1: kd> dd kdDebuggerEnabled
83f9d96c 00000001 00000000 00000000 db1dbbbb 1: kd> ed kdDebuggerEnabled 0
1: kd> dd kdDebuggerEnabled
83f9d96c 00000000 00000000 00000000 db1dbbbb 00 807eaae0 83eb40cb nt!RtlpBreakWithStatusInstruction
01 807eaae8 83eb409d nt!KdCheckForDebugBreak+0x22
02 807eab98 83eb937f nt!KeUpdateRunTime+0x164
03 807eac20 83eb0e0d nt!PoIdle+0x524
04 807eac24 00000000 nt!KiIdleLoop+0xd 00 807eaae0 83e950cb nt!RtlpBreakWithStatusInstruction
01 807eaae8 83e9509d nt!KdCheckForDebugBreak+0x22
02 807eab18 8422f430 nt!KeUpdateRunTime+0x164
03 807eab18 937d05d6 hal!HalpClockInterruptPn+0x158
... 1: kd> uf KeUpdateRunTime
后ctrl+F搜索kdDebuggerEnabled发现一处代码
83eb4082 803d6cd9f98300 cmp byte ptr [nt!KdDebuggerEnabled (83f9d96c)],0
83eb4089 7412 je nt!KeUpdateRunTime+0x164 (83eb409d)
83eb408b a1740ff783 mov eax,dword ptr [nt!KiPollSlot (83f70f74)]
83eb4090 3b86cc030000 cmp eax,dword ptr [esi+3CCh]
83eb4096 7505 jne nt!KeUpdateRunTime+0x164 (83eb409d)
83eb4098 e80c000000 call nt!KdCheckForDebugBreak (83eb40a9)
83eb409d 5f pop edi 1: kd> uf KdCheckForDebugBreak
83eb40a9 803d271df68300 cmp byte ptr [nt!KdPitchDebugger (83f61d27)],0
83eb40b0 7519 jne nt!KdCheckForDebugBreak+0x22 (83eb40cb)
83eb40b2 803d6cd9f98300 cmp byte ptr [nt!KdDebuggerEnabled (83f9d96c)],0
83eb40b9 7410 je nt!KdCheckForDebugBreak+0x22 (83eb40cb)
83eb40bb e81f000000 call nt!KdPollBreakIn (83eb40df)
83eb40c0 84c0 test al,al
83eb40c2 7407 je nt!KdCheckForDebugBreak+0x22 (83eb40cb)
83eb40c4 6a01 push 1
83eb40c6 e801000000 call nt!DbgBreakPointWithStatus (83eb40cc)
83eb40cb c3 ret 1: kd> u DbgBreakPointWithStatus
nt!DbgBreakPointWithStatus:
83eb40cc 8b442404 mov eax,dword ptr [esp+4]
nt!RtlpBreakWithStatusInstruction:
83eb40d0 cc int 3
83eb40d1 c20400 ret 4 83eb40fa 381d6cd9f983 cmp byte ptr [nt!KdDebuggerEnabled (83f9d96c)],bl
//KdDebuggerEnabled变量存储
BOOLEAN gKdDebuggerEnabled=TRUE;
//KdPitchDebugger变量存储
BOOLEAN gKdPitchDebugger=FALSE;
//转移win7中的KdDebuggerEnabled和KdPitchDebugger变量
void MoveVariable_Win7(IN BOOL b***)
{
ULONG ulAddr, ulAddr2;
//----------------------------改写KeUpdateRunTime中的KdDebuggerEnabled
//得到原内核的KeUpdateRunTime地址
ulAddr=GetOriginalProcAddr(L"KeUpdateRunTime");
//定位KdDebuggerEnabled
//特征码
//83ec9082 803d6c29fb8300 cmp byte ptr [nt!KdDebuggerEnabled (83fb296c)],0
//83ec9089 7412 je nt!KeUpdateRunTime+0x164 (83ec909d)
//83ec908b a1745ff883 mov eax,dword ptr [nt!KiPollSlot (83f85f74)]
UCHAR szSig1[10] = {0x80, 0x3d, '?', '?', '?', '?', '?', 0x74, 0x12, 0xa1};
//特征码定位KdDebuggerEnabled
ulAddr=SearchCode((PUCHAR)ulAddr, szSig1, 10, 0x200);
ulAddr+=2;
//改写KdDebuggerEnabled变量
PageProtect(FALSE);
*(PULONG)ulAddr=(ULONG)&gKdDebuggerEnabled;
PageProtect(TRUE);
//----------------------------改写KdCheckForDebugBreak中的KdDebuggerEnabled
//得到KdCheckForDebugBreak地址
//特征码
//83ec9098 e80c000000 call nt!KdCheckForDebugBreak (83ec90a9)
//83ec909d 5f pop edi
UCHAR szSig2[6] = {0xe8, '?', '?', '?', '?', 0x5f};
ulAddr=SearchCode((PUCHAR)ulAddr, szSig2, 6, 0x100);
ulAddr=ulAddr+*(PULONG)((PUCHAR)ulAddr+1)+5;
//记录KdCheckForDebugBreak函数地址 用于KdPitchDebugger变量的处理
ulAddr2=ulAddr;
//特征码定位KdDebuggerEnabled
//83ec90b2 803d6c29fb8300 cmp byte ptr [nt!KdDebuggerEnabled (83fb296c)],0
//83ec90b9 7410 je nt!KdCheckForDebugBreak+0x22 (83ec90cb)
//83ec90bb e81f000000 call nt!KdPollBreakIn (83ec90df)
UCHAR szSig3[10] = {0x80, 0x3d, '?', '?', '?', '?', '?', 0x74, 0x10, 0xe8};
ulAddr=SearchCode((PUCHAR)ulAddr, szSig3, 10, 0x100);
ulAddr+=2;
//改写KdDebuggerEnabled变量
PageProtect(FALSE);
*(PULONG)ulAddr=(ULONG)&gKdDebuggerEnabled;
PageProtect(TRUE);
//----------------------------改写KdCheckForDebugBreak中的KdPitchDebugger
//定位KdPitchDebugger变量
//由于KdPitchDebugger变量在函数开头偏移2处 所以直接偏移定位KdPitchDebugger
//83eb30a9 803d270df68300 cmp byte ptr [nt!KdPitchDebugger (83f60d27)],0
//83eb30b0 7519 jne nt!KdCheckForDebugBreak+0x22 (83eb30cb)
ulAddr2+=2;
//改写KdPitchDebugger变量
PageProtect(FALSE);
*(PULONG)ulAddr2=(ULONG)&gKdPitchDebugger;
PageProtect(TRUE);
//----------------------------改写KdPollBreakIn中的KdDebuggerEnabled
//得到KdPollBreakIn地址
//特征码
//83ebe0bb e81f000000 call nt!KdPollBreakIn (83ebe0df)
//83ebe0c0 84c0 test al,al
UCHAR szSig4[7] = {0xe8, '?', '?', '?', '?', 0x84, 0xc0};
ulAddr=SearchCode((PUCHAR)ulAddr, szSig4, 7, 0x100);
ulAddr=ulAddr+*(PULONG)((PUCHAR)ulAddr+1)+5;
//记录KdPollBreakIn函数地址 用于KdPitchDebugger变量的处理
ulAddr2=ulAddr;
//特征码定位KdDebuggerEnabled
//83ebe0f7 885dff mov byte ptr [ebp-1],bl
//83ebe0fa 381d6c79fa83 cmp byte ptr [nt!KdDebuggerEnabled (83fa796c)],bl
//83ebe100 0f84c0000000 je nt!KdPollBreakIn+0xe7 (83ebe1c6)
UCHAR szSig5[11] = {0x88, 0x5d, 0xff, 0x38, 0x1d, '?', '?', '?', '?', 0x0f, 0x84};
ulAddr=SearchCode((PUCHAR)ulAddr, szSig5, 11, 0x100);
ulAddr+=5;
//改写KdDebuggerEnabled变量
PageProtect(FALSE);
*(PULONG)ulAddr=(ULONG)&gKdDebuggerEnabled;
PageProtect(TRUE);
//----------------------------改写KdPollBreakIn中的KdPitchDebugger
//特征码定位KdPitchDebugger
//83eb30e6 33db xor ebx,ebx
//83eb30e8 381d270df683 cmp byte ptr [nt!KdPitchDebugger (83f60d27)],bl
//83eb30ee 7407 je nt!KdPollBreakIn+0x18 (83eb30f7)
UCHAR szSig6[10] = {0x33, 0xdb, 0x38, 0x1d, '?', '?', '?', '?', 0x74, 0x07};
ulAddr2=SearchCode((PUCHAR)ulAddr2, szSig6, 10, 0x100);
ulAddr2+=4;
//改写KdPitchDebugger变量
PageProtect(FALSE);
*(PULONG)ulAddr2=(ULONG)&gKdPitchDebugger;
PageProtect(TRUE);
} 1: kd> dd KiDebugRoutine
83fa2b20 841664f2 83f16683 00000000 0311870a
83fa2b30 00000bb8 00000011 5385d2ba d717548f
83fa2b40 83eb7d5c 00000000 00000191 83eb83a4
83fa2b50 986fa000 00000000 00000339 986fb02c
83fa2b60 00000100 00000000 00000000 83fa2b68
83fa2b70 00000340 00000340 00000007 00000000
83fa2b80 86cdb6b8 86cdb5f0 86ce3838 86ce39c8
83fa2b90 86ce3900 00000000 86d37040 00000000
1: kd> u 841664f2
nt!KdpTrap:
841664f2 8bff mov edi,edi
841664f4 55 push ebp
841664f5 8bec mov ebp,esp
841664f7 51 push ecx
841664f8 51 push ecx
841664f9 8b4510 mov eax,dword ptr [ebp+10h]
841664fc 33d2 xor edx,edx
841664fe 813803000080 cmp dword ptr [eax],80000003h
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
上传的附件：
