Ͽ£ShadowSSDTĺԭʼַķ²ǺܶࡣȽϼ򵥵Ӧźsymbolķ

˾symbolShadowSSDTǱȽϷģԼҲȥһűֶΪ^_^

취򵥵ԭֻҪһwin32.syswin32.pdbԼò10APIɹ

ãôЩ

1.SymInitializeʼDbghelpϵеĺ
2.ImageLoadȡļwin32.sys
3.SymLoadModuleȡpdbļ
4.SymEnumSymbolsöٷţһǻصSymEnumSymbolsProcthat's the key
SymEnumSymbolsProcһϵͳæһΪPSYMBOL_INFOṹĲṹҪõNameAddress
5.ImageUnloadSymCleanupһЩ

OKһҵ˼·

ǻW32pServiceTableĵַϤShadowSSDT֪W32pServiceTableں˳ʼShadowSSDTı
Ȼ֪W32pServiceTableĵַҲסSymEnumSymbolsProcShadowSSDTÿĵַͺ

˵е㸴ӣܼ򵥵ġ

:
#include <windows.h>
#include <stdio.h>
#include <Dbghelp.h>

#pragma comment(lib, "Dbghelp.lib")
#pragma comment(lib, "Imagehlp.lib")

extern "C" {

  PLOADED_IMAGE
    IMAGEAPI
    ImageLoad(
    PCSTR DllName,
    PCSTR DllPath
    );

  BOOL 
    IMAGEAPI 
    ImageUnload(
    PLOADED_IMAGE LoadedImage  
    );

}

//
//ڴŵõShadowSSDTĺͺ
//
typedef struct _SHADOWFUNC
{
  CHAR FuncName[100];
  DWORD FuncAddr;

}SHADOWFUNC, *PSHADOWFUNC;

DWORD    g_W32pServiceTable = 0;
SHADOWFUNC  g_ShadowFunc[667] = {0};

//
//صڻShadowSSDTĺͺ
//
BOOL CALLBACK SymEnumSymbolsProc(
                 PSYMBOL_INFO  pSymInfo,
                 ULONG  SymbolSize,
                 PVOID  UserContext
                 )
{
  PDWORD  pW32pServiceTable = NULL;
  INT    i = 0;
  if (!UserContext)
  {
    if (strstr(pSymInfo->Name, "W32pServiceTable"))
    {
      printf("%s, %#x\n", pSymInfo->Name, pSymInfo->Address);
      g_W32pServiceTable = (DWORD)pSymInfo->Address;
    }
  }
  else
  {
    pW32pServiceTable = (PDWORD)UserContext;
    for (i = 0; i < 667; i++)
    {
      if (*(pW32pServiceTable + i) == (DWORD)pSymInfo->Address)
      {
        g_ShadowFunc[i].FuncAddr = (DWORD)pSymInfo->Address;
        lstrcpyn(g_ShadowFunc[i].FuncName, pSymInfo->Name, 100);        
      }
    }
  }

  return TRUE;
}




void main()
{
  INT        i = 0;
  PDWORD      pW32pServiceTable = 0;
  HANDLE      hHandle = 0;
  PLOADED_IMAGE  ploadImage = {0};
  DWORD      dwload = 0;

  hHandle = GetCurrentProcess();
  SymInitialize(hHandle, NULL, TRUE);

  ploadImage = ImageLoad("win32k.sys", NULL);

  dwload = SymLoadModule (hHandle, ploadImage->hFile, 
    "win32k.sys", "win32k.pdb", 
    0, ploadImage->SizeOfImage);


  SymEnumSymbols(hHandle, dwload, NULL, SymEnumSymbolsProc, NULL);
  if (g_W32pServiceTable)
  {
    pW32pServiceTable = (PDWORD)(g_W32pServiceTable - dwload 
      + (DWORD)ploadImage->MappedAddress);
    SymEnumSymbols(hHandle, dwload, NULL, SymEnumSymbolsProc, pW32pServiceTable);
  }

  for (i = 0; i < 667; i++)
  {
    printf("%03d, 0x%08X, %s\n", i, g_ShadowFunc[i].FuncAddr, g_ShadowFunc[i].FuncName);
  }

  ImageUnload(ploadImage);
  SymCleanup(hHandle);
}