寻找SSDT表地址

最新推荐文章于 2019-10-19 12:08:50 发布

「已注销」

最新推荐文章于 2019-10-19 12:08:50 发布

阅读量276

点赞数

分类专栏：自己写的函数全部集合

自己写的函数全部集合专栏收录该内容

13 篇文章 1 订阅

订阅专栏

#include"ntifs.h"
#include"intsafe.h"
#include"ntimage.h"
#define out
#define in
ULONG_PTR  dizhi_zwclose = 0;
ULONG_PTR  dizhi_KiServiceInternal = 0;
ULONG_PTR dizhi_KiSystemServiceStart = 0;
ULONG_PTR dizhi_KiSystemServiceStart_zhen = 0;
ULONG_PTR dizhi_KeServiceDescriptorTable = 0;
ULONG_PTR hanshu_zhengbandizhi(wchar_t *s1)//原版
{
	UNICODE_STRING str1 = { 0 };
	ULONG_PTR dizhi = 0;
	RtlInitUnicodeString(&str1, s1);
	dizhi = (ULONG_PTR)MmGetSystemRoutineAddress(&str1);
	return dizhi;
}
ULONG_PTR sao1()//求KiServiceInternal
{
	UCHAR *p1 = (UCHAR*)dizhi_zwclose;
	UCHAR *p2 = NULL;
	UCHAR n1 = 0;
	for (ULONG_PTR i = 0; i <= 0x20; i++)
	{
		if (MmIsAddressValid(p1 + i))
		{
			n1 = *(p1 + i);
			p2 = (p1 + i);
			if (*(p2 + 0) == 0x50 &&
				*(p2 + 1) == 0xb8 && *(p2 + 2) == 0x0c && *(p2 + 3) == 0x00  &&*(p2 + 4) == 0x00 &&*(p2 + 5) == 0x00
				)
			{
				return (ULONG_PTR)(p1 + i);
			}
		}
	}
	return 0;
}
ULONG_PTR sao2()//求KiSystemServiceStart
{
	UCHAR *p1 = (UCHAR*)dizhi_KiServiceInternal; 
	UCHAR *p2 = NULL;
	UCHAR n1 = 0;
	for (ULONG_PTR i = 0; i <= 0x70; i++)
	{
		if (MmIsAddressValid(p1 + i))
		{
			n1 = *(p1 + i);
			p2 = (p1 + i);
			if (*(p2 + 0) == 0x4c &&*(p2 + 1) == 0x89 && *(p2 + 2) == 0x95 && *(p2 + 3) == 0xb8 &&
				*(p2 + 4) == 0x00&& *(p2 + 5) == 0x00 && *(p2 + 6) == 0x00
				)
			{
				return (ULONG_PTR)(p1 + i);
			}
		}
	}
	return 0;
}
ULONG_PTR dedaossdt()
{
	dizhi_zwclose = hanshu_zhengbandizhi(L"ZwClose");
	KdPrint(("zwclose地址%p", dizhi_zwclose));
	ULONG_PTR linshi1 = sao1(); //求KiServiceInternal
	ULONG_PTR linshi2 = sao1() + 7;
	KdPrint(("linshi1地址%p", linshi1));
	KdPrint(("linshi2地址%p", linshi2));
	ULONG pianyi = *(ULONG*)linshi2;
	KdPrint(("pianyi%p", pianyi));
	dizhi_KiServiceInternal = linshi2 + 4 + pianyi;
	KdPrint(("KiServiceInternal地址%p", dizhi_KiServiceInternal));
	dizhi_KiSystemServiceStart = sao2();//求KiSystemServiceStart
	KdPrint(("KiSystemServiceStart地址%p", dizhi_KiSystemServiceStart));
	ULONG_PTR linshi3 = dizhi_KiSystemServiceStart + 10;
	KdPrint(("linshi3地址%p", linshi3));
	ULONG pianyi2 = *(ULONG*)linshi3;
	KdPrint(("pianyi2地址%x", pianyi2));
	dizhi_KiSystemServiceStart_zhen = linshi3 + 4 + pianyi2;
	KdPrint(("KiSystemServiceStart地址%p", dizhi_KiSystemServiceStart_zhen));//正确
	ULONG_PTR linshi4 = dizhi_KiSystemServiceStart_zhen + 0x14;
	KdPrint(("linshi4地址%p", linshi4));
	ULONG_PTR linshi5 = linshi4 + 0x3;
	ULONG pianyi3 = *(ULONG*)linshi5;
	KdPrint(("pianyi3==%x", pianyi3));
	dizhi_KeServiceDescriptorTable = linshi4 + 7 + pianyi3;
	//KdPrint(("KeServiceDescriptorTable地址%p", dizhi_KeServiceDescriptorTable));
	return dizhi_KeServiceDescriptorTable;
}