==============================================
#define VERSION_2K          50
#define VERSION_XP          51
#define VERSION_2K3         52
#define VERSION_XP64        52
#define VERSION_2K3_R2      52
#define VERSION_VISTA       60
#define VERSION_SERVER2008  60
#define VERSION_WIN7            61
#define VERSION_SERVER2008_R2   61
#pragma PAGECODE
DWORD GetVersion()
{  ULONG rtn=0;
ULONG MajorVersion,MinorVersion,BuildNumber;
PsGetVersion(&MajorVersion,&MinorVersion,&BuildNumber,NULL);//系统版本.参数1主版本,参数2副版本,参数3时间序号,参数4字串
rtn=MajorVersion;
rtn=rtn *10;     
rtn+=MinorVersion;   //主版本+副版本
return rtn;
}

#pragma PAGECODE
DWORD Get_KeServiceDescriptorTableShadow_Addr()
{   
DWORD KeServiceDescriptorTableShadow=0;
DWORD Version=GetVersion();
//__asm int 3
switch (Version)
{
case VERSION_2K:
  KeServiceDescriptorTableShadow=(DWORD)KeServiceDescriptorTable+0xE0;
  break;
case VERSION_2K3:
  break;
case VERSION_XP:
  KeServiceDescriptorTableShadow=(DWORD)KeServiceDescriptorTable-0x40;//XP系统的影子描述表是-0X40
  break;
default:
  break;
}
//__asm int 3
return KeServiceDescriptorTableShadow;
}
VOID GetInfo()
{
ULONG ssdt_base,*ssdt,NtOpenProcess_curAdr;
ssdt_base=(ULONG)KeServiceDescriptorTable->ServiceTableBase;
//__asm int 3
//接下来找NtOpenProcess的当前地址与源地址
ssdt= (PULONG) (ssdt_base+0x7a*4);
NtOpenProcess_curAdr=*ssdt; //NtOpenProcess的当前地址
UNICODE_STRING funName;
ULONG old_addr;
RtlInitUnicodeString(&funName,L"NtOpenProcess");
old_addr=(ULONG)MmGetSystemRoutineAddress(&funName);
KdPrint(("ssdt_base=%x\nssdt=%x\nNtOpenProcess_curAdr=%x\nold_addr=%x\n",
  ssdt_base,ssdt,NtOpenProcess_curAdr,old_addr));
//再来取影子表的基址
DWORD shadowTableBase=Get_KeServiceDescriptorTableShadow_Addr();
//__asm int 3

}
#pragma PAGECODE
VOID Show_SSDTShadowList()
{ 
KdPrint(("Entry  Show_SSDTShadowList \n"));
DWORD TableBase=Get_KeServiceDescriptorTableShadow_Addr();
TableBase=TableBase+0x10;//表基址                              //表基址应该取得正确，因为下面的表函数数量也是正确的
DWORD TableCount=TableBase+8;//表函数 数量          //这个取得也是正确的

DWORD count=*((PDWORD)TableCount);//函数数量
KdPrint(("SSDT_Shadow Base=%x Count=%x\n",TableBase,count));
__asm  int 3
PDWORD CFun_Addr=PDWORD(TableBase);//+=355
CFun_Addr=PDWORD(*CFun_Addr);

for (DWORD i=0;i<count;i++)
{
     KdPrint(("\n %d=%x\n",i,*CFun_Addr )); [B][COLOR="Red"][SIZE="5"]//就是这里蓝屏，要命啊！！[/SIZE][/COLOR][/B]  CFun_Addr++;
  //__asm int 3
}
}

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课