PspCidTable is an undocmented variable in Windows kernel... it contains HANDLE_TABLE...
if get address of PspCidTable , i find the follow methods to get it in net... thx for sudami 's article...
1. 通过暴力搜索特征值的办法得到 PspCidTable的地址。。
要搜索的函数有：
PsLookupProcessThreadByCid()
PsLookupProcessByProcessId()
PsLookupThreadByThreadId()
从wrk上看到的 PsLookupProcessByProcessId() 的原码：
Code
1
2 NTSTATUS
3 PsLookupProcessByProcessId(
4 __in HANDLE ProcessId,
5 __deref_out PEPROCESS *Process
6 )
7 {
8
9 PHANDLE_TABLE_ENTRY CidEntry;
10 PEPROCESS lProcess;
11 PETHREAD CurrentThread;
12 NTSTATUS Status;
13
14 PAGED_CODE();
15
16 Status = STATUS_INVALID_PARAMETER;
17
18 CurrentThread = PsGetCurrentThread ();
19 KeEnterCriticalRegionThread (&CurrentThread->Tcb);
20
21 CidEntry = ExMapHandleToPointer(PspCidTable, ProcessId);
22 if (CidEntry != NULL) {
23 lProcess = (PEPROCESS)CidEntry->Object;
24 if (lProcess->Pcb.Header.Type == ProcessObject &&
25 lProcess->GrantedAccess != 0) {
26 if (ObReferenceObjectSafe(lProcess)) {
27 *Process = lProcess;
28 Status = STATUS_SUCCESS;
29 }
30 }
31
32 ExUnlockHandleTableEntry(PspCidTable, CidEntry);
33 }
34
35 KeLeaveCriticalRegionThread (&CurrentThread->Tcb);
36 return Status;
37 }
里面有这样的一段：
.........
20 KeEnterCriticalRegionThread (&CurrentThread->Tcb);
21 CidEntry = ExMapHandleToPointer(PspCidTable, ProcessId);
.........
这样找到这个函数的汇编代码，然后穷搜这一句就可以了。。。
通过windbg看到的反汇编代码：
kd> u nt! PsLookupProcessByProcessId+0x12
nt!PsLookupProcessByProcessId+0x12:
80572960 ff8ed4000000 dec dword ptr [esi+0D4h]
80572966 ff3560245680 push dword ptr [nt!PspCidTable (80562460)]
8057296c e8dc50ffff call nt!ExMapHandleToPointer (80567a4d)
80572971 8bd8 mov ebx,eax
80572973 85db test ebx,ebx
80572975 c745080d0000c0 mov dword ptr [ebp+8],0C000000Dh
8057297c 7432 je nt!PsLookupProcessByProcessId+0x62 (805729b0)
8057297e 57 push edi
便找到PspCidTable的地址了。。。
代码实现如下：
Code
/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
**
** author : Herso
**
** date : 2009/04/06
**
** parameter : NULL
**
** usage : to get the address of PspCidTable
**
** history :
**
--------------------------------------------------------------------------------------------------------------------*/
ULONG get_pspcidtable_address( )
{
UNICODE_STRING psLookup;
PUCHAR address_psLookup = NULL;
PUCHAR p = NULL;
ULONG address_cidtable = 0x0;
::RtlInitUnicodeString( &psLookup, L"PsLookupProcessByProcessId" );
address_psLookup =( PUCHAR )MmGetSystemRoutineAddress( &psLookup );
for( p = address_psLookup; p < address_psLookup + PAGE_SIZE; p++ )
{
//ExMapHandleToPointer(PspCidTable, ProcessId)
if( (*(PUSHORT)p) == 0x35ff && (*(p+6)) == 0xe8 )
{
address_cidtable = (*(PULONG32)(p+2));
break;
}
}
return address_cidtable;
}
