typedef struct _SYSTEM_SERVICE_TABLE
{
PNTPROC ServiceTable ; // array of entry points
PULONG CounterTable ; // array of usage counters . be NULL
ULONG ServiceLimit ; // number of table entries
UCHAR* ArgumentTable ; // array of bytes counts
} SYSTEM_SERVICE_TABLE , *PSYSTEM_SERVICE_TABLE , **PPSYSTEM_SERVICE_TABLE ;
ULONG GetSSDTFunction(ULONG nIndex, ULONG *pFunAddr )
{
PETHREAD kthread;
PSYSTEM_SERVICE_TABLE pssdt;
kthread = (ULONG)PsGetCurrentThread();
pssdt = kthread ->ServiceTable;
if( nIndex < pssdt->ServiceLimit )
{
*pFunAddr = pssdt->ServiceTable [nIndex];
return *pFunAddr;
}
return 0;
}
一段获取ssdt表及其中函数的简单代码
最新推荐文章于 2021-12-18 15:10:01 发布