just started teaching myself how to write kernel driver not too long ago and wrote my first real driver with microsofts ddk. i need help with two things.
first is, anyone know a good and effective way of getting ahold of the ServiceDescriptorTableShadow in kernel mode? ive googled for days and not sure if anything ive read is up to date with win xp. all i see mentioned is windows 2000. im trying to reroute some native api's and well need to find the shadow to do that! some sites say to compare the first entry in the kernel mode variable KeServiceDescriptorTable to memory around it because they are the same, once you find a match it will be the shadow. which im confused kinda with what they mean by that, but im not sure what im comparing in the prototype (what is the first entry that they mean?). i have the prototypes for the ServiceDescriptorTable; everywhere i look is the same so im sure i have those correct. i know how to find the call numbers, i just need that shadow to change them now.
second is, my first kernel i wrote actualy uses some undocumented api's and read/writes to memory in processes. its a hacking utility i decided to write to learn how things work mainly using a kernel driver. reading memory isnt a problem at all. when it writes to memory its just fine until it alters any code being executed like the exe or dll's. so like if i wanted to nop a jump with 90, i cant change it in kernel mode. the way it works is the kernel attaches to the process, then alters the memory using no api's what so ever. it only uses pointers to alter things. i get no crashes or errors, it just doesnt change anything. when i alter things like variables not in executable memory space it changes memory just fine. anyone know a way to change the code in these area's?
i figured there are a lot of programmers that browse these boards so thought someone might know something! any help would be great. oh and if anyone knows of any sites with any undocumented native api's or prototypes and doesnt mind sharing them that would be great too! thanks
-skeet
need kernel mode driver help!
Moderator: MacroQuest Developers
I don't have the foggiest clue what you are saying, but this struck me as odd.
Back to your regularly scheduled programming...
If sites exist, then it's documented. It's just not possible for an undocumented thingy to have a website.if anyone knows of any sites with any undocumented native api's or prototypes
Back to your regularly scheduled programming...
[quote="dont_know_at_all"][quote="sybarite"]Um.. search works fine for me (used spell_routines.inc)... Try scrolling down you lazy fuck.
http://www.macroquest2.com/phpBB2/viewtopic.php?t=8964&highlight=spellroutines+inc[/quote]
That's great but he's looking for move.inc, you fucking spastic colon.[/quote]
http://www.macroquest2.com/phpBB2/viewtopic.php?t=8964&highlight=spellroutines+inc[/quote]
That's great but he's looking for move.inc, you fucking spastic colon.[/quote]
lol well undocumented i mean as in microsoft doesnt tell anyone about them. there are a lot of native api's that microsoft doesnt want people to know. i found a few sites that have some of the api's that microsoft is hiding but dont have them all, and im sure some of what i have arent right.
the servicedescriptortable holds a list of kernel functions and the pointers to them all for the windows kernel. i want to change the addresses to re-route them to my new functions to do what i want. same concept as detouring but you dont need to patch code, just change a pointer. i cant just change the servicedescriptortable addresses though to goto my new functions for user-mode applications to be affected. there is another list called the servicedescriptortableshadow. its exactly the same as the regular servicedescriptortable except if i alter this then any application that calls a function like EnumProcesses which requires the kernel will be re-routed to my new functions in my kernel because they use the shadow instead. this is not exported at all so you need to actualy find it. once you find it you alter its pointers and user-mode applications will be affected. i believe rootkit viruses use this method to hide themselves from the system not totaly sure though.
to find the shadow you start at the servicedescriptortable which is exported. the shadow is not far from this so you just scan memory around the exported one by comparing memory to the first entry in the table and once you find a match its suppost to be the shadow. at least this is what ive read. ive tried it and not sure if i had any luck because its not doing anything at all for me lol.
the servicedescriptortable holds a list of kernel functions and the pointers to them all for the windows kernel. i want to change the addresses to re-route them to my new functions to do what i want. same concept as detouring but you dont need to patch code, just change a pointer. i cant just change the servicedescriptortable addresses though to goto my new functions for user-mode applications to be affected. there is another list called the servicedescriptortableshadow. its exactly the same as the regular servicedescriptortable except if i alter this then any application that calls a function like EnumProcesses which requires the kernel will be re-routed to my new functions in my kernel because they use the shadow instead. this is not exported at all so you need to actualy find it. once you find it you alter its pointers and user-mode applications will be affected. i believe rootkit viruses use this method to hide themselves from the system not totaly sure though.
to find the shadow you start at the servicedescriptortable which is exported. the shadow is not far from this so you just scan memory around the exported one by comparing memory to the first entry in the table and once you find a match its suppost to be the shadow. at least this is what ive read. ive tried it and not sure if i had any luck because its not doing anything at all for me lol.