SSDT表结构的深入学习

SSDT表的知识目录：

A、了解SSDT结构

B、由SSDT索引号获取当前函数地址       

C、如何获取索引号

D、获取起源地址-判断SSDT是否被HOOK

E、如何向内核地址写入自己代码

A、了解SSDT结构

SSDT的全称是 System  ServicesDescriptor Table--系统服务描述符表，是由 ntoskrnl.exe导出KeServiceDescriptorTable 这个表，是全局的，声明导出即可在编程中使用。

typedef  struct  ServiceDescriptorEntry

{

   unsigned  int  *ServiceTableBase;       //SystemService Dispatch Table 的基地址

   unsigned  int  *ServiceCounterTable(0);

//包含着 SSDT 中每个服务被调用次数的计数器。这个计数器一般由 sysenter  更新。

   unsigned  int   NumberOfServices;     //由 ServiceTableBase描述的服务的数目。

   unsigned  char  *ParamTableBase;

//包含每个系统服务参数字节数表的基地址-系统服务参数表

 } SSDT_Entry;

用windbg 了解SSDT结构,命令：

dp    nt!KeServiceDescriptorTable

B、由SSDT索引号获取当前函数地址

[[KeServiceDescriptorTable基址] + index*4]

 

C、如何获取SSDT索引号

用工具查看如：狙剑、火眼等

D、获取起源地址-判断SSDT是否被HOOK

MmGetSystemRoutineAddress函数，得到系统导出函数的地址

包含头文件Wdm.h 或Ntddk.h

//NTKERNELAPI
PVOID
MmGetSystemRoutineAddress (
    __in    PUNICODE_STRING   SystemRoutineName
    )
/*++

Routine Description:

    This functionreturns the address of the argument function pointer if
    it is in the kernelor HAL, NULL if it is not.

Arguments:

    SystemRoutineName -Supplies the name of the desired routine.

Return Value:

    Non-NULL functionpointer if successful.  NULL if not.

Environment:

    Kernel mode,PASSIVE_LEVEL, arbitrary process context.

--*/
{
    PKTHREADCurrentThread;
    NTSTATUS Status;
    PKLDR_DATA_TABLE_ENTRY DataTableEntry;
    ANSI_STRINGAnsiString;
    PLIST_ENTRYNextEntry;
    UNICODE_STRINGKernelString;
    UNICODE_STRINGHalString;
    PVOIDFunctionAddress;
    LOGICAL Found;
    ULONGEntriesChecked;

    ASSERT(KeGetCurrentIrql() == PASSIVE_LEVEL);

    EntriesChecked = 0;
    FunctionAddress =NULL;

    KernelString.Buffer= (const PUSHORT) KERNEL_NAME;
    KernelString.Length= sizeof (KERNEL_NAME) - sizeof (WCHAR);
   KernelString.MaximumLength = sizeof KERNEL_NAME;

    HalString.Buffer =(const PUSHORT) HAL_NAME;
    HalString.Length =sizeof (HAL_NAME) - sizeof (WCHAR);
   HalString.MaximumLength = sizeof HAL_NAME;

    do {
        Status =RtlUnicodeStringToAnsiString (&AnsiString,
                                               SystemRoutineName,
                                               TRUE);

        if (NT_SUCCESS(Status)) {
            break;
        }

       KeDelayExecutionThread (KernelMode, FALSE,(PLARGE_INTEGER)&MmShortTime);

    } while (TRUE);

    //
    // Arbitraryprocess context so prevent suspend APCs now.
    //

    CurrentThread =KeGetCurrentThread ();
    KeEnterCriticalRegionThread(CurrentThread);
   ExAcquireResourceSharedLite (&PsLoadedModuleResource, TRUE);

    //
    // Check only thekernel and the HAL for exports.
    //

    NextEntry =PsLoadedModuleList.Flink;
    while (NextEntry !=&PsLoadedModuleList) {

        Found = FALSE;

        DataTableEntry= CONTAINING_RECORD(NextEntry,
                                          KLDR_DATA_TABLE_ENTRY,
                                          InLoadOrderLinks);

        if (RtlEqualUnicodeString(&KernelString,
                                  &DataTableEntry->BaseDllName,
                                  TRUE)) {

            Found =TRUE;
           EntriesChecked += 1;

        }
        else if(RtlEqualUnicodeString (&HalString,
                                       &DataTableEntry->BaseDllName,
                                       TRUE)){

            Found =TRUE;
           EntriesChecked += 1;
        }

        if (Found ==TRUE) {

           FunctionAddress = MiFindExportedRoutineByName(DataTableEntry->DllBase,
                                                         &AnsiString);

            if(FunctionAddress != NULL) {
                break;
            }

            if (EntriesChecked== 2) {
                break;
            }
        }

        NextEntry =NextEntry->Flink;
    }

   ExReleaseResourceLite (&PsLoadedModuleResource);
   KeLeaveCriticalRegionThread (CurrentThread);

    RtlFreeAnsiString(&AnsiString);

    returnFunctionAddress;
}
//WRK中的源码

E、如何向内核地址写入自己代码

在后期版本的操作系统中，要求SSDT是只读的，因此任何合法的程序都不可能修改这个表，不过聪明的大牛们还是想出了修改SSDT表的方法。

方法一：更改注册表（需要重启）

HKLM\SYSTEM\CurrentControlset\Control\SessionManger\MemoryManagement\EnforceWriteProtection= 0

与

HKLM\SYSTEM\CurrentControlset\Control\SessionManger\MemoryManagement\DisablePagingExecutive= 1

方法二：修改CR0寄存器的第1位即wp位置0

//关闭内存保护
_asm
{
    push eax
    mov eax, CR0
    and eax, 0FFFEFFFFh
    mov CR0, eax
    pop eax
} 

//恢复内存保护
_asm
{
    push eax
    mov eax, CR0
    or eax , not 0FFFEFFFFh
    mov CR0, eax
    pop eax
} 

方法三：利用MDL(Memory Descriptor List)来绕过写保护

//MDL reference defined inntddk.h
typedef struct  _MDL{
                      Struct  _MDL   *Next;
                      CSHORT  Size;
                      CSHORT  MdlFlags;
                      Struct  _EPROCESS  *Process;
                      PVOID   MappedSystemVa;
                      PVOID   StartVa;
                      ULONG   ByteCount;
                      ULONG   ByteOffset;
}MDL,*PMDL; 

//MDL Flags
#define	MDL_MAPPED_TO_SYSTEM_VA             0x0001
#define	MDL_PAGES_LOCKED                    0x0002
#define	MDL_SOURCE_IS_NONPAGED_POOL         0x0004
#define	MDL_ALLOCATED_FIXED_SIZE            0x0008
#define MDL_PARTIAL                         0x0010
#define	MDL_PARTIAL_HAS_BEEN_MAPPED         0x0020
#define	MDL_IO_PAGE_READ                    0x0040
#define	MDL_WRITE_OPERATION                 0x0080
#define	MDL_PARENT_MAPPED_SYSTEM_VA         0x0100
#define MDL_LOCK_HELD                       0x0200
#define MDL_PHYSICAL_VIEW                   0x0400
#define MDL_IO_SPACE                        0x0800
#define	MDL_NETWORK_HEADER                  0x1000
#define	MDL_MAPPING_CAN_FAIL                0x2000
#define	MDL_ALLOCATED_MUST_SUCCEED          0x4000 

//声明
#pragma pack(1)
typedef struct  ServiceDescriptorEntry{
                                        unsigned int*   ServiceTableBase;
					unsigned int*   ServiceCounterTableBase;
					unsigned int    NumberOfService;
					unsigned char*  ParamTableBase;
}SSDT_Entry;
#pragma pack()

//导出SSDT表
_declspec(dllimport)SSDT_Entry KeServiceDescriptorTable;

//保存原始的系统调用地址
PMDL g_pmdlSystemCall;
PVOID *MappedSystemCallTable;
//创建MDL
g_pmdlSystemCall = MmCreateMdl(NULL, KeServiceDescriptorTable, ServiceTableBase, KeServcieDescriptorTable.NumberOfService*4);
if(!g_pmdlSystemCall)
{
	return STATUS_UNSUCCESSFUL;
}

//构建非分页内存
MmBuildMdlForNonPagedPool(g_pmdlSystemCall);
//改变MDL的标志
g_pmdlSystemCall->MdlFlags = g_pmdlSystemCall->MdlFlags | MDL_MAPPED_TO_SYSTEM_VA ;
//锁定内存
MappedSystemCallTable = MmMapLockedPages(g_pmdlSystemCall, KernelMode);

参考资料：

《Windows内核的安全防护》推荐

http://blog.csdn.net/evi10r/article/details/6840564