windows 7 x86 中核心模組nt（ntkrpamp 模組）源碼學習

windows 7 x86 中核心模組 nt（即 ntkrpamp 模組）的實現：

位移      機器碼         指令nt!memset:83c8ce40 8b54240c        mov     edx,dword ptr [esp+0Ch]83c8ce44 8b4c2404        mov     ecx,dword ptr [esp+4]83c8ce48 85d2            test    edx,edx83c8ce4a 744f            je      nt!memset+0x5b (83c8ce9b)83c8ce4c 33c0            xor     eax,eax83c8ce4e 8a442408        mov     al,byte ptr [esp+8]83c8ce52 57              push    edi83c8ce53 8bf9            mov     edi,ecx83c8ce55 83fa04          cmp     edx,483c8ce58 7231            jb      nt!memset+0x4b (83c8ce8b)83c8ce5a f7d9            neg     ecx83c8ce5c 83e103          and     ecx,383c8ce5f 740c            je      nt!memset+0x2d (83c8ce6d)83c8ce61 2bd1            sub     edx,ecx83c8ce63 8807            mov     byte ptr [edi],al83c8ce65 83c701          add     edi,183c8ce68 83e901          sub     ecx,183c8ce6b 75f6            jne     nt!memset+0x23 (83c8ce63)83c8ce6d 8bc8            mov     ecx,eax83c8ce6f c1e008          shl     eax,883c8ce72 03c1            add     eax,ecx83c8ce74 8bc8            mov     ecx,eax83c8ce76 c1e010          shl     eax,10h83c8ce79 03c1            add     eax,ecx83c8ce7b 8bca            mov     ecx,edx83c8ce7d 83e203          and     edx,383c8ce80 c1e902          shr     ecx,283c8ce83 7406            je      nt!memset+0x4b (83c8ce8b)83c8ce85 f3ab            rep stos dword ptr es:[edi]83c8ce87 85d2            test    edx,edx83c8ce89 740a            je      nt!memset+0x55 (83c8ce95)83c8ce8b 8807            mov     byte ptr [edi],al83c8ce8d 83c701          add     edi,183c8ce90 83ea01          sub     edx,183c8ce93 75f6            jne     nt!memset+0x4b (83c8ce8b)83c8ce95 8b442408        mov     eax,dword ptr [esp+8]83c8ce99 5f              pop     edi83c8ce9a c3              ret83c8ce9b 8b442404        mov     eax,dword ptr [esp+4]83c8ce9f c3              retnt!strcpy:83c8cea0 57              push    edi83c8cea1 8b7c2408        mov     edi,dword ptr [esp+8]83c8cea5 eb6e            jmp     nt!strcat+0x65 (83c8cf15)83c8cea7 8da42400000000  lea     esp,[esp]83c8ceae 8bff            mov     edi,edint!strcat:83c8ceb0 8b4c2404        mov     ecx,dword ptr [esp+4]83c8ceb4 57              push    edi83c8ceb5 f7c103000000    test    ecx,383c8cebb 7413            je      nt!strcat+0x20 (83c8ced0)83c8cebd 8a01            mov     al,byte ptr [ecx]83c8cebf 83c101          add     ecx,183c8cec2 84c0            test    al,al83c8cec4 743d            je      nt!strcat+0x53 (83c8cf03)83c8cec6 f7c103000000    test    ecx,383c8cecc 75ef            jne     nt!strcat+0xd (83c8cebd)83c8cece 8bff            mov     edi,edi83c8ced0 8b01            mov     eax,dword ptr [ecx]83c8ced2 bafffefe7e      mov     edx,7EFEFEFFh83c8ced7 03d0            add     edx,eax83c8ced9 83f0ff          xor     eax,0FFFFFFFFh83c8cedc 33c2            xor     eax,edx83c8cede 83c104          add     ecx,483c8cee1 a900010181      test    eax,81010100h83c8cee6 74e8            je      nt!strcat+0x20 (83c8ced0)83c8cee8 8b41fc          mov     eax,dword ptr [ecx-4]83c8ceeb 84c0            test    al,al83c8ceed 7423            je      nt!strcat+0x62 (83c8cf12)83c8ceef 84e4            test    ah,ah83c8cef1 741a            je      nt!strcat+0x5d (83c8cf0d)83c8cef3 a90000ff00      test    eax,0FF0000h83c8cef8 740e            je      nt!strcat+0x58 (83c8cf08)83c8cefa a9000000ff      test    eax,0FF000000h83c8ceff 7402            je      nt!strcat+0x53 (83c8cf03)83c8cf01 ebcd            jmp     nt!strcat+0x20 (83c8ced0)83c8cf03 8d79ff          lea     edi,[ecx-1]83c8cf06 eb0d            jmp     nt!strcat+0x65 (83c8cf15)83c8cf08 8d79fe          lea     edi,[ecx-2]83c8cf0b eb08            jmp     nt!strcat+0x65 (83c8cf15)83c8cf0d 8d79fd          lea     edi,[ecx-3]83c8cf10 eb03            jmp     nt!strcat+0x65 (83c8cf15)83c8cf12 8d79fc          lea     edi,[ecx-4]83c8cf15 8b4c240c        mov     ecx,dword ptr [esp+0Ch]83c8cf19 f7c103000000    test    ecx,383c8cf1f 741d            je      nt!strcat+0x8e (83c8cf3e)83c8cf21 8a11            mov     dl,byte ptr [ecx]83c8cf23 83c101          add     ecx,183c8cf26 84d2            test    dl,dl83c8cf28 7466            je      nt!strcat+0xe0 (83c8cf90)83c8cf2a 8817            mov     byte ptr [edi],dl83c8cf2c 83c701          add     edi,183c8cf2f f7c103000000    test    ecx,383c8cf35 75ea            jne     nt!strcat+0x71 (83c8cf21)83c8cf37 eb05            jmp     nt!strcat+0x8e (83c8cf3e)83c8cf39 8917            mov     dword ptr [edi],edx83c8cf3b 83c704          add     edi,483c8cf3e bafffefe7e      mov     edx,7EFEFEFFh83c8cf43 8b01            mov     eax,dword ptr [ecx]83c8cf45 03d0            add     edx,eax83c8cf47 83f0ff          xor     eax,0FFFFFFFFh83c8cf4a 33c2            xor     eax,edx83c8cf4c 8b11            mov     edx,dword ptr [ecx]83c8cf4e 83c104          add     ecx,483c8cf51 a900010181      test    eax,81010100h83c8cf56 74e1            je      nt!strcat+0x89 (83c8cf39)83c8cf58 84d2            test    dl,dl83c8cf5a 7434            je      nt!strcat+0xe0 (83c8cf90)83c8cf5c 84f6            test    dh,dh83c8cf5e 7427            je      nt!strcat+0xd7 (83c8cf87)83c8cf60 f7c20000ff00    test    edx,0FF0000h83c8cf66 7412            je      nt!strcat+0xca (83c8cf7a)83c8cf68 f7c2000000ff    test    edx,0FF000000h83c8cf6e 7402            je      nt!strcat+0xc2 (83c8cf72)83c8cf70 ebc7            jmp     nt!strcat+0x89 (83c8cf39)83c8cf72 8917            mov     dword ptr [edi],edx83c8cf74 8b442408        mov     eax,dword ptr [esp+8]83c8cf78 5f              pop     edi83c8cf79 c3              ret83c8cf7a 668917          mov     word ptr [edi],dx83c8cf7d 8b442408        mov     eax,dword ptr [esp+8]83c8cf81 c6470200        mov     byte ptr [edi+2],083c8cf85 5f              pop     edi83c8cf86 c3              ret83c8cf87 668917          mov     word ptr [edi],dx83c8cf8a 8b442408        mov     eax,dword ptr [esp+8]83c8cf8e 5f              pop     edi83c8cf8f c3              ret83c8cf90 8817            mov     byte ptr [edi],dl83c8cf92 8b442408        mov     eax,dword ptr [esp+8]83c8cf96 5f              pop     edi83c8cf97 c3              ret

fasm實現樣本：

;-----------------------------------------------------------------------;*--==--* fasm memset.asm memset.exe By G-Spider;-----------------------------------------------------------------------format PE consoleentry startinclude 'win32a.inc'COUNT=64;-----------------------------------------------------------------------section '.text' code readable executable  start:  ccall nt_memset,buffer,0x12,COUNT  xor ecx,ecx  @@:    push ecx    movzx eax,byte [buffer+ecx]        cinvoke printf,fmt,eax    pop ecx    inc ecx    cmp ecx,COUNT    jb  @B        cinvoke system,szPause    ret ;----------------------------------------------------------------------- ;//void *nt_memset(;//   void *dest,;//   int c,;//   size_t count ;//);;//Return Value:The value of dest.;-----------------------------------------------------------------------align 16nt_memset:;[esp+4]     ->dest;[esp+8]     ->c;[esp+0Ch]   ->count             mov     edx,dword [esp+0Ch]             mov     ecx,dword [esp+4]             test    edx,edx                           je      .A03                 ;如果count=0 ，直接返回dest             xor     eax,eax             mov     al ,byte [esp+8]     ;c只有低8位有效，高位忽略             push    edi                  ;儲存將要改變的寄存器edi,esp=esp-4             mov     edi,ecx              ;edi=dest             cmp     edx,4             jb      @F                   ;count小於4位元組時，跳轉             neg     ecx             and     ecx,3             je      .A01                 ;地址對齊，能被4整除時，跳轉             sub     edx,ecx              ;dest未4位元組對齊，則處理頭部,count=cout-ecx.A00:                                     ;.A00處理處理頭部多餘的ecx位元組(<4)              mov     byte [edi],al             add     edi,1             sub     ecx,1             jne     .A00                                                       ;.A00執行完後，edi已4位元組對齊.A01:        ;--------------              ;若c=0x11(高位忽略),則                       mov     ecx,eax              ;ecx=0000 0012             shl     eax,8                ;eax=0000 1200             add     eax,ecx              ;eax=0000 1212             mov     ecx,eax              ;ecx=eax             shl     eax,10h              ;eax=1212 0000             add     eax,ecx              ;eax=1212 1212             ;--------------             mov     ecx,edx                           and     edx,3                ;edx為餘下的位元組(<4)             shr     ecx,2                ;ecx=ecx/4 以4位元組為單位計數              je      @F                   ;此時若ecx=0,則說明:                                          ;當dest未對齊時，4<=cout<7，跳轉                                          ;當dest對齊時，0<cout<4，跳轉                      rep stos dword [edi]         ;以4位元組為單位處理edx位元組(能被4整除)              test    edx,edx              ;處理餘下的位元組             je      .A02                           @@:                mov     byte [edi],al             add     edi,1             sub     edx,1             jne     @B.A02:                  mov     eax,dword [esp+8]    ;eax=dest             pop     edi                  ;還原寄存器edi             ret.A03:                  mov     eax,dword [esp+4]             ret;-----------------------------------------------------------------------            section '.data' data readable writeable  fmt        db '%c',0  szPause    db 'pause',0section '.bss' readable writeable  buffer     rb 1024             section '.idata' import data readable writeable  library msvcrt,'msvcrt.dll'        import msvcrt,\     printf,'printf',\     system,'system'                       

內嵌彙編c實現:

//------------------------------------------------------------// compile:   cl  memset.c  by G-Spider vc6.0//------------------------------------------------------------#include <stdio.h>void * nt_memset(void *dest,int c,size_t count ); __declspec(naked) void * nt_memset(void *dest,int c,size_t count ){    // Naked functions    __asm {             mov     edx,dword ptr [esp+0x0C]             mov     ecx,dword ptr [esp+4]             test    edx,edx                           je      A03                              xor     eax,eax             mov     al ,byte ptr [esp+8]             push    edi             mov     edi,ecx             cmp     edx,4             jb      _LOOP             neg     ecx             and     ecx,3             je      A01             sub     edx,ecxA00:             mov     byte ptr [edi],al             add     edi,1             sub     ecx,1             jne     A00A01:        ;--------------                          mov     ecx,eax                           shl     eax,8             add     eax,ecx             mov     ecx,eax             shl     eax,0x10             add     eax,ecx             ;--------------             mov     ecx,edx                           and     edx,3             shr     ecx,2             je      _LOOP             rep stos dword ptr [edi]             test    edx,edx             je      A02                         _LOOP:                mov     byte ptr [edi],al             add     edi,1             sub     edx,1             jne     _LOOPA02:                  mov     eax,dword ptr [esp+8]             pop     edi             ret    A03:             mov     eax,dword ptr [esp+4]             ret    }}void main(){    char buffer[1024],*p;    int i;    p=nt_memset(buffer,0x12,64);    for(i=0;i<64;i++)      printf("%c",p[i]);         system("pause");}

 

;==========================================================;部分彙編片段分析(以下片段在多處可見,strcpy,strcat,strlen..)83c8ced0 8b01            mov     eax,dword ptr [ecx]83c8ced2 bafffefe7e      mov     edx,7EFEFEFFh83c8ced7 03d0            add     edx,eax83c8ced9 83f0ff          xor     eax,0FFFFFFFFh83c8cedc 33c2            xor     eax,edx83c8cede 83c104          add     ecx,483c8cee1 a900010181      test    eax,81010100h83c8cee6 74e8            je      nt!strcat+0x20 (83c8ced0)83c8cee8 8b41fc          mov     eax,dword ptr [ecx-4]83c8ceeb 84c0            test    al,al83c8ceed 7423            je      nt!strcat+0x62 (83c8cf12)83c8ceef 84e4            test    ah,ah83c8cef1 741a            je      nt!strcat+0x5d (83c8cf0d)83c8cef3 a90000ff00      test    eax,0FF0000h83c8cef8 740e            je      nt!strcat+0x58 (83c8cf08)83c8cefa a9000000ff      test    eax,0FF000000h83c8ceff 7402            je      nt!strcat+0x53 (83c8cf03)83c8cf01 ebcd            jmp     nt!strcat+0x20 (83c8ced0);----------------------------------------------------------x0=[ecx]x1=x0+7EFEFEFFhx2=!x0x0=x1 xor x2 =(x0+7EFEFEFFh) xor (!x0);----------------------------------------------------------;0??? ???0 ???? ???0 ???? ???0 ???? ???? 若byte1為0，設4個0對應的有效位為a1,a2,a3,a4，則有  a1=(a1+0+7EFEFEFFh) xor (!a1)= a1 xor !a1=1若byte1不為0，記為x，則  a1=(a1+x+7EFEFEFFh) xor (!a1)=!a1 xor !a1=0這就是上面0??? ???0 ???? ???0 ???? ???0 ???? ????第二個byte的第一個bit是0的來曆 ,同理，第二,三,四個byte中的的第一個bit的0也是在前面所有的byte都不為0的時候才會出現，否則就會出現至少一個1。然而你會發現多了下面一個無條件跳轉：  jmp     nt!strcat+0x20 (83c8ced0)這在什麼情況下發生呢？  taken if bits 24-30 are clear and  bit 31 is set 也即當位31為1，位24-30位為0的情況下是無法判斷的。因為：  (0x00******+7EFEFEFFh) xor !0=1  (0x80******+7EFEFEFFh) xor !1=1均視為存在0位元組的情況。即只有當[ecx]的低3位元組不為0，且最高位元組為80h時，形如：0x80123456將執行jmp nt!strcat+0x20 (83c8ced0)語句。