用户APC的执行过程

时间:2019-11-03
本文章向大家介绍用户APC的执行过程,主要包括用户APC的执行过程使用实例、应用技巧、基本知识点总结和需要注意事项,具有一定的参考价值,需要的朋友可以参考一下。

Windows内核分析索引目录:https://www.cnblogs.com/onetrainee/p/11675224.html

用户APC的执行过程

一、一个启发式问题

  有一个问题,线程什么时候检查自己的APC队列,答案前面已经介绍过,是执行KiServerExit函数时。

  KiServiceExit函数:这个函数是系统调用、异常或中断的必经之路。

  也就是说:当线程发现自己有APC要执行时,已经处于内核了,我们在系统调用那一节介绍过,从三环到零环,将数据保存在 _KTRAP_FRAME 结构体中。

  现在,我们发现有用户APC要执行,肯定要返回三环,肯定也需要借助 _KTRAP_FRAME 结构体。

  但是,_KTRAP_FRAME结构体保存着是原先的三环地址,返回绝对不可能返回到那里去,一定返回另外一个地方。

  可一个线程只有一个_KTRAP_FRAME,返回只能通过这个返回。

  因此,我们真正要做的:将原来的_KTRAP_FRAME结构体保存起来,之后建立一个新的,往里面写入返回时执行的ESP(栈地址)与EIP(代码地址),之后返回三环执行。

    执行完之后返回到零环,继续执行原来的任务。(如果搞懂这一点,那么用户APC的执行过程已经解决一大半了!)

二、用户APC过程分析:

由于分析量大,代码繁杂,直接整理成图标的形式展现出来,最后附带反汇编代码可以自己观看。

 三、反汇编代码

1. KiserviceExit(ntkrnlpa.exe)代码分析

  1 :004667F0 _KiServiceExit2 proc near               ; CODE XREF: NtContinue(x,x)+3A↓j
  2 .text:004667F0                                         ; NtRaiseException(x,x,x)+3C↓j ...
  3 .text:004667F0
  4 .text:004667F0 arg_C           = dword ptr  10h
  5 .text:004667F0 arg_10          = dword ptr  14h
  6 .text:004667F0 arg_38          = dword ptr  3Ch
  7 .text:004667F0 arg_3C          = dword ptr  40h
  8 .text:004667F0 arg_40          = dword ptr  44h
  9 .text:004667F0 arg_44          = dword ptr  48h
 10 .text:004667F0 arg_48          = dword ptr  4Ch
 11 .text:004667F0 arg_60          = dword ptr  64h
 12 .text:004667F0 arg_64          = dword ptr  68h
 13 .text:004667F0 arg_68          = dword ptr  6Ch
 14 .text:004667F0 arg_6C          = dword ptr  70h
 15 .text:004667F0
 16 .text:004667F0                 cli
 17 .text:004667F1                 test    dword ptr [ebp+70h], 20000h
 18 .text:004667F8                 jnz     short loc_466800 ; 获取Kthread
 19 .text:004667FA                 test    byte ptr [ebp+6Ch], 1
 20 .text:004667FE                 jz      short loc_466834
 21 .text:00466800
 22 .text:00466800 loc_466800:                             ; CODE XREF: _KiServiceExit2+8↑j
 23 .text:00466800                                         ; _KiServiceExit2+41↓j
 24 .text:00466800                 mov     ebx, ds:0FFDFF124h ; 获取Kthread
 25 .text:00466806                 mov     byte ptr [ebx+2Eh], 0
 26 .text:0046680A                 cmp     byte ptr [ebx+4Ah], 0 ; 判断是否有用户APC请求
 27 .text:0046680E                 jz      short loc_466834 ; 如果有APC请求则不会跳转
 28 .text:00466810                 mov     ebx, ebp
 29 .text:00466812                 mov     ecx, 1          ; NewIrql
 30 .text:00466817                 call    ds:__imp_@KfRaiseIrql@4 ; KfRaiseIrql(x)
 31 .text:0046681D                 push    eax
 32 .text:0046681E                 sti
 33 .text:0046681F                 push    ebx
 34 .text:00466820                 push    0
 35 .text:00466822                 push    1               ; 这里处理用户层的APC函数
 36 .text:00466824                 call    _KiDeliverApc@12 ; 该函数实现对APC的处理
 37 .text:00466829                 pop     ecx             ; NewIrql
 38 .text:0046682A                 call    ds:__imp_@KfLowerIrql@4 ; KfLowerIrql(x)
 39 .text:00466830                 cli
 40 .text:00466831                 jmp     short loc_466800 ; 获取Kthread
 41 .text:00466831 ; ---------------------------------------------------------------------------
 42 .text:00466833                 db  90h
 43 .text:00466834 ; ---------------------------------------------------------------------------
 44 .text:00466834
 45 .text:00466834 loc_466834:                             ; CODE XREF: _KiServiceExit2+E↑j
 46 .text:00466834                                         ; _KiServiceExit2+1E↑j
 47 .text:00466834                 mov     edx, [esp+arg_48]
 48 .text:00466838                 mov     ebx, large fs:50h
 49 .text:0046683F                 mov     large fs:0, edx
 50 .text:00466846                 mov     ecx, [esp+arg_44]
 51 .text:0046684A                 mov     esi, large fs:124h
 52 .text:00466851                 mov     [esi+140h], cl
 53 .text:00466857                 test    ebx, 0FFh
 54 .text:0046685D                 jnz     short loc_4668B0
 55 .text:0046685F
 56 .text:0046685F loc_46685F:                             ; CODE XREF: _KiServiceExit2+D0↓j
 57 .text:0046685F                                         ; _KiServiceExit2+FB↓j
 58 .text:0046685F                 test    [esp+arg_6C], 20000h
 59 .text:00466867                 jnz     loc_466FD4
 60 .text:0046686D                 test    word ptr [esp+arg_68], 0FFF8h
 61 .text:00466874                 jz      short loc_4668F0
 62 .text:00466876                 mov     edx, [esp+arg_38]
 63 .text:0046687A                 mov     ecx, [esp+arg_3C]
 64 .text:0046687E                 mov     eax, [esp+arg_40]
 65 .text:00466882                 cmp     word ptr [ebp+6Ch], 8
 66 .text:00466887                 jz      short loc_466895
 67 .text:00466889                 lea     esp, [ebp+30h]
 68 .text:0046688C                 pop     gs
 69 .text:0046688E                 pop     es
 70 .text:0046688F                 pop     ds
 71 .text:00466890                 lea     esp, [ebp+50h]
 72 .text:00466893                 pop     fs
 73 .text:00466895
 74 .text:00466895 loc_466895:                             ; CODE XREF: _KiServiceExit2+97↑j
 75 .text:00466895                 lea     esp, [ebp+54h]
 76 .text:00466898                 pop     edi
 77 .text:00466899                 pop     esi
 78 .text:0046689A                 pop     ebx
 79 .text:0046689B                 pop     ebp
 80 .text:0046689C                 cmp     word ptr [esp-60h+arg_64], 80h
 81 .text:004668A3                 ja      loc_466FF0
 82 .text:004668A9                 add     esp, 4
 83 .text:004668AC                 iret
 84 .text:004668AC ; ---------------------------------------------------------------------------
 85 .text:004668AD                 db  8Dh
 86 .text:004668AE                 db  49h ; I
 87 .text:004668AF                 db    0
 88 .text:004668B0 ; ---------------------------------------------------------------------------
 89 .text:004668B0
 90 .text:004668B0 loc_4668B0:                             ; CODE XREF: _KiServiceExit2+6D↑j
 91 .text:004668B0                 test    dword ptr [ebp+70h], 20000h
 92 .text:004668B7                 jnz     short loc_4668C2
 93 .text:004668B9                 test    dword ptr [ebp+6Ch], 1
 94 .text:004668C0                 jz      short loc_46685F
 95 .text:004668C2
 96 .text:004668C2 loc_4668C2:                             ; CODE XREF: _KiServiceExit2+C7↑j
 97 .text:004668C2                 xor     ebx, ebx
 98 .text:004668C4                 mov     esi, [ebp+18h]
 99 .text:004668C7                 mov     edi, [ebp+1Ch]
100 .text:004668CA                 mov     dr7, ebx
101 .text:004668CD                 mov     dr0, esi
102 .text:004668D0                 mov     ebx, [ebp+20h]
103 .text:004668D3                 mov     dr1, edi
104 .text:004668D6                 mov     dr2, ebx
105 .text:004668D9                 mov     esi, [ebp+24h]
106 .text:004668DC                 mov     edi, [ebp+28h]
107 .text:004668DF                 mov     ebx, [ebp+2Ch]
108 .text:004668E2                 mov     dr3, esi
109 .text:004668E5                 mov     dr6, edi
110 .text:004668E8                 mov     dr7, ebx
111 .text:004668EB                 jmp     loc_46685F
112 .text:004668F0 ; ---------------------------------------------------------------------------
113 .text:004668F0
114 .text:004668F0 loc_4668F0:                             ; CODE XREF: _KiServiceExit2+84↑j
115 .text:004668F0                 mov     ebx, [esp+arg_C]
116 .text:004668F4                 mov     [esp+arg_68], ebx
117 .text:004668F8                 mov     ebx, [esp+arg_10]
118 .text:004668FC                 sub     ebx, 0Ch
119 .text:004668FF                 mov     [esp+arg_60], ebx
120 .text:00466903                 mov     esi, [esp+arg_6C]
121 .text:00466907                 mov     [ebx+8], esi
122 .text:0046690A                 mov     esi, [esp+arg_68]
123 .text:0046690E                 mov     [ebx+4], esi
124 .text:00466911                 mov     esi, [esp+arg_64]
125 .text:00466915                 mov     [ebx], esi
126 .text:00466917                 mov     eax, [esp+arg_40]
127 .text:0046691B                 mov     edx, [esp+arg_38]
128 .text:0046691F                 mov     ecx, [esp+arg_3C]
129 .text:00466923                 add     esp, 54h
130 .text:00466926                 pop     edi
131 .text:00466927                 pop     esi
132 .text:00466928                 pop     ebx
133 .text:00466929                 pop     ebp
134 .text:0046692A                 mov     esp, [esp-64h+arg_60]
135 .text:0046692D                 iret
136 .text:0046692D _KiServiceExit2 endp ; sp-analysis failed

2. KiDeliverApc(ntkrnlpa.exe)代码分析

  1 ; __stdcall KiDeliverApc(x, x, x)
  2 .text:00426A2E                 public _KiDeliverApc@12
  3 .text:00426A2E _KiDeliverApc@12 proc near              ; CODE XREF: KiSwapThread()+5F↓p
  4 .text:00426A2E                                         ; _KiSystemService+21B↓p ...
  5 .text:00426A2E
  6 .text:00426A2E LockHandle      = _KLOCK_QUEUE_HANDLE ptr -28h
  7 .text:00426A2E var_1C          = dword ptr -1Ch
  8 .text:00426A2E BugCheckParameter1= dword ptr -18h
  9 .text:00426A2E var_14          = dword ptr -14h
 10 .text:00426A2E var_10          = dword ptr -10h
 11 .text:00426A2E var_C           = dword ptr -0Ch
 12 .text:00426A2E var_8           = dword ptr -8
 13 .text:00426A2E var_4           = dword ptr -4
 14 .text:00426A2E arg_0           = byte ptr  8
 15 .text:00426A2E arg_4           = dword ptr  0Ch
 16 .text:00426A2E arg_8           = dword ptr  10h
 17 .text:00426A2E
 18 .text:00426A2E                 mov     edi, edi
 19 .text:00426A30                 push    ebp
 20 .text:00426A31                 mov     ebp, esp
 21 .text:00426A33                 sub     esp, 28h
 22 .text:00426A36                 mov     ecx, [ebp+arg_8]
 23 .text:00426A39                 test    ecx, ecx
 24 .text:00426A3B                 jz      short loc_426A54
 25 .text:00426A3D                 mov     edx, [ecx+68h]
 26 .text:00426A40                 mov     eax, offset _ExpInterlockedPopEntrySListResume@0 ; ExpInterlockedPopEntrySListResume()
 27 .text:00426A45                 cmp     edx, eax
 28 .text:00426A47                 jb      short loc_426A54
 29 .text:00426A49                 cmp     edx, offset _ExpInterlockedPopEntrySListEnd@0 ; ExpInterlockedPopEntrySListEnd()
 30 .text:00426A4F                 ja      short loc_426A54
 31 .text:00426A51                 mov     [ecx+68h], eax
 32 .text:00426A54
 33 .text:00426A54 loc_426A54:                             ; CODE XREF: KiDeliverApc(x,x,x)+D↑j
 34 .text:00426A54                                         ; KiDeliverApc(x,x,x)+19↑j ...
 35 .text:00426A54                 push    ebx
 36 .text:00426A55                 push    esi
 37 .text:00426A56                 push    edi
 38 .text:00426A57                 mov     eax, large fs:124h
 39 .text:00426A5D                 mov     esi, eax
 40 .text:00426A5F                 mov     eax, [esi+134h]
 41 .text:00426A65                 mov     [ebp+var_1C], eax
 42 .text:00426A68                 mov     eax, [esi+44h]
 43 .text:00426A6B                 mov     [esi+134h], ecx
 44 .text:00426A71                 lea     ecx, [esi+0E8h] ; SpinLock
 45 .text:00426A77                 lea     edx, [ebp+LockHandle] ; LockHandle
 46 .text:00426A7A                 mov     [ebp+BugCheckParameter1], eax
 47 .text:00426A7D                 call    ds:__imp_@KeAcquireInStackQueuedSpinLock@8 ; KeAcquireInStackQueuedSpinLock(x,x)
 48 .text:00426A83                 mov     byte ptr [esi+49h], 0
 49 .text:00426A87                 lea     ebx, [esi+34h]  ; 取内核APC列表(双向链表 第一个内核 第二个用户)
 50 .text:00426A8A                 jmp     loc_426B70      ; 判断第一个链表是否为空,如果内核与当前地址一样,说明没有内核APC函数。
 51 .text:00426A8F ; ---------------------------------------------------------------------------
 52 .text:00426A8F
 53 .text:00426A8F loc_426A8F:                             ; CODE XREF: KiDeliverApc(x,x,x)+144↓j
 54 .text:00426A8F                 mov     eax, [ebx]
 55 .text:00426A91                 lea     edi, [eax-0Ch]
 56 .text:00426A94                 mov     ecx, [edi+14h]
 57 .text:00426A97                 mov     [ebp+var_14], ecx
 58 .text:00426A9A                 mov     ecx, [edi+1Ch]
 59 .text:00426A9D                 test    ecx, ecx
 60 .text:00426A9F                 mov     [ebp+var_4], ecx
 61 .text:00426AA2                 mov     edx, [edi+20h]
 62 .text:00426AA5                 mov     [ebp+var_10], edx
 63 .text:00426AA8                 mov     edx, [edi+24h]
 64 .text:00426AAB                 mov     [ebp+var_C], edx
 65 .text:00426AAE                 mov     edx, [edi+28h]
 66 .text:00426AB1                 mov     [ebp+var_8], edx
 67 .text:00426AB4                 jnz     short loc_426AF2
 68 .text:00426AB6                 mov     ecx, [eax]
 69 .text:00426AB8                 mov     eax, [eax+4]
 70 .text:00426ABB                 mov     [eax], ecx
 71 .text:00426ABD                 mov     [ecx+4], eax
 72 .text:00426AC0                 lea     ecx, [ebp+LockHandle] ; LockHandle
 73 .text:00426AC3                 mov     byte ptr [edi+2Eh], 0
 74 .text:00426AC7                 call    ds:__imp_@KeReleaseInStackQueuedSpinLock@4 ; KeReleaseInStackQueuedSpinLock(x)
 75 .text:00426ACD                 lea     eax, [ebp+var_8]
 76 .text:00426AD0                 push    eax
 77 .text:00426AD1                 lea     eax, [ebp+var_C]
 78 .text:00426AD4                 push    eax
 79 .text:00426AD5                 lea     eax, [ebp+var_10]
 80 .text:00426AD8                 push    eax
 81 .text:00426AD9                 lea     eax, [ebp+var_4]
 82 .text:00426ADC                 push    eax
 83 .text:00426ADD                 push    edi
 84 .text:00426ADE                 call    [ebp+var_14]
 85 .text:00426AE1                 lea     edx, [ebp+LockHandle] ; LockHandle
 86 .text:00426AE4                 lea     ecx, [esi+0E8h] ; SpinLock
 87 .text:00426AEA                 call    ds:__imp_@KeAcquireInStackQueuedSpinLock@8 ; KeAcquireInStackQueuedSpinLock(x,x)
 88 .text:00426AF0                 jmp     short loc_426B70 ; 判断第一个链表是否为空,如果内核与当前地址一样,说明没有内核APC函数。
 89 .text:00426AF2 ; ---------------------------------------------------------------------------
 90 .text:00426AF2
 91 .text:00426AF2 loc_426AF2:                             ; CODE XREF: KiDeliverApc(x,x,x)+86↑j
 92 .text:00426AF2                 cmp     byte ptr [esi+48h], 0
 93 .text:00426AF6                 jnz     loc_426C05
 94 .text:00426AFC                 cmp     dword ptr [esi+0D4h], 0
 95 .text:00426B03                 jnz     loc_426C05
 96 .text:00426B09                 mov     ecx, [eax]
 97 .text:00426B0B                 mov     eax, [eax+4]
 98 .text:00426B0E                 mov     [eax], ecx
 99 .text:00426B10                 mov     [ecx+4], eax
100 .text:00426B13                 lea     ecx, [ebp+LockHandle] ; LockHandle
101 .text:00426B16                 mov     byte ptr [edi+2Eh], 0
102 .text:00426B1A                 call    ds:__imp_@KeReleaseInStackQueuedSpinLock@4 ; KeReleaseInStackQueuedSpinLock(x)
103 .text:00426B20                 lea     eax, [ebp+var_8]
104 .text:00426B23                 push    eax
105 .text:00426B24                 lea     eax, [ebp+var_C]
106 .text:00426B27                 push    eax
107 .text:00426B28                 lea     eax, [ebp+var_10]
108 .text:00426B2B                 push    eax
109 .text:00426B2C                 lea     eax, [ebp+var_4]
110 .text:00426B2F                 push    eax
111 .text:00426B30                 push    edi
112 .text:00426B31                 call    [ebp+var_14]
113 .text:00426B34                 cmp     [ebp+var_4], 0
114 .text:00426B38                 jz      short loc_426B5D
115 .text:00426B3A                 xor     cl, cl          ; NewIrql
116 .text:00426B3C                 mov     byte ptr [esi+48h], 1
117 .text:00426B40                 call    ds:__imp_@KfLowerIrql@4 ; KfLowerIrql(x)
118 .text:00426B46                 push    [ebp+var_8]
119 .text:00426B49                 push    [ebp+var_C]
120 .text:00426B4C                 push    [ebp+var_10]
121 .text:00426B4F                 call    [ebp+var_4]
122 .text:00426B52                 mov     cl, 1           ; NewIrql
123 .text:00426B54                 call    ds:__imp_@KfRaiseIrql@4 ; KfRaiseIrql(x)
124 .text:00426B5A                 mov     [ebp+LockHandle.OldIrql], al
125 .text:00426B5D
126 .text:00426B5D loc_426B5D:                             ; CODE XREF: KiDeliverApc(x,x,x)+10A↑j
127 .text:00426B5D                 lea     edx, [ebp+LockHandle] ; LockHandle
128 .text:00426B60                 lea     ecx, [esi+0E8h] ; SpinLock
129 .text:00426B66                 call    ds:__imp_@KeAcquireInStackQueuedSpinLock@8 ; KeAcquireInStackQueuedSpinLock(x,x)
130 .text:00426B6C                 mov     byte ptr [esi+48h], 0
131 .text:00426B70
132 .text:00426B70 loc_426B70:                             ; CODE XREF: KiDeliverApc(x,x,x)+5C↑j
133 .text:00426B70                                         ; KiDeliverApc(x,x,x)+C2↑j
134 .text:00426B70                 cmp     [ebx], ebx      ; 判断第一个链表是否为空,如果内核与当前地址一样,说明没有内核APC函数。
135 .text:00426B72                 jnz     loc_426A8F      ; 如果有内核APC,则跳转去执行内核APC,否则继续执行处理用户APC。
136 .text:00426B78                 lea     ecx, [esi+3Ch]  ; 取第二个双向链表,第二个APC队列。
137 .text:00426B7B                 mov     eax, [ecx]      ; 判断当前队列是否为空
138 .text:00426B7D                 cmp     eax, ecx
139 .text:00426B7F                 jz      loc_426C05      ; 如果不为空,则说明存在用户APC,则跳转去处理.
140 .text:00426B85                 cmp     [ebp+arg_0], 1  ; 判断参数是0还是1,如果为1的时候才处理用户APC
141 .text:00426B89                 jnz     short loc_426C05 ; 如果是用户APC,则去跳转执行。
142 .text:00426B8B                 cmp     byte ptr [esi+4Ah], 0
143 .text:00426B8F                 jz      short loc_426C05
144 .text:00426B91                 mov     byte ptr [esi+4Ah], 0
145 .text:00426B95                 lea     edi, [eax-0Ch]  ; 获取_KAPC的首地址,因为链表在偏移+0ch处
146 .text:00426B98                 mov     ecx, [edi+_KAPC.NormalRoutine]
147 .text:00426B9B                 mov     ebx, [edi+_KAPC.KernelRoutine]
148 .text:00426B9E                 mov     [ebp+var_4], ecx
149 .text:00426BA1                 mov     ecx, [edi+_KAPC.NormalContext]
150 .text:00426BA4                 mov     [ebp+var_10], ecx
151 .text:00426BA7                 mov     ecx, [edi+24h]
152 .text:00426BAA                 mov     [ebp+var_C], ecx
153 .text:00426BAD                 mov     ecx, [edi+28h]
154 .text:00426BB0                 mov     [ebp+var_8], ecx
155 .text:00426BB3                 mov     ecx, [eax]      ; 链表操作 将当前APC从用户队列中拆除,因为变量已经存储在局部变量中,方便存储。
156 .text:00426BB5                 mov     eax, [eax+4]
157 .text:00426BB8                 mov     [eax], ecx
158 .text:00426BBA                 mov     [ecx+4], eax
159 .text:00426BBD                 lea     ecx, [ebp+LockHandle] ; LockHandle
160 .text:00426BC0                 mov     byte ptr [edi+2Eh], 0
161 .text:00426BC4                 call    ds:__imp_@KeReleaseInStackQueuedSpinLock@4 ; KeReleaseInStackQueuedSpinLock(x)
162 .text:00426BCA                 lea     eax, [ebp+var_8]
163 .text:00426BCD                 push    eax
164 .text:00426BCE                 lea     eax, [ebp+var_C]
165 .text:00426BD1                 push    eax
166 .text:00426BD2                 lea     eax, [ebp+var_10]
167 .text:00426BD5                 push    eax
168 .text:00426BD6                 lea     eax, [ebp+var_4]
169 .text:00426BD9                 push    eax
170 .text:00426BDA                 push    edi
171 .text:00426BDB                 call    ebx             ; 调用_KAPC.KernelRoutine 释放APC函数
172 .text:00426BDD                 cmp     [ebp+var_4], 0
173 .text:00426BE1                 jnz     short loc_426BEC
174 .text:00426BE3                 push    1
175 .text:00426BE5                 call    _KeTestAlertThread@4 ; KeTestAlertThread(x)
176 .text:00426BEA                 jmp     short loc_426C0E
177 .text:00426BEC ; ---------------------------------------------------------------------------
178 .text:00426BEC
179 .text:00426BEC loc_426BEC:                             ; CODE XREF: KiDeliverApc(x,x,x)+1B3↑j
180 .text:00426BEC                 push    [ebp+var_8]
181 .text:00426BEF                 push    [ebp+var_C]
182 .text:00426BF2                 push    [ebp+var_10]
183 .text:00426BF5                 push    [ebp+var_4]
184 .text:00426BF8                 push    [ebp+arg_8]
185 .text:00426BFB                 push    [ebp+arg_4]
186 .text:00426BFE                 call    _KiInitializeUserApc@24 ; 用户APC中调用APC用来初始化用户APC执行的环境
187 .text:00426C03                 jmp     short loc_426C0E
188 .text:00426C05 ; ---------------------------------------------------------------------------
189 .text:00426C05
190 .text:00426C05 loc_426C05:                             ; CODE XREF: KiDeliverApc(x,x,x)+C8↑j
191 .text:00426C05                                         ; KiDeliverApc(x,x,x)+D5↑j ...
192 .text:00426C05                 lea     ecx, [ebp+LockHandle] ; LockHandle
193 .text:00426C08                 call    ds:__imp_@KeReleaseInStackQueuedSpinLock@4 ; KeReleaseInStackQueuedSpinLock(x)
194 .text:00426C0E
195 .text:00426C0E loc_426C0E:                             ; CODE XREF: KiDeliverApc(x,x,x)+1BC↑j
196 .text:00426C0E                                         ; KiDeliverApc(x,x,x)+1D5↑j
197 .text:00426C0E                 mov     ecx, [ebp+BugCheckParameter1]
198 .text:00426C11                 cmp     [esi+44h], ecx
199 .text:00426C14                 jz      short loc_426C30
200 .text:00426C16                 mov     eax, large fs:994h
201 .text:00426C1C                 push    eax             ; BugCheckParameter4
202 .text:00426C1D                 movzx   eax, byte ptr [esi+165h]
203 .text:00426C24                 push    eax             ; BugCheckParameter3
204 .text:00426C25                 push    dword ptr [esi+44h] ; BugCheckParameter2
205 .text:00426C28                 push    ecx             ; BugCheckParameter1
206 .text:00426C29                 push    5               ; BugCheckCode
207 .text:00426C2B                 call    _KeBugCheckEx@20 ; KeBugCheckEx(x,x,x,x,x)
208 .text:00426C30 ; ---------------------------------------------------------------------------
209 .text:00426C30
210 .text:00426C30 loc_426C30:                             ; CODE XREF: KiDeliverApc(x,x,x)+1E6↑j
211 .text:00426C30                 mov     eax, [ebp+var_1C]
212 .text:00426C33                 pop     edi
213 .text:00426C34                 mov     [esi+134h], eax
214 .text:00426C3A                 pop     esi
215 .text:00426C3B                 pop     ebx
216 .text:00426C3C                 leave
217 .text:00426C3D                 retn    0Ch
218 .text:00426C3D _KiDeliverApc@12 endp

3. KiDeliverApc(ntkrnlpa.exe)代码分析

  1 :0042A9FE ; =============== S U B R O U T I N E =======================================
  2 .text:0042A9FE
  3 .text:0042A9FE ; Attributes: bp-based frame
  4 .text:0042A9FE
  5 .text:0042A9FE ; __stdcall KiInitializeUserApc(x, x, x, x, x, x)
  6 .text:0042A9FE _KiInitializeUserApc@24 proc near       ; CODE XREF: KiDeliverApc(x,x,x)+1D0↑p
  7 .text:0042A9FE
  8 .text:0042A9FE var_34C         = dword ptr -34Ch
  9 .text:0042A9FE var_340         = dword ptr -340h
 10 .text:0042A9FE var_2FC         = dword ptr -2FCh
 11 .text:0042A9FE var_2F8         = dword ptr -2F8h
 12 .text:0042A9FE var_2F4         = dword ptr -2F4h
 13 .text:0042A9FE BugCheckParameter3= dword ptr -2F0h
 14 .text:0042A9FE var_2EC         = dword ptr -2ECh
 15 .text:0042A9FE var_2E8         = dword ptr -2E8h
 16 .text:0042A9FE var_228         = dword ptr -228h
 17 .text:0042A9FE var_224         = dword ptr -224h
 18 .text:0042A9FE var_1C          = dword ptr -1Ch
 19 .text:0042A9FE ms_exc          = CPPEH_RECORD ptr -18h
 20 .text:0042A9FE arg_0           = dword ptr  8
 21 .text:0042A9FE arg_4           = dword ptr  0Ch
 22 .text:0042A9FE arg_8           = dword ptr  10h
 23 .text:0042A9FE arg_C           = dword ptr  14h
 24 .text:0042A9FE arg_10          = dword ptr  18h
 25 .text:0042A9FE arg_14          = dword ptr  1Ch
 26 .text:0042A9FE
 27 .text:0042A9FE ; __unwind { // __SEH_prolog
 28 .text:0042A9FE                 push    33Ch
 29 .text:0042AA03                 push    offset stru_4020B0
 30 .text:0042AA08                 call    __SEH_prolog
 31 .text:0042AA0D                 mov     eax, ___security_cookie
 32 .text:0042AA12                 mov     [ebp+var_1C], eax
 33 .text:0042AA15                 mov     eax, [ebp+_KAPC.Thread]
 34 .text:0042AA18                 mov     [ebp+var_2F4], eax
 35 .text:0042AA1E                 mov     ebx, [ebp+arg_4]
 36 .text:0042AA21                 mov     [ebp+BugCheckParameter3], ebx
 37 .text:0042AA27                 test    byte ptr [ebx+72h], 2
 38 .text:0042AA2B                 jnz     loc_42AB7B
 39 .text:0042AA31                 mov     [ebp+var_2E8], 10017h
 40 .text:0042AA3B                 lea     ecx, [ebp+var_2E8]
 41 .text:0042AA41                 push    ecx             ; context对象的首地址
 42 .text:0042AA42                 push    eax
 43 .text:0042AA43                 push    ebx             ; trap_frame的地址
 44 .text:0042AA44                 call    _KeContextFromKframes@12 ; 因为要返回3环去处理,_TRAP_FRAME保存的EIP与ESP显然需要修改,因此这里就需要来进行备份处理。
 45 .text:0042AA49 ;   __try { // __except at loc_42AB4E
 46 .text:0042AA49                 and     [ebp+ms_exc.registration.TryLevel], 0
 47 .text:0042AA4D                 mov     eax, 2DCh       ; 一个CONTEXT 和 另外四个值的大小
 48 .text:0042AA52                 mov     [ebp+var_2F8], eax
 49 .text:0042AA58                 mov     esi, [ebp+var_224] ; ebp指向context堆栈 context -2e8
 50 .text:0042AA5E                 and     esi, 0FFFFFFFCh ; 1100 四字节对齐
 51 .text:0042AA61                 sub     esi, eax        ; z在0环直接修改三环的堆栈,将用户三环堆栈减少为0x2DC字节
 52 .text:0042AA63                 mov     [ebp+var_2EC], esi
 53 .text:0042AA69                 push    4               ; Alignment
 54 .text:0042AA6B                 push    eax             ; Length
 55 .text:0042AA6C                 push    esi             ; Address
 56 .text:0042AA6D                 call    _ProbeForWrite@12 ; 修改新增部分的内存属性
 57 .text:0042AA72                 lea     edi, [esi+10h]  ; 先让过前面4个成员
 58 .text:0042AA75                 mov     ecx, 0B3h       ; 0B3*4 + 10 = 2DC
 59 .text:0042AA7A                 lea     esi, [ebp+var_2E8]
 60 .text:0042AA80                 rep movsd               ; 复制context到用户栈
 61 .text:0042AA82                 mov     dword ptr [ebx+6Ch], 1Bh
 62 .text:0042AA89                 push    23h
 63 .text:0042AA8B                 pop     eax
 64 .text:0042AA8C                 mov     [ebx+78h], eax
 65 .text:0042AA8F                 mov     [ebx+38h], eax
 66 .text:0042AA92                 mov     [ebx+34h], eax
 67 .text:0042AA95                 mov     dword ptr [ebx+50h], 3Bh
 68 .text:0042AA9C                 and     dword ptr [ebx+30h], 0
 69 .text:0042AAA0                 mov     ecx, [ebp+var_228]
 70 .text:0042AAA6                 test    ecx, 20000h
 71 .text:0042AAAC                 jz      short loc_42AAC6
 72 .text:0042AAAE                 cmp     byte ptr _KeI386VdmIoplAllowed, 0
 73 .text:0042AAB5                 jz      short loc_42AAC6
 74 .text:0042AAB7                 mov     eax, _KeI386EFlagsAndMaskV86
 75 .text:0042AABC                 and     eax, ecx
 76 .text:0042AABE                 or      eax, _KeI386EFlagsOrMaskV86
 77 .text:0042AAC4                 jmp     short loc_42AAD4
 78 .text:0042AAC6 ; ---------------------------------------------------------------------------
 79 .text:0042AAC6
 80 .text:0042AAC6 loc_42AAC6:                             ; CODE XREF: KiInitializeUserApc(x,x,x,x,x,x)+AE↑j
 81 .text:0042AAC6                                         ; KiInitializeUserApc(x,x,x,x,x,x)+B7↑j
 82 .text:0042AAC6                 and     ecx, 3E0DD7h
 83 .text:0042AACC                 or      ecx, 200h
 84 .text:0042AAD2                 mov     eax, ecx
 85 .text:0042AAD4
 86 .text:0042AAD4 loc_42AAD4:                             ; CODE XREF: KiInitializeUserApc(x,x,x,x,x,x)+C6↑j
 87 .text:0042AAD4                 mov     [ebx+KTRAP_FRAME.EFlags], eax
 88 .text:0042AAD7                 mov     eax, large fs:292 ; 直接来进行修改fs寄存器
 89 .text:0042AADD                 mov     [ebp+var_2FC], eax
 90 .text:0042AAE3                 cmp     byte ptr [eax+KTRAP_FRAME.SegGs], 0
 91 .text:0042AAE7                 jz      short loc_42AAED
 92 .text:0042AAE9                 or      byte ptr [ebx+71h], 30h
 93 .text:0042AAED
 94 .text:0042AAED loc_42AAED:                             ; CODE XREF: KiInitializeUserApc(x,x,x,x,x,x)+E9↑j
 95 .text:0042AAED                 mov     eax, [ebp+var_2EC]
 96 .text:0042AAF3                 mov     [ebx+KTRAP_FRAME.HardwareEsp], eax
 97 .text:0042AAF6                 mov     ecx, _KeUserApcDispatcher
 98 .text:0042AAFC                 mov     [ebx+KTRAP_FRAME._Eip], ecx ; 将eip改为_KeUserApcDispatcher这个函数,这意味着跑回来,就执行这个函数。
 99 .text:0042AAFF                 and     [ebx+KTRAP_FRAME.ErrCode], 0
100 .text:0042AB03                 mov     ecx, [ebp+arg_8]
101 .text:0042AB06                 mov     [eax], ecx
102 .text:0042AB08                 push    4
103 .text:0042AB0A                 pop     ecx
104 .text:0042AB0B                 add     eax, ecx
105 .text:0042AB0D                 mov     [ebp+var_2EC], eax
106 .text:0042AB13                 mov     edx, [ebp+arg_C]
107 .text:0042AB16                 mov     [eax], edx
108 .text:0042AB18                 add     eax, ecx
109 .text:0042AB1A                 mov     [ebp+var_2EC], eax
110 .text:0042AB20                 mov     edx, [ebp+arg_10]
111 .text:0042AB23                 mov     [eax], edx
112 .text:0042AB25                 add     eax, ecx
113 .text:0042AB27                 mov     [ebp+var_2EC], eax
114 .text:0042AB2D                 mov     edx, [ebp+arg_14]
115 .text:0042AB30                 mov     [eax], edx
116 .text:0042AB32                 add     eax, ecx
117 .text:0042AB34                 mov     [ebp+var_2EC], eax
118 .text:0042AB3A                 jmp     short loc_42AB77
119 .text:0042AB3C ; ---------------------------------------------------------------------------
120 .text:0042AB3C
121 .text:0042AB3C loc_42AB3C:                             ; DATA XREF: .text:stru_4020B0↑o
122 .text:0042AB3C ;   __except filter // owned by 42AA49
123 .text:0042AB3C                 mov     eax, [ebp+ms_exc.exc_ptr]
124 .text:0042AB3F                 push    dword ptr [eax]
125 .text:0042AB41                 lea     eax, [ebp+var_34C]
126 .text:0042AB47                 push    eax
127 .text:0042AB48                 call    _KiCopyInformation@8 ; KiCopyInformation(x,x)
128 .text:0042AB4D                 retn
129 .text:0042AB4E ; ---------------------------------------------------------------------------
130 .text:0042AB4E
131 .text:0042AB4E loc_42AB4E:                             ; DATA XREF: .text:stru_4020B0↑o
132 .text:0042AB4E ;   __except(loc_42AB3C) // owned by 42AA49
133 .text:0042AB4E                 mov     esp, [ebp+ms_exc.old_esp]
134 .text:0042AB51                 mov     eax, [ebp+BugCheckParameter3]
135 .text:0042AB57                 mov     ecx, [eax+68h]
136 .text:0042AB5A                 mov     [ebp+var_340], ecx
137 .text:0042AB60                 push    1               ; char
138 .text:0042AB62                 push    1               ; int
139 .text:0042AB64                 push    eax             ; BugCheckParameter3
140 .text:0042AB65                 push    [ebp+var_2F4]   ; int
141 .text:0042AB6B                 lea     eax, [ebp+var_34C]
142 .text:0042AB71                 push    eax             ; int
143 .text:0042AB72                 call    _KiDispatchException@20 ; KiDispatchException(x,x,x,x,x)
144 .text:0042AB72 ;   } // starts at 42AA49
145 .text:0042AB77
146 .text:0042AB77 loc_42AB77:                             ; CODE XREF: KiInitializeUserApc(x,x,x,x,x,x)+13C↑j
147 .text:0042AB77                 or      [ebp+ms_exc.registration.TryLevel], 0FFFFFFFFh
148 .text:0042AB7B
149 .text:0042AB7B loc_42AB7B:                             ; CODE XREF: KiInitializeUserApc(x,x,x,x,x,x)+2D↑j
150 .text:0042AB7B                 mov     ecx, [ebp+var_1C]
151 .text:0042AB7E                 call    @xHalReferenceHandler@4 ; xHalReferenceHandler(x)
152 .text:0042AB83                 call    __SEH_epilog
153 .text:0042AB88                 retn    18h
154 .text:0042AB88 ; } // starts at 42A9FE
155 .text:0042AB88 _KiInitializeUserApc@24 endp

4. KiUserApcDispatcher(ntdll.dll)分析

 1 ; __stdcall KiUserApcDispatcher(x, x, x, x, x)
 2 public _KiUserApcDispatcher@20
 3 _KiUserApcDispatcher@20 proc near
 4 arg_C= byte ptr  10h
 5 lea     edi, [esp+arg_C]
 6 pop     eax
 7 call    eax             ; NormalRoutine 执行用户APC的总入口
 8 push    1
 9 push    edi
10 call    _ZwContinue@8   ; 返回到用户内核
11 nop
12 _KiUserApcDispatcher@20 endp ; sp-analysis failed

原文地址:https://www.cnblogs.com/onetrainee/p/11788097.html