找KiServiceTable

最新推荐文章于 2023-05-06 10:57:34 发布

weixin_33739541

最新推荐文章于 2023-05-06 10:57:34 发布

阅读量171

点赞数

原文链接：https://my.oschina.net/ejoyc/blog/184748

版权

为什么80%的码农都做不了架构师？>>>

已知
a1 = NtClearEvent地址;
a2 = NtClose地址;
a3 = NtOpenFile地址;
i1 = *(PULONG)((PUCHAR)ZwClearEvent+1);
i2 = *(PULONG)((PUCHAR)ZwClose+1);
i3 = *(PULONG)((PUCHAR)ZwOpenFile+1);
并且
a1 = KiServiceTable[i1];
a2 = KiServiceTable[i2];
a3 = KiServiceTable[i3];

b = Ntoskrnl的映像基址
s = Ntoskrnl的映像大小

求
KiServiceTable

for( a = b; a < s+b; a+=0x10 )
{
    if( *(PULONG)s == a1 )
    {
        if( *(PULONG)(s + 4*(i2-i1)) == a2 )
        {
            if( *(PULONG)(s + 4*(i3-i1)) == a3 )
            {
                KiServiceTable = a;
                break;
            }
        }
    }
}

转载于:https://my.oschina.net/ejoyc/blog/184748