能力值：
( LV2，RANK：10 )
|
-
-
2 楼
我看了下特征码没变，还可以用win10 1709。可以正常SSDT HOOK。
//1709
//fffff802`655160be 4c8d15bb071800 lea r10, [nt!KeServiceDescriptorTable(fffff802`65696880)]
//fffff802`655160c5 4c8d1df4951600 lea r11, [nt!KeServiceDescriptorTableShadow(fffff802`6567f6c0)]
|
能力值：
( LV2，RANK：10 )
|
-
-
3 楼
楼主，你代码是怎么发的？
|
能力值：
( LV9，RANK：280 )
|
-
-
4 楼
PSYSTEM_SERVICE_DESCRIPTOR_TABLE GetSSDTBase(void)
{
#ifdef AMD64
PIMAGE_NT_HEADERS pHdr;
PIMAGE_SECTION_HEADER pFirstSec;
PIMAGE_SECTION_HEADER pSec;
PUCHAR ntosBase;
ntosBase = (PUCHAR)g_ntosbase;
// Already found
if (g_SSDT != NULL)
return g_SSDT;
if (!ntosBase)
return NULL;
pHdr = RtlImageNtHeader(ntosBase);
pFirstSec = (PIMAGE_SECTION_HEADER)(pHdr + 1);
for (pSec = pFirstSec; pSec < pFirstSec + pHdr->FileHeader.NumberOfSections; pSec++)
{
// Non-paged, non-discardable, readable sections
// Probably still not fool-proof enough...
if (pSec->Characteristics & IMAGE_SCN_MEM_NOT_PAGED &&
pSec->Characteristics & IMAGE_SCN_MEM_EXECUTE &&
!(pSec->Characteristics & IMAGE_SCN_MEM_DISCARDABLE) &&
(*(PULONG)pSec->Name != 'TINI') &&
(*(PULONG)pSec->Name != 'EGAP'))
{
PVOID pFound = NULL;
// KiSystemServiceRepeat pattern
UCHAR pattern[] = "\x4c\x8d\x15\xcc\xcc\xcc\xcc\x4c\x8d\x1d\xcc\xcc\xcc\xcc\xf7";
NTSTATUS status = BBSearchPattern(pattern, 0xCC, sizeof(pattern) - 1, ntosBase + pSec->VirtualAddress, pSec->Misc.VirtualSize, &pFound);
if (NT_SUCCESS(status))
{
g_SSDT = (PSYSTEM_SERVICE_DESCRIPTOR_TABLE)((PUCHAR)pFound + *(PULONG)((PUCHAR)pFound + 3) + 7);
return g_SSDT;
}
}
}
return NULL;
#else
return KeServiceDescriptorTable;
#endif
}
from https://github.com/DarthTon/Blackbone/ still work for 1803
最后于 2018-9-25 09:22
被hzqst编辑
，原因：
|
|
|
