系统调用得到函数的参数

最新推荐文章于 2023-01-13 12:54:41 发布

weixin_34071713

最新推荐文章于 2023-01-13 12:54:41 发布

阅读量198

点赞数

文章标签： python

原文链接：https://my.oschina.net/sincoder/blog/130878

版权

2019独角兽企业重金招聘Python工程师标准>>>

调用一个系统调用从 r3 进入 r0 需要把 r3 堆栈上面的参数复制到 r0 的堆栈上但是怎么得到这个函数的参数呢？今天在看了下 SSDT 的结构原来还有一个参数 ParamTableBase 用来保存系统调用的参数个数

typedef struct ServiceDescriptorTable {

	PVOID ServiceTableBase;

	PVOID ServiceCounterTable(0);

	unsigned int NumberOfServices;

	PVOID ParamTableBase;

}

where

ServiceTableBase	Base address of the System Service Dispatch Table.
NumberOfServices	Number of services described by ServiceTableBase.
ServiceCounterTable	This field is used only in checked builds of the operating system and contains the counter of how many times each service in SSDT is called. This counter is updated by INT 2Eh handler (KiSystemService).
ParamTableBase	Base address of the table containing the number of parameter bytes for each of the system services.

转载于:https://my.oschina.net/sincoder/blog/130878