-
-
[原创]逆ExpLookupHandleTableEntry
-
-
[原创]逆ExpLookupHandleTableEntry
额，最近在补内核的基础，看到对象那里，然后就想起之前32位下的PspCidTable了。
好像也没人发，然后逆了下Win7 64 下的这个函数。。比较简单，大牛飘过。。。
优化代码
PEPROCESS MyWin764_ExpLookupHandleTableEntry(
IN PVOID HandleTable,
IN HANDLE LookupHandle,
IN BOOLEAN bClear)
{
PEPROCESS pResult = NULL;
ULONG uIndex = (ULONG)((ULONG_PTR)LookupHandle & 0xfffffffc);
PULONG pNextHandleNeedingPool = (PULONG)((PUCHAR)HandleTable + 0x5c);
PULONG_PTR pTable = NULL;
ULONG uLayer = 0;
if (HandleTable == NULL) goto _EXIT;
if (uIndex >= *pNextHandleNeedingPool) goto _EXIT;
pTable = (PULONG_PTR)(*(PULONG_PTR)HandleTable);
uLayer = (ULONG)((ULONG_PTR)pTable & 3);
pTable = (PULONG_PTR)((ULONG_PTR)pTable - uLayer);
switch (uLayer)
{
case 0:
pResult = *(PEPROCESS *)((ULONG_PTR)pTable + 4 * uIndex);
if (bClear) *(PEPROCESS *)((ULONG_PTR)pTable + 4 * uIndex) = 0;
break;
case 1:
pResult = *(PEPROCESS *)(pTable[uIndex / 1024] + 4 * (uIndex % 1024));
if (bClear) *(PEPROCESS *)(pTable[uIndex / 1024] + 4 * (uIndex % 1024)) = 0;
break;
case 2:
pResult = *(PEPROCESS *)(*(PULONG_PTR)(pTable[uIndex / 1024 / 4096] + 8 * (uIndex / 1024 % 4096)) + 4 * (uIndex % 1024));
if (bClear) *(PEPROCESS *)(*(PULONG_PTR)(pTable[uIndex / 1024 / 4096] + 8 * (uIndex / 1024 % 4096)) + 4 * (uIndex % 1024)) = 0;
break;
default:
break;
}
_EXIT:
return (PEPROCESS)((ULONG_PTR)pResult & 0xfffffffffffffffc);
}
F5代码
signed __int64 __fastcall ExpLookupHandleTableEntry(__int64 a1, unsigned __int64 a2)
{
__int64 v2; // r8@2
signed __int64 v3; // rcx@2
__int64 v4; // r8@2
signed __int64 result; // rax@4
unsigned __int64 v6; // [sp+8h] [bp+8h]@1
v6 = a2;
LODWORD(v6) = a2 & 0xFFFFFFFC;
if ( v6 >= *(_DWORD *)(a1 + 92) )
{
result = 0i64;
}
else
{
v2 = *(_QWORD *)a1;
v3 = *(_QWORD *)a1 & 3i64;
v4 = v2 - (unsigned int)v3;
if ( (_DWORD)v3 )
{
if ( (_DWORD)v3 == 1 )
result = *(_QWORD *)(((a2 - (a2 & 0x3FF)) >> 7) + v4) + 4 * (a2 & 0x3FF);
else
result = *(_QWORD *)(*(_QWORD *)(((((a2 - (a2 & 0x3FF)) >> 7) - (((a2 - (a2 & 0x3FF)) >> 7) & 0xFFF)) >> 9) + v4)
+ (((a2 - (a2 & 0x3FF)) >> 7) & 0xFFF))
+ 4 * (a2 & 0x3FF);
}
else
{
result = v4 + 4 * a2;
}
}
return result;
}
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
