32位/64位WINDOWS驱动之windbg分析进程句柄表和句柄权限地址关系

最新推荐文章于 2024-01-30 15:30:48 发布
a756598009
最新推荐文章于 2024-01-30 15:30:48 发布
阅读量430
点赞数
分类专栏： windbg分析文章标签： windows 驱动开发单片机嵌入式硬件 c#
本文链接：https://blog.youkuaiyun.com/a756598009/article/details/131754493
版权
windbg分析专栏收录该内容
4 篇文章
订阅专栏
本文介绍了如何使用Windbg进行调试，特别是针对ObReferenceObjectByHandleWithTag函数的分析。详细展示了如何设置断点、查看结构指令以及理解代码执行流程，涉及到权限对象的计算方法，是逆向工程和驱动开发中的重要技能。
摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >
   windbg调试技巧
   逆向分析
   windbg访问断点
   dt查看结构指令

windbg使用帮助
参考 https://docs.microsoft.com/zh-cn/windows-hardware/drivers/debugger/commands
   
 ObReferenceObjectByHandle->ObReferenceObjectByHandleWithTag
 
  权限对象=RP((_HANDLE_TABLE->TableCode -_HANDLE_TABLE->NextHandleNeedingPool)+句柄*4)+8//权限  //0x10
  
: kd> u nt!ObReferenceObjectByHandleWithTag l 80
nt!ObReferenceObjectByHandleWithTag:
fffff800`041770e0 44884c2420      mov     byte ptr [rsp+20h],r9b
fffff800`041770e5 4c89442418      mov     qword ptr [rsp+18h],r8
fffff800`041770ea 89542410        mov     dword ptr [rsp+10h],edx
fffff800`041770ee 53              push    rbx
fffff800`041770ef 55              push    rbp
fffff800`041770f0 56              push    rsi
fffff800`041770f1 57              push    rdi
fffff800`041770f2 4154            push    r12
fffff800`041770f4 4155            push    r13
fffff800`041770f6 4156            push    r14
fffff800`041770f8 4157            push    r15
fffff800`041770fa 4881ec88000000  sub     rsp,88h
fffff800`04177101 65488b3c2588010000 mov   rdi,qword ptr gs:[188h]
fffff800`0417710a 488b9c24f8000000 mov     rbx,qword ptr [rsp+0F8h]
fffff800`04177112 4533e4          xor     r12d,r12d
fffff800`04177115 4c8b7f70        mov     r15,qword ptr [rdi+70h]
fffff800`04177119 4032ed          xor     bpl,bpl
fffff800`0417711c 450fb6f1        movzx   r14d,r9b
fffff800`04177120 4c8923          mov     qword ptr [rbx],r12
fffff800`04177123 4c8be9          mov     r13,rcx //Handle
fffff800`04177126 4088ac24d0000000 mov     byte ptr [rsp+0D0h],bpl
fffff800`0417712e 85c9            test    ecx,ecx
fffff800`04177130 0f88e1010000    js      nt!ObReferenceObjectByHandleWithTag+0x237 (fffff800`04177317)
fffff800`04177136 4c3925937bebff  cmp     qword ptr [nt!ViVerifierDriverAddedThunkListHead (fffff800`0402ecd0)],r12
fffff800`0417713d 0f85ef3cf6ff    jne     nt! ?? ::NNGAKEGL::`string'+0x20220 (fffff800`040dae32)
fffff800`04177143 4c3bbf10020000  cmp     r15,qword ptr [rdi+210h]
fffff800`0417714a 0f85f63cf6ff    jne     nt! ?? ::NNGAKEGL::`string'+0x20234 (fffff800`040dae46)
fffff800`04177150 498bb700020000  mov     rsi,qword ptr [r15+200h] PEPROCESS+0x200 ObjectTable      : Ptr64 _HANDLE_TABLE //win7
fffff800`04177157 4885f6          test    rsi,rsi
fffff800`0417715a 0f84283df6ff    je      nt! ?? ::NNGAKEGL::`string'+0x2027e (fffff800`040dae88)
fffff800`04177160 483b3559a0ebff  cmp     rsi,qword ptr [nt!ObpKernelHandleTable (fffff800`040311c0)]
fffff800`04177167 0f84f43cf6ff    je      nt! ?? ::NNGAKEGL::`string'+0x2024f (fffff800`040dae61)
fffff800`0417716d 66ff8fc4010000  dec     word ptr [rdi+1C4h]
fffff800`04177174 41f7c5fc030000  test    r13d,3FCh
fffff800`0417717b 0f8402030000    je      nt!ObReferenceObjectByHandleWithTag+0x3a3 (fffff800`04177483)
fffff800`04177181 418bc5          mov     eax,r13d
fffff800`04177184 4c896c2430      mov     qword ptr [rsp+30h],r13 //Handle 0x7C 0x80 //79 77 74 78 7C 

断点 fffff800`04177184     0001 (0001) nt!ObReferenceObjectByHandleWithTag+0xa4

fffff800`04177189 83e0fc          and     eax,0FFFFFFFCh //按4字节对齐 
fffff800`0417718c 89442430        mov     dword ptr [rsp+30h],eax Handle
fffff800`04177190 8b465c          mov     eax,dword ptr [rsi+5Ch]
fffff800`04177193 4c8b4c2430      mov     r9,qword ptr [rsp+30h]   Handle
fffff800`04177198 4c3bc8          cmp     r9,rax
fffff800`0417719b 0f83e2020000    jae     nt!ObReferenceObjectByHandleWithTag+0x3a3 (fffff800`04177483) 没有跳
fffff800`041771a1 4c8b06          mov     r8,qword ptr [rsi] //r8d= +0x000 _HANDLE_TABLE->TableCode        :  fffff8a002b3a000

这一块没执行到 //分析错了 这里执行到了
fffff800`041771a4 418bc8          mov     ecx,r8d _HANDLE_TABLE->TableCode
fffff800`041771a7 83e103          and     ecx,3  //4字节对齐
fffff800`041771aa 8bc1            mov     eax,ecx
fffff800`041771ac 4c2bc0          sub     r8,rax //4字节对齐 r8=[_HANDLE_TABLE]- _HANDLE_TABLE->NextHandleNeedingPool //分析错了 这里是4字节对齐
//_HANDLE_TABLE->NextHandleNeedingPool=0x400


fffff800`041771af 85c9            test    ecx,ecx
fffff800`041771b1 0f853a010000    jne     nt!ObReferenceObjectByHandleWithTag+0x211 (fffff800`041772f1)
fffff800`041771b7 4b8d1c88        lea     rbx,[r8+r9*4] //权限对象=rbx //rbx+8 //1FFFFF  r9=Handle=0x78   r8=HANDLE_TABLE->TableCode 
 权限对象=RP((_HANDLE_TABLE->TableCode -_HANDLE_TABLE->NextHandleNeedingPool)+句柄*4)+8//权限  //0x10
 
 fffff8a002b3a000  rbx= fffff8a002b3a000+0x78*4=fffff8a002b3a1e0
fffff8a002b3a000+0x78*4+8 =权限 //OK
_HANDLE_TABLE->TableCode+Handle*4+8 //权限地址 
fffff800`041771bb 4885db          test    rbx,rbx
fffff800`041771be 0f84c2020000    je      nt!ObReferenceObjectByHandleWithTag+0x3a6 (fffff800`04177486)
fffff800`041771c4 0f0d0b          prefetchw [rbx]
fffff800`041771c7 488b03          mov     rax,qword ptr [rbx]
fffff800`041771ca a801            test    al,1
fffff800`041771cc 0f8422020000    je      nt!ObReferenceObjectByHandleWithTag+0x314 (fffff800`041773f4)
fffff800`041771d2 488d48ff        lea     rcx,[rax-1]
fffff800`041771d6 f0480fb10b      lock cmpxchg qword ptr [rbx],rcx
fffff800`041771db 0f851c020000    jne     nt!ObReferenceObjectByHandleWithTag+0x31d (fffff800`041773fd)
fffff800`041771e1 488b2b          mov     rbp,qword ptr [rbx]
fffff800`041771e4 4883e5f8        and     rbp,0FFFFFFFFFFFFFFF8h
fffff800`041771e8 0f0d4d00        prefetchw [rbp]
fffff800`041771ec 0fb64518        movzx   eax,byte ptr [rbp+18h]
fffff800`041771f0 4c8b9424e0000000 mov     r10,qword ptr [rsp+0E0h]
fffff800`041771f8 488d0d41bbebff  lea     rcx,[nt!ObTypeIndexTable (fffff800`04032d40)]
fffff800`041771ff 41be01000000    mov     r14d,1
fffff800`04177205 4c3914c1        cmp     qword ptr [rcx+rax*8],r10
fffff800`04177209 0f8530010000    jne     nt!ObReferenceObjectByHandleWithTag+0x25f (fffff800`0417733f)
fffff800`0417720f 448b5b08        mov     r11d,dword ptr [rbx+8] //权限 nt!ObReferenceObjectByHandleWithTag+0x12f:
fffff800`04177213 8b8c24d8000000  mov     ecx,dword ptr [rsp+0D8h]
fffff800`0417721a 410fbaf319      btr     r11d,19h
fffff800`0417721f 418bc3          mov     eax,r11d
fffff800`04177222 f7d0            not     eax
fffff800`04177224 85c1            test    ecx,eax
fffff800`04177226 0f85af010000    jne     nt!ObReferenceObjectByHandleWithTag+0x2fb (fffff800`041773db)
fffff800`0417722c 44396640        cmp     dword ptr [rsi+40h],r12d
fffff800`04177230 0f85983cf6ff    jne     nt! ?? ::NNGAKEGL::`string'+0x202c4 (fffff800`040daece)
fffff800`04177236 498bd4          mov     rdx,r12
fffff800`04177239 488b842400010000 mov     rax,qword ptr [rsp+100h]
fffff800`04177241 4885c0          test    rax,rax
fffff800`04177244 0f8585000000    jne     nt!ObReferenceObjectByHandleWithTag+0x1ef (fffff800`041772cf)
fffff800`0417724a f60304          test    byte ptr [rbx],4
fffff800`0417724d 0f85993cf6ff    jne     nt! ?? ::NNGAKEGL::`string'+0x202e2 (fffff800`040daeec)
fffff800`04177253 443925bab3eaff  cmp     dword ptr [nt!ObpTraceFlags (fffff800`04022614)],r12d
fffff800`0417725a 0f85ba3cf6ff    jne     nt! ?? ::NNGAKEGL::`string'+0x20310 (fffff800`040daf1a)
fffff800`04177260 f04c017500      lock add qword ptr [rbp],r14
fffff800`04177265 488b8c24f8000000 mov     rcx,qword ptr [rsp+0F8h]
fffff800`0417726d 488d4530        lea     rax,[rbp+30h]
fffff800`04177271 488901          mov     qword ptr [rcx],rax
fffff800`04177274 f04c0fc133      lock xadd qword ptr [rbx],r14
fffff800`04177279 488d4e30        lea     rcx,[rsi+30h]
fffff800`0417727d f0830c2400      lock or dword ptr [rsp],0
fffff800`04177282 0faee8          lfence
fffff800`04177285 48833900        cmp     qword ptr [rcx],0
fffff800`04177289 0f85ac010000    jne     nt!ObReferenceObjectByHandleWithTag+0x35b (fffff800`0417743b)
fffff800`0417728f 0fb6ac24d0000000 movzx   ebp,byte ptr [rsp+0D0h]
fffff800`04177297 668387c401000001 add     word ptr [rdi+1C4h],1
fffff800`0417729f 750d            jne     nt!ObReferenceObjectByHandleWithTag+0x1ce (fffff800`041772ae)
fffff800`041772a1 488d4750        lea     rax,[rdi+50h]
fffff800`041772a5 483900          cmp     qword ptr [rax],rax
fffff800`041772a8 0f85ed010000    jne     nt!ObReferenceObjectByHandleWithTag+0x3bb (fffff800`0417749b)
fffff800`041772ae 4080fd01        cmp     bpl,1
fffff800`041772b2 0f842c3df6ff    je      nt! ?? ::NNGAKEGL::`string'+0x203e2 (fffff800`040dafe4)
fffff800`041772b8 418bc4          mov     eax,r12d
fffff800`041772bb 4881c488000000  add     rsp,88h
fffff800`041772c2 415f            pop     r15
fffff800`041772c4 415e            pop     r14
fffff800`041772c6 415d            pop     r13
fffff800`041772c8 415c            pop     r12
fffff800`041772ca 5f              pop     rdi
fffff800`041772cb 5e              pop     rsi
fffff800`041772cc 5d              pop     rbp
fffff800`041772cd 5b              pop     rbx
fffff800`041772ce c3              ret
fffff800`041772cf 44895804        mov     dword ptr [rax+4],r11d
fffff800`041772d3 8b0b            mov     ecx,dword ptr [rbx]
fffff800`041772d5 83e106          and     ecx,6
fffff800`041772d8 0fba630819      bt      dword ptr [rbx+8],19h
fffff800`041772dd 0f828f010000    jb      nt!ObReferenceObjectByHandleWithTag+0x392 (fffff800`04177472)
fffff800`041772e3 8908            mov     dword ptr [rax],ecx
fffff800`041772e5 8b8c24d8000000  mov     ecx,dword ptr [rsp+0D8h]
fffff800`041772ec e959ffffff      jmp     nt!ObReferenceObjectByHandleWithTag+0x16a (fffff800`0417724a)
fffff800`041772f1 83f901          cmp     ecx,1
fffff800`041772f4 0f85983bf6ff    jne     nt! ?? ::NNGAKEGL::`string'+0x20288 (fffff800`040dae92)
fffff800`041772fa 498bc9          mov     rcx,r9
fffff800`041772fd 81e1ff030000    and     ecx,3FFh
fffff800`04177303 4c2bc9          sub     r9,rcx





 
 cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00000206
nt!ObReferenceObjectByHandleWithTag+0xac:
fffff800`0417718c 89442430        mov     dword ptr [rsp+30h],eax ss:0018:fffff880`06fcd670=00000078
3: kd> dt _HANDLE_TABLE fffff8a00294e740 //rsi=fffff8a00294e740 PEPROCESS+0x200
nt!_HANDLE_TABLE
   +0x000 TableCode        : 0xfffff8a0`02b3a000
   +0x008 QuotaProcess     : 0xfffffa80`32076b30 _EPROCESS
   +0x010 UniqueProcessId  : 0x00000000`000007dc Void
   +0x018 HandleLock       : _EX_PUSH_LOCK
   +0x020 HandleTableList  : _LIST_ENTRY [ 0xfffff800`040264d0 - 0xfffff8a0`02d56d40 ]
   +0x030 HandleContentionEvent : _EX_PUSH_LOCK
   +0x038 DebugInfo        : (null) 
   +0x040 ExtraInfoPages   : 0n0
   +0x044 Flags            : 0
   +0x044 StrictFIFO       : 0y0
   +0x048 FirstFreeHandle  : 0xe0
   +0x050 LastFreeHandleEntry : 0xfffff8a0`02b3aff0 _HANDLE_TABLE_ENTRY
   +0x058 HandleCount      : 0x37
   +0x05c NextHandleNeedingPool : 0x400
   +0x060 HandleCountHighWatermark : 0x37