两种方法获取shadow ssdt

电玩女神 2023-10-12 06:32 9阅读 0赞

**\[cpp\]** view plain copy

print ?

1.  ULONG   
2.  GetShadowSsdtCurrentAddresses(  
3.      PSSDT\_ADDRESS   AddressInfo,   
4.      PULONG          Length  
5.      )  
6.  \{  
7.      PSYSTEM\_SERVICE\_TABLE KeServiceDescriptorTableShadow = NULL;  
8.      ULONG NumberOfService = 0;  
9.      ULONG ServiceId = 0;  
10.     PKAPC\_STATE ApcState;  
11.     ULONG i;  
12.       
13.     if (AddressInfo == NULL || Length == NULL)  
14.     \{  
15.         KdPrint(("\[GetShadowSsdtCurrentAddresses\] 输入参数无效"));  
16.         return 0;  
17.     \}  
18.   
19.     //KdPrint(("pid = %d", PsGetCurrentProcessId()));  
20.     ServiceId = (ULONG)PsGetCurrentProcessId();  
21.   
22.     if (!g\_CsrssProcess) \{  
23.         PsLookupProcessByProcessId((PVOID)ScPsGetCsrssProcessId(), &g\_CsrssProcess);  
24.     \}  
25.   
26.     KeServiceDescriptorTableShadow = GetKeServiceDescriptorTableShadow();  
27.   
28.     if (KeServiceDescriptorTableShadow == NULL)    
29.     \{  
30.         KdPrint(("\[GetShadowSsdtCurrentAddresses\] GetKeServiceDescriptorTableShadow failed"));  
31.         return 0;  
32.     \}  
33.   
34.     NumberOfService = KeServiceDescriptorTableShadow->NumberOfService;  
35.     if (Length\[0\] < NumberOfService \* sizeof(SSDT\_ADDRESS))  
36.     \{  
37.         Length\[0\] = NumberOfService \* sizeof(SSDT\_ADDRESS);  
38.         return 0;  
39.     \}  
40.   
41.     ApcState = ExAllocatePoolWithTag(NonPagedPool, sizeof(KAPC\_STATE), MEM\_TAG);  
42.     KeStackAttachProcess((PRKPROCESS)g\_CsrssProcess, ApcState);  
43.   
44.     for (ServiceId = 0; ServiceId < NumberOfService; ServiceId ++)  
45.     \{  
46.         AddressInfo\[ServiceId\].FunAddress = (ULONG)  
47.             KeServiceDescriptorTableShadow->ServiceTableBase\[ServiceId\];  
48.         AddressInfo\[ServiceId\].nIndex = ServiceId;  
49.     \}  
50.   
51.     KeUnstackDetachProcess(ApcState);  
52.     ExFreePool(ApcState);  
53.   
54.     Length\[0\] = NumberOfService \* sizeof(SSDT\_ADDRESS);  
55.     return NumberOfService;  
56. \}  
57.   
58. ///  
59. //  
60. //  功能实现：枚举当前Shadow SSDT 表函数地址  
61. //  输入参数：void  
62. //  输出参数：返回Shadow ssdt table  
63. //  
64. ///  
65. PSYSTEM\_SERVICE\_TABLE   
66. GetKeServiceDescriptorTableShadow(VOID)  
67. \{  
68.     PSYSTEM\_SERVICE\_TABLE ShadowTable = NULL;  
69.     ULONG   ServiceTableAddress = 0;  
70.     PUCHAR  cPtr = NULL;   
71.   
72.     for (cPtr = (PUCHAR)KeAddSystemServiceTable;  
73.          cPtr < (PUCHAR)KeAddSystemServiceTable + PAGE\_SIZE;  
74.          cPtr += 1 )  
75.     \{  
76.         if (!MmIsAddressValid(cPtr))  continue;  
77.   
78.         ServiceTableAddress = \*(PULONG)cPtr;  
79.         if (!MmIsAddressValid((PVOID)ServiceTableAddress)) continue;  
80.   
81.         if (memcmp((PVOID)ServiceTableAddress, &KeServiceDescriptorTable, 16) == 0)  
82.         \{  
83.             if ((PVOID)ServiceTableAddress == &KeServiceDescriptorTable) continue;  
84.             ShadowTable = (PSYSTEM\_SERVICE\_TABLE)ServiceTableAddress;  
85.             ShadowTable ++;  
86.             return ShadowTable;  
87.         \}  
88.     \}  
89.     return NULL;  
90. \}  
91. //  
92. // 方法2，通过硬编码实现，不通用  
93. //   
94. PSYSTEM\_SERVICE\_TABLE   
95. GetKeServiceDescriptorTableShadow\_2(VOID)  
96. /\*++ 
97.     KeAddSystemServiceTable函数
98.     805ba5a3 8d8840a65580    lea    ecx,nt!KeServiceDescriptorTableShadow (8055a640)\[eax\] 
99.     805ba5a9 833900          cmp    dword ptr \[ecx\],0 
100. \--\*/  
101. \{  
102.     PSYSTEM\_SERVICE\_TABLE ShadowTable;  
103.     ULONG   ServiceTableAddress;  
104.     PUCHAR  cPtr, pOpcode;  
105.     ULONG   Length = 0;  
106.   
107.     for (cPtr = (PUCHAR)KeAddSystemServiceTable;  
108.          cPtr < (PUCHAR)KeAddSystemServiceTable + PAGE\_SIZE;  
109.          cPtr += Length )  
110.     \{  
111.         if (!MmIsAddressValid(cPtr))  return NULL;  
112.   
113.         Length = SizeOfCode(cPtr, &pOpcode);  
114.   
115.         if (!Length || (Length == 1 && \*pOpcode == 0xC3)) return NULL;  
116.   
117.         if (\*(PUSHORT)pOpcode == 0x888D)  
118.         \{  
119.             ServiceTableAddress = \*(PULONG)(pOpcode + 2);  
120.             ShadowTable = (PSYSTEM\_SERVICE\_TABLE)ServiceTableAddress;  
121.             ShadowTable ++;  
122.             return ShadowTable;  
123.         \}  
124.     \}  
125.     return NULL;  
126. \}

![923483-20160811163250574-220511885.jpg][]

ULONG GetShadowSsdtCurrentAddresses( PSSDT\_ADDRESS AddressInfo, PULONG Length ) \{ PSYSTEM\_SERVICE\_TABLE KeServiceDescriptorTableShadow = NULL; ULONG NumberOfService = 0; ULONG ServiceId = 0; PKAPC\_STATE ApcState; ULONG i; if (AddressInfo == NULL || Length == NULL) \{ KdPrint(("\[GetShadowSsdtCurrentAddresses\] 输入参数无效")); return 0; \} //KdPrint(("pid = %d", PsGetCurrentProcessId())); ServiceId = (ULONG)PsGetCurrentProcessId(); if (!g\_CsrssProcess) \{ PsLookupProcessByProcessId((PVOID)ScPsGetCsrssProcessId(), &g\_CsrssProcess); \} KeServiceDescriptorTableShadow = GetKeServiceDescriptorTableShadow(); if (KeServiceDescriptorTableShadow == NULL) \{ KdPrint(("\[GetShadowSsdtCurrentAddresses\] GetKeServiceDescriptorTableShadow failed")); return 0; \} NumberOfService = KeServiceDescriptorTableShadow->NumberOfService; if (Length\[0\] < NumberOfService \* sizeof(SSDT\_ADDRESS)) \{ Length\[0\] = NumberOfService \* sizeof(SSDT\_ADDRESS); return 0; \} ApcState = ExAllocatePoolWithTag(NonPagedPool, sizeof(KAPC\_STATE), MEM\_TAG); KeStackAttachProcess((PRKPROCESS)g\_CsrssProcess, ApcState); for (ServiceId = 0; ServiceId < NumberOfService; ServiceId ++) \{ AddressInfo\[ServiceId\].FunAddress = (ULONG) KeServiceDescriptorTableShadow->ServiceTableBase\[ServiceId\]; AddressInfo\[ServiceId\].nIndex = ServiceId; \} KeUnstackDetachProcess(ApcState); ExFreePool(ApcState); Length\[0\] = NumberOfService \* sizeof(SSDT\_ADDRESS); return NumberOfService; \} /// // // 功能实现：枚举当前Shadow SSDT 表函数地址 // 输入参数：void // 输出参数：返回Shadow ssdt table // /// PSYSTEM\_SERVICE\_TABLE GetKeServiceDescriptorTableShadow(VOID) \{ PSYSTEM\_SERVICE\_TABLE ShadowTable = NULL; ULONG ServiceTableAddress = 0; PUCHAR cPtr = NULL; for (cPtr = (PUCHAR)KeAddSystemServiceTable; cPtr < (PUCHAR)KeAddSystemServiceTable + PAGE\_SIZE; cPtr += 1 ) \{ if (!MmIsAddressValid(cPtr)) continue; ServiceTableAddress = \*(PULONG)cPtr; if (!MmIsAddressValid((PVOID)ServiceTableAddress)) continue; if (memcmp((PVOID)ServiceTableAddress, &KeServiceDescriptorTable, 16) == 0) \{ if ((PVOID)ServiceTableAddress == &KeServiceDescriptorTable) continue; ShadowTable = (PSYSTEM\_SERVICE\_TABLE)ServiceTableAddress; ShadowTable ++; return ShadowTable; \} \} return NULL; \} // // 方法2，通过硬编码实现，不通用 // PSYSTEM\_SERVICE\_TABLE GetKeServiceDescriptorTableShadow\_2(VOID) /\*++ 805ba5a3 8d8840a65580 lea ecx,nt!KeServiceDescriptorTableShadow (8055a640)\[eax\] 805ba5a9 833900 cmp dword ptr \[ecx\],0 --\*/ \{ PSYSTEM\_SERVICE\_TABLE ShadowTable; ULONG ServiceTableAddress; PUCHAR cPtr, pOpcode; ULONG Length = 0; for (cPtr = (PUCHAR)KeAddSystemServiceTable; cPtr < (PUCHAR)KeAddSystemServiceTable + PAGE\_SIZE; cPtr += Length ) \{ if (!MmIsAddressValid(cPtr)) return NULL; Length = SizeOfCode(cPtr, &pOpcode); if (!Length || (Length == 1 && \*pOpcode == 0xC3)) return NULL; if (\*(PUSHORT)pOpcode == 0x888D) \{ ServiceTableAddress = \*(PULONG)(pOpcode + 2); ShadowTable = (PSYSTEM\_SERVICE\_TABLE)ServiceTableAddress; ShadowTable ++; return ShadowTable; \} \} return NULL; \}

转载于:https://www.cnblogs.com/kuangke/p/5761555.html

[923483-20160811163250574-220511885.jpg]: https://images2015.cnblogs.com/blog/923483/201608/923483-20160811163250574-220511885.jpg