关于SSDT

2023-08-08 17:50:46

百度上比较好的解释是：SSDT的全称是System Services Descriptor Table，系统服务描述符表。这个表就是一个把ring3的Win32 API和ring0的内核API联系起来。SSDT并不仅仅只包含一个庞大的地址索引表，它还包含着一些其它有用的信息，诸如地址索引的基地址、服务函数个数等。

说白了，SSDT就是把系统两个不同级别的函数给关联起来，因为为了安全需要，我们平常所使用的API函数基本都是在ring3下的函数，ring3的级别比较低，但是有些涉及到系统底层的函数怎么办呢？Windows就给出一个SSDT表，把ring3和ring0的函数给关联起来，这样，我们就通过使用ring3的函数就可以直接做一些底层操作了。

好吧，既然有这个东西，谁最关心呢？当然是杀毒软件最关心了，因为为了阻止某些病毒不让他破坏系统的底层，杀毒软件会把SSDT中的地址给修改并转向，这样，当病毒或程序调用这些函数的时候，就无法找到真正的对应函数，从而调用失败。

不过这玩意已经没有什么神秘的了，道高一尺魔高一丈，现在的病毒已经可以绕过SSDT去直接调用底层函数了，或者说可以找出底层函数的真实地址了，这里，我们就简单利用KeServiceDescriptorTable这个函数来读取系统的SSDT表吧。

完整代码如下：

001.#include "stdafx.h"

002.#include <windows.h>

003.#include <iostream>

004.usingnamespace
std;

005.

006.#define RVATOVA(base,offset) ((PVOID)((DWORD)(base)+(DWORD)(offset)))

007.#define ibaseDD *(PDWORD)&ibase

008.#define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L)

009.#define NT_SUCCESS(Status) ((NTSTATUS)(Status) >= 0)

010.

011.

012.typedefstruct
{

013. WORD

offset:12;

014. WORD

type:4;

015.} IMAGE_FIXUP_ENTRY, *PIMAGE_FIXUP_ENTRY;

016.

017.

018.typedefLONG
NTSTATUS;

019.

020.long

( __stdcall *NtQuerySystemInformation )(

DWORD,PVOID

DWORD,DWORD
);

021.

022.typedefstruct
_SYSTEM_MODULE_INFORMATION {//Information Class 11

023. ULONG

Reserved[2];

024. PVOID

Base;

025. ULONG

Size;

026. ULONG

Flags;

027. USHORT

Index;

028. USHORT

Unknown;

029. USHORT

LoadCount;

030. USHORT

ModuleNameOffset;

031. CHAR

ImageName[256];

032.}SYSTEM_MODULE_INFORMATION,*PSYSTEM_MODULE_INFORMATION;

033.

034.typedefstruct
{

035. DWORD

dwNumberOfModules;

036. SYSTEM_MODULE_INFORMATION smi;

037.} MODULES, *PMODULES;

038.

039.#define SystemModuleInformation 11

040.

041.

042.

043.

044.DWORDGetHeaders(PCHAR
ibase,

045. PIMAGE_FILE_HEADER *pfh,

046. PIMAGE_OPTIONAL_HEADER *poh,

047. PIMAGE_SECTION_HEADER *psh)

048.

049.{

050. PIMAGE_DOS_HEADER mzhead=(PIMAGE_DOS_HEADER)ibase;

051.

052. if

((mzhead->e_magic!=IMAGE_DOS_SIGNATURE)

 ||

053. (ibaseDD[mzhead->e_lfanew]!=IMAGE_NT_SIGNATURE))

054. return

FALSE;

055.

056. *pfh=(PIMAGE_FILE_HEADER)&ibase[mzhead->e_lfanew];

057. if

(((PIMAGE_NT_HEADERS)*pfh)->Signature!=IMAGE_NT_SIGNATURE)

058. return

FALSE;

059. *pfh=(PIMAGE_FILE_HEADER)((PBYTE)*pfh+sizeof(IMAGE_NT_SIGNATURE));

060.

061. *poh=(PIMAGE_OPTIONAL_HEADER)((PBYTE)*pfh+sizeof(IMAGE_FILE_HEADER));

062. if

((*poh)->Magic!=IMAGE_NT_OPTIONAL_HDR32_MAGIC)

063. return

FALSE;

064.

065. *psh=(PIMAGE_SECTION_HEADER)((PBYTE)*poh+sizeof(IMAGE_OPTIONAL_HEADER));

066. return

TRUE;

067.}

068.

069.

070.DWORDFindKiServiceTable(HMODULEhModule,DWORD
dwKSDT)

071.{

072. PIMAGE_FILE_HEADER pfh;

073. PIMAGE_OPTIONAL_HEADER poh;

074. PIMAGE_SECTION_HEADER psh;

075. PIMAGE_BASE_RELOCATION pbr;

076. PIMAGE_FIXUP_ENTRY pfe;

077.

078. DWORD

dwFixups=0,i,dwPointerRva,dwPointsToRva,dwKiServiceTable;

079. BOOL

bFirstChunk;

080.

081. GetHeaders((char

*)hModule,&pfh,&poh,&psh);

082.

083. // loop thru relocs to speed up the search

084. if

((poh->DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress)

 &&

085. (!((pfh->Characteristics)&IMAGE_FILE_RELOCS_STRIPPED))) {

086.

087. pbr=(PIMAGE_BASE_RELOCATION)RVATOVA(poh->DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress,hModule);

088.

089. bFirstChunk=TRUE;

090. // 1st IMAGE_BASE_RELOCATION.VirtualAddress of ntoskrnl is 0

091. while

(bFirstChunk || pbr->VirtualAddress)

 {

092. bFirstChunk=FALSE;

093.

094. pfe=(PIMAGE_FIXUP_ENTRY)((DWORD)pbr+sizeof(IMAGE_BASE_RELOCATION));

095.

096. for(i=0;i<(pbr->SizeOfBlock-sizeof

(IMAGE_BASE_RELOCATION))>>1;i++,pfe++)

 {

097. if

(pfe->type==IMAGE_REL_BASED_HIGHLOW)

 {

098. dwFixups++;

099. dwPointerRva=pbr->VirtualAddress+pfe->offset;

100.

// DONT_RESOLVE_DLL_REFERENCES flag means relocs aren't

 fixed

101. dwPointsToRva=*(PDWORD)((DWORD)hModule+dwPointerRva)-(DWORD)poh->ImageBase;

102.

103. // does this reloc point to KeServiceDescriptorTable.Base?

104. if

(dwPointsToRva==dwKSDT)

 {

105.

// check for mov [mem32],imm32. we are trying to

 find

106.

// "mov ds:_KeServiceDescriptorTable.Base, offset

 _KiServiceTable"

107. // from the KiInitSystem.

108. if(*(PWORD)((DWORD

)hModule+dwPointerRva-2)==0x05c7)

 {

109.

// should check for a reloc presence on KiServiceTable

 here

110. // but forget it

111. dwKiServiceTable=*(PDWORD)((DWORD)hModule+dwPointerRva+4)-poh->ImageBase;

112. return

dwKiServiceTable;

113. }

114. }

115.

116. }

117. }

118. *(PDWORD)&pbr+=pbr->SizeOfBlock;

119. }

120. }

121.

122.

123.

124. return

0;

125.}

126.

127.

128.int

EnumSSDT()

129.{

130. HMODULE

hKernel;

131. DWORD

dwKSDT;

// rva of KeServiceDescriptorTable

132. DWORD

dwKiServiceTable;

// rva of KiServiceTable

133. PMODULES pModules=(PMODULES)&pModules;

134. DWORD

dwNeededSize,rc;

135. DWORD

dwKernelBase,dwServices=0;

136. PCHAR

pKernelName;

137. PDWORD pService;

138. PIMAGE_FILE_HEADER pfh;

139. PIMAGE_OPTIONAL_HEADER poh;

140. PIMAGE_SECTION_HEADER psh;

141. NtQuerySystemInformation = (long(__stdcall*)(DWORD,PVOID,DWORD,DWORD

))GetProcAddress(

 GetModuleHandle(

"ntdll.dll"

),

"NtQuerySystemInformation"

);

142. //通过NtQuerySystemInformation取得系统内核文件，判断为是ntoskrnl.exe ntkrnlmp.exe ntkrnlpa.exe

143. rc=NtQuerySystemInformation(SystemModuleInformation,pModules,4,(ULONG)&dwNeededSize);

144. if

(rc==STATUS_INFO_LENGTH_MISMATCH)

//如果内存不够

145. {

146. pModules=(PMODULES)GlobalAlloc(GPTR,dwNeededSize) ;

//重新分配内存

147. rc=NtQuerySystemInformation(SystemModuleInformation,pModules,dwNeededSize,NULL);

//系统内核文件是总是在第一个，枚举1次

148. }

149.

150. if

(!NT_SUCCESS(rc))

151. {

152. cout <<

"NtQuerySystemInformation() Failed

 !\n"

;

//NtQuerySystemInformation执行失败，检查当前进程权限

153. return

0;

154. }

155.

156. dwKernelBase=(DWORD)pModules->smi.Base;

//

 imagebase

157. pKernelName=pModules->smi.ModuleNameOffset+pModules->smi.ImageName;

158. hKernel=LoadLibraryEx(pKernelName,0,DONT_RESOLVE_DLL_REFERENCES);

//

 映射ntoskrnl //高

159. if

(!hKernel)

160. {

161. cout <<"Failed to load \n"

162. return

0;

163. }

164. GlobalFree(pModules);

165. if(!(dwKSDT=(DWORD)GetProcAddress(hKernel,"KeServiceDescriptorTable")))

//在内核文件中查找KeServiceDescriptorTable地址

166. {

167. cout <<"Can't find KeServiceDescriptorTable\n";

168. return

0;

169. }

170.

171. dwKSDT-=(DWORD)hKernel;

//

 获取 KeServiceDescriptorTable RVA

172. if

(!(dwKiServiceTable=FindKiServiceTable(hKernel,dwKSDT)))

// 获取KiServiceTable地址

173. {

174. cout <<"Can't find KiServiceTable...\n";

175. return

0;

176. }

177.

178. GetHeaders((char

*)hKernel,&pfh,&poh,&psh);

179.

180. int

dwIndex=0;

181. for(pService=(PDWORD)((DWORD)hKernel+dwKiServiceTable);

182. *pService-poh->ImageBase<poh->SizeOfImage;

183. pService++,dwServices++,dwIndex++)

184. {

185. printf("0x%03X-0x%08X\n",dwIndex,*pService-poh->ImageBase+dwKernelBase);

//SSDT索引和地址

186. }

187. FreeLibrary(hKernel);

188. return

1;

189.}

190.

191.

192.

193.int

main()

194.{

195. EnumSSDT();

196.

197. system("pause");

198. return

0;

199.}

码农公寓

相关文章