|
|
有了SSDT, 不免俗也要發個 Shadow SSDT {:soso_e120:}
$$ Windows 7 SP1 x64
$$ variables
aS lnkS "<u><col fg=\\\"emphfg\\\"><link name=\\\"%p\\\" cmd=\\\"u 0x%p\\\">";
aS lnkE "</link></col></u>";
r $t1 = nt!KeServiceDescriptorTableShadow;
r $t2 = poi(@$t1 + 30);
r $t3 = poi(@$t1 + 20);
$$ select explorer.exe thread
.foreach /pS 1 /ps 13 (obj {.shell -i - -ci "!process 0 0 explorer.exe" FIND " "}){.process /p ${obj}}
.printf "\nKeServiceDescriptorTableShadow = 0x%p\n", @$t1;
.printf "ServiceSectionCount = 0x%X\n", @$t2;
.printf "ServiceTable = 0x%p\n", @$t3;
.printf " Index FunctionAddr Symbols\n";
.printf "---------------------------------------------\n\n";
.for (r $t0 = 0; @$t0 < @$t2 ; r $t0 = @$t0 + 1)
{
$$ ln win32k!W32pServiceTable+((poi(win32k!W32pServiceTable+4*index) & 0x00000000ffffffff)>>4)-10000000
r $t4 = dwo((@$t3 + (@$t0 * 4))) >> 4;
.if (@$t4 > 0x7ffffff)
{
r $t5 = @$t3 + @$t4 - 10000000;
}
.else
{
r $t5 = @$t3 + @$t4;
}
.printf /D "[%4d] ${lnkS}%p${lnkE}: (%y)\n", @$t0, @$t5, @$t5, @$t5, @$t5;
}
.printf "\n- end -\n";
ad lnkS;
ad lnkE;
主要難度在於由 kernel 進到 exploer 進程, 再去問資料, 腳本的寫法不熟, 花了不少時間... {:soso_e106:}
|
评分
-
查看全部评分
|
发表于 2013-10-29 01:09:30
发表于 2013-10-29 15:26:21
发表于 2013-11-2 20:21:08
