nganhkhoa/lpus
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Fix SSDT entry

Browse Source 
SSDT entries can be negative, so signed int is used
This commit is contained in:
nganhkhoa 2020-07-24 21:44:29 +07:00
parent 2d7576b1e2
commit 967684f140
2 changed files with 8 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/bin/kernel_module_traverse.rs
View File

@ -27,7 +27,7 @@ fn main() -> Result<(), Box<dyn Error>> {
// }
println!("=============================================");
for r in unloaded.iter() {
println!("{:#}", r.to_string());
println!("{:#}", r);
}
println!("=============================================");
for (idx, func) in ssdt.iter().enumerate() {
@ -65,7 +65,7 @@ fn main() -> Result<(), Box<dyn Error>> {
println!("\towned by nt!{}", funcname);
}
else if let Some(owner_) = owner {
println!("\towned by {}", owner_);
println!("\\thooked by {}", owner_);
}
else {
println!("\tmissing owner");

9
src/lib.rs
View File

@ -573,12 +573,15 @@ pub fn ssdt_table(driver: &DriverState) -> BoxResult<Vec<u64>> {
let servicetable = ntosbase.clone() + driver.pdb_store.get_offset_r("KiServiceTable")?;
let servicelimit_ptr = ntosbase.clone() + driver.pdb_store.get_offset_r("KiServiceLimit")?;
// TODO: Shifting is wrong, Rust seems to do arithmetic shift
let servicelimit = driver.deref_addr_new::<u32>(servicelimit_ptr.address()) as u64;
let ssdt: Vec<u64> = driver
.deref_array::<u32>(&servicetable, servicelimit)
.deref_array::<i32>(&servicetable, servicelimit)
.iter()
.map(|entry| servicetable.address() + ((*entry as u64) >> 4))
.map(|entry| {
// the entry can be negative, we need to do calculation using signed int
// and convert back to unsigned int for address
((servicetable.address() as i64) + ((*entry >> 4) as i64)) as u64
})
.collect();
Ok(ssdt)
}