PspCidTable句柄表辅助检测隐藏进程

一、获取PspCidTable的地址

1.特征码搜索以下几个函数之一提取Call PspCidTable地址：

PsLookupProcessByProcessId()
PsLookupProcessThreadByCid()
PsLookupThreadByThreadId()

0: kd> u PsLookupProcessByProcessId l 20
nt!PsLookupProcessByProcessId:
805d40de 8bff            mov     edi,edi
805d40e0 55              push    ebp
805d40e1 8bec            mov     ebp,esp
805d40e3 53              push    ebx
805d40e4 56              push    esi
805d40e5 64a124010000    mov     eax,dword ptr fs:[00000124h]
805d40eb ff7508          push    dword ptr [ebp+8]
805d40ee 8bf0            mov     esi,eax
805d40f0 ff8ed4000000    dec     dword ptr [esi+0D4h]
805d40f6 ff35c0495680    push    dword ptr [nt!PspCidTable (805649c0)]	<-就这儿! 特征码：ff 35 E8
805d40fc e859ad0300      call    nt!ExMapHandleToPointer (8060ee5a)
..

/*=========================================