;goto make ;直接将显存数据保存为BMP图片,注意：是实验代码! .386 ;注意:保存后的BMP图片是垂直倒了90度.不知道怎么弄哈~ .model flat, stdcall;显卡物理地址可以用PCI配置空间获取,这里实验从设备管理器中获取的. option casemap:none ;作者:成松林 QQ:179641795 Email:cheng_5103@126.com ;转贴请保留作者信息,文章发篇不容易!请大家尊重下吧!!!!! include d:\masm32\include\w2k\ntstatus.inc include d:\masm32\include\w2k\hal.inc include d:\masm32\include\w2k\ntddk.inc include d:\masm32\include\w2k\win32k.inc include d:\masm32\include\w2k\ntoskrnl.inc includelib d:\masm32\lib\w2k\ntoskrnl.lib includelib d:\masm32\lib\w2k\hal.lib includelib d:\masm32\lib\w2k\win32k.lib include d:\masm32\Macros\Strings.mac .const CCOUNTED_UNICODE_STRING "\\??\\C:\\aa.bmp",uFile_Name,4 ;将显存数据写入文件 .data bmphd db 42h,4dh,36h,00h,24h,0,0000,000,0,0,036h,000,000,00,28h,0 db 000,000,000,04h,000,0,0000,003,0,0,0001,000,18h,00,000,0 db 000,000,000,00h,24h,0,0c4h,0eh,0,0,0c4h,0eh,000,00,000,0 db 000,000,000,000,000,0,0000 DataSize dd 1024*768*4 ;注意:显存屏幕数据大小,显示色彩为32位色! BmpSize dd 0 File_Handle dd 0 ScrnBuffer dd 0 ScrnPhysicalAddress dd 0f0000000h ;显存物理地地址,可用PCI配置空间端口CF8、CFC获取. ScrnSizeMemory dd 1280*1024*4 ;显存大小,可在PCI空间获取.这里用支持的最大分辨率. DisplayLineAddr dd 0 ;调用MmMapIoSpace函数映射的虚拟地址. DisplayMDLAddr dd 0 OB_AB OBJECT_ATTRIBUTES <> Status IO_STATUS_BLOCK <> ByteOffset LARGE_INTEGER<> .code ;**************************************************************************************************************** DriverEntry proc uses ebx ecx edx esi edi pDriverObject:PDRIVER_OBJECT, pusRegistryPath:PUNICODE_STRING invoke MmMapIoSpace,ScrnPhysicalAddress,0,ScrnSizeMemory,FALSE ;建立显存物理地址到线性地址映射 mov DisplayLineAddr,eax ;保存线性地址 invoke IoAllocateMdl,DisplayLineAddr,ScrnSizeMemory,FALSE,FALSE,NULL;分配显存MDL描述,以便锁定 .if eax == 0 ;注意:发现分配太大的内存会失败! invoke MmUnmapIoSpace,DisplayLineAddr,ScrnSizeMemory ;释放显存映射资源 ret .endif mov DisplayMDLAddr,eax ;保存分配的显存MDL描述 invoke MmProbeAndLockPages,DisplayMDLAddr,KernelMode,IoReadAccess OR IoWriteAccess;锁存内存操作 invoke ExAllocatePool,PagedPool,DataSize ;分配内存缓冲,拷贝显存数据 .if eax == 0 ;分配失败 invoke MmUnlockPages,DisplayMDLAddr ;解出显存锁定 invoke IoFreeMdl,DisplayMDLAddr ;释放分配的显存MDL描述 invoke MmUnmapIoSpace,DisplayLineAddr,ScrnSizeMemory ;释放显存映射资源 ret .endif mov ScrnBuffer,eax ;保存分配的内存缓冲 mov edi,ScrnBuffer mov esi,DisplayLineAddr ;esi->显存线性地址(手动获取的仅为实验) mov ecx,DisplayLineAddr add ecx,DataSize .while esi < ecx ;拷贝显存数据到本地 mov eax,[esi] mov [edi],eax add edi,3 ;BMP数据每个象素点=32位色下显存4个字节的最后一个字节去掉. add esi,4 .endw invoke MmUnlockPages,DisplayMDLAddr ;解出显存MDL描述锁定 invoke IoFreeMdl,DisplayMDLAddr ;释放分配的显存MDL描述 invoke MmUnmapIoSpace,DisplayLineAddr,ScrnSizeMemory ;释放显存映射资源 InitializeObjectAttributes addr OB_AB,addr uFile_Name,OBJ_CASE_INSENSITIVE or OBJ_KERNEL_HANDLE,NULL,NULL;宏native.inc:InitializeObjectAttributes invoke ZwCreateFile,addr File_Handle,GENERIC_WRITE,addr OB_AB,addr Status,NULL,FILE_ATTRIBUTE_NORMAL,0,FILE_OVERWRITE_IF,FILE_SYNCHRONOUS_IO_NONALERT,NULL,0 .if eax !=0 ;建立打开文件失败 ret .endif mov ByteOffset.HighPart,0 mov ByteOffset.LowPart,0 invoke ZwWriteFile,File_Handle,NULL,NULL,NULL,addr Status,addr bmphd,36h,NULL,NULL mov ByteOffset.LowPart,36h mov esi,DataSize ;每个象素点占4个字节,最后一个字节0,bmp不保存的. shr esi,2 ;esi=有多少个象素 mov edi,DataSize sub edi,esi ;edi=BMP应该保存的字节数 mov BmpSize,edi invoke ZwWriteFile,File_Handle,NULL,NULL,NULL,addr Status,ScrnBuffer,BmpSize,addr ByteOffset,NULL invoke ZwClose,File_Handle invoke ExFreePool,ScrnBuffer ;释放分分配的保存显存数据的缓冲区 mov eax, 0 ret DriverEntry endp end DriverEntry :make set drv=DRRamScreen ..\bin\ml /nologo /c /coff %drv%.bat ..\bin\link /nologo /driver /base:0x10000 /align:32 /out:%drv%.sys /subsystem:native %drv%.obj del %drv%.obj pause