XC3 完整专业逆向工程与虚拟化恢复报告
- 版本：1.3.2
- 日期：2026-08-22
- 项目：
XC3-analysis-20260820
- 工件集：
XC3 本地快照
- 范围：二进制逆向、驱动协议、虚拟化结构、函数恢复、内存取证、跨会话差分、IR/CFG 证据。
正文只列主要函数和调用锚点；全部 IDA 函数、VM handler、family 与 exports 随发布包以 CSV 交付。
主程序尚未建立全量 IDB；NMSSWCore 运行时 .vdata 尚未完成函数边界恢复，均明确列为开放项。
0. 技术概览
0.1 系统定位
XC3 是一套多层系统，由 游戏主程序、NMSSWCore、x3 用户态模块和 xhunter 内核驱动 共同组成。
目前，各层入口、通信协议、VM 调度表、12,000 余个 IDA 函数和 1,647 条 VM 路径都已整理为可查询目录。
下一阶段的关键不再是收集静态函数名，而是补齐完整进程中的堆、线程栈和连续 VM 状态。
0.2 组件职责
| 组件 |
职责 |
当前恢复状态 |
| 游戏主程序 |
宿主应用 |
映像和导出已确认；完整函数图尚未建立 |
NMSSWCore.nsm |
启动和编排层 |
8 个导出；运行时产生约 5.3MB .vdata |
x3_x64.xem |
主要用户态执行模块 |
loader、隐藏代码区、VM 调度器、驱动 wrapper 已定位 |
.vlizer |
解压后才出现的隐藏代码区 |
范围、解码、修复、1,647 条路径已恢复 |
xhunter1.sys |
内核服务层 |
44 个命令、请求格式、PID/句柄/线程相关函数和 live callbacks 已恢复 |
| VM handler |
调度器选中的一小段代码 |
1,647 条全部有 RVA、大小、终点、family 和哈希 |
0.3 恢复状态
| 状态 |
分析面 |
结论 |
| Confirmed |
工件身份 |
关键结论均绑定文件版本、大小与证据相位 |
| Confirmed |
驱动协议 |
44 个 opcode、request/response schema 与关键 helper |
| Confirmed |
VM 结构 |
1,647 个 table/stub/landing 全覆盖 |
| Confirmed |
跨会话稳定性 |
1,647 个 first block 与 table RVA 两轮一致 |
| Partial |
VM 状态模型 |
已恢复 0x1A2 → 0x465 两段状态转换 |
| Partial |
NMSSWCore |
.vdata 已捕获，内部格式仍待恢复 |
| Missing input |
完整 VM 语义 |
仍需 full process dump 中的 heap/stack/thread context |
| Open |
全 IR/CFG 与原生等价 |
尚未达到完整去虚拟化验收 |
0.4 执行链
flowchart LR
A[游戏启动] --> B[NMSSWCore 组织初始化]
B --> C[x3 加载]
C --> D[解压 .vlizer]
D --> E[dispatcher 读取 selector]
E --> F[从 1647 项表选择 handler]
F --> G[修改 VM context / stack]
F --> H[需要时调用 Windows API]
C --> I[通过 wrapper 向 xhunter 写请求]
I --> J[驱动按 opcode 调用 handler]
0.5 阅读索引
| 读者 |
建议顺序 |
可以跳过 |
| 第一次接触 XC3 |
0 → 1 → 4 → 12 → 13 |
发布包里的函数 CSV |
| 项目负责人 |
0 → 1 → 6 → 12 → 13 |
单个函数字节与机器字段 |
| 驱动逆向人员 |
3 → 7 → 10.1/10.2 → 11 |
x3 全函数 CSV |
| VM 逆向人员 |
8 → 10.3/10.4/10.6 → 11/12 |
普通 PE exports |
| 内存取证人员 |
3 → 5 → 9 → 11 → 13 |
44 opcode 的业务细节 |
0.6 术语索引
| 术语 |
定义 |
| RVA |
相对模块起点的地址；重启后仍可复用 |
| VA |
某次运行的绝对地址；ASLR 后会变化 |
| IDA / IDB |
反汇编工具 / 它保存的分析数据库 |
| VAD |
Windows 记录进程每段虚拟内存用途的目录 |
| mapped dump |
只抓一个已加载模块的映像，不含整个进程堆和栈 |
| full process dump |
包含模块、私有内存、线程、栈和地址空间信息的完整进程快照 |
| dispatcher |
根据 selector 决定下一段 handler 的调度器 |
| selector |
调度表索引，可近似理解为“下一步编号” |
| handler |
VM 执行的一小段代码 |
| context |
VM 保存寄存器、状态、标志和指针的数据区 |
| IR |
把混乱机器指令翻译成统一的 LOAD/STORE/ADD/BRANCH 等操作 |
| CFG |
控制流图，说明代码块之间如何跳转 |
| family |
指令形状相近的一组 handler；形状相同不自动等于语义相同 |
0.7 统计口径
- 12,148 个 x3 函数：来自
x3_x64.xem.bin 的 Stage5 IDB；这是 IDA 当前定义的全部函数，不表示每个都已经人工命名。完整目录：catalogs/x3_all_functions.csv。
- 1,647 个 VM handler：来自
x3_x64.xem.bin 的 .vlizer 区域；这是完整结构目录，不表示已经得到 1,647 个通用 opcode 语义。完整目录：catalogs/vm_handlers_1647.csv。
- 1,431 个 family：由
x3_x64.xem.bin 的 1,647 个 handler 归一化聚类产生；仅用于压缩分析规模，不能替代语义验证。完整目录：catalogs/feature_families_1431.csv。
全量函数与 handler 目录不进入正文；检索时使用发布包中的 CSV。
1. 执行摘要
本报告把 Stage1–12 的逆向结果合并为一条可复现证据链，并纳入两轮运行时模块映像和一份 live kernel dump：
xhunter1.sys：361 个 IDA 函数、44 项 opcode 分发、关键协议/状态/回调均有本地字节证据；x3_x64.xem：12,148 个 Stage5 IDA 函数、1,647 项 VM handler 结构全覆盖；NMSSWCore.nsm：8 个 PE exports、4 个现有 IDA 函数、运行时 RWX .vdata 已捕获；- VM：1,647 table RVA 与 1,647 first handler blocks 跨两次会话完全稳定；
- 动态状态：
0x1A2 → 0x465 bounded transition、API resolver、low-I/O、__piob、kernel callbacks 已建立；
- 仍未完成：全 selector next-state、通用 VM state、全 IR/CFG、NMSSWCore
.vdata 格式、完整用户进程 heap/stack。
| 对象 |
数量 |
含义 |
| xhunter IDA functions |
361 |
当前工作 IDB 全函数 |
| x3 IDA functions |
12148 |
Stage5 最终 mapped IDB 全函数 |
| NMSSWCore IDA functions |
4 |
现有 protected disk IDB 全函数 |
| xhunter opcode handlers |
44 |
44-entry driver protocol |
| x3 relevant function subset |
192 |
entry 可达/相关函数深读集合 |
| VM handlers |
1647 |
全 selector 结构目录 |
| feature families |
1431 |
normalized structural family |
| live xhunter callbacks |
9 |
kernel dump + IDA 语义交叉 |
2. 证据等级与地址规则
| 等级 |
定义 |
本报告用法 |
| Confirmed |
当前文件字节、IDB、CDB、结构化输出直接证明 |
RVA、函数边界、表项、回调、哈希 |
| Inferred |
多面证据一致但仍缺原生执行闭环 |
组件角色、部分 VM state 字段 |
| Unknown |
当前材料未覆盖或存在版本/运行时缺口 |
.vdata 格式、外部 heap、全 selector 语义 |
长期标识全部使用 RVA。0x7FF95C5A0000、0x7FFE486B0000、0x7FFA6CC00000 等 VA 只绑定各自会话。
3. 当前工件身份
| 文件 |
大小 |
证据面 |
版本/边界 |
| x3_x64.xem |
6865552 |
disk PE |
2024.6.18.236 |
| x3_x64.xem.bin |
10391552 |
2026-08-21 mapped module |
base 0x7FFE486B0000 |
| NMSSWCore.nsm |
4322776 |
disk PE |
protected orchestration module |
| NMSSWCore.nsm.bin |
11698176 |
2026-08-21 mapped module |
base 0x7FFE3CB90000 |
| SevenDeadlySins_Origin-Win64-Shipping.exe.bin |
217829376 |
2026-08-21 mapped module |
base 0x7FF6F6600000 |
| xhunter1.sys |
194448 |
disk driver |
2023.12.7.78 |
| xhunter1.sys.bin |
196608 |
mapped driver snapshot |
historical capture |
| kernel.dmp |
5627596800 |
PAGEDU64 live kernel bitmap dump |
2026-08-21 20:27:14 +08:00 |
| xcorona_x64.xem |
7426904 |
disk PE |
mapped runtime snapshot absent |
| xmag_x64.xem |
9314304 |
non-PE container |
runtime private region absent |
| xnina_x64.xem |
2105344 |
non-PE container |
runtime private region absent |
历史 Stage1 基线为 18 files / 185,509,317 bytes。2026-08-21 新抓取覆盖了两个 mapped .bin，
并新增主程序 mapped image 与 kernel.dmp；因此旧报告中的“当前 18/18”只作为历史相位结论。
旧 x3 mapped snapshot 已从只读 IDB 完整恢复；精确身份记录保存在 manifest。
4. 系统架构与数据流
flowchart TD
GAME[SevenDeadlySins Origin] --> CORE[NMSSWCore.nsm]
CORE --> X3[x3_x64.xem]
X3 --> VL[.vlizer decode / fixups]
VL --> DISP[dispatcher RVA 0x8512AC]
DISP --> TABLE[1647-entry table RVA 0x86C332]
TABLE --> HANDLERS[stub -> landing -> terminal families]
X3 --> WRAP[xhunter request wrappers]
WRAP --> IRP[IRP_MJ_WRITE request/response]
IRP --> DRIVER[xhunter1.sys 44 handlers]
DRIVER --> KCB[process/image/Object callbacks]
HANDLERS --> API[resolver / CRT / low-I/O / FILE]
5. 工具与数据库
| 工具 |
版本/模式 |
实际用途 |
边界 |
| IDA Pro / IDALib |
9.4.260713 x64 |
PE/driver IDB、函数、xrefs、标注、完整目录 |
只读导出或副本写入；原始字节未 patch |
| Hex-Rays |
9.4.0.260713 |
关键 driver/x3 函数伪代码 |
混淆块以反汇编为准 |
| CDB/WinDbg |
10.0.29617.1000 |
PAGEDU64、EPROCESS/VAD、DriverObject、callback arrays |
kernel bitmap 缺用户页 |
| Unicorn |
2.1.4 |
bounded selector/context/API trace |
synthetic contracts 与原生等价分离 |
| Capstone |
module 5.0.7 / metadata 5.0.9 |
block/terminal/normalized instruction catalog |
静态解码 |
| pefile / stdlib PE parser |
2024.8.26 + self-contained parsers |
disk/mapped/relocation/import/section 比较 |
文件与会话绑定 |
| Volatility 3 |
Framework 2.28.0 |
尝试解析 kernel bitmap |
未构造 layer，结论不依赖它 |
6. Stage1–12 路线与验证
| 阶段 |
状态 |
验证 |
失败 |
主要结论 |
| Stage1 |
PASS |
18/18 |
0 |
18-file 基线、格式/签名/熵/import/export/string；185,509,317 bytes |
| Stage2 |
PASS |
21/21 |
0 |
DriverEntry/IRP/44 handlers/164 labels |
| Stage3 |
PASS |
27/27 |
0 |
correct mapped x3 IDB、14 wrappers |
| Stage4 |
PASS |
44/44 |
0 |
LZMA86、1651 fixups、9 opcode semantics |
| Stage5 |
PASS |
58/58 |
0 |
1647 table/stub/landing、context access |
| Stage6 |
PASS |
42/42 |
0 |
selector 0x1A2→0x465 delta |
| Stage7 |
PASS |
324/324 |
0 |
ABI-correct resolver/API shim/fastfail boundary |
| Stage8 |
PASS |
1629/1629 |
0 |
low-I/O、bounded L3、producer/static proof |
| Stage9 |
PASS |
756/756 |
0 |
__piob/FILE、1431 families、1647 structural IR |
| Stage10 |
PASS |
387/387 |
0 |
18-file offline closure and completion matrix |
| Stage11 |
PASS |
272/272 |
0 |
live target/xhunter/VAD/callbacks |
| Stage12 |
PASS |
189/189 |
0 |
three mapped dumps/cross-session stability |
7. xhunter1.sys 详细恢复
7.1 入口、IRP 与协议
DriverEntry RVA 0x24000
-> xh_driver_entry_impl 0xB31C
-> IRP_MJ_CREATE xh_irp_create 0xB138
-> IRP_MJ_CLOSE xh_irp_close 0xB0D0
-> IRP_MJ_WRITE xh_irp_write 0xB178
-> DriverUnload xh_driver_unload 0xB4F4
-> xh_init_dispatch_table 0x2A3C
xh_irp_write
-> xh_validate_write_request 0xB568
-> xh_dispatch_opcode 0x3764
-> xh_map_caller_buffer_write 0x81D0
-> copy 0x2FA bytes
-> xh_unmap_caller_buffer 0x7A74
| 字段 |
值/偏移 |
证据 |
| request size |
0x270 |
IRP write + validator |
| magic |
0x345821AB |
request+0x04 compare |
| nonce |
+0x08 |
response 写按位取反 |
| opcode |
+0x0C |
44-entry linear dispatch |
| response pointer |
+0x10 |
caller buffer mapping |
| response marker |
0x12121212 |
response+0x04 |
| response status |
+0x0C |
NTSTATUS |
| copy size |
0x2FA |
IRP response copy |
7.2 live kernel callback surface
Stage11 live driver base：0xFFFFF8009FEF0000；DriverObject：0xFFFF998632903560；DeviceObject：0xFFFF998621EB3320。
| 函数 |
RVA |
函数范围 |
语义 |
live registration |
| nullsub_1 |
0x1FF4 |
0x1FF4–0x1FF7 |
线程对象 post-operation 空函数 |
process/image notify 或 process/thread Object callback |
| sub_140004764 |
0x4764 |
0x4764–0x4777 |
仅在 ProcessId==0 时进入内核映像处理器 |
process/image notify 或 process/thread Object callback |
| sub_140004778 |
0x4778 |
0x4778–0x48C0 |
验证 PE 指针并比较 TimeDateStamp/CheckSum 表 |
process/image notify 或 process/thread Object callback |
| sub_140004EA0 |
0x4EA0 |
0x4EA0–0x4FCB |
进程句柄 post-operation 记录/状态更新 |
process/image notify 或 process/thread Object callback |
| sub_140004FCC |
0x4FCC |
0x4FCC–0x50D0 |
按 PID flags 条件化缩减进程句柄 DesiredAccess |
process/image notify 或 process/thread Object callback |
| sub_1400050D0 |
0x50D0 |
0x50D0–0x51B7 |
按 PID flags 条件化缩减线程句柄 DesiredAccess |
process/image notify 或 process/thread Object callback |
| sub_140006324 |
0x6324 |
0x6324–0x6417 |
从 PID flags 链移除退出进程 |
process/image notify 或 process/thread Object callback |
| sub_140007074 |
0x7074 |
0x7074–0x7198 |
进程创建分类并更新 PID flags |
process/image notify 或 process/thread Object callback |
| sub_1400072B4 |
0x72B4 |
0x72B4–0x72C8 |
create/exit 分流入口 |
process/image notify 或 process/thread Object callback |
8. x3_x64.xem 与 VM 恢复
8.1 loader、decode 与 redirect
DllEntryPoint 0x13748C
-> x3_vlizer_entry_bootstrap 0x591050
-> x3_lzma_range_decode 0x591199
-> relocate/redirect 0x591B3D
-> .vlizer runtime range 0x591000–0x9E9000
pristine/runtime 差异 6,715 bytes，其中 1,651 个严格 qword RVA-to-VA fixup。
VM table 位于 RVA 0x86C332，共 1,647 qword；dispatcher 基本块位于 RVA 0x8512AC。
8.2 VM 结构统计
| 项目 |
结果 |
| entries/stubs/landings |
1647 / 1647 / 1647，全唯一 |
| stub encoding |
全部 5-byte E9 |
| even/odd pairs |
823/823 为 +5 相邻；另 1 singleton |
| stub runs |
219；最大 86 项 |
| terminal distribution |
jbe1365 / je220 / ret31 / jmp-reg25 / jne5 / call-reg1 |
| block instructions |
6–455；median 82 |
| block bytes |
28–2550；median 434 |
| exact block hashes |
1642 unique；5 组二重复 |
| RBP affine accesses |
15,018 次，覆盖 1646 blocks |
| feature families |
1431 |
| tail/full structural signatures |
1602 |
8.3 selector/context 与 API/CRT
- selector
0x1A2：table 0x86D042 → stub 0x5B8E9D → landing 0x5F4BD5；下一 selector 0x465；
- selector
0x465：table 0x86E65A → stub 0x5F35BA → landing 0x76FF65；终止于 0x18A8D8 GetProcAddress call 前；
- 第一段 17,560 instructions，RSP -0x28，7/11 context fields 改变；
- 第二段 16,167 instructions，RSP -0xD8，8/11 fields 改变；
- ABI-correct shim trace 最终到
RVA 0x137CF7 INT29 code 7；从 RVA 0x19D256 起依赖显式 zero-page contract；
__piob producer 0x1920E8，FILE-like stride 0x58；low-I/O target stride 0x40，与本机 UCRT 26100 推导 0x48 冲突。
8.4 跨会话稳定性
- old base：
0x7FF95C5A0000；new base：0x7FFE486B0000；
- table 归一化为 RVA 后，两轮结果完全一致；
- handler first blocks：1647/1647 byte-exact；
- relocation/table/IAT canonicalization 后仅剩 1888 bytes / 11 pages；
__piob/low-I/O 新指针位于模块外，module dump 未包含 pointee。
9. NMSSWCore 与主程序映像
NMSSWCore 新 mapped base：0x7FFE3CB90000。.vdata RVA 0xB9000–0x75D000，
大小 6,963,200 bytes，RWX，非零 5,323,973 bytes，entropy 6.14522。
该区域 disk raw size 为 0；当前只完成 page/entropy/pointer 分层，未建立函数边界与格式语义。
主程序 mapped base：0x7FF6F6600000；.text 151,343,104 bytes 与磁盘映像 byte-exact。
主程序尚无全量 IDB，本文只列 PE exports，不宣称全函数恢复。
10. 主要函数与调用锚点
以下附录是函数权威索引。正文只保留查询最常用的 RVA、范围、名称、所属节和结构分类。
flags、chunks、first bytes、完整 context/stream profile 与哈希保存在 stage13/complete-report/catalogs/ 和 Stage9 CSV 中，
避免让主报告被低价值机器字段淹没。
10.1 xhunter 36 个关键函数
| label |
IDA name |
start RVA |
end RVA |
size |
callers |
callees |
作用 |
| driver_entry |
DriverEntry |
0x24000 |
0x2402C |
44 |
0 |
xh_driver_entry_impl; __security_init_cookie |
标准 DriverEntry 包装并进入主初始化 |
| driver_entry_impl |
xh_driver_entry_impl |
0xB31C |
0xB4F2 |
470 |
1 |
nullsub_1; xh_init_dispatch_table; sub_140004744; sub_140004754; sub_14000575C; sub_1400072C8; sub_1400073A4; sub_140007B78; sub_140007C74; sub_14000B694; sub_14000B6FC; sub_14000B83C; IoCreateDevice; IoCreateSymbolicLink; IoDeleteDevice |
安装 IRP create/close/write、unload 并初始化命令表/回调 |
| dispatch_create |
xh_irp_create |
0xB138 |
0xB175 |
61 |
0 |
sub_140007614; IofCompleteRequest |
IRP_MJ_CREATE |
| dispatch_close |
xh_irp_close |
0xB0D0 |
0xB135 |
101 |
0 |
sub_140006850; sub_140006AC4; sub_14000733C; PsGetCurrentProcessId; IofCompleteRequest; ZwUnloadDriver |
IRP_MJ_CLOSE |
| dispatch_write |
xh_irp_write |
0xB178 |
0xB31A |
418 |
0 |
xh_dispatch_opcode; xh_unmap_caller_buffer; xh_map_caller_buffer_write; xh_validate_write_request; __security_check_cookie; IofCompleteRequest |
IRP_MJ_WRITE：校验请求、分发 opcode、复制响应 |
| driver_unload |
xh_driver_unload |
0xB4F4 |
0xB568 |
116 |
0 |
nullsub_1; sub_140003AA0; sub_140004754; sub_1400072C8; sub_140009C24; sub_14000B6FC; sub_14000B820; IoDeleteDevice; IoDeleteSymbolicLink |
驱动卸载清理 |
| dispatch_write_owner |
xh_validate_write_request |
0xB568 |
0xB5C6 |
94 |
1 |
|
验证 0x270 请求与 magic 0x345821AB |
| dispatch_table_initializer |
xh_init_dispatch_table |
0x2A3C |
0x2E85 |
1097 |
1 |
sub_14000DC80 |
构建 44×0x10 运行时 handler 表 |
| dispatch_table_aux_initializer |
xh_dispatch_opcode |
0x3764 |
0x37AA |
70 |
1 |
|
按 request+0x0C 线性查找并间接调用 handler |
| cmd_set_pid_flags |
xh_cmd_775_set_pid_flags |
0x1DD8 |
0x1E14 |
60 |
0 |
xh_set_pid_flags_low16 |
opcode 775 wrapper |
| cmd_register_self |
xh_cmd_777_register_self |
0x3498 |
0x3508 |
112 |
0 |
sub_140006418; xh_register_pid_slot; sub_140006C50; PsGetCurrentProcessId |
opcode 777 wrapper |
| cmd_open_process |
xh_cmd_785_open_process |
0x30B8 |
0x313E |
134 |
0 |
xh_auth_gate_flags_80000008; xh_open_process_object_handle |
opcode 785 wrapper |
| cmd_read_process_memory |
xh_cmd_787_read_process_memory |
0x3278 |
0x3397 |
287 |
0 |
xh_auth_gate_flags_80000008; sub_140005F24; xh_reference_handle_fallback_access; xh_unmap_caller_buffer; xh_map_caller_buffer_write; xh_copy_from_process; IoGetCurrentProcess; ObfDereferenceObject |
opcode 787 wrapper |
| cmd_read_kernel_va |
xh_cmd_788_read_kernel_va |
0x31C4 |
0x3275 |
177 |
0 |
xh_auth_gate_flags_80000008; xh_unmap_caller_buffer; xh_map_caller_buffer_write; xh_copy_from_kernel_va |
opcode 788 wrapper |
| cmd_close_remote_handle |
xh_cmd_800_close_remote_handle |
0x1FF8 |
0x20D7 |
223 |
0 |
xh_set_handle_attributes_and_close; xh_reference_handle_fallback_access; __security_check_cookie; ObfDereferenceObject; KeStackAttachProcess; KeUnstackDetachProcess |
opcode 800 wrapper |
| cmd_init_thread_pointers |
xh_cmd_801_803_init_thread_pointers |
0x3658 |
0x3691 |
57 |
0 |
xh_resolve_win32k_thread_routines_thunk |
opcode 801/803 wrapper |
| cmd_inject_thread_legacy |
xh_cmd_815_inject_thread_legacy |
0x1E54 |
0x1E91 |
61 |
0 |
xh_inject_legacy_resolve_target |
opcode 815 wrapper |
| cmd_inject_rwx |
xh_cmd_820_inject_rwx |
0x1E94 |
0x1ED1 |
61 |
0 |
xh_inject_rwx_resolve_target |
opcode 820 wrapper |
| auth_gate |
xh_auth_gate_flags_80000008 |
0x5E84 |
0x5EA6 |
34 |
3 |
xh_lookup_pid_flags; PsGetCurrentProcessId |
要求当前 PID flags 满足 0x80000008 |
| auth_flags_lookup |
xh_lookup_pid_flags |
0x6204 |
0x625B |
87 |
18 |
ExAcquireFastMutex; ExReleaseFastMutex |
按 PID 查询 flags 链 |
| set_pid_flags_impl |
xh_set_pid_flags_low16 |
0x5F98 |
0x5FC6 |
46 |
7 |
xh_lookup_pid_flags |
保留高 16 位并替换低 16 位 |
| set_pid_flags_store |
xh_store_pid_flags |
0x5FC8 |
0x60F2 |
298 |
3 |
sub_14000CEE0; ExAcquireFastMutex; ExReleaseFastMutex |
新建或更新 PID flags 节点 |
| register_self_impl |
xh_register_pid_slot |
0x6A10 |
0x6AC1 |
177 |
1 |
ExAcquireFastMutex; ExReleaseFastMutex |
写入最多 100 项 PID slot |
| open_process_impl |
xh_open_process_object_handle |
0x87F4 |
0x8922 |
302 |
1 |
sub_14000C2EC; ObOpenObjectByPointer; ObfDereferenceObject; ProbeForRead; ProbeForWrite; PsLookupProcessThreadByCid |
通过 ObOpenObjectByPointer 获得进程对象句柄 |
| map_caller_buffer |
xh_map_caller_buffer_write |
0x81D0 |
0x81DE |
14 |
17 |
|
映射调用者写响应缓冲区 |
| unmap_caller_buffer |
xh_unmap_caller_buffer |
0x7A74 |
0x7AC0 |
76 |
21 |
MmUnlockPages; MmUnmapLockedPages; IoFreeMdl |
解除调用者缓冲区映射 |
| read_process_memory_impl |
xh_copy_from_process |
0x8924 |
0x8A0B |
231 |
1 |
__security_check_cookie; KeStackAttachProcess; KeUnstackDetachProcess |
附加目标进程并复制用户地址 |
| read_kernel_va_impl |
xh_copy_from_kernel_va |
0x84AC |
0x8522 |
118 |
2 |
MmIsAddressValid |
逐字节验证并读取内核虚拟地址 |
| close_remote_handle_impl |
xh_reference_handle_fallback_access |
0x7874 |
0x79B6 |
322 |
9 |
__security_check_cookie; ObReferenceObjectByHandle |
引用远程句柄；不是最终关闭函数 |
| set_handle_attributes_and_close |
xh_set_handle_attributes_and_close |
0x3A1C |
0x3A5E |
66 |
1 |
ZwClose; ObSetHandleAttributes |
设置句柄属性并 ZwClose |
| init_thread_pointers_impl |
xh_resolve_win32k_thread_routines |
0x9C5C |
0x9FCE |
882 |
1 |
sub_14000593C; sub_140005A1C; sub_140005BE4; sub_140007B6C; sub_140007FB0; sub_140008F38; sub_1400093D0; sub_140009680; sub_140009720; RtlInitUnicodeString; MmGetSystemRoutineAddress |
解析 win32k/线程相关例程 |
| inject_thread_legacy_impl |
xh_inject_legacy_resolve_target |
0xA028 |
0xA1AA |
386 |
2 |
xh_reference_handle_fallback_access; xh_inject_legacy_execute; sub_14000C300; sub_14000C6B4; ObfDereferenceObject; PsLookupProcessByProcessId; PsLookupThreadByThreadId; IoThreadToProcess; ObfReferenceObject |
legacy 路径目标解析 |
| inject_thread_target_impl |
xh_inject_legacy_execute |
0xA7A4 |
0xAB34 |
912 |
5 |
sub_1400077EC; sub_1400079B8; sub_140008A0C; sub_140008BC0; sub_140009208; sub_140009A70; sub_14000B828; __security_check_cookie; ZwClose; ObOpenObjectByPointer; ZwAllocateVirtualMemory; ZwFreeVirtualMemory; ZwWaitForSingleObject; ExFreePoolWithTag |
legacy 路径执行端 |
| inject_rwx_impl |
xh_inject_rwx_resolve_target |
0xA1AC |
0xA32E |
386 |
1 |
xh_reference_handle_fallback_access; xh_inject_rwx_execute; sub_14000C300; sub_14000C6B4; ObfDereferenceObject; PsLookupProcessByProcessId; PsLookupThreadByThreadId; IoThreadToProcess; ObfReferenceObject |
RWX 路径目标解析 |
| inject_rwx_target_impl |
xh_inject_rwx_execute |
0xA330 |
0xA6C5 |
917 |
5 |
sub_1400077EC; sub_1400079B8; sub_140008A0C; sub_140008AF0; sub_14000904C; sub_140009A70; sub_14000B828; __security_check_cookie; ZwClose; ObOpenObjectByPointer; ZwAllocateVirtualMemory; ZwFreeVirtualMemory; ZwWaitForSingleObject; ExFreePoolWithTag |
RWX 路径执行端 |
| init_thread_pointers_thunk |
xh_resolve_win32k_thread_routines_thunk |
0xB0C8 |
0xB0CD |
5 |
1 |
|
线程例程解析 thunk |
10.2 xhunter 44 个 opcode handler
| opcode |
table entry |
handler |
IDA name |
end |
size |
semantic |
x3 wrapper |
evidence |
| 774 |
0x21710 |
0x1F54 |
xh_cmd_774_unknown |
0x1F77 |
35 |
handshake_ack |
0x2F07C |
derived-cross-callsite |
| 775 |
0x21720 |
0x1DD8 |
xh_cmd_775_set_pid_flags |
0x1E14 |
60 |
set_pid_flags |
|
local IDA + pinned-source cross-check |
| 776 |
0x21730 |
0x3598 |
xh_cmd_776_unknown |
0x35D1 |
57 |
Unknown |
|
handler structure only |
| 777 |
0x21740 |
0x3498 |
xh_cmd_777_register_self |
0x3508 |
112 |
register_self |
|
local IDA + pinned-source cross-check |
| 778 |
0x21750 |
0x3708 |
xh_cmd_778_unknown |
0x3761 |
89 |
Unknown |
|
handler structure only |
| 779 |
0x21760 |
0x3398 |
xh_cmd_779_unknown |
0x3456 |
190 |
Unknown |
|
handler structure only |
| 790 |
0x21770 |
0x3508 |
xh_cmd_790_unknown |
0x3597 |
143 |
Unknown |
|
handler structure only |
| 782 |
0x21780 |
0x35D4 |
xh_cmd_782_unknown |
0x3619 |
69 |
Unknown |
|
handler structure only |
| 783 |
0x21790 |
0x26C8 |
xh_cmd_783_unknown |
0x2701 |
57 |
Unknown |
|
handler structure only |
| 785 |
0x217A0 |
0x30B8 |
xh_cmd_785_open_process |
0x313E |
134 |
open_process |
0x2FA00 |
local IDA + pinned-source cross-check |
| 786 |
0x217B0 |
0x22F8 |
xh_cmd_786_unknown |
0x2331 |
57 |
Unknown |
|
handler structure only |
| 787 |
0x217C0 |
0x3278 |
xh_cmd_787_read_process_memory |
0x3397 |
287 |
read_process_memory |
0x2FF5C |
local IDA + pinned-source cross-check |
| 788 |
0x217D0 |
0x31C4 |
xh_cmd_788_read_kernel_va |
0x3275 |
177 |
read_kernel_va |
0x30044 |
local IDA + pinned-source cross-check |
| 789 |
0x217E0 |
0x2180 |
xh_cmd_789_unknown |
0x21BD |
61 |
query_driver_module |
0x30114 |
confirmed-driver-pseudocode |
| 791 |
0x217F0 |
0x3018 |
xh_cmd_791_unknown |
0x30B7 |
159 |
Unknown |
|
handler structure only |
| 792 |
0x21800 |
0x27F0 |
xh_cmd_792_unknown |
0x2870 |
128 |
get_process_peb |
0x3035C |
confirmed-driver-pseudocode |
| 793 |
0x21810 |
0x2990 |
xh_cmd_793_unknown |
0x2A10 |
128 |
Unknown |
|
handler structure only |
| 794 |
0x21820 |
0x2730 |
xh_cmd_794_unknown |
0x27EF |
191 |
Unknown |
|
handler structure only |
| 796 |
0x21830 |
0x21FC |
xh_cmd_796_unknown |
0x22F8 |
252 |
file_checksum32 |
0x30408 |
confirmed-driver-pseudocode |
| 797 |
0x21840 |
0x2954 |
xh_cmd_797_unknown |
0x2990 |
60 |
get_pid_flags |
0x304D8 |
confirmed-driver-pseudocode |
| 798 |
0x21850 |
0x20D8 |
xh_cmd_798_unknown |
0x2180 |
168 |
Unknown |
|
handler structure only |
| 799 |
0x21860 |
0x2A10 |
xh_cmd_799_unknown |
0x2A3A |
42 |
query_capability_level |
0x2F1C8 |
confirmed-value-derived-domain |
| 800 |
0x21870 |
0x1FF8 |
xh_cmd_800_close_remote_handle |
0x20D7 |
223 |
close_remote_handle |
0x30590 |
local IDA + pinned-source cross-check |
| 801 |
0x21880 |
0x3658 |
xh_cmd_801_803_init_thread_pointers |
0x3691 |
57 |
init_thread_pointers |
0x3063C |
local IDA + pinned-source cross-check |
| 803 |
0x21890 |
0x3658 |
xh_cmd_801_803_init_thread_pointers |
0x3691 |
57 |
Unknown |
|
handler structure only |
| 804 |
0x218A0 |
0x3694 |
xh_cmd_804_unknown |
0x36D0 |
60 |
set_window_display_affinity |
0x2F110 |
confirmed-driver-pseudocode |
| 802 |
0x218B0 |
0x36D0 |
xh_cmd_802_unknown |
0x3705 |
53 |
Unknown |
|
handler structure only |
| 805 |
0x218C0 |
0x2870 |
xh_cmd_805_unknown |
0x2954 |
228 |
Unknown |
|
handler structure only |
| 806 |
0x218D0 |
0x2E88 |
xh_cmd_806_unknown |
0x2EAF |
39 |
query_zero_flag |
0x30764 |
confirmed-value-domain-unknown |
| 807 |
0x218E0 |
0x1E14 |
xh_cmd_807_unknown |
0x1E51 |
61 |
Unknown |
|
handler structure only |
| 808 |
0x218F0 |
0x1ED4 |
xh_cmd_808_unknown |
0x1F11 |
61 |
Unknown |
|
handler structure only |
| 811 |
0x21900 |
0x1F14 |
xh_cmd_811_unknown |
0x1F51 |
61 |
Unknown |
|
handler structure only |
| 820 |
0x21910 |
0x1E94 |
xh_cmd_820_inject_rwx |
0x1ED1 |
61 |
inject_rwx |
|
local IDA + pinned-source cross-check |
| 809 |
0x21920 |
0x2704 |
xh_cmd_809_unknown |
0x272E |
42 |
Unknown |
|
handler structure only |
| 810 |
0x21930 |
0x2F1C |
xh_cmd_810_unknown |
0x3018 |
252 |
create_file |
0x30834 |
confirmed-driver-pseudocode |
| 812 |
0x21940 |
0x21C0 |
xh_cmd_812_unknown |
0x21FA |
58 |
Unknown |
|
handler structure only |
| 813 |
0x21950 |
0x3458 |
xh_cmd_813_unknown |
0x3497 |
63 |
Unknown |
|
handler structure only |
| 814 |
0x21960 |
0x1F78 |
xh_cmd_814_unknown |
0x1FB2 |
58 |
Unknown |
|
handler structure only |
| 817 |
0x21970 |
0x1FB4 |
xh_cmd_817_unknown |
0x1FF1 |
61 |
Unknown |
|
handler structure only |
| 815 |
0x21980 |
0x1E54 |
xh_cmd_815_inject_thread_legacy |
0x1E91 |
61 |
inject_thread_legacy |
|
local IDA + pinned-source cross-check |
| 816 |
0x21990 |
0x2334 |
xh_cmd_816_unknown |
0x26C7 |
915 |
Unknown |
|
handler structure only |
| 818 |
0x219A0 |
0x3140 |
xh_cmd_818_unknown |
0x31C2 |
130 |
Unknown |
|
handler structure only |
| 819 |
0x219B0 |
0x2EB0 |
xh_cmd_819_unknown |
0x2F19 |
105 |
Unknown |
|
handler structure only |
| 821 |
0x219C0 |
0x361C |
xh_cmd_821_unknown |
0x3655 |
57 |
Unknown |
|
handler structure only |
10.3 x3 语义锚点函数
| RVA |
名称 |
作用 |
| 0x13748C |
DllEntryPoint |
模块入口；进入 CRT/保护初始化 |
| 0x591050 |
x3_vlizer_entry_bootstrap |
读取 .vlizer 描述、调用解码器并进入重定位/redirect |
| 0x591199 |
x3_lzma_range_decode |
LZMA86 range decoder |
| 0x591B3D |
x3_vlizer_relocate_and_redirect_return |
修复 qword RVA-to-VA 并建立 redirect |
| 0x2F020 |
x3_xhunter_request_initializer |
写 0x270/magic/nonce/opcode/response pointer |
| 0x8512AC |
x3_vm_indirect_dispatch |
jmp qword ptr [rax]；VM dispatch 基本块，不强称 ABI 函数 |
| 0x18A780 |
x3_dynamic_api_resolver |
三模块五槽 resolver/fallback/cache/cookie/guard |
| 0x18A8D8 |
x3_GetProcAddress_callsite |
IAT KERNEL32!GetProcAddress 调用点 |
| 0x137CD0 |
x3_fatal_app_exit |
PF_FASTFAIL_AVAILABLE 分支与 fatal-app-exit 终止语义 |
| 0x137CF7 |
x3_fastfail_int29 |
INT 29h，FAST_FAIL_FATAL_APP_EXIT code 7 |
| 0x1AD394 |
x3_lowio_block_initializer |
64×0x40 low-I/O block 初始化，+0x28=-1 |
| 0x1AD47C |
x3_lowio_table_publisher |
0x2000 上限并发布表/计数 |
| 0x19D220 |
x3_lowio_consumer |
索引公式、osfhnd/osfile sentinel 与 stdio 路径 |
| 0x19D31C |
x3_lowio_consumer_chain |
low-I/O 后续消费者链 |
| 0x1920E8 |
x3_piob_producer |
默认512/min3、calloc(count,8)、fallback3、前三 slots |
10.4 x3 14 个 driver wrapper
| opcode |
start |
end |
name |
semantic |
imports |
status |
| 774 |
0x2F07C |
0x2F110 |
x3_xh_cmd_774_handshake_ack |
handshake_ack |
WriteFile |
derived-cross-callsite |
| 785 |
0x2FA00 |
0x2FAEC |
x3_xh_cmd_785_open_process |
open_process |
CloseHandle;WriteFile |
cross-checked-local-driver |
| 787 |
0x2FF5C |
0x30044 |
x3_xh_cmd_787_read_process_memory |
read_process_memory |
WriteFile |
cross-checked-local-driver |
| 788 |
0x30044 |
0x30114 |
x3_xh_cmd_788_read_kernel_va |
read_kernel_va |
WriteFile |
cross-checked-local-driver |
| 789 |
0x30114 |
0x30359 |
x3_xh_cmd_789_query_driver_module |
query_driver_module |
WriteFile |
confirmed-driver-pseudocode |
| 792 |
0x3035C |
0x30408 |
x3_xh_cmd_792_get_process_peb |
get_process_peb |
WriteFile |
confirmed-driver-pseudocode |
| 796 |
0x30408 |
0x304D5 |
x3_xh_cmd_796_file_checksum32 |
file_checksum32 |
WriteFile |
confirmed-driver-pseudocode |
| 797 |
0x304D8 |
0x3058F |
x3_xh_cmd_797_get_pid_flags |
get_pid_flags |
WriteFile |
confirmed-driver-pseudocode |
| 799 |
0x2F1C8 |
0x2F25B |
x3_xh_cmd_799_query_capability_level |
query_capability_level |
WriteFile |
confirmed-value-derived-domain |
| 800 |
0x30590 |
0x3063C |
x3_xh_cmd_800_close_remote_handle |
close_remote_handle |
WriteFile |
cross-checked-local-driver |
| 801 |
0x3063C |
0x30763 |
x3_xh_cmd_801_init_thread_pointers |
init_thread_pointers |
GetLastError;IsGUIThread;SetLastError;WriteFile |
cross-checked-local-driver |
| 804 |
0x2F110 |
0x2F1C8 |
x3_xh_cmd_804_set_window_display_affinity |
set_window_display_affinity |
SetLastError;WriteFile |
confirmed-driver-pseudocode |
| 806 |
0x30764 |
0x30833 |
x3_xh_cmd_806_query_zero_flag |
query_zero_flag |
SetLastError;WriteFile |
confirmed-value-domain-unknown |
| 810 |
0x30834 |
0x30935 |
x3_xh_cmd_810_create_file |
create_file |
SetLastError;WriteFile |
confirmed-driver-pseudocode |
10.5 NMSSWCore 主要函数与 exports
| RVA |
size |
name |
segment |
说明 |
| 0x11240 |
25 |
Init |
____ |
现有 IDB 已定义函数 |
| 0x11380 |
36 |
GGSetHwndToGameMon |
____ |
现有 IDB 已定义函数 |
| 0x75D058 |
391 |
DllEntryPoint |
.boot |
现有 IDB 已定义函数 |
| 0x75D1DF |
77 |
sub_18075D1DF |
.boot |
现有 IDB 已定义函数 |
| ordinal |
RVA |
name |
| 1 |
0x11340 |
Close |
| 2 |
0x113D0 |
GGSCheck |
| 3 |
0x11380 |
GGSetHwndToGameMon |
| 4 |
0x11240 |
Init |
| 5 |
0x112A0 |
Run |
| 6 |
0xFC20 |
ScreenCapture |
| 7 |
0x112F0 |
SetInfo |
| 8 |
0x11590 |
XCProbeEx |
10.6 代表性 VM handler
正文仅保留六种 terminal family、一个 even/odd pair 和已观测 selector 链；完整 1,647 行见发布包。
| role |
selector |
entry |
stub |
landing |
terminal |
family |
| major:jbe |
0x34A |
0x86DD82 |
0x5B8E25 |
0x6FD818 |
jbe 0x6fd939 |
FF-FB59B262BAA7F0C7 |
| major:je |
0x2B |
0x86C48A |
0x5C039A |
0x5CBE75 |
je 0x5cbea7 |
FF-758B620FB3E04AE8 |
| major:jne |
0x5EB |
0x86F28A |
0x5BA9D8 |
0x7FDF68 |
jne 0x7fe00e |
FF-646450DFFEC5F6B2 |
| major:ret |
0x263 |
0x86D64A |
0x5C0020 |
0x662074 |
ret 0 |
FF-A9BD911B6839BB39 |
| major:jmp-reg |
0x620 |
0x86F432 |
0x5B79BF |
0x765307 |
jmp rdx |
FF-DA7306E50723B2B6 |
| major:call-reg |
0x38A |
0x86DF82 |
0x5B98A7 |
0x61AC17 |
call rax |
FF-EDFC41E1F44CA33E |
| pair:even |
0x224 |
0x86D452 |
0x5B9EED |
0x6887E7 |
je 0x688819 |
FF-758B620FB3E04AE8 |
| pair:odd |
0x225 |
0x86D45A |
0x5B9EF2 |
0x6992E7 |
je 0x699315 |
FF-758B620FB3E04AE8 |
| observed-chain:first |
0x1A2 |
0x86D042 |
0x5B8E9D |
0x5F4BD5 |
je 0x5f4c1e |
FF-1BBCE23240C7B401 |
| observed-chain:second |
0x465 |
0x86E65A |
0x5F35BA |
0x76FF65 |
jmp r12 |
FF-C1C431F384D71FC0 |
10.7 全量函数发布包索引
主报告不再内嵌全函数目录。下列 CSV 随发布包交付，可用 Excel、Python 或数据库直接筛选。
| 目录 |
发布包相对路径 |
行数 |
| xhunter all IDA functions |
catalogs/xhunter_all_functions.csv |
361 |
| x3 all Stage5 IDA functions |
catalogs/x3_all_functions.csv |
12148 |
| NMSSWCore all current IDA functions |
catalogs/nmsswcore_all_functions.csv |
4 |
| xhunter key functions |
catalogs/xhunter_key_functions_36.csv |
36 |
| xhunter opcode handlers |
catalogs/xhunter_opcode_handlers_44.csv |
44 |
| xhunter live callbacks |
catalogs/xhunter_live_callbacks_9.csv |
9 |
| x3 semantic anchors |
catalogs/x3_semantic_functions_15.csv |
15 |
| x3 driver wrappers |
catalogs/x3_driver_wrappers_14.csv |
14 |
| x3 relevant subset |
catalogs/x3_relevant_functions_192.csv |
192 |
| VM handlers |
catalogs/vm_handlers_1647.csv |
1647 |
| feature families |
catalogs/feature_families_1431.csv |
1431 |
| all PE exports |
catalogs/pe_exports_all.csv |
347 |
11. 内存取证与新 dump 结论
- kernel dump：PAGEDU64，采集端为 ARK NoOne；
- 活目标：EPROCESS
0xFFFF99864EAE8080，PID 0x10B40，main base 0x7FF7D2B20000；
- live x3/core bases：
0x7FFA6CC00000 / 0x7FFA6D5F0000；kernel bitmap 中用户页缺失；
- 新 mapped bases：main
0x7FF6F6600000、x3 0x7FFE486B0000、core 0x7FFE3CB90000；属于另一会话；
- 新三份
.bin 长度均等于 SizeOfImage，是 module image，不含完整 heap/stack/private allocations。
12. 当前已证实、推断与开放项
| 状态 |
事项 |
当前结论 |
| Confirmed |
driver protocol |
44 handlers、request/response、关键 helper、live callbacks |
| Confirmed |
x3 mapped identity |
disk/mapped/IDB 三面绑定，decode/fixup/table/dispatcher |
| Confirmed |
handler stability |
1647 table RVA + 1647 first blocks 跨会话一致 |
| Confirmed |
bounded state |
selector 0x1A2→0x465、context/stack/API boundary |
| Confirmed |
CRT state |
low-I/O/__piob/FILE producers and bounded alternatives |
| Confirmed |
NMSSWCore runtime population |
RWX .vdata 5,323,973 nonzero bytes |
| Unknown |
full VM state |
缺通用 VPC/register/flags/memory/exception/next-selector |
| Unknown |
NMSSWCore .vdata semantics |
未恢复 entry、record format、interpreter/decoded blocks |
| Unknown |
external heap/stack |
module dumps 未含 pointee、RSP/RBP 和 private pages |
| Unknown |
main full function graph |
仅完成 module integrity 与 exports，未建立全量 IDB |
| Not achieved |
full devirtualization |
结构全覆盖不等于 1647 通用 opcode 语义 |
| Not achieved |
native/source equivalence |
尚无多输入 differential equivalence |
13. 下一阶段最小输入与验收
P0 输入是 SevenDeadlySins_Origin-Win64-Shipping.exe 的 -ma full process dump，需包含 image/mapped/private/thread/handle/address-space 信息。
条件式补抓：xcorona_x64.xem 映像，以及 xmag/xnina 实际出现的 private/mapped region。普通图形、音频、DLSS DLL 不进入当前 VM 主线。
下一阶段验收：
- dispatcher 连续返回 next dispatch；
- 恢复 selector/VPC、VM register/stack/flags；
- handler family 提升为可执行 IR；
- 建立 selector CFG、loop 和 native-call summaries；
- 原 handler 与 IR 在多输入下比较 next selector、context、stack、flags、memory writes 与 exit reason。
14. 证据索引
| 来源（相对项目根） |
内容 |
| XC3_STATIC_ANALYSIS_REPORT.md |
综合报告 |
| XC3_STAGE2_IDA_REPORT.md |
阶段报告 |
| XC3_STAGE3_X3_REPORT.md |
阶段报告 |
| XC3_STAGE4_VLIZER_PROTOCOL_REPORT.md |
阶段报告 |
| XC3_STAGE5_VM_STRUCTURE_REPORT.md |
阶段报告 |
| XC3_STAGE7_API_SHIM_VM_STATE_REPORT.md |
阶段报告 |
| XC3_STAGE8_LOWIO_L3_REPORT.md |
阶段报告 |
| XC3_STAGE9_PIOB_HANDLER_FAMILY_REPORT.md |
阶段报告 |
| XC3_FINAL_OFFLINE_ANALYSIS_REPORT.md |
综合报告 |
| XC3_PROFESSIONAL_RETROSPECTIVE_REPORT.md |
综合报告 |
| stage11/kernel-dump-analysis/XC3_KERNEL_DUMP_ANALYSIS.md |
内存/新 dump 分析 |
| stage12/new-user-dumps/XC3_STAGE12_NEW_DUMPS_REPORT.md |
阶段报告 |
发表于 2026-8-21 17:07
发表于 2026-8-21 20:47
|
发表于 2026-8-21 04:20
|楼主
分享到朋友圈
，我有时候觉得。