[Tigzy]

Hello

I'm trying to restore some altered SSDT indexes, and to do so I need to find the true adresses of theses funcs.
Gmer told me he was using a scan function in ntoskrnl to retrieve theses pointers.

How this is possible? Is there an opcode template to find which indicates the beginning of a func in memory? If yes, how can we find the name of this function?

Thanks in advance

[rkhunter]

Do you need find original KiServiceTable?

[Tigzy]

Yes I do. My aim is to find pointer values before hook by scanning some memory.
I found something interesting about the "mov edi,edi" instruction which indicates the beginning of a function. But the problem is, which function? :D

[rkhunter]

KeServiceDescriptorTable is initialized by KiInitSystem():

KeServiceDescriptorTable[0].Base = &KiServiceTable[0];
KeServiceDescriptorTable[0].Count = NULL;
KeServiceDescriptorTable[0].Limit = KiServiceLimit;
KeServiceDescriptorTable[0].Number = &KiArgumentTable[0];
for (Index = 1; Index < NUMBER_SERVICE_TABLES; Index += 1) {
KeServiceDescriptorTable[Index].Limit = 0;
}

Thus, we can find KiServiceTable by examining all xrefs to KeServiceDescriptorTable in the kernel. We will search for

C7 05 ..8 bytes.. mov ds:_KeServiceDescriptorTable.Base, offset _KiServiceTable

from which we will get _KiServiceTable rva.

It's easy to find KeServiceDescriptorTable xrefs by scanning the code, but this is dangerous and time-consuming. It's better to use ntoskrnl's relocation information - it is always present in all nt systems.
This "mov [mem32], imm32" instruction will have 2 relocs pointing in it, and the second is the one we're searching for. So, the usermode code will do these steps:

1. Load ntosknrl as a dll.
2. Locate KeServiceDescriptorTable - it is exported.
3. Enumerate all relocations to find xrefs to the KeServiceDescriptorTable.
4. Check these opcodes to be a "mov [mem32],imm32".
5. Get KiServiceTable - it's offset is +6 from the opcode beginning.

[Tigzy]

Many thanks rkhunter, will try to do so
;)

[Alex]

Here is the 90210's "A more stable way to locate real KiServiceTable article with sources...

[Tigzy]

Hello Alex

In the meantime I found the same link
It works well, so now I'm able to restore the SSDT! ;)

---

Is there an equivalent in win32k.sys for Shadow SSDT?