01 intro.txt

gloomy的windows内核hacker研究

        PVOID FiberData;                // for TIB
        ULONG Version;                       // for TEB
    };
    PVOID ArbitraryUserPointer;              // 14h Available
// for application use
    struct _NT_TIB *Self;                    // 18h Linear address
// of TEB structure
} NT_TIB;
typedef NT_TIB *PNT_TIB;


typedef struct _TEB {              // Size: 0xF88
/*000*/  NT_TIB NtTib;
/*01C*/  VOID *EnvironmentPointer;
/*020*/  CLIENT_ID ClientId;       // PROCESS id, THREAD id
/*028*/  HANDLE ActiveRpcHandle;
/*02C*/  VOID *ThreadLocalStoragePointer;
/*030*/  PEB *ProcessEnvironmentBlock;  // PEB
/*034*/  ULONG LastErrorValue;
/*038*/  ULONG CountOfOwnedCriticalSections;
/*03C*/  ULONG CsrClientThread;
/*040*/  ULONG Win32ThreadInfo;
/*044*/  UCHAR Win32ClientInfo[0x7C];
/*0C0*/  ULONG WOW32Reserved;
/*0C4*/  ULONG CurrentLocale;
/*0C8*/  ULONG FpSoftwareStatusRegister;
/*0CC*/  UCHAR SystemReserved1[0xD8];   // ExitStack ???
/*1A4*/  ULONG Spare1;
/*1A8*/  ULONG ExceptionCode;
/*1AC*/  UCHAR SpareBytes1[0x28];
/*1D4*/  UCHAR SystemReserved2[0x28];
/*1FC*/  UCHAR GdiTebBatch[0x4E0];
/*6DC*/  ULONG gdiRgn;
/*6E0*/  ULONG gdiPen;
/*6E4*/  ULONG gdiBrush;
/*6E8*/  CLIENT_ID RealClientId;
/*6F0*/  ULONG GdiCachedProcessHandle;
/*6F4*/  ULONG GdiClientPID;
/*6F8*/  ULONG GdiClientTID;
/*6FC*/  ULONG GdiThreadLocalInfo;
/*700*/  UCHAR UserReserved[0x14];
/*714*/  UCHAR glDispatchTable[0x460];
/*B74*/  UCHAR glReserved1[0x68];
/*BDC*/  ULONG glReserved2;
/*BE0*/  ULONG glSectionInfo;
/*BE4*/  ULONG glSection;
/*BE8*/  ULONG glTable;
/*BEC*/  ULONG glCurrentRC;
/*BF0*/  ULONG glContext;
/*BF4*/  ULONG LastStatusValue;
/*BF8*/  LARGE_INTEGER StaticUnicodeString;
/*C00*/  UCHAR StaticUnicodeBuffer[0x20C];
/*E0C*/  ULONG DeallocationStack;
/*E10*/  UCHAR TlsSlots[0x100];
/*F10*/  LARGE_INTEGER TlsLinks;
/*F18*/  ULONG Vdm;
/*F1C*/  ULONG ReservedForNtRpc;
/*F20*/  LARGE_INTEGER DbgSsReserved;
/*F28*/  ULONG HardErrorsAreDisabled;
/*F2C*/  UCHAR Instrumentation[0x40];
/*F6C*/  ULONG WinSockData;
/*F70*/  ULONG GdiBatchCount;
/*F74*/  ULONG Spare2;
/*F78*/  ULONG Spare3;
/*F7C*/  ULONG Spare4;
/*F80*/  ULONG ReservedForOle;
/*F84*/  ULONG WaitingOnLoaderLock;
} TEB, *PTEB;

在Windows 95下，位于TIB中的偏移0x30的是指向拥有该线程的进程的基址数据指针。在Windows NT 4.0中，这个偏移保存的是指向结构体的指针，该结构体实现于kernel32.dll。遗憾的是，到现在为止，除了几个域之外我还不清楚这个结构体的格式。除此之外，类似的，在Win 2K中
PEB结构体也发生了变化。

typedef struct _PROCESS_PARAMETERS {
/*000*/   ULONG AllocationSize;
/*004*/   ULONG ActualSize;
/*008*/   ULONG Flags;//PPFLAG_xxx
/*00c*/   ULONG Unknown1;
/*010*/   ULONG Unknown2;
/*014*/   ULONG Unknown3;
/*018*/   HANDLE InputHandle;
/*01c*/   HANDLE OutputHandle;
/*020*/   HANDLE ErrorHandle;
/*024*/   UNICODE_STRING CurrentDirectory;
/*028*/   HANDLE CurrentDir;
/*02c*/   UNICODE_STRING SearchPaths;
/*030*/   UNICODE_STRING ApplicationName;
/*034*/   UNICODE_STRING CommandLine;
/*038*/   PVOID EnvironmentBlock;
/*03c*/   ULONG Unknown[9];
     UNICODE_STRING Unknown4;
     UNICODE_STRING Unknown5;
     UNICODE_STRING Unknown6;
     UNICODE_STRING Unknown7;
} PROCESS_PARAMETERS, *PPROCESS_PARAMETERS;

typedef struct _PEB {                   // Size: 0x1D8
/*000*/ UCHAR InheritedAddressSpace;
/*001*/ UCHAR ReadImageFileExecOptions;
/*002*/ UCHAR BeingDebugged;
/*003*/ UCHAR SpareBool;                     // Allocation size
/*004*/ HANDLE Mutant;
/*008*/ HINSTANCE ImageBaseAddress;          // Instance
/*00C*/ VOID *DllList;
/*010*/ PPROCESS_PARAMETERS *ProcessParameters;
/*014*/ ULONG SubSystemData;
/*018*/ HANDLE DefaultHeap;
/*01C*/ KSPIN_LOCK FastPebLock;
/*020*/ ULONG FastPebLockRoutine;
/*024*/ ULONG FastPebUnlockRoutine;
/*028*/ ULONG EnvironmentUpdateCount;
/*02C*/ ULONG KernelCallbackTable;
/*030*/ LARGE_INTEGER SystemReserved;
/*038*/ ULONG FreeList;
/*03C*/ ULONG TlsExpansionCounter;
/*040*/ ULONG TlsBitmap;
/*044*/ LARGE_INTEGER TlsBitmapBits;
/*04C*/ ULONG ReadOnlySharedMemoryBase;
/*050*/ ULONG ReadOnlySharedMemoryHeap;
/*054*/ ULONG ReadOnlyStaticServerData;
/*058*/ ULONG AnsiCodePageData;
/*05C*/ ULONG OemCodePageData;
/*060*/ ULONG UnicodeCaseTableData;
/*064*/ ULONG NumberOfProcessors;
/*068*/ LARGE_INTEGER NtGlobalFlag;          // Address of a local copy
/*070*/ LARGE_INTEGER CriticalSectionTimeout;
/*078*/ ULONG HeapSegmentReserve;
/*07C*/ ULONG HeapSegmentCommit;
/*080*/ ULONG HeapDeCommitTotalFreeThreshold;
/*084*/ ULONG HeapDeCommitFreeBlockThreshold;
/*088*/ ULONG NumberOfHeaps;
/*08C*/ ULONG MaximumNumberOfHeaps;
/*090*/ ULONG ProcessHeaps;
/*094*/ ULONG GdiSharedHandleTable;
/*098*/ ULONG ProcessStarterHelper;
/*09C*/ ULONG GdiDCAttributeList;
/*0A0*/ KSPIN_LOCK LoaderLock;
/*0A4*/ ULONG OSMajorVersion;
/*0A8*/ ULONG OSMinorVersion;
/*0AC*/ USHORT OSBuildNumber;
/*0AE*/ USHORT OSCSDVersion;
/*0B0*/ ULONG OSPlatformId;
/*0B4*/ ULONG ImageSubsystem;
/*0B8*/ ULONG ImageSubsystemMajorVersion;
/*0BC*/ ULONG ImageSubsystemMinorVersion;
/*0C0*/ ULONG ImageProcessAffinityMask;
/*0C4*/ ULONG GdiHandleBuffer[0x22];
/*14C*/ ULONG PostProcessInitRoutine;
/*150*/ ULONG TlsExpansionBitmap;
/*154*/ UCHAR TlsExpansionBitmapBits[0x80];
/*1D4*/ ULONG SessionId;
} PEB, *PPEB;

在TEB的开头是NT_TIB结构体（TEB和TIB的结合）。这个结构体中的大部分名字都很易懂，最有意思的是指向异常处理链表的指针peExcept（Fs:[0]）。这个域经常被引用。如果在随便某个Win32应用程序下看一下实际的情况，可以看到类似下面这样的代码：

.01B45480: 64A100000000                 mov       eax,fs:[000000000]
.01B45486: 55                           push      ebp
.01B45487: 8BEC                         mov       ebp,esp
.01B45489: 6AFF                         push      0FF
.01B4548B: 68F868B401                   push      001B468F8
.01B45490: 687256B401                   push      001B45672
.01B45495: 50                           push      eax
.01B45496: 64892500000000               mov       fs:[000000000],esp
.01B4549D: 83EC78                       sub       esp,078

这段有代表性的代码是由编译器生成的，用于在堆栈中生成_EXCEPTION_REGISTRATION_RECORD。这个堆栈中的结构体用于实现称作“structured exception handling”的机制，这就是结构化异常处理。接着，我们来看Windows NT下的结构化异常处理。这个机制可真是十分著名，而且实现在编译器的细节之中。在MSDN中可以找到Matt Petriek写得非常详细的文章，题为“A Crash Course  on  the  Depths  of Win32 Structured Exception Handling”，此文介绍的就是这项机制。

FS:[0]中的指针是指向_EXCEPTION_REGISTRATION_RECORD首部的指针。对应地，每个结构体在pNext域中包含着指向下一个结构体的指针和指向回调函数pfnHandler的指针。不难猜到，这就是异常处理的处理程序。函数的原型如下：

EXCEPTION_DISPOSITION    __cdecl _except_handler(
struct _EXCEPTION_RECORD *ExceptionRecord,
void * EstablisherFrame,
struct _CONTEXT *ContextRecord,
void * DispatcherContext
);

我们来分析函数的参数。第一个参数是指向下面结构体的指针。

typedef struct _EXCEPTION_RECORD {
DWORD ExceptionCode;
DWORD ExceptionFlags;
struct _EXCEPTION_RECORD *ExceptionRecord;
PVOID ExceptionAddress;
DWORD NumberParameters;
DWORD ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS];
} EXCEPTION_RECORD;