找KiServiceTable

摘要: 看雪上常有各种“大牛”原创各种获取SSDT和SSDTShadow地址的帖子，小生不才，也分享一份去年获得的KiServiceTable基址获取方法（绝非原创）；貌似改改，也是可以找W32pServiceTable基址。

已知
a1 = NtClearEvent地址;
a2 = NtClose地址;
a3 = NtOpenFile地址;
i1 = *(PULONG)((PUCHAR)ZwClearEvent+1);
i2 = *(PULONG)((PUCHAR)ZwClose+1);
i3 = *(PULONG)((PUCHAR)ZwOpenFile+1);
并且
a1 = KiServiceTable[i1];
a2 = KiServiceTable[i2];
a3 = KiServiceTable[i3];

b = Ntoskrnl的映像基址
s = Ntoskrnl的映像大小

求
KiServiceTable

for( a = b; a < s+b; a+=0x10 )
{
if( *(PULONG)s == a1 )
{
if( *(PULONG)(s + 4*(i2-i1)) == a2 )
{
if( *(PULONG)(s + 4*(i3-i1)) == a3 )
{
KiServiceTable = a;
break;
}
}
}
}