系统服务描述表指针查找

反汇编KiSystemCall64

kd> uf KiSystemCall64
Flow analysis was incomplete, some code may be missing
nt!KiSystemCall64:
fffff800`040e1640 0f01f8          swapgs
fffff800`040e1643 654889242510000000 mov   qword ptr gs:[10h],rsp
fffff800`040e164c 65488b2425a8010000 mov   rsp,qword ptr gs:[1A8h]
fffff800`040e1655 6a2b            push    2Bh
fffff800`040e1657 65ff342510000000 push    qword ptr gs:[10h]
fffff800`040e165f 4153            push    r11
fffff800`040e1661 6a33            push    33h
fffff800`040e1663 51              push    rcx
fffff800`040e1664 498bca          mov     rcx,r10
fffff800`040e1667 4883ec08        sub     rsp,8
fffff800`040e166b 55              push    rbp
fffff800`040e166c 4881ec58010000  sub     rsp,158h
fffff800`040e1673 488dac2480000000 lea     rbp,[rsp+80h]
fffff800`040e167b 48899dc0000000  mov     qword ptr [rbp+0C0h],rbx
fffff800`040e1682 4889bdc8000000  mov     qword ptr [rbp+0C8h],rdi
fffff800`040e1689 4889b5d0000000  mov     qword ptr [rbp+0D0h],rsi
fffff800`040e1690 c645ab02        mov     byte ptr [rbp-55h],2
fffff800`040e1694 65488b1c2588010000 mov   rbx,qword ptr gs:[188h]
fffff800`040e169d 0f0d8bd8010000  prefetchw [rbx+1D8h]
fffff800`040e16a4 0fae5dac        stmxcsr dword ptr [rbp-54h]
fffff800`040e16a8 650fae142580010000 ldmxcsr dword ptr gs:[180h]
fffff800`040e16b1 807b0300        cmp     byte ptr [rbx+3],0
fffff800`040e16b5 66c785800000000000 mov   word ptr [rbp+80h],0
fffff800`040e16be 0f848c000000    je      nt!KiSystemCall64+0x110 (fffff800`040e1750)  Branch

nt!KiSystemCall64+0x84:
fffff800`040e16c4 488945b0        mov     qword ptr [rbp-50h],rax
fffff800`040e16c8 48894db8        mov     qword ptr [rbp-48h],rcx
fffff800`040e16cc 488955c0        mov     qword ptr [rbp-40h],rdx
fffff800`040e16d0 f6430303        test    byte ptr [rbx+3],3
fffff800`040e16d4 4c8945c8        mov     qword ptr [rbp-38h],r8
fffff800`040e16d8 4c894dd0        mov     qword ptr [rbp-30h],r9
fffff800`040e16dc 7405            je      nt!KiSystemCall64+0xa3 (fffff800`040e16e3)  Branch

nt!KiSystemCall64+0x9e:
fffff800`040e16de e80d140000      call    nt!KiSaveDebugRegisterState (fffff800`040e2af0)

nt!KiSystemCall64+0xa3:
fffff800`040e16e3 f6430380        test    byte ptr [rbx+3],80h
fffff800`040e16e7 7442            je      nt!KiSystemCall64+0xeb (fffff800`040e172b)  Branch

nt!KiSystemCall64+0xa9:
fffff800`040e16e9 b9020100c0      mov     ecx,0C0000102h
fffff800`040e16ee 0f32            rdmsr
fffff800`040e16f0 48c1e220        shl     rdx,20h
fffff800`040e16f4 480bc2          or      rax,rdx
fffff800`040e16f7 483983b8000000  cmp     qword ptr [rbx+0B8h],rax
fffff800`040e16fe 742b            je      nt!KiSystemCall64+0xeb (fffff800`040e172b)  Branch

nt!KiSystemCall64+0xc0:
fffff800`040e1700 483983b0010000  cmp     qword ptr [rbx+1B0h],rax
fffff800`040e1707 7422            je      nt!KiSystemCall64+0xeb (fffff800`040e172b)  Branch

nt!KiSystemCall64+0xc9:
fffff800`040e1709 488b93b8010000  mov     rdx,qword ptr [rbx+1B8h]
fffff800`040e1710 0fba6b4c0b      bts     dword ptr [rbx+4Ch],0Bh
fffff800`040e1715 66ff8bc4010000  dec     word ptr [rbx+1C4h]
fffff800`040e171c 48898280000000  mov     qword ptr [rdx+80h],rax
fffff800`040e1723 fb              sti
fffff800`040e1724 e8170b0000      call    nt!KiUmsCallEntry (fffff800`040e2240)
fffff800`040e1729 eb0f            jmp     nt!KiSystemCall64+0xfa (fffff800`040e173a)  Branch

nt!KiSystemCall64+0xeb:
fffff800`040e172b f6430340        test    byte ptr [rbx+3],40h
fffff800`040e172f 7409            je      nt!KiSystemCall64+0xfa (fffff800`040e173a)  Branch

nt!KiSystemCall64+0xf1:
fffff800`040e1731 f00fbaab0001000008 lock bts dword ptr [rbx+100h],8

nt!KiSystemCall64+0xfa:
fffff800`040e173a 488b45b0        mov     rax,qword ptr [rbp-50h]
fffff800`040e173e 488b4db8        mov     rcx,qword ptr [rbp-48h]
fffff800`040e1742 488b55c0        mov     rdx,qword ptr [rbp-40h]
fffff800`040e1746 4c8b45c8        mov     r8,qword ptr [rbp-38h]
fffff800`040e174a 4c8b4dd0        mov     r9,qword ptr [rbp-30h]
fffff800`040e174e 6690            xchg    ax,ax

nt!KiSystemCall64+0x110:
fffff800`040e1750 fb              sti
fffff800`040e1751 48898be0010000  mov     qword ptr [rbx+1E0h],rcx
fffff800`040e1758 8983f8010000    mov     dword ptr [rbx+1F8h],eax
fffff800`040e175e 4889a3d8010000  mov     qword ptr [rbx+1D8h],rsp
fffff800`040e1765 8bf8            mov     edi,eax
fffff800`040e1767 c1ef07          shr     edi,7
fffff800`040e176a 83e720          and     edi,20h
fffff800`040e176d 25ff0f0000      and     eax,0FFFh

nt!KiSystemServiceRepeat:
fffff800`040e1772 4c8d15c7202300  lea     r10,[nt!KeServiceDescriptorTable (fffff800`04313840)]
fffff800`040e1779 4c8d1d00212300  lea     r11,[nt!KeServiceDescriptorTableShadow (fffff800`04313880)]
fffff800`040e1780 f7830001000080000000 test dword ptr [rbx+100h],80h
fffff800`040e178a 4d0f45d3        cmovne  r10,r11
fffff800`040e178e 423b441710      cmp     eax,dword ptr [rdi+r10+10h]
fffff800`040e1793 0f83e9020000    jae     nt!KiSystemServiceExit+0x1a7 (fffff800`040e1a82)  Branch

nt!KiSystemServiceRepeat+0x27:
fffff800`040e1799 4e8b1417        mov     r10,qword ptr [rdi+r10]
fffff800`040e179d 4d631c82        movsxd  r11,dword ptr [r10+rax*4]
fffff800`040e17a1 498bc3          mov     rax,r11
fffff800`040e17a4 49c1fb04        sar     r11,4
fffff800`040e17a8 4d03d3          add     r10,r11
fffff800`040e17ab 83ff20          cmp     edi,20h
fffff800`040e17ae 7550            jne     nt!KiSystemServiceGdiTebAccess+0x49 (fffff800`040e1800)  Branch

nt!KiSystemServiceRepeat+0x3e:
fffff800`040e17b0 4c8b9bb8000000  mov     r11,qword ptr [rbx+0B8h]
fffff800`040e17b7 4183bb4017000000 cmp     dword ptr [r11+1740h],0
fffff800`040e17bf 743f            je      nt!KiSystemServiceGdiTebAccess+0x49 (fffff800`040e1800)  Branch

nt!KiSystemServiceGdiTebAccess+0xa:
fffff800`040e17c1 488945b0        mov     qword ptr [rbp-50h],rax
fffff800`040e17c5 48894db8        mov     qword ptr [rbp-48h],rcx
fffff800`040e17c9 488955c0        mov     qword ptr [rbp-40h],rdx
fffff800`040e17cd 498bd8          mov     rbx,r8
fffff800`040e17d0 498bf9          mov     rdi,r9
fffff800`040e17d3 498bf2          mov     rsi,r10
fffff800`040e17d6 ff15341f2300    call    qword ptr [nt!KeGdiFlushUserBatch (fffff800`04313710)]
fffff800`040e17dc 488b45b0        mov     rax,qword ptr [rbp-50h]
fffff800`040e17e0 488b4db8        mov     rcx,qword ptr [rbp-48h]
fffff800`040e17e4 488b55c0        mov     rdx,qword ptr [rbp-40h]
fffff800`040e17e8 4c8bc3          mov     r8,rbx
fffff800`040e17eb 4c8bcf          mov     r9,rdi
fffff800`040e17ee 4c8bd6          mov     r10,rsi
fffff800`040e17f1 666666666666660f1f840000000000 nop word ptr [rax+rax]

nt!KiSystemServiceGdiTebAccess+0x49:
fffff800`040e1800 83e00f          and     eax,0Fh
fffff800`040e1803 0f84b7000000    je      nt!KiSystemServiceCopyEnd (fffff800`040e18c0)  Branch

nt!KiSystemServiceGdiTebAccess+0x52:
fffff800`040e1809 c1e003          shl     eax,3
fffff800`040e180c 488d642490      lea     rsp,[rsp-70h]
fffff800`040e1811 488d7c2418      lea     rdi,[rsp+18h]
fffff800`040e1816 488bb500010000  mov     rsi,qword ptr [rbp+100h]
fffff800`040e181d 488d7620        lea     rsi,[rsi+20h]
fffff800`040e1821 f685f000000001  test    byte ptr [rbp+0F0h],1
fffff800`040e1828 7416            je      nt!KiSystemServiceGdiTebAccess+0x89 (fffff800`040e1840)  Branch

nt!KiSystemServiceGdiTebAccess+0x73:
fffff800`040e182a 483b35cf172300  cmp     rsi,qword ptr [nt!MmUserProbeAddress (fffff800`04313000)]
fffff800`040e1831 480f4335c7172300 cmovae  rsi,qword ptr [nt!MmUserProbeAddress (fffff800`04313000)]
fffff800`040e1839 0f1f8000000000  nop     dword ptr [rax]

nt!KiSystemServiceGdiTebAccess+0x89:
fffff800`040e1840 4c8d1d79000000  lea     r11,[nt!KiSystemServiceCopyEnd (fffff800`040e18c0)]
fffff800`040e1847 4c2bd8          sub     r11,rax
fffff800`040e184a 41ffe3          jmp     r11

nt!KiSystemServiceCopyEnd:
fffff800`040e18c0 f705be7d180040000000 test dword ptr [nt!PerfGlobalGroupMask+0x8 (fffff800`04269688)],40h
fffff800`040e18ca 0f8550020000    jne     nt!KiSystemServiceExit+0x245 (fffff800`040e1b20)  Branch

nt!KiSystemServiceCopyEnd+0x10:
fffff800`040e18d0 41ffd2          call    r10

nt!KiSystemServiceCopyEnd+0x13:
fffff800`040e18d3 65ff042538220000 inc     dword ptr gs:[2238h]

nt!KiSystemServiceExit:
fffff800`040e18db 488b9dc0000000  mov     rbx,qword ptr [rbp+0C0h]
fffff800`040e18e2 488bbdc8000000  mov     rdi,qword ptr [rbp+0C8h]
fffff800`040e18e9 488bb5d0000000  mov     rsi,qword ptr [rbp+0D0h]
fffff800`040e18f0 654c8b1c2588010000 mov   r11,qword ptr gs:[188h]
fffff800`040e18f9 f685f000000001  test    byte ptr [rbp+0F0h],1
fffff800`040e1900 0f844f010000    je      nt!KiSystemServiceExit+0x17a (fffff800`040e1a55)  Branch

nt!KiSystemServiceExit+0x2b:
fffff800`040e1906 440f20c1        mov     rcx,cr8
fffff800`040e190a 410a8bf0010000  or      cl,byte ptr [r11+1F0h]
fffff800`040e1911 410b8bc4010000  or      ecx,dword ptr [r11+1C4h]
fffff800`040e1918 0f85ce010000    jne     nt!KiSystemServiceExit+0x211 (fffff800`040e1aec)  Branch

nt!KiSystemServiceExit+0x43:
fffff800`040e191e fa              cli
fffff800`040e191f 65488b0c2588010000 mov   rcx,qword ptr gs:[188h]
fffff800`040e1928 80797a00        cmp     byte ptr [rcx+7Ah],0
fffff800`040e192c 7457            je      nt!KiSystemServiceExit+0xaa (fffff800`040e1985)  Branch

nt!KiSystemServiceExit+0x53:
fffff800`040e192e 488945b0        mov     qword ptr [rbp-50h],rax
fffff800`040e1932 33c0            xor     eax,eax
fffff800`040e1934 488945b8        mov     qword ptr [rbp-48h],rax
fffff800`040e1938 488945c0        mov     qword ptr [rbp-40h],rax
fffff800`040e193c 488945c8        mov     qword ptr [rbp-38h],rax
fffff800`040e1940 488945d0        mov     qword ptr [rbp-30h],rax
fffff800`040e1944 488945d8        mov     qword ptr [rbp-28h],rax
fffff800`040e1948 488945e0        mov     qword ptr [rbp-20h],rax
fffff800`040e194c 660fefc0        pxor    xmm0,xmm0
fffff800`040e1950 0f2945f0        movaps  xmmword ptr [rbp-10h],xmm0
fffff800`040e1954 0f294500        movaps  xmmword ptr [rbp],xmm0
fffff800`040e1958 0f294510        movaps  xmmword ptr [rbp+10h],xmm0
fffff800`040e195c 0f294520        movaps  xmmword ptr [rbp+20h],xmm0
fffff800`040e1960 0f294530        movaps  xmmword ptr [rbp+30h],xmm0
fffff800`040e1964 0f294540        movaps  xmmword ptr [rbp+40h],xmm0
fffff800`040e1968 b901000000      mov     ecx,1
fffff800`040e196d 440f22c1        mov     cr8,rcx
fffff800`040e1971 fb              sti
fffff800`040e1972 e85947ffff      call    nt!KiInitiateUserApc (fffff800`040d60d0)
fffff800`040e1977 fa              cli
fffff800`040e1978 b900000000      mov     ecx,0
fffff800`040e197d 440f22c1        mov     cr8,rcx
fffff800`040e1981 488b45b0        mov     rax,qword ptr [rbp-50h]

nt!KiSystemServiceExit+0xaa:
fffff800`040e1985 65488b0c2588010000 mov   rcx,qword ptr gs:[188h]
fffff800`040e198e f70100000240    test    dword ptr [rcx],40020000h
fffff800`040e1994 742e            je      nt!KiSystemServiceExit+0xe9 (fffff800`040e19c4)  Branch

nt!KiSystemServiceExit+0xbb:
fffff800`040e1996 488945b0        mov     qword ptr [rbp-50h],rax
fffff800`040e199a f6410202        test    byte ptr [rcx+2],2
fffff800`040e199e 740e            je      nt!KiSystemServiceExit+0xd3 (fffff800`040e19ae)  Branch

nt!KiSystemServiceExit+0xc5:
fffff800`040e19a0 e87b9f0900      call    nt!KiCopyCounters (fffff800`0417b920)
fffff800`040e19a5 65488b0c2588010000 mov   rcx,qword ptr gs:[188h]

nt!KiSystemServiceExit+0xd3:
fffff800`040e19ae f6410340        test    byte ptr [rcx+3],40h
fffff800`040e19b2 740c            je      nt!KiSystemServiceExit+0xe5 (fffff800`040e19c0)  Branch

nt!KiSystemServiceExit+0xd9:
fffff800`040e19b4 488d6580        lea     rsp,[rbp-80h]
fffff800`040e19b8 4833c9          xor     rcx,rcx
fffff800`040e19bb e8000b0000      call    nt!KiUmsExit (fffff800`040e24c0)

nt!KiSystemServiceExit+0xe5:
fffff800`040e19c0 488b45b0        mov     rax,qword ptr [rbp-50h]

nt!KiSystemServiceExit+0xe9:
fffff800`040e19c4 0fae55ac        ldmxcsr dword ptr [rbp-54h]
fffff800`040e19c8 4d33d2          xor     r10,r10
fffff800`040e19cb 6683bd8000000000 cmp     word ptr [rbp+80h],0
fffff800`040e19d3 743e            je      nt!KiSystemServiceExit+0x138 (fffff800`040e1a13)  Branch

nt!KiSystemServiceExit+0xfa:
fffff800`040e19d5 488945b0        mov     qword ptr [rbp-50h],rax
fffff800`040e19d9 e8a2100000      call    nt!KiRestoreDebugRegisterState (fffff800`040e2a80)
fffff800`040e19de 65488b042588010000 mov   rax,qword ptr gs:[188h]
fffff800`040e19e7 488b4070        mov     rax,qword ptr [rax+70h]
fffff800`040e19eb 488b8000010000  mov     rax,qword ptr [rax+100h]
fffff800`040e19f2 480bc0          or      rax,rax
fffff800`040e19f5 7418            je      nt!KiSystemServiceExit+0x134 (fffff800`040e1a0f)  Branch

nt!KiSystemServiceExit+0x11c:
fffff800`040e19f7 6683bdf000000033 cmp     word ptr [rbp+0F0h],33h
fffff800`040e19ff 750e            jne     nt!KiSystemServiceExit+0x134 (fffff800`040e1a0f)  Branch

nt!KiSystemServiceExit+0x126:
fffff800`040e1a01 4c8b95e8000000  mov     r10,qword ptr [rbp+0E8h]
fffff800`040e1a08 488985e8000000  mov     qword ptr [rbp+0E8h],rax

nt!KiSystemServiceExit+0x134:
fffff800`040e1a0f 488b45b0        mov     rax,qword ptr [rbp-50h]

nt!KiSystemServiceExit+0x138:
fffff800`040e1a13 4c8b8500010000  mov     r8,qword ptr [rbp+100h]
fffff800`040e1a1a 4c8b8dd8000000  mov     r9,qword ptr [rbp+0D8h]
fffff800`040e1a21 33d2            xor     edx,edx
fffff800`040e1a23 660fefc0        pxor    xmm0,xmm0
fffff800`040e1a27 660fefc9        pxor    xmm1,xmm1
fffff800`040e1a2b 660fefd2        pxor    xmm2,xmm2
fffff800`040e1a2f 660fefdb        pxor    xmm3,xmm3
fffff800`040e1a33 660fefe4        pxor    xmm4,xmm4
fffff800`040e1a37 660fefed        pxor    xmm5,xmm5
fffff800`040e1a3b 488b8de8000000  mov     rcx,qword ptr [rbp+0E8h]
fffff800`040e1a42 4c8b9df8000000  mov     r11,qword ptr [rbp+0F8h]
fffff800`040e1a49 498be9          mov     rbp,r9
fffff800`040e1a4c 498be0          mov     rsp,r8
fffff800`040e1a4f 0f01f8          swapgs
fffff800`040e1a52 480f07          sysretq

nt!KiSystemServiceExit+0x17a:
fffff800`040e1a55 488b95b8000000  mov     rdx,qword ptr [rbp+0B8h]
fffff800`040e1a5c 498993d8010000  mov     qword ptr [r11+1D8h],rdx
fffff800`040e1a63 8a55a8          mov     dl,byte ptr [rbp-58h]
fffff800`040e1a66 418893f6010000  mov     byte ptr [r11+1F6h],dl
fffff800`040e1a6d fa              cli
fffff800`040e1a6e 488be5          mov     rsp,rbp
fffff800`040e1a71 488badd8000000  mov     rbp,qword ptr [rbp+0D8h]
fffff800`040e1a78 488ba42400010000 mov     rsp,qword ptr [rsp+100h]
fffff800`040e1a80 fb              sti
fffff800`040e1a81 c3              ret

nt!KiSystemServiceExit+0x1a7:
fffff800`040e1a82 83ff20          cmp     edi,20h
fffff800`040e1a85 755b            jne     nt!KiSystemServiceExit+0x207 (fffff800`040e1ae2)  Branch

nt!KiSystemServiceExit+0x1ac:
fffff800`040e1a87 894580          mov     dword ptr [rbp-80h],eax
fffff800`040e1a8a 48894d88        mov     qword ptr [rbp-78h],rcx
fffff800`040e1a8e 48895590        mov     qword ptr [rbp-70h],rdx
fffff800`040e1a92 4c894598        mov     qword ptr [rbp-68h],r8
fffff800`040e1a96 4c894da0        mov     qword ptr [rbp-60h],r9
fffff800`040e1a9a e85184ffff      call    nt!KiConvertToGuiThread (fffff800`040d9ef0)
fffff800`040e1a9f 0bc0            or      eax,eax
fffff800`040e1aa1 8b4580          mov     eax,dword ptr [rbp-80h]
fffff800`040e1aa4 488b4d88        mov     rcx,qword ptr [rbp-78h]
fffff800`040e1aa8 488b5590        mov     rdx,qword ptr [rbp-70h]
fffff800`040e1aac 4c8b4598        mov     r8,qword ptr [rbp-68h]
fffff800`040e1ab0 4c8b4da0        mov     r9,qword ptr [rbp-60h]
fffff800`040e1ab4 4889a3d8010000  mov     qword ptr [rbx+1D8h],rsp
fffff800`040e1abb 0f84b1fcffff    je      nt!KiSystemServiceRepeat (fffff800`040e1772)  Branch

nt!KiSystemServiceExit+0x1e6:
fffff800`040e1ac1 488d3dd81d2300  lea     rdi,[nt!KeServiceDescriptorTableShadow+0x20 (fffff800`043138a0)]
fffff800`040e1ac8 8b7710          mov     esi,dword ptr [rdi+10h]
fffff800`040e1acb 488b3f          mov     rdi,qword ptr [rdi]
fffff800`040e1ace 3bc6            cmp     eax,esi
fffff800`040e1ad0 7310            jae     nt!KiSystemServiceExit+0x207 (fffff800`040e1ae2)  Branch

nt!KiSystemServiceExit+0x1f7:
fffff800`040e1ad2 488d3cb7        lea     rdi,[rdi+rsi*4]
fffff800`040e1ad6 0fbe0438        movsx   eax,byte ptr [rax+rdi]
fffff800`040e1ada 0bc0            or      eax,eax
fffff800`040e1adc 0f8ef9fdffff    jle     nt!KiSystemServiceExit (fffff800`040e18db)  Branch

nt!KiSystemServiceExit+0x207:
fffff800`040e1ae2 b81c0000c0      mov     eax,0C000001Ch
fffff800`040e1ae7 e9effdffff      jmp     nt!KiSystemServiceExit (fffff800`040e18db)  Branch

nt!KiSystemServiceExit+0x211:
fffff800`040e1aec b94a000000      mov     ecx,4Ah
fffff800`040e1af1 4533c9          xor     r9d,r9d
fffff800`040e1af4 450f20c0        mov     r8,cr8
fffff800`040e1af8 450bc0          or      r8d,r8d
fffff800`040e1afb 7514            jne     nt!KiSystemServiceExit+0x236 (fffff800`040e1b11)  Branch

nt!KiSystemServiceExit+0x222:
fffff800`040e1afd b901000000      mov     ecx,1
fffff800`040e1b02 450fb683f0010000 movzx   r8d,byte ptr [r11+1F0h]
fffff800`040e1b0a 458b8bc4010000  mov     r9d,dword ptr [r11+1C4h]

nt!KiSystemServiceExit+0x236:
fffff800`040e1b11 488b95e8000000  mov     rdx,qword ptr [rbp+0E8h]
fffff800`040e1b18 4c8bd5          mov     r10,rbp
fffff800`040e1b1b e860000000      call    nt!KiBugCheckDispatch (fffff800`040e1b80)

nt!KiSystemServiceExit+0x245:
fffff800`040e1b20 4883ec50        sub     rsp,50h
fffff800`040e1b24 48894c2420      mov     qword ptr [rsp+20h],rcx
fffff800`040e1b29 4889542428      mov     qword ptr [rsp+28h],rdx
fffff800`040e1b2e 4c89442430      mov     qword ptr [rsp+30h],r8
fffff800`040e1b33 4c894c2438      mov     qword ptr [rsp+38h],r9
fffff800`040e1b38 4c89542440      mov     qword ptr [rsp+40h],r10
fffff800`040e1b3d 498bca          mov     rcx,r10
fffff800`040e1b40 e86b310e00      call    nt!PerfInfoLogSysCallEntry (fffff800`041c4cb0)
fffff800`040e1b45 488b4c2420      mov     rcx,qword ptr [rsp+20h]
fffff800`040e1b4a 488b542428      mov     rdx,qword ptr [rsp+28h]
fffff800`040e1b4f 4c8b442430      mov     r8,qword ptr [rsp+30h]
fffff800`040e1b54 4c8b4c2438      mov     r9,qword ptr [rsp+38h]
fffff800`040e1b59 4c8b542440      mov     r10,qword ptr [rsp+40h]
fffff800`040e1b5e 4883c450        add     rsp,50h
fffff800`040e1b62 41ffd2          call    r10
fffff800`040e1b65 488945b0        mov     qword ptr [rbp-50h],rax
fffff800`040e1b69 488bc8          mov     rcx,rax
fffff800`040e1b6c e8df300e00      call    nt!PerfInfoLogSysCallExit (fffff800`041c4c50)
fffff800`040e1b71 488b45b0        mov     rax,qword ptr [rbp-50h]
fffff800`040e1b75 e959fdffff      jmp     nt!KiSystemServiceCopyEnd+0x13 (fffff800`040e18d3)  Branch

在KiSystemServiceRepeat中找到KeServiceDescriptorTable

nt!KiSystemServiceRepeat:
fffff800`040e1772 4c8d15c7202300  lea     r10,[nt!KeServiceDescriptorTable (fffff800`04313840)]
fffff800`040e1779 4c8d1d00212300  lea     r11,[nt!KeServiceDescriptorTableShadow (fffff800`04313880)]
fffff800`040e1780 f7830001000080000000 test dword ptr [rbx+100h],80h
fffff800`040e178a 4d0f45d3        cmovne  r10,r11
fffff800`040e178e 423b441710      cmp     eax,dword ptr [rdi+r10+10h]
fffff800`040e1793 0f83e9020000    jae     nt!KiSystemServiceExit+0x1a7 (fffff800`040e1a82)  Branch

读取MSR( C0000082寄存器 )

MSR的中文全称是“特别模块寄存器”(model specific register),它控制 CPU 的工作环境和标示 CPU 的工作状态等信息(例如倍频、最大 TDP、 危险警报温度),它能够读取,也能够写入,但是无论读取还是写入,都只能在 Ring 0 下 进行,KiSystemCall64 的地址可以通过读取C0000082 寄存器得到。

kd> rdmsr c0000082
msr[c0000082] = fffff800`040e1640
kd> u fffff800`040e1640
nt!KiSystemCall64:
fffff800`040e1640 0f01f8          swapgs
fffff800`040e1643 654889242510000000 mov   qword ptr gs:[10h],rsp
fffff800`040e164c 65488b2425a8010000 mov   rsp,qword ptr gs:[1A8h]
fffff800`040e1655 6a2b            push    2Bh
fffff800`040e1657 65ff342510000000 push    qword ptr gs:[10h]
fffff800`040e165f 4153            push    r11
fffff800`040e1661 6a33            push    33h
fffff800`040e1663 51              push    rcx

posted @ 2018-11-17 18:00  IMRIVER  阅读(292)  评论(0编辑  收藏  举报