Análise
Eu não tenho o mesmo hardware nem uso o Windows 8.x, então o que vou fornecer é alguma estática análise .
Cordas
Inicialmente, verifiquei o arquivo de biblioteca mvs91xx.dll de 64 bits usando o utilitário Strings.
Strings just scans the file you pass it for UNICODE (or ASCII) strings of a default length of 3 or more UNICODE (or ASCII) characters.
Source: Strings
Aqui está a saída completa:
!This program cannot be run in DOS mode.
Rich
.text
'.data
.pdata
@.rsrc
@.reloc
EEE
('8PW
700PP
'''hhh
xppwpp
SeShutdownPrivilege
Change Cahce Module Policy
You must restart your computer before the new settings will take effect.
Do you want to restart your computer now?
RSDS
d:\project13_10\magni_svn\windows\win\sys\amd64\mv91xxm.pdb
%f&
B@H
L$ H
D$ '
D$(H
D$$
D$HH
D$0f
D$XH
\$P
s I
NtH
(tL
t?3
\d:\project13_10\magni_svn\windows\win\sys\amd64\mv91xxm.pdb
H
t$8H
D$PD
D$1
D$3A
T$0A
8M;
t.H
|$8H+
T$0H
tJH
0t4H
|$8H
L$0
D$(
D$
|$0H
D$0D
L$(H
D$
L$PH3
\$'I
s I
d$X
d$P
!D$0
D$T
D$4
D$8
D$<
D$X
D$PH
D$PH
L$XH
d$(
d$
D$0A
D$4
D$0
D$<
L$X
D$0
d$
%L!
u'H
d$
d$
tUH
D$(
D$
L$0H3
\$XH
D$(
D$
D$4H
D$(H
D$@E3
D$4P
D$
D$4H
D$(H
D$0E3
D$4
D$
L$0
L$0
L$@
L$@
ATH
d$
t2M
d$
t$@H
0A\
VWATAUAVH
t7H
t!H
\$PH
l$XH
A^A]A\_^
SVWH
\$
\$
uxH
D$
\$
t/L
D$
\$
D$
\$
uoE3
\$ E3
\$ H
\$
uaL
D$
\$
D$
\$
_^[
\Tag 9B1349794EE18ECCCBBD7F38FEEA9D44CC42746E
Thumbprint algorithm sha1
Thumbprint 9b 13 49 79 4e e1 8e cc cb bd 7f 38 fe ea 9d 44 cc 42 74 6e
OSAttr 2:6.1,2:6.2,2:6.3
File mvs91xx.dll
H
t$8H
@SH
McP
A8H
HcH<H
9PE
f9Q
LcA<E3
(E;
t"M+
d$0
L$0
\RegSetValueExA
RegQueryValueExA
RegCloseKey
L$8D
\L3
\$@H
\$XE3
T$'H
L$X
D$PH
|$P
tAH
D$8
D$HH
D$0H
D$@H
D$(H
D$ L
L$PL
D$XH
T$'3
D$hH
D$p3
@UH
EP=csm
E0H
@UH
Ep=csm
E8H
@UH
E'=csm
EHH
@UH
=csm
E$H
@UH
E(=csm
E4H
@UH
E@=csm
ELH
@UH
EX=csm
EhH
@UH
Ex=csm
@UH
@UH
pd
pd
strchr
atol
_XcptFilter
malloc
_initterm
free
_amsg_exit
__C_specific_handler
msvcrt.dll
SetupDiOpenDevRegKey
SETUPAPI.dll
HeapAlloc
GetCurrentProcess
HeapFree
GetProcessHeap
GetLastError
DisableThreadLibraryCalls
OutputDebugStringA
CloseHandle
LocalFree
Sleep
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
KERNEL32.dll
OpenProcessToken
RegSetValueExA
RegQueryValueExA
LookupPrivilegeValueA
AdjustTokenPrivileges
RegCloseKey
InitiateSystemShutdownExA
ADVAPI32.dll
EnableWindow
SetWindowLongPtrA
GetDlgItem
MessageBoxA
GetFocus
SendDlgItemMessageA
GetWindowLongPtrA
USER32.dll
DestroyPropertySheetPage
CreatePropertySheetPageA
COMCTL32.dll
MVCOINST.dll
ESATAPortPropPageProvider
N@
kU'9
&D(
HMXB
9;5
?q=
?Zd;
?3=
?/L[
S;uD
?$#
;1a
z?aUY
D?$?
*?}
d|F
U>c{
#Tw
zc%C1
.:3q
,%I
-64OS
NKeb
eSATAport
MatchingDeviceId
eSATAportCount
DriverPolicySet
0123
wwwwwwwwwwwwwwwwwwwwww
wwwwwwwwwwwwwwwwwwwwww
www
wwww
wwwwwwwwwww}
wwwwwwww
wwwwwwwwwwwwww
wwwwwwwwwwwwww
wwwwwww}
wwww
wwwwwww}x
}wwwwwww}
wwww
wXk
qN]
tno
<sa
_'__''_''a'_'_aaaa'
! !
i\\\\[\\\\[\a///2/////////2/22///
i\^
da2/
BB<<<<777111,,,*/
i\^
na2/
RFGHJCDKLL=>>88+/
h\^
}qq
['//"QRT$
1=>>8+2
j\^
sccy
\'2/"OQ
$%=>>*2
i\^
sccy
\a//"NO
66**
L=>(2
i\]~
rccy
\a//"WN
FTHI*++LL=(/
h\^|~
rccs
\'//'VW
RFTHJCDKLL)2
j\]x|~
rccp~
\_//'VV
QRFTHJCDKL(/
i\^wx|~pcccccb
\'//'UV
OQRFGHJCDK(/
i\]wwx|pcckrss
\a//0UU
NOQRSGHIJD(2
i\^vwwxpccr
\'///YU
WNOQRFTHIJ)/
j\]uvwwmccp
\'//9YY
VWNO5;*THI)2
j\]uuvwmccp
\a//9XY
VVWN
STH)2
i\]ouuvmccbbbbbs
\a//@XX0
RST)/
i\]oouulefffggkt
\'/2@ZXX:
;NPRF(/
h\]loouuvwwx|~
\_2/@ZZXXYYUUUVWNOPQ(/
i\]ffggkkqqqzzz{{{
\_//?MMMMEEEAAAA3345
i\\\\\\\\\\'//&&&&&--&&&&-&&&&./
illlllllll
##"
nPh
_s-
>w+
3Zz
]ZZZZZZZZZZZWV-1---------1-
mV2.AHBC5D;<<(-
kV2.P:#
!!+=>(-
kV239
$=(-
{co
kV73@
GJ'
0<(-
^e~
xco
kV78@
OGJKD;*1
]d}~wca''
kV78F
OOGJKD*1
\dy}rch{
kV7EF
MNOGIK/1
\buyrcj
kV?EE
RR.#:I/-
[btuncfssv
kV?LE
&%"
9G41
]_ptqhhhjj
kV?LTE
@NO41
]_mptuy}~
lV6SUTTQQQRRN91
[WXXXYXXYXYYWV-)))))))))),,
uVh
_s-
F5><<==.
ECK2LPV.
E@J3MOU.
D?H31IT.
-,%
B;G1JKS.(
E9A011R.&#
E/4678:."&'
NQWhX^XXXe
rpq
t}~]
djklnoc
sgba'_f|
ux||||
# # #
#! #
#! #! #
# #
#gdc
# #! #
# # #
# #
# #
# # # #
! #
t5! #! #
lR! #
.Bu
mS! #
<Bv
lR! #
lR! #
d0_
lR! #
b0'
lR! #
'0_
lR! #
]1'
lR! #
[0_
lR! #
V0_
lR! #
U0_
lR! #
O0_
lR! #
M0_
lR! #
K0_
lR! #
F0_
lR! #
lR! #
lS! #
lR! #
lR! #
b;wi=ua=ua=ua=ua<u'=ua=ua<u'9d[qikunntnntnnunntnnunnunntpwyr
cVgdc
y]q
nkgdc
wYl
gdc
rP'
gdc
oJY
gdc
y|~$s
hJ[
rcgdc
4@egdc
5@fgdc
5@fgdc
4@egdc
5Afgdc
4@egdc
5@fgdc
5@fgdc
4@egdc
4@egdc
5@fgdc
5Afgdc
5@egdc
5@fgdc
BL@BM@BM@BL@BL@BL@BL@BM@CMABM@BL@BL@
#w\Rv\Rw]Sw\Rw\Rw\Sv\Rv\Rw\Rw]Sw]Sw]StYQ1-/
_s-
t6REE
F_s-
t6RDD
<_s-
t5REE
=^s,
t5RDE
=_s-
u6RDD
y0_
=_s-
=REE
t0_
=^s,
=REE
j0_
=_s-
=SEE
f0_
=_s-
=REE
[0_
>w+^
=^s,
=REE
=_s-
=SEE
<^s,
=SEE
_s-
;tcc
3ZzWo
vWj
pM\
XBe
4@e
?Ru
CXz
CXz
CYz
CXz
BXz
CXz
CY{
=_s-
|Xfdc
_s-
Zgec
_s-
Zfdc
_s-
Zfdc
y=z
^s-
Zfdc
^<y
_s-
Yfdc
>_s-
vVh
7<K
8<K
7<K
8<K
Policies
MS Shell Dlg
This setting enables driver caching to improve disk performance. This setting will be ignored and un-checked if enabled safely remove disk
Enable driver cache mode.
Note:
The setting will not take effect until you restart system
This setting enables remove disk safely. To disconnect disk from controller, click the Safely Remove Hardware icon in the taskbar notification area.
Enable safely remove disk.
VS_VERSION_INFO
StringFileInfo
040904e4
CompanyName
<Marvell>
FileDescription
Coinstaller
FileVersion
1.0.0.2
InternalName
hotplug.exe
LegalCopyright
2009 (c) <Marvell>. All rights reserved.
OriginalFilename
hotplug.exe
ProductName
driver feature policy
ProductVersion
1.0.0.2
VarFileInfo
Translation
Informações da biblioteca
Embora as informações sobre direitos autorais não tenham sido atualizadas desde 2009, o arquivo foi modificado pela última vez em outubro de 2013, de acordo com seu registro de data e hora. Isso parece ser confirmado pelo diretório de criação incorporado no arquivo:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E97B-E325-11CE-BFC1-08002BE10318}!This program cannot be run in DOS mode.
Rich
.text
'.data
.pdata
@.rsrc
@.reloc
EEE
('8PW
700PP
'''hhh
xppwpp
SeShutdownPrivilege
Change Cahce Module Policy
You must restart your computer before the new settings will take effect.
Do you want to restart your computer now?
RSDS
d:\project13_10\magni_svn\windows\win\sys\amd64\mv91xxm.pdb
%f&
B@H
L$ H
D$ '
D$(H
D$$
D$HH
D$0f
D$XH
\$P
s I
NtH
(tL
t?3
\d:\project13_10\magni_svn\windows\win\sys\amd64\mv91xxm.pdb
H
t$8H
D$PD
D$1
D$3A
T$0A
8M;
t.H
|$8H+
T$0H
tJH
0t4H
|$8H
L$0
D$(
D$
|$0H
D$0D
L$(H
D$
L$PH3
\$'I
s I
d$X
d$P
!D$0
D$T
D$4
D$8
D$<
D$X
D$PH
D$PH
L$XH
d$(
d$
D$0A
D$4
D$0
D$<
L$X
D$0
d$
%L!
u'H
d$
d$
tUH
D$(
D$
L$0H3
\$XH
D$(
D$
D$4H
D$(H
D$@E3
D$4P
D$
D$4H
D$(H
D$0E3
D$4
D$
L$0
L$0
L$@
L$@
ATH
d$
t2M
d$
t$@H
0A\
VWATAUAVH
t7H
t!H
\$PH
l$XH
A^A]A\_^
SVWH
\$
\$
uxH
D$
\$
t/L
D$
\$
D$
\$
uoE3
\$ E3
\$ H
\$
uaL
D$
\$
D$
\$
_^[
\Tag 9B1349794EE18ECCCBBD7F38FEEA9D44CC42746E
Thumbprint algorithm sha1
Thumbprint 9b 13 49 79 4e e1 8e cc cb bd 7f 38 fe ea 9d 44 cc 42 74 6e
OSAttr 2:6.1,2:6.2,2:6.3
File mvs91xx.dll
H
t$8H
@SH
McP
A8H
HcH<H
9PE
f9Q
LcA<E3
(E;
t"M+
d$0
L$0
\RegSetValueExA
RegQueryValueExA
RegCloseKey
L$8D
\L3
\$@H
\$XE3
T$'H
L$X
D$PH
|$P
tAH
D$8
D$HH
D$0H
D$@H
D$(H
D$ L
L$PL
D$XH
T$'3
D$hH
D$p3
@UH
EP=csm
E0H
@UH
Ep=csm
E8H
@UH
E'=csm
EHH
@UH
=csm
E$H
@UH
E(=csm
E4H
@UH
E@=csm
ELH
@UH
EX=csm
EhH
@UH
Ex=csm
@UH
@UH
pd
pd
strchr
atol
_XcptFilter
malloc
_initterm
free
_amsg_exit
__C_specific_handler
msvcrt.dll
SetupDiOpenDevRegKey
SETUPAPI.dll
HeapAlloc
GetCurrentProcess
HeapFree
GetProcessHeap
GetLastError
DisableThreadLibraryCalls
OutputDebugStringA
CloseHandle
LocalFree
Sleep
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
KERNEL32.dll
OpenProcessToken
RegSetValueExA
RegQueryValueExA
LookupPrivilegeValueA
AdjustTokenPrivileges
RegCloseKey
InitiateSystemShutdownExA
ADVAPI32.dll
EnableWindow
SetWindowLongPtrA
GetDlgItem
MessageBoxA
GetFocus
SendDlgItemMessageA
GetWindowLongPtrA
USER32.dll
DestroyPropertySheetPage
CreatePropertySheetPageA
COMCTL32.dll
MVCOINST.dll
ESATAPortPropPageProvider
N@
kU'9
&D(
HMXB
9;5
?q=
?Zd;
?3=
?/L[
S;uD
?$#
;1a
z?aUY
D?$?
*?}
d|F
U>c{
#Tw
zc%C1
.:3q
,%I
-64OS
NKeb
eSATAport
MatchingDeviceId
eSATAportCount
DriverPolicySet
0123
wwwwwwwwwwwwwwwwwwwwww
wwwwwwwwwwwwwwwwwwwwww
www
wwww
wwwwwwwwwww}
wwwwwwww
wwwwwwwwwwwwww
wwwwwwwwwwwwww
wwwwwww}
wwww
wwwwwww}x
}wwwwwww}
wwww
wXk
qN]
tno
<sa
_'__''_''a'_'_aaaa'
! !
i\\\\[\\\\[\a///2/////////2/22///
i\^
da2/
BB<<<<777111,,,*/
i\^
na2/
RFGHJCDKLL=>>88+/
h\^
}qq
['//"QRT$
1=>>8+2
j\^
sccy
\'2/"OQ
$%=>>*2
i\^
sccy
\a//"NO
66**
L=>(2
i\]~
rccy
\a//"WN
FTHI*++LL=(/
h\^|~
rccs
\'//'VW
RFTHJCDKLL)2
j\]x|~
rccp~
\_//'VV
QRFTHJCDKL(/
i\^wx|~pcccccb
\'//'UV
OQRFGHJCDK(/
i\]wwx|pcckrss
\a//0UU
NOQRSGHIJD(2
i\^vwwxpccr
\'///YU
WNOQRFTHIJ)/
j\]uvwwmccp
\'//9YY
VWNO5;*THI)2
j\]uuvwmccp
\a//9XY
VVWN
STH)2
i\]ouuvmccbbbbbs
\a//@XX0
RST)/
i\]oouulefffggkt
\'/2@ZXX:
;NPRF(/
h\]loouuvwwx|~
\_2/@ZZXXYYUUUVWNOPQ(/
i\]ffggkkqqqzzz{{{
\_//?MMMMEEEAAAA3345
i\\\\\\\\\\'//&&&&&--&&&&-&&&&./
illlllllll
##"
nPh
_s-
>w+
3Zz
]ZZZZZZZZZZZWV-1---------1-
mV2.AHBC5D;<<(-
kV2.P:#
!!+=>(-
kV239
$=(-
{co
kV73@
GJ'
0<(-
^e~
xco
kV78@
OGJKD;*1
]d}~wca''
kV78F
OOGJKD*1
\dy}rch{
kV7EF
MNOGIK/1
\buyrcj
kV?EE
RR.#:I/-
[btuncfssv
kV?LE
&%"
9G41
]_ptqhhhjj
kV?LTE
@NO41
]_mptuy}~
lV6SUTTQQQRRN91
[WXXXYXXYXYYWV-)))))))))),,
uVh
_s-
F5><<==.
ECK2LPV.
E@J3MOU.
D?H31IT.
-,%
B;G1JKS.(
E9A011R.&#
E/4678:."&'
NQWhX^XXXe
rpq
t}~]
djklnoc
sgba'_f|
ux||||
# # #
#! #
#! #! #
# #
#gdc
# #! #
# # #
# #
# #
# # # #
! #
t5! #! #
lR! #
.Bu
mS! #
<Bv
lR! #
lR! #
d0_
lR! #
b0'
lR! #
'0_
lR! #
]1'
lR! #
[0_
lR! #
V0_
lR! #
U0_
lR! #
O0_
lR! #
M0_
lR! #
K0_
lR! #
F0_
lR! #
lR! #
lS! #
lR! #
lR! #
b;wi=ua=ua=ua=ua<u'=ua=ua<u'9d[qikunntnntnnunntnnunnunntpwyr
cVgdc
y]q
nkgdc
wYl
gdc
rP'
gdc
oJY
gdc
y|~$s
hJ[
rcgdc
4@egdc
5@fgdc
5@fgdc
4@egdc
5Afgdc
4@egdc
5@fgdc
5@fgdc
4@egdc
4@egdc
5@fgdc
5Afgdc
5@egdc
5@fgdc
BL@BM@BM@BL@BL@BL@BL@BM@CMABM@BL@BL@
#w\Rv\Rw]Sw\Rw\Rw\Sv\Rv\Rw\Rw]Sw]Sw]StYQ1-/
_s-
t6REE
F_s-
t6RDD
<_s-
t5REE
=^s,
t5RDE
=_s-
u6RDD
y0_
=_s-
=REE
t0_
=^s,
=REE
j0_
=_s-
=SEE
f0_
=_s-
=REE
[0_
>w+^
=^s,
=REE
=_s-
=SEE
<^s,
=SEE
_s-
;tcc
3ZzWo
vWj
pM\
XBe
4@e
?Ru
CXz
CXz
CYz
CXz
BXz
CXz
CY{
=_s-
|Xfdc
_s-
Zgec
_s-
Zfdc
_s-
Zfdc
y=z
^s-
Zfdc
^<y
_s-
Yfdc
>_s-
vVh
7<K
8<K
7<K
8<K
Policies
MS Shell Dlg
This setting enables driver caching to improve disk performance. This setting will be ignored and un-checked if enabled safely remove disk
Enable driver cache mode.
Note:
The setting will not take effect until you restart system
This setting enables remove disk safely. To disconnect disk from controller, click the Safely Remove Hardware icon in the taskbar notification area.
Enable safely remove disk.
VS_VERSION_INFO
StringFileInfo
040904e4
CompanyName
<Marvell>
FileDescription
Coinstaller
FileVersion
1.0.0.2
InternalName
hotplug.exe
LegalCopyright
2009 (c) <Marvell>. All rights reserved.
OriginalFilename
hotplug.exe
ProductName
driver feature policy
ProductVersion
1.0.0.2
VarFileInfo
Translation
01
A extensão de arquivo .pdb representa Banco de dados de programas , um formato proprietário da Microsoft que armazena informações de depuração. Na verdade, há também uma string msvcrt.dll , o que significa que a biblioteca foi compilada usando alguma versão do Microsoft Visual C ++ .
Como uma nota lateral, eles usam (d) Apache Subversion como seu sistema de controle de versão e revisão de software.
Compatibilidade do Windows 8.x
Como a biblioteca foi atualizada em outubro de 2013, é razoável pensar que eles forneceriam compatibilidade com o Windows 8 e possivelmente com o Windows 8.1 também. Verificando o arquivo de catálogo mvs91xx.cat , aqui estão os detalhes relacionados ao arquivo de biblioteca mvs91xx.dll :
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E97B-E325-11CE-BFC1-08002BE10318}%pre%01
OSAttr:2:6.0The
OSAttrattribute specifies the target Windows version whose signing requirements are compatible with the driver package. The attribute's value specifies the following:
- The value
2specifies the catalog file is compatible with NT-based versions of the Windows operating system.- The value
6.0specifies the catalog file is compatible with Windows Vista.Note If the driver package is compatible with multiple Windows versions, you must use separate
CATATTRoptions to specify theOSAttrattribute for each Windows version.Source: Creating a Catalog File for a Non-PnP Driver Package
Nesse caso, o valor OSAttr inclui três versões do Windows baseadas no NT: Windows 7 ( 6.1 ), Windows 8 ( 6.2 ) e Windows 8.1 ( 6.3 ). Isso significa que o pacote do driver é compatível com o Windows 8 / 8.1, pelo menos no papel; ainda o painel Políticas não está disponível no Windows 8.x. Se o sistema operacional ou o arquivo da biblioteca é o culpado, eu não saberia.
Funções de registro
As configurações do driver geralmente são armazenadas no registro, e a biblioteca inclui alguns funções de registro :
%pre% Procurando por strings relacionadas a políticas, me deparei com DriverPolicySet . Ao fazer engenharia reversa da biblioteca, confirmei que as funções de registro foram de fato usadas e que a string mencionada acima fazia parte de um caminho do registro que estava sendo lido ou escrito.
Ajustes manuais da política
A pesquisa por "DriverPolicySet" na web gerou poucos resultados interessantes. Em particular, uma postagem em um fórum japonês e um responda em um fórum russo . Ao traduzir e juntar os bits de informação, consegui obter uma imagem mais clara - literalmente.
OvalorDriverPolicySetéumastring(REG_SZ)quepodeserdefinidacomo:
0-Desativatodasaspolíticas.1-Ativarapenasocachedodriver.2-Ativarapenasaremoçãosegura.3-Ativeocachedodriverearemoçãosegura.
Geralmenteéarmazenadonaseguintechavederegistro:
%pre%Observações
Casoovalordoregistronãoestejalá,vocêprecisarácriá-lovocêmesmo.
Vocêprecisareiniciarosistemaparaaplicarasalterações.
{4D36E97B-E325-11CE-BFC1-08002BE10318}éomvs91xx.inf.-
A parte
0001final pode ser ligeiramente diferente, dependendo do número de controladores disponíveis. Por exemplo, pode ser em0000ou0002, etc.