Thank for your reply.

I'll find something from your code and test it.

About SYSTEM_PROCESS ,defined as follow:

    _SYSTEM_PROCESS = record

      NextEntryDelta:ULONG;// Netx Struct Offset,0 = Struct End
      ThreadCount:ULONG;
      Reserved : array [0..5] of ULONG;
      CreateTime:LARGE_INTEGER;
      UserTime:LARGE_INTEGER;
      KernelTime:LARGE_INTEGER;
      ImageName: UNICODE_STRING;
      BasePriority:KPRIORITY;
      ProcessId :ULONG;
      InheritedFromProcessId:ULONG;
      HandleCount:ULONG;
      Reserved2:array[0..1]of ULONG;
      VmCounters : VM_COUNTERS;
      IoCounters : IO_COUNTERS;
      Threads : array [0..0] of SYSTEM_THREADS;
   end;
   SYSTEM_PROCESS = _SYSTEM_PROCESS;
   PSYSTEM_PROCESS = ^SYSTEM_PROCESS;

My EnumKernelSSDT code as follow(Uncompleted && Untest):

procedure EnumKernelSSDT_ID;stdcall;
var
   modIndex:Integer;// 1=ntdll.dll 2=user32.dll 3=gdi32.dll
   tempFile:string;
   modFile:string;
   modData:THandle;
   dataPointer:Pointer;
   r3handle:PDWORD;
   modHandle:Integer;
   optHeader:IMAGE_OPTIONAL_HEADER;
   sectionHeader:array of IMAGE_SECTION_HEADER_E;
   funcExportArr:array of FuncExportTable;
   temp : NTFuncID;
   opcodeArr : ByteArray; //API Entry First X number Bytes OpCodes
   mpointer : Integer;
   count : Integer;
   tempAddr : DWORD;
   tempAddrJmp : DWORD;
   tempAddrJmpX:DWORD;
   tempAddrJmpXX:DWORD;

   tempPath : array [0..MAX_PATH-1] of AnsiChar;
   hFile : THandle;
   fileSize : Integer;
  i: Integer;

begin
   if g_NTSSDT_Id  = nil then
   begin
      g_NTSSDT_Id := TList.Create;
   end;

   for modIndex := 1 to 3 do
   begin
      case modIndex of
         1: modFile := 'ntdll.dll';
         2: modFile := 'use32.dll';
         3: modFile := 'gdi32.dll';
      end;
      temp.dllIndex := modIndex;
      modHandle := Module_GetModuleHandle(modFile);

      GetTempPath(MAX_PATH,tempPath);
      GetTempFileNameA(tempPath,'*',0,PChar(tempFile));
      GetSystemDirectory(tempPath,MAX_PATH);
      modFile := StrPas(tempPath) + '\' + modFile;
      CopyFile(PChar(modFile),PChar(tempFile),False);

      hFile := FileOpen(tempFile,fmOpenRead);
      fileSize := GetFileSize(hFile,nil);
      FileRead(hFile,modData,fileSize);
      DeleteFile(tempFile);

      if (GetModuleImage(modData,optHeader,False) and (optHeader.Magic = $10B)) then
      begin
        r3handle := VirtualAllocEx(
        THandle(-1),
        nil,
        optHeader.SizeOfImage,
        4096 or 8192,
        64);
        Mem_WriteMem_(
        r3handle^,
        modData,
        optHeader.SizeOfHeaders);
        for i := 0 to GetModuleSection(modData,sectionHeader,nil) - 1 do//Copy all sectionData from Dll
        begin
           Mem_WriteMem_(
           ADD__(r3handle^,sectionHeader[i].VirtualAddress),
           ADD__(modData,sectionHeader[i].PointerToRawData),
           sectionHeader[i].SizeOfRawData);
        end;
        RetifyReloc(r3handle^,modHandle);

        
        for i := 0 to GetModuleExport(r3handle^,funcExportArr) - 1 do
        begin
           if modIndex = 1 then//一级
           begin
             if LeftStr(funcExportArr[i].ApiName,2) <> 'Zw' then//Jmp if not Zw prefix
                Continue;
           end;
           Mem_ReadBytes_(funcExportArr[i].ApiEntry,opcodeArr,32);
           if (opcodeArr[0] = 184) or (opcodeArr[0] = 255) then //
           begin
              temp.APIName := funcExportArr[i].ApiName;
              temp.RETN_XX := 0;
              temp.SSDT_ID := ReadInteger(opcodeArr,1);
              if (g_WindowsVersoin.dwMajorVersion = 5) and (g_WindowsVersoin.dwMinorVersion = 0) then//' Windows 2000
              begin
                 if (opcodeArr[9] = 205) and (opcodeArr[10] = 46) then // INT 2E
                 begin
                    if opcodeArr[11] = 194 then// C2=194 C3=195
                    begin
                       temp.RETN_XX := ReadWord(opcodeArr,12);
                       g_NTSSDT_Id.Add(@temp);
                       Continue;
                    end;
                    if opcodeArr[11] = 195 then
                    begin
                       g_NTSSDT_Id.Add(@temp);
                       Continue;
                    end;
                    if opcodeArr[11] = 233 then
                    begin
                       mpointer := ADD__(mpointer,16);
                       mpointer := ADD__(mpointer,ReadWord(opcodeArr,12));
                       Mem_ReadBytes_(mpointer,opcodeArr,32);//C2 0C00         RETN 0C             JMP to Here
                       if opcodeArr[0] = 194 then//C2=194 C3=195
                       begin
                         temp.RETN_XX := ReadWord(opcodeArr,1);
                         g_NTSSDT_Id.Add(@temp);
                         Continue;
                       end;
                       if opcodeArr[0] = 195 then
                       begin
                         g_NTSSDT_Id.Add(@temp);
                         Continue;
                       end;
                    end;
                 end;
              end;
              if g_WindowsVersoin.isWin64 then
              begin

              end;

              if opcodeArr[5] = 232 then//' WIN8.32
              begin
                 mpointer := ReadInteger(opcodeArr,6);
                 if (mpointer > 0) and (mpointer < 10) then //11+API Pointer + 2 = 15(sysenter)
                 begin
                     mpointer := ADD__(mpointer,13);
                     if 15 = opcodeArr[mpointer] then
                     begin
                        if opcodeArr[10] = 194 then
                        begin
                          temp.RETN_XX := ReadWord(opcodeArr,11);
                          g_NTSSDT_Id.Add(@temp);
                          Continue;
                        end;
                        if opcodeArr[10] = 195 then
                        begin
                          g_NTSSDT_Id.Add(@temp);
                          Continue;
                        end;
                     end;
                 end;

              end;

              if (opcodeArr[5] = 186) and (opcodeArr[10] = 255) then//XP.SP2 2003 Vista Win7
              begin
                 if (opcodeArr[11] = 18) or (opcodeArr[11] = 210) then
                 begin
                    if opcodeArr[12] = 194 then// C2=194 C3=195
                     begin
                        temp.RETN_XX := ReadWord(opcodeArr,13);
                        g_NTSSDT_Id.Add(@temp);
                        Continue;
                     end;
                 end;
                 if opcodeArr[12] = 195 then
                 begin
                    g_NTSSDT_Id.Add(@temp);
                    Continue;
                 end;
              end;
           end;
        end;

        if g_WindowsVersoin.isWin64 then
        begin
           temp.ECX := 0;
           if (g_WindowsVersoin.dwMajorVersion = 10) and (g_WindowsVersoin.dwMinorVersion = 0) then
           begin
              if (opcodeArr[5] = 186) and (opcodeArr[10] = 255) and (opcodeArr[11] = 210) then//Win10.x64
              begin
                 if opcodeArr[12] = 194 then//temp.ECX ＝ 0
                 begin
                    temp.RETN_XX := ReadWord(opcodeArr,13);
                    g_NTSSDT_Id.Add(@temp);
                    Continue;
                 end;
                 if opcodeArr[12] = 195 then
                 begin
                    g_NTSSDT_Id.Add(@temp);
                    Continue;
                 end;
              end;

              if (opcodeArr[5] = 186) and (opcodeArr[10] <> 255) and (opcodeArr[11] <> 210) then//Win10.x64
              begin
                 if funcExportArr[i].ApiName = 'ZwQueryInformationProcess' then
                 begin
                    if (opcodeArr[24] = 194) or (opcodeArr[28] = 194) then// temp.ECX ＝ 0
                    begin
                       if (opcodeArr[24] = 194) then
                          temp.RETN_XX := ReadWord(opcodeArr,25);
                       if opcodeArr[28] = 194 then
                         temp.RETN_XX := ReadWord(opcodeArr,29);
                       g_NTSSDT_Id.Add(@temp);
                       Continue;
                    end;
                    if (opcodeArr[24] = 195) or (opcodeArr[28] = 195) then
                     begin
                        g_NTSSDT_Id.Add(@temp);
                        Continue;
                     end;
                 end;
              end;

              if opcodeArr[0] = 255 then
              begin
                Mem_ReadInteger_(funcExportArr[i].ApiEntry + 2,tempAddrJmp);
                Mem_ReadInteger_(tempAddrJmpX,tempAddrJmpXX);
                Mem_ReadBytes_(tempAddrJmpXX,opcodeArr,32);
                temp.SSDT_ID := ReadInteger(opcodeArr,1);
                if opcodeArr[12] = 194 then//temp.ECX ＝ 0
                begin
                  temp.RETN_XX := ReadWord(opcodeArr,13);
                  g_NTSSDT_Id.Add(@temp);
                  Continue;
                end;
                if opcodeArr[12] = 195 then
                 begin
                    g_NTSSDT_Id.Add(@temp);
                    Continue;
                 end;
              end;
           end;
           if (opcodeArr[5] = 100) and (opcodeArr[6] = 255) and (opcodeArr[8] = 192) then//Win8.x64
              begin
                 if opcodeArr[12] = 194 then
                 begin
                    temp.RETN_XX := ReadWord(opcodeArr,13);
                    g_NTSSDT_Id.Add(@temp);
                    Continue;
                 end;
                 if opcodeArr[12] = 195 then
                 begin
                    g_NTSSDT_Id.Add(@temp);
                    Continue;
                 end;
              end;

              if (opcodeArr[5] = 51) and (opcodeArr[7] = 141) and (opcodeArr[11] = 100) then// xor       ecx, ecx
              begin
                 if (opcodeArr[18] = 195) or (opcodeArr[21] = 195) then
                 begin
                    g_NTSSDT_Id.Add(@temp);
                    Continue;
                 end;
                 if opcodeArr[18] = 194 then
                 begin
                    temp.RETN_XX := ReadWord(opcodeArr,19);
                    g_NTSSDT_Id.Add(@temp);
                    Continue;
                 end;
                 if opcodeArr[21] = 194 then
                 begin
                    temp.RETN_XX := ReadWord(opcodeArr,22);
                    g_NTSSDT_Id.Add(@temp);
                    Continue;
                 end;
              end;

              if (opcodeArr[5] = 141) and (opcodeArr[9] = 51) and (opcodeArr[11] = 100) then//xor     ecx, ecx Unknown
              begin
                 if (opcodeArr[18] = 195) or (opcodeArr[21] = 195) then
                 begin
                    g_NTSSDT_Id.Add(@temp);
                    Continue;
                 end;
                 if opcodeArr[18] = 194 then
                 begin
                    temp.RETN_XX := ReadWord(opcodeArr,19);
                    g_NTSSDT_Id.Add(@temp);
                    Continue;
                 end;
                 if opcodeArr[21] = 194 then
                 begin
                    temp.RETN_XX := ReadWord(opcodeArr,22);
                    g_NTSSDT_Id.Add(@temp);
                    Continue;
                 end;
              end;

              if (opcodeArr[5] = 185) and (opcodeArr[10] = 141) and (opcodeArr[14] = 100) then//mov       ecx,xxxxx
              begin
                 temp.ECX := ReadInteger(opcodeArr,6);
                 if (opcodeArr[21] = 195) or (opcodeArr[24] = 195) then
                 begin
                    g_NTSSDT_Id.Add(@temp);
                    Continue;
                 end;
                 if opcodeArr[21] = 194 then
                 begin
                    temp.RETN_XX := ReadWord(opcodeArr,22);
                    g_NTSSDT_Id.Add(@temp);
                    Continue;
                 end;
                 if opcodeArr[24] = 194 then
                 begin
                    temp.RETN_XX := ReadWord(opcodeArr,25);
                    g_NTSSDT_Id.Add(@temp);
                    Continue;
                 end;
                 temp.ECX := 0;
              end;

              if (opcodeArr[5] = 141) and (opcodeArr[9] = 185) and (opcodeArr[14] = 100) then//' mov       ecx, xxxxxxxx
              begin
                 temp.ECX := ReadInteger(opcodeArr,10);
                 if (opcodeArr[21] = 195) or (opcodeArr[24] = 195) then
                 begin
                    g_NTSSDT_Id.Add(@temp);
                    Continue;
                 end;
                 if opcodeArr[22] = 194 then
                 begin
                    temp.RETN_XX := ReadWord(opcodeArr,22);
                    g_NTSSDT_Id.Add(@temp);
                    Continue;
                 end;
                 if opcodeArr[24] = 194 then
                 begin
                    temp.RETN_XX := ReadWord(opcodeArr,25);
                    g_NTSSDT_Id.Add(@temp);
                    Continue;
                 end;
              end;
        end;
      end;
   end;
end;

Nice work,but poor doc #6

Description

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions