MmGetSystemRoutineAddress 函数源码
| MmGetSystemRoutineAddress 函数源码 |
| 作者：阿国哥 发布于2007-3-29 20:34(星期四) |
| 以下代码反编译自XP+SP2内核文件ntoskrnl.exe(5.1.2600.3051)的MmGetSystemRoutineAddress函数
原代码如下(IDA反编译结果,已自动作了标识): |
; PVOID __stdcall MmGetSystemRoutineAddress(PUNICODE_STRING SystemRoutineName)
public _MmGetSystemRoutineAddress@4
_MmGetSystemRoutineAddress@4 proc near
SystemRoutineName= dword ptr 8
8B FF mov edi, edi
55 push ebp
8B EC mov ebp, esp
83 EC 20 sub esp, 20h
53 push ebx
56 push esi
57 push edi
68 D8 9F 4E 00 push offset aNtoskrnl_exe ; "ntoskrnl.exe"
8D 45 E8 lea eax, [ebp-18h]
33 F6 xor esi, esi
50 push eax
89 75 FC mov [ebp-4], esi
89 75 F8 mov [ebp-8], esi
E8 53 83 F1 FF call _RtlInitUnicodeString@8 ; RtlInitUnicodeString(x,x)
68 F4 9F 4E 00 push offset aHal_dll_0 ; "hal.dll"
8D 45 E0 lea eax, [ebp-20h]
50 push eax
E8 45 83 F1 FF call _RtlInitUnicodeString@8 ; RtlInitUnicodeString(x,x)
loc_4E9F62: ; CODE XREF: PAGE:005194DA j
6A 01 push 1
FF 75 08 push dword ptr [ebp+8]
8D 45 F0 lea eax, [ebp-10h]
50 push eax
E8 F7 D9 FB FF call _RtlUnicodeStringToAnsiString@12 ; RtlUnicodeStringToAnsiString(x,x,x)
85 C0 test eax, eax
0F 8C 56 F5 02 00 jl loc_5194CE
64 A1 24 01 00 00 mov eax, large fs:124h
6A 01 push 1
8B F8 mov edi, eax
FF 8F D4 00 00 00 dec dword ptr [edi+0D4h]
68 40 36 48 00 push offset _PsLoadedModuleResource
E8 14 84 F1 FF call _ExAcquireResourceSharedLite@8 ; ExAcquireResourceSharedLite(x,x)
8B 35 20 36 48 00 mov esi, _PsLoadedModuleList
BB 20 36 48 00 mov ebx, offset _PsLoadedModuleList
;以上两行注意,可以8B35作特征码从MmGetSystemRoutineAddress起始地址搜索,并检测之后的双字与之后移6字节的双字
是否相同作特征检测. 此特征码目前适合的平台有待进一步考核.
loc_4E9F9D: ; CODE XREF: MmGetSystemRoutineAddress(x)+A3 j
3B F3 cmp esi, ebx
74 69 jz short loc_4EA00A
6A 01 push 1
8D 46 2C lea eax, [esi+2Ch]
50 push eax
8D 45 E8 lea eax, [ebp-18h]
50 push eax
E8 ED 1E FA FF call _RtlEqualUnicodeString@12 ; RtlEqualUnicodeString(x,x,x)
84 C0 test al, al
0F 84 5A FF FF FF jz loc_4E9F12
loc_4E9FB8: ; CODE XREF: PAGE:004E9F23 j
FF 45 FC inc dword ptr [ebp-4]
8D 45 F0 lea eax, [ebp-10h]
50 push eax
FF 76 18 push dword ptr [esi+18h]
E8 F3 DA FF FF call _MiFindExportedRoutineByName@8 ; MiFindExportedRoutineByName(x,x)
85 C0 test eax, eax
89 45 F8 mov [ebp-8], eax
75 3C jnz short loc_4EA00A
83 7D FC 02 cmp dword ptr [ebp-4], 2
74 36 jz short loc_4EA00A
loc_4E9FD4: ; CODE XREF: PAGE:004E9F29 j
8B 36 mov esi, [esi]
EB C5 jmp short loc_4E9F9D
; **************************************************************************?
aNtoskrnl_exe: ; DATA XREF: MmGetSystemRoutineAddress(x)+B o
6E 00 74 00 6F 00+ unicode 0, <ntoskrnl.exe>,0
00 db 0
00 db 0
aHal_dll_0: ; DATA XREF: MmGetSystemRoutineAddress(x)+21 o
68 00 61 00 6C 00+ unicode 0, <hal.dll>,0
CC db 0CCh ; ?
CC db 0CCh ; ?
CC db 0CCh ; ?
CC db 0CCh ; ?
CC db 0CCh ; ?
CC db 0CCh ; ?
; **************************************************************************?
loc_4EA00A: ; CODE XREF: MmGetSystemRoutineAddress(x)+6C j
; MmGetSystemRoutineAddress(x)+99 j ...
B9 40 36 48 00 mov ecx, offset _PsLoadedModuleResource
E8 3C A6 F1 FF call @ExReleaseResourceLite@4 ; ExReleaseResourceLite(x)
FF 87 D4 00 00 00 inc dword ptr [edi+0D4h]
75 0B jnz short loc_4EA027
8D 47 34 lea eax, [edi+34h]
39 00 cmp [eax], eax
0F 85 B8 F4 02 00 jnz loc_5194DF
loc_4EA027: ; CODE XREF: MmGetSystemRoutineAddress(x)+E7 j
; PAGE:005194EB j
8D 45 F0 lea eax, [ebp-10h]
50 push eax
E8 4A FB FA FF call _RtlFreeAnsiString@4 ; RtlFreeAnsiString(x)
8B 45 F8 mov eax, [ebp-8]
5F pop edi
5E pop esi
5B pop ebx
C9 leave
C2 04 00 retn 4
_MmGetSystemRoutineAddress@4 endp ; sp = 3Ch