MmGetSystemRoutineAddress 函数源码

 

MmGetSystemRoutineAddress 函数源码

作者：阿国哥   发布于2007-3-29 20:34(星期四)

以下代码反编译自XP+SP2内核文件ntoskrnl.exe(5.1.2600.3051)的MmGetSystemRoutineAddress函数 函数功能:用来获取内核导出函数的地址,与用户态的GetProcessAddress函数雷同 功能引申:反编译这个函数,主要的作用是可借助它来定位PsLoadedModuleResource以及PsLoadedModuleList这个重量级内核变量 原代码如下(IDA反编译结果,已自动作了标识):

; PVOID __stdcall MmGetSystemRoutineAddress(PUNICODE_STRING SystemRoutineName)

public _MmGetSystemRoutineAddress@4

_MmGetSystemRoutineAddress@4 proc near



                   SystemRoutineName= dword ptr   8


8B FF                   mov edi, edi
55                      push ebp
8B EC                   mov ebp, esp
83 EC 20                sub esp, 20h
53                      push ebx
56                      push esi
57                      push edi
68 D8 9F 4E 00          push offset aNtoskrnl_exe         ; "ntoskrnl.exe"
8D 45 E8                lea eax, [ebp-18h]
33 F6                   xor esi, esi
50                      push eax
89 75 FC                mov [ebp-4], esi
89 75 F8                mov [ebp-8], esi
E8 53 83 F1 FF          call _RtlInitUnicodeString@8      ; RtlInitUnicodeString(x,x)
68 F4 9F 4E 00          push offset aHal_dll_0            ; "hal.dll"
8D 45 E0                lea eax, [ebp-20h]
50                      push eax
E8 45 83 F1 FF          call _RtlInitUnicodeString@8      ; RtlInitUnicodeString(x,x)



                   loc_4E9F62:                             ; CODE XREF: PAGE:005194DA j

6A 01                   push 1
FF 75 08                push dword ptr [ebp+8]
8D 45 F0                lea eax, [ebp-10h]
50                      push eax
E8 F7 D9 FB FF          call _RtlUnicodeStringToAnsiString@12 ; RtlUnicodeStringToAnsiString(x,x,x)
85 C0                   test eax, eax
0F 8C 56 F5 02 00       jl loc_5194CE
64 A1 24 01 00 00       mov eax, large fs:124h
6A 01                   push 1
8B F8                   mov edi, eax
FF 8F D4 00 00 00       dec dword ptr [edi+0D4h]
68 40 36 48 00          push offset _PsLoadedModuleResource
E8 14 84 F1 FF          call _ExAcquireResourceSharedLite@8 ; ExAcquireResourceSharedLite(x,x)
8B 35 20 36 48 00       mov esi, _PsLoadedModuleList
BB 20 36 48 00          mov ebx, offset _PsLoadedModuleList

;以上两行注意,可以8B35作特征码从MmGetSystemRoutineAddress起始地址搜索,并检测之后的双字与之后移6字节的双字
是否相同作特征检测. 此特征码目前适合的平台有待进一步考核.

                   loc_4E9F9D:                             ; CODE XREF: MmGetSystemRoutineAddress(x)+A3 j

3B F3                   cmp esi, ebx
74 69                   jz short loc_4EA00A
6A 01                   push 1
8D 46 2C                lea eax, [esi+2Ch]
50                      push eax
8D 45 E8                lea eax, [ebp-18h]
50                      push eax
E8 ED 1E FA FF          call _RtlEqualUnicodeString@12    ; RtlEqualUnicodeString(x,x,x)
84 C0                   test al, al
0F 84 5A FF FF FF       jz loc_4E9F12


                   loc_4E9FB8:                             ; CODE XREF: PAGE:004E9F23 j

FF 45 FC                inc dword ptr [ebp-4]
8D 45 F0                lea eax, [ebp-10h]
50                      push eax
FF 76 18                push dword ptr [esi+18h]
E8 F3 DA FF FF          call _MiFindExportedRoutineByName@8 ; MiFindExportedRoutineByName(x,x)
85 C0                   test eax, eax
89 45 F8                mov [ebp-8], eax
75 3C                   jnz short loc_4EA00A
83 7D FC 02             cmp dword ptr [ebp-4], 2
74 36                   jz short loc_4EA00A


                   loc_4E9FD4:                             ; CODE XREF: PAGE:004E9F29 j
8B 36                   mov esi, [esi]
EB C5                   jmp short loc_4E9F9D
                  ; **************************************************************************?

                   aNtoskrnl_exe:                          ; DATA XREF: MmGetSystemRoutineAddress(x)+B o

6E 00 74 00 6F 00+       unicode 0, <ntoskrnl.exe>,0
00                      db     0
00                      db     0
                   aHal_dll_0:                             ; DATA XREF: MmGetSystemRoutineAddress(x)+21 o

68 00 61 00 6C 00+       unicode 0, <hal.dll>,0
CC                      db 0CCh ; ?
CC                      db 0CCh ; ?
CC                      db 0CCh ; ?
CC                      db 0CCh ; ?
CC                      db 0CCh ; ?
CC                      db 0CCh ; ?

                  ; **************************************************************************?



                   loc_4EA00A:                             ; CODE XREF: MmGetSystemRoutineAddress(x)+6C j

                                                          ; MmGetSystemRoutineAddress(x)+99 j ...
B9 40 36 48 00          mov ecx, offset _PsLoadedModuleResource
E8 3C A6 F1 FF          call @ExReleaseResourceLite@4     ; ExReleaseResourceLite(x)
FF 87 D4 00 00 00       inc dword ptr [edi+0D4h]
75 0B                   jnz short loc_4EA027
8D 47 34                lea eax, [edi+34h]
39 00                   cmp [eax], eax
0F 85 B8 F4 02 00       jnz loc_5194DF


                   loc_4EA027:                             ; CODE XREF: MmGetSystemRoutineAddress(x)+E7 j

                                                          ; PAGE:005194EB j
8D 45 F0                lea eax, [ebp-10h]
50                      push eax
E8 4A FB FA FF          call _RtlFreeAnsiString@4         ; RtlFreeAnsiString(x)
8B 45 F8                mov eax, [ebp-8]
5F                      pop edi
5E                      pop esi
5B                      pop ebx
C9                      leave
C2 04 00                retn 4

                   _MmGetSystemRoutineAddress@4 endp ; sp =   3Ch