编程获取当前Windows平台的System Service列表

   通常我们都是通过反汇编或者静态数组映射的方式获取构建System Service Id到System Service的映射的，这种方式依赖于Windows的版本。为了克服这个不足，本文介绍了一种编程动态获取当前Windows平台的System Service列表的方法。
  代码如下：
 
bool IsSystemService (LPCTSTR lpcszFunctionName, PBYTE pFunction, ULONG &nServiceId)
{
     if (!lpcszFunctionName || !pFunction)
         return false;

     if ((lpcszFunctionName [0] != 'N')|| (lpcszFunctionName [1] != 't'))
         return false;

     //
     // 77F5B438   B8 00000000    MOV EAX, _FUNCTION_ID_
     // 77F5B43D   BA 0003FE7F    MOV EDX,7FFE0300
     // 77F5B442   FF12           CALL EDX
     // 77F5B444   C2 1800        RETN XX
     //

     //
     // mov eax
     //
     if ( *pFunction != 0xB8 )
     {
         return false;
     }

     //
     // since the address of the function which actually makes the call6 (SYSCALL) may change, we
     //   just check for mov edx
     //
     if ( *(pFunction + 5) != 0xBA )
     {
         return false;
     }

     //
     // call edx
     //
     if ( *(PWORD)(pFunction + 10) != 0x12FF )
     {
         return false;
     }
 
     //
     // retn
     //
     if ( *(pFunction + 12) != 0xC2 )
     {
         return false;
     }

     nServiceId = *(PDWORD)(pFunction + 1);

     return true;
}

bool GetSystemService ()
{
     //get the function's address
     HMODULE hMod = GetModuleHandle ("ntdll.dll");
     if (!hMod)
         return false;

     IMAGE_DOS_HEADER* dosheader;
     IMAGE_OPTIONAL_HEADER* opthdr;
     IMAGE_EXPORT_DIRECTORY* pExportTable;
     DWORD* arrayOfFunctionAddresses;
     DWORD* arrayOfFunctionNames;
     WORD* arrayOfFunctionOrdinals;
     DWORD functionOrdinal;
     ULONG Base, x, functionAddress;
     char* functionName;
     PVOID BaseAddress = NULL;
     SIZE_T size=0;

     dosheader = (IMAGE_DOS_HEADER *)hMod;
     opthdr =(IMAGE_OPTIONAL_HEADER *) ((BYTE*)hMod+dosheader->e_lfanew+24);

     pExportTable =(IMAGE_EXPORT_DIRECTORY*)((BYTE*) hMod + opthdr->DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT]. VirtualAddress);

     // now we can get the exported functions, but note we convert from RVA to address
     arrayOfFunctionAddresses = (DWORD*)( (BYTE*)hMod + pExportTable->AddressOfFunctions);

     arrayOfFunctionNames = (DWORD*)( (BYTE*)hMod + pExportTable->AddressOfNames);

     arrayOfFunctionOrdinals = (WORD*)( (BYTE*)hMod + pExportTable->AddressOfNameOrdinals);

     Base = pExportTable->Base;

     ULONG nServiceId = 0;
     for(x = 0; x < pExportTable->NumberOfFunctions; x++)
     {
         functionName = (char*)( (BYTE*)hMod + arrayOfFunctionNames[x]);

         functionOrdinal = arrayOfFunctionOrdinals[x] + Base - 1; // always need to add base, -1 as array counts from 0

         // this is the funny bit.  you would expect the function pointer to simply be arrayOfFunctionAddresses[x]...
         // oh no... thats too simple.  it is actually arrayOfFunctionAddresses[functionOrdinal]!!
         functionAddress = (DWORD)( (BYTE*)hMod + arrayOfFunctionAddresses[functionOrdinal]);

         if (IsSystemService (functionName, (PBYTE)functionAddress, nServiceId))
         {
              printf ("0x%08x %s 0x%08x/n",
                   nServiceId,
                   functionName,
                   functionAddress);
         }
     }

     FreeLibrary (hMod);

     return TRUE;
}