Hook Api lib 0.4 for C原文及源代码地址链接《 [原创]Hook Api lib 0.4 for C 》

一、使用背景

　　最新在学习SSDT Inline Hook，一般在Hook开头进行一个JMP，例如Near Jmp，或者一个Far Jmp。

        Near Jmp机器码为 E9 xx xx xx xx，一共五个字节；Far Jmp机器码为 EA xx xx xx xx 08 00,其中驱动中段址为08。

        在Hook时保存原调用函数对应的字节数，然后修改其为跳转到自定义函数。

        以Windows XP SP3中的 NtOpenFile为例，其反汇编如下：

 1 0: kd> u nt!NtOpenFile nt!NtQueryEaFile-1
 2 nt!NtOpenFile:
 3 8057b1a0 8bff            mov     edi,edi
 4 8057b1a2 55              push    ebp
 5 8057b1a3 8bec            mov     ebp,esp
 6 8057b1a5 33c0            xor     eax,eax
 7 8057b1a7 50              push    eax
 8 8057b1a8 50              push    eax
 9 8057b1a9 50              push    eax
10 8057b1aa 50              push    eax
11 8057b1ab 50              push    eax
12 8057b1ac ff751c          push    dword ptr [ebp+1Ch]
13 8057b1af 6a01            push    1
14 8057b1b1 ff7518          push    dword ptr [ebp+18h]
15 8057b1b4 50              push    eax
16 8057b1b5 50              push    eax
17 8057b1b6 ff7514          push    dword ptr [ebp+14h]
18 8057b1b9 ff7510          push    dword ptr [ebp+10h]
19 8057b1bc ff750c          push    dword ptr [ebp+0Ch]
20 8057b1bf ff7508          push    dword ptr [ebp+8]
21 8057b1c2 e873c7ffff      call    nt!IoCreateFile (8057793a)
22 8057b1c7 5d              pop     ebp
23 8057b1c8 c21800          ret     18h
24 8057b1cb cc              int     3
25 8057b1cc cc              int     3
26 8057b1cd cc              int     3
27 8057b1ce cc              int     3
28 8057b1cf cc              int     3

　　 在这种情况下进行Near Jmp的Inline Hook正好，三条指令，5个字节长度。但也有例外情况。 

        如Windows XP SP3中的 NtOpenEvent:

 1 0: kd> u nt!NtOpenEvent L25
 2 nt!NtOpenEvent:
 3 806101e0 6a18            push    18h
 4 806101e2 68a0df4d80      push    offset nt!ExTraceAllTables+0x1b (804ddfa0)
 5 806101e7 e854cbf2ff      call    nt!_SEH_prolog (8053cd40)
 6 806101ec 64a124010000    mov     eax,dword ptr fs:[00000124h]
 7 806101f2 8a9840010000    mov     bl,byte ptr [eax+140h]
 8 806101f8 885ddc          mov     byte ptr [ebp-24h],bl
 9 806101fb 84db            test    bl,bl
10 806101fd 743c            je      nt!NtOpenEvent+0x5b (8061023b)
11 806101ff 8365fc00        and     dword ptr [ebp-4],0
12 80610203 8b7508          mov     esi,dword ptr [ebp+8]
13 80610206 a134315680      mov     eax,dword ptr [nt!MmUserProbeAddress (80563134)]
14 8061020b 3bf0            cmp     esi,eax
15 8061020d 7206            jb      nt!NtOpenEvent+0x35 (80610215)
16 8061020f c70000000000    mov     dword ptr [eax],0
17 80610215 8b06            mov     eax,dword ptr [esi]
18 80610217 8906            mov     dword ptr [esi],eax
19 80610219 834dfcff        or      dword ptr [ebp-4],0FFFFFFFFh
20 8061021d eb1f            jmp     nt!NtOpenEvent+0x5e (8061023e)
21 8061021f 8b45ec          mov     eax,dword ptr [ebp-14h]
22 80610222 8b00            mov     eax,dword ptr [eax]
23 80610224 8b00            mov     eax,dword ptr [eax]
24 80610226 8945e0          mov     dword ptr [ebp-20h],eax
25 80610229 e8c0400000      call    nt!ExSystemExceptionFilter (806142ee)
26 8061022e c3              ret
27 ......

　　发现第一条指令2字节，第二条指令5字节，对于使用Near Jmp的5字节来说，正好落在第2条指令中间，也就是说把一整条指令打断了，这样运行肯定会出问题。

　　所以需要一个计算每条指令长度的功能，来获取大于等于我们需要hook长度的最少完整指令长度，而 Hook Api lib 0.4 for C 这篇文章就提供了这个方法。

二、代码实现

        直接上代码：

　　 头文件

  1 //
  2 //deroko 的LDEX86的头文件定义
  3 /*
  4        C_MODRM       for instructions that require MODRM
  5        C_PREFIX      for PREFIXES (SEG/REP)
  6        C_2BYTE       for instructions which opcode is 2 byte
  7 */
  8 #define       C_SIZE1             0x01
  9 #define       C_MODRM             0x02
 10 #define       C_DATA8             0x04
 11 #define       C_DATA16            0x08
 12 #define       C_DATA32            0x10
 13 #define       C_PREFIX            0x20
 14 #define       C_2BYTE             0x40
 15 #define       C_REL               0x80    //used to don't fuck up relative jmps with 67 prefix    
 16 #define       C_66                0x66    //operand size prefix
 17 #define       C_67                0x67    //address size prefix
 18  
 19 #define       C_UNKNOWN           0x00
 20  
 21 static BYTE table_1[256]={
 22 /* 00 */  C_MODRM
 23 /* 01 */, C_MODRM
 24 /* 02 */, C_MODRM
 25 /* 03 */, C_MODRM
 26 /* 04 */, C_DATA8    // add al, ax, eax + 32imm  w not set imm size = 8
 27 /* 05 */, C_DATA32   // add al, ax, eax + 32imm  w set imm size = 32
 28 /* 06 */, C_SIZE1    //push es
 29 /* 07 */, C_SIZE1    //pop es
 30 /* 08 */, C_MODRM    //or w set
 31 /* 09 */, C_MODRM    //or w not set :)
 32 /* 0A */, C_MODRM
 33 /* 0B */, C_MODRM
 34 /* 0C */, C_DATA8    // or al/ax/eax shortcut
 35 /* 0D */, C_DATA32   // or al/ax/eax shortcut
 36 /* 0E */, C_SIZE1    // push cs
 37 /* 0F */, C_2BYTE
 38 /* 10 */, C_MODRM    //adc w/d set mod rm, next 4
 39 /* 11 */, C_MODRM
 40 /* 12 */, C_MODRM
 41 /* 13 */, C_MODRM
 42 /* 14 */, C_DATA8    //adc al, imm8
 43 /* 15 */, C_DATA32   //adc al, imm32
 44 /* 16 */, C_SIZE1    //push ss
 45 /* 17 */, C_SIZE1    //pop ss
 46 /* 18 */, C_MODRM    //sbb w set/not set
 47 /* 19 */, C_MODRM
 48 /* 1A */, C_MODRM    //sbb d/w combinations
 49 /* 1B */, C_MODRM    //sbb d/w combinations
 50 /* 1C */, C_DATA8    //sbb al, imm8
 51 /* 1D */, C_DATA32   //sbb eax, imm32
 52 /* 1E */, C_SIZE1    //push ds
 53 /* 1F */, C_SIZE1    //pop ds
 54 /* 20 */, C_MODRM    //and mod/rm d/w bit combinations = 4
 55 /* 21 */, C_MODRM
 56 /* 22 */, C_MODRM
 57 /* 23 */, C_MODRM    //end and mod/rm d/w bit combinations
 58 /* 24 */, C_DATA8    //and al, imm8
 59 /* 25 */, C_DATA32   //and al, imm32
 60 /* 26 */, C_PREFIX
 61 /* 27 */, C_SIZE1    //daa
 62 /* 28 */, C_MODRM    //sub w/d mixup
 63 /* 29 */, C_MODRM    
 64 /* 2A */, C_MODRM
 65 /* 2B */, C_MODRM    //sub w/d mixup end
 66 /* 2C */, C_DATA8    //sub al, ax ,eax imm8
 67 /* 2D */, C_DATA32   //sub al, ax, eax imm8
 68 /* 2E */, C_PREFIX
 69 /* 2F */, C_SIZE1    //das
 70 /* 30 */, C_MODRM    //xor next 4
 71 /* 31 */, C_MODRM
 72 /* 32 */, C_MODRM
 73 /* 33 */, C_MODRM
 74 /* 34 */, C_DATA8    //xor al, ax, eax imm 8 w not set (al)
 75 /* 35 */, C_DATA32   //xor al, ax, eax imm 32 w set (eax)
 76 /* 36 */, C_PREFIX
 77 /* 37 */, C_SIZE1           //AAA
 78 /* 38 */, C_MODRM           //cmp d/w set 4 combinations
 79 /* 39 */, C_MODRM           //cmp
 80 /* 3A */, C_MODRM           //cmp
 81 /* 3B */, C_MODRM           //cmp
 82 /* 3C */, C_DATA8           //cmp al, ax, eax imm 8
 83 /* 3D */, C_DATA32          //cmp al, ax, eax imm 32
 84 /* 3E */, C_PREFIX
 85 /* 3F */, C_SIZE1           //AAS
 86 /* 40 */, C_SIZE1           //inc reg (alternate encoding)
 87 /* 41 */, C_SIZE1
 88 /* 42 */, C_SIZE1
 89 /* 43 */, C_SIZE1
 90 /* 44 */, C_SIZE1
 91 /* 45 */, C_SIZE1
 92 /* 46 */, C_SIZE1
 93 /* 47 */, C_SIZE1
 94 /* 48 */, C_SIZE1           //dec reg (alternate encoding)
 95 /* 49 */, C_SIZE1
 96 /* 4A */, C_SIZE1
 97 /* 4B */, C_SIZE1
 98 /* 4C */, C_SIZE1
 99 /* 4D */, C_SIZE1
100 /* 4E */, C_SIZE1
101 /* 4F */, C_SIZE1
102 /* 50 */, C_SIZE1
103 /* 51 */, C_SIZE1
104 /* 52 */, C_SIZE1
105 /* 53 */, C_SIZE1
106 /* 54 */, C_SIZE1
107 /* 55 */, C_SIZE1
108 /* 56 */, C_SIZE1
109 /* 57 */, C_SIZE1
110 /* 58 */, C_SIZE1    //pop reg
111 /* 59 */, C_SIZE1
112 /* 5A */, C_SIZE1
113 /* 5B */, C_SIZE1
114 /* 5C */, C_SIZE1
115 /* 5D */, C_SIZE1
116 /* 5E */, C_SIZE1
117 /* 5F */, C_SIZE1    //pop reg ends
118 /* 60 */, C_SIZE1    //pushad
119 /* 61 */, C_SIZE1    //popad
120 /* 62 */, C_MODRM    //bound
121 /* 63 */, C_MODRM    //arpl
122 /* 64 */, C_PREFIX
123 /* 65 */, C_PREFIX
124 /* 66 */, C_PREFIX
125 /* 67 */, C_PREFIX
126 /* 68 */, C_DATA32  //push immidiate 32
127 /* 69 */, C_MODRM + C_DATA32       //imul reg/reg imm32
128 /* 6A */, C_DATA8   //push imm 8
129 /* 6B */, C_MODRM + C_DATA8        //imul reg/reg imm8
130 /* 6C */, C_SIZE1   //ins w not set
131 /* 6D */, C_SIZE1   //ins w set
132 /* 6E */, C_SIZE1   //outs w not set
133 /* 6F */, C_SIZE1   //outs w set
134 /* 70 */, C_DATA8  + C_REL  //jcc 8 bit displacement start
135 /* 71 */, C_DATA8  + C_REL
136 /* 72 */, C_DATA8  + C_REL
137 /* 73 */, C_DATA8  + C_REL
138 /* 74 */, C_DATA8  + C_REL
139 /* 75 */, C_DATA8  + C_REL
140 /* 76 */, C_DATA8  + C_REL
141 /* 77 */, C_DATA8  + C_REL
142 /* 78 */, C_DATA8  + C_REL
143 /* 79 */, C_DATA8  + C_REL
144 /* 7A */, C_DATA8  + C_REL
145 /* 7B */, C_DATA8  + C_REL
146 /* 7C */, C_DATA8  + C_REL
147 /* 7D */, C_DATA8  + C_REL
148 /* 7E */, C_DATA8  + C_REL
149 /* 7F */, C_DATA8  + C_REL  //jcc 8 bit displacement ends
150 /* 80 */, C_MODRM + C_DATA8   //sub immidira/reg 32bit imm, also cmp modrm/imm32, also cmp
151 /* 81 */, C_MODRM + C_DATA32   //sub imidiate/reg 32bit imm, also cmp modrm/imm32, also cmp
152 /* 82 */, C_MODRM + C_DATA8    //sub or mod rm 8imm w not set, --||--      /imm8, also cmp
153 /* 83 */, C_MODRM + C_DATA8    //sub or mod rm 8imm w set set, --||--      /imm8, also cmp
154 /* 84 */, C_MODRM    //test w not set
155 /* 85 */, C_MODRM    //test w set
156 /* 86 */, C_MODRM    //xchg w not set
157 /* 87 */, C_MODRM    //xchg w set
158 /* 88 */, C_MODRM    //mov not set w
159 /* 89 */, C_MODRM    //mov set w
160 /* 8A */, C_MODRM    //mov d set/not
161 /* 8B */, C_MODRM
162 /* 8C */, C_MODRM    //mov reg/seg
163 /* 8D */, C_MODRM    //lea
164 /* 8E */, C_MODRM    //mov reg/seg I guess
165 /* 8F */, C_MODRM    //pop reg/memory
166 /* 90 */, C_SIZE1    //nop
167 /* 91 */, C_SIZE1    //xchg al, ax, eax   reg
168 /* 92 */, C_SIZE1
169 /* 93 */, C_SIZE1
170 /* 94 */, C_SIZE1
171 /* 95 */, C_SIZE1
172 /* 96 */, C_SIZE1
173 /* 97 */, C_SIZE1    //xchg al, ax, eax,  ret ends
174 /* 98 */, C_SIZE1    //cbw, cwde
175 /* 99 */, C_SIZE1    //cdq, cwd
176 /* 9A */, C_DATA32 + C_DATA16 //far call (call unsinged full offset,selector)
177 /* 9B */, C_SIZE1    //wait//fwait
178 /* 9C */, C_SIZE1           //pushfd
179 /* 9D */, C_SIZE1           //popfd
180 /* 9E */, C_SIZE1           //sahf
181 /* 9F */, C_SIZE1           //LAHF
182 /* A0 */, C_DATA32          //mov al, ax, eax,mem full_offset
183 /* A1 */, C_DATA32          //mov al, ax, eax, mem full_offset
184 /* A2 */, C_DATA32          //mov mem, al, ax, eax full_offset
185 /* A3 */, C_DATA32          //mov mem, al, ax, eax full_offset
186 /* A4 */, C_SIZE1           //movsb
187 /* A5 */, C_SIZE1           //movsd
188 /* A6 */, C_SIZE1    //cmpsb... 2 of them w bit set
189 /* A7 */, C_SIZE1    
190 /* A8 */, C_DATA8    //test al/ax/eax shortcut
191 /* A9 */, C_DATA32   //test al/ax/eax shortcut
192 /* AA */, C_SIZE1    //stosb
193 /* AB */, C_SIZE1    //stosd, or stosw + PREFIX 66
194 /* AC */, C_SIZE1    //lodsb
195 /* AD */, C_SIZE1    //lodsw + PREFIX 66 or lodsd
196 /* AE */, C_SIZE1    //scasb
197 /* AF */, C_SIZE1    //scasd
198 /* B0 */, C_DATA8    //mov reg, imm 8 alterante encoding
199 /* B1 */, C_DATA8
200 /* B2 */, C_DATA8
201 /* B3 */, C_DATA8
202 /* B4 */, C_DATA8
203 /* B5 */, C_DATA8
204 /* B6 */, C_DATA8
205 /* B7 */, C_DATA8
206 /* B8 */, C_DATA32   //mov immidiate to reg (alternate encoding)
207 /* B9 */, C_DATA32
208 /* BA */, C_DATA32
209 /* BB */, C_DATA32
210 /* BC */, C_DATA32
211 /* BD */, C_DATA32
212 /* BE */, C_DATA32
213 /* BF */, C_DATA32
214 /* C0 */, C_MODRM+C_DATA8 //rcl reg/mem by imm8 also rcr depends on opcode in modr/m field, also rol/ror
215 /* C1 */, C_MODRM+C_DATA8 //-----------||-----------
216 /* C2 */, C_DATA16
217 /* C3 */, C_SIZE1    //ret no args
218 /* C4 */, C_MODRM    //les
219 /* C5 */, C_MODRM    //lds
220 /* C6 */, C_MODRM+C_DATA8   // mov mem/imm
221 /* C7 */, C_MODRM+C_DATA32  //litle change (mov mem/imm)
222 /* C8 */, C_DATA8 + C_DATA16    //enter 16disp, 8bit level =4 size
223 /* C9 */, C_SIZE1
224 /* CA */, C_DATA16              //retf param
225 /* CB */, C_SIZE1               //retf no param
226 /* CC */, C_SIZE1
227 /* CD */, C_DATA8    //int, 8bit interupt number
228 /* CE */, C_SIZE1    //into 
229 /* CF */, C_SIZE1    //iret
230 /* D0 */, C_MODRM    //rcl reg/memory by 1 , also rcr, also ror/rol
231 /* D1 */, C_MODRM    //same with w bit set , -||-
232 /* D2 */, C_MODRM    //rcl register by cl  , -||-
233 /* D3 */, C_MODRM    //same with w bit set , -||- , also rol,ror
234 /* D4 */, C_DATA8    //aam 2 byte long but C_DATA8 is processed as 2 in my algo so this is ok
235 /* D5 */, C_DATA8    //aad 2 bytes long C_DATA8 is processed as 2 byte long 
236 /* D6 */, C_SIZE1    //salc
237 /* D7 */, C_SIZE1    //xlat
238 /* D8 */, C_MODRM    //all FPU are C_MODRM
239 /* D9 */, C_MODRM    
240 /* DA */, C_MODRM
241 /* DB */, C_MODRM
242 /* DC */, C_MODRM
243 /* DD */, C_MODRM
244 /* DE */, C_MODRM
245 /* DF */, C_MODRM    //end FPU instructions
246 /* E0 */, C_DATA8 + C_REL   //loonz 8bit
247 /* E1 */, C_DATA8 + C_REL   //loopz 8bit
248 /* E2 */, C_DATA8 + C_REL   //loop  8bit
249 /* E3 */, C_DATA8 + C_REL    //jecxz 8bit Address-size prefix indicates jcxz or jecxz
250 /* E4 */, C_DATA8    //in al, port
251 /* E5 */, C_DATA8    //in eax, port
252 /* E6 */, C_DATA8    //out port w not set (out 0, al)
253 /* E7 */, C_DATA8    //out port w set (out 0, eax)
254 /* E8 */, C_DATA32 + C_REL
255 /* E9 */, C_DATA32 + C_REL   //jmp full displacement
256 /* EA */, C_DATA32 + C_DATA16 //jmp far full offset, selector
257 /* EB */, C_DATA8     //jmp 8 bit displacement
258 /* EC */, C_SIZE1    //in
259 /* ED */, C_SIZE1    //in
260 /* EE */, C_SIZE1    //out
261 /* EF */, C_SIZE1    //out
262 /* F0 */, C_PREFIX
263 /* F1 */, C_SIZE1    //int1
264 /* F2 */, C_PREFIX
265 /* F3 */, C_PREFIX
266 /* F4 */, C_SIZE1    //hlt
267 /* F5 */, C_SIZE1    //cmc
268 /* F6 */, C_MODRM + C_DATA8 //not (w not set), neg depends on opcode field in modrm, it can be test imm
269 /* F7 */, C_MODRM + C_DATA32 //not (w set)    , neg depends on opcode field in modrm, it can be test imm
270 /* F8 */, C_SIZE1    //clc
271 /* F9 */, C_SIZE1    //stc
272 /* FA */, C_SIZE1    //cli
273 /* FB */, C_SIZE1    //sti
274 /* FC */, C_SIZE1    //cld
275 /* FD */, C_SIZE1    //std    
276 /* FE */, C_MODRM    //inc/dec w not set (modrm)
277 /* FF */, C_MODRM    //inc/dec w set     (modrm) //call also depends on reg/opcode field
278 };                   //also jmp (depends on reg/opcode) fild
279  
280 static BYTE table_2[256]={
281 /* 00 */  C_MODRM           //lldt
282 /* 01 */, C_MODRM           //invlpg
283 /* 02 */, C_MODRM           //lar
284 /* 03 */, C_MODRM           //LSL
285 /* 04 */, 0
286 /* 05 */, 0
287 /* 06 */, C_SIZE1           //clts
288 /* 07 */, 0
289 /* 08 */, C_SIZE1           //invd
290 /* 09 */, C_SIZE1
291 /* 0A */, 0
292 /* 0B */, 0
293 /* 0C */, 0
294 /* 0D */, 0
295 /* 0E */, 0
296 /* 0F */, 0
297 /* 10 */, 0
298 /* 11 */, 0
299 /* 12 */, 0
300 /* 13 */, 0
301 /* 14 */, 0
302 /* 15 */, 0
303 /* 16 */, 0
304 /* 17 */, 0
305 /* 18 */, 0
306 /* 19 */, 0
307 /* 1A */, 0
308 /* 1B */, 0
309 /* 1C */, 0
310 /* 1D */, 0
311 /* 1E */, 0
312 /* 1F */, 0
313 /* 20 */, C_MODRM           //mov reg/crX
314 /* 21 */, C_MODRM           //mov drX/reg
315 /* 22 */, C_MODRM           //mov crX/reg and it foes all the way down
316 /* 23 */, C_MODRM           //mov reg/drX
317 /* 24 */, 0
318 /* 25 */, 0
319 /* 26 */, 0
320 /* 27 */, 0
321 /* 28 */, 0
322 /* 29 */, 0
323 /* 2A */, 0
324 /* 2B */, 0
325 /* 2C */, 0
326 /* 2D */, 0
327 /* 2E */, 0
328 /* 2F */, 0
329 /* 30 */, C_SIZE1
330 /* 31 */, C_SIZE1
331 /* 32 */, C_SIZE1
332 /* 33 */, C_SIZE1
333 /* 34 */, C_SIZE1
334 /* 35 */, 0
335 /* 36 */, 0
336 /* 37 */, 0
337 /* 38 */, 0
338 /* 39 */, 0
339 /* 3A */, 0
340 /* 3B */, 0
341 /* 3C */, 0
342 /* 3D */, 0
343 /* 3E */, 0
344 /* 3F */, 0
345 /* 40 */, C_MODRM           //conditional move
346 /* 41 */, C_MODRM
347 /* 42 */, C_MODRM
348 /* 43 */, C_MODRM
349 /* 44 */, C_MODRM
350 /* 45 */, C_MODRM
351 /* 46 */, C_MODRM
352 /* 47 */, C_MODRM
353 /* 48 */, C_MODRM
354 /* 49 */, C_MODRM
355 /* 4A */, C_MODRM
356 /* 4B */, C_MODRM
357 /* 4C */, C_MODRM
358 /* 4D */, C_MODRM
359 /* 4E */, C_MODRM
360 /* 4F */, C_MODRM           //end conditional move 
361 /* 50 */, 0
362 /* 51 */, 0
363 /* 52 */, 0
364 /* 53 */, 0
365 /* 54 */, 0
366 /* 55 */, 0
367 /* 56 */, 0
368 /* 57 */, 0
369 /* 58 */, 0
370 /* 59 */, 0
371 /* 5A */, 0
372 /* 5B */, 0
373 /* 5C */, 0
374 /* 5D */, 0
375 /* 5E */, 0
376 /* 5F */, 0
377 /* 60 */, 0
378 /* 61 */, 0
379 /* 62 */, 0
380 /* 63 */, 0
381 /* 64 */, 0
382 /* 65 */, 0
383 /* 66 */, 0
384 /* 67 */, 0
385 /* 68 */, 0
386 /* 69 */, 0
387 /* 6A */, 0
388 /* 6B */, 0
389 /* 6C */, 0
390 /* 6D */, 0
391 /* 6E */, 0
392 /* 6F */, 0
393 /* 70 */, 0
394 /* 71 */, 0
395 /* 72 */, 0
396 /* 73 */, 0
397 /* 74 */, 0
398 /* 75 */, 0
399 /* 76 */, 0
400 /* 77 */, 0
401 /* 78 */, 0
402 /* 79 */, 0
403 /* 7A */, 0
404 /* 7B */, 0
405 /* 7C */, 0
406 /* 7D */, 0
407 /* 7E */, 0
408 /* 7F */, 0
409 /* 80 */, C_DATA32   //jccs 2 byte long imm32
410 /* 81 */, C_DATA32
411 /* 82 */, C_DATA32
412 /* 83 */, C_DATA32
413 /* 84 */, C_DATA32
414 /* 85 */, C_DATA32
415 /* 86 */, C_DATA32
416 /* 87 */, C_DATA32
417 /* 88 */, C_DATA32
418 /* 89 */, C_DATA32
419 /* 8A */, C_DATA32
420 /* 8B */, C_DATA32
421 /* 8C */, C_DATA32
422 /* 8D */, C_DATA32
423 /* 8E */, C_DATA32
424 /* 8F */, C_DATA32   //jccs 2byte long ends imm32
425 /* 90 */, C_MODRM
426 /* 91 */, C_MODRM
427 /* 92 */, C_MODRM
428 /* 93 */, C_MODRM
429 /* 94 */, C_MODRM
430 /* 95 */, C_MODRM
431 /* 96 */, C_MODRM
432 /* 97 */, C_MODRM
433 /* 98 */, C_MODRM
434 /* 99 */, C_MODRM
435 /* 9A */, C_MODRM
436 /* 9B */, C_MODRM
437 /* 9C */, C_MODRM
438 /* 9D */, C_MODRM
439 /* 9E */, C_MODRM
440 /* 9F */, C_MODRM
441 /* A0 */, C_SIZE1            //push fs
442 /* A1 */, C_SIZE1           //pop fs
443 /* A2 */, C_SIZE1           //cpuid
444 /* A3 */, C_MODRM           //bt reg/mem
445 /* A4 */, C_MODRM + C_DATA8
446 /* A5 */, C_MODRM
447 /* A6 */, 0
448 /* A7 */, 0
449 /* A8 */, C_SIZE1           //push gs
450 /* A9 */, C_SIZE1           //pop gs
451 /* AA */, C_SIZE1
452 /* AB */, C_MODRM           //bts
453 /* AC */, C_MODRM + C_DATA8
454 /* AD */, C_MODRM
455 /* AE */, 0
456 /* AF */, C_MODRM           //imul reg/reg or reg/mem
457 /* B0 */, C_MODRM           //cmpxchg
458 /* B1 */, C_MODRM           //cmpxchg
459 /* B2 */, C_MODRM           //lss
460 /* B3 */, C_MODRM           //btr
461 /* B4 */, C_MODRM           //lfs
462 /* B5 */, C_MODRM           //lgs
463 /* B6 */, C_MODRM           //movzx
464 /* B7 */, C_MODRM           //movzx
465 /* B8 */, 0
466 /* B9 */, 0
467 /* BA */, C_MODRM + C_DATA8 //bt imm8
468 /* BB */, C_MODRM           //btc mod/rm
469 /* BC */, C_MODRM           //BSF
470 /* BD */, C_MODRM           //BSR
471 /* BE */, C_MODRM           //movsx
472 /* BF */, C_MODRM           //movsx
473 /* C0 */, C_MODRM           //xadd
474 /* C1 */, C_MODRM           //xadd
475 /* C2 */, 0
476 /* C3 */, 0
477 /* C4 */, 0
478 /* C5 */, 0
479 /* C6 */, 0
480 /* C7 */, 0
481 /* C8 */, C_SIZE1           //bswap eax
482 /* C9 */, C_SIZE1
483 /* CA */, C_SIZE1
484 /* CB */, C_SIZE1
485 /* CC */, C_SIZE1
486 /* CD */, C_SIZE1
487 /* CE */, C_SIZE1
488 /* CF */, C_SIZE1           //bswap reg ends
489 /* D0 */, 0
490 /* D1 */, 0
491 /* D2 */, 0
492 /* D3 */, 0
493 /* D4 */, 0
494 /* D5 */, 0
495 /* D6 */, 0
496 /* D7 */, 0
497 /* D8 */, 0
498 /* D9 */, 0
499 /* DA */, 0
500 /* DB */, 0
501 /* DC */, 0
502 /* DD */, 0
503 /* DE */, 0
504 /* DF */, 0
505 /* E0 */, 0
506 /* E1 */, 0
507 /* E2 */, 0
508 /* E3 */, 0
509 /* E4 */, 0
510 /* E5 */, 0
511 /* E6 */, 0
512 /* E7 */, 0
513 /* E8 */, 0
514 /* E9 */, 0
515 /* EA */, 0
516 /* EB */, 0
517 /* EC */, 0
518 /* ED */, 0
519 /* EE */, 0
520 /* EF */, 0
521 /* F0 */, 0
522 /* F1 */, 0
523 /* F2 */, 0
524 /* F3 */, 0
525 /* F4 */, 0
526 /* F5 */, 0
527 /* F6 */, 0
528 /* F7 */, 0
529 /* F8 */, 0
530 /* F9 */, 0
531 /* FA */, 0
532 /* FB */, 0
533 /* FC */, 0
534 /* FD */, 0
535 /* FE */, 0
536 /* FF */, 0
537 };

　　CPP文件

 1 int GetOpCodeSize(PVOID Start)
 2 {
 3         BYTE opcode, * p, /*tempopcode,*/ instruction;
 4         int size;
 5         int opsizeprefix = 0, addressprefix = 0;
 6         size = 0;
 7         p = (PBYTE)Start;
 8         opcode = *p;
 9         //Proces PREFIXES!!! if any...
10 prefix_loop:
11         if (table_1[opcode] == C_PREFIX) {
12                 if (opcode == C_66)
13                         opsizeprefix = 1;
14                 if (opcode == C_67)
15                         addressprefix = 1;
16                 size++;
17                 p++;
18                 opcode = *p;
19                 goto prefix_loop;
20         }
21         //check for test, stupid and fucking test
22         instruction = table_1[opcode];
23         if ((opcode == 0xF6) || (opcode == 0xF7)) {
24                 opcode = p[1];
25                 if ((opcode & 0x38) != 0)         //test or neg/not...
26                         instruction = C_MODRM;
27  
28         }
29         if (opsizeprefix)
30                 //where was 8 still is 8 //where was 32 now is 16
31                 if (instruction & C_DATA32) {
32                         instruction &= ~(C_DATA32);
33                         instruction |= C_DATA16;
34                 }
35         //if not relative change 
36         if (addressprefix && !(instruction & C_REL)) {
37                 instruction &= ~(C_DATA32);
38                 instruction &= ~(C_DATA8);
39                 instruction |= C_DATA16;
40         }
41         //clear relative flag
42         if (instruction & C_REL)
43                 instruction &= ~(C_REL);
44         //fill instruction with flags from table_2 and decode it in right way
45         if (instruction == C_2BYTE) {
46                 size += 1;
47                 p++;
48                 instruction = table_2[*p];
49                 //if (instruction == C_DATA32)
50                 //   size += 5;
51                 //goto check_modrm;   
52         }
53         size += 1;                         //opcode len;     
54 //check_modrm:
55         if (instruction & C_MODRM) {
56                 unsigned char modrm, sib;
57                 size += 1;
58                 p++;
59                 modrm = *p;
60                 if ((modrm >> 6) == 0 && (modrm & 0x07) == 0x05) //modrm is folowed by 32disp
61                         size += 4;
62  
63                 if ((modrm >> 6) != 3 && (modrm & 0x07) == 0x04) {   //sib
64                         size++;
65                         p++;
66                         sib = *p;
67                         if ((modrm >> 6) == 1 && (modrm & 0x07) == 0x04) //8bit disp after SIB(added to index)
68                                 size++;
69                         if ((modrm >> 6) == 2 && (modrm & 0x07) == 0x04) //32bit displacement after sib(added to index)             
70                                 size += 4;
71                         if ((modrm >> 6) == 0 && (sib & 0x07) == 0x05)
72                                 size += 4;
73                 } //SIB processing
74                 TEST CODE//
75                 if (modrm >= 0x40 && modrm <= 0x7f && (modrm & 0x07) != 0x04)
76                         size += 1;
77                 if (modrm >= 0x80 && modrm <= 0xbf && (modrm & 0x07) != 0x04)
78                         size += 4;
79                 ///TEST CODE/// 
80         }
81         if (instruction & C_DATA32)  //is this opcode opcode modrm immdata ???
82                 size += 4;
83         if (instruction & C_DATA8)
84                 size++;
85         if (instruction & C_DATA16)
86                 size += 2;
87         if (instruction == C_UNKNOWN)
88                 size += 1;
89         return size;
90 }

三、测试

         测试循环打印出 NtOpenProcess 前50行指令,环境为WinXP x86 SP3.。

　　1.代码

 1 #if DBG
 2 #define KDPRINT(projectName, format, ...) DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL,    projectName "::【" __FUNCTION__  "】" ##format,  ##__VA_ARGS__ )
 3 #else
 4 #define KDPRINT(format, ...)
 5 #endif
 6 
 7 
 8 NTSTATUS  DriverEntry(
 9         PDRIVER_OBJECT pDriverObject,
10         PUNICODE_STRING pRegistryPath)
11 {
12         UNREFERENCED_PARAMETER(pDriverObject);
13         NTSTATUS ntStatus = STATUS_SUCCESS;
14         do
15         {
16                 KDPRINT("【GetOpCodeX86】","DriverEntry! \n");
17 
18                 KDPRINT("【GetOpCodeX86】","Hello Kernel World! CurrentProcessId:0x%p CurrentIRQL:0x%u\n",
19                         PsGetCurrentProcessId(),
20                         KeGetCurrentIrql());
21 
22                 if (pRegistryPath != NULL)
23                 {
24                         KDPRINT("【GetOpCodeX86】","RegistryPath:%wZ \n", pRegistryPath);
25                 }
26                 pDriverObject->DriverUnload = DriverUnload;
27 
28                 PrintFunctionOpCode((PBYTE)NtOpenProcess);
29 
30         } while (false);
31 
32         return ntStatus;
33 }
34 
35 VOID DriverUnload(
36         PDRIVER_OBJECT pDriverObject)
37 {
38         UNREFERENCED_PARAMETER(pDriverObject);
39         KDPRINT("【GetOpCodeX86】"," CurrentProcessId:0x%p CurrentIRQL:0x%u\n",
40                 PsGetCurrentProcessId(),
41                 KeGetCurrentIrql());
42 }
43 
44 VOID PrintFunctionOpCode(PBYTE pAddress)
45 {
46         ULONG ulGetOpCodeSingleSize = 0;
47         ULONG ulGetOpCodeTotalSize = 0;
48         ULONG nLines = 1;
49         while (nLines <= 50)
50         {
51                 ulGetOpCodeSingleSize = GetOpCodeSize(pAddress + ulGetOpCodeTotalSize);
52                 KDPRINT("【GetOpCodeX86】","Line %03d, GetOpCodeSize:%d\r\n",
53                         nLines, ulGetOpCodeSingleSize);
54                 ulGetOpCodeTotalSize += ulGetOpCodeSingleSize;
55                 nLines++;
56         }
57 }

　　2.输出结果(WinXP SP3):

　　 3.Windbg反汇编结果

　　4.结论

        通过对比可以看出前50条指令中每条指令长度都是正确计算出来的。

PS 附上库代码的下载链接：

　　《HookAPILib0.4.rar》