两种方法获取shadow ssdt

1. ULONG
2. GetShadowSsdtCurrentAddresses(
3. PSSDT_ADDRESS   AddressInfo,
4. PULONG          Length
5. )
6. {
7. PSYSTEM_SERVICE_TABLE KeServiceDescriptorTableShadow = NULL;
8. ULONG NumberOfService = 0;
9. ULONG ServiceId = 0;
10. PKAPC_STATE ApcState;
11. ULONG i;
12. if (AddressInfo == NULL || Length == NULL)
13. {
14. KdPrint(("[GetShadowSsdtCurrentAddresses] 输入参数无效"));
15. return 0;
16. }
17. //KdPrint(("pid = %d", PsGetCurrentProcessId()));
18. ServiceId = (ULONG)PsGetCurrentProcessId();
19. if (!g_CsrssProcess) {
20. PsLookupProcessByProcessId((PVOID)ScPsGetCsrssProcessId(), &g_CsrssProcess);
21. }
22. KeServiceDescriptorTableShadow = GetKeServiceDescriptorTableShadow();
23. if (KeServiceDescriptorTableShadow == NULL)
24. {
25. KdPrint(("[GetShadowSsdtCurrentAddresses] GetKeServiceDescriptorTableShadow failed"));
26. return 0;
27. }
28. NumberOfService = KeServiceDescriptorTableShadow->NumberOfService;
29. if (Length[0] < NumberOfService * sizeof(SSDT_ADDRESS))
30. {
31. Length[0] = NumberOfService * sizeof(SSDT_ADDRESS);
32. return 0;
33. }
34. ApcState = ExAllocatePoolWithTag(NonPagedPool, sizeof(KAPC_STATE), MEM_TAG);
35. KeStackAttachProcess((PRKPROCESS)g_CsrssProcess, ApcState);
36. for (ServiceId = 0; ServiceId < NumberOfService; ServiceId ++)
37. {
38. AddressInfo[ServiceId].FunAddress = (ULONG)
39. KeServiceDescriptorTableShadow->ServiceTableBase[ServiceId];
40. AddressInfo[ServiceId].nIndex = ServiceId;
41. }
42. KeUnstackDetachProcess(ApcState);
43. ExFreePool(ApcState);
44. Length[0] = NumberOfService * sizeof(SSDT_ADDRESS);
45. return NumberOfService;
46. }
47. ///////////////////////////////////////////////////////////////////////////////////
48. //
49. //  功能实现：枚举当前Shadow SSDT 表函数地址
50. //  输入参数：void
51. //  输出参数：返回Shadow ssdt table
52. //
53. ///////////////////////////////////////////////////////////////////////////////////
54. PSYSTEM_SERVICE_TABLE
55. GetKeServiceDescriptorTableShadow(VOID)
56. {
57. PSYSTEM_SERVICE_TABLE ShadowTable = NULL;
58. ULONG   ServiceTableAddress = 0;
59. PUCHAR  cPtr = NULL;
60. for (cPtr = (PUCHAR)KeAddSystemServiceTable;
61. cPtr < (PUCHAR)KeAddSystemServiceTable + PAGE_SIZE;
62. cPtr += 1 )
63. {
64. if (!MmIsAddressValid(cPtr))  continue;
65. ServiceTableAddress = *(PULONG)cPtr;
66. if (!MmIsAddressValid((PVOID)ServiceTableAddress)) continue;
67. if (memcmp((PVOID)ServiceTableAddress, &KeServiceDescriptorTable, 16) == 0)
68. {
69. if ((PVOID)ServiceTableAddress == &KeServiceDescriptorTable) continue;
70. ShadowTable = (PSYSTEM_SERVICE_TABLE)ServiceTableAddress;
71. ShadowTable ++;
72. return ShadowTable;
73. }
74. }
75. return NULL;
76. }
77. //
78. // 方法2，通过硬编码实现，不通用
79. //
80. PSYSTEM_SERVICE_TABLE
81. GetKeServiceDescriptorTableShadow_2(VOID)
82. /*++
83. KeAddSystemServiceTable函数
84. 805ba5a3 8d8840a65580    lea    ecx,nt!KeServiceDescriptorTableShadow (8055a640)[eax]
85. 805ba5a9 833900          cmp    dword ptr [ecx],0
86. --*/
87. {
88. PSYSTEM_SERVICE_TABLE ShadowTable;
89. ULONG   ServiceTableAddress;
90. PUCHAR  cPtr, pOpcode;
91. ULONG   Length = 0;
92. for (cPtr = (PUCHAR)KeAddSystemServiceTable;
93. cPtr < (PUCHAR)KeAddSystemServiceTable + PAGE_SIZE;
94. cPtr += Length )
95. {
96. if (!MmIsAddressValid(cPtr))  return NULL;
97. Length = SizeOfCode(cPtr, &pOpcode);
98. if (!Length || (Length == 1 && *pOpcode == 0xC3)) return NULL;
99. if (*(PUSHORT)pOpcode == 0x888D)
100. {
101. ServiceTableAddress = *(PULONG)(pOpcode + 2);
102. ShadowTable = (PSYSTEM_SERVICE_TABLE)ServiceTableAddress;
103. ShadowTable ++;
104. return ShadowTable;
105. }
106. }
107. return NULL;
108. }

ULONG
GetShadowSsdtCurrentAddresses(
PSSDT_ADDRESS AddressInfo,
PULONG Length
)
{
PSYSTEM_SERVICE_TABLE KeServiceDescriptorTableShadow = NULL;
ULONG NumberOfService = 0;
ULONG ServiceId = 0;
PKAPC_STATE ApcState;
ULONG i;

if (AddressInfo == NULL || Length == NULL)
{
KdPrint(("[GetShadowSsdtCurrentAddresses] 输入参数无效"));
return 0;
}

//KdPrint(("pid = %d", PsGetCurrentProcessId()));
ServiceId = (ULONG)PsGetCurrentProcessId();

if (!g_CsrssProcess) {
PsLookupProcessByProcessId((PVOID)ScPsGetCsrssProcessId(), &g_CsrssProcess);
}

KeServiceDescriptorTableShadow = GetKeServiceDescriptorTableShadow();

if (KeServiceDescriptorTableShadow == NULL)
{
KdPrint(("[GetShadowSsdtCurrentAddresses] GetKeServiceDescriptorTableShadow failed"));
return 0;
}

NumberOfService = KeServiceDescriptorTableShadow->NumberOfService;
if (Length[0] < NumberOfService * sizeof(SSDT_ADDRESS))
{
Length[0] = NumberOfService * sizeof(SSDT_ADDRESS);
return 0;
}

ApcState = ExAllocatePoolWithTag(NonPagedPool, sizeof(KAPC_STATE), MEM_TAG);
KeStackAttachProcess((PRKPROCESS)g_CsrssProcess, ApcState);

for (ServiceId = 0; ServiceId < NumberOfService; ServiceId ++)
{
AddressInfo[ServiceId].FunAddress = (ULONG)
KeServiceDescriptorTableShadow->ServiceTableBase[ServiceId];
AddressInfo[ServiceId].nIndex = ServiceId;
}

KeUnstackDetachProcess(ApcState);
ExFreePool(ApcState);

Length[0] = NumberOfService * sizeof(SSDT_ADDRESS);
return NumberOfService;
}

///////////////////////////////////////////////////////////////////////////////////
//
// 功能实现：枚举当前Shadow SSDT 表函数地址
// 输入参数：void
// 输出参数：返回Shadow ssdt table
//
///////////////////////////////////////////////////////////////////////////////////
PSYSTEM_SERVICE_TABLE
GetKeServiceDescriptorTableShadow(VOID)
{
PSYSTEM_SERVICE_TABLE ShadowTable = NULL;
ULONG ServiceTableAddress = 0;
PUCHAR cPtr = NULL;

for (cPtr = (PUCHAR)KeAddSystemServiceTable;
cPtr < (PUCHAR)KeAddSystemServiceTable + PAGE_SIZE;
cPtr += 1 )
{
if (!MmIsAddressValid(cPtr)) continue;

ServiceTableAddress = *(PULONG)cPtr;
if (!MmIsAddressValid((PVOID)ServiceTableAddress)) continue;

if (memcmp((PVOID)ServiceTableAddress, &KeServiceDescriptorTable, 16) == 0)
{
if ((PVOID)ServiceTableAddress == &KeServiceDescriptorTable) continue;
ShadowTable = (PSYSTEM_SERVICE_TABLE)ServiceTableAddress;
ShadowTable ++;
return ShadowTable;
}
}
return NULL;
}
//
// 方法2，通过硬编码实现，不通用
//
PSYSTEM_SERVICE_TABLE
GetKeServiceDescriptorTableShadow_2(VOID)
/*++
805ba5a3 8d8840a65580 lea ecx,nt!KeServiceDescriptorTableShadow (8055a640)[eax]
805ba5a9 833900 cmp dword ptr [ecx],0
--*/
{
PSYSTEM_SERVICE_TABLE ShadowTable;
ULONG ServiceTableAddress;
PUCHAR cPtr, pOpcode;
ULONG Length = 0;

for (cPtr = (PUCHAR)KeAddSystemServiceTable;
cPtr < (PUCHAR)KeAddSystemServiceTable + PAGE_SIZE;
cPtr += Length )
{
if (!MmIsAddressValid(cPtr)) return NULL;

Length = SizeOfCode(cPtr, &pOpcode);

if (!Length || (Length == 1 && *pOpcode == 0xC3)) return NULL;

if (*(PUSHORT)pOpcode == 0x888D)
{
ServiceTableAddress = *(PULONG)(pOpcode + 2);
ShadowTable = (PSYSTEM_SERVICE_TABLE)ServiceTableAddress;
ShadowTable ++;
return ShadowTable;
}
}
return NULL;
}