunload:
		  call unl1
		  db 'Driver Unloaded',0
		  unl1:
		  call dbg_string
          call dbg_allout,1
		  
		  
cmp dword ptr [esp+4],0AAAAAAAAh
jne retme
call exitprocess,0
retme:
ret
;---------------------------------------------
dlg1Proc endp

end main

;-----------------------------------------------------------------------------