|
|
今天跑去研究x64的内核重载，因为x64的全局变量访问都是采用的相对偏移（目标地址 = 指令地址 + 指令长度 + 偏移），这里的偏移就是4byte的机器码。
那么是否意味着x64不需要重定位了？
正常加载情况下的全局变量访问都会随着模块加载的地址“自动”计算，公式如上。另外是否是因为内存对齐而导致的需要重定位？
思考不通x64重定位的意义~
以下是我重载ntos的函数截取。
原始内核函数：
- nt!NtCreateDebugObject:
- fffff800`01c70da0 48895c2408 mov qword ptr [rsp+8],rbx
- fffff800`01c70da5 4889742410 mov qword ptr [rsp+10h],rsi
- fffff800`01c70daa 57 push rdi
- fffff800`01c70dab 4883ec70 sub rsp,70h
- fffff800`01c70daf 418bf9 mov edi,r9d
- fffff800`01c70db2 8bf2 mov esi,edx
- fffff800`01c70db4 488bd9 mov rbx,rcx
- fffff800`01c70db7 65488b042588010000 mov rax,qword ptr gs:[188h]
- fffff800`01c70dc0 448a90f6010000 mov r10b,byte ptr [rax+1F6h]
- fffff800`01c70dc7 4584d2 test r10b,r10b
- fffff800`01c70dca 7414 je nt!NtCreateDebugObject+0x40 (fffff800`01c70de0)
- fffff800`01c70dcc 488b052d32e5ff mov rax,qword ptr [nt!MmUserProbeAddress (fffff800`01ac4000)]
- fffff800`01c70dd3 483bc8 cmp rcx,rax
- fffff800`01c70dd6 480f43c8 cmovae rcx,rax
- fffff800`01c70dda 488b01 mov rax,qword ptr [rcx]
- fffff800`01c70ddd 488901 mov qword ptr [rcx],rax
- fffff800`01c70de0 48832300 and qword ptr [rbx],0
- fffff800`01c70de4 41f7c1feffffff test r9d,0FFFFFFFEh
- fffff800`01c70deb 740a je nt!NtCreateDebugObject+0x57 (fffff800`01c70df7)
- fffff800`01c70ded b80d0000c0 mov eax,0C000000Dh
- fffff800`01c70df2 e9e4000000 jmp nt!NtCreateDebugObject+0x13b (fffff800`01c70edb)
- fffff800`01c70df7 488d442450 lea rax,[rsp+50h]
- fffff800`01c70dfc 4889442440 mov qword ptr [rsp+40h],rax
- fffff800`01c70e01 8364243800 and dword ptr [rsp+38h],0
- fffff800`01c70e06 8364243000 and dword ptr [rsp+30h],0
- fffff800`01c70e0b c744242868000000 mov dword ptr [rsp+28h],68h
- fffff800`01c70e13 488364242000 and qword ptr [rsp+20h],0
- fffff800`01c70e19 458aca mov r9b,r10b
- fffff800`01c70e1c 488b151db1daff mov rdx,qword ptr [nt!DbgkDebugObjectType (fffff800`01a1bf40)]
- fffff800`01c70e23 418aca mov cl,r10b
- fffff800`01c70e26 e8b5bef1ff call nt!ObCreateObject (fffff800`01b8cce0)
- fffff800`01c70e2b 4c8b4c2450 mov r9,qword ptr [rsp+50h]
- fffff800`01c70e30 4c894c2460 mov qword ptr [rsp+60h],r9
- fffff800`01c70e35 85c0 test eax,eax
- fffff800`01c70e37 0f889e000000 js nt!NtCreateDebugObject+0x13b (fffff800`01c70edb)
- fffff800`01c70e3d 41ba01000000 mov r10d,1
- fffff800`01c70e43 45895118 mov dword ptr [r9+18h],r10d
- fffff800`01c70e47 4983612000 and qword ptr [r9+20h],0
- fffff800`01c70e4c 4183612800 and dword ptr [r9+28h],0
- fffff800`01c70e51 498d4930 lea rcx,[r9+30h]
- fffff800`01c70e55 4533c0 xor r8d,r8d
- fffff800`01c70e58 418bd2 mov edx,r10d
- fffff800`01c70e5b e8a0efc2ff call nt!KeInitializeEvent (fffff800`0189fe00)
- fffff800`01c70e60 498d4950 lea rcx,[r9+50h]
- fffff800`01c70e64 48894908 mov qword ptr [rcx+8],rcx
- fffff800`01c70e68 488909 mov qword ptr [rcx],rcx
- fffff800`01c70e6b 33d2 xor edx,edx
- fffff800`01c70e6d 498bc9 mov rcx,r9
重载的内核中的函数：
- lkd> u fffffa80`2145DDA0 l 30
- fffffa80`2145dda0 48895c2408 mov qword ptr [rsp+8],rbx
- fffffa80`2145dda5 4889742410 mov qword ptr [rsp+10h],rsi
- fffffa80`2145ddaa 57 push rdi
- fffffa80`2145ddab 4883ec70 sub rsp,70h
- fffffa80`2145ddaf 418bf9 mov edi,r9d
- fffffa80`2145ddb2 8bf2 mov esi,edx
- fffffa80`2145ddb4 488bd9 mov rbx,rcx
- fffffa80`2145ddb7 65488b042588010000 mov rax,qword ptr gs:[188h]
- fffffa80`2145ddc0 448a90f6010000 mov r10b,byte ptr [rax+1F6h]
- fffffa80`2145ddc7 4584d2 test r10b,r10b
- fffffa80`2145ddca 7414 je fffffa80`2145dde0
- fffffa80`2145ddcc 488b052d32e5ff mov rax,qword ptr [fffffa80`212b1000]
- fffffa80`2145ddd3 483bc8 cmp rcx,rax
- fffffa80`2145ddd6 480f43c8 cmovae rcx,rax
- fffffa80`2145ddda 488b01 mov rax,qword ptr [rcx]
- fffffa80`2145dddd 488901 mov qword ptr [rcx],rax
- fffffa80`2145dde0 48832300 and qword ptr [rbx],0
- fffffa80`2145dde4 41f7c1feffffff test r9d,0FFFFFFFEh
- fffffa80`2145ddeb 740a je fffffa80`2145ddf7
- fffffa80`2145dded b80d0000c0 mov eax,0C000000Dh
- fffffa80`2145ddf2 e9e4000000 jmp fffffa80`2145dedb
- fffffa80`2145ddf7 488d442450 lea rax,[rsp+50h]
- fffffa80`2145ddfc 4889442440 mov qword ptr [rsp+40h],rax
- fffffa80`2145de01 8364243800 and dword ptr [rsp+38h],0
- fffffa80`2145de06 8364243000 and dword ptr [rsp+30h],0
- fffffa80`2145de0b c744242868000000 mov dword ptr [rsp+28h],68h
- fffffa80`2145de13 488364242000 and qword ptr [rsp+20h],0
- fffffa80`2145de19 458aca mov r9b,r10b
- fffffa80`2145de1c 488b151db1daff mov rdx,qword ptr [fffffa80`21208f40]
- fffffa80`2145de23 418aca mov cl,r10b
- fffffa80`2145de26 e8b5bef1ff call fffffa80`21379ce0
- fffffa80`2145de2b 4c8b4c2450 mov r9,qword ptr [rsp+50h]
- fffffa80`2145de30 4c894c2460 mov qword ptr [rsp+60h],r9
- fffffa80`2145de35 85c0 test eax,eax
- fffffa80`2145de37 0f889e000000 js fffffa80`2145dedb
- fffffa80`2145de3d 41ba01000000 mov r10d,1
- fffffa80`2145de43 45895118 mov dword ptr [r9+18h],r10d
- fffffa80`2145de47 4983612000 and qword ptr [r9+20h],0
- fffffa80`2145de4c 4183612800 and dword ptr [r9+28h],0
- fffffa80`2145de51 498d4930 lea rcx,[r9+30h]
- fffffa80`2145de55 4533c0 xor r8d,r8d
- fffffa80`2145de58 418bd2 mov edx,r10d
- fffffa80`2145de5b e8a0efc2ff call fffffa80`2108ce00
- fffffa80`2145de60 498d4950 lea rcx,[r9+50h]
- fffffa80`2145de64 48894908 mov qword ptr [rcx+8],rcx
- fffffa80`2145de68 488909 mov qword ptr [rcx],rcx
- fffffa80`2145de6b 33d2 xor edx,edx
- fffffa80`2145de6d 498bc9 mov rcx,r9
可以看到，机器码都是一致的。 |
|
发表于 2015-6-18 17:48:01
发表于 2015-6-18 20:08:43
