VanCheer版主，听说你对汇编极其熟悉，能否帮一下忙？（同时欢迎其它汇编高手进来指点）

在Windows 2000平台上，通过以下这段代码，可以在不编写驱动程序的前提下直接操作系统空间内存（诸如写0xFFDDEEEE等），但是不太明白其中的原理。


void __declspec(naked) ModifyPrivilegeStub()
{
__asm
{
//
// Prolog
//
PUSHAD
PUSHFD
PUSH FS

MOV EBX,00000030h
MOV FS,BX
SUB ESP, 50h
MOV EBP,ESP

//
// Setup the exception frame to NULL
//
MOV EBX,DWORD PTR CS:[0FFDFF000h]
MOV DWORD PTR DS:[0FFDFF000h], 0FFFFFFFFh
MOV DWORD PTR [EBP],EBX

//
// Save away the existing KSS EBP
//
MOV ESI, DWORD PTR CS:[0FFDFF124h]
MOV EBX,DWORD PTR [ESI+00000128h]
MOV DWORD PTR [EBP+4h],EBX
MOV DWORD PTR [ESI+00000128h],EBP

//
// Save away the kernel time and the thread mode (kernel/user)
//
MOV EDI,DWORD PTR [ESI+00000137h]
MOV DWORD PTR [EBP+8h],EDI

//
// Set the thread mode (kernel/user) based on the code selector
//
MOV EBX,DWORD PTR [EBP+7Ch]
AND EBX,01
MOV BYTE PTR [ESI+00000137h],BL

STI

//
// 执行自己的代码=========================================================
//
..................

//
// 结束执行自己的代码=====================================================
//

// Epilog

//
// Restore the KSS EBP
//
MOV ESI,DWORD PTR CS:[0FFDFF124h]
MOV EBX,DWORD PTR [EBP+4]
MOV DWORD PTR [ESI+00000128h],EBX

//
// Restore the exception frame
//
MOV EBX,DWORD PTR [EBP]
MOV DWORD PTR FS:[00000000],EBX

//
// Restore the thread mode
//
MOV EBX,DWORD PTR [EBP+8h]
MOV ESI,DWORD PTR FS:[00000124h]
MOV BYTE PTR [ESI+00000137h],BL
ADD ESP, 50h
POP FS
POPFD
POPAD

RETF
}
}

===========

本来这个贴首先发在“病毒”版，但是从中午到现在居然没有一个人浏览，人气太差了:(:(:(，这个论坛又不允许转移贴子:mad: :mad: :mad:，只好再发一贴。  

[编辑 -  6/6/03 by  slwqw]

帮你顶 :D

帮你顶 :D

我只会DOS下的汇编。

[quote]帮你顶 :D

我只会DOS下的汇编。 [/quote]

现在一般都研究保护模式下的汇编，纯DOS的汇编比较少见了~~~

似乎是胡扯，我现在没SoftIce，没法仔细看，但
MOV EBX,00000030h
MOV FS,BX
如果我没记错的话，30h应该是ring 0段，那么“MOV FS,BX”肯定会导致GP错误的。
这个代码看起来应该有问题。

臭花猫还真利害！ :D :D
毒猫

似乎是胡扯，我现在没SoftIce，没法仔细看，但
MOV EBX,00000030h
MOV FS,BX
如果我没记错的话，30h应该是ring 0段，那么“MOV FS,BX”肯定会导致GP错误的。
这个代码看起来应该有问题。
 

我KAO，一看就看出问题来了。我上面没有交代清楚，在此再说明一下：这段代码是进入Ring0之后才执行的，这时候FS指向Ring0段应该是正常的。

至于在Win2000下面怎样不编写驱动就进入Ring0，WebCrazy早就已经公布了方法，我就不再说明了，何况它跟本贴也没有关系。

现在可以肯定地是：这段代码在我这里工作很正常，没有任何问题。我的平台是：Windows 2000 + SP3 中文版。

顶~~~~~~~~~~~~~~~~~~~~~~~~~~~~

期待阿猫地解答~~~~~~~~~~~~~~~~

你究竟要问什么？
既然进Ring0了，还有什么不能做的？

就是就是
都进了ring0了，访问操作系统空间内存还不是小case :D

你究竟要问什么？
既然进Ring0了，还有什么不能做的？

进入Ring0之后，当然什么都可以做，不过99%的情况下都可能导致死机。这段代码的作用就是用来防止死机的（当然，还是有可能死机，只是机率更小而已），所以我就想知道这其中的原理~~~~~~~~

具体一点吧，比如我想更改进程的Token的权限值，按理说这样做是没有问题的：

void __declspec(naked) ModifyPrivilegeStub()
{
__asm
{
//
// 我的代码
//
MOV     EAX,FS:[00000124h]
MOV     EAX,[EAX + 44h]
PUSH    EAX                // 把EPROCESS结构压入堆栈
...........
}
}

但是，计算机马上就Down了。

如果先执行上面我贴出的代码，再执行这段代码就一切正常了。

我现在就想知道上面我贴出的那段代码的作用，为什么先执行它然后再执行我的代码就不死机了呢？



[编辑 -  6/9/03 by  slwqw]

臭花猫还真利害！ :D :D
毒猫

KAO

最后一顶，然后让其自生自灭~~~~~~~~~~~~~~

最后一顶，然后让其自生自灭~~~~~~~~~~~~~~
 

老弟，这超出汇编的范围了，我也不知道那些数字（比如0FFDFF000h）是干什么的。
这个问题，需要问pjf，他比较明白这些玩意。

唉，找不到pif啊，他一两个月才来一次驱动开发网~~~~~~~~

唉，找不到pif啊，他一两个月才来一次驱动开发网~~~~~~~~

你去俺们CVC的Win32版发贴，他一去就看到了

事先声明，我是一菜鸟，有不到之处多包涵
这段代码应该是出自Undocumented Windows NT，网上一篇文章就此有过解释，地址：
http://www.windowsitlibrary.com/Content/356/10/2.html

PAGING ISSUES

While writing the callgate sample, we observed that there are certain issues regarding accessing the paged/swapped out data in the interrupt routine and also in the function called through callgate. All the existing interrupt handlers such as INT 2Eh were seen to follow certain entry and exit code before performing any real work. Some of the tasks performed by the entry code were:
1.Creates some space on stack.
2.Prepares a trap frame that will record the state of some of the CPU registers.
3.Saves away some of the fields in Thread Environment Block such as processor mode and one field in TEB, which SoftICE calls as \"KSS EBP.\" We don’t know the exact meaning of this, but its seems that each interrupt handler should set this field to the trap frame created in previous step.
4.Saves away the contents of FS register and sets FS register to 0x30.
Out of all these steps, the first step is absolutely necessary and is related to the logic used by page fault handler of the operating system. The page fault handler does some arithmetic on the current stack pointer and the stack pointer at the time of ring transition from ring 3 to ring 0 and take some decisions. If at least a specific amount of stack space is not found between these two stack pointer values, then the system crashes with a Blue Screen.

It is essential that you follow this while writing interrupt handlers or functions executed through callgate to successfully access paged out data. The fourth step of setting FS register to 0x30 is also necessary since the system expects FS register to point to Processor Control Region when the thread is executing in ring 0 and the selector 0x30 points to the descriptor with the base address equal to address of processor control region.

Note: Note that you have to follow the same steps while hooking software interrupts.

The second and third step seems to be only for bookkeeping information.

All the samples in this book that use callgates or interrupt handlers use a macro defined in UNDOCNT.INC file called Ring0Prolog and Ring0Epilog. These macros implement the code, which takes care of these paging issues.
按我的理解，它的意思是说当做软中断钩子的时候，最好按上面说的步骤来写代码，这样可避免中断例程中由于分页使某些数据不能访问而导致页错，且操作系统内部也是如此实现的，你可以跟踪反汇编int 2e的处理代码看看，就实际跟踪来看，
MOV EAX,FS:[00000124h]   //这里的值为0
MOV EAX,[EAX + 44h]   //由于0是无效地址，所以访问00000044H就产生页错（0XC0000005）
PUSH EAX // 把EPROCESS结构压入堆栈
...........

若加了如上代码，此时FS的值为0030，而0030：[00000124H]处的值不为0，且为有效地址，所以不会出错，至于这些地址中（0FFDFF000h）保存的是什么，我就不太清楚了

事先声明，我是一菜鸟，有不到之处多包涵
这段代码应该是出自Undocumented Windows NT，网上一篇文章就此有过解释，地址：
http://www.windowsitlibrary.com/Content/356/10/2.html

PAGING ISSUES

While writing the callgate sample, we observed that there are certain issues regarding accessing the paged/swapped out data in the interrupt routine and also in the function called through callgate. All the existing interrupt handlers such as INT 2Eh were seen to follow certain entry and exit code before performing any real work. Some of the tasks performed by the entry code were:
1.Creates some space on stack.
2.Prepares a trap frame that will record the state of some of the CPU registers.
3.Saves away some of the fields in Thread Environment Block such as processor mode and one field in TEB, which SoftICE calls as \"KSS EBP.\" We don’t know the exact meaning of this, but its seems that each interrupt handler should set this field to the trap frame created in previous step.
4.Saves away the contents of FS register and sets FS register to 0x30.
Out of all these steps, the first step is absolutely necessary and is related to the logic used by page fault handler of the operating system. The page fault handler does some arithmetic on the current stack pointer and the stack pointer at the time of ring transition from ring 3 to ring 0 and take some decisions. If at least a specific amount of stack space is not found between these two stack pointer values, then the system crashes with a Blue Screen.

It is essential that you follow this while writing interrupt handlers or functions executed through callgate to successfully access paged out data. The fourth step of setting FS register to 0x30 is also necessary since the system expects FS register to point to Processor Control Region when the thread is executing in ring 0 and the selector 0x30 points to the descriptor with the base address equal to address of processor control region.

Note: Note that you have to follow the same steps while hooking software interrupts.

The second and third step seems to be only for bookkeeping information.

All the samples in this book that use callgates or interrupt handlers use a macro defined in UNDOCNT.INC file called Ring0Prolog and Ring0Epilog. These macros implement the code, which takes care of these paging issues.
按我的理解，它的意思是说当做软中断钩子的时候，最好按上面说的步骤来写代码，这样可避免中断例程中由于分页使某些数据不能访问而导致页错，且操作系统内部也是如此实现的，你可以跟踪反汇编int 2e的处理代码看看，就实际跟踪来看，
MOV EAX,FS:[00000124h]   //这里的值为0
MOV EAX,[EAX + 44h]   //由于0是无效地址，所以访问00000044H就产生页错（0XC0000005）
PUSH EAX // 把EPROCESS结构压入堆栈
...........

若加了如上代码，此时FS的值为0030，而0030：[00000124H]处的值不为0，且为有效地址，所以不会出错，至于这些地址中（0FFDFF000h）保存的是什么，我就不太清楚了
 

没错啊，这段代码的确是从《Undocumented NT》上拷贝过来的，一直没有看懂。

真正难的部分就是这些数据到底是怎么得来的。

MOV ESI, DWORD PTR CS:[0FFDFF124h] // 为什么一定要使用0FFDFF124h？？？
MOV EBX,DWORD PTR [ESI+00000128h]  // 加128h又代表什么？
MOV DWORD PTR [EBP+4h],EBX
MOV DWORD PTR [ESI+00000128h],EBP

UndocNT的这段代码是直接仿制于NT系统代码（_KiSystemService），随NT版本而变，严格说来你应尽量
避免这样的代码。
已有注释了，我不再说明每句的意义，加几个字便于你理解：
Ring0Prolog macro
PUSHAD
PUSHFD
PUSH FS
;FS:0即指向FFDFF000h这个重要结构，用户态与核心态的FS值不同，下面是例行公事而已
MOV     EBX,00000030h
MOV     FS,BX
SUB     ESP, 50h        
MOV     EBP,ESP
；看英文注释
;Setup the exception frame to NULL
MOV     EBX,DWORD PTR CS:[0FFDFF000h]
MOV     DWORD PTR DS:[0FFDFF000h], 0FFFFFFFFh
MOV     DWORD PTR [EBP],EBX
；CS:[FFDFF124h]存有大家再熟悉不过的线程核心块KTHREAD，其中偏移128h处为TrapFrame，顾名思义了吧。
;Save away the existing KSS EBP
MOV     ESI, DWORD PTR CS:[0FFDFF124h]
MOV     EBX,DWORD PTR [ESI+00000128h]
MOV     DWORD PTR [EBP+4h],EBX
MOV     DWORD PTR [ESI+00000128h],EBP
；块偏移137h处为PreviousMode，简单说供核心函数区分是用户态还是核心态请求，直接决定了某些函数调
；用的成功与否。btw，137与上面的128都是nt上的偏移，2000/XP下是不同的，所以这段代码平台相关，你
；并不能照抄
;Save away the kernel time and the thread mode (kernel/user)
MOV     EDI,DWORD PTR [ESI+00000137h]
MOV     DWORD PTR [EBP+8h],EDI

;Set the thread mode (kernel/user) based on the code selector
MOV     EBX,DWORD PTR [EBP+7Ch]
AND     EBX,01
MOV     BYTE PTR [ESI+00000137h],BL

STI
endm

真高兴得到pif老大的亲自指点;)，不过我的道行有限，所以也没有完全弄明白。

OK，先不管这些问题了，问另外一些问题吧，好不容易有这种机会，要好好利用一下:D:D:D

在Ring0中，FS指向一个PCR（Processsor Control Region）结构，我想知道的是PCR、NIB（or TIB ?）、KTHREAD、ETHREAD、KPROCESS、EPROCESS这些结构是如何关联在一起的？？？比如“EPROCESS的???偏移处指向KPROCESS结构”等等这些东西。

我在网上倒是搜索到了一大把有关这些结构的定义，不过它们之间看起来相差好大，我反而被弄得糊涂了 :(