LoadDriver SSDT Hook - نسخة قابلة للطباعة

كود :

PWCHAR *GetSsdtStrings(VOID)
{
	LOADED_IMAGE LoadedImage;
	PVOID PtrImage;
	PWCHAR *Result;
	PUSHORT Ordinals;
	PULONG ExportRva;
	PCHAR FunctionString, *StringRva;
	ULONG ServiceId, FunctionId;

	MapAndLoad("ntdll.dll", NULL, &LoadedImage, FALSE, TRUE);
	PtrImage = calloc(LoadedImage.FileHeader->OptionalHeader.SizeOfImage, sizeof(UCHAR));
	CopyMemory((PUCHAR)PtrImage, LoadedImage.MappedAddress, LoadedImage.FileHeader->OptionalHeader.SizeOfHeaders);
	for (WORD Index = 0; Index < LoadedImage.FileHeader->FileHeader.NumberOfSections; Index++)
	{
		CopyMemory((PUCHAR)PtrImage + LoadedImage.Sections[Index].VirtualAddress,
				   LoadedImage.MappedAddress + LoadedImage.Sections[Index].PointerToRawData,
				   LoadedImage.Sections[Index].SizeOfRawData
				   );
	}
	UnMapAndLoad(&LoadedImage);
	LoadedImage.FileHeader = (PIMAGE_NT_HEADERS)((ULONG_PTR)PtrImage + ((PIMAGE_DOS_HEADER)PtrImage)->e_lfanew);
	
	PIMAGE_EXPORT_DIRECTORY ExportDirectory = (PIMAGE_EXPORT_DIRECTORY)(LoadedImage.FileHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress + (ULONG_PTR)PtrImage);
	StringRva = (PCHAR *)(ExportDirectory->AddressOfNames + (ULONG_PTR)PtrImage);
	Ordinals = (PUSHORT)(ExportDirectory->AddressOfNameOrdinals + (ULONG_PTR)PtrImage);
	ExportRva = (PULONG)(ExportDirectory->AddressOfFunctions + (ULONG_PTR)PtrImage);

	Result = (PWCHAR *)calloc(KiSsdtLimit, sizeof(PWCHAR));
	for (ULONG Index = 0; Index < KiSsdtLimit; Index++) 
	{
		Result[Index] = L"Unknown Entry";
	}

	for (ULONG Index = 0; Index < ExportDirectory->NumberOfNames; Index++)
	{
		FunctionId = ExportRva[Ordinals[Index]] + (ULONG_PTR)PtrImage;
		FunctionString = StringRva[Index] + (ULONG_PTR)PtrImage;
		if (*(PUCHAR)FunctionId == 0xb8 && 
			*(PUCHAR)(FunctionId + 5)  == 0xba &&
			*(PUCHAR)(FunctionId + 10) == 0xff &&
			(*(PUCHAR)(FunctionId + 12) & 0xc0) == 0xc0)
		{
			if (FunctionString[0] == 'N' && FunctionString[1] == 't')
			{
				ServiceId = *(PULONG)(FunctionId + 1);
				if (ServiceId < KiSsdtLimit)
				{
					Result[ServiceId] = (PWCHAR)calloc(256, sizeof(WCHAR));
					_snwprintf_s(Result[ServiceId], 256, _TRUNCATE, L"%S", FunctionString);
				}
			}
		}
	}
	free(PtrImage);
	return Result;
}

كود :

type
  TDWordArray = array [0..$FFFFF] of DWORD;
var
  imageinfo: LoadedImage;
  pExportDirectory: PImageExportDirectory;
  dirsize: Cardinal;
  pDummy: PImageSectionHeader;
  i: Cardinal;
  pNameRVAs: ^TDWordArray;
  Name: string;
  _index: Word;
begin
  ListFdLL.Clear; _index:= 0;
  if MapAndLoad(PChar('ntdll.dll'), nil, @imageinfo, True, True) then
  begin
    try
      pExportDirectory := ImageDirectoryEntryToData(imageinfo.MappedAddress,
        False, IMAGE_DIRECTORY_ENTRY_EXPORT, dirsize);
      if (pExportDirectory <> nil) then
      begin
        pNameRVAs := ImageRvaToVa(imageinfo.FileHeader, imageinfo.MappedAddress,
          DWORD(pExportDirectory^.AddressOfNames), pDummy);
        for i := 0 to pExportDirectory^.NumberOfNames - 1 do
        begin
          Name := PChar(ImageRvaToVa(imageinfo.FileHeader, imageinfo.MappedAddress,
            pNameRVAs^[i], pDummy));
          If Pos('Nt',Name)=1 Then
           Begin
            ListFdLL.Items.Add;
            ListFdLL.Items.Item[_index].Caption:= IntToStr(_index);
            ListFdLL.Items.Item[_index].SubItems.Add(Name);
            ListFdLL.Items.Item[_index].SubItems.Add('');
            ListFdLL.Items.Item[_index].SubItems.Add('');
            ListFdLL.Items.Item[_index].SubItems.Add('-');
            ListFdLL.Items.Item[_index].SubItems.Add('%SystemDirectory%\ntkrnlpa.exe');
            Inc(_index);
           End;
        end;
      end;
    finally
      UnMapAndLoad(@imageinfo);
      Label2.Caption:= IntToStr(ListFdLL.Items.Count -1 );
      ListFdLL.Items.Add;
    end;
  end;
End;

PHP كود :

KiSystem
Service() knows that it is handling a win32k.sys API call by examining bits #12
and 13 of the function index in register EAX. If both bits are zero, it is a Native API
call handled by ntoskrnl.exe, so KiSystemService() uses the first SDT slot. If bit
#12 is set and bit #13 is zero, KiSystemService() uses the second slot.