系統服務描述表基址和函式指標查詢
阿新 • • 發佈：2018-11-17
系統服務描述表基址和函式指標查詢
1.反彙編KiSystemCall64
kd> uf KiSystemCall64 Flow analysis was incomplete, some code may be missing nt!KiSystemCall64: fffff800`040e1640 0f01f8 swapgs fffff800`040e1643 654889242510000000 mov qword ptr gs:[10h],rsp fffff800`040e164c 65488b2425a8010000 mov rsp,qword ptr gs:[1A8h] fffff800`040e1655 6a2b push 2Bh fffff800`040e1657 65ff342510000000 push qword ptr gs:[10h] fffff800`040e165f 4153 push r11 fffff800`040e1661 6a33 push 33h fffff800`040e1663 51 push rcx fffff800`040e1664 498bca mov rcx,r10 fffff800`040e1667 4883ec08 sub rsp,8 fffff800`040e166b 55 push rbp fffff800`040e166c 4881ec58010000 sub rsp,158h fffff800`040e1673 488dac2480000000 lea rbp,[rsp+80h] fffff800`040e167b 48899dc0000000 mov qword ptr [rbp+0C0h],rbx fffff800`040e1682 4889bdc8000000 mov qword ptr [rbp+0C8h],rdi fffff800`040e1689 4889b5d0000000 mov qword ptr [rbp+0D0h],rsi fffff800`040e1690 c645ab02 mov byte ptr [rbp-55h],2 fffff800`040e1694 65488b1c2588010000 mov rbx,qword ptr gs:[188h] fffff800`040e169d 0f0d8bd8010000 prefetchw [rbx+1D8h] fffff800`040e16a4 0fae5dac stmxcsr dword ptr [rbp-54h] fffff800`040e16a8 650fae142580010000 ldmxcsr dword ptr gs:[180h] fffff800`040e16b1 807b0300 cmp byte ptr [rbx+3],0 fffff800`040e16b5 66c785800000000000 mov word ptr [rbp+80h],0 fffff800`040e16be 0f848c000000 je nt!KiSystemCall64+0x110 (fffff800`040e1750) Branch nt!KiSystemCall64+0x84: fffff800`040e16c4 488945b0 mov qword ptr [rbp-50h],rax fffff800`040e16c8 48894db8 mov qword ptr [rbp-48h],rcx fffff800`040e16cc 488955c0 mov qword ptr [rbp-40h],rdx fffff800`040e16d0 f6430303 test byte ptr [rbx+3],3 fffff800`040e16d4 4c8945c8 mov qword ptr [rbp-38h],r8 fffff800`040e16d8 4c894dd0 mov qword ptr [rbp-30h],r9 fffff800`040e16dc 7405 je nt!KiSystemCall64+0xa3 (fffff800`040e16e3) Branch nt!KiSystemCall64+0x9e: fffff800`040e16de e80d140000 call nt!KiSaveDebugRegisterState (fffff800`040e2af0) nt!KiSystemCall64+0xa3: fffff800`040e16e3 f6430380 test byte ptr [rbx+3],80h fffff800`040e16e7 7442 je nt!KiSystemCall64+0xeb (fffff800`040e172b) Branch nt!KiSystemCall64+0xa9: fffff800`040e16e9 b9020100c0 mov ecx,0C0000102h fffff800`040e16ee 0f32 rdmsr fffff800`040e16f0 48c1e220 shl rdx,20h fffff800`040e16f4 480bc2 or rax,rdx fffff800`040e16f7 483983b8000000 cmp qword ptr [rbx+0B8h],rax fffff800`040e16fe 742b je nt!KiSystemCall64+0xeb (fffff800`040e172b) Branch nt!KiSystemCall64+0xc0: fffff800`040e1700 483983b0010000 cmp qword ptr [rbx+1B0h],rax fffff800`040e1707 7422 je nt!KiSystemCall64+0xeb (fffff800`040e172b) Branch nt!KiSystemCall64+0xc9: fffff800`040e1709 488b93b8010000 mov rdx,qword ptr [rbx+1B8h] fffff800`040e1710 0fba6b4c0b bts dword ptr [rbx+4Ch],0Bh fffff800`040e1715 66ff8bc4010000 dec word ptr [rbx+1C4h] fffff800`040e171c 48898280000000 mov qword ptr [rdx+80h],rax fffff800`040e1723 fb sti fffff800`040e1724 e8170b0000 call nt!KiUmsCallEntry (fffff800`040e2240) fffff800`040e1729 eb0f jmp nt!KiSystemCall64+0xfa (fffff800`040e173a) Branch nt!KiSystemCall64+0xeb: fffff800`040e172b f6430340 test byte ptr [rbx+3],40h fffff800`040e172f 7409 je nt!KiSystemCall64+0xfa (fffff800`040e173a) Branch nt!KiSystemCall64+0xf1: fffff800`040e1731 f00fbaab0001000008 lock bts dword ptr [rbx+100h],8 nt!KiSystemCall64+0xfa: fffff800`040e173a 488b45b0 mov rax,qword ptr [rbp-50h] fffff800`040e173e 488b4db8 mov rcx,qword ptr [rbp-48h] fffff800`040e1742 488b55c0 mov rdx,qword ptr [rbp-40h] fffff800`040e1746 4c8b45c8 mov r8,qword ptr [rbp-38h] fffff800`040e174a 4c8b4dd0 mov r9,qword ptr [rbp-30h] fffff800`040e174e 6690 xchg ax,ax nt!KiSystemCall64+0x110: fffff800`040e1750 fb sti fffff800`040e1751 48898be0010000 mov qword ptr [rbx+1E0h],rcx fffff800`040e1758 8983f8010000 mov dword ptr [rbx+1F8h],eax fffff800`040e175e 4889a3d8010000 mov qword ptr [rbx+1D8h],rsp fffff800`040e1765 8bf8 mov edi,eax fffff800`040e1767 c1ef07 shr edi,7 fffff800`040e176a 83e720 and edi,20h fffff800`040e176d 25ff0f0000 and eax,0FFFh nt!KiSystemServiceRepeat: fffff800`040e1772 4c8d15c7202300 lea r10,[nt!KeServiceDescriptorTable (fffff800`04313840)] fffff800`040e1779 4c8d1d00212300 lea r11,[nt!KeServiceDescriptorTableShadow (fffff800`04313880)] fffff800`040e1780 f7830001000080000000 test dword ptr [rbx+100h],80h fffff800`040e178a 4d0f45d3 cmovne r10,r11 fffff800`040e178e 423b441710 cmp eax,dword ptr [rdi+r10+10h] fffff800`040e1793 0f83e9020000 jae nt!KiSystemServiceExit+0x1a7 (fffff800`040e1a82) Branch nt!KiSystemServiceRepeat+0x27: fffff800`040e1799 4e8b1417 mov r10,qword ptr [rdi+r10] fffff800`040e179d 4d631c82 movsxd r11,dword ptr [r10+rax*4] fffff800`040e17a1 498bc3 mov rax,r11 fffff800`040e17a4 49c1fb04 sar r11,4 fffff800`040e17a8 4d03d3 add r10,r11 fffff800`040e17ab 83ff20 cmp edi,20h fffff800`040e17ae 7550 jne nt!KiSystemServiceGdiTebAccess+0x49 (fffff800`040e1800) Branch nt!KiSystemServiceRepeat+0x3e: fffff800`040e17b0 4c8b9bb8000000 mov r11,qword ptr [rbx+0B8h] fffff800`040e17b7 4183bb4017000000 cmp dword ptr [r11+1740h],0 fffff800`040e17bf 743f je nt!KiSystemServiceGdiTebAccess+0x49 (fffff800`040e1800) Branch nt!KiSystemServiceGdiTebAccess+0xa: fffff800`040e17c1 488945b0 mov qword ptr [rbp-50h],rax fffff800`040e17c5 48894db8 mov qword ptr [rbp-48h],rcx fffff800`040e17c9 488955c0 mov qword ptr [rbp-40h],rdx fffff800`040e17cd 498bd8 mov rbx,r8 fffff800`040e17d0 498bf9 mov rdi,r9 fffff800`040e17d3 498bf2 mov rsi,r10 fffff800`040e17d6 ff15341f2300 call qword ptr [nt!KeGdiFlushUserBatch (fffff800`04313710)] fffff800`040e17dc 488b45b0 mov rax,qword ptr [rbp-50h] fffff800`040e17e0 488b4db8 mov rcx,qword ptr [rbp-48h] fffff800`040e17e4 488b55c0 mov rdx,qword ptr [rbp-40h] fffff800`040e17e8 4c8bc3 mov r8,rbx fffff800`040e17eb 4c8bcf mov r9,rdi fffff800`040e17ee 4c8bd6 mov r10,rsi fffff800`040e17f1 666666666666660f1f840000000000 nop word ptr [rax+rax] nt!KiSystemServiceGdiTebAccess+0x49: fffff800`040e1800 83e00f and eax,0Fh fffff800`040e1803 0f84b7000000 je nt!KiSystemServiceCopyEnd (fffff800`040e18c0) Branch nt!KiSystemServiceGdiTebAccess+0x52: fffff800`040e1809 c1e003 shl eax,3 fffff800`040e180c 488d642490 lea rsp,[rsp-70h] fffff800`040e1811 488d7c2418 lea rdi,[rsp+18h] fffff800`040e1816 488bb500010000 mov rsi,qword ptr [rbp+100h] fffff800`040e181d 488d7620 lea rsi,[rsi+20h] fffff800`040e1821 f685f000000001 test byte ptr [rbp+0F0h],1 fffff800`040e1828 7416 je nt!KiSystemServiceGdiTebAccess+0x89 (fffff800`040e1840) Branch nt!KiSystemServiceGdiTebAccess+0x73: fffff800`040e182a 483b35cf172300 cmp rsi,qword ptr [nt!MmUserProbeAddress (fffff800`04313000)] fffff800`040e1831 480f4335c7172300 cmovae rsi,qword ptr [nt!MmUserProbeAddress (fffff800`04313000)] fffff800`040e1839 0f1f8000000000 nop dword ptr [rax] nt!KiSystemServiceGdiTebAccess+0x89: fffff800`040e1840 4c8d1d79000000 lea r11,[nt!KiSystemServiceCopyEnd (fffff800`040e18c0)] fffff800`040e1847 4c2bd8 sub r11,rax fffff800`040e184a 41ffe3 jmp r11 nt!KiSystemServiceCopyEnd: fffff800`040e18c0 f705be7d180040000000 test dword ptr [nt!PerfGlobalGroupMask+0x8 (fffff800`04269688)],40h fffff800`040e18ca 0f8550020000 jne nt!KiSystemServiceExit+0x245 (fffff800`040e1b20) Branch nt!KiSystemServiceCopyEnd+0x10: fffff800`040e18d0 41ffd2 call r10 nt!KiSystemServiceCopyEnd+0x13: fffff800`040e18d3 65ff042538220000 inc dword ptr gs:[2238h] nt!KiSystemServiceExit: fffff800`040e18db 488b9dc0000000 mov rbx,qword ptr [rbp+0C0h] fffff800`040e18e2 488bbdc8000000 mov rdi,qword ptr [rbp+0C8h] fffff800`040e18e9 488bb5d0000000 mov rsi,qword ptr [rbp+0D0h] fffff800`040e18f0 654c8b1c2588010000 mov r11,qword ptr gs:[188h] fffff800`040e18f9 f685f000000001 test byte ptr [rbp+0F0h],1 fffff800`040e1900 0f844f010000 je nt!KiSystemServiceExit+0x17a (fffff800`040e1a55) Branch nt!KiSystemServiceExit+0x2b: fffff800`040e1906 440f20c1 mov rcx,cr8 fffff800`040e190a 410a8bf0010000 or cl,byte ptr [r11+1F0h] fffff800`040e1911 410b8bc4010000 or ecx,dword ptr [r11+1C4h] fffff800`040e1918 0f85ce010000 jne nt!KiSystemServiceExit+0x211 (fffff800`040e1aec) Branch nt!KiSystemServiceExit+0x43: fffff800`040e191e fa cli fffff800`040e191f 65488b0c2588010000 mov rcx,qword ptr gs:[188h] fffff800`040e1928 80797a00 cmp byte ptr [rcx+7Ah],0 fffff800`040e192c 7457 je nt!KiSystemServiceExit+0xaa (fffff800`040e1985) Branch nt!KiSystemServiceExit+0x53: fffff800`040e192e 488945b0 mov qword ptr [rbp-50h],rax fffff800`040e1932 33c0 xor eax,eax fffff800`040e1934 488945b8 mov qword ptr [rbp-48h],rax fffff800`040e1938 488945c0 mov qword ptr [rbp-40h],rax fffff800`040e193c 488945c8 mov qword ptr [rbp-38h],rax fffff800`040e1940 488945d0 mov qword ptr [rbp-30h],rax fffff800`040e1944 488945d8 mov qword ptr [rbp-28h],rax fffff800`040e1948 488945e0 mov qword ptr [rbp-20h],rax fffff800`040e194c 660fefc0 pxor xmm0,xmm0 fffff800`040e1950 0f2945f0 movaps xmmword ptr [rbp-10h],xmm0 fffff800`040e1954 0f294500 movaps xmmword ptr [rbp],xmm0 fffff800`040e1958 0f294510 movaps xmmword ptr [rbp+10h],xmm0 fffff800`040e195c 0f294520 movaps xmmword ptr [rbp+20h],xmm0 fffff800`040e1960 0f294530 movaps xmmword ptr [rbp+30h],xmm0 fffff800`040e1964 0f294540 movaps xmmword ptr [rbp+40h],xmm0 fffff800`040e1968 b901000000 mov ecx,1 fffff800`040e196d 440f22c1 mov cr8,rcx fffff800`040e1971 fb sti fffff800`040e1972 e85947ffff call nt!KiInitiateUserApc (fffff800`040d60d0) fffff800`040e1977 fa cli fffff800`040e1978 b900000000 mov ecx,0 fffff800`040e197d 440f22c1 mov cr8,rcx fffff800`040e1981 488b45b0 mov rax,qword ptr [rbp-50h] nt!KiSystemServiceExit+0xaa: fffff800`040e1985 65488b0c2588010000 mov rcx,qword ptr gs:[188h] fffff800`040e198e f70100000240 test dword ptr [rcx],40020000h fffff800`040e1994 742e je nt!KiSystemServiceExit+0xe9 (fffff800`040e19c4) Branch nt!KiSystemServiceExit+0xbb: fffff800`040e1996 488945b0 mov qword ptr [rbp-50h],rax fffff800`040e199a f6410202 test byte ptr [rcx+2],2 fffff800`040e199e 740e je nt!KiSystemServiceExit+0xd3 (fffff800`040e19ae) Branch nt!KiSystemServiceExit+0xc5: fffff800`040e19a0 e87b9f0900 call nt!KiCopyCounters (fffff800`0417b920) fffff800`040e19a5 65488b0c2588010000 mov rcx,qword ptr gs:[188h] nt!KiSystemServiceExit+0xd3: fffff800`040e19ae f6410340 test byte ptr [rcx+3],40h fffff800`040e19b2 740c je nt!KiSystemServiceExit+0xe5 (fffff800`040e19c0) Branch nt!KiSystemServiceExit+0xd9: fffff800`040e19b4 488d6580 lea rsp,[rbp-80h] fffff800`040e19b8 4833c9 xor rcx,rcx fffff800`040e19bb e8000b0000 call nt!KiUmsExit (fffff800`040e24c0) nt!KiSystemServiceExit+0xe5: fffff800`040e19c0 488b45b0 mov rax,qword ptr [rbp-50h] nt!KiSystemServiceExit+0xe9: fffff800`040e19c4 0fae55ac ldmxcsr dword ptr [rbp-54h] fffff800`040e19c8 4d33d2 xor r10,r10 fffff800`040e19cb 6683bd8000000000 cmp word ptr [rbp+80h],0 fffff800`040e19d3 743e je nt!KiSystemServiceExit+0x138 (fffff800`040e1a13) Branch nt!KiSystemServiceExit+0xfa: fffff800`040e19d5 488945b0 mov qword ptr [rbp-50h],rax fffff800`040e19d9 e8a2100000 call nt!KiRestoreDebugRegisterState (fffff800`040e2a80) fffff800`040e19de 65488b042588010000 mov rax,qword ptr gs:[188h] fffff800`040e19e7 488b4070 mov rax,qword ptr [rax+70h] fffff800`040e19eb 488b8000010000 mov rax,qword ptr [rax+100h] fffff800`040e19f2 480bc0 or rax,rax fffff800`040e19f5 7418 je nt!KiSystemServiceExit+0x134 (fffff800`040e1a0f) Branch nt!KiSystemServiceExit+0x11c: fffff800`040e19f7 6683bdf000000033 cmp word ptr [rbp+0F0h],33h fffff800`040e19ff 750e jne nt!KiSystemServiceExit+0x134 (fffff800`040e1a0f) Branch nt!KiSystemServiceExit+0x126: fffff800`040e1a01 4c8b95e8000000 mov r10,qword ptr [rbp+0E8h] fffff800`040e1a08 488985e8000000 mov qword ptr [rbp+0E8h],rax nt!KiSystemServiceExit+0x134: fffff800`040e1a0f 488b45b0 mov rax,qword ptr [rbp-50h] nt!KiSystemServiceExit+0x138: fffff800`040e1a13 4c8b8500010000 mov r8,qword ptr [rbp+100h] fffff800`040e1a1a 4c8b8dd8000000 mov r9,qword ptr [rbp+0D8h] fffff800`040e1a21 33d2 xor edx,edx fffff800`040e1a23 660fefc0 pxor xmm0,xmm0 fffff800`040e1a27 660fefc9 pxor xmm1,xmm1 fffff800`040e1a2b 660fefd2 pxor xmm2,xmm2 fffff800`040e1a2f 660fefdb pxor xmm3,xmm3 fffff800`040e1a33 660fefe4 pxor xmm4,xmm4 fffff800`040e1a37 660fefed pxor xmm5,xmm5 fffff800`040e1a3b 488b8de8000000 mov rcx,qword ptr [rbp+0E8h] fffff800`040e1a42 4c8b9df8000000 mov r11,qword ptr [rbp+0F8h] fffff800`040e1a49 498be9 mov rbp,r9 fffff800`040e1a4c 498be0 mov rsp,r8 fffff800`040e1a4f 0f01f8 swapgs fffff800`040e1a52 480f07 sysretq nt!KiSystemServiceExit+0x17a: fffff800`040e1a55 488b95b8000000 mov rdx,qword ptr [rbp+0B8h] fffff800`040e1a5c 498993d8010000 mov qword ptr [r11+1D8h],rdx fffff800`040e1a63 8a55a8 mov dl,byte ptr [rbp-58h] fffff800`040e1a66 418893f6010000 mov byte ptr [r11+1F6h],dl fffff800`040e1a6d fa cli fffff800`040e1a6e 488be5 mov rsp,rbp fffff800`040e1a71 488badd8000000 mov rbp,qword ptr [rbp+0D8h] fffff800`040e1a78 488ba42400010000 mov rsp,qword ptr [rsp+100h] fffff800`040e1a80 fb sti fffff800`040e1a81 c3 ret nt!KiSystemServiceExit+0x1a7: fffff800`040e1a82 83ff20 cmp edi,20h fffff800`040e1a85 755b jne nt!KiSystemServiceExit+0x207 (fffff800`040e1ae2) Branch nt!KiSystemServiceExit+0x1ac: fffff800`040e1a87 894580 mov dword ptr [rbp-80h],eax fffff800`040e1a8a 48894d88 mov qword ptr [rbp-78h],rcx fffff800`040e1a8e 48895590 mov qword ptr [rbp-70h],rdx fffff800`040e1a92 4c894598 mov qword ptr [rbp-68h],r8 fffff800`040e1a96 4c894da0 mov qword ptr [rbp-60h],r9 fffff800`040e1a9a e85184ffff call nt!KiConvertToGuiThread (fffff800`040d9ef0) fffff800`040e1a9f 0bc0 or eax,eax fffff800`040e1aa1 8b4580 mov eax,dword ptr [rbp-80h] fffff800`040e1aa4 488b4d88 mov rcx,qword ptr [rbp-78h] fffff800`040e1aa8 488b5590 mov rdx,qword ptr [rbp-70h] fffff800`040e1aac 4c8b4598 mov r8,qword ptr [rbp-68h] fffff800`040e1ab0 4c8b4da0 mov r9,qword ptr [rbp-60h] fffff800`040e1ab4 4889a3d8010000 mov qword ptr [rbx+1D8h],rsp fffff800`040e1abb 0f84b1fcffff je nt!KiSystemServiceRepeat (fffff800`040e1772) Branch nt!KiSystemServiceExit+0x1e6: fffff800`040e1ac1 488d3dd81d2300 lea rdi,[nt!KeServiceDescriptorTableShadow+0x20 (fffff800`043138a0)] fffff800`040e1ac8 8b7710 mov esi,dword ptr [rdi+10h] fffff800`040e1acb 488b3f mov rdi,qword ptr [rdi] fffff800`040e1ace 3bc6 cmp eax,esi fffff800`040e1ad0 7310 jae nt!KiSystemServiceExit+0x207 (fffff800`040e1ae2) Branch nt!KiSystemServiceExit+0x1f7: fffff800`040e1ad2 488d3cb7 lea rdi,[rdi+rsi*4] fffff800`040e1ad6 0fbe0438 movsx eax,byte ptr [rax+rdi] fffff800`040e1ada 0bc0 or eax,eax fffff800`040e1adc 0f8ef9fdffff jle nt!KiSystemServiceExit (fffff800`040e18db) Branch nt!KiSystemServiceExit+0x207: fffff800`040e1ae2 b81c0000c0 mov eax,0C000001Ch fffff800`040e1ae7 e9effdffff jmp nt!KiSystemServiceExit (fffff800`040e18db) Branch nt!KiSystemServiceExit+0x211: fffff800`040e1aec b94a000000 mov ecx,4Ah fffff800`040e1af1 4533c9 xor r9d,r9d fffff800`040e1af4 450f20c0 mov r8,cr8 fffff800`040e1af8 450bc0 or r8d,r8d fffff800`040e1afb 7514 jne nt!KiSystemServiceExit+0x236 (fffff800`040e1b11) Branch nt!KiSystemServiceExit+0x222: fffff800`040e1afd b901000000 mov ecx,1 fffff800`040e1b02 450fb683f0010000 movzx r8d,byte ptr [r11+1F0h] fffff800`040e1b0a 458b8bc4010000 mov r9d,dword ptr [r11+1C4h] nt!KiSystemServiceExit+0x236: fffff800`040e1b11 488b95e8000000 mov rdx,qword ptr [rbp+0E8h] fffff800`040e1b18 4c8bd5 mov r10,rbp fffff800`040e1b1b e860000000 call nt!KiBugCheckDispatch (fffff800`040e1b80) nt!KiSystemServiceExit+0x245: fffff800`040e1b20 4883ec50 sub rsp,50h fffff800`040e1b24 48894c2420 mov qword ptr [rsp+20h],rcx fffff800`040e1b29 4889542428 mov qword ptr [rsp+28h],rdx fffff800`040e1b2e 4c89442430 mov qword ptr [rsp+30h],r8 fffff800`040e1b33 4c894c2438 mov qword ptr [rsp+38h],r9 fffff800`040e1b38 4c89542440 mov qword ptr [rsp+40h],r10 fffff800`040e1b3d 498bca mov rcx,r10 fffff800`040e1b40 e86b310e00 call nt!PerfInfoLogSysCallEntry (fffff800`041c4cb0) fffff800`040e1b45 488b4c2420 mov rcx,qword ptr [rsp+20h] fffff800`040e1b4a 488b542428 mov rdx,qword ptr [rsp+28h] fffff800`040e1b4f 4c8b442430 mov r8,qword ptr [rsp+30h] fffff800`040e1b54 4c8b4c2438 mov r9,qword ptr [rsp+38h] fffff800`040e1b59 4c8b542440 mov r10,qword ptr [rsp+40h] fffff800`040e1b5e 4883c450 add rsp,50h fffff800`040e1b62 41ffd2 call r10 fffff800`040e1b65 488945b0 mov qword ptr [rbp-50h],rax fffff800`040e1b69 488bc8 mov rcx,rax fffff800`040e1b6c e8df300e00 call nt!PerfInfoLogSysCallExit (fffff800`041c4c50) fffff800`040e1b71 488b45b0 mov rax,qword ptr [rbp-50h] fffff800`040e1b75 e959fdffff jmp nt!KiSystemServiceCopyEnd+0x13 (fffff800`040e18d3) Branch