驱动开发:内核枚举ShadowSSDT基址

在笔者上一篇文章《驱动开发:Win10枚举完整SSDT地址表》实现了针对SSDT表的枚举功能,本章继续实现对SSSDT表的枚举,ShadowSSDT中文名影子系统服务描述表,SSSDT其主要的作用是管理系统中的图形化界面,其Win32子系统的内核实现是Win32k.sys驱动,属于GUI线程的一部分,其自身没有导出表,枚举SSSDT表其与SSDT原理基本一致。

如下是闭源ARK工具的枚举效果:

驱动开发:内核枚举ShadowSSDT基址插图

首先需要找到SSSDT表的位置,通过《驱动开发:Win10内核枚举SSDT表基址》文章中的分析可知,SSSDT就在SSDT的下面,只需要枚举4c8d1dde1e3a00特征即可,如果你找不到上一篇具体分析流程了,那么多半你是看到了转载文章。

驱动开发:内核枚举ShadowSSDT基址插图1

先实现第一个功能,得到SSSDT表的基地址以及SSDT函数个数,完整代码如下所示。

// 署名权
// right to sign one's name on a piece of work
// PowerBy: LyShark
// Email: me@lyshark.com

#include 
#pragma intrinsic(__readmsr)

typedef struct _SYSTEM_SERVICE_TABLE
{
    PVOID          ServiceTableBase;
    PVOID          ServiceCounterTableBase;
    ULONGLONG      NumberOfServices;
    PVOID          ParamTableBase;
} SYSTEM_SERVICE_TABLE, *PSYSTEM_SERVICE_TABLE;

PSYSTEM_SERVICE_TABLE KeServiceDescriptorTableShadow = 0;
ULONG64 ul64W32pServiceTable = 0;

// 获取 KeServiceDescriptorTableShadow 首地址
ULONGLONG GetKeServiceDescriptorTableShadow()
{
    // 设置起始位置
    PUCHAR StartSearchAddress = (PUCHAR)__readmsr(0xC0000082) - 0x1808FE;

    // 设置结束位置
    PUCHAR EndSearchAddress = StartSearchAddress + 0x8192;
    // DbgPrint("扫描起始地址: %p --> 扫描结束地址: %p n", StartSearchAddress, EndSearchAddress);

    PUCHAR ByteCode = NULL;

    UCHAR OpCodeA = 0, OpCodeB = 0, OpCodeC = 0;
    ULONGLONG addr = 0;
    ULONG templong = 0;

    for (ByteCode = StartSearchAddress; ByteCode  u KiSystemServiceRepeat
                nt!KiSystemServiceRepeat:
                fffff8027c1d2b94 4c8d15e59c3b00  lea     r10,[nt!KeServiceDescriptorTable (fffff8027c58c880)]
                fffff8027c1d2b9b 4c8d1dde1e3a00  lea     r11,[nt!KeServiceDescriptorTableShadow (fffff8027c574a80)]
                fffff802`7c1d2ba2 f7437880000000  test    dword ptr [rbx+78h],80h
                fffff8027c1d2ba9 7413            je      nt!KiSystemServiceRepeat+0x2a (fffff8027c1d2bbe)
                fffff802`7c1d2bab f7437800002000  test    dword ptr [rbx+78h],200000h
                fffff8027c1d2bb2 7407            je      nt!KiSystemServiceRepeat+0x27 (fffff8027c1d2bbb)
                fffff8027c1d2bb4 4c8d1d051f3a00  lea     r11,[nt!KeServiceDescriptorTableFilter (fffff8027c574ac0)]
                fffff802`7c1d2bbb 4d8bd3          mov     r10,r11
            */
            if (OpCodeA == 0x4c && OpCodeB == 0x8d && OpCodeC == 0x1d)
            {
                // 获取高位地址fffff802
                memcpy(&templong, ByteCode + 3, 4);

                // 与低位64da4880地址相加得到完整地址
                addr = (ULONGLONG)templong + (ULONGLONG)ByteCode + 7;
                return addr;
            }
        }
    }
    return  0;
}

// 得到SSSDT个数
ULONGLONG GetSSSDTCount()
{
    PSYSTEM_SERVICE_TABLE pWin32k;
    ULONGLONG W32pServiceTable;

    pWin32k = (PSYSTEM_SERVICE_TABLE)((ULONG64)KeServiceDescriptorTableShadow + sizeof(SYSTEM_SERVICE_TABLE));
    W32pServiceTable = (ULONGLONG)(pWin32k->ServiceTableBase);
    // DbgPrint("Count => %d n", pWin32k->NumberOfServices);

    return pWin32k->NumberOfServices;
}

VOID UnDriver(PDRIVER_OBJECT driver)
{
    DbgPrint(("驱动程序卸载成功! n"));
}

NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
{
    DbgPrint("hello lyshark.com n");

    KeServiceDescriptorTableShadow = (PSYSTEM_SERVICE_TABLE)GetKeServiceDescriptorTableShadow();

    DbgPrint("[LyShark] SSSDT基地址 = 0x%p n", KeServiceDescriptorTableShadow);

    ULONGLONG count = GetSSSDTCount();

    DbgPrint("[LyShark] SSSDT个数 = %d n", count);

    DriverObject->DriverUnload = UnDriver;
    return STATUS_SUCCESS;
}

这段代码运行后即可得到SSSDT表基地址,以及该表中函数个数。

驱动开发:内核枚举ShadowSSDT基址插图2

在此基础之上增加枚举计算过程即可,完整源代码如下所示。

SSSDT 函数起始index是0x1000,但W32pServiceTable是从基址开始记录的,这个误差则需要(index-0x1000)来得到,至于+4则是下一个元素与上一个元素的偏移。

计算公式:

  • W32pServiceTable + 4 * (index-0x1000)
// 署名权
// right to sign one's name on a piece of work
// PowerBy: LyShark
// Email: me@lyshark.com

#include 
#pragma intrinsic(__readmsr)

typedef struct _SYSTEM_SERVICE_TABLE
{
    PVOID          ServiceTableBase;
    PVOID          ServiceCounterTableBase;
    ULONGLONG      NumberOfServices;
    PVOID          ParamTableBase;
} SYSTEM_SERVICE_TABLE, *PSYSTEM_SERVICE_TABLE;

PSYSTEM_SERVICE_TABLE KeServiceDescriptorTableShadow = 0;
ULONG64 ul64W32pServiceTable = 0;

// 获取 KeServiceDescriptorTableShadow 首地址
ULONGLONG GetKeServiceDescriptorTableShadow()
{
    // 设置起始位置
    PUCHAR StartSearchAddress = (PUCHAR)__readmsr(0xC0000082) - 0x1808FE;

    // 设置结束位置
    PUCHAR EndSearchAddress = StartSearchAddress + 0x8192;
    // DbgPrint("扫描起始地址: %p --> 扫描结束地址: %p n", StartSearchAddress, EndSearchAddress);

    PUCHAR ByteCode = NULL;

    UCHAR OpCodeA = 0, OpCodeB = 0, OpCodeC = 0;
    ULONGLONG addr = 0;
    ULONG templong = 0;

    for (ByteCode = StartSearchAddress; ByteCode  u KiSystemServiceRepeat
            nt!KiSystemServiceRepeat:
            fffff8027c1d2b94 4c8d15e59c3b00  lea     r10,[nt!KeServiceDescriptorTable (fffff8027c58c880)]
            fffff8027c1d2b9b 4c8d1dde1e3a00  lea     r11,[nt!KeServiceDescriptorTableShadow (fffff8027c574a80)]
            fffff802`7c1d2ba2 f7437880000000  test    dword ptr [rbx+78h],80h
            fffff8027c1d2ba9 7413            je      nt!KiSystemServiceRepeat+0x2a (fffff8027c1d2bbe)
            fffff802`7c1d2bab f7437800002000  test    dword ptr [rbx+78h],200000h
            fffff8027c1d2bb2 7407            je      nt!KiSystemServiceRepeat+0x27 (fffff8027c1d2bbb)
            fffff8027c1d2bb4 4c8d1d051f3a00  lea     r11,[nt!KeServiceDescriptorTableFilter (fffff8027c574ac0)]
            fffff802`7c1d2bbb 4d8bd3          mov     r10,r11
            */
            if (OpCodeA == 0x4c && OpCodeB == 0x8d && OpCodeC == 0x1d)
            {
                // 获取高位地址fffff802
                memcpy(&templong, ByteCode + 3, 4);

                // 与低位64da4880地址相加得到完整地址
                addr = (ULONGLONG)templong + (ULONGLONG)ByteCode + 7;
                return addr;
            }
        }
    }
    return  0;
}

// 得到SSSDT个数
ULONGLONG GetSSSDTCount()
{
    PSYSTEM_SERVICE_TABLE pWin32k;
    ULONGLONG W32pServiceTable;

    pWin32k = (PSYSTEM_SERVICE_TABLE)((ULONG64)KeServiceDescriptorTableShadow + sizeof(SYSTEM_SERVICE_TABLE));
    W32pServiceTable = (ULONGLONG)(pWin32k->ServiceTableBase);
    // DbgPrint("Count => %d n", pWin32k->NumberOfServices);

    return pWin32k->NumberOfServices;
}

VOID UnDriver(PDRIVER_OBJECT driver)
{
    DbgPrint(("驱动程序卸载成功! n"));
}

NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
{
    DbgPrint("hello lyshark.com n");

    KeServiceDescriptorTableShadow = (PSYSTEM_SERVICE_TABLE)GetKeServiceDescriptorTableShadow();

    DbgPrint("[LyShark] SSSDT基地址 = 0x%p n", KeServiceDescriptorTableShadow);

    ULONGLONG count = GetSSSDTCount();

    DbgPrint("[LyShark] SSSDT个数 = %d n", count);

    // 循环枚举SSSDT
    for (size_t Index = 0; Index ServiceTableBase);

        // 获取SSSDT地址
        //ln win32k!W32pServiceTable+((poi(win32k!W32pServiceTable+4*(1-1000))&0x00000000`ffffffff)>>4)-10000000
        //u win32k!W32pServiceTable+((poi(win32k!W32pServiceTable+4*(Index-0x1000))&0x00000000`ffffffff)>>4)-0x10000000

        //u poi(win32k!W32pServiceTable+4*(1-0x1000))
        //u poi(win32k!W32pServiceTable+4*(1-0x1000))&0x00000000`ffffffff
        //u (poi(win32k!W32pServiceTable+4*(1-0x1000))&0x00000000`ffffffff)>>4

        //u win32k!W32pServiceTable+((poi(win32k!W32pServiceTable+4*(1-0x1000))&0x00000000`ffffffff)>>4)-0x10000000

        ULONGLONG qword_temp = 0;
        LONG dw = 0;

        // SSSDT 下标从1000开始,而W32pServiceTable是从0开始
        // + 4 则是每次向下4字节就是下一个地址
        qword_temp = W32pServiceTable + 4 * (Index - 0x1000);

        dw = *(PLONG)qword_temp;
        // dw = qword_temp & 0x00000000ffffffff;
        dw = dw >> 4;
        qword_temp = W32pServiceTable + (LONG64)dw;

        DbgPrint("[LyShark] ID: %d | SSSDT: 0x%p n", Index, qword_temp);
    }

    DriverObject->DriverUnload = UnDriver;
    return STATUS_SUCCESS;
}

枚举效果如下所示(存在问题):

驱动开发:内核枚举ShadowSSDT基址插图3

注这一步必须要在GUI线程中执行,否则会异常,建议将枚举过程写成DLL文件,注入到explorer.exe进程内执行。

文章来源于互联网:驱动开发:内核枚举ShadowSSDT基址

THE END
分享
二维码