一、脚本
-
x86环境
aS ufLinkS "<u><col fg=\\\"emphfg\\\"><link name=\\\"%p\\\" cmd=\\\"uf 0x%p\\\">";
aS ufLinkE "</link></col></u>";
r $t1 = nt!KeServiceDescriptorTable;
r $t2 = poi(@$t1 + 0x8);
r $t1 = poi(@$t1);
.printf "\n\nKeServiceDescriptorTable->KiServiceTable: %p\nKeServiceDescriptorTable->Count: %d\n", @$t1, @$t2;
.printf "\nOrd Address fnAddr Symbols\n";
.printf "--------------------------------\n\n";
.for (r $t0 = 0; @$t0 != @$t2; r $t0 = @$t0 + 1)
{
r @$t3 = (poi(@$t1 + @$t0 * 4))
.printf /D "[%3d] ${ufLinkS}%p${ufLinkE} (%y)\n", @$t0, @$t3, @$t3, @$t3, @$t3;
}
.printf "\n- end -\n";
-
x64环境
aS ufLinkS "<u><col fg=\\\"emphfg\\\"><link name=\\\"%p\\\" cmd=\\\"uf 0x%p\\\">";
aS ufLinkE "</link></col></u>";
r $t1 = nt!KeServiceDescriptorTable;
r $t2 = poi(@$t1 + 0x10);
r $t1 = poi(@$t1);
.printf "\n\nKeServiceDescriptorTable->KiServiceTable: %p\nKeServiceDescriptorTable->Count: %d\n", @$t1, @$t2;
.printf "\nOrd Address fnAddr Symbols\n";
.printf "--------------------------------\n\n";
.for (r $t0 = 0; @$t0 != @$t2; r $t0 = @$t0 + 1)
{
r @$t3 = (poi(@$t1 + @$t0 * 4)) & 0x00000000`FFFFFFFF;
$$.printf "2. %p\n", @$t3;
.if ( @$t3 & 0x80000000 )
{
r @$t3 = (@$t3 >> 4) | 0xFFFFFFFF`F0000000;
r @$t3 = 0 - @$t3;
r @$t3 = @$t1 - @$t3;
}
.else
{
r @$t3 = (@$t3 >> 4);
r @$t3 = (@$t1 + @$t3);
}
.printf /D "[%3d] ${ufLinkS}%p${ufLinkE} (%y)\n", @$t0, @$t3, @$t3, @$t3, @$t3;
}
.printf "\n- end -\n";
二、测试效果
-
x86(Win7 x86)
-
x64(Win10 x64)