pspcidtable 学习

56 阅读 0 评论 37 点赞

我是靠谱客的博主虚幻煎饼，最近开发中收集的这篇文章主要介绍pspcidtable 学习，觉得挺不错的，现在分享给大家，希望可以做个参考。

概述

PspCidTable is an undocmented variable in Windows kernel... it contains HANDLE_TABLE...

if get address of PspCidTable , i find the follow methods to get it in net... thx for sudami 's article...

1. 通过暴力搜索特征值的办法得到 PspCidTable的地址。。

要搜索的函数有：

PsLookupProcessThreadByCid()
PsLookupProcessByProcessId()
PsLookupThreadByThreadId()

从wrk上看到的 PsLookupProcessByProcessId() 的原码：

Code
1
2 NTSTATUS
3 PsLookupProcessByProcessId(
4     __in HANDLE ProcessId,
5     __deref_out PEPROCESS *Process
6     )
7 {
8
9     PHANDLE_TABLE_ENTRY CidEntry;
10     PEPROCESS lProcess;
11     PETHREAD CurrentThread;
12     NTSTATUS Status;
13
14     PAGED_CODE();
15
16     Status = STATUS_INVALID_PARAMETER;
17
18     CurrentThread = PsGetCurrentThread ();
19     KeEnterCriticalRegionThread (&CurrentThread->Tcb);
20
21     CidEntry = ExMapHandleToPointer(PspCidTable, ProcessId);
22     if (CidEntry != NULL) {
23         lProcess = (PEPROCESS)CidEntry->Object;
24         if (lProcess->Pcb.Header.Type == ProcessObject &&
25             lProcess->GrantedAccess != 0) {
26             if (ObReferenceObjectSafe(lProcess)) {
27                *Process = lProcess;
28                 Status = STATUS_SUCCESS;
29             }
30         }
31
32         ExUnlockHandleTableEntry(PspCidTable, CidEntry);
33     }
34
35     KeLeaveCriticalRegionThread (&CurrentThread->Tcb);
36     return Status;
37 }

里面有这样的一段：

.........

20 KeEnterCriticalRegionThread (&CurrentThread->Tcb);

21 CidEntry = ExMapHandleToPointer(PspCidTable, ProcessId);

.........

这样找到这个函数的汇编代码，然后穷搜这一句就可以了。。。

通过windbg看到的反汇编代码：

kd> u nt! PsLookupProcessByProcessId+0x12
nt!PsLookupProcessByProcessId+0x12:
80572960 ff8ed4000000            dec     dword ptr [esi+0D4h]
80572966 ff3560245680            push    dword ptr [nt!PspCidTable (80562460)]
8057296c e8dc50ffff                  call    nt!ExMapHandleToPointer (80567a4d)
80572971 8bd8                         mov     ebx,eax
80572973 85db                         test    ebx,ebx
80572975 c745080d0000c0        mov     dword ptr [ebp+8],0C000000Dh
8057297c 7432                         je      nt!PsLookupProcessByProcessId+0x62 (805729b0)
8057297e 57                           push    edi

便找到PspCidTable的地址了。。。

代码实现如下：

Code
/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
**
**  author           :   Herso
**
**  date             :   2009/04/06
**
**  parameter        :   NULL
**
**  usage            :   to get the address of PspCidTable
**
**  history          :
**
--------------------------------------------------------------------------------------------------------------------*/
ULONG  get_pspcidtable_address( )
{
UNICODE_STRING   psLookup;
PUCHAR           address_psLookup    = NULL;
PUCHAR           p                   = NULL;

ULONG            address_cidtable    = 0x0;

::RtlInitUnicodeString( &psLookup, L"PsLookupProcessByProcessId" );
address_psLookup =( PUCHAR )MmGetSystemRoutineAddress( &psLookup );

for( p = address_psLookup; p < address_psLookup + PAGE_SIZE; p++ )
{
  //ExMapHandleToPointer(PspCidTable, ProcessId)
  if( (*(PUSHORT)p) == 0x35ff && (*(p+6)) == 0xe8 )
  {
      address_cidtable = (*(PULONG32)(p+2));
      break;
  }
}

return   address_cidtable;
}