In Windows 7x86, the kernel module NT (ntkrpamp module) source code learning

In Windows 7x86, the implementation of the kernel module NT (that is, the ntkrpamp module:

Offset machine code command nt! Memset: 83c8ce40 8b54240c mov edX, dword ptr [esp + 0ch] 83c8ce44 8b4c2404 mov ECx, dword ptr [esp + 4] 83c8ce48 85d2 test edX, edx83c8ce4a 744f je nt! Memset + 0x5b (83c8ce9b) 83c8ce4c 33c0 XOR eax, eax83c8ce4e 8a442408 mov Al, byte PTR [esp + 8] 83c8ce52 57 push edi83c8ce53 8bf9 mov EDI, 10983fa04 CMP edX, 483c8ce58 7231 JB nt! Memset + 0x4b (83c8ce8b) 83c8ce5a f7d9 neg ecx83c8ce5c 83e103 and ECx, 383c8ce5f 740c je nt! Memset + 0x2d (83c8ce6d) 83c8ce61 2bd1 sub edX, 1168807 mov byte PTR [EDI], al83c8ce65 83c701 add EDI, 183c8ce68 83e901 sub ECx, 183c8ce6b 75f6 JNE nt! Memset + 0x23 (83c8ce63) 83c8ce6d 8bc8 mov ECx, 2017c1e008 SHL eax, 883c8ce72 03c1 add eax, 20178bc8 mov ECx, 2017c1e010 SHL eax, 201703c1 add eax, ecx83c8ce7b 8bca mov ECx, edx83c8ce7d 83e203 and EDX, 383c8ce80 c1e902 SHR ECx, 283c8ce83 7406 je nt! Memset + 0x4b (83c8ce8b) 83c8ce85 f3ab rep STOs dword ptr es: [EDI] 83c8ce87 85d2 test edX, edx83c8ce89 740a je nt! Memset + 0x55 (83c8ce95) 83c8ce8b 8807 mov byte PTR [EDI], al83c8ce8d 83c701 add EDI, 183c8ce90 83ea01 edX sub, 183c8ce93 75f6 JNE nt! Memset + 0x4b (83c8ce8b) 83c8ce95 8b442408 mov eax, dword ptr [esp + 8] 83c8ce99 5f pop edi83c8ce9a C3 4408b442404 mov eax, dword ptr [esp + 4] 83c8ce9f C3 retnt! Strcpy: 83c8cea0 57 push edi83c8cea1 8b7c2408 mov EDI, dword ptr [esp + 8] 83c8cea5 eb6e JMP nt! Strcat + 0x65 (83c8cf15) 83c8cea7 8da1_00000000 Lea ESP, [esp] 83c8ceae 8bff mov EDI, edint! Strcat: 83c8ceb0 8b4c2404 mov ECx, dword ptr [esp + 4] 83c8ceb4 57 push edi83c8ceb5 f7c103000000 test ECx, 383c8cebb 7413 je nt! Strcat + 0x20 (83c8ced0) 83c8cebd 8a01 mov Al, byte PTR [ECx] 83c8cebf 83c101 add ECx, 183c8cec2 84c0 test Al, al83c8cec4 743d je nt! Strcat + 0x53 (83c8cf03) 83c8cec6 f7c103000000 test ECx, 383c8cecc 75ef JNE nt! Strcat + 0xd (83c8cebd) 83c8cece 8bff mov EDI, edi83c8ced0 8b01 mov eax, dword ptr [ECx] 83c8ced2 109edx, 10903d0 add edX, eax83c8ced9 83f0ff XOR eax, 0ffffffh83c8cedc 33c2 XOR eax, edx83c8cede 83c104 add ECx, 483c8cee1 a900010181 test eax, 81010100h83c8cee6 74e8 je nt! Strcat + 0x20 (83c8ced0) 83c8cee8 8b41fc mov eax, dword ptr [ecx-4] 83c8ceeb 84c0 test Al, al83c8ceed 7423 je nt! Strcat + 0x62 (83c8cf12) 83c8ceef 84e4 test ah, ah83c8cef1 741a je nt! Strcat + 0x5d (83c8cf0d) 83c8cef3 a90000ff00 test eax, 0ff1_h83c8cef8 740e je nt! Strcat + 0x58 (83c8cf08) 83c8cefa a9000000ff test eax, 0ff000000h83c8ceff 7402 je nt! Strcat + 0x53 (83c8cf03) 83c8cf01 ebcd JMP nt! Strcat + 0x20 (83c8ced0) 83c8cf03 8d79ff Lea EDI, [ecx-1] 83c8cf06 eb0d JMP nt! Strcat + 0x65 (83c8cf15) 83c8cf08 8d79fe Lea EDI, [ecx-2] 83c8cf0b eb08 JMP nt! Strcat + 0x65 (83c8cf15) 83c8cf0d 8d79fd Lea EDI, [ecx-3] 83c8cf10 eb03 JMP nt! Strcat + 0x65 (83c8cf15) 83c8cf12 8d79fc Lea EDI, [ecx-4] 83c8cf15 8b4c240c mov ECx, dword ptr [esp + 0ch] 83c8cf19 109test ECx, 383c8cf1f 741d je NT! Strcat + 0x8e (83c8cf3e) 83c8cf21 8a11 mov DL, byte PTR [ECx] 83c8cf23 83c101 add ECx, 183c8cf26 84d2 test DL, dl83c8cf28 7466 je nt! Strcat + 0xe0 (83c8cf90) 83c8cf2a 8817 mov byte PTR [EDI], dl83c8cf2c 83c701 add EDI, 183c8cf2f f7c103000000 test ECx, 383c8cf35 75ea JNE nt! Strcat + 0x71 (83c8cf21) 83c8cf37 eb05 JMP nt! Strcat + 0x8e (83c8cf3e) 83c8cf39 8917 mov dword ptr [EDI], 10983c704 add EDI, 483c8cf3e 1_mov edX, 4158b01 mov eax, dword ptr [ECx] 83c8cf45 03d0 add edX, eax83c8cf47 83f0ff XOR eax, 201733c2 XOR eax, edx83c8cf4c 8b11 mov edX, dword ptr [ECx] 83c8cf4e 83c104 add ECx, 483c8cf51 release test eax, 10974e1 je nt! Strcat + 0x89 (83c8cf39) 83c8cf58 84d2 test DL, dl83c8cf5a 7434 je nt! Strcat + 0xe0 (83c8cf90) 83c8cf5c 84f6 test DH, fig 7427 je nt! Strcat + 0xd7 (83c8cf87) 83c8cf60 f7c20000ff00 test edX, 0ff1_h83c8cf66 7412 je nt! Strcat + 0xca (83c8cf7a) 83c8cf68 f7c2000000ff test edX, 0ff000000h83c8cf6e 7402 je nt! Strcat + 0xc2 (83c8cf72) 83c8cf70 ebc7 JMP nt! Strcat + 0x89 (83c8cf39) 83c8cf72 8917 mov dword ptr [EDI], edx83c8cf74 8b442408 mov eax, dword ptr [esp + 8] 83c8cf78 5f pop edi83c8cf79 C3 ret83c8cf7a 668917 mov word PTR [EDI], dx83c8cf7d 8b442408 mov eax, dword ptr [esp + 8] 83c8cf81 c6470200 mov byte PTR [EDI + 2], 083c8cf85 5f pop edi83c8cf86 C3 ret83c8cf87 668917 mov word PTR [EDI], dx83c8cf8a 8b442408 mov eax, dword ptr [esp + 8] 83c8cf8e 5f pop rjc3 ret83c8cf90 8817 mov byte PTR [EDI], dl83c8cf92 8b442408 mov eax, dword ptr [esp + 8] 83c8cf96 5f pop edi83c8cf97 C3 RET

FASM implementation example:

; ---------------------------------------------------------------------; * -- = -- * FASM memset. ASM memset.exe by G-spider; --------------------------------------------------------------------------- format PE consoleentry startinclude 'win32a. INC 'count = 64; ------------------------------------------------------------------------- section '. text 'Code readable executable start: cCall nt_memset, buffer, 0x12, Count XOR ECx, ECx @: Push ECx movzx eax, byte [buffer + ECx] cinvoke printf, FMT, eax pop ECx Inc ECx CMP ECx, Count JB @ B cinvoke system, szpause ret; done; // void * nt_memset (; // void * DEST,; // int C ,; // size_t count; //); // return value: the value of DeST .; ----------------------------------------------------------------------- align 16nt_memset:; [esp + 4]-> DEST; [esp + 8]-> C; [esp + 0ch]-> count mov edX, DWORD [esp + 0ch] mov ECx, DWORD [esp + 4] Test edX, EDX je. a03; if Count = 0, dest xor eax, eax mov Al, byte [esp + 8] will be returned directly; C is only valid for low 8 bits, while push EDI is ignored for high bits; save the register EDI to be changed, esp = esp-4 mov EDI, ECx; EDI = dest cmp edX, 4 JB @ F; when count is less than 4 bytes, jump to neg ECx and ECx, 3 je. a01; address alignment, can be 4 divisible, jump sub edX, ECx; DEST is not 4 bytes alignment, then process the header, Count = cout-ecx.A00 :;. a00 processes redundant ECx bytes in the header (<4) mov byte [EDI], Al add EDI, 1 sub ECx, 1 JNE. a00 ;. after a00 is executed, EDI is 4 bytes aligned. a01:; --------------; if C = 0x11 (high ignore), mov ECx, eax; ECx = 0000 0012 SHL eax, 8; eax = 0000 1200 add eax, ECx; eax = 0000 1212 mov ECx, eax; ECx = eax SHL eax, 10 h; eax = 1212 0000 add eax, ECx; eax = 1212 1212; -------------- mov ECx, EDX and EDX, 3; edX is the remaining bytes (<4) SHR ECx, 2; ECx = ECx/4 count je @ F in 4 bytes; If ECx = 0, note:; When DEST is not aligned, 4 <= cout <7, jump; When DEST is aligned, 0 <cout <4, jump to rep STOs DWORD [EDI]; process edX bytes (which can be fully divided by four) test EDX and EDX in 4 bytes; process the remaining bytes je. a02: mov byte [EDI], Al add EDI, 1 sub edX, 1 JNE @ B. a02: mov eax, DWORD [esp + 8]; eax = DEST pop EDI; restore register EDI ret. a03: mov eax, DWORD [esp + 4] ret; --------------------------------------------------------------------- section '. data 'data readable writeable FMT dB '% C', 0 szpause dB 'pause', 0 section '. BSS 'readable writeable buffer RB 1024 section '. idata 'import data readable writeable library msvcrt, 'msvcrt. DLL 'import msvcrt, \ printf, 'printf', \ System, 'system'

Embedded Assembly C implementation:

//------------------------------------------------------------// compile:   cl  memset.c  by G-Spider vc6.0//------------------------------------------------------------#include <stdio.h>void * nt_memset(void *dest,int c,size_t count ); __declspec(naked) void * nt_memset(void *dest,int c,size_t count ){    // Naked functions    __asm {             mov     edx,dword ptr [esp+0x0C]             mov     ecx,dword ptr [esp+4]             test    edx,edx                           je      A03                              xor     eax,eax             mov     al ,byte ptr [esp+8]             push    edi             mov     edi,ecx             cmp     edx,4             jb      _LOOP             neg     ecx             and     ecx,3             je      A01             sub     edx,ecxA00:             mov     byte ptr [edi],al             add     edi,1             sub     ecx,1             jne     A00A01:        ;--------------                          mov     ecx,eax                           shl     eax,8             add     eax,ecx             mov     ecx,eax             shl     eax,0x10             add     eax,ecx             ;--------------             mov     ecx,edx                           and     edx,3             shr     ecx,2             je      _LOOP             rep stos dword ptr [edi]             test    edx,edx             je      A02                         _LOOP:                mov     byte ptr [edi],al             add     edi,1             sub     edx,1             jne     _LOOPA02:                  mov     eax,dword ptr [esp+8]             pop     edi             ret    A03:             mov     eax,dword ptr [esp+4]             ret    }}void main(){    char buffer[1024],*p;    int i;    p=nt_memset(buffer,0x12,64);    for(i=0;i<64;i++)      printf("%c",p[i]);         system("pause");}

 

; ========================================================== ===========================; Partial Assembly fragment analysis (the following parts are visible in multiple places, strcpy, strcat, strlen ..) 83c8ced0 8b01 mov eax, dword ptr [ECx] 83c8ced2 116mov edX, 12703d0 add edX, 10983f0ff XOR eax, 10933c2 XOR eax, 10983c104 add ECx, 483c8cee1 release test eax, 81010100h83c8cee6 74e8 je nt! Strcat + 0x20 (83c8ced0) 83c8cee8 8b41fc mov eax, dword ptr [ecx-4] 83c8ceeb 84c0 test Al, al83c8ceed 7423 je nt! Strcat + 0x62 (83c8cf12) 83c8ceef 84e4 test ah, ah83c8cef1 741a je nt! Strcat + 0x5d (83c8cf0d) 83c8cef3 a90000ff00 test eax, 0ff1_h83c8cef8 740e je nt! Strcat + 0x58 (83c8cf08) 83c8cefa a9000000ff test eax, 0ff000000h83c8ceff 7402 je nt! Strcat + 0x53 (83c8cf03) 83c8cf01 ebcd JMP nt! Strcat + 0x20 (83c8ced0); ---------------------------------------------------------- X0 = [ECx] X1 = x0 + 7efeffhx2 =! X0x0 = x1 XOR X2 = (x0 + 7 efefeffh) XOR (! X0); ----------------------------------------------------------; 0 ??? ??? 0 ???? ??? 0 ???? ??? 0 ???? ???? If byte1 is 0 and four valid bits corresponding to 0 are A1, A2, A3, and A4, a1 = (A1 + 0 + 7 efefeffh) XOR (! A1) = A1 XOR! A1 = 1 If byte1 is not 0 and is counted as X, a1 = (A1 + x + 7 efefeffh) XOR (! A1) =! A1 XOR! A1 = 0 this is the above 0 ??? ??? 0 ???? ??? 0 ???? ??? 0 ???? ???? The first bit of the second byte is 0. Likewise, the Second, Third, the 0 value of the first bit of the four bytes is displayed only when the previous bytes are not 0. Otherwise, at least one byte is displayed. However, you will find the following unconditional jump: JMP nt! What happens when strcat + 0x20 (83c8ced0? Taken if bits 24-30 are clear and bit 31 is set, that is, when the bit 31 is 1 and the bit 24-30 is 0, it cannot be determined. Because: (0x00 ******* + 7 efefeffh) XOR! 0 = 1 (0x80 ****** + 7 efefeffh) XOR! 1 = 1 is regarded as 0 bytes. That is, only when the low 3 bytes of [ECx] is not 0 and the maximum byte is 80 h, for example, 0x80123456 will execute JMP nt! Strcat + 0x20 (83c8ced0) statement.