|
|
本帖最后由 wenh7788 于 2012-2-17 09:49 编辑
看到如下的代码，
- ULONGLONG GetKeServiceDescriptorTable64()
- {
- //Pattern
- char KiSystemServiceStart_pattern[14] = "\x8B\xF8\xC1\xEF\x07\x83\xE7\x20\x25\xFF\x0F\x00\x00";
- //Scan boundaries
- ×××××××××××××××××××××××××不明白×××××××
- ULONGLONG CodeScanStart = (ULONGLONG)&_strnicmp;
- ULONGLONG CodeScanEnd = (ULONGLONG)&KdDebuggerNotPresent;
- ×××××××××××××××××××××××××不明白×××××××
- //Another needed variables
- UNICODE_STRING Symbol;
- ULONGLONG i, tbl_address, b;
- //Loop - to find the KiSystemServiceStart function
- for (i = 0; i < CodeScanEnd - CodeScanStart; i++)
- {
- //Check if those bytes are equal to our pattern-bytes
- if (!memcmp((char*)(ULONGLONG)CodeScanStart +i, (char*)KiSystemServiceStart_pattern,14))
- {
- //Search lea rdx, * - by opcodes: 4c 8d
- for (b = 0; b < 50; b++)
- {
- tbl_address = ((ULONGLONG)CodeScanStart+i+b);
- //Check for lea rdx, * and calculate base address from relative address
- if (*(USHORT*) ((ULONGLONG)tbl_address ) == (USHORT)0x8d4c)
- return ((LONGLONG)tbl_address +7) + *(LONG*)(tbl_address +3);
- }
- }
- }
|
|
发表于 2012-2-17 09:47:14
发表于 2012-2-18 23:38:14
