由于我没有物理的两台机器，因此我这里使用虚拟机来进行讲解(虚拟机真是个好东西)。我将先讲述如何设置，然后以一个实例来讲述如何进行内核驱动的调试。

Target环境：
Virtual PC 2004、Win2000 sp 4 en

Host环境：
WinXP sp2, WinDBG 6.6.07.5, SUDT SerialNull 1.6 试用版

一) 设置篇
SUDT SerialNull是一个虚拟串口软件，用于模拟RS232串口的虚拟连接，SerialNull 可以在不占用真实串口的情况下，创建任意数量并互为连接的纯虚拟串口对。
我们将用这个软件虚拟一个串口对出来供Host与Target使用。

如图：

 

我们虚拟了一个串口对，COM2-COM3，这对串口是联通的。

在VirtualPC中设置：

进行入虚拟机系统(Win2k)，打开boot.ini文件，添加一行，如下：
multi(0)disk(0)rdisk(0)partition(1)\WINNT=”Microsoft Windows 2000 Professional”/fastdetect /debug /debugport=com1 /baudrate=115200
意思是以Debug模式起动系统，调试端口为COM1，波特率为115200

重新以Debug模式启动系统：

在Host端,启动WinDBG，选File->KernelDebug…，COM页，在BaudRate输入115200，Port输入我们建立的虚拟串口对的COM2口，钩上Reconnected：

点击“OK”之后在COMMAND窗口出现：
Opened \\.\com2
Waiting to reconnect…
此时按Ctrl+Break，会出现如下画面：

调试器显示：“Connected to Windows 2000 2195 x86 compatible target, ptr64 FALSE”，此时代表连接目标成功，处于中断状态，我们
可以在File->Symbol File Path…中设置符号路径，我习惯于使用Symbol Server，因此我在这里设置了：

SRV*f:\symbols*http://msdl.microsoft.com/download/symbols

 到此时我们的双机调试环境搭建完成。此环境已经可以工作了。

 二) 实例讲解

接着上面的步骤，我将以一个软件做为实例进行讲解，做为练习目标的软件是国产软件，在此隐去软件名称，我使用A软件代替。

在command窗口输入：G，此命令跟SoftICE中的G一样，让程序继续运行。

将A软件安装在虚拟机中，安装完成后，运行A软件，进入注册界面，此时我们在WinDBG中再次按Ctrl+Break，让Target中断下来，A软件的注册算法在驱动程序snbus.sys中DeviceControl例程中（为什么在snbus中的DeviceControl例程中，请自行跟踪应用程序并查看DDK的相关文档就知道了，这里的重点不是Crack软件，而是讲内核驱动的调试），在Command窗口中输入：
!drvobj snbus 2

!drvobj命令类似于SoftICE中的driver命令，用于显示驱动对象的相关信息，具体的用法请参看WinDBG的帮助文档，当我们输入!drvobj snbus 2时，我们将得到这个驱动的Dispatch routines信息：

kd> !drvobj snbus 2

2.  \Driver\SnBus    
3. Dispatch     routines:
4. [00]     IRP_MJ_CREATE                          f7353aa0 +0xf7353aa0
5. [01]     IRP_MJ_CREATE_NAMED_PIPE               80423f0c nt!IopInvalidDeviceRequest
6. [02]     IRP_MJ_CLOSE                           f7353aa0 +0xf7353aa0
7. [03]     IRP_MJ_READ                            80423f0c nt!IopInvalidDeviceRequest
8. [04]     IRP_MJ_WRITE                           80423f0c nt!IopInvalidDeviceRequest
9. [05]     IRP_MJ_QUERY_INFORMATION               80423f0c nt!IopInvalidDeviceRequest
10. [06]     IRP_MJ_SET_INFORMATION                 80423f0c nt!IopInvalidDeviceRequest
11. [07]     IRP_MJ_QUERY_EA                        80423f0c nt!IopInvalidDeviceRequest
12. [08]     IRP_MJ_SET_EA                          80423f0c nt!IopInvalidDeviceRequest
13. [09]     IRP_MJ_FLUSH_BUFFERS                   80423f0c nt!IopInvalidDeviceRequest
14. [0a]     IRP_MJ_QUERY_VOLUME_INFORMATION        80423f0c nt!IopInvalidDeviceRequest
15. [0b]     IRP_MJ_SET_VOLUME_INFORMATION          80423f0c nt!IopInvalidDeviceRequest
16. [0c]     IRP_MJ_DIRECTORY_CONTROL               80423f0c nt!IopInvalidDeviceRequest
17. [0d]     IRP_MJ_FILE_SYSTEM_CONTROL             80423f0c nt!IopInvalidDeviceRequest
18. [0e]     IRP_MJ_DEVICE_CONTROL                  f7353b1a +0xf7353b1a
19. [0f]     IRP_MJ_INTERNAL_DEVICE_CONTROL         80423f0c nt!IopInvalidDeviceRequest
20. [10]     IRP_MJ_SHUTDOWN                        80423f0c nt!IopInvalidDeviceRequest
21. [11]     IRP_MJ_LOCK_CONTROL                    80423f0c nt!IopInvalidDeviceRequest
22. [12]     IRP_MJ_CLEANUP                         80423f0c nt!IopInvalidDeviceRequest
23. [13]     IRP_MJ_CREATE_MAILSLOT                 80423f0c nt!IopInvalidDeviceRequest
24. [14]     IRP_MJ_QUERY_SECURITY                  80423f0c nt!IopInvalidDeviceRequest
25. [15]     IRP_MJ_SET_SECURITY                    80423f0c nt!IopInvalidDeviceRequest
26. [16]     IRP_MJ_POWER                           f735065e +0xf735065e
27. [17]     IRP_MJ_SYSTEM_CONTROL                  f7354db8 +0xf7354db8
28. [18]     IRP_MJ_DEVICE_CHANGE                   80423f0c nt!IopInvalidDeviceRequest
29. [19]     IRP_MJ_QUERY_QUOTA                     80423f0c nt!IopInvalidDeviceRequest
30. [1a]     IRP_MJ_SET_QUOTA                       80423f0c nt!IopInvalidDeviceRequest
31. [1b]     IRP_MJ_PNP                             f7354590 +0xf7354590

我们找到了

[0e]IRP_MJ_DEVICE_CONTROL             f7353b1a +0xf7353b1a
知道DeviceControl例程的入口在0xf7353b1a处，于是我们在0xf7353b1a处设下断点，在Command窗口中输入：

bp 0xf7353b1a

bp指令相当于softice的bpx，后面跟“地址”即可在指定地址设下断点，具体用法请参加WinDBG的帮助。

输入G，让Target继续跑起来，此时我们在注册窗口中输入我们的注册用户名与假码：
xIkUg
aaaaaaaa-bbbbbbbb-cccccccc-dddddddd

点“确定”，此时WinDBG把Target中断了下来，中断之处正是我们刚才设置的DeviceControl的例程处0xf7353b1a：

2. f7353b1c     55                  push    ebp
3. f7353b1d     8bec                mov     ebp,esp
4. f7353b1f     51                  push    ecx
5. f7353b20     8b4508              mov     eax,dword ptr     [ebp+8]                  ; [ebp+8] = DeviceObject
6. f7353b23     56                  push    esi
7. f7353b24     57                  push    edi
8. f7353b25     8b7828              mov     edi,dword ptr     [eax+28h]                ; [eax+28h] = DEVICE_OBJECT.DeviceExtension
9. f7353b28     807f0400            cmp     byte ptr     [edi+4],0                     ; ds:0023:8145494c=01
10. f7353b2c     897dfc              mov     dword ptr [ebp-4],edi                  ; 保存设备扩展
11. f7353b2f     751a                jne         f7353b4b                               ; 8145494c如果为真则跳，否则执行下面的代码并退出这个 routine
12. f7353b31     8b4d0c              mov     ecx,dword ptr     [ebp+0Ch]                ; Irp
13. f7353b34     be100000c0      mov         esi,0C0000010h                         ; 0C0000010h = STATUS_INVALID_DEVICE_REQUEST
14. f7353b39     32d2                xor     dl,dl
15. f7353b3b     897118              mov     dword ptr     [ecx+18h],esi                ; [ecx+18h] = IoStatus
16. f7353b3e     ff15182635f7    call    dword ptr ds:[0F7352618h]              ; [0F7352618h] = IofCompleteRequest
17. f7353b44     8bc6                mov         eax,esi                                ; 返回状态
18. f7353b46     e977020000      jmp         f7353dc2                               ; Exit

在这里你可能看到这些代码后的注解可能会问为什么是这样的？不急，让我们看看MSND，DeviceControl的函数原型如下：

2.         IN PDEVICE_OBJECT DeviceObject,
3.         IN PIRP Irp);

于是我们知道f7353b20 的[ebp+8] 指向DeviceObject

在Command窗口输入dt _DEVICE_OBJECT，我们得到如下信息：

kd> dt _DEVICE_OBJECT

2.        +0x002     Size                 : Uint2B
3.        +0x004 ReferenceCount   : Int4B
4.        +0x008 DriverObject     : Ptr32 _DRIVER_OBJECT
5.        +0x00c NextDevice       : Ptr32     _DEVICE_OBJECT
6.        +0x010 AttachedDevice   : Ptr32 _DEVICE_OBJECT
7.        +0x014 CurrentIrp       : Ptr32 _IRP
8.        +0x018     Timer            :     Ptr32 _IO_TIMER
9.        +0x01c     Flags            :     Uint4B
10.        +0x020 Characteristics  : Uint4B
11.        +0x024     Vpb                  : Ptr32 _VPB
12.        +0x028 DeviceExtension  : Ptr32 Void
13.        +0x02c DeviceType       : Uint4B
14.        +0x030 StackSize        : Char
15.        +0x034     Queue            :     __unnamed
16.        +0x05c AlignmentRequirement : Uint4B
17.        +0x060 DeviceQueue      : _KDEVICE_QUEUE
18.        +0x074     Dpc                  : _KDPC
19.        +0x094 ActiveThreadCount : Uint4B
20.        +0x098 SecurityDescriptor : Ptr32 Void
21.        +0x09c DeviceLock       : _KEVENT
22.        +0x0ac SectorSize       : Uint2B
23.        +0x0ae Spare1               : Uint2B
24.        +0x0b0 DeviceObjectExtension : Ptr32 _DEVOBJ_EXTENSION
25.        +0x0b4 Reserved         : Ptr32     Void

通过这个结构我们知道f7353b25 的[eax+28h] 是指DeviceObject偏移0×28处，即是指向 DEVICE_OBJECT.DeviceExtension，
同理，我们可以知道f7353b31 的[ebp+0Ch]是指Irp了

好，话就到这里，相当聪明的你应该都知道后面我讲的那些东西是怎么得出来的了，后面我会大致讲一讲，不会讲得太细，毕竟这篇文章的重
点不是将Crack，如果你还不懂的话可能需要补一下相关的Crack知识。

当我们输入假码后，运行上面的代码之后会由f7353b2f跳到f7353b4b：

;跳到这里来执行

2. f7353b4c     e835c9ffff      call    f7350486
3. f7353b51     837f0806            cmp     dword ptr [edi+8],6
4. f7353b55     8b750c              mov     esi,dword ptr     [ebp+0Ch]                ; Esi = Irp
5. f7353b58     750c                jne         f7353b66                               ; 跳

跳到这里来执行

2. f7353b69     8b5008              mov     edx,dword ptr     [eax+8]                  ; edx = CurrentIoStackLocation.Parameters.InputBufferLength
3. f7353b6c     8b400c              mov     eax,dword ptr     [eax+0Ch]                ; eax = CurrentIoStackLocation.Parameters.IoControlCode = 2A4010h
4. f7353b6f     b914402a00      mov         ecx,2A4014h                            ; ecx = IOCTL_CODE
5. f7353b74     3bc1                cmp         eax,ecx                                ; 比较IO控制码
6. f7353b76     53                  push    ebx
7. f7353b77     8b5e0c              mov     ebx,dword ptr     [esi+0Ch]                ; ebx = Irp.AssociatedIrp.SystemBuffer, 指向输入缓冲区
8. f7353b7a     c745080d0000c0  mov     dword ptr     [ebp+8],0C000000Dh

上面的注解得出方法同前面的一致：

kd> dt -b _IRP

2.        +0x002     Size                 : Uint2B
3.        +0x004 MdlAddress       : Ptr32
4.        +0x008     Flags            :     Uint4B
5.        +0x00c AssociatedIrp    : __unnamed
6.           +0x000 MasterIrp        : Ptr32
7.           +0x000 IrpCount         : Int4B
8.           +0x000 SystemBuffer     : Ptr32
9.        +0x010 ThreadListEntry  : _LIST_ENTRY
10.           +0x000     Flink            :     Ptr32
11.           +0x004     Blink            :     Ptr32
12.        +0x018 IoStatus         :     _IO_STATUS_BLOCK
13.           +0x000 Status               : Int4B
14.           +0x000 Pointer          :     Ptr32
15.           +0x004 Information      : Uint4B
16.        +0x020 RequestorMode    : Char
17.        +0x021 PendingReturned  : UChar
18.        +0x022 StackCount       : Char
19.        +0x023 CurrentLocation  : Char
20.        +0x024 Cancel               : UChar
21.        +0x025 CancelIrql       : UChar
22.        +0x026 ApcEnvironment   : Char
23.        +0x027 AllocationFlags  : UChar
24.        +0x028 UserIosb         : Ptr32
25.        +0x02c UserEvent        : Ptr32
26.        +0x030 Overlay          :     __unnamed
27.           +0x000 AsynchronousParameters : __unnamed
28.              +0x000 UserApcRoutine   : Ptr32
29.              +0x004 UserApcContext   : Ptr32
30.           +0x000 AllocationSize   : _LARGE_INTEGER
31.              +0x000 LowPart          :     Uint4B
32.              +0x004 HighPart         : Int4B
33.              +0x000 u                    : __unnamed
34.                 +0x000 LowPart          :     Uint4B
35.                 +0x004 HighPart         : Int4B
36.              +0x000 QuadPart         : Int8B
37.        +0x038 CancelRoutine    : Ptr32
38.        +0x03c UserBuffer       : Ptr32
39.        +0x040     Tail                 : __unnamed
40.           +0x000 Overlay          :     __unnamed
41.              +0x000 DeviceQueueEntry : _KDEVICE_QUEUE_ENTRY
42.                 +0x000 DeviceListEntry  : _LIST_ENTRY
43.                    +0x000     Flink            :     Ptr32
44.                    +0x004     Blink            :     Ptr32
45.                 +0x008 SortKey          :     Uint4B
46.                 +0x00c Inserted         : UChar
47.              +0x000 DriverContext    : Ptr32
48.              +0x010 Thread               : Ptr32
49.              +0x014 AuxiliaryBuffer  : Ptr32
50.              +0x018 ListEntry        : _LIST_ENTRY
51.                 +0x000     Flink            :     Ptr32
52.                 +0x004     Blink            :     Ptr32
53.              +0x020 CurrentStackLocation : Ptr32
54.              +0x020 PacketType       : Uint4B
55.              +0x024 OriginalFileObject : Ptr32
56.           +0x000 Apc                  : _KAPC
57.              +0x000     Type                 : Int2B
58.              +0x002     Size                 : Int2B
59.              +0x004 Spare0               : Uint4B
60.              +0x008 Thread               : Ptr32
61.              +0x00c ApcListEntry     : _LIST_ENTRY
62.                 +0x000 Flink                : Ptr32
63.                 +0x004     Blink            :     Ptr32
64.              +0x014 KernelRoutine    : Ptr32
65.              +0x018 RundownRoutine   : Ptr32
66.              +0x01c NormalRoutine    : Ptr32
67.              +0x020 NormalContext    : Ptr32
68.              +0x024 SystemArgument1  : Ptr32
69.              +0x028 SystemArgument2  : Ptr32
70.              +0x02c ApcStateIndex    : Char
71.              +0x02d ApcMode          :     Char
72.              +0x02e Inserted         : UChar
73.           +0x000 CompletionKey    : Ptr32

kd> dt -b _IO_STACK_LOCATION

2.        +0x001 MinorFunction    : UChar
3.        +0x002     Flags            :     UChar
4.        +0x003 Control          :     UChar
5.        +0x004 Parameters       : __unnamed
6.      
7.           ...... 省略若干     ......
8.      
9.           +0x000 DeviceIoControl  : __unnamed
10.              +0x000 OutputBufferLength : Uint4B
11.              +0x004 InputBufferLength : Uint4B
12.              +0x008 IoControlCode    : Uint4B
13.              +0x00c Type3InputBuffer : Ptr32
14.      
15.           ...... 省略若干     ......
16.      
17.        +0x014 DeviceObject     : Ptr32
18.        +0x018 FileObject       : Ptr32
19.        +0x01c CompletionRoutine : Ptr32
20.        +0x020 Context          :     Ptr32

通过上面的代码我们得到了输入缓冲区和其长度，并且取得了控制码为2A4010H，EBX指向输入缓冲区，EDX为其长度，值为604H，于是我们在
Command中输入如下命令来查看一下内存中的数据：

kd> d ebx L0×604

2. 812715d8      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
3. 812715e8      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
4. 812715f8      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
5. 81271608      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
6. 81271618      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
7. 81271628      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
8. 81271638      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
9. 81271648      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
10. 81271658      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
11. 81271668      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
12. 81271678      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
13. 81271688      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
14. 81271698      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
15. 812716a8      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
16. 812716b8      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
17. 812716c8      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
18. 812716d8      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
19. 812716e8      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
20. 812716f8      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
21. 81271708      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
22. 81271718      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
23. 81271728      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
24. 81271738      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
25. 81271748      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
26. 81271758      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
27. 81271768      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
28. 81271778      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
29. 81271788      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
30. 81271798      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
31. 812717a8      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
32. 812717b8      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
33. 812717c8      00 00 00 00 78 49 6b 55-67 00 00 00 00 00 00 00  ....xIkUg.......
34. 812717d8      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
35. 812717e8      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
36. 812717f8      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
37. 81271808      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
38. 81271818      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
39. 81271828      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
40. 81271838      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
41. 81271848      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
42. 81271858      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
43. 81271868      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
44. 81271878      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
45. 81271888      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
46. 81271898      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
47. 812718a8      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
48. 812718b8      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
49. 812718c8      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
50. 812718d8      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
51. 812718e8      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
52. 812718f8      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
53. 81271908      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
54. 81271918      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
55. 81271928      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
56. 81271938      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
57. 81271948      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
58. 81271958      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
59. 81271968      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
60. 81271978      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
61. 81271988      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
62. 81271998      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
63. 812719a8      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
64. 812719b8      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
65. 812719c8      00 00 00 00 41 41 41 41-41 41 41 41 42 42 42 42  ....AAAAAAAABBBB
66. 812719d8      42 42 42 42 43 43 43 43-43 43 43 43 44 44 44 44  BBBBCCCCCCCCDDDD
67. 812719e8      44 44 44 44 00 00 00 00-00 00 00 00 00 00 00 00  DDDD............
68. 812719f8      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
69. 81271a08      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
70. 81271a18      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
71. 81271a28      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
72. 81271a38      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
73. 81271a48      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
74. 81271a58      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
75. 81271a68      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
76. 81271a78      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
77. 81271a88      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
78. 81271a98      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
79. 81271aa8      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
80. 81271ab8      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
81. 81271ac8      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
82. 81271ad8      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
83. 81271ae8      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
84. 81271af8      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
85. 81271b08      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
86. 81271b18      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
87. 81271b28      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
88. 81271b38      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
89. 81271b48      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
90. 81271b58      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
91. 81271b68      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
92. 81271b78      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
93. 81271b88      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
94. 81271b98      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
95. 81271ba8      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
96. 81271bb8      00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
97. 81271bc8      00 00 00     00                                          ....

在这604H个字节中包含了我们输入的用户名和注册码。

好，我们继续向下走：

2. f7353b87     0f84d2000000    je      f7353c5f
3. f7353b8d     2d00402a00      sub         eax,2A4000h                            ; IO控制码减2A4000h    
4. f7353b92     0f8488000000    je          f7353c20                               ; 为2A4000h跳
5. f7353b98     83e804              sub     eax,4
6. f7353b9b     7469                je          f7353c06                               ; 为2A4004h跳
7. f7353b9d     83e804              sub     eax,4
8. f7353ba0     7444                je          f7353be6                               ; 为2A4008h跳
9. f7353ba2     83e808              sub     eax,8
10. f7353ba5     0f85f8010000    jne         f7353da3                               ; 不为2A4010h的话则结束处理

此处是处理控制码为2A4010h的代码

2. f7353bb2     0f85eb010000    jne         f7353da3                               ; 已经注册则结束处理
3. f7353bb8     b804060000      mov         eax,604h                               ;
4. f7353bbd     3bd0                cmp         edx,eax                                ; 缓冲区长度是否为604h    
5. f7353bbf     0f85de010000    jne         f7353da3                               ; 不为604h则结束处理
6. f7353bc5     3903                cmp     dword ptr     [ebx],eax                    ; 比较缓冲区的长度
7. f7353bc7     0f85d6010000    jne         f7353da3                               ; 不为604h则结束处理

从前面知道 edi 指向设备扩展, ebx 指向 输入缓冲区，后面就处理结束了，因此可以知道f7351532是处理注册的算法函数，我们跟进

2. f7353bce     53                  push    ebx
3. f7353bcf     e85ed9ffff      call        f7351532                               ; 跟进
4. f7353bd4     85c0                test    eax,eax
5. f7353bd6     894508              mov     dword ptr [ebp+8],eax                  ; 保存注册结果
6. f7353bd9     0f94c0              sete    al
7. f7353bdc     a2803535f7      mov     byte     ptr ds:[F7353580h],al
8. f7353be1     e9bd010000      jmp         f7353da3                               ; 处理结束

跟进f7351532后我们来到这里：

2. f7351534     55                  push    ebp
3. f7351535     8bec                mov     ebp,esp
4. f7351537     81ecac000000    sub     esp,0ACh
5. f735153d     803d183a35f700  cmp     byte ptr     ds:[0F7353A18h],0 ds:0023:f7353a18=01
6. f7351544     a1a03335f7      mov         eax,dword ptr ds:[F73533A0h]
7. f7351549     53                  push    ebx
8. f735154a     8b5d08              mov     ebx,dword ptr     [ebp+8]                  ; [ebp+8] = 输入缓冲区
9. f735154d     56                  push    esi
10. f735154e     8b750c              mov     esi,dword ptr     [ebp+0Ch]                ; [ebp+0Ch] = DeviceExtension
11. f7351551     8945fc              mov     dword ptr [ebp-4],eax
12. f7351554     c6855bffffff00  mov     byte ptr [ebp-0A5h],0
13. f735155b     750a                jne         f7351567                               ; 跳
14. f735155d     b8010000c0      mov         eax,0C0000001h
15. f7351562     e9e3000000      jmp         f735164a
16. f7351567     8d4e30              lea         ecx,[esi+30h]                          ; 跳到这里
17. f735156a     57                  push    edi
18. f735156b     898d54ffffff    mov     dword ptr     [ebp-0ACh],ecx ss:0010:bcbc1b34=00000000
19. f7351571     ff15802535f7    call    dword ptr     ds:[0F7352580h]          ;     call    ds:ExAcquireFastMutex
20. f7351577     6a0a                push    0Ah
21. f7351579     59                  pop     ecx
22. f735157a     33c0                xor     eax,eax
23. f735157c     8d7d84              lea     edi,[ebp-7Ch]
24. f735157f     56                  push    esi
25. f7351580     f3ab            rep     stos dword ptr es:[edi]  es:0023:bcbc1b64=00000000
26. f7351582     e851fdffff      call    f73512d8
27. f7351587     be083a35f7      mov         esi,0F7353A08h
28. f735158c     8d7dcc              lea     edi,[ebp-34h]
29. f735158f     a5                  movs    dword ptr es:[edi],dword ptr [esi]
30. f7351590     a5                  movs    dword ptr es:[edi],dword ptr [esi]
31. f7351591     8d45dc              lea         eax,[ebp-24h]                          ; [ebp-24h] = 存放用户名MD5值的缓冲区
32. f7351594     a5                  movs    dword ptr es:[edi],dword ptr [esi]
33. f7351595     50                  push    eax
34. f7351596     8d8304020000    lea     eax,[ebx+204h]
35. f735159c     50                  push    eax
36. f735159d     a5                  movs    dword ptr es:[edi],dword ptr [esi] ; 这一段是把序列号复制到edi指向的地方

我们对比一下，在驱动内部的序列号表示和ring3应用程序中显示的序列号，某些数字是被替换过了，他们有一种对应关系：

2. A513C11W-26F73M4E-56M919DW-3WFE2WCC

对应关系为：

2. 0-M    
3. B-K

继续往下：

2. f73515a3     6a0a                push    0Ah
3. f73515a5     59                  pop     ecx

从f735127e跟进，我们来到下面的地方：

2. f7351280     55                  push    ebp
3. f7351281     8bec                mov     ebp,esp
4. f7351283     e898f5ffff      call        f7350820                               ; 初始化MD5种子
5. f7351288     8b4508              mov     eax,dword ptr     [ebp+8]                  ; [ebp+8] = 用户名
6. f735128b     8d4801              lea     ecx,[eax+1]
7. f735128e     8a10                mov     dl,byte ptr [eax]
8. f7351290     40                  inc     eax
9. f7351291     84d2                test    dl,dl
10. f7351293     75f9                jne     f735128e
11. f7351295     2bc1                sub     eax,ecx                                ; 求用户名长度
12. f7351297     50                  push        eax                                    ; 长度入栈
13. f7351298     ff7508              push    dword ptr     [ebp+8]                      ; 用户名入栈
14. f735129b     e874feffff      call        f7351114                               ; 求用户名的md5值
15. f73512a0     ff750c              push    dword ptr     [ebp+0Ch]                    ; [ebp+0Ch] = md5值缓冲区
16. f73512a3     e836ffffff      call        f73511de                               ; 把用户名的md5值放入缓冲区
17. f73512a8     5d                  pop     ebp
18. f73512a9     c20800              ret         8                                      ; 返回

我们于是知道f735127e函数是求md5值的，从这个函数返回后，我们继续：

2. f73515a5     59                  pop     ecx
3. f73515a6     33c0                xor     eax,eax
4. f73515a8     8dbd5cffffff    lea         edi,[ebp-0A4h]                         ; [ebp-0A4h] = 存放md5值字符串的缓冲区
5. f73515ae     f3ab            rep     stos dword ptr     es:[edi]                    ; 缓冲区清0
6. f73515b0     8d855cffffff    lea     eax,[ebp-0A4h]
7. f73515b6     50                  push        eax                                    ; 入栈
8. f73515b7     8d45dc              lea         eax,[ebp-24h]                          ; [ebp-24h] = 用户名的md5值缓冲区
9. f73515ba     50                  push        eax                                    ; 入栈
10. f73515bb     e8d8f1ffff      call        f7350798                               ; 把二进制值转为16进制字符串
11. f73515c0     6a10                push    10h
12. f73515c2     5e                  pop     esi
13. f73515c3     33c0                xor     eax,eax
14. f73515c5     5f                  pop     edi
15. f73515c6     8a4c05dc            mov     cl,byte ptr     [ebp+eax-24h]          ; 用户名的md5值
16. f73515ca     224c05cc            and     cl,byte ptr     [ebp+eax-34h]          ; 跟序列号的值进行“与”运算
17. f73515ce     40                  inc     eax
18. f73515cf     3bc6                cmp     eax,esi
19. f73515d1     884c05bb            mov     byte ptr     [ebp+eax-45h],cl          ; 运算结果放到[ebp+eax-45h]的地方
20. f73515d5     7cef                jl      f73515c6
21. f73515d7     8d45ec              lea     eax,[ebp-14h]
22. f73515da     50                  push        eax                                    ; 输出缓冲区
23. f73515db     56                  push        esi                                    ; esi = 10H, 缓冲区长度
24. f73515dc     8d45bc              lea         eax,[ebp-44h]                          ; 输入缓冲区, 指向用户名的md5值与序列号运算的结果
25. f73515df     50                  push    eax
26. f73515e0     e8cdfcffff      call        f73512b2                               ; 再次计算MD5    
27. f73515e5     8d4584              lea         eax,[ebp-7Ch]                          ; [ebp-7Ch] = 存放md5值字符串的缓冲区
28. f73515e8     50                  push    eax
29. f73515e9     8d45ec              lea         eax,[ebp-14h]                          ; [ebp-14h] = 指向刚计算出来的md5的值
30. f73515ec     50                  push    eax
31. f73515ed     e8a6f1ffff      call        f7350798                               ; 这个函数与前面的函数一样，把二进制值转为16进制字符串
32. f73515f2     8d45ec              lea         eax,[ebp-14h]                          ; md5值的输出缓冲区
33. f73515f5     50                  push        eax                                    ; 入栈
34. f73515f6     8d4584              lea     eax,[ebp-7Ch]                          ; 输入缓冲区，指向刚才转换出来的字符串
35. f73515f9     50                  push        eax                                    ; 入栈
36. f73515fa     e87ffcffff      call        f735127e                               ; 计算MD5值, 这里是最终与注册码比较的md5值了，我们设为Result_MD5
37. f73515ff     8d45ac          lea         eax,[ebp-54h]
38. f7351602     50                  push        eax                                    ; md5值输出缓冲区
39. f7351603     81c304040000    add         ebx,404h                               ; ebx = 指向我们输入的注册码
40. f7351609     53                  push    ebx
41. f735160a     e86ffcffff      call        f735127e                               ; 计算md5值
42. f735160f     33c0                xor     eax,eax
43. f7351611     8a4c05ac            mov     cl,byte ptr     [ebp+eax-54h]          ;     [ebp+eax-54h] = 我们输入的注册码的md5值
44. f7351615     3a4c05ec            cmp     cl,byte ptr     [ebp+eax-14h]          ; 与Result_MD5[eax]进行比较
45. f7351619     7505                jne         f7351620                               ; 不一样就失败跳
46. f735161b     40                  inc     eax
47. f735161c     3bc6                cmp     eax,esi
48. f735161e     7cf1                jl      f7351611
49. f7351620     3bc6            cmp         eax,esi                                ; eax索引与esi表示长度是否一样，这句话的意思就是看是不是把md5值的各字节都比较完了
50. f7351622     b301                mov         bl,1                                   ;
51. f7351624     7406                je          f735162c                               ; 如果是比较完成则证明注册码是正确的，注册成功
52. f7351626     8a9d5bffffff    mov     bl,byte ptr     [ebp-0A5h]                 ; [ebp-0A5h]存放的是0，表示注册失败了
53. f735162c     8b8d54ffffff    mov     ecx,dword ptr     [ebp-0ACh]
54. f7351632     ff15842535f7    call    dword ptr     ds:[0F7352584h]
55. f7351638     f6db                neg     bl
56. f735163a     1bdb                sbb     ebx,ebx
57. f735163c     81e3f3ffff3f    and     ebx,3FFFFFF3h
58. f7351642     81c30d0000c0    add     ebx,0C000000Dh
59. f7351648     8bc3                mov     eax,ebx
60. f735164a     8b4dfc              mov     ecx,dword ptr [ebp-4]
61. f735164d     5e                  pop     esi
62. f735164e     5b                  pop     ebx
63. f735164f     e86a030000      call    f73519be
64. f7351654     c9                  leave
65. f7351655     c20800              ret     8

到这里我们的算法分析就完成了。

算法总结：
1. 求用户名的md5值，设为usermd5
2. usermd5的值与序列号的值进行“与”运算，结果设为mid_result1
3. 求mid_result1的MD5值，结果设为mid_result2
4. mid_result2转换为字符串，结果设为mid_result3
5. 求mid_result3的MD5值，结果设为Result_MD5
6. 求注册码的MD5值，结果设为Regcode_MD5
7. 比较Result_MD5与Regcode_MD5，如果值都相等则注册成功，否则注册失败。