|
|
发表于 2022-6-10 11:01:44
|
显示全部楼层
还有3-3 计算SSDT地址
那汇编代码没看懂
mov rax, rcx ;rcx=index
lea r10,[rdx] ;rdx=ssdt
mov edi,eax
shr edi,7 ;为什么右移7...C代码都没这个操作
and edi,20h
mov r10, qword ptr [r10+rdi]
movsxd r11,dword ptr [r10+rax*4]
mov rax,r11
sar r11,4
add r10,r11
mov rax,r10
ret
自己写了一个
;-------------------------------------
GetSSDTFunctionAddress PROC
mov qword ptr [rsp+8h],rcx ;rcx=Native API index
mov qword ptr [rsp+10h],rdx ;rdx=ssdt base
push rbp
push rdi
sub rsp,0C8h
mov rbp,rsp
mov rdi,rsp
mov ecx,32h
mov eax,0CCCCCCCCh
rep stosd
;-------------------------------------
mov rax,qword ptr[rbp+0C8h+8h*2+1*8h]
mov rdx,qword ptr[rbp+0C8h+8h*2+2*8h]
mov r10,qword ptr [rdx]
mov edi,eax
shl edi,2h
mov r10d, dword ptr [r10+rdi]
shr r10d,4h
mov r11,qword ptr [rdx]
mov rax,r11
add rax,r10
;----------------------------------------------
lea rsp, [rbp+0C8h]
pop rdi
pop rbp
ret
GetSSDTFunctionAddress ENDP
EXTERN_C UINT_PTR GetSSDTFunctionAddress(UINT64 idx, UINT64 uSSDT_base);
|
|
发表于 2014-5-12 23:27:58
