自己尝试还原的ObReferenceObjectByHandle

ObReferencObjectByHandle()这个函数从字面上看就可以知道是通过句柄（Handle)来访问对象。还原的过程中对汇编语言强大又有了进一步的认识，其效率之高令人惊叹，每个寄存器的使用都是那么的精妙绝伦，相同或类似的功能的代码很少重复出现。效率高的代价就是可读性较差，和C代码相比就会表现出巨大的差异；但是对于那些比较熟悉这两种语言的高手来说，随意在两者之间切换应该不是什么问题，而我看起来就好吃力拉，要重新好好看看汇编和C语言了（可能有许多低级错误）。下面还原的代码完成了60%左右，后面有些还没整合，仅供参考:)

typedef struct _OBJECT_HANDLE_INFORMATION {
    ULONG HandleAttributes;
    ACCESS_MASK GrantedAccess;
} OBJECT_HANDLE_INFORMATION, *POBJECT_HANDLE_INFORMATION;
NTKERNELAPI
NTSTATUS
ObReferenceObjectByHandleWithTag(
    __in HANDLE Handle,
    __in ACCESS_MASK DesiredAccess,
    __in_opt POBJECT_TYPE ObjectType,
    __in KPROCESSOR_MODE AccessMode,
    __in ULONG Tag,//with this tag
    __out PVOID *Object,
    __out_opt POBJECT_HANDLE_INFORMATION HandleInformation
    )
{
    PKTHREAD CurrentThread=KeGetCurrentThread();

    BOOLEAN       IsHandleTable=FALSE;          //esp+13h    byte
    PHANDLE_TABLE HandleTable=NULL;             //esp+14h    dword
    PVOID         Pointer=NULL;                 //esp+18h    dword
    POBJECT_HANDLE_INFORMATION HandleInfo=NULL; //esp+1ch    dword
    PKPROCESS Process=CurrentThread->ApcState.Process;//_kthread  偏移为0x40处是一个union,一个是_kapc_state ApcState,一个是uchar ApcStateFill[23]
    //esp+20h 
    if(!Handle)    // test edx,edx   jge 0x127
    {
        if(0x0FFFFFFFF==Handle)   //0x32   jne 0x9f
        {
            if((*PsProcessType!=*ObjectType)&&(*ObjectType))   //0x37   je 0x50  0x42    je 0x50
            {
                    return STATUS_OBJECT_TYPE_MISMATCH/*0x0c0000024*/;   //0x46
            }
            //mov esi,[esi+50h];  //0x50      
            if(!((0FFE00000h)&DesiredAccess)||(AccessMode==KernelMode))  //0xb3  0xbc   je 0x5f
            {  //#define STANDARD_RIGHTS_ALL (0X001F0000L)
                0x5f        +0x038 WaitRegister     : _KWAIT_STATUS_REGISTER
                //lea edi,[esi-18h]
                if(HandleInformation)    //0x5f   je 0x73
                {
                    HandleInformation->HandleAttributes&=0;//0x69  and dword ptr [eax],0
                    HandleInformation->GrantedAccess=1fffffh;//mov dword ptr [eax+4],1fffffh
                }
                else if(0!=*ObpTraceFlags)  //0x73   je 0x8f
                {
                    if((CurrentThread->ApcStateFill[6])&1)  //0x7c    je 0x8f
                    {
                        ObpPushStackInfo(CurrentThread->WaitReigster/*edi*/,1,1,Tag); //0x82
                    }
                }
                lock xadd CurrentThread->WaitStatus,1    //0x8f   State
                Object=CurrentThread->ApcState.Process;  
                return STATUS_SUCCESS;
            } 
            else    //0xc2
            {
                //0x55
                return STATUS_ACCESS_DENIED/*0x0c0000022*/;
            }
            ++0xc4
        }
        else if(0x0FFFFFFFE==Handle)    //0x9f   jne 0xc4
        {
            if(*PsThreadType!=*ObjectType)  //0xa4   je 0xb3
            {
                if(*ObjectType)    //0xaf    jne ox46
                {
                    return STATUS_OBJECT_TYPE_MISMATCH;
                }
            }
            if(!((0FFE00000h)&DesiredAccess)||(AccessMode==KernelMode))  //0xb3  0xbc   je 0x5f
            {  //#define STANDARD_RIGHTS_ALL (0X001F0000L)
                0x5f        +0x038 WaitRegister     : _KWAIT_STATUS_REGISTER
                //lea edi,[esi-18h]
                if(HandleInformation)    //0x5f   je 0x73
                {
                    HandleInformation->HandleAttributes&=0;//0x69  and dword ptr [eax],0
                    HandleInformation->GrantedAccess=1fffffh;//mov dword ptr [eax+4],1fffffh
                }
                else if(0!=*ObpTraceFlags)  //0x73   je 0x8f
                {
            ???     if((CurrentThread->ApcStateFill[6])&1)  //0x7c    je 0x8f
                    {
                        ObpPushStackInfo(CurrentThread->WaitReigster/*edi*/,1,1,Tag); //0x82
                    }
                }
                lock xadd CurrentThread->WaitStatus,1    //0x8f   State
                Object=CurrentThread;  
                return STATUS_SUCCESS;
            } 
            else    //0xc2
            {
                //0x55
                return STATUS_ACCESS_DENIED/*0x0c0000022*/;
            }
        }
        else if(KernelMode==AccessMode)  //0xc4     jne 0x179
        {
            Handle^=80000000h;   //0xce
            HandleTable=ObpKernelHandleTable;  //_HANDLE_TABLE

            CurrentThread->ApcStateIndex--;  //0xe0
            Pointer=ExMapHandleToPointerEx(Handle,AccessMode);  //mov edi,dword ptr [esp+18h] mov edi,eax   
            if(Pointer)   //je 0x28a
            {
                //mov ecx,dword ptr [edi] mov eax,dword ptr [ebp+10h] and ecx,0fffffff8h 
                //movzx edx,byte ptr [ecx+0ch]  mov dword ptr [esp+18h],ecx
                Pointer=CurrentThread->ApcState.Process->DispatcherHeader.Type-8;   //0x100
                if(*ObjectType!=*(ObTypeIndexTable+
                    ((CurrentThread->ApcState.Process->Dispatcher.SingalState)&0x0000ffff)*4) // je 0x183
                {
                    if(!(*ObjectType))  //0x119   je 0x183
                    {
                        mov ebx,0c0000024h   //0x11d
                        lock or Process->DispatcherHeader.Type,1;     //0x26b
                        if(ObpKernelHandleTable->HandleContentionEvent)    //je 0x28f
                        {
                            ExfUnblockPushLock(ObpKernelHandleTable->HandleContentionEvent,0); //0x281
                        }
                        //0x28a mov ebx,0c0000008h
                        CurrentThread->KernelApcDisable++;  //0x28f  2a2  2a9
                        if((!CurrentThread->KernelApcDisable))&&
                            (CurrentThread->ApcState.ApcListHead[0]!=CurrentThread->ApcState.ApcListHead[0].Flink)
                            &&(!CurrentThread->SpecialApcDisable))
                        {
                            KiCheckForKernelApcDelivery();  //0x2b3
                        }
                        else if(TRUE=IsHandleTable)   //0x2b8  jne  0x2c8
                        {
                            ObpDereferenceProcessHandleTable(CurrentThread->ApcState.Process);  //0x2bf
                        }
                        else
                        {
                            return STATUE_OBJECT_TYPE_MISMATCH;
                        }
                    }
                }
                jmp 0x183
            }
        }
    }
    else if((ViVerifierDriverAddedThrunkListHead)&&(KernelMode==AccessMode) ) //0x127  0x130
    {
            VfCheckUserHandle();     //0x136
    }
    if(CurrentThread->ApcState.Process!=CurrentThread->Process)  //0x13b    je 0x151
    {
        //eax=CurrentThread->ApcState.Process;
        HandleTable=ObReferenceProcessHandleTable();  //0x143
        IsHandleTable=TRUE;     //jmp 0x157
    }
    else
    {
        HandleTable=Eprocess->ObjectTable;    //0x151   KPROCESS IS A MEMBER OF STRUCT EPROCESS 
    }
    if(HandleTable)  //0x157  je 0x179   mov [esp+14h],eax
    {
        if(HandleTable==ObpKernelHandleTable)  //0x15f   jne jmp 0xe0
        {
            if(TRUE==IsHandleTable)  //0x16b  jne 0x179
            {
                ObDereferenceProcessHandleTable(CurrentThread->ApcState.Process);  //0x172
            }
            else
            {
                return STATUS_INVALID_HANDLE;
            }
        }
        else
        {
            jmp 0xe0;
        }
    }
    else
    {
        return STATUS_INVALID_HANDLE/*0c0000008h*/;  //0x179
    }



    if((NtGlobalFlag)&(2000h))   //0x183   je 0x1a1
    {
        /*0x18f ObpTranslateGrantedAccessIndex(
            CurrentThread->ApcState.Process->DispatcherHeader.SingalState);  */
        //mov     ecx,dword ptr [esp+18h]
        if(DesiredAccess&(~ObpTranslateGrantedAccessIndex(//0x18f   1ac
            CurrentThread->ApcState.Process->DispatcherHeader.SingalState))   //  je 0x1c5
        {
            if(KernelMode!=AccessMode)   //0x1b5  je 0x1c5
            {
                mov ebx,0c0000022h      //0x1bb   
                jmp 0x26b
            }
        }
    }
    else
    {
        (!*ObpAccessProtectCloseBit)&
            (CurrentThread->ApcState.Process->DispatcherHeader.SingalState);  //1a1
        //mov ebx,dword ptr [nt!ObpAccessProtectCloseBit]
        if(DesiredAccess&~(*ObpAccessProtectCloseBit))   //0x1ac  je 0x1c5
        {
            if(KernelMode!=AccessMode)   //0x1b5  je 0x1c5
            {
                mov ebx,0c0000022h      //0x1bb   jmp 0x26b
            }
        }
    }

    //mov     edx,dword ptr [esp+14h]    0x1c5
    if(!HandleTable->ExtraInfoPages)         //je  1e3 
    {
        HandleInfo=ExpGetHandleInfo(HandleTable->ExtraInfoPages,Handle);//0x1cf
        mov     ecx,dword ptr [esp+18h]
        if(!HandleInformation)  //0x1e8  
        {
            jmp 0x20b
        }
        else   //0x1ef
        {
            HandleInformation->GrantedAccess=
                ebx;  //0x1ef
            if((CurrentThread->ApcState.Process->DispatcherHeader.SingalState)
                &(*ObpAccessProtectCloseBit))   //je 0x206
            {
                *ObpAccessProtectCloseBit&=6;  //0x1fe
                *ObpAccessProtectCloseBit|=1;
            }
            else
            {
                *ObpAccessProtectCloseBit&=6;  //0x206
            }
            HandleInfomation->HandleAttributes=*ObpAccessProtectCloseBit; //0x209
            if((CurrentThread->ApcState.Process->DispatcherHeader.TimerControlFlags&4)&&
                (HandleInfo)&&(ObpAccessProtectCloseBit)&&
                    (DesiredAccess))//0x20b 210 218 21d   je 0x238
            {
                ObpAuditObjectAccess(Pointer,HandleInfo,Handle,DesiredAccess);  //0x223
                mov     ecx,dword ptr [esp+18h]          
                //0x238
            }
            else if((*ObpTraceFlags)&&([ecx+0dh]&1))  //0x238 0x241 je 258
            { 
                ObpPushStackInfo(Pointer,1,1,Object);   //0x247
                mov ecx,dword ptr [esp+18h]
                //0x258
            }
            else
            { //0x258
                mov     eax,ecx  //esp+18h
                lock xadd dword ptr [eax],1
                mov     eax,dword ptr [ebp+1Ch]
                add     ecx,18h
                mov     dword ptr [eax],ecx
                xor     ebx,ebx   //ebx=0   status_success
            }
        }
    }
    else
    {
        HandleInfo=NULL;   //0x1e3
        if(!HandleInformation)  //0x1e8   
        {
            jmp 0x20b
        } 
        else
        {
            //0x1ef
        }
        ...
    }
}