和其他的函数(stub这里翻译成了函数)一样,NtCreateSection()把函数的服务索引号放进EAX中,让EDX指向函数的参数,然后执行转到内核函数KiDispatchService()(这一步在windows NT/2000下通过INT 0x2E指令,在windows XP下是SYSENTER实现).在检查过参数的有效性之后,KiDispatchService()把执行权转到实际的服务实现处,在SSDT(System Service Descriptor Table)中这个服务的地址是有效的(ntoskrnl.exe导出的KeServiceDescriptorTable变量指向这个表,因此对于内核驱动它可以使用).SSDT描述见下面的结构:
struct SYS_SERVICE_TABLE {
void **ServiceTable;
unsigned long CounterTable;
unsigned long ServiceLimit;
void **ArgumentsTable;
};
//open device
device=CreateFile("\\\\.\\PROTECTOR",GENERIC_READ|GENERIC_WRITE,
0,0,OPEN_EXISTING, FILE_ATTRIBUTE_SYSTEM,0);
// get index of NtCreateSection, and pass it to the driver, along with the
//address of output buffer
DWORD * addr=(DWORD *)
(1+(DWORD)GetProcAddress(GetModuleHandle("ntdll.dll"),
"NtCreateSection"));
ZeroMemory(outputbuff,256);
controlbuff[0]=addr[0];
controlbuff[1]=(DWORD)&outputbuff[0];
DeviceIoControl(device,1000,controlbuff,256,controlbuff,256,&dw,0);
