ObReferencObjectByHandle()这个函数从字面上看就可以知道是通过句柄(Handle)来访问对象。还原的过程中对汇编语言强大又有了进一步的认识,其效率之高令人惊叹,每个寄存器的使用都是那么的精妙绝伦,相同或类似的功能的代码很少重复出现。效率高的代价就是可读性较差,和C代码相比就会表现出巨大的差异;但是对于那些比较熟悉这两种语言的高手来说,随意在两者之间切换应该不是什么问题,而我看起来就好吃力拉,要重新好好看看汇编和C语言了(可能有许多低级错误)。下面还原的代码完成了60%左右,后面有些还没整合,仅供参考:)
typedef struct _OBJECT_HANDLE_INFORMATION {
ULONG HandleAttributes;
ACCESS_MASK GrantedAccess;
} OBJECT_HANDLE_INFORMATION, *POBJECT_HANDLE_INFORMATION;
NTKERNELAPI
NTSTATUS
ObReferenceObjectByHandleWithTag(
__in HANDLE Handle,
__in ACCESS_MASK DesiredAccess,
__in_opt POBJECT_TYPE ObjectType,
__in KPROCESSOR_MODE AccessMode,
__in ULONG Tag,//with this tag
__out PVOID *Object,
__out_opt POBJECT_HANDLE_INFORMATION HandleInformation
)
{
PKTHREAD CurrentThread=KeGetCurrentThread();
BOOLEAN IsHandleTable=FALSE; //esp+13h byte
PHANDLE_TABLE HandleTable=NULL; //esp+14h dword
PVOID Pointer=NULL; //esp+18h dword
POBJECT_HANDLE_INFORMATION HandleInfo=NULL; //esp+1ch dword
PKPROCESS Process=CurrentThread->ApcState.Process;//_kthread 偏移为0x40处是一个union,一个是_kapc_state ApcState,一个是uchar ApcStateFill[23]
//esp+20h
if(!Handle) // test edx,edx jge 0x127
{
if(0x0FFFFFFFF==Handle) //0x32 jne 0x9f
{
if((*PsProcessType!=*ObjectType)&&(*ObjectType)) //0x37 je 0x50 0x42 je 0x50
{
return STATUS_OBJECT_TYPE_MISMATCH/*0x0c0000024*/; //0x46
}
//mov esi,[esi+50h]; //0x50
if(!((0FFE00000h)&DesiredAccess)||(AccessMode==KernelMode)) //0xb3 0xbc je 0x5f
{ //#define STANDARD_RIGHTS_ALL (0X001F0000L)
0x5f +0x038 WaitRegister : _KWAIT_STATUS_REGISTER
//lea edi,[esi-18h]
if(HandleInformation) //0x5f je 0x73
{
HandleInformation->HandleAttributes&=0;//0x69 and dword ptr [eax],0
HandleInformation->GrantedAccess=1fffffh;//mov dword ptr [eax+4],1fffffh
}
else if(0!=*ObpTraceFlags) //0x73 je 0x8f
{
if((CurrentThread->ApcStateFill[6])&1) //0x7c je 0x8f
{
ObpPushStackInfo(CurrentThread->WaitReigster/*edi*/,1,1,Tag); //0x82
}
}
lock xadd CurrentThread->WaitStatus,1 //0x8f State
Object=CurrentThread->ApcState.Process;
return STATUS_SUCCESS;
}
else //0xc2
{
//0x55
return STATUS_ACCESS_DENIED/*0x0c0000022*/;
}
++0xc4
}
else if(0x0FFFFFFFE==Handle) //0x9f jne 0xc4
{
if(*PsThreadType!=*ObjectType) //0xa4 je 0xb3
{
if(*ObjectType) //0xaf jne ox46
{
return STATUS_OBJECT_TYPE_MISMATCH;
}
}
if(!((0FFE00000h)&DesiredAccess)||(AccessMode==KernelMode)) //0xb3 0xbc je 0x5f
{ //#define STANDARD_RIGHTS_ALL (0X001F0000L)
0x5f +0x038 WaitRegister : _KWAIT_STATUS_REGISTER
//lea edi,[esi-18h]
if(HandleInformation) //0x5f je 0x73
{
HandleInformation->HandleAttributes&=0;//0x69 and dword ptr [eax],0
HandleInformation->GrantedAccess=1fffffh;//mov dword ptr [eax+4],1fffffh
}
else if(0!=*ObpTraceFlags) //0x73 je 0x8f
{
??? if((CurrentThread->ApcStateFill[6])&1) //0x7c je 0x8f
{
ObpPushStackInfo(CurrentThread->WaitReigster/*edi*/,1,1,Tag); //0x82
}
}
lock xadd CurrentThread->WaitStatus,1 //0x8f State
Object=CurrentThread;
return STATUS_SUCCESS;
}
else //0xc2
{
//0x55
return STATUS_ACCESS_DENIED/*0x0c0000022*/;
}
}
else if(KernelMode==AccessMode) //0xc4 jne 0x179
{
Handle^=80000000h; //0xce
HandleTable=ObpKernelHandleTable; //_HANDLE_TABLE
CurrentThread->ApcStateIndex--; //0xe0
Pointer=ExMapHandleToPointerEx(Handle,AccessMode); //mov edi,dword ptr [esp+18h] mov edi,eax
if(Pointer) //je 0x28a
{
//mov ecx,dword ptr [edi] mov eax,dword ptr [ebp+10h] and ecx,0fffffff8h
//movzx edx,byte ptr [ecx+0ch] mov dword ptr [esp+18h],ecx
Pointer=CurrentThread->ApcState.Process->DispatcherHeader.Type-8; //0x100
if(*ObjectType!=*(ObTypeIndexTable+
((CurrentThread->ApcState.Process->Dispatcher.SingalState)&0x0000ffff)*4) // je 0x183
{
if(!(*ObjectType)) //0x119 je 0x183
{
mov ebx,0c0000024h //0x11d
lock or Process->DispatcherHeader.Type,1; //0x26b
if(ObpKernelHandleTable->HandleContentionEvent) //je 0x28f
{
ExfUnblockPushLock(ObpKernelHandleTable->HandleContentionEvent,0); //0x281
}
//0x28a mov ebx,0c0000008h
CurrentThread->KernelApcDisable++; //0x28f 2a2 2a9
if((!CurrentThread->KernelApcDisable))&&
(CurrentThread->ApcState.ApcListHead[0]!=CurrentThread->ApcState.ApcListHead[0].Flink)
&&(!CurrentThread->SpecialApcDisable))
{
KiCheckForKernelApcDelivery(); //0x2b3
}
else if(TRUE=IsHandleTable) //0x2b8 jne 0x2c8
{
ObpDereferenceProcessHandleTable(CurrentThread->ApcState.Process); //0x2bf
}
else
{
return STATUE_OBJECT_TYPE_MISMATCH;
}
}
}
jmp 0x183
}
}
}
else if((ViVerifierDriverAddedThrunkListHead)&&(KernelMode==AccessMode) ) //0x127 0x130
{
VfCheckUserHandle(); //0x136
}
if(CurrentThread->ApcState.Process!=CurrentThread->Process) //0x13b je 0x151
{
//eax=CurrentThread->ApcState.Process;
HandleTable=ObReferenceProcessHandleTable(); //0x143
IsHandleTable=TRUE; //jmp 0x157
}
else
{
HandleTable=Eprocess->ObjectTable; //0x151 KPROCESS IS A MEMBER OF STRUCT EPROCESS
}
if(HandleTable) //0x157 je 0x179 mov [esp+14h],eax
{
if(HandleTable==ObpKernelHandleTable) //0x15f jne jmp 0xe0
{
if(TRUE==IsHandleTable) //0x16b jne 0x179
{
ObDereferenceProcessHandleTable(CurrentThread->ApcState.Process); //0x172
}
else
{
return STATUS_INVALID_HANDLE;
}
}
else
{
jmp 0xe0;
}
}
else
{
return STATUS_INVALID_HANDLE/*0c0000008h*/; //0x179
}
if((NtGlobalFlag)&(2000h)) //0x183 je 0x1a1
{
/*0x18f ObpTranslateGrantedAccessIndex(
CurrentThread->ApcState.Process->DispatcherHeader.SingalState); */
//mov ecx,dword ptr [esp+18h]
if(DesiredAccess&(~ObpTranslateGrantedAccessIndex(//0x18f 1ac
CurrentThread->ApcState.Process->DispatcherHeader.SingalState)) // je 0x1c5
{
if(KernelMode!=AccessMode) //0x1b5 je 0x1c5
{
mov ebx,0c0000022h //0x1bb
jmp 0x26b
}
}
}
else
{
(!*ObpAccessProtectCloseBit)&
(CurrentThread->ApcState.Process->DispatcherHeader.SingalState); //1a1
//mov ebx,dword ptr [nt!ObpAccessProtectCloseBit]
if(DesiredAccess&~(*ObpAccessProtectCloseBit)) //0x1ac je 0x1c5
{
if(KernelMode!=AccessMode) //0x1b5 je 0x1c5
{
mov ebx,0c0000022h //0x1bb jmp 0x26b
}
}
}
//mov edx,dword ptr [esp+14h] 0x1c5
if(!HandleTable->ExtraInfoPages) //je 1e3
{
HandleInfo=ExpGetHandleInfo(HandleTable->ExtraInfoPages,Handle);//0x1cf
mov ecx,dword ptr [esp+18h]
if(!HandleInformation) //0x1e8
{
jmp 0x20b
}
else //0x1ef
{
HandleInformation->GrantedAccess=
ebx; //0x1ef
if((CurrentThread->ApcState.Process->DispatcherHeader.SingalState)
&(*ObpAccessProtectCloseBit)) //je 0x206
{
*ObpAccessProtectCloseBit&=6; //0x1fe
*ObpAccessProtectCloseBit|=1;
}
else
{
*ObpAccessProtectCloseBit&=6; //0x206
}
HandleInfomation->HandleAttributes=*ObpAccessProtectCloseBit; //0x209
if((CurrentThread->ApcState.Process->DispatcherHeader.TimerControlFlags&4)&&
(HandleInfo)&&(ObpAccessProtectCloseBit)&&
(DesiredAccess))//0x20b 210 218 21d je 0x238
{
ObpAuditObjectAccess(Pointer,HandleInfo,Handle,DesiredAccess); //0x223
mov ecx,dword ptr [esp+18h]
//0x238
}
else if((*ObpTraceFlags)&&([ecx+0dh]&1)) //0x238 0x241 je 258
{
ObpPushStackInfo(Pointer,1,1,Object); //0x247
mov ecx,dword ptr [esp+18h]
//0x258
}
else
{ //0x258
mov eax,ecx //esp+18h
lock xadd dword ptr [eax],1
mov eax,dword ptr [ebp+1Ch]
add ecx,18h
mov dword ptr [eax],ecx
xor ebx,ebx //ebx=0 status_success
}
}
}
else
{
HandleInfo=NULL; //0x1e3
if(!HandleInformation) //0x1e8
{
jmp 0x20b
}
else
{
//0x1ef
}
...
}
}