BYR Achieve · 镜像论坛

这哥们好像hook了int 0e的中断处理函数，然后修改代码节对应的页表项使其无效从而自己接管了控制权，想象力真丰富啊。并且这哥们也用汇编，还是nasm,连invoke,.if这样的伪指令都不能用，满文尽是jmp,call,终于见到比我还是疯狂的疯子了，看来，老外更疯狂........... ------------------------------------- 4MB to 1024 x 4KB... By: c0de90e7 Have you used pagetable tricks ( INT 0Eh hooking + P bit clearing in PTEs ) for execution breakpoints in code pages ? This is something I wrote some time ago when playing around with pagetable tricks. Now I have added some comments and ascii art schematics, but it is far from being good enough for general use out of PoC field... Well, back then, I was experimenting all kind of page tricks and one thing I thought of was using page tricks for executable code breakpoints ( i.e., not data access ones but code execution access ones, why ? because I wanted to do hooks without touching the code itself -similar to DRx...- ). So I implemented the thing and everything was fine... until I tried the experiments in a machine with far more ram... ntoskrnl.exe module was mapped into a 4MB page so problems were evident: - If I wanted to put a breakpoint in, say, ntosknrl.exe!NtOpenFile and ntoskrnl.exe was mapped in a 4MB page, I would need to mark the whole 4MB page as nonpresent, making the OS almost unable to run with that many pagefaults. - INT 0Eh handler itself was into that 4MB page, so even if I hooked INT 0Eh by IDT entry manipulation, many problems would arise... - Other later and more subtle problems which I don't fully remember, but not important, since first problem already made the thing unviable... So I thought, ok, I could disable 4MB page use in boot time ( by registry keys and in other ways ) and it would be ok. But that wouldn't do in direct load scenarios, I need to split those 4MB pages on the fly. That's what led me to write the routine: http://www.rootkit.com/vault/c0de90e7/SPLIT4M-4K.INC The theory behind it is pretty simple, as the tittle says, just change the 4MB PDE into a 1024x4KB PDE and create a PT with 1024 PTEs that map the same physical address space by aliasing those 4MBs. It was written in NASM ( I use NASM whenever I experiment with stuff or have an idea... ). I might write a driver in C and implement this and PAE supporting routines also, I don't know. P.S.: Just in case you someone wonders... when I try ideas and so on that need ring0, I use a small loader that goes ring0 by \Device\PhysicalMemory edition. It's just a quick&easy template for NASM experiments. I'm sorry if that sucks.