还原NtTerminateProcess

本文详述了作者在闲暇时研究Windows XP Service Pack 3的内核过程中,如何还原NtTerminateProcess的代码。通过Windbg分析,发现PsTerminateProcess实际上依赖于NtTerminateProcess和ObReferenceObjectByHandle。作者对于为何不直接调用NtTerminateProcess而采用间接方式存在疑问,推测可能是为了防止函数被篡改,因为PsTerminateProcess并未导出。
摘要由CSDN通过智能技术生成

在上课吃饱了没事干的情况下,花了点功夫还原了我电脑上的NtTerminateProcess的代码

我的系统是Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible(来自windbg)

nt!NtTerminateProcess:
mov     edi,edi
push    ebp
mov     ebp,esp
sub     esp,10h
push    ebx
push    esi
push    edi
mov     eax,KPCR.PrcbData.CurrentThread ;eax = CurrentThread
cmp     ProcessHandle,0
mov     edi,eax
mov     eax,CurrentThread.ApcState.Process
mov     Process,eax ;Process = CurrentThread.ApcState.Process
je      nt!NtTerminateProcess+0x25
;if(ProcessHandle)
;{
nt!NtTerminateProcess+0x1f:
mov     ebp_1,1 ;ebp_1 = 1
jmp     nt!NtTerminateProcess+0x2d
;}
;else
;{
nt!NtTerminateProcess+0x25:
or      ProcessHandle,0FFFFFFFFh ;ProcessHandle = NtCurrentProcess()
mov     ebp_1,0 ;ebp_1 = 0
;}
nt!NtTerminateProcess+0x2d:
mov     al,CurrentThread.PreviousMode
push    0
mov     PreviousMode,al ;ebp_8.PreviousMode = CurrentThread.PreviousMode
lea     eax,EPROCESS
push    eax
push    CurrentThread.PreviousMode
push    dword ptr [nt!PsProcessType]
push    1
push    ProcessHandle
call    nt!ObReferenceObjectByHandle ;NTSTATUS = ObReferenceObjectByHandle(ProcessHandle,1,PsProcessType,ebp_8.PreviousMode,&ebp_8.EPROCESS,NULL)
test    eax,eax
mov     esi,EPROCESS ;esi = EPROCESS
mov     ebx,esi ;ebx = esi
jl      nt!NtTerminateProcess+0x144
;if(NT_SUCCESS(NTSTATUS))
;{
nt!NtTerminateProcess+0x5c:
lea     eax,EPROCESS.Fl
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值