ULONGLONG GetKeServiceDescriptorTable64()
{
//Pattern
char KiSystemServiceStart_pattern[14] = "\x8B\xF8\xC1\xEF\x07\x83\xE7\x20\x25\xFF\x0F\x00\x00";

//Scan boundaries
×××××××××××××××××××××××××不明白×××××××
ULONGLONG CodeScanStart = (ULONGLONG)&_strnicmp;
ULONGLONG CodeScanEnd = (ULONGLONG)&KdDebuggerNotPresent;
×××××××××××××××××××××××××不明白×××××××

//Another needed variables
UNICODE_STRING Symbol;
ULONGLONG i, tbl_address, b;

//Loop - to find the KiSystemServiceStart function
for (i = 0; i < CodeScanEnd - CodeScanStart; i++)
{
//Check if those bytes are equal to our pattern-bytes
if (!memcmp((char*)(ULONGLONG)CodeScanStart +i, (char*)KiSystemServiceStart_pattern,14))
{
//Search lea rdx, * - by opcodes: 4c 8d
for (b = 0; b < 50; b++)
{
tbl_address = ((ULONGLONG)CodeScanStart+i+b);

//Check for lea rdx, * and calculate base address from relative address

if (*(USHORT*) ((ULONGLONG)tbl_address ) == (USHORT)0x8d4c)
return ((LONGLONG)tbl_address +7) + *(LONG*)(tbl_address +3);
}
}
}

[课程]Android-CTF解题方法汇总！