HanDs
NO.2

[Delphi文章] 用delphi写的SSDTView 





学习中请遵循国家相关法律法规,黑客不作恶。没有网络安全就没有国家安全

本站需要登陆后才能查看

unit SSDT;
interface
uses SysUtils,windows,Graphics;

const
STATUS_INFO_LENGTH_MISMATCH=$C0000004;
SysDbgReadVirtualMemory = 8;
SysDbgWriteVirtualMemory = 9;

//一些常用的内型
type
NTSTATUS=ULONG;
PVOID =Pointer;
PImageBaseRelocation=^TImageBaseRelocation;
  TImageBaseRelocation=Packed Record
     VirtualAddress: DWORD;
     SizeOfBlock: DWORD;
     //TypeOffset: array[0..1] of Word;
end;

PModuleInformation=^TModuleInformation;
TModuleInformation=packed record
    Reserved:array[0..1] of ULONG ;
    Baseongint;
    Sizeongint;
    Flags: Longint;
    Index:Smallint;
    Unknown : Smallint;
    Loadcount: Smallint;
    ModuleNameOffset:Smallint;
    ImageName:array[0..255] of  CHAR;
end;

PMEMORY_CHUNKS=^TMEMORY_CHUNKS;
TMEMORY_CHUNKS=  packed record
    Address:ULONG;
    DataVOID;
    Length:ULONG;
end;

TSSDT_LIST_ENTRY=packed record
fname:sTRING;
address1:ULONG; //原始地址
address2:ULONG; //目前内存地址
end;
TSSDT_LIST_ARRAY=array of TSSDT_LIST_ENTRY;
type
PArray=^TArray;
TArray=array[0..4196] of DWORD;

function  ZwQuerySystemInformation(SystemInformationClass: ULONG; SystemInformation: PVOID; SystemInformationLength: ULONG; lpReturnLength: PULONG): NTSTATUS; stdcall; external 'ntdll.dll' name 'ZwQuerySystemInformation';
function  ZwSystemDebugControl(ControlCode:integer;InputBufferVOID;InputBufferLength:ulong;OutputBufferVOID;OutputBufferLength:ulong;ReturnLengthULONG): NTSTATUS; stdcall; external 'ntdll.dll' name 'ZwSystemDebugControl';
function LocateNtdllEntry():BOOL;
function GetHeaders(ibaseCHAR;var pfh:PImageFileHeader;var poh:PImageOptionalHeader;var psh:PImageSectionHeader)WORD;
procedure FindExport();
function FindKiServiceTable(hModule:HMODULE ;dwKSDTWORD)WORD;
function DebugPrivilege(PName:PCHAR;bEnable:BOOL):BOOL;
procedure GetSSDT();
var
ssdt_list:TSSDT_LIST_ARRAY;
dwKSDTWORD;                // rva of KeServiceDescriptorTable
dwKiServiceTableWORD;    // rva of KiServiceTable
dwKernelBase,dwServices:DWORD;
implementation
  uses unit1;
function LocateNtdllEntry():BOOL;
var
ntdll:THandle;
PFunc:TFarProc;
begin
ntdll:=GetModuleHandle('ntdll.dll');
if ntdll=0 then
result:=False;
pFunc:=GetProcAddress(ntdll,'ZwQuerySystemInformation');
if pFunc=nil then
result:=False;
end;

function GetHeaders(ibase:PCHAR;var pfh:PImageFileHeader;var poh:PImageOptionalHeader;var psh:PImageSectionHeader):DWORD;
var
mzhead: PImageDosHeader;
nthead: PImageNtHeaders;
begin
mzhead:=PImageDosHeader(ibase);
if (mzhead^.e_magic<>IMAGE_DOS_SIGNATURE)  then
begin
result:=0;
exit;
end;
nthead:=PImageNtHeaders(ibase+DWORD(mzhead^._lfanew));
if  nthead^.Signature<> IMAGE_NT_SIGNATURE  then
begin
result:=0;
exit;
end;

pfh:=PImageFileHeader(ibase + DWORD(mzhead^._lfanew) + Sizeof(DWORD));
poh:=PImageOptionalHeader(ibase + DWORD(mzhead^._lfanew) + Sizeof(DWORD)+ sizeof(IMAGE_FILE_HEADER) );
if poh^.Magic<> $10b then
begin
result:=0;
exit;
end;
psh:=PImageSectionHeader( ibase + DWORD(mzhead^._lfanew) + Sizeof(DWORD) + sizeof(IMAGE_FILE_HEADER) + Sizeof(IMAGE_OPTIONAL_HEADER) ) ;
result:=1;
end;

//搜索函数名称
procedure FindExport();
var
pfh:PImageFileHeader;
poh:PImageOptionalHeader;
psh:PImageSectionHeader;
ped:PImageExportDirectory;
arrayOfFunctionNames:PArray;
arrayOfFunctionAddresses:PArray;
arrayOfFunctionOrdinals: PWordArray;
functionOrdinal,functionAddress:DWORD;
hNtdll:THandle;
i:integer;
funcName: PChar;
number:Word;
begin
hNtdll:=GetModuleHandle('ntdll.dll');
GetHeaders(PCHAR(hNtdll),pfh,poh,psh);
if(poh^.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress<>0) then
begin
  ped:= PImageExportDirectory( poh^.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress + pchar(hNtdll) );
  arrayOfFunctionNames:= PArray( hNtdll+ DWORD(ped^.AddressOfNames));
  arrayOfFunctionAddresses:= PArray(hNtdll+ DWORD(ped^.AddressOfFunctions));
  arrayOfFunctionOrdinals:=   PWordArray(hNtdll+ WORD(ped^.AddressOfNameOrdinals));
end;
SetLength(ssdt_list,ped^.NumberOfNames);
for i:= 0 to ped^.NumberOfNames -1 do
begin
  funcName:=PCHAR(hNtdll+ arrayOfFunctionNames[i]);
  functionOrdinal :=  arrayOfFunctionOrdinals[i] + ped^.Base - 1;
  functionAddress:= DWORD( hNtdll + arrayOfFunctionAddresses[functionOrdinal]);
  if (Copy(funcName,1,2)='Nt') then
  begin
    number:=(PWORD(functionAddress+1))^;
    if (number>ped^.NumberOfNames) then continue;
     ssdt_list[number].fname:=StrPas(funcName);
    //messagebox(0,pchar(inttostr(number)+'  '+StrPas(funcName)),'sad',0);
  end;
end;

end;
// 根据 KeServiceDescriptorTable 的RVA查找 KiServiceTable
function FindKiServiceTable(hModule:HMODULE ;dwKSDT:DWORD):DWORD;
var
pfh:PImageFileHeader;
poh:PImageOptionalHeader;
psh:PImageSectionHeader;
pbr:PImageBaseRelocation;
pfe:PWORD;
i,dwPointerRva,dwPointsToRva,dwKiServiceTable:DWORD;
bFirstChunk:BOOL;
begin
  GetHeaders(PCHAR(hModule),pfh,poh,psh);
if (poh^.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress<>0) then
begin
    pbr:=PImageBaseRelocation(POINTER(DWORD(hModule)+DWORD(poh^.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress)));
    bFirstChunk:=TRUE;
    while(bFirstChunk or (pbr^.VirtualAddress<>0)) do
    begin
      bFirstChunk:=FALSE;
      pfe:=PWORD(DWORD(pbr)+sizeof(TImageBaseRelocation)) ;
      for i:=0 to ((pbr^.SizeOfBlock-sizeof(TImageBaseRelocation)) shr 1)-1 do
      begin
        if(( (pfe^ and $F000) shr 12 ) = 3 ) then
        begin
         dwPointerRva:=pbr^.VirtualAddress + (pfe^ and $0FFF);
         dwPointsToRva:=(PDWORD(DWORD(hModule)+dwPointerRva))^ - DWORD(poh^.ImageBase);
         if (dwPointsToRva=dwKSDT)  then
         begin
          //这里要具体分析一下
          if((PWORD(DWORD(hModule)+dwPointerRva-2))^=$05c7)  then
          begin
          dwKiServiceTable:=(PDWORD(DWORD(hModule) + dwPointerRva +4))^ - poh^.ImageBase;
          Result:= dwKiServiceTable;
          EXIT;
          end;
         end;
        end;
       pfe:=PWORD(DWORD(pfe)+sizeof(WORD));
      end;
      (PDWORD(@pbr))^ := (PDWORD(@pbr))^ + pbr^.SizeOfBlock;
    end;
end;
  result:=0;
end;

procedure GetSSDT();
var
hKernel: HMODULE    ;
pKernelName: PCHAR ;
pService:PDWORD ;
pfh:PImageFileHeader;
poh:PImageOptionalHeader;
psh:PImageSectionHeader;
n:ULONG;
P:PULONG;
module,s:PModuleInformation;
nowaddress:PDWORD;
QueryBuff: TMEMORY_CHUNKS;
ReturnLength:DWORD;
i,j:integer;
begin
  ZwQuerySystemInformation(11,0,0,@n); //查询长度
  GetMem(p,sizeof(ULONG)*n); //分配空间
  ZwQuerySystemInformation(11,p,n*sizeof(ULONG),nil);   //通过长度查询内容
  module:= PModuleInformation(PULONG(Ulong(p)+sizeof(ULONG)));
  dwKernelBase:=DWORD(module^.Base);
  pKernelName:=pchar(module^.ImageName+module^.ModuleNameOffset);
  hKernel:=LoadLibraryEx(pKernelName,0,DONT_RESOLVE_DLL_REFERENCES);
   // map ntoskrnl - hopefully it has relocs
  if  hKernel=0 then
  begin
  exit;
  end;
  dwKSDT:=DWORD(GetProcAddress(hKernel,'KeServiceDescriptorTable'));
  if  dwKSDT=0 then
  begin
  exit;
  end;
  //得到KeServiceDescriptorTable的相对偏移
  dwKSDT:=dwKSDT-DWORD(hKernel);
  dwKiServiceTable:=FindKiServiceTable(hKernel,dwKSDT);
  GetHeaders(PCHAR(hKernel),pfh,poh,psh);
  dwServices:=0;
  pService:=PDWORD((DWORD(hKernel)+dwKiServiceTable));
  while ( (pService^- poh^.ImageBase)<poh^.SizeOfImage ) do
  begin
  ssdt_list[dwServices].address1:=pService^ - poh^.ImageBase + dwKernelBase;//dwKernelBase查询的模块地址
  pService:=PDWORD(DWORD(pService)+sizeof(DWORD));
  inc(dwServices);
  end;
  FreeLibrary(hKernel);

   GetMem(nowaddress,sizeof(DWORD)* dwServices);
   QueryBuff.Address:=  dwKernelBase+dwKiServiceTable;
   QueryBuff.Data:= nowaddress;
   QueryBuff.Length:=sizeof(DWORD)* dwServices;
  ZwSystemDebugControl(SysDbgReadVirtualMemory,
                       @QueryBuff,
                       sizeof(QueryBuff),
                       nil,
                       0,
                       @ReturnLength);

   // messagebox(0,pchar(inttohex(Ulong(QueryBuff),4)),'lk',0);
//把结果输出来
form1.ListView1.Clear;
i:=0;
while(i<dwServices) do
begin
  form1.ListView1.Items.Add;
  form1.ListView1.Items.Item[i].Caption:='0x'+inttohex(i,2);
  form1.ListView1.Items.Item[i].SubItems.add( ssdt_list[i].fname);
  form1.ListView1.Items.Item[i].SubItems.add('0x'+inttohex(ssdt_list[i].address1,4));
  ssdt_list[i].address2:= nowaddress^;
  form1.ListView1.Items.Item[i].SubItems.add('0x'+inttohex(ssdt_list[i].address2,4));
  nowaddress:=PDWORD(DWORD(nowaddress)+sizeof(DWORD));
  s:=module;
   //搜索模块
   for j:=0 to p^-1 do
   begin
    if(ssdt_list[i].address2>DWORD(s^.Base)) and (ssdt_list[i].address2<DWORD(s^.Base+ s^.Size) )  then
     begin
       form1.Listview1.Items.Item[i].SubItems.add(s^.ImageName);
       break;
    end;
    s:=PModuleInformation(DWORD(module)+sizeof(TModuleInformation)*J);
  end;
  inc(i);
end;
    FreeMem(p);
end;
//使用 ZwSystemDebugControl前必须提权
function DebugPrivilege(PName:PCHAR;bEnable:BOOL):BOOL;
var
Ok:BOOL;
hToken:THANDLE;
tp,tkpo: TTokenPrivileges;
lBufferNeeded:DWORD;
begin
if (OpenProcessToken(GetCurrentProcess,TOKEN_QUERY or TOKEN_ADJUST_PRIVILEGES,hToken)) then
begin
  tp.PrivilegeCount:=1;
  if  bEnable then
  tp.Privileges[0].Attributes:=SE_PRIVILEGE_ENABLED;
  LookupPrivilegeValue(nil,PName,tp.Privileges[0].Luid);
  AdjustTokenPrivileges(hToken, False, tp, Sizeof(TOKEN_PRIVILEGES), TKPO, lBufferNeeded);
  if  GetLastError()=ERROR_SUCCESS then
  begin
      ok:=false;
      Exit;
  end ;
  CloseHandle(hToken);
  result:=ok;
end;
end;

 

end.


学习中请遵守法律法规,本网站内容均来自于互联网,本网站不负担法律责任
de lp hi
#1楼
发帖时间:2016-7-9   |   查看数:0   |   回复数:0
游客组