这也都没有Windows环境了，只好在网上找了几个文章看看。
就是到了2019年，也还有搞这个的。相比十几年前的通过firewire接口，现在的通过PCI-E接口。还没仔细看，大概好像是用块PCI-E的fpga开发板，插上以后搜内存。
好消息是，win10的验证系统和xp基本没变，还是有msv1_0.dll
https://docs.microsoft.com/en-us/windows/win32/secauthn/msv1-0-authentication-package
最终核心函数还是MsvpPasswordValidate，我自己这没环境，看文章里的图
https://www.synacktiv.com/en/publications/practical-dma-attack-on-windows-10.html
最终比较rc4的hash的是用RtlCompareMemory
让朋友帮着u了份汇编
如果要比较的内存长度是4字节对齐的，就走红色代码部分。
rc4 hash是16字节，这个时32bit系统。
所以要搞的就是repe cmps byte ptr [esi],byte ptr es:[edi]
比如密码123的rc4 hash是
97e6bd3d a79016d7 eb4b2069 78362812
repe应该是prefix，先看看qemu tcg里怎么搞。
64位的RtlCompareMemory
0:000> uf RtlCompareMemory
ntdll!RtlCompareMemory:
00007ff9`1cbb06f0 57 push rdi
00007ff9`1cbb06f1 56 push rsi
00007ff9`1cbb06f2 488bf1 mov rsi,rcx
00007ff9`1cbb06f5 488bfa mov rdi,rdx
00007ff9`1cbb06f8 33d1 xor edx,ecx
00007ff9`1cbb06fa 83e207 and edx,7
00007ff9`1cbb06fd 7553 jne ntdll!RtlCompareMemory+0x62 (00007ff9`1cbb0752)
ntdll!RtlCompareMemory+0xf:
00007ff9`1cbb06ff 4983f808 cmp r8,8
00007ff9`1cbb0703 724d jb ntdll!RtlCompareMemory+0x62 (00007ff9`1cbb0752)
ntdll!RtlCompareMemory+0x15:
00007ff9`1cbb0705 4c8bcf mov r9,rdi
00007ff9`1cbb0708 f7d9 neg ecx
00007ff9`1cbb070a 83e107 and ecx,7
00007ff9`1cbb070d 7407 je ntdll!RtlCompareMemory+0x26 (00007ff9`1cbb0716)
ntdll!RtlCompareMemory+0x1f:
00007ff9`1cbb070f 4c2bc1 sub r8,rcx
00007ff9`1cbb0712 f3a6 repe cmps byte ptr [rsi],byte ptr [rdi]
00007ff9`1cbb0714 7530 jne ntdll!RtlCompareMemory+0x56 (00007ff9`1cbb0746)
ntdll!RtlCompareMemory+0x26:
00007ff9`1cbb0716 498bc8 mov rcx,r8
00007ff9`1cbb0719 4883e1f8 and rcx,0FFFFFFFFFFFFFFF8h
00007ff9`1cbb071d 741b je ntdll!RtlCompareMemory+0x4a (00007ff9`1cbb073a)
ntdll!RtlCompareMemory+0x2f:
00007ff9`1cbb071f 4c2bc1 sub r8,rcx
00007ff9`1cbb0722 48c1e903 shr rcx,3
00007ff9`1cbb0726 f348a7 repe cmps qword ptr [rsi],qword ptr [rdi]
00007ff9`1cbb0729 740f je ntdll!RtlCompareMemory+0x4a (00007ff9`1cbb073a)
ntdll!RtlCompareMemory+0x3b:
00007ff9`1cbb072b 48ffc1 inc rcx
00007ff9`1cbb072e 4883ee08 sub rsi,8
00007ff9`1cbb0732 4883ef08 sub rdi,8
00007ff9`1cbb0736 48c1e103 shl rcx,3
ntdll!RtlCompareMemory+0x4a:
00007ff9`1cbb073a 4c03c1 add r8,rcx
00007ff9`1cbb073d 740a je ntdll!RtlCompareMemory+0x59 (00007ff9`1cbb0749)
ntdll!RtlCompareMemory+0x4f:
00007ff9`1cbb073f 498bc8 mov rcx,r8
00007ff9`1cbb0742 f3a6 repe cmps byte ptr [rsi],byte ptr [rdi]
00007ff9`1cbb0744 7403 je ntdll!RtlCompareMemory+0x59 (00007ff9`1cbb0749)
ntdll!RtlCompareMemory+0x56:
00007ff9`1cbb0746 48ffcf dec rdi
ntdll!RtlCompareMemory+0x59:
00007ff9`1cbb0749 492bf9 sub rdi,r9
00007ff9`1cbb074c 488bc7 mov rax,rdi
00007ff9`1cbb074f 5e pop rsi
00007ff9`1cbb0750 5f pop rdi
00007ff9`1cbb0751 c3 ret
ntdll!RtlCompareMemory+0x62:
00007ff9`1cbb0752 4d85c0 test r8,r8
00007ff9`1cbb0755 740d je ntdll!RtlCompareMemory+0x74 (00007ff9`1cbb0764)
ntdll!RtlCompareMemory+0x67:
00007ff9`1cbb0757 498bc8 mov rcx,r8
00007ff9`1cbb075a f3a6 repe cmps byte ptr [rsi],byte ptr [rdi]
00007ff9`1cbb075c 7406 je ntdll!RtlCompareMemory+0x74 (00007ff9`1cbb0764)
ntdll!RtlCompareMemory+0x6e:
00007ff9`1cbb075e 48ffc1 inc rcx
00007ff9`1cbb0761 4c2bc1 sub r8,rcx
ntdll!RtlCompareMemory+0x74:
00007ff9`1cbb0764 498bc0 mov rax,r8
00007ff9`1cbb0767 5e pop rsi
00007ff9`1cbb0768 5f pop rdi
00007ff9`1cbb0769 c3 ret
