[Tigzy]

no, actually from export table of the given module.

OK

This code full of perversions and this is the way how they get address of service descriptor table by doing memory scan and then work with a shadow table through acquired pointer.
I suggest carefully review anything from this bsod-generator source code.

Do you know a better way to do so? :geek:

EDIT: Missing a word...

[EP_X0FF]

Do you know a better to do so? :geek:

I'm not getting this question. You have all possible hints in this thread, including even this bsod-generator source code.
You know how to hook usual service table, so what is the problem?

[Tigzy]

Edited the previous post.

Hooking isn't the problem.
The only thing I don't understand is how to get the SSDT Shadow adress. It seems not to be as simple as it is with the "not shadow" SSDT.
Or maybe I don't understand at all... :D

[EP_X0FF]

Code: Select all

PVOID GetKeServiceDescriptorTableShadow()
{
	for (PBYTE c = (PBYTE)&KeAddSystemServiceTable; c < (PBYTE)&KeAddSystemServiceTable + PAGE_SIZE; c++)
	{
		if ( *(PUSHORT)c == 0x888d )
			return *(PVOID *)(c + 2);
	}
	return NULL;
}

you can put here additionally length disassember and more checks, but this code works all around 2000 - 7 for years without problems.

Code: Select all

PSERVICE_DESCRIPTOR_ENTRY p = GetKeServiceDescriptorTableShadow();

p[0] -system table, p[1] - shadow table.

Remember that to modify/read win32k.sys table you need to attach to GUI process (if not). There also some hints but you don't need to know about them for now.

[Tigzy]

Many thanks, It really helps :!:

EDIT.

I would like to understand, may you explain your code?

if ( *(PUSHORT)c == 0x888d )
return *(PVOID *)(c + 2);

What are these values?

[EP_X0FF]

It is LEA.

[syntax="asm"]lea ecx, _KeServiceDescriptorTableShadow[eax][/syntax]

[Tigzy]

Can you develop?

if ( *(PUSHORT)c == 0x888d )
return *(PVOID *)(c + 2);

Why we compare with 0x888d ?
Why we return c + 2?

[EP_X0FF]

To get lea instruction and extract from it address of _KeServiceDescriptorTableShadow.
+2 because of lea ecx (88 8D)

[Tigzy]

Ah well ;)
Thanks

[Tigzy]

does that loop travels through the ASM code of KeAddSystemServiceTable API?
Is this the aim of the loop?

for (PBYTE c = (PBYTE)&KeAddSystemServiceTable; c < (PBYTE)&KeAddSystemServiceTable + PAGE_SIZE; c++)