还原NtTerminateProcess

最新推荐文章于 2025-09-05 16:39:55 发布

原创

最新推荐文章于 2025-09-05 16:39:55 发布 · 3.4k 阅读

1 ·

CC 4.0 BY-SA版权

本文详述了作者在闲暇时研究Windows XP Service Pack 3的内核过程中，如何还原NtTerminateProcess的代码。通过Windbg分析，发现PsTerminateProcess实际上依赖于NtTerminateProcess和ObReferenceObjectByHandle。作者对于为何不直接调用NtTerminateProcess而采用间接方式存在疑问，推测可能是为了防止函数被篡改，因为PsTerminateProcess并未导出。

在上课吃饱了没事干的情况下,花了点功夫还原了我电脑上的NtTerminateProcess的代码

我的系统是Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible(来自windbg)

nt!NtTerminateProcess:
mov     edi,edi
push    ebp
mov     ebp,esp
sub     esp,10h
push    ebx
push    esi
push    edi
mov     eax,KPCR.PrcbData.CurrentThread ;eax = CurrentThread
cmp     ProcessHandle,0
mov     edi,eax
mov     eax,CurrentThread.ApcState.Process
mov     Process,eax ;Process = CurrentThread.ApcState.Process
je      nt!NtTerminateProcess+0x25
;if(ProcessHandle)
;{
nt!NtTerminateProcess+0x1f:
mov     ebp_1,1 ;ebp_1 = 1
jmp     nt!NtTerminateProcess+0x2d
;}
;else
;{
nt!NtTerminateProcess+0x25:
or      ProcessHandle,0FFFFFFFFh ;ProcessHandle = NtCurrentProcess()
mov     ebp_1,0 ;ebp_1 = 0
;}
nt!NtTerminateProcess+0x2d:
mov     al,CurrentThread.PreviousMode
push    0
mov     PreviousMode,al ;ebp_8.PreviousMode = CurrentThread.PreviousMode
lea     eax,EPROCESS
push    eax
push    CurrentThread.PreviousMode
push    dword ptr [nt!PsProcessType]
push    1
push    ProcessHandle
call    nt!ObReferenceObjectByHandle ;NTSTATUS = ObReferenceObjectByHandle(ProcessHandle,1,PsProcessType,ebp_8.PreviousMode,&ebp_8.EPROCESS,NULL)
test    eax,eax
mov     esi,EPROCESS ;esi = EPROCESS
mov     ebx,esi ;ebx = esi
jl      nt!NtTerminateProcess+0x144
;if(NT_SUCCESS(NTSTATUS))
;{
nt!NtTerminateProcess+0x5c:
lea