一种通用的Shadow SSDT原始地址获取新方式  

A NOVEL AND GENERAL METHOD ON ACQUIRING ORIGINAL ADDRESSES OF SHADOW SSDT

作　　者：霍亮[1,2] 马恒太[1] 张楠[1] 

机构地区：[1]中国科学院软件研究所天基综合信息系统重点实验室,北京100190 [2]中国科学院大学,北京100190

出　　处：《计算机应用与软件》2014年第6期66-68,119,共4页Computer Applications and Software

摘　　要：挂钩恢复是一项重要的安全技术。对Shadow系统服务描述表(SSDT)挂钩检测以及恢复方法进行分析,传统方法中的原始地址获取方式不仅存在Windows操作系统版本兼容性问题,而且代码逻辑复杂。针对该问题,提出一种通用算法,对Shadow SSDT原始地址获取方法进行改进,并设计了基址重定位方法,减少了代码量,有效提高了稳定性和兼容性。Hook recovery is one of the important security technologies. We analyse the detection of Shadow system service description table （SSDT） hook and its recovery. In traditional way of original addresses acquisition there are the problems of compatibility in regard to Windows operating system versions and of the complex code logic. In light of this issue, we present a general algorithm, which improves the acquisition means of Shadow SSDT original addresses, and design the base address relocating approach, which reduces the amount of code. They efficiently enhance the stability and compatibility.

关 键 词：SHADOW SSDT win32k SYS SHADOW SSDT钩子Shadow SSDT恢复 

分 类 号：TP316.86[自动化与计算机技术—计算机软件与理论]