一、获取PspCidTable的地址
1.特征码搜索以下几个函数之一提取Call PspCidTable地址:
PsLookupProcessByProcessId()
PsLookupProcessThreadByCid()
PsLookupThreadByThreadId()
0: kd> u PsLookupProcessByProcessId l 20
nt!PsLookupProcessByProcessId:
805d40de 8bff mov edi,edi
805d40e0 55 push ebp
805d40e1 8bec mov ebp,esp
805d40e3 53 push ebx
805d40e4 56 push esi
805d40e5 64a124010000 mov eax,dword ptr fs:[00000124h]
805d40eb ff7508 push dword ptr [ebp+8]
805d40ee 8bf0 mov esi,eax
805d40f0 ff8ed4000000 dec dword ptr [esi+0D4h]
805d40f6 ff35c0495680 push dword ptr [nt!PspCidTable (805649c0)] <-就这儿! 特征码:ff 35 E8
805d40fc e859ad0300 call nt!ExMapHandleToPointer (8060ee5a)
..
/*==