首页
社区
课程
招聘
[原创]无需硬编码搜索定位PspCidTable的方法
发表于: 2021-12-2 17:23 26154

[原创]无需硬编码搜索定位PspCidTable的方法

2021-12-2 17:23
26154

硬编码搜太烦人了所以研究了一下此方法

代码如下 就不多BB了

 
#include <ntifs.h>
 
 
 
typedef struct _DBGKD_DEBUG_DATA_HEADER64 {
 
    //
    // Link to other blocks
    //
 
    LIST_ENTRY64 List;
 
    //
    // This is a unique tag to identify the owner of the block.
    // If your component only uses one pool tag, use it for this, too.
    //
 
    ULONG           OwnerTag;
 
    //
    // This must be initialized to the size of the data block,
    // including this structure.
    //
 
    ULONG           Size;
 
} DBGKD_DEBUG_DATA_HEADER64, * PDBGKD_DEBUG_DATA_HEADER64;
 
typedef struct _KDDEBUGGER_DATA64 {
 
    DBGKD_DEBUG_DATA_HEADER64 Header;
 
    //
    // Base address of kernel image
    //
 
    ULONG64   KernBase;
 
    //
    // DbgBreakPointWithStatus is a function which takes an argument
    // and hits a breakpoint.  This field contains the address of the
    // breakpoint instruction.  When the debugger sees a breakpoint
    // at this address, it may retrieve the argument from the first
    // argument register, or on x86 the eax register.
    //
 
    ULONG64   BreakpointWithStatus;       // address of breakpoint
 
    //
    // Address of the saved context record during a bugcheck
    //
    // N.B. This is an automatic in KeBugcheckEx's frame, and
    // is only valid after a bugcheck.
    //
 
    ULONG64   SavedContext;
 
    //
    // help for walking stacks with user callbacks:
    //
 
    //
    // The address of the thread structure is provided in the
    // WAIT_STATE_CHANGE packet.  This is the offset from the base of
    // the thread structure to the pointer to the kernel stack frame
    // for the currently active usermode callback.
    //
 
    USHORT  ThCallbackStack;            // offset in thread data
 
    //
    // these values are offsets into that frame:
    //
 
    USHORT  NextCallback;               // saved pointer to next callback frame
    USHORT  FramePointer;               // saved frame pointer
 
    //
    // pad to a quad boundary
    //
    USHORT  PaeEnabled : 1;
    USHORT  KiBugCheckRecoveryActive : 1; // Windows 10 Manganese Addition
    USHORT  PagingLevels : 4;
 
    //
    // Address of the kernel callout routine.
    //
 
    ULONG64   KiCallUserMode;             // kernel routine
 
    //
    // Address of the usermode entry point for callbacks.
    //
 
    ULONG64   KeUserCallbackDispatcher;   // address in ntdll
 
 
    //
    // Addresses of various kernel data structures and lists
    // that are of interest to the kernel debugger.
    //
 
    ULONG64   PsLoadedModuleList;
    ULONG64   PsActiveProcessHead;
    ULONG64   PspCidTable;
 
    ULONG64   ExpSystemResourcesList;
    ULONG64   ExpPagedPoolDescriptor;
    ULONG64   ExpNumberOfPagedPools;
 
    ULONG64   KeTimeIncrement;
    ULONG64   KeBugCheckCallbackListHead;
    ULONG64   KiBugcheckData;
 
    ULONG64   IopErrorLogListHead;
 
    ULONG64   ObpRootDirectoryObject;
    ULONG64   ObpTypeObjectType;
 
    ULONG64   MmSystemCacheStart;
    ULONG64   MmSystemCacheEnd;
    ULONG64   MmSystemCacheWs;
 
    ULONG64   MmPfnDatabase;
    ULONG64   MmSystemPtesStart;
    ULONG64   MmSystemPtesEnd;
    ULONG64   MmSubsectionBase;
    ULONG64   MmNumberOfPagingFiles;
 
    ULONG64   MmLowestPhysicalPage;
    ULONG64   MmHighestPhysicalPage;
    ULONG64   MmNumberOfPhysicalPages;
 
    ULONG64   MmMaximumNonPagedPoolInBytes;
    ULONG64   MmNonPagedSystemStart;
    ULONG64   MmNonPagedPoolStart;
    ULONG64   MmNonPagedPoolEnd;
 
    ULONG64   MmPagedPoolStart;
    ULONG64   MmPagedPoolEnd;
    ULONG64   MmPagedPoolInformation;
    ULONG64   MmPageSize;
 
    ULONG64   MmSizeOfPagedPoolInBytes;
 
    ULONG64   MmTotalCommitLimit;
    ULONG64   MmTotalCommittedPages;
    ULONG64   MmSharedCommit;
    ULONG64   MmDriverCommit;
    ULONG64   MmProcessCommit;
    ULONG64   MmPagedPoolCommit;
    ULONG64   MmExtendedCommit;
 
    ULONG64   MmZeroedPageListHead;
    ULONG64   MmFreePageListHead;
    ULONG64   MmStandbyPageListHead;
    ULONG64   MmModifiedPageListHead;
    ULONG64   MmModifiedNoWritePageListHead;
    ULONG64   MmAvailablePages;
    ULONG64   MmResidentAvailablePages;
 
    ULONG64   PoolTrackTable;
    ULONG64   NonPagedPoolDescriptor;
 
    ULONG64   MmHighestUserAddress;
    ULONG64   MmSystemRangeStart;
    ULONG64   MmUserProbeAddress;
 
    ULONG64   KdPrintCircularBuffer;
    ULONG64   KdPrintCircularBufferEnd;
    ULONG64   KdPrintWritePointer;
    ULONG64   KdPrintRolloverCount;
 
    ULONG64   MmLoadedUserImageList;
 
    // NT 5.1 Addition
 
    ULONG64   NtBuildLab;
    ULONG64   KiNormalSystemCall;
 
    // NT 5.0 hotfix addition
 
    ULONG64   KiProcessorBlock;
    ULONG64   MmUnloadedDrivers;
    ULONG64   MmLastUnloadedDriver;
    ULONG64   MmTriageActionTaken;
    ULONG64   MmSpecialPoolTag;
    ULONG64   KernelVerifier;
    ULONG64   MmVerifierData;
    ULONG64   MmAllocatedNonPagedPool;
    ULONG64   MmPeakCommitment;
    ULONG64   MmTotalCommitLimitMaximum;
    ULONG64   CmNtCSDVersion;
 
    // NT 5.1 Addition
 
    ULONG64   MmPhysicalMemoryBlock;
    ULONG64   MmSessionBase;
    ULONG64   MmSessionSize;
    ULONG64   MmSystemParentTablePage;
 
    // Server 2003 addition
 
    ULONG64   MmVirtualTranslationBase;
 
    USHORT    OffsetKThreadNextProcessor;
    USHORT    OffsetKThreadTeb;
    USHORT    OffsetKThreadKernelStack;
    USHORT    OffsetKThreadInitialStack;
 
    USHORT    OffsetKThreadApcProcess;
    USHORT    OffsetKThreadState;
    USHORT    OffsetKThreadBStore;
    USHORT    OffsetKThreadBStoreLimit;
 
    USHORT    SizeEProcess;
    USHORT    OffsetEprocessPeb;
    USHORT    OffsetEprocessParentCID;
    USHORT    OffsetEprocessDirectoryTableBase;
 
    USHORT    SizePrcb;
    USHORT    OffsetPrcbDpcRoutine;
    USHORT    OffsetPrcbCurrentThread;
    USHORT    OffsetPrcbMhz;
 
    USHORT    OffsetPrcbCpuType;
    USHORT    OffsetPrcbVendorString;
    USHORT    OffsetPrcbProcStateContext;
    USHORT    OffsetPrcbNumber;
 
    USHORT    SizeEThread;
 
    UCHAR     L1tfHighPhysicalBitIndex;  // Windows 10 19H1 Addition
    UCHAR     L1tfSwizzleBitIndex;       // Windows 10 19H1 Addition
 
    ULONG     Padding0;
 
    ULONG64   KdPrintCircularBufferPtr;
    ULONG64   KdPrintBufferSize;
 
    ULONG64   KeLoaderBlock;
 
    USHORT    SizePcr;
    USHORT    OffsetPcrSelfPcr;
    USHORT    OffsetPcrCurrentPrcb;
    USHORT    OffsetPcrContainedPrcb;
 
    USHORT    OffsetPcrInitialBStore;
    USHORT    OffsetPcrBStoreLimit;
    USHORT    OffsetPcrInitialStack;
    USHORT    OffsetPcrStackLimit;
 
    USHORT    OffsetPrcbPcrPage;
    USHORT    OffsetPrcbProcStateSpecialReg;
    USHORT    GdtR0Code;
    USHORT    GdtR0Data;
 
    USHORT    GdtR0Pcr;
    USHORT    GdtR3Code;
    USHORT    GdtR3Data;
    USHORT    GdtR3Teb;
 
    USHORT    GdtLdt;
    USHORT    GdtTss;
    USHORT    Gdt64R3CmCode;
    USHORT    Gdt64R3CmTeb;
 
    ULONG64   IopNumTriageDumpDataBlocks;
    ULONG64   IopTriageDumpDataBlocks;
 
    // Longhorn addition
 
    ULONG64   VfCrashDataBlock;
    ULONG64   MmBadPagesDetected;
    ULONG64   MmZeroedPageSingleBitErrorsDetected;
 
    // Windows 7 addition
 
    ULONG64   EtwpDebuggerData;
    USHORT    OffsetPrcbContext;
 
    // Windows 8 addition
 
    USHORT    OffsetPrcbMaxBreakpoints;
    USHORT    OffsetPrcbMaxWatchpoints;
 
    ULONG     OffsetKThreadStackLimit;
    ULONG     OffsetKThreadStackBase;
    ULONG     OffsetKThreadQueueListEntry;
    ULONG     OffsetEThreadIrpList;
 
    USHORT    OffsetPrcbIdleThread;
    USHORT    OffsetPrcbNormalDpcState;
    USHORT    OffsetPrcbDpcStack;
    USHORT    OffsetPrcbIsrStack;
 
    USHORT    SizeKDPC_STACK_FRAME;
 
    // Windows 8.1 Addition
 
    USHORT    OffsetKPriQueueThreadListHead;
    USHORT    OffsetKThreadWaitReason;
 
    // Windows 10 RS1 Addition
 
    USHORT    Padding1;
    ULONG64   PteBase;
 
    // Windows 10 RS5 Addition
 
    ULONG64   RetpolineStubFunctionTable;
    ULONG     RetpolineStubFunctionTableSize;
    ULONG     RetpolineStubOffset;
    ULONG     RetpolineStubSize;
 
    // Windows 10 Iron Addition
 
    USHORT OffsetEProcessMmHotPatchContext;
 
} KDDEBUGGER_DATA64, * PKDDEBUGGER_DATA64;
 
typedef struct _DBGKD_GET_VERSION64 {
    USHORT  MajorVersion;
    USHORT  MinorVersion;
    USHORT  ProtocolVersion;
    USHORT  Flags;
    USHORT  MachineType;
    UCHAR   MaxPacketType;
    UCHAR   MaxStateChange;
    UCHAR   MaxManipulate;
    UCHAR   Simulation;
    USHORT  Unused[1];
    ULONG64 KernBase;
    ULONG64 PsLoadedModuleList;
    PKDDEBUGGER_DATA64 DebuggerDataList;
} DBGKD_GET_VERSION64, * PDBGKD_GET_VERSION64;
 
 
typedef enum _SYSDBG_COMMAND {
    SysDbgQueryModuleInformation,
    SysDbgQueryTraceInformation,
    SysDbgSetTracepoint,
    SysDbgSetSpecialCall,
    SysDbgClearSpecialCalls,
    SysDbgQuerySpecialCalls,
    SysDbgBreakPoint,
    SysDbgQueryVersion,
    SysDbgReadVirtual,
    SysDbgWriteVirtual,
    SysDbgReadPhysical,
    SysDbgWritePhysical,
    SysDbgReadControlSpace,
    SysDbgWriteControlSpace,
    SysDbgReadIoSpace,
    SysDbgWriteIoSpace,
    SysDbgReadMsr,
    SysDbgWriteMsr,
    SysDbgReadBusData,
    SysDbgWriteBusData,
    SysDbgCheckLowMemory,
    SysDbgEnableKernelDebugger,
    SysDbgDisableKernelDebugger,
    SysDbgGetAutoKdEnable,
    SysDbgSetAutoKdEnable,
    SysDbgGetPrintBufferSize,
    SysDbgSetPrintBufferSize,
    SysDbgGetKdUmExceptionEnable,
    SysDbgSetKdUmExceptionEnable,
    SysDbgGetTriageDump,
    SysDbgGetKdBlockEnable,
    SysDbgSetKdBlockEnable,
} SYSDBG_COMMAND, * PSYSDBG_COMMAND;
 
NTKERNELAPI
NTSTATUS
KdSystemDebugControl(
    __in SYSDBG_COMMAND Command,
    __inout_bcount_opt(InputBufferLength) PVOID InputBuffer,
    __in ULONG InputBufferLength,
    __out_bcount(OutputBufferLength) PVOID OutputBuffer,
    __out_opt ULONG OutputBufferLength,
    __out_opt PULONG ReturnLength,
    __in KPROCESSOR_MODE PreviousMode
);
 
 
NTSTATUS DriverUnload(PDRIVER_OBJECT pDriver)
{
    return STATUS_SUCCESS;
}
 
 
VOID GetKdVersionBlock(PDBGKD_GET_VERSION64 KdVersionBlock)
{
    KdBreakPoint();
    KdSystemDebugControl
    (
        SysDbgQueryVersion,
        NULL,
        0,
        KdVersionBlock,
        sizeof(DBGKD_GET_VERSION64),
        NULL,
        UserMode
    );
}
 
 
/////////////////////////
//
//      通过KdSystemDebugControl定位KDDEBUGGER_DATA64
//    
//
//
 
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING pReg)
{
    PDBGKD_GET_VERSION64 VersionBlock = ExAllocatePool(NonPagedPool, sizeof(DBGKD_GET_VERSION64));
    GetKdVersionBlock(VersionBlock);
    KDDEBUGGER_DATA64* KdDebugData64 = *(KDDEBUGGER_DATA64**)VersionBlock->DebuggerDataList;
    KdPrint(("PspCidTable:%p KernBase:%p", *(ULONG64*)KdDebugData64->PspCidTable, VersionBlock->KernBase));
    ExFreePool(VersionBlock);
    pDriver->DriverUnload = DriverUnload;
    return STATUS_SUCCESS;
}
#include <ntifs.h>
 
 
 
typedef struct _DBGKD_DEBUG_DATA_HEADER64 {
 
    //
    // Link to other blocks
    //
 
    LIST_ENTRY64 List;
 
    //
    // This is a unique tag to identify the owner of the block.
    // If your component only uses one pool tag, use it for this, too.
    //
 
    ULONG           OwnerTag;
 
    //
    // This must be initialized to the size of the data block,
    // including this structure.
    //
 
    ULONG           Size;
 
} DBGKD_DEBUG_DATA_HEADER64, * PDBGKD_DEBUG_DATA_HEADER64;
 
typedef struct _KDDEBUGGER_DATA64 {
 
    DBGKD_DEBUG_DATA_HEADER64 Header;
 
    //
    // Base address of kernel image
    //
 
    ULONG64   KernBase;
 
    //
    // DbgBreakPointWithStatus is a function which takes an argument
    // and hits a breakpoint.  This field contains the address of the
    // breakpoint instruction.  When the debugger sees a breakpoint
    // at this address, it may retrieve the argument from the first
    // argument register, or on x86 the eax register.
    //
 
    ULONG64   BreakpointWithStatus;       // address of breakpoint
 
    //
    // Address of the saved context record during a bugcheck
    //
    // N.B. This is an automatic in KeBugcheckEx's frame, and
    // is only valid after a bugcheck.
    //
 
    ULONG64   SavedContext;
 
    //
    // help for walking stacks with user callbacks:
    //
 
    //
    // The address of the thread structure is provided in the
    // WAIT_STATE_CHANGE packet.  This is the offset from the base of
    // the thread structure to the pointer to the kernel stack frame
    // for the currently active usermode callback.
    //
 
    USHORT  ThCallbackStack;            // offset in thread data
 
    //
    // these values are offsets into that frame:
    //
 
    USHORT  NextCallback;               // saved pointer to next callback frame
    USHORT  FramePointer;               // saved frame pointer
 
    //
    // pad to a quad boundary
    //
    USHORT  PaeEnabled : 1;
    USHORT  KiBugCheckRecoveryActive : 1; // Windows 10 Manganese Addition
    USHORT  PagingLevels : 4;
 
    //
    // Address of the kernel callout routine.
    //
 
    ULONG64   KiCallUserMode;             // kernel routine
 
    //
    // Address of the usermode entry point for callbacks.
    //
 
    ULONG64   KeUserCallbackDispatcher;   // address in ntdll
 
 
    //
    // Addresses of various kernel data structures and lists
    // that are of interest to the kernel debugger.
    //
 
    ULONG64   PsLoadedModuleList;
    ULONG64   PsActiveProcessHead;
    ULONG64   PspCidTable;
 
    ULONG64   ExpSystemResourcesList;
    ULONG64   ExpPagedPoolDescriptor;
    ULONG64   ExpNumberOfPagedPools;
 
    ULONG64   KeTimeIncrement;
    ULONG64   KeBugCheckCallbackListHead;
    ULONG64   KiBugcheckData;
 
    ULONG64   IopErrorLogListHead;
 
    ULONG64   ObpRootDirectoryObject;
    ULONG64   ObpTypeObjectType;
 
    ULONG64   MmSystemCacheStart;
    ULONG64   MmSystemCacheEnd;
    ULONG64   MmSystemCacheWs;
 
    ULONG64   MmPfnDatabase;
    ULONG64   MmSystemPtesStart;
    ULONG64   MmSystemPtesEnd;
    ULONG64   MmSubsectionBase;
    ULONG64   MmNumberOfPagingFiles;
 
    ULONG64   MmLowestPhysicalPage;
    ULONG64   MmHighestPhysicalPage;
    ULONG64   MmNumberOfPhysicalPages;
 
    ULONG64   MmMaximumNonPagedPoolInBytes;
    ULONG64   MmNonPagedSystemStart;
    ULONG64   MmNonPagedPoolStart;
    ULONG64   MmNonPagedPoolEnd;
 
    ULONG64   MmPagedPoolStart;
    ULONG64   MmPagedPoolEnd;
    ULONG64   MmPagedPoolInformation;
    ULONG64   MmPageSize;
 
    ULONG64   MmSizeOfPagedPoolInBytes;
 
    ULONG64   MmTotalCommitLimit;
    ULONG64   MmTotalCommittedPages;
    ULONG64   MmSharedCommit;
    ULONG64   MmDriverCommit;
    ULONG64   MmProcessCommit;
    ULONG64   MmPagedPoolCommit;
    ULONG64   MmExtendedCommit;
 
    ULONG64   MmZeroedPageListHead;
    ULONG64   MmFreePageListHead;
    ULONG64   MmStandbyPageListHead;
    ULONG64   MmModifiedPageListHead;
    ULONG64   MmModifiedNoWritePageListHead;
    ULONG64   MmAvailablePages;
    ULONG64   MmResidentAvailablePages;
 
    ULONG64   PoolTrackTable;
    ULONG64   NonPagedPoolDescriptor;
 
    ULONG64   MmHighestUserAddress;
    ULONG64   MmSystemRangeStart;
    ULONG64   MmUserProbeAddress;
 
    ULONG64   KdPrintCircularBuffer;
    ULONG64   KdPrintCircularBufferEnd;
    ULONG64   KdPrintWritePointer;
    ULONG64   KdPrintRolloverCount;
 
    ULONG64   MmLoadedUserImageList;
 
    // NT 5.1 Addition
 
    ULONG64   NtBuildLab;
    ULONG64   KiNormalSystemCall;
 
    // NT 5.0 hotfix addition
 
    ULONG64   KiProcessorBlock;
    ULONG64   MmUnloadedDrivers;
    ULONG64   MmLastUnloadedDriver;
    ULONG64   MmTriageActionTaken;
    ULONG64   MmSpecialPoolTag;
    ULONG64   KernelVerifier;
    ULONG64   MmVerifierData;
    ULONG64   MmAllocatedNonPagedPool;
    ULONG64   MmPeakCommitment;
    ULONG64   MmTotalCommitLimitMaximum;
    ULONG64   CmNtCSDVersion;
 
    // NT 5.1 Addition
 
    ULONG64   MmPhysicalMemoryBlock;
    ULONG64   MmSessionBase;
    ULONG64   MmSessionSize;
    ULONG64   MmSystemParentTablePage;
 
    // Server 2003 addition
 
    ULONG64   MmVirtualTranslationBase;
 
    USHORT    OffsetKThreadNextProcessor;
    USHORT    OffsetKThreadTeb;
    USHORT    OffsetKThreadKernelStack;
    USHORT    OffsetKThreadInitialStack;
 
    USHORT    OffsetKThreadApcProcess;

[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)

最后于 2021-12-2 18:32 被zx_687333编辑 ,原因:
收藏
免费 2
支持
分享
最新回复 (12)
雪    币: 1525
活跃值: (3422)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
2
那么问题来了,这个结构体是微软公开的吗
2021-12-2 17:49
0
雪    币: 515
活跃值: (3272)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
wem
3

可以用于win10隐藏进程吗?

触发pg吗?

最后于 2021-12-2 22:29 被wem编辑 ,原因:
2021-12-2 22:19
0
雪    币: 6166
活跃值: (4937)
能力值: ( LV10,RANK:160 )
在线值:
发帖
回帖
粉丝
4
mark
2021-12-3 00:03
0
雪    币: 0
活跃值: (45)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
5
wem 可以用于win10隐藏进程吗?触发pg吗?
隐藏进程,已经不需要PatchGuard了,最新技术无限钩,w7-w11 隐藏进程完美实现。
2022-4-12 12:45
0
雪    币: 300
活跃值: (2472)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
6
mark
2022-4-12 15:57
0
雪    币: 1095
活跃值: (655)
能力值: ( LV3,RANK:20 )
在线值:
发帖
回帖
粉丝
7
编程与少年 隐藏进程,已经不需要PatchGuard了,最新技术无限钩,w7-w11 隐藏进程完美实现。
大佬  能指条路么   想学学新技术
2022-4-15 22:32
0
雪    币: 22
能力值: ( LV1,RANK:0 )
在线值:
发帖
回帖
粉丝
8
不开内核调试模式能KdSystemDebugControl?
2022-5-30 02:18
0
雪    币: 283
活跃值: (998)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
9
好像并不行 没开启调试模式的话KdSystemDebugControl会失败
2022-6-5 21:53
0
雪    币: 410
活跃值: (1168)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
10
在系统启动的时候会判断那些标志位 开启了才会填充这个结构体.此贴终结
2022-6-8 17:13
0
雪    币: 3836
活跃值: (4142)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
11

支持

最后于 2022-8-26 17:04 被caolinkai编辑 ,原因:
2022-8-26 17:03
0
雪    币: 436
活跃值: (2668)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
12
mark一下。
2022-9-8 17:28
0
雪    币: 1282
活跃值: (4555)
能力值: ( LV6,RANK:90 )
在线值:
发帖
回帖
粉丝
13
如梦而醉 在系统启动的时候会判断那些标志位 开启了才会填充这个结构体.此贴终结
2022-10-25 19:33
0
游客
登录 | 注册 方可回帖
返回
//