本文共 6255 字，大约阅读时间需要 20 分钟。

DeviceIoControl调用流程

试验环境:  vmware + WinXpSp3

 

在R3调用DeviceIoControl处和R0 IoDeviceIoControl处理例程处 各下一个WinDbg断点

从R3单步到sysenter, 可以看到R3处理流程

 

R3 

填好DeviceIoControl参数

=> kernel32!DeviceIoControl

=> ntdll!ZwDeviceIoControlFile

=> ntdll!KiFastSystemCall ///< mov     eax,42h

=> sysenter ///< 进入R0

 

当断在R0自己驱动DeviceIoControl处理例程时, 看调用链，可以看到sysenter进入R0后的处理流程

 

R0 => ntdll!KiFastSystemCallRet

=> nt!KiFastCallEntry

=> nt!NtDeviceIoControlFile

=> nt!IopXxxControlFile

=> nt!IopSynchronousServiceTail

=> nt!IopfCallDriver

=> LsNtDrv!DisPatchDeviceControl ///< 进入自己的驱动

 

 

备注

SSDT 表 0x42项为 nt!NtDeviceIoControlFile

kd> dd KeServiceDescriptorTable

80553fa0  80502b8c 00000000 0000011c 80503000

80553fb0  00000000 00000000 00000000 00000000

80553fc0  00000000 00000000 00000000 00000000

80553fd0  00000000 00000000 00000000 00000000

80553fe0  00002710 bf80c0b6 00000000 00000000

80553ff0  f7ac2a80 f7249b60 8619c0f0 806e2f40

80554000  00000000 00000000 2a8d70b4 00000000

80554010  e70c1c74 01cecc93 00000000 00000000

kd> dd (80502b8c + 4 * 42h)

80502c94  8056f442 8060a0ce 805b484e 805e4062

80502ca4  8060db50 8061bac6 8060db34 8061bd30

80502cb4  805aa126 805e420e 8060d068 8056cee8

80502cc4  805ace38 8061bf9a 805a2ab8 805acdda

80502cd4  805ac94a 805a9400 8056f476 805c871a

80502ce4  805bf4d8 8058f588 8051e9a2 805efd1c

80502cf4  8059b492 805cea5c 806193dc 805bf2be

80502d04  805cc484 805bf4c4 8059b69e 8057a588

kd> u 8056f442

nt!NtDeviceIoControlFile:

8056f442 8bff            mov     edi,edi

8056f444 55              push    ebp

8056f445 8bec            mov     ebp,esp

 

R3 WinDbg纪录

 

kd> t

kernel32!DeviceIoControl:

001b:7c801629 6a14            push    14h

kd> t

kernel32!DeviceIoControl+0x2:

001b:7c80162b 68400b817c      push    offset kernel32!`string'+0x44 (7c810b40)

kd> t

kernel32!DeviceIoControl+0x7:

001b:7c801630 e8a10e0000      call    kernel32!_SEH_prolog (7c8024d6)

kd> t

kernel32!_SEH_prolog:

001b:7c8024d6 68c09a837c      push    offset kernel32!_except_handler3 (7c839ac0)

kd> t

kernel32!_SEH_prolog+0x5:

001b:7c8024db 64a100000000    mov     eax,dword ptr fs:[00000000h]

kd> t

kernel32!_SEH_prolog+0xb:

001b:7c8024e1 50              push    eax

kd> t

kernel32!_SEH_prolog+0xc:

001b:7c8024e2 8b442410        mov     eax,dword ptr [esp+10h]

kd> t

kernel32!_SEH_prolog+0x10:

001b:7c8024e6 896c2410        mov     dword ptr [esp+10h],ebp

kd> t

kernel32!_SEH_prolog+0x14:

001b:7c8024ea 8d6c2410        lea     ebp,[esp+10h]

kd> t

kernel32!_SEH_prolog+0x18:

001b:7c8024ee 2be0            sub     esp,eax

kd> t

kernel32!_SEH_prolog+0x1a:

001b:7c8024f0 53              push    ebx

kd> t

kernel32!_SEH_prolog+0x1b:

001b:7c8024f1 56              push    esi

kd> t

kernel32!_SEH_prolog+0x1c:

001b:7c8024f2 57              push    edi

kd> t

kernel32!_SEH_prolog+0x1d:

001b:7c8024f3 8b45f8          mov     eax,dword ptr [ebp-8]

kd> t

kernel32!_SEH_prolog+0x20:

001b:7c8024f6 8965e8          mov     dword ptr [ebp-18h],esp

kd> t

kernel32!_SEH_prolog+0x23:

001b:7c8024f9 50              push    eax

kd> t

kernel32!_SEH_prolog+0x24:

001b:7c8024fa 8b45fc          mov     eax,dword ptr [ebp-4]

kd> t

kernel32!_SEH_prolog+0x27:

001b:7c8024fd c745fcffffffff  mov     dword ptr [ebp-4],0FFFFFFFFh

kd> t

kernel32!_SEH_prolog+0x2e:

001b:7c802504 8945f8          mov     dword ptr [ebp-8],eax

kd> t

kernel32!_SEH_prolog+0x31:

001b:7c802507 8d45f0          lea     eax,[ebp-10h]

kd> t

kernel32!_SEH_prolog+0x34:

001b:7c80250a 64a300000000    mov     dword ptr fs:[00000000h],eax

kd> t

kernel32!_SEH_prolog+0x3a:

001b:7c802510 c3              ret

kd> t

kernel32!DeviceIoControl+0xc:

001b:7c801635 8b4d0c          mov     ecx,dword ptr [ebp+0Ch]

kd> t

kernel32!DeviceIoControl+0xf:

001b:7c801638 8bc1            mov     eax,ecx

kd> t

kernel32!DeviceIoControl+0x11:

001b:7c80163a 250000ffff      and     eax,0FFFF0000h

kd> t

kernel32!DeviceIoControl+0x16:

001b:7c80163f 3d00000900      cmp     eax,90000h

kd> t

kernel32!DeviceIoControl+0x1b:

001b:7c801644 0f95c0          setne   al

kd> t

kernel32!DeviceIoControl+0x1e:

001b:7c801647 8b7524          mov     esi,dword ptr [ebp+24h]

kd> t

kernel32!DeviceIoControl+0x21:

001b:7c80164a 33db            xor     ebx,ebx

kd> t

kernel32!DeviceIoControl+0x23:

001b:7c80164c ff751c          push    dword ptr [ebp+1Ch]

kd> t

kernel32!DeviceIoControl+0x26:

001b:7c80164f ff7518          push    dword ptr [ebp+18h]

kd> t

kernel32!DeviceIoControl+0x29:

001b:7c801652 ff7514          push    dword ptr [ebp+14h]

kd> t

kernel32!DeviceIoControl+0x2c:

001b:7c801655 ff7510          push    dword ptr [ebp+10h]

kd> t

kernel32!DeviceIoControl+0x2f:

001b:7c801658 51              push    ecx

kd> t

kernel32!DeviceIoControl+0x30:

001b:7c801659 3bf3            cmp     esi,ebx

kd> t

kernel32!DeviceIoControl+0x32:

001b:7c80165b 753e            jne     kernel32!DeviceIoControl+0x38 (7c80169b)

kd> t

kernel32!DeviceIoControl+0xc1:

001b:7c80165d 3ac3            cmp     al,bl

kd> t

kernel32!DeviceIoControl+0xc3:

001b:7c80165f 8d45dc          lea     eax,[ebp-24h]

kd> t

kernel32!DeviceIoControl+0xc6:

001b:7c801662 50              push    eax

kd> t

kernel32!DeviceIoControl+0xc7:

001b:7c801663 53              push    ebx

kd> t

kernel32!DeviceIoControl+0xc8:

001b:7c801664 53              push    ebx

kd> t

kernel32!DeviceIoControl+0xc9:

001b:7c801665 53              push    ebx

kd> t

kernel32!DeviceIoControl+0xca:

001b:7c801666 ff7508          push    dword ptr [ebp+8]

kd> t

kernel32!DeviceIoControl+0xcd:

001b:7c801669 0f84d8000000    je      kernel32!DeviceIoControl+0xd7 (7c801747)

kd> t

kernel32!DeviceIoControl+0xcf:

001b:7c80166f ff153810807c    call    dword ptr [kernel32!_imp__NtDeviceIoControlFile (7c801038)]

kd> t

ntdll!ZwDeviceIoControlFile:

001b:7c92d260 b842000000      mov     eax,42h

kd> t

ntdll!NtDeviceIoControlFile+0x5:

001b:7c92d265 ba0003fe7f      mov     edx,offset SharedUserData!SystemCallStub (7ffe0300)

kd> t

ntdll!NtDeviceIoControlFile+0xa:

001b:7c92d26a ff12            call    dword ptr [edx]

kd> t

ntdll!KiFastSystemCall:

001b:7c92e4f0 8bd4            mov     edx,esp

kd> t

ntdll!KiFastSystemCall+0x2:

001b:7c92e4f2 0f34            sysenter ///< r3的调用结束

 

R0 堆栈调用链

 

00 ee3d3c34 804ef119 8602d460 86061008 806d32d0 LsNtDrv!DisPatchDeviceControl+0x83 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\lsworkdir\demo\srcbhowebpageautofill\prj\lsntdrv\lsntdrv.c @ 98]

01 ee3d3c44 80575d5e 86061078 860ae718 86061008 nt!IopfCallDriver+0x31 (FPO: [0,0,0])

02 ee3d3c58 80576bff 8602d460 86061008 860ae718 nt!IopSynchronousServiceTail+0x70 (FPO: [Non-Fpo])

03 ee3d3d00 8056f46c 000000fc 00000000 00000000 nt!IopXxxControlFile+0x5e7 (FPO: [Non-Fpo])

04 ee3d3d34 8053e638 000000fc 00000000 00000000 nt!NtDeviceIoControlFile+0x2a (FPO: [Non-Fpo])

05 ee3d3d34 7c92e4f4 000000fc 00000000 00000000 nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ ee3d3d64)

06 0012fa30 7c92d26c 7c801675 000000fc 00000000 ntdll!KiFastSystemCallRet (FPO: [0,0,0])

07 0012fa34 7c801675 000000fc 00000000 00000000 ntdll!NtDeviceIoControlFile+0xc (FPO: [10,0,0])

 

转载地址：https://lostspeed.blog.csdn.net/article/details/12871335 如侵犯您的版权，请留言回复原文章的地址，我们会给您删除此文章，给您带来不便请您谅解！