Method GetSystemServiceTable

KernelLibrary/khook.cpp:156–199

bool khook::GetSystemServiceTable() {
	if (!_ntTable) {
#ifndef _WIN64
		// x86 code
		UNICODE_STRING name = RTL_CONSTANT_STRING(L"KeServiceDescriptorTable");
		_ntTable = (SystemServiceTable*)MmGetSystemRoutineAddress(&name);
#else
		// x64 code
		PEParser parser(_kernelImageBase);
		for (int i = 0; parser.GetSectionCount(); i++) {
			auto pSec = parser.GetSectionHeader(i);
			if (pSec->Characteristics & IMAGE_SCN_MEM_NOT_PAGED &&
				pSec->Characteristics & IMAGE_SCN_MEM_EXECUTE &&
				!(pSec->Characteristics & IMAGE_SCN_MEM_DISCARDABLE) &&
				(*(PULONG)pSec->Name != 'TINI') &&
				(*(PULONG)pSec->Name != 'EGAP')) {
				ULONG_PTR searchAddr = (ULONG_PTR)((PUCHAR)_kernelImageBase + pSec->VirtualAddress);
				ULONG_PTR maxAddress = searchAddr + pSec->Misc.VirtualSize;
				UCHAR pattern[] = { 0x8B, 0xF8, 0xC1, 0xEF, 0x07, 0x83, 0xE7, 0x20, 0x25, 0xFF, 0x0F, 0x00, 0x00 };
				ULONG_PTR label = Helpers::SearchSignature(searchAddr,pattern, sizeof(pattern), pSec->Misc.VirtualSize);
				if (label == 0)
					return false;
				searchAddr = label + sizeof(pattern);
				UCHAR signature[] = { 0x4c,0x8d,0x15 };
				// IA32_LSTAR 0xC0000082H
				// ΢�����������˸����ϵ���ת��������������������__readmsr����ʹ�ˡ�
				ULONG size = maxAddress - searchAddr;
				ULONG_PTR addr = Helpers::SearchSignature(searchAddr, signature, sizeof(signature), size);
				if (addr == 0)
					return false;
				ULONG_PTR offsetAddr = addr + sizeof(signature);
				ULONG_PTR offset = 0;
				memcpy(&offset, (void*)offsetAddr, 4);
				if (offset == 0) {
					return false;
				}
				// 7Ϊָ���
				_ntTable = (SystemServiceTable*)(addr + offset + 7);
			}
		}
#endif // !_WIN64
	}
	return true;
}

bool khook::GetShadowSystemServiceNumber(PUNICODE_STRING symbolName, PULONG index) {
	PLIST_ENTRY head = _shadowServiceNameList.GetHead();