nt!KeInitializeApc:                               ;
mov     edi,edi                                   ;
push    ebp                                       ;
mov     ebp,esp                                   ;
mov     eax,dword ptr [ebp+8]                     ;[ebp+8]： Apc
mov     edx,dword ptr [ebp+10h]                   ;[ebp+10h]： TargetEnvironment
cmp     edx,2                                     ;
mov     ecx,dword ptr [ebp+0Ch]                   ;[ebp+0Ch]： Thread
mov     word ptr [eax],12h                        ;Apc->Type = 0x12
mov     word ptr [eax+2],30h                      ;Apc->Size = 0x30
jne     nt!KeInitializeApc+0x24 (804fd3c2)        ;若TargetEnvironment != CurrentApcEnvironment则跳转
mov     dl,byte ptr [ecx+165h]                    ;[ecx+165h]:Thread->ApcStateIndex,表示当前线程的环境值
---------------------------------------------------
[COLOR="Blue"]nop                                               ;inline Hook部分：仅对Apc->Thread进行了处理
call    xyz12345+0x333c (ba27b33c)                ;处理函数[/COLOR]
---------------------------------------------------
mov     dword ptr [eax+14h],ecx			  ;
mov     ecx,dword ptr [ebp+18h]                   ;
mov     byte ptr [eax+2Ch],dl                     ;
mov     dword ptr [eax+18h],ecx                   ;
mov     ecx,dword ptr [ebp+1Ch]                   ;
xor     edx,edx                                   ;
cmp     ecx,edx                                   ;
mov     dword ptr [eax+1Ch],ecx                   ;
je      nt!KeInitializeApc+0x50 (804fbaa6)        ;
mov     cl,byte ptr [ebp+20h]                     ;
mov     byte ptr [eax+2Dh],cl                     ;
--------------------------------------------------;
在进入处理函数之前，堆栈空间内容：
|Context            |
|Mode               |
|NormalRoutine      |
|RundownRoutine     |
|KernelRoutine      |
|TargetEnvironment  |
|Thread             |
|Apc                |
|KeInitializeApc.Ret|
|KeInitializeApc.Ebp|


b2a7033c：                                        ;
mov     edi, edi                                  ;
pusha                                             ;
pushf                                             ;
lock inc dword_16AC0                              ;多核同步
mov     eax, dword_16B44                          ;dword_16B44：PsExitSpecialApc函数地址
test    eax, eax                                  ;
jnz     short loc_1338A                           ;
mov     ebx, [ebp+14h]                            ;[ebp+14h]：KernelRoutine
mov     ecx, [ebp+20h]                            ;[ebp+20h]：NormalRoutine
mov     edx, [ebp+10h]                            ;[ebp+10h]：TargetEnvironment
mov     esi, [ebp+0Ch]                            ;[ebp+0Ch]：Thread
mov     eax, Object                               ;Object： 进程的ETHREAD结构指针
cmp     eax, esi                                  ;
jnz     short loc_133B5                           ;若当前线程不是Object代表的线程则跳转
test    ecx, ecx                                  ;
jnz     short loc_133B5                           ;若NormalRoutine!= NULL 则跳转
test    edx, edx                                  ;
jnz     short loc_133B5                           ;若TargetEnvironment != OriginalApcEnvironment则跳转
mov     edi, dword_16A7C                          ;dword_16A7C： ntoskln.exe模块的Base
cmp     ebx, edi                                  ;
jb      short loc_133B5                           ;若KernelRoutine 低于dword_16A7C 则跳转
mov     eax, dword_16AA0                          ;dword_16AA0： ntoskln.exe模块的Size
add     edi, eax                                  ;
cmp     ebx, edi                                  ;
jg      short loc_133B5                           ;若KernelRoutine 高于dword_16A7C + dword_16AA0 则跳转
mov     dword_16B44, ebx                          ;
jmp     short loc_133B5                           ;
--------------------------------------------------;
                                                  ;
.text:0001338A loc_1338A:                         ;
mov     eax, [ebp+0Ch]                            ;[ebp+0Ch]：Thread
push    eax                                       ;
mov     eax, [ebp+14h]                            ;[ebp+14h]：KernelRoutine
push    eax                                       ;
mov     eax, [ebp+4]                              ;[ebp+4]: KeInitializeApc.Ret
push    eax                                       ;
[COLOR="Green"]call    sub_130A4                                 ;关键函数
[/COLOR]test    al, al                                    ;
jz      short loc_133B5                           ;
popf                                              ;
popa                                              ;
[COLOR="red"]mov     ecx, Object                               ;
mov     [eax+8], ecx                              ;Apc->Thread = Object
mov     ecx, [ebp+14h]                            ;[/COLOR]
lock dec dword_16AC0                              ;
retn                                              ;
-----------------------------                     ;
.text:000133B5 loc_133B5:                         ;
popf                                              ;
popa                                              ;
[COLOR="red"]mov     [eax+8], ecx                              ;
mov     ecx, [ebp+14h]                            ;[/COLOR]
lock dec dword_16AC0                              ;
retn                                              ;

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课