开启辅助访问

登录 | 注册

切换到宽版

新人指南 邀请好友注册 - 我关注人的新帖 教你赚取精币 - 每日签到

求职/招聘- 论坛接单- 开发者大厅

论坛版规 总版规 - 建议/投诉 - 应聘版主 - 精华帖总集 积分说明 - 禁言标准 - 有奖举报

精易论坛»论坛 › 技术专区 › 更多子版块 › 汇编学习资料区 › WIN7 X64 SSDT函数获得

发新帖

查看: 3620|回复: 0

收起左侧

[其它] WIN7 X64 SSDT函数获得

结帖率：53% (9/17)

发表于 2013-3-23 21:49:16 | 显示全部楼层 |阅读模式广东省深圳市

曾经在网上看到一片文章，

在早期64位系统，内核函数开头地址的低四位一般是0，形如:xxxxxxxx`xxxxxxx0，这一特征在SSDT表中有很强大的引用，SSDT表在64位系统于32位系统有较大的差别。以下是在64位系统下的KeServiceDescriptorTable：

<li>nt!KiSystemServiceStart+0x7:
</li><li>fffff800`03cc7fe5 8bf8 mov edi,eax ; copy system service
number
</li><li>kd> p
</li><li>nt!KiSystemServiceStart+0x9:
</li><li>fffff800`03cc7fe7 c1ef07 shr edi,7 ; isolate service table
number(SERVICE_TABLE_SHIFT)
</li><li>kd> p
</li><li>nt!KiSystemServiceStart+0xc:
</li><li>fffff800`03cc7fea 83e720 and edi,20h ;(SERVICE_TABLE_MASK)
</li><li>kd> p
</li><li>nt!KiSystemServiceStart+0xf:
</li><li>fffff800`03cc7fed 25ff0f0000 and eax,0FFFh ;(SERVICE_NUMBER_MASK
)isolate service table offset 0fffh
</li><li>kd> r
</li><li>rax=0000000000000138 rbx=fffffa800edc0100 rcx=0000000000000084
</li><li>rdx=0000000000000000 rsi=00000000002a8490 rdi=0000000000000000
</li><li>rip=fffff80003cc7fed rsp=fffff8800245dc20 rbp=fffff8800245dca0
</li><li>r8=0000000000000001 r9=0000000000000001 r10=0000000000000084
</li><li>r11=0000000000000206 r12=00000000772c4420 r13=0000000000000000
</li><li>r14=00000000772c4400 r15=00000000772c4498
</li><li>iopl=0 nv up ei pl zr na po nc
</li><li>cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b
efl=00000246
</li><li>nt!KiSystemServiceStart+0xf:
</li><li>fffff800`03cc7fed 25ff0f0000 and eax,0FFFh
</li><li>kd> p
</li><li>nt!KiSystemServiceRepeat:
</li><li>fffff800`03cc7ff2 4c8d1547782300 lea r10,[nt!KeServiceDescriptorTable
(fffff800`03eff840)]
</li><li>kd> r
</li><li>rax=0000000000000138 rbx=fffffa800edc0100 rcx=0000000000000084
</li><li>rdx=0000000000000000 rsi=00000000002a8490 rdi=0000000000000000
</li><li>rip=fffff80003cc7ff2 rsp=fffff8800245dc20 rbp=fffff8800245dca0
</li><li>r8=0000000000000001 r9=0000000000000001 r10=0000000000000084
</li><li>r11=0000000000000206 r12=00000000772c4420 r13=0000000000000000
</li><li>r14=00000000772c4400 r15=00000000772c4498
</li><li>iopl=0 nv up ei pl nz na pe nc
</li><li>cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b
efl=00000202
</li><li>nt!KiSystemServiceRepeat:
</li><li>fffff800`03cc7ff2 4c8d1547782300 lea r10,[nt!KeServiceDescriptorTable
(fffff800`03eff840)]
</li><li>kd> p
</li><li>nt!KiSystemServiceRepeat+0x7:
</li><li>fffff800`03cc7ff9 4c8d1d80782300 lea
r11,[nt!KeServiceDescriptorTableShadow (fffff800`03eff880)]
</li><li>kd> p
</li><li>nt!KiSystemServiceRepeat+0xe:
</li><li>fffff800`03cc8000 f7830001000080000000 test dword ptr [rbx+100h],80h
</li><li>kd> r
</li><li>rax=0000000000000138 rbx=fffffa800edc0100 rcx=0000000000000084
</li><li>rdx=0000000000000000 rsi=00000000002a8490 rdi=0000000000000000
</li><li>rip=fffff80003cc8000 rsp=fffff8800245dc20 rbp=fffff8800245dca0
</li><li>r8=0000000000000001 r9=0000000000000001 r10=fffff80003eff840
</li><li>r11=fffff80003eff880 r12=00000000772c4420 r13=0000000000000000
</li><li>r14=00000000772c4400 r15=00000000772c4498
</li><li>iopl=0 nv up ei pl nz na pe nc
</li><li>cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b
efl=00000202
</li><li>nt!KiSystemServiceRepeat+0xe:
</li><li>fffff800`03cc8000 f7830001000080000000 test dword ptr [rbx+100h],80h
ds:002b:fffffa80`0edc0200=00000060
</li><li>kd> db fffff800`03eff840
</li><li>fffff800`03eff840 00 9b cc 03 00 f8 ff ff-00 00 00 00 00 00 00
00 ................
</li><li>fffff800`03eff850 91 01 00 00 00 00 00 00-8c a7 cc 03 00 f8 ff
ff ................
</li><li>fffff800`03eff860 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00
00 ................
</li><li>fffff800`03eff870 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00
00 ................
</li><li>fffff800`03eff880 00 9b cc 03 00 f8 ff ff-00 00 00 00 00 00 00
00 ................
</li><li>fffff800`03eff890 91 01 00 00 00 00 00 00-8c a7 cc 03 00 f8 ff
ff ................
</li><li>fffff800`03eff8a0 00 1c 0e 00 60 f9 ff ff-00 00 00 00 00 00 00
00 ....`...........
</li><li>fffff800`03eff8b0 3b 03 00 00 00 00 00 00-1c 39 0e 00 60 f9 ff
ff ;........9..`...
</li><li>kd> p
</li><li>nt!KiSystemServiceRepeat+0x18:
</li><li>fffff800`03cc800a 4d0f45d3 cmovne r10,r11
</li><li>kd> p
</li><li>nt!KiSystemServiceRepeat+0x1c:
</li><li>fffff800`03cc800e 423b441710 cmp eax,dword ptr [rdi+r10+10h] ;check
if valid service
</li><li>kd> r
</li><li>rax=0000000000000138 rbx=fffffa800edc0100 rcx=0000000000000084
</li><li>rdx=0000000000000000 rsi=00000000002a8490 rdi=0000000000000000
</li><li>rip=fffff80003cc800e rsp=fffff8800245dc20 rbp=fffff8800245dca0
</li><li>r8=0000000000000001 r9=0000000000000001 r10=fffff80003eff840
</li><li>r11=fffff80003eff880 r12=00000000772c4420 r13=0000000000000000
</li><li>r14=00000000772c4400 r15=00000000772c4498
</li><li>iopl=0 nv up ei pl zr na po nc
</li><li>cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b
efl=00000246
</li><li>nt!KiSystemServiceRepeat+0x1c:
</li><li>fffff800`03cc800e 423b441710 cmp eax,dword ptr [rdi+r10+10h]
ds:002b:fffff800`03eff850=00000191
</li><li>kd> p
</li><li>nt!KiSystemServiceRepeat+0x21:
</li><li>fffff800`03cc8013 0f83e9020000 jae nt!KiSystemServiceExit+0x1a7
(fffff800`03cc8302)
</li><li>kd> p
</li><li>nt!KiSystemServiceRepeat+0x27:
</li><li>fffff800`03cc8019 4e8b1417 mov r10,qword ptr [rdi+r10] ;table
base
</li><li>kd> p
</li><li>nt!KiSystemServiceRepeat+0x2b:
</li><li>fffff800`03cc801d 4d631c82 movsxd r11,dword ptr [r10+rax*4] ; get
system service offset
</li><li>kd> r
</li><li>rax=0000000000000138 rbx=fffffa800edc0100 rcx=0000000000000084
</li><li>rdx=0000000000000000 rsi=00000000002a8490 rdi=0000000000000000
</li><li>rip=fffff80003cc801d rsp=fffff8800245dc20 rbp=fffff8800245dca0
</li><li>r8=0000000000000001 r9=0000000000000001 r10=fffff80003cc9b00
</li><li>r11=fffff80003eff880 r12=00000000772c4420 r13=0000000000000000
</li><li>r14=00000000772c4400 r15=00000000772c4498
</li><li>iopl=0 nv up ei ng nz na pe cy
</li><li>cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b
efl=00000283
</li><li>nt!KiSystemServiceRepeat+0x2b:
</li><li>fffff800`03cc801d 4d631c82 movsxd r11,dword ptr [r10+rax*4]
ds:002b:fffff800`03cc9fe0=000f3080
</li><li>kd> p
</li><li>nt!KiSystemServiceRepeat+0x2f:
</li><li>fffff800`03cc8021 498bc3 mov rax,r11 ; system service
offset
</li><li>kd> r
</li><li>rax=0000000000000138 rbx=fffffa800edc0100 rcx=0000000000000084
</li><li>rdx=0000000000000000 rsi=00000000002a8490 rdi=0000000000000000
</li><li>rip=fffff80003cc8021 rsp=fffff8800245dc20 rbp=fffff8800245dca0
</li><li>r8=0000000000000001 r9=0000000000000001 r10=fffff80003cc9b00
</li><li>r11=00000000000f3080 r12=00000000772c4420 r13=0000000000000000
</li><li>r14=00000000772c4400 r15=00000000772c4498
</li><li>iopl=0 nv up ei ng nz na pe cy
</li><li>cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b
efl=00000283
</li><li>nt!KiSystemServiceRepeat+0x2f:
</li><li>fffff800`03cc8021 498bc3 mov rax,r11
</li><li>kd> p
</li><li>nt!KiSystemServiceRepeat+0x32:
</li><li>fffff800`03cc8024 49c1fb04 sar r11,4 ;关键所在，还得再右移4位
</li><li>kd> p
</li><li>nt!KiSystemServiceRepeat+0x36:
</li><li>fffff800`03cc8028 4d03d3 add r10,r11 ；; add table base to
获得真正的函数地址
</li><li>kd> r
</li><li>rax=00000000000f3080 rbx=fffffa800edc0100 rcx=0000000000000084
</li><li>rdx=0000000000000000 rsi=00000000002a8490 rdi=0000000000000000
</li><li>rip=fffff80003cc8028 rsp=fffff8800245dc20 rbp=fffff8800245dca0
</li><li>r8=0000000000000001 r9=0000000000000001 r10=fffff80003cc9b00
</li><li>r11=000000000000f308 r12=00000000772c4420 r13=0000000000000000
</li><li>r14=00000000772c4400 r15=00000000772c4498
</li><li>iopl=0 nv up ei pl nz na pe nc
</li><li>cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b
efl=00000202
</li><li>nt!KiSystemServiceRepeat+0x36:
</li><li>fffff800`03cc8028 4d03d3 add r10,r11
</li><li>kd> p
</li><li>nt!KiSystemServiceRepeat+0x39:
</li><li>fffff800`03cc802b 83ff20 cmp edi,20h
</li><li>kd> r
</li><li>rax=00000000000f3080 rbx=fffffa800edc0100 rcx=0000000000000084
</li><li>rdx=0000000000000000 rsi=00000000002a8490 rdi=0000000000000000
</li><li>rip=fffff80003cc802b rsp=fffff8800245dc20 rbp=fffff8800245dca0
</li><li>r8=0000000000000001 r9=0000000000000001 r10=fffff80003cd8e08
</li><li>r11=000000000000f308 r12=00000000772c4420 r13=0000000000000000
</li><li>r14=00000000772c4400 r15=00000000772c4498
</li><li>iopl=0 nv up ei ng nz na pe nc
</li><li>cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b
efl=00000282
</li><li>nt!KiSystemServiceRepeat+0x39:
</li><li>fffff800`03cc802b 83ff20 cmp edi,20h
</li><li>kd> u fffff80003cd8e08
</li><li>nt!NtReleaseWorkerFactoryWorker:
</li><li>fffff800`03cd8e08 4c8bdc mov r11,rsp
</li><li>fffff800`03cd8e0b 49895b08 mov qword ptr [r11+8],rbx
</li><li>fffff800`03cd8e0f 49896b18 mov qword ptr [r11+18h],rbp
</li><li>fffff800`03cd8e13 49897320 mov qword ptr [r11+20h],rsi
</li><li>fffff800`03cd8e17 57 push rdi
</li><li>fffff800`03cd8e18 4154 push r12
</li><li>fffff800`03cd8e1a 4155 push r13
</li><li>fffff800`03cd8e1c 4883ec60 sub rsp,60h
</li><li>kd> p
</li><li>nt!KiSystemServiceRepeat+0x3c:
</li><li>fffff800`03cc802e 7550 jne
nt!KiSystemServiceGdiTebAccess+0x49 (fffff800`03cc8080)
</li><li>kd> p
</li><li>nt!KiSystemServiceGdiTebAccess+0x49:
</li><li>fffff800`03cc8080 83e00f and eax,0Fh
</li><li>kd> p
</li><li>nt!KiSystemServiceGdiTebAccess+0x4c:
</li><li>fffff800`03cc8083 0f84b7000000 je nt!KiSystemServiceCopyEnd
(fffff800`03cc8140)
</li><li>kd> p
</li><li>nt!KiSystemServiceCopyEnd:
</li><li>fffff800`03cc8140 f705fee4180040000000 test dword ptr
[nt!PerfGlobalGroupMask+0x8 (fffff800`03e56648)],40h
</li><li>kd> p
</li><li>nt!KiSystemServiceCopyEnd+0xa:
</li><li>fffff800`03cc814a 0f8550020000 jne nt!KiSystemServiceExit+0x245
(fffff800`03cc83a0)
</li><li>kd> p
</li><li>nt!KiSystemServiceCopyEnd+0x10:
</li><li>fffff800`03cc8150 41ffd2 call r10 ; ; call system
service</li>

复制代码

所以WIN7 X64下应该是:

FuncAddr=([KeServiceDescriptortable+index*4] >>4 +KeServiceDescriptortable)&0xFFFFFFF0.

而且和以前不同的是原来是从ETHREAD里取TABLE 地址，但现在通过 lea r10,[nt!KeServiceDescriptorTable (fffff800`03eff840)]
，扑灭了ROOTKITER们的最后一线HOOK 希望。

回复

使用道具举报

发新帖

发布主题 收藏帖子 返回列表

关注微信

sitemap| 易语言源码| 易语言教程| 易语言论坛| 易语言模块| 手机版| 广告投放| 精易论坛
拒绝任何人以任何形式在本论坛发表与中华人民共和国法律相抵触的言论，本站内容均为会员发表，并不代表精易立场!
论坛帖子内容仅用于技术交流学习和研究的目的，严禁用于非法目的，否则造成一切后果自负！如帖子内容侵害到你的权益，请联系我们！
防范网络诈骗，远离网络犯罪违法和不良信息举报电话0663-3422125，QQ： 793400750，邮箱：wp@125.la
Powered by Discuz! X3.4 揭阳市揭东区精易科技有限公司 ( 粤ICP备12094385号-1) 粤公网安备 44522102000125　增值电信业务经营许可证粤B2-20192173

快速回复 返回顶部 返回列表