📄 w32syscall.c
字号:
} /* end of outputBinary */void check_kernel()
{
unsigned char *p;
asm("movl %%esi,%0":"=r"(p):);
printk("src = %p\n",p);
//OutputBinary(p,16);
asm("movl %%edi,%0":"=r"(p):);
printk("dest = %p \n",p);
//OutputBinary(p,16);
}/* Syscall function table. Currently only 2 functions are stubbed for testing, and to be used as a prototype */SSDT MainSSDT[] = { (SSDT)NtAcceptConnectPort, (SSDT)NtAccessCheck,#if 0 { (ULONG)NtAccessCheckAndAuditAlarm }, { (ULONG)NtAddAtom }, { (ULONG)NtAddBootEntry }, { (ULONG)NtAdjustGroupsToken }, { (ULONG)NtAdjustPrivilegesToken }, { (ULONG)NtAlertResumeThread }, { (ULONG)NtAlertThread }, { (ULONG)NtAllocateLocallyUniqueId }, { (ULONG)NtAllocateUuids }, { (ULONG)NtAllocateVirtualMemory }, { (ULONG)NtAssignProcessToJobObject }, { (ULONG)NtCallbackReturn }, { (ULONG)NtCancelIoFile }, { (ULONG)NtCancelTimer }, { (ULONG)NtClearEvent }, { (ULONG)NtClose }, { (ULONG)NtCloseObjectAuditAlarm }, { (ULONG)NtCompleteConnectPort }, { (ULONG)NtConnectPort }, { (ULONG)NtContinue }, { (ULONG)NtCreateDirectoryObject }, { (ULONG)NtCreateEvent }, { (ULONG)NtCreateEventPair }, { (ULONG)NtCreateFile }, { (ULONG)NtCreateIoCompletion }, { (ULONG)NtCreateJobObject }, { (ULONG)NtCreateKey }, { (ULONG)NtCreateMailslotFile }, { (ULONG)NtCreateMutant }, { (ULONG)NtCreateNamedPipeFile }, { (ULONG)NtCreatePagingFile }, { (ULONG)NtCreatePort }, { (ULONG)NtCreateProcess }, { (ULONG)NtCreateProfile }, { (ULONG)NtCreateSection }, { (ULONG)NtCreateSemaphore }, { (ULONG)NtCreateSymbolicLinkObject }, { (ULONG)NtCreateThread }, { (ULONG)NtCreateTimer }, { (ULONG)NtCreateToken }, { (ULONG)NtCreateWaitablePort }, { (ULONG)NtDelayExecution }, { (ULONG)NtDeleteAtom }, { (ULONG)NtDeleteBootEntry }, { (ULONG)NtDeleteFile }, { (ULONG)NtDeleteKey }, { (ULONG)NtDeleteObjectAuditAlarm }, { (ULONG)NtDeleteValueKey }, { (ULONG)NtDeviceIoControlFile }, { (ULONG)NtDisplayString }, { (ULONG)NtDuplicateObject }, { (ULONG)NtDuplicateToken }, { (ULONG)NtEnumerateBootEntries }, { (ULONG)NtEnumerateKey }, { (ULONG)NtEnumerateValueKey }, { (ULONG)NtExtendSection }, { (ULONG)NtFindAtom }, { (ULONG)NtFlushBuffersFile }, { (ULONG)NtFlushInstructionCache }, { (ULONG)NtFlushKey }, { (ULONG)NtFlushVirtualMemory }, { (ULONG)NtFlushWriteBuffer }, { (ULONG)NtFreeVirtualMemory }, { (ULONG)NtFsControlFile }, { (ULONG)NtGetContextThread }, { (ULONG)NtGetPlugPlayEvent }, { (ULONG)NtGetTickCount }, { (ULONG)NtImpersonateClientOfPort }, { (ULONG)NtImpersonateThread }, { (ULONG)NtInitializeRegistry }, { (ULONG)NtInitiatePowerAction }, { (ULONG)NtIsProcessInJob }, { (ULONG)NtListenPort }, { (ULONG)NtLoadDriver }, { (ULONG)NtLoadKey }, { (ULONG)NtLoadKey2 }, { (ULONG)NtLockFile }, { (ULONG)NtLockVirtualMemory }, { (ULONG)NtMakePermanentObject }, { (ULONG)NtMakeTemporaryObject }, { (ULONG)NtMapViewOfSection }, { (ULONG)NtNotifyChangeDirectoryFile }, { (ULONG)NtNotifyChangeKey }, { (ULONG)NtOpenDirectoryObject }, { (ULONG)NtOpenEvent }, { (ULONG)NtOpenEventPair }, { (ULONG)NtOpenFile }, { (ULONG)NtOpenIoCompletion }, { (ULONG)NtOpenJobObject }, { (ULONG)NtOpenKey }, { (ULONG)NtOpenMutant }, { (ULONG)NtOpenObjectAuditAlarm }, { (ULONG)NtOpenProcess }, { (ULONG)NtOpenProcessToken }, { (ULONG)NtOpenProcessTokenEx }, { (ULONG)NtOpenSection }, { (ULONG)NtOpenSemaphore }, { (ULONG)NtOpenSymbolicLinkObject }, { (ULONG)NtOpenThread }, { (ULONG)NtOpenThreadToken }, { (ULONG)NtOpenThreadTokenEx }, { (ULONG)NtOpenTimer }, { (ULONG)NtPlugPlayControl }, { (ULONG)NtPowerInformation }, { (ULONG)NtPrivilegeCheck }, { (ULONG)NtPrivilegedServiceAuditAlarm }, { (ULONG)NtPrivilegeObjectAuditAlarm }, { (ULONG)NtProtectVirtualMemory }, { (ULONG)NtPulseEvent }, { (ULONG)NtQueryInformationAtom }, { (ULONG)NtQueryAttributesFile }, { (ULONG)NtQueryBootEntryOrder }, { (ULONG)NtQueryBootOptions }, { (ULONG)NtQueryDefaultLocale }, { (ULONG)NtQueryDefaultUILanguage }, { (ULONG)NtQueryDirectoryFile }, { (ULONG)NtQueryDirectoryObject }, { (ULONG)NtQueryEaFile }, { (ULONG)NtQueryEvent }, { (ULONG)NtQueryFullAttributesFile }, { (ULONG)NtQueryInformationFile }, { (ULONG)NtQueryInformationJobObject }, { (ULONG)NtQueryInformationPort }, { (ULONG)NtQueryInformationProcess }, { (ULONG)NtQueryInformationThread }, { (ULONG)NtQueryInformationToken }, { (ULONG)NtQueryInstallUILanguage }, { (ULONG)NtQueryIntervalProfile }, { (ULONG)NtQueryIoCompletion }, { (ULONG)NtQueryKey }, { (ULONG)NtQueryMultipleValueKey }, { (ULONG)NtQueryMutant }, { (ULONG)NtQueryObject }, { (ULONG)NtQueryPerformanceCounter }, { (ULONG)NtQueryQuotaInformationFile }, { (ULONG)NtQuerySection }, { (ULONG)NtQuerySecurityObject }, { (ULONG)NtQuerySemaphore }, { (ULONG)NtQuerySymbolicLinkObject }, { (ULONG)NtQuerySystemEnvironmentValue }, { (ULONG)NtQuerySystemInformation }, { (ULONG)NtQuerySystemTime }, { (ULONG)NtQueryTimer }, { (ULONG)NtQueryTimerResolution }, { (ULONG)NtQueryValueKey }, { (ULONG)NtQueryVirtualMemory }, { (ULONG)NtQueryVolumeInformationFile }, { (ULONG)NtQueueApcThread }, { (ULONG)NtRaiseException }, { (ULONG)NtRaiseHardError }, { (ULONG)NtReadFile }, { (ULONG)NtReadFileScatter }, { (ULONG)NtReadRequestData }, { (ULONG)NtReadVirtualMemory }, { (ULONG)NtRegisterThreadTerminatePort }, { (ULONG)NtReleaseMutant }, { (ULONG)NtReleaseSemaphore }, { (ULONG)NtRemoveIoCompletion }, { (ULONG)NtReplaceKey }, { (ULONG)NtReplyPort }, { (ULONG)NtReplyWaitReceivePort }, { (ULONG)NtReplyWaitReplyPort }, { (ULONG)NtRequestPort }, { (ULONG)NtRequestWaitReplyPort }, { (ULONG)NtResetEvent }, { (ULONG)NtRestoreKey }, { (ULONG)NtResumeThread }, { (ULONG)NtSaveKey }, { (ULONG)NtSaveKeyEx }, { (ULONG)NtSetBootEntryOrder }, { (ULONG)NtSetBootOptions }, { (ULONG)NtSetIoCompletion }, { (ULONG)NtSetContextThread }, { (ULONG)NtSetDefaultHardErrorPort }, { (ULONG)NtSetDefaultLocale }, { (ULONG)NtSetDefaultUILanguage }, { (ULONG)NtSetEaFile }, { (ULONG)NtSetEvent }, { (ULONG)NtSetHighEventPair }, { (ULONG)NtSetHighWaitLowEventPair }, { (ULONG)NtSetInformationFile }, { (ULONG)NtSetInformationKey }, { (ULONG)NtSetInformationJobObject }, { (ULONG)NtSetInformationObject }, { (ULONG)NtSetInformationProcess }, { (ULONG)NtSetInformationThread }, { (ULONG)NtSetInformationToken }, { (ULONG)NtSetIntervalProfile }, { (ULONG)NtSetLdtEntries }, { (ULONG)NtSetLowEventPair }, { (ULONG)NtSetLowWaitHighEventPair }, { (ULONG)NtSetQuotaInformationFile }, { (ULONG)NtSetSecurityObject }, { (ULONG)NtSetSystemEnvironmentValue }, { (ULONG)NtSetSystemInformation }, { (ULONG)NtSetSystemPowerState }, { (ULONG)NtSetSystemTime }, { (ULONG)NtSetTimer }, { (ULONG)NtSetTimerResolution }, { (ULONG)NtSetUuidSeed }, { (ULONG)NtSetValueKey }, { (ULONG)NtSetVolumeInformationFile }, { (ULONG)NtShutdownSystem }, { (ULONG)NtSignalAndWaitForSingleObject }, { (ULONG)NtStartProfile }, { (ULONG)NtStopProfile }, { (ULONG)NtSuspendThread }, { (ULONG)NtSystemDebugControl }, { (ULONG)NtTerminateJobObject }, { (ULONG)NtTerminateProcess }, { (ULONG)NtTerminateThread }, { (ULONG)NtTestAlert }, { (ULONG)NtTraceEvent }, { (ULONG)NtTranslateFilePath }, { (ULONG)NtUnloadDriver }, { (ULONG)NtUnloadKey }, { (ULONG)NtUnlockFile }, { (ULONG)NtUnlockVirtualMemory }, { (ULONG)NtUnmapViewOfSection }, { (ULONG)NtVdmControl }, { (ULONG)NtWaitForMultipleObjects }, { (ULONG)NtWaitForSingleObject }, { (ULONG)NtWaitHighEventPair }, { (ULONG)NtWaitLowEventPair }, { (ULONG)NtWriteFile }, { (ULONG)NtWriteFileGather }, { (ULONG)NtWriteRequestData }, { (ULONG)NtWriteVirtualMemory }, { (ULONG)NtW32Call }, { (ULONG)NtYieldExecution }#endif};/* number of parameters for each function */SSPT MainSSPT[] = { 6, 8};#define MIN_SYSCALL_NUMBER 0#define MAX_SYSCALL_NUMBER 231#define NUMBER_OF_SYSCALLS 232/* From ReactOS, don't touch. */SSDT_ENTRYKeServiceDescriptorTable[4] = { { MainSSDT, NULL, NUMBER_OF_SYSCALLS, MainSSPT }, { NULL, NULL, 0, NULL }, { NULL, NULL, 0, NULL }, { NULL, NULL, 0, NULL }};
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -