遍历 SSDT ShadowSSDT 编号和函数名

小烟囱

已于 2023-03-01 14:08:53 修改

阅读量394

点赞数

分类专栏：操作系统文章标签： windows 系统安全 c语言 c++

于 2023-02-26 22:38:24 首次发布

本文链接：https://blog.csdn.net/qq_23389971/article/details/129233003

版权

操作系统专栏收录该内容

1 篇文章 0 订阅

订阅专栏

该代码示例展示了如何在Windows10和11系统中遍历系统服务描述表（SSDT）和ShadowSSDT，通过读取PE文件的导出表获取函数名和编号，特别是查找特定地址的函数。

摘要由CSDN通过智能技术生成

遍历 SSDT ShadowSSDT 编号和函数名

通过遍历导出表获取函数名和编号

win10x64,win11测试可通用

    #include <windows.h>
	#include <stdio.h>
	#include <ImageHlp.h>
	
	#pragma comment(lib,"ImageHlp.lib")
	
	typedef struct {
		ULONG num;
		PULONG64 addr;
		PCHAR name;
	}SSDT;
	
	SSDT* ssdt = 0;
	
	PVOID PeGetExport(PVOID ImageBase)
	{
		ULONG size = 0;
		return ImageDirectoryEntryToData(ImageBase, FALSE, IMAGE_DIRECTORY_ENTRY_EXPORT, &size);
	}
	
	VOID PeGetServiceTable(PCHAR dllname, PCHAR dllpath)
	{
		PLOADED_IMAGE image = ImageLoad(dllname, dllpath);
		PVOID ImageBase = image->MappedAddress;
		IMAGE_EXPORT_DIRECTORY* pExport = PeGetExport(image->MappedAddress);
		PIMAGE_NT_HEADERS pNtHeader = ImageNtHeader(ImageBase);
	
		PULONG offsetFunc = ImageRvaToVa(pNtHeader, ImageBase, pExport->AddressOfFunctions, NULL);
		PULONG offsetName = ImageRvaToVa(pNtHeader, ImageBase, pExport->AddressOfNames, NULL);
		PSHORT offsetOrd = ImageRvaToVa(pNtHeader, ImageBase, pExport->AddressOfNameOrdinals, NULL);
	
		for (DWORD index = 0; index < pExport->NumberOfNames; index++)
		{
			PCHAR name = ImageRvaToVa(pNtHeader, ImageBase, offsetName[index], NULL);
			PULONG addr = ImageRvaToVa(pNtHeader, ImageBase, offsetFunc[offsetOrd[index]], NULL);
	
			if (addr && *addr == 0xB8D18B4C)
			{
				ULONG num = *(addr + 1);
				ssdt[num].num = num;
				ssdt[num].addr = (PULONG64)addr;
				ssdt[num].name = name;
			}
		}
	}
	
	int main()
	{
		ssdt = calloc(0x2000, sizeof(SSDT));
	
		PeGetServiceTable("ntdll.dll", "C:\\Windows\\System32\\");
		PeGetServiceTable("win32u.dll", "C:\\Windows\\System32\\");
	
		for (size_t i = 0; i < 0x2000; i++)
		{
			if (ssdt && ssdt[i].name)
			{
				printf("%04X,%I64X,%s\n", ssdt[i].num, (ULONG64)ssdt[i].addr, ssdt[i].name);
			}
		}
		free(ssdt);
		return 0;
	}