WIN7 X64 SSDT函数获得

wowocock · 发表于 2010-4-17 00:33

曾经在网上看到一片文章，

在早期64位系统，内核函数开头地址的低四位一般是0，形如:xxxxxxxx`xxxxxxx0，这一特征在SSDT表中有很强大的引用，SSDT表在64位系统于32位系统有较大的差别。以下是在64位系统下的KeServiceDescriptorTable：

kd> dp KeServiceDescriptorTable
fffff800`0117bb80  fffff800`01076e00 00000000`00000000
fffff800`0117bb90  00000000`00000128 00000000`00000000

表的第二项于第四项都为0，这两项在32位系统下分别对应ServiceCounterTableBase与ParamTableBase。SSDT表还是同32位系统每4字节表示一项，由于函数的起始地址最低四位都是0，所以微软将SSDT中的低四位用来记录这个函数有多少个参数。并且由于表的每一项都为四个字节，保存的就不可能是绝对地址，而是相对KeServiceDescriptorTable表的地址。所以地址计算方法如下：

FuncAddr=([KeServiceDescriptortable+index*4]+KeServiceDescriptortable)&0xFFFFFFF0

用公式，尝试了一下，果然找到了正确的地址。

不过到了WIN7 X64下又有所改变。

nt!KiSystemServiceStart+0x7:
fffff800`03cc7fe5 8bf8            mov     edi,eax ; copy system service number
kd> p
nt!KiSystemServiceStart+0x9:
fffff800`03cc7fe7 c1ef07          shr     edi,7   ; isolate service table number(SERVICE_TABLE_SHIFT) 
kd> p
nt!KiSystemServiceStart+0xc:
fffff800`03cc7fea 83e720          and     edi,20h ;(SERVICE_TABLE_MASK)
kd> p
nt!KiSystemServiceStart+0xf:
fffff800`03cc7fed 25ff0f0000      and     eax,0FFFh ;(SERVICE_NUMBER_MASK )isolate service table offset 0fffh
kd> r
rax=0000000000000138 rbx=fffffa800edc0100 rcx=0000000000000084
rdx=0000000000000000 rsi=00000000002a8490 rdi=0000000000000000
rip=fffff80003cc7fed rsp=fffff8800245dc20 rbp=fffff8800245dca0
 r8=0000000000000001  r9=0000000000000001 r10=0000000000000084
r11=0000000000000206 r12=00000000772c4420 r13=0000000000000000
r14=00000000772c4400 r15=00000000772c4498
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00000246
nt!KiSystemServiceStart+0xf:
fffff800`03cc7fed 25ff0f0000      and     eax,0FFFh
kd> p
nt!KiSystemServiceRepeat:
fffff800`03cc7ff2 4c8d1547782300  lea     r10,[nt!KeServiceDescriptorTable (fffff800`03eff840)]
kd> r
rax=0000000000000138 rbx=fffffa800edc0100 rcx=0000000000000084
rdx=0000000000000000 rsi=00000000002a8490 rdi=0000000000000000
rip=fffff80003cc7ff2 rsp=fffff8800245dc20 rbp=fffff8800245dca0
 r8=0000000000000001  r9=0000000000000001 r10=0000000000000084
r11=0000000000000206 r12=00000000772c4420 r13=0000000000000000
r14=00000000772c4400 r15=00000000772c4498
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00000202
nt!KiSystemServiceRepeat:
fffff800`03cc7ff2 4c8d1547782300  lea     r10,[nt!KeServiceDescriptorTable (fffff800`03eff840)]
kd> p
nt!KiSystemServiceRepeat+0x7:
fffff800`03cc7ff9 4c8d1d80782300  lea     r11,[nt!KeServiceDescriptorTableShadow (fffff800`03eff880)]
kd> p
nt!KiSystemServiceRepeat+0xe:
fffff800`03cc8000 f7830001000080000000 test dword ptr [rbx+100h],80h
kd> r
rax=0000000000000138 rbx=fffffa800edc0100 rcx=0000000000000084
rdx=0000000000000000 rsi=00000000002a8490 rdi=0000000000000000
rip=fffff80003cc8000 rsp=fffff8800245dc20 rbp=fffff8800245dca0
 r8=0000000000000001  r9=0000000000000001 r10=fffff80003eff840
r11=fffff80003eff880 r12=00000000772c4420 r13=0000000000000000
r14=00000000772c4400 r15=00000000772c4498
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00000202
nt!KiSystemServiceRepeat+0xe:
fffff800`03cc8000 f7830001000080000000 test dword ptr [rbx+100h],80h ds:002b:fffffa80`0edc0200=00000060
kd> db fffff800`03eff840
fffff800`03eff840  00 9b cc 03 00 f8 ff ff-00 00 00 00 00 00 00 00  ................
fffff800`03eff850  91 01 00 00 00 00 00 00-8c a7 cc 03 00 f8 ff ff  ................
fffff800`03eff860  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
fffff800`03eff870  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
fffff800`03eff880  00 9b cc 03 00 f8 ff ff-00 00 00 00 00 00 00 00  ................
fffff800`03eff890  91 01 00 00 00 00 00 00-8c a7 cc 03 00 f8 ff ff  ................
fffff800`03eff8a0  00 1c 0e 00 60 f9 ff ff-00 00 00 00 00 00 00 00  ....`...........
fffff800`03eff8b0  3b 03 00 00 00 00 00 00-1c 39 0e 00 60 f9 ff ff  ;........9..`...
kd> p
nt!KiSystemServiceRepeat+0x18:
fffff800`03cc800a 4d0f45d3        cmovne  r10,r11
kd> p
nt!KiSystemServiceRepeat+0x1c:
fffff800`03cc800e 423b441710      cmp     eax,dword ptr [rdi+r10+10h] ;check if valid service
kd> r
rax=0000000000000138 rbx=fffffa800edc0100 rcx=0000000000000084
rdx=0000000000000000 rsi=00000000002a8490 rdi=0000000000000000
rip=fffff80003cc800e rsp=fffff8800245dc20 rbp=fffff8800245dca0
 r8=0000000000000001  r9=0000000000000001 r10=fffff80003eff840
r11=fffff80003eff880 r12=00000000772c4420 r13=0000000000000000
r14=00000000772c4400 r15=00000000772c4498
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00000246
nt!KiSystemServiceRepeat+0x1c:
fffff800`03cc800e 423b441710      cmp     eax,dword ptr [rdi+r10+10h] ds:002b:fffff800`03eff850=00000191
kd> p
nt!KiSystemServiceRepeat+0x21:
fffff800`03cc8013 0f83e9020000    jae     nt!KiSystemServiceExit+0x1a7 (fffff800`03cc8302)
kd> p
nt!KiSystemServiceRepeat+0x27:
fffff800`03cc8019 4e8b1417        mov     r10,qword ptr [rdi+r10] ;table base
kd> p
nt!KiSystemServiceRepeat+0x2b:
fffff800`03cc801d 4d631c82        movsxd  r11,dword ptr [r10+rax*4] ; get system service offset
kd> r
rax=0000000000000138 rbx=fffffa800edc0100 rcx=0000000000000084
rdx=0000000000000000 rsi=00000000002a8490 rdi=0000000000000000
rip=fffff80003cc801d rsp=fffff8800245dc20 rbp=fffff8800245dca0
 r8=0000000000000001  r9=0000000000000001 r10=fffff80003cc9b00
r11=fffff80003eff880 r12=00000000772c4420 r13=0000000000000000
r14=00000000772c4400 r15=00000000772c4498
iopl=0         nv up ei ng nz na pe cy
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00000283
nt!KiSystemServiceRepeat+0x2b:
fffff800`03cc801d 4d631c82        movsxd  r11,dword ptr [r10+rax*4] ds:002b:fffff800`03cc9fe0=000f3080
kd> p
nt!KiSystemServiceRepeat+0x2f:
fffff800`03cc8021 498bc3          mov     rax,r11 ; system service offset
kd> r
rax=0000000000000138 rbx=fffffa800edc0100 rcx=0000000000000084
rdx=0000000000000000 rsi=00000000002a8490 rdi=0000000000000000
rip=fffff80003cc8021 rsp=fffff8800245dc20 rbp=fffff8800245dca0
 r8=0000000000000001  r9=0000000000000001 r10=fffff80003cc9b00
r11=00000000000f3080 r12=00000000772c4420 r13=0000000000000000
r14=00000000772c4400 r15=00000000772c4498
iopl=0         nv up ei ng nz na pe cy
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00000283
nt!KiSystemServiceRepeat+0x2f:
fffff800`03cc8021 498bc3          mov     rax,r11
kd> p
nt!KiSystemServiceRepeat+0x32:
fffff800`03cc8024 49c1fb04        sar     r11,4 ;关键所在 ，还得再右移4位 
kd> p
nt!KiSystemServiceRepeat+0x36:
fffff800`03cc8028 4d03d3          add     r10,r11 ；; add table base to 获得真正的函数地址
kd> r
rax=00000000000f3080 rbx=fffffa800edc0100 rcx=0000000000000084
rdx=0000000000000000 rsi=00000000002a8490 rdi=0000000000000000
rip=fffff80003cc8028 rsp=fffff8800245dc20 rbp=fffff8800245dca0
 r8=0000000000000001  r9=0000000000000001 r10=fffff80003cc9b00
r11=000000000000f308 r12=00000000772c4420 r13=0000000000000000
r14=00000000772c4400 r15=00000000772c4498
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00000202
nt!KiSystemServiceRepeat+0x36:
fffff800`03cc8028 4d03d3          add     r10,r11
kd> p
nt!KiSystemServiceRepeat+0x39:
fffff800`03cc802b 83ff20          cmp     edi,20h
kd> r
rax=00000000000f3080 rbx=fffffa800edc0100 rcx=0000000000000084
rdx=0000000000000000 rsi=00000000002a8490 rdi=0000000000000000
rip=fffff80003cc802b rsp=fffff8800245dc20 rbp=fffff8800245dca0
 r8=0000000000000001  r9=0000000000000001 r10=fffff80003cd8e08
r11=000000000000f308 r12=00000000772c4420 r13=0000000000000000
r14=00000000772c4400 r15=00000000772c4498
iopl=0         nv up ei ng nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00000282
nt!KiSystemServiceRepeat+0x39:
fffff800`03cc802b 83ff20          cmp     edi,20h
kd> u fffff80003cd8e08
nt!NtReleaseWorkerFactoryWorker:
fffff800`03cd8e08 4c8bdc          mov     r11,rsp
fffff800`03cd8e0b 49895b08        mov     qword ptr [r11+8],rbx
fffff800`03cd8e0f 49896b18        mov     qword ptr [r11+18h],rbp
fffff800`03cd8e13 49897320        mov     qword ptr [r11+20h],rsi
fffff800`03cd8e17 57              push    rdi
fffff800`03cd8e18 4154            push    r12
fffff800`03cd8e1a 4155            push    r13
fffff800`03cd8e1c 4883ec60        sub     rsp,60h
kd> p
nt!KiSystemServiceRepeat+0x3c:
fffff800`03cc802e 7550            jne     nt!KiSystemServiceGdiTebAccess+0x49 (fffff800`03cc8080)
kd> p
nt!KiSystemServiceGdiTebAccess+0x49:
fffff800`03cc8080 83e00f          and     eax,0Fh
kd> p
nt!KiSystemServiceGdiTebAccess+0x4c:
fffff800`03cc8083 0f84b7000000    je      nt!KiSystemServiceCopyEnd (fffff800`03cc8140)
kd> p
nt!KiSystemServiceCopyEnd:
fffff800`03cc8140 f705fee4180040000000 test dword ptr [nt!PerfGlobalGroupMask+0x8 (fffff800`03e56648)],40h
kd> p
nt!KiSystemServiceCopyEnd+0xa:
fffff800`03cc814a 0f8550020000    jne     nt!KiSystemServiceExit+0x245 (fffff800`03cc83a0)
kd> p
nt!KiSystemServiceCopyEnd+0x10:
fffff800`03cc8150 41ffd2          call    r10 ; ; call system service

所以WIN7 X64下应该是:

FuncAddr=([KeServiceDescriptortable+index*4] >>4 +KeServiceDescriptortable)&0xFFFFFFF0.

而且和以前不同的是原来是从ETHREAD里取TABLE 地址，但现在通过 lea r10,[nt!KeServiceDescriptorTable (fffff800`03eff840)]
，扑灭了ROOTKITER们的最后一线HOOK 希望。

MJ0011 · 发表于 2010-4-17 00:40

找ssdt在x64下不太简单了，不过方法还是挺多了，例如利用msr里的c0000082 EIP来定位等。

另外rootkiter想HOOK还是有很多办法的了

Hmily · 发表于 2010-4-17 00:44

大肉鸡你的发帖质量怎么这么差...帮你编辑下下次自己编辑...

淡淡香草味 · 发表于 2010-4-17 00:46

看人来的

zzage · 发表于 2010-4-17 00:49

[s:352]~~~向肉肉学习！

hixiaosheng · 发表于 2010-4-17 12:01

顶肉肉···

UserName · 发表于 2010-7-31 00:21

x64都出来了，牛B。

novirus · 发表于 2011-2-14 20:19

没看懂

linyiwei · 发表于 2011-4-5 12:19

勋爵 · 发表于 2011-4-12 22:19

好深奥....

帐号		自动登录	找回密码
密码			注册[Register]

[调试逆向] WIN7 X64 SSDT函数获得

个人中心