查看文章 |
一段获取ssdt表及其中函数的简单代码
2009-03-02 23:34
typedef struct _SYSTEM_SERVICE_TABLE { PNTPROC ServiceTable ; // array of entry points PULONG CounterTable ; // array of usage counters . be NULL ULONG ServiceLimit ; // number of table entries UCHAR* ArgumentTable ; // array of bytes counts } SYSTEM_SERVICE_TABLE , *PSYSTEM_SERVICE_TABLE , **PPSYSTEM_SERVICE_TABLE ; ULONG GetSSDTFunction(ULONG nIndex, ULONG *pFunAddr ) { PETHREAD kthread; PSYSTEM_SERVICE_TABLE pssdt; kthread = (ULONG)PsGetCurrentThread(); pssdt = kthread ->ServiceTable; if( nIndex < pssdt->ServiceLimit ) { *pFunAddr = pssdt->ServiceTable [nIndex]; return *pFunAddr; } return 0; } |
最近读者: