恢复SSDT不一定要加载驱动，但是要进Ring0才行.
.386p
.model flat, stdcall
option casemap:none
include \masm32\include\windows.inc
include \masm32\include\kernel32.inc
include \masm32\include\user32.inc
include macros.asm
include masm32.inc
include debug.inc
include advapi32.inc
includelib debug.lib
includelib masm32.lib
includelib \masm32\lib\user32.lib
includelib \masm32\lib\kernel32.lib
includelib advapi32.lib
.data
dwFileSize dd 0
hFile dd 0
hMemory dd 0
pMemory dd 0
FunBase dd 0b6a8h
szExceptionCaused db 'Exception Caused - could not switch to ring 0',0
szError db 'Error',0
MsgCaption db 'Test',0
MsgBoxText db "cr3=%8x",0
tmp db 50 dup(90)
Callgt dd 0
dw 353h
.data?
.code
ExceptCallBack PROC
invoke MessageBoxA, 0, addr szExceptionCaused,addr szError, 0
invoke ExitProcess, -1
ret
ExceptCallBack ENDP
_OpenSys proc
local hSCManager:HANDLE
local hService:HANDLE
local acDriverPath[MAX_PATH]:CHAR
; Open a handle to the SC Manager database
invoke OpenSCManager, NULL, NULL, SC_MANAGER_CREATE_SERVICE
.if eax != NULL
mov hSCManager, eax
push eax
invoke GetFullPathName, CTXT("sys.sys",0), sizeof acDriverPath, addr acDriverPath, esp
pop eax
; Register driver in SCM active database
invoke CreateService, hSCManager, CTXT("sys",0), CTXT("System",0), \
SERVICE_START + DELETE, SERVICE_KERNEL_DRIVER, SERVICE_DEMAND_START, \
SERVICE_ERROR_IGNORE, addr acDriverPath, NULL, NULL, NULL, NULL, NULL
.if eax != NULL
mov hService, eax
invoke StartService, hService, 0, NULL
; Here driver beeper.sys plays its nice melody
; and reports error to be removed from memory
; Remove driver from SCM database
invoke DeleteService, hService
invoke CloseServiceHandle, hService
.else
invoke MessageBox, NULL, CTXT("Can't register driver.",0), NULL, MB_ICONSTOP
.endif
invoke CloseServiceHandle, hSCManager
.else
invoke MessageBox, NULL, CTXT("Can't connect to Service Control Manager.",0), \
NULL, MB_ICONSTOP
.endif
ret
_OpenSys endp
start:
push offset ExceptCallBack
call SetUnhandledExceptionFilter
invoke _OpenSys
invoke CreateFile, CTXT("C:\WINDOWS\system32\ntoskrnl.exe",0), GENERIC_READ or GENERIC_WRITE, FILE_SHARE_READ or FILE_SHARE_WRITE, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL
.if eax == INVALID_HANDLE_VALUE
invoke MessageBox, NULL, CTXT("打开文件失败！",0), CTXT("打开文件失败！",0), MB_OK or MB_ICONHAND
jmp Exit
.endif
mov hFile, eax
invoke GetFileSize, hFile, NULL
;add eax, 0100h
mov dwFileSize, eax
invoke GlobalAlloc,GMEM_SHARE or GMEM_MOVEABLE or GMEM_ZEROINIT, dwFileSize
mov hMemory,eax
invoke GlobalLock,hMemory
mov pMemory,eax
invoke ReadFile, hFile, pMemory, dwFileSize, esp, 0
mov ecx, 0470h/4
mov esi, pMemory
add esi, 0b6a8h
mov edi, esi
add1: lodsd
add eax, 0800d8000h
stosd
loop add1
;jmp Exit
call fword ptr [Callgt] ;use callgate to Ring0!
mov eax,esp ;save ring0 esp
mov esp,[esp+4];->ring3 esp
push eax
cli
mov edi,0804d8000h
add edi,FunBase
mov esi,pMemory
add esi,FunBase
mov ecx,0470h
cld
rep movsb
sti
pop esp ;restore ring0 esp
push offset Exit
retf
Exit:
;invoke MessageBox, NULL, CTXT("已成功恢复SSDT",0), CTXT("Success",0), MB_OK
invoke CloseHandle,hFile
invoke GlobalUnlock,pMemory
invoke GlobalFree,hMemory
invoke ExitProcess,NULL
end start
