[Mehdi]

Hello everyone
I want to call ZwQueryVirtualMemory in Windows XP SP2 (This syscall is not exported from ntoskrnl.exe in Win XP)
I've succeeded with using the hard-coded address (for proof of concept), now I want a better and more stable solution.

Code: Select all

MyZwQueryVirtualMemory zwQVM = (MyZwQueryVirtualMemory)0x805ACD0E;

How I can reliably find the address of ZwQueryVirtualMemory and call it ?
(I've read that using unexported system calls from kernel mode is not recommended, but for my utility which is a Kernel mode memory dumper I need it)

Thank you very much

[cjbi]

Try this.

Code: Select all

GetProcAddress(GetModuleHandleA("ntdll.dll"), "ZwQueryVirtualMemory"); 

[Mehdi]

Thanks, but
1- my code is kernel mode.
2- And ZW* functions are in ntoskrnl (not ntdll)

[GamingMasteR]

Code: Select all

#define SYSCALL_INDEX(_address) *(PULONG)((PUCHAR)_address+1)

VOID GetNtQueryVirtualMemory(VOID)
{
    ASSERT(Irql <= APC_LEVEL)
    Ntdll = GetNtdllImageBase(); // Ntdll.dll is mapped into all processes VM by default
    if (Ntdll == NULL)
        return;
    lpNtQueryVirtualMemory =  KeServiceDescriptorTable[SYSCALL_INDEX(GetProcAddress(NtDll, "ZwQueryVirtualMemory"))].ServiceRoutine;
}

Or you can send the service index from the application to the driver while initializing .

[Mehdi]

Thanks. Your post was very helpful
First I tried using MmGetSystemRoutineAddress, but it returns NULL for ZwQueryVirtualMemory.
Now I'm using this code (I've hardcoded the index, because it only runs on XP SP0-SP2) and it works.

Code: Select all

DWORD* systemCallTable              = (DWORD*)KeServiceDescriptorTable.KiServiceTable;
MyZwQueryVirtualMemory	zwQVM = (MyZwQueryVirtualMemory)(systemCallTable[0xB2]);

One question: GetProcAddress is a user mode function. How can we run it in kernel ?

[EP_X0FF]

For a beginner, more efficient solution is to hardcode NtQueryVirtualMemory SSDT index inside driver.

[cjbi]

One question: GetProcAddress is a user mode function. How can we run it in kernel ?

Implementation of GetProcAddress and GetModuleHandle for Windows NT3.51/NT4/2000/XP/2003/Vista kernel mode, both 32 and 64 bit platforms
http://alter.org.ua/docs/nt_kernel/procaddr/