bool CSysInfo::GetOSKernelName()
{
ULONG Size;
CHAR szFileName[MAX_FN_LEN];
NTSTATUS ntstatus;
PSYSTEM_MODULE_INFORMATION pModInfo,p;
ntstatus = ZwQuerySystemInformation( SystemModuleInformation,NULL,0,&Size);
if(ntstatus != STATUS_INFO_LENGTH_MISMATCH || Size==0)
return false;
p = (PSYSTEM_MODULE_INFORMATION) new BYTE[Size];
if(p==NULL)
return false;
ntstatus = ZwQuerySystemInformation( SystemModuleInformation,p,Size,0);
if(!NT_SUCCESS(ntstatus))
{
delete p;
return false;
}
pModInfo = p;
for(ULONG n=0; n<p->dCount; n++)
{
TStrCpyLimit(szFileName,(PCSTR)pModInfo->aSM[n].abName+pModInfo->aSM[n].wNameOffset,MAX_FN_LEN);
for(int i =0 ;m_gNtoskrnlName[i];i++)
{
if(TStrICmp(szFileName,m_gNtoskrnlName[i])==0)
{
TStrCpyLimit(szFileName,(PCSTR)pModInfo->aSM[n].abName,MAX_FN_LEN);
if(ConvertFileName(szFileName)==false)
{
TStrCpy(szFileName,"\\??\\");
TStrCpyLimit(szFileName,(PCSTR)pModInfo->aSM[n].abName,MAX_FN_LEN-sizeof("\\??\\"));
}
m_OSKernlBase = *(DWORD*)&pModInfo->aSM[n].pAddress;
TStrCpy(m_OSKernelName,szFileName);
::DbgPrint("Syser : Windows kernel name '%s' base=%08x\n",(PCSTR)pModInfo->aSM[n].abName+pModInfo->aSM[n].wNameOffset,m_OSKernlBase);
delete p;
return true;
}
}
}
delete p;
return false;
}
bool CSysInfo::NtcallInit()
{
CPEFile PEFile;
char FileName[MAX_FN_LEN];
CHAR*Name=NULL;
CSymbolModule* pSymbolModule;
BYTE CodeBuffer[MAX_INSTR_LEN];
int n;
ULONGLONG zwFunc[4]={0,0,0,0};
ULSIZE ReadLen;
DWORD ServiceNum;
ULONGLONG llData;
TNtcallMap::IT Iter;
CDbgModule* pDbgModule;
TStrCpy(FileName,m_szSystem32A);
TStrCat(FileName,"ntdll.dll");
PEFile.m_OpenMode|=PE_OPEN_NO_IMPORT;
if(PEFile.Open(FileName)==false)
{
::DbgPrint("Syser : Ntcall initialize failed to load PE file symbol %s\n",FileName);
return false;
}
for(n=0;n<PEFile.m_ExportFuncCount;n++)
{
if(_GET_WORD(PEFile.m_ExportFunc[n].FuncName)=='tN')
{
ReadLen = PEFile.ReadImageMemory(PEFile.m_ExportFunc[n].Address,CodeBuffer,sizeof(CodeBuffer));
if(ReadLen!=sizeof(CodeBuffer))continue;
if((CodeBuffer[0]==0xb8&&CodeBuffer[5]==0x8d&&CodeBuffer[0x9]==0xcd)||//2k
(CodeBuffer[0]==0xb8&&CodeBuffer[5]==0xba&&CodeBuffer[0xa]==0xff&&CodeBuffer[0xb]==0x12)||//xp vista windows7
(CodeBuffer[0]==0xb8&&CodeBuffer[5]==0xba&&CodeBuffer[0xa]==0xff&&CodeBuffer[0xb]==0xd2)//2003
)
{
ServiceNum = *(DWORD*)&CodeBuffer[1];
llData = PEFile.m_ExportFunc[n].Address-PEFile.m_ImageBase;
llData <<= 32;
llData |= ServiceNum;
Iter = m_NtcallMap.InsertUnique(PEFile.m_ExportFunc[n].FuncName,llData);
if(Iter==m_NtcallMap.End())continue;
}
}
}
Iter = m_NtcallMap.Find("NtQueryVirtualMemory");
if(Iter!=m_NtcallMap.End())
zwFunc[3]=*Iter;
PEFile.Close();
if(m_OSKernelName[0])
Name = m_OSKernelName;
if(Name==NULL)
{
if(gpSyser->m_pSysDebugger==NULL)
return true;
pDbgModule = gpSyser->m_pSysDebugger->GetModule((ULPOS)KeSetEvent);
if(pDbgModule==NULL)
return true;
Name = (char*)pDbgModule->m_ModuleFullName;
}
PEFile.m_OpenMode|=PE_OPEN_NO_IMPORT;
if(PEFile.Open(Name)==false)
{
::DbgPrint("Syser : Ntcall initialize failed to load PE file symbol %s\n",(char*)Name);
return true;
}
for(n=0;n<PEFile.m_ExportFuncCount;n++)
{
if(_GET_WORD(PEFile.m_ExportFunc[n].FuncName)=='wZ')
{
ReadLen = PEFile.ReadImageMemory(PEFile.m_ExportFunc[n].Address,CodeBuffer,sizeof(CodeBuffer));
if(ReadLen==sizeof(CodeBuffer))
{
if(CodeBuffer[0]==0xb8||CodeBuffer[5]==0x8d||CodeBuffer[0x9]==0x9c||CodeBuffer[0xa]==0x6a)
{
ServiceNum = *(DWORD*)&CodeBuffer[1];
llData = PEFile.m_ExportFunc[n].Address-PEFile.m_ImageBase;
llData <<= 32;
llData |= ServiceNum;
Iter = m_NtcallMap.InsertUnique(PEFile.m_ExportFunc[n].FuncName,llData);
if(zwFunc[0]==0)
zwFunc[0]=llData;
else if(zwFunc[1]==0)
zwFunc[1]=llData;
else if(zwFunc[2]==0)
zwFunc[2]=llData;
}
}
}
}
if(zwFunc[0] && zwFunc[1]&&zwFunc[2]&&zwFunc[3])
{
ULONGLONG first,second,addr1,addr2,len1,len2,len3;
if((zwFunc[0] & 0xffffffff)>(zwFunc[1] & 0xffffffff))
{
first = zwFunc[0] & 0xffffffff;
addr1 = (zwFunc[0]>>32) & 0xffffffff;
second = zwFunc[1] & 0xffffffff;
addr2 = (zwFunc[1]>>32) & 0xffffffff;
}
else
{
first=zwFunc[1] & 0xffffffff;
addr1 = (zwFunc[1]>>32) & 0xffffffff;
second=zwFunc[0] & 0xffffffff;
addr2 = (zwFunc[0]>>32) & 0xffffffff;
}
len1= (addr1-addr2) / (first-second);
if((zwFunc[1] & 0xffffffff)>(zwFunc[2] & 0xffffffff))
{
first = zwFunc[1] & 0xffffffff;
addr1 = (zwFunc[1]>>32) & 0xffffffff;
second = zwFunc[2] & 0xffffffff;
addr2 = (zwFunc[2]>>32) & 0xffffffff;
}
else
{
first=zwFunc[2] & 0xffffffff;
addr1 = (zwFunc[2]>>32) & 0xffffffff;
second=zwFunc[1] & 0xffffffff;
addr2 = (zwFunc[1]>>32) & 0xffffffff;
}
len2= (addr1-addr2) / (first-second);
if((zwFunc[0] & 0xffffffff)>(zwFunc[2] & 0xffffffff))
{
first = zwFunc[0] & 0xffffffff;
addr1 = (zwFunc[0]>>32) & 0xffffffff;
second = zwFunc[2] & 0xffffffff;
addr2 = (zwFunc[2]>>32) & 0xffffffff;
}
else
{
first=zwFunc[2] & 0xffffffff;
addr1 = (zwFunc[2]>>32) & 0xffffffff;
second=zwFunc[0] & 0xffffffff;
addr2 = (zwFunc[0]>>32) & 0xffffffff;
}
len3= (addr1-addr2) / (first-second);
addr2=0;
if(len2 == len1 || len2 == len3)
{
if((zwFunc[0] & 0xffffffff)>(zwFunc[3] & 0xffffffff))
{
first = zwFunc[0] & 0xffffffff;
second = zwFunc[3] & 0xffffffff;
addr1 = (zwFunc[0] >> 32) & 0xffffffff;
addr2 = addr1 -(first - second)*len1;
}
else
{
first = zwFunc[3] & 0xffffffff;
second = zwFunc[0] & 0xffffffff;
addr1 = (zwFunc[0] >> 32) & 0xffffffff;
addr2 = addr1 + (first - second)*len1;
}
}
if(m_OSKernlBase)
{
addr2+=m_OSKernlBase;
m_pZwQueryVirtualMemory = *(ZWQUERYVIRTUALMEMORY*)&addr2;
DbgPrint("Syser : Find ZwQueryVirtualMemory address %08x\n",m_pZwQueryVirtualMemory);
}
}
PEFile.Close();
return true;
}
