nt!KeInitializeApc: ;
mov edi,edi ;
push ebp ;
mov ebp,esp ;
mov eax,dword ptr [ebp+8] ;[ebp+8]： Apc
mov edx,dword ptr [ebp+10h] ;[ebp+10h]： TargetEnvironment
cmp edx,2 ;
mov ecx,dword ptr [ebp+0Ch] ;[ebp+0Ch]： Thread
mov word ptr [eax],12h ;Apc->Type = 0x12
mov word ptr [eax+2],30h ;Apc->Size = 0x30
jne nt!KeInitializeApc+0x24 (804fd3c2) ;若TargetEnvironment != CurrentApcEnvironment则跳转
mov dl,byte ptr [ecx+165h] ;[ecx+165h]:Thread->ApcStateIndex,表示当前线程的环境值
---------------------------------------------------
[COLOR="Blue"]nop ;inline Hook部分：仅对Apc->Thread进行了处理
call xyz12345+0x333c (ba27b33c) ;处理函数[/COLOR]
---------------------------------------------------
mov dword ptr [eax+14h],ecx ;
mov ecx,dword ptr [ebp+18h] ;
mov byte ptr [eax+2Ch],dl ;
mov dword ptr [eax+18h],ecx ;
mov ecx,dword ptr [ebp+1Ch] ;
xor edx,edx ;
cmp ecx,edx ;
mov dword ptr [eax+1Ch],ecx ;
je nt!KeInitializeApc+0x50 (804fbaa6) ;
mov cl,byte ptr [ebp+20h] ;
mov byte ptr [eax+2Dh],cl ;
--------------------------------------------------;
在进入处理函数之前，堆栈空间内容：
|Context |
|Mode |
|NormalRoutine |
|RundownRoutine |
|KernelRoutine |
|TargetEnvironment |
|Thread |
|Apc |
|KeInitializeApc.Ret|
|KeInitializeApc.Ebp|
b2a7033c： ;
mov edi, edi ;
pusha ;
pushf ;
lock inc dword_16AC0 ;多核同步
mov eax, dword_16B44 ;dword_16B44：PsExitSpecialApc函数地址
test eax, eax ;
jnz short loc_1338A ;
mov ebx, [ebp+14h] ;[ebp+14h]：KernelRoutine
mov ecx, [ebp+20h] ;[ebp+20h]：NormalRoutine
mov edx, [ebp+10h] ;[ebp+10h]：TargetEnvironment
mov esi, [ebp+0Ch] ;[ebp+0Ch]：Thread
mov eax, Object ;Object： 进程的ETHREAD结构指针
cmp eax, esi ;
jnz short loc_133B5 ;若当前线程不是Object代表的线程则跳转
test ecx, ecx ;
jnz short loc_133B5 ;若NormalRoutine!= NULL 则跳转
test edx, edx ;
jnz short loc_133B5 ;若TargetEnvironment != OriginalApcEnvironment则跳转
mov edi, dword_16A7C ;dword_16A7C： ntoskln.exe模块的Base
cmp ebx, edi ;
jb short loc_133B5 ;若KernelRoutine 低于dword_16A7C 则跳转
mov eax, dword_16AA0 ;dword_16AA0： ntoskln.exe模块的Size
add edi, eax ;
cmp ebx, edi ;
jg short loc_133B5 ;若KernelRoutine 高于dword_16A7C + dword_16AA0 则跳转
mov dword_16B44, ebx ;
jmp short loc_133B5 ;
--------------------------------------------------;
;
.text:0001338A loc_1338A: ;
mov eax, [ebp+0Ch] ;[ebp+0Ch]：Thread
push eax ;
mov eax, [ebp+14h] ;[ebp+14h]：KernelRoutine
push eax ;
mov eax, [ebp+4] ;[ebp+4]: KeInitializeApc.Ret
push eax ;
[COLOR="Green"]call sub_130A4 ;关键函数
[/COLOR]test al, al ;
jz short loc_133B5 ;
popf ;
popa ;
[COLOR="red"]mov ecx, Object ;
mov [eax+8], ecx ;Apc->Thread = Object
mov ecx, [ebp+14h] ;[/COLOR]
lock dec dword_16AC0 ;
retn ;
----------------------------- ;
.text:000133B5 loc_133B5: ;
popf ;
popa ;
[COLOR="red"]mov [eax+8], ecx ;
mov ecx, [ebp+14h] ;[/COLOR]
lock dec dword_16AC0 ;
retn ;
，感谢楼上发现了这个
