ACPI!ACPIInitialize函数分析之替换中断对象的地址
//
// The following two instructions set the address of current interrupt
// object the the NORMAL dispatching code.
//
pl = (PULONG)((PUCHAR)pl + ((PUCHAR)&KiInterruptTemplateObject -
(PUCHAR)KiInterruptTemplate) -4);
*pl = (ULONG)Interrupt; Interrupt = 0x89d266b0
0: kd> kc
#
00 nt!KeInitializeInterrupt
01 nt!IoConnectInterrupt
02 ACPI!OSInterruptVector
03 ACPI!ACPIInitialize
04 ACPI!ACPIInitStartACPI
05 ACPI!ACPIRootIrpStartDevice
06 ACPI!ACPIDispatchIrp
07 nt!IofCallDriver
08 nt!IopSynchronousCall
09 nt!IopStartDevice
0a nt!PipProcessStartPhase1
0b nt!PipProcessDevNodeTree
0c nt!PipDeviceActionWorker
0d nt!PipRequestDeviceAction
0e nt!IopInitializeBootDrivers
0f nt!IoInitSystem
10 nt!Phase1Initialization
11 nt!PspSystemThreadStartup
12 nt!KiThreadStartup
0: kd> kv
# ChildEBP RetAddr Args to Child
00 f789a19c 80c61a05 89d266b0 f7409b10 89db4ea0 nt!KeInitializeInterrupt+0x8a (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\base\ntos\ke\i386\intobj.c @ 237]
01 f789a1e8 f743c182 89db4ecc f7409b10 89db4ea0 nt!IoConnectInterrupt+0x105 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\base\ntos\io\iomgr\iosubs.c @ 4007]
02 f789a22c f7454412 89db4020 804ee150 f743b620 ACPI!OSInterruptVector+0xb8 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\base\busdrv\acpi\driver\nt\acpiosnt.c @ 511]
03 f789a248 f740899d 89db4020 89db4ea0 00000000 ACPI!ACPIInitialize+0x24a (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\base\busdrv\acpi\driver\shared\acpiinit.c @ 278]
04 f789a27c f744f51e 89db4020 00000000 f744f3ea ACPI!ACPIInitStartACPI+0x6f (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\base\busdrv\acpi\driver\nt\init.c @ 1211]
05 f789a2a8 f740410e 89db4020 89df3400 89db4020 ACPI!ACPIRootIrpStartDevice+0x134 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\base\busdrv\acpi\driver\nt\root.c @ 1340]
06 f789a2dc 80a2675c 89db4020 89df3460 89df3518 ACPI!ACPIDispatchIrp+0x19e (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\base\busdrv\acpi\driver\nt\dispatch.c @ 690]
07 f789a2f8 80c95e00 f789a36c 89db5008 89db5cb8 nt!IofCallDriver+0x62 (FPO: [Non-Fpo]) (CONV: fastcall) [d:\srv03rtm\base\ntos\io\iomgr\iosubs.c @ 2237]
08 f789a328 80c95f56 00000000 f789a348 00000000 nt!IopSynchronousCall+0x1aa (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\base\ntos\io\pnpmgr\pnpirp.c @ 258]
09 f789a36c 80c8f415 89db5cb8 00000001 00000000 nt!IopStartDevice+0x78 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\base\ntos\io\pnpmgr\pnpirp.c @ 334]
0a f789a388 80c94d55 89db5cb8 00000000 00000000 nt!PipProcessStartPhase1+0x9d (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\base\ntos\io\pnpmgr\pnpenum.c @ 5014]
0b f789a5d4 80a2dde9 89db9ac0 00000000 89df9300 nt!PipProcessDevNodeTree+0x1c7 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\base\ntos\io\pnpmgr\pnpenum.c @ 4648]
0c f789a618 80a2e161 00000000 00000000 80083760 nt!PipDeviceActionWorker+0xcd (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\base\ntos\io\pnpmgr\pnpenum.c @ 710]
0d f789a630 80e69358 00000000 00000005 00000000 nt!PipRequestDeviceAction+0x139 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\base\ntos\io\pnpmgr\pnpenum.c @ 598]
0e f789a694 80e655c7 80077000 f789a7dc 00034000 nt!IopInitializeBootDrivers+0x392 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\base\ntos\io\pnpmgr\pnpinit.c @ 1440]
0f f789a838 80e632fd 80077000 00000000 89dd4020 nt!IoInitSystem+0x70b (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\base\ntos\io\iomgr\ioinit.c @ 665]
10 f789adac 80d391f0 80077000 00000000 00000000 nt!Phase1Initialization+0x9b3 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\base\ntos\init\init.c @ 2221]
11 f789addc 80b00d52 80e6294a 80077000 00000000 nt!PspSystemThreadStartup+0x2e (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\base\ntos\ps\create.c @ 2213]
12 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16 [d:\srv03rtm\base\ntos\ke\i386\threadbg.asm @ 81]
0: kd> p
eax=89d266b0 ebx=08247489 ecx=092261b1 edx=80b0053b esi=89d266b0 edi=89d26918
eip=80a346ca esp=f789a198 ebp=f789a19c iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000206
nt!KeInitializeInterrupt+0x8a:
80a346ca c6402b00 mov byte ptr [eax+2Bh],0 ds:0023:89d266db=00
0: kd> dv
Interrupt = 0x89d266b0
ServiceRoutine = 0xf7409b10
ServiceContext = 0x89db4ea0
SpinLock = 0x89d26914
Vector = 0x1b1
Irql = 0x0a ''
SynchronizeIrql = 0x0a ''
InterruptMode = LevelSensitive (0n0)
ShareVector = 0x03 ''
ProcessorNumber = 0n0 ''
FloatingSave = 0x00 ''
0: kd> dx -id 0,0,ffffffff89dd5240 -r1 ((ntkrnlmp!_KINTERRUPT *)0x89d266b0)
((ntkrnlmp!_KINTERRUPT *)0x89d266b0) : 0x89d266b0 [Type: _KINTERRUPT *]
[+0x000] Type : 22 [Type: short]
[+0x002] Size : 484 [Type: short]
[+0x004] InterruptListEntry [Type: _LIST_ENTRY]
[+0x00c] ServiceRoutine : 0xf7409b10 [Type: unsigned char (*)(_KINTERRUPT *,void *)]
[+0x010] ServiceContext : 0x89db4ea0 [Type: void *]
[+0x014] SpinLock : 0x0 [Type: unsigned long]
[+0x018] TickCount : 0xffffffff [Type: unsigned long]
[+0x01c] ActualLock : 0x89d26914 : 0x0 [Type: unsigned long *]
[+0x020] DispatchAddress : 0x0 [Type: void (*)()]
[+0x024] Vector : 0x1b1 [Type: unsigned long]
[+0x028] Irql : 0xa [Type: unsigned char]
[+0x029] SynchronizeIrql : 0xa [Type: unsigned char]
[+0x02a] FloatingSave : 0x0 [Type: unsigned char]
[+0x02b] Connected : 0x0 [Type: unsigned char]
[+0x02c] Number : 0 [Type: char]
[+0x02d] ShareVector : 0x3 [Type: unsigned char]
[+0x030] Mode : LevelSensitive (0) [Type: _KINTERRUPT_MODE]
[+0x034] ServiceCount : 0x0 [Type: unsigned long]
[+0x038] DispatchCount : 0xffffffff [Type: unsigned long]
[+0x03c] DispatchCode [Type: unsigned long [106]]
0: kd> dx -id 0,0,ffffffff89dd5240 -r1 (*((ntkrnlmp!unsigned long (*)[106])0x89d266ec))
(*((ntkrnlmp!unsigned long (*)[106])0x89d266ec)) [Type: unsigned long [106]]
[0] : 0x56535554 [Type: unsigned long]
[1] : 0x54ec8357 [Type: unsigned long]
[2] : 0x4489ec8b [Type: unsigned long]
[3] : 0x4c894424 [Type: unsigned long]
[4] : 0x54894024 [Type: unsigned long]
[5] : 0x44c73c24 [Type: unsigned long]
[6] : 0xffff4824 [Type: unsigned long]
[7] : 0x44f7ffff [Type: unsigned long]
[8] : 0x7024 [Type: unsigned long]
[9] : 0x850f0002 [Type: unsigned long]
[10] : 0x135 [Type: unsigned long]
[11] : 0x247c8366 [Type: unsigned long]
[12] : 0x2374086c [Type: unsigned long]
[13] : 0x5024648c [Type: unsigned long]
[14] : 0x38245c8c [Type: unsigned long]
[15] : 0x3424448c [Type: unsigned long]
[16] : 0x30246c8c [Type: unsigned long]
[17] : 0x30bb [Type: unsigned long]
[18] : 0x23b800 [Type: unsigned long]
[19] : 0x8e660000 [Type: unsigned long]
[20] : 0xd88e66e3 [Type: unsigned long]
[21] : 0x64c08e66 [Type: unsigned long]
[22] : 0x1d8b [Type: unsigned long]
[23] : 0xc7640000 [Type: unsigned long]
[24] : 0x5 [Type: unsigned long]
[25] : 0xffffff00 [Type: unsigned long]
[26] : 0x245c89ff [Type: unsigned long]
[27] : 0xfc814c [Type: unsigned long]
[28] : 0xf000100 [Type: unsigned long]
[29] : 0xbc82 [Type: unsigned long]
[30] : 0x2444c700 [Type: unsigned long]
[31] : 0x64 [Type: unsigned long]
[32] : 0xd8b6400 [Type: unsigned long]
[33] : 0x124 [Type: unsigned long]
[34] : 0x341f6fc [Type: unsigned long]
[35] : 0x2c45c7ff [Type: unsigned long]
[36] : 0x0 [Type: unsigned long]
[37] : 0x5d8b2375 [Type: unsigned long]
[38] : 0x687d8b60 [Type: unsigned long]
[39] : 0xc70c5589 [Type: unsigned long]
[40] : 0xd000845 [Type: unsigned long]
[41] : 0x5d89badb [Type: unsigned long]
[42] : 0x47d8900 [Type: unsigned long]
[43] : 0xd266b0bf [Type: unsigned long]
[44] : 0xf8efe989 [Type: unsigned long]
[45] : 0x498dffff [Type: unsigned long]
[46] : 0x7045f700 [Type: unsigned long]
[47] : 0x20000 [Type: unsigned long]
[48] : 0x45f60675 [Type: unsigned long]
[49] : 0xce74016c [Type: unsigned long]
[50] : 0xfc3210f [Type: unsigned long]
[51] : 0x210fc921 [Type: unsigned long]
[52] : 0x185d89d7 [Type: unsigned long]
[53] : 0x891c4d89 [Type: unsigned long]
[54] : 0x210f207d [Type: unsigned long]
[55] : 0xf1210fdb [Type: unsigned long]
[56] : 0x89ff210f [Type: unsigned long]
[57] : 0x4d89245d [Type: unsigned long]
[58] : 0x89db3328 [Type: unsigned long]
[59] : 0x230f2c7d [Type: unsigned long]
[60] : 0x3d8b64fb [Type: unsigned long]
[61] : 0x20 [Type: unsigned long]
[62] : 0x2f89f8b [Type: unsigned long]
[63] : 0x8f8b0000 [Type: unsigned long]
[64] : 0x2fc [Type: unsigned long]
[65] : 0xfc3230f [Type: unsigned long]
[66] : 0x9f8bc923 [Type: unsigned long]
[67] : 0x300 [Type: unsigned long]
[68] : 0x3048f8b [Type: unsigned long]
[69] : 0x230f0000 [Type: unsigned long]
[70] : 0xd9230fd3 [Type: unsigned long]
[71] : 0x3089f8b [Type: unsigned long]
[72] : 0x8f8b0000 [Type: unsigned long]
[73] : 0x30c [Type: unsigned long]
[74] : 0xff3230f [Type: unsigned long]
[75] : 0x63e9f923 [Type: unsigned long]
[76] : 0x8bffffff [Type: unsigned long]
[77] : 0x24448bff [Type: unsigned long]
[78] : 0x10b964 [Type: unsigned long]
[79] : 0x8b640000 [Type: unsigned long]
[80] : 0x2015 [Type: unsigned long]
[81] : 0x4528b00 [Type: unsigned long]
[82] : 0xc11c528b [Type: unsigned long]
[83] : 0xd40310e0 [Type: unsigned long]
[84] : 0x64244489 [Type: unsigned long]
[85] : 0x8bd18e66 [Type: unsigned long]
[86] : 0xe9ea8be2 [Type: unsigned long]
[87] : 0xffffff21 [Type: unsigned long]
[88] : 0x84858b90 [Type: unsigned long]
[89] : 0x8b000000 [Type: unsigned long]
[90] : 0x889d [Type: unsigned long]
[91] : 0x7c4d8b00 [Type: unsigned long]
[92] : 0x80958b [Type: unsigned long]
[93] : 0x89660000 [Type: unsigned long]
[94] : 0x89665045 [Type: unsigned long]
[95] : 0x8966305d [Type: unsigned long]
[96] : 0x8966344d [Type: unsigned long]
[97] : 0xb9e93855 [Type: unsigned long]
[98] : 0x6afffffe [Type: unsigned long]
[99] : 0x2ff9e812 [Type: unsigned long]
[...] [Type: unsigned long [106]]
0: kd> dd 0x89d266ec
89d266ec 56535554 54ec8357 4489ec8b 4c894424
89d266fc 54894024 44c73c24 ffff4824 44f7ffff
89d2670c 00007024 850f0002 00000135 247c8366
89d2671c 2374086c 5024648c 38245c8c 3424448c
89d2672c 30246c8c 000030bb 0023b800 8e660000
89d2673c d88e66e3 64c08e66 00001d8b c7640000
89d2674c 00000005 ffffff00 245c89ff 00fc814c
89d2675c 0f000100 0000bc82 2444c700 00000064
0: kd> dd 0x89d266ec+80
89d2676c 0d8b6400 00000124 0341f6fc 2c45c7ff
89d2677c 00000000 5d8b2375 687d8b60 c70c5589
89d2678c 0d000845 5d89badb 047d8900d266b0bf
89d2679c f8efe989498dffff 7045f700 00020000
89d267ac 45f60675 ce74016c 0fc3210f 210fc921
89d267bc 185d89d7 891c4d89 210f207d f1210fdb
89d267cc 89ff210f 4d89245d 89db3328 230f2c7d
89d267dc 3d8b64fb 00000020 02f89f8b 8f8b0000
0: kd> dd 0x89d266ec+80*2
89d267ec 000002fc 0fc3230f 9f8bc923 00000300
89d267fc 03048f8b 230f0000 d9230fd3 03089f8b
89d2680c 8f8b0000 0000030c 0ff3230f 63e9f923
89d2681c 8bffffff 24448bff 0010b964 8b640000
89d2682c 00002015 04528b00 c11c528b d40310e0
89d2683c 64244489 8bd18e66 e9ea8be2 ffffff21
89d2684c 84858b90 8b000000 0000889d 7c4d8b00
89d2685c 0080958b 89660000 89665045 8966305d
0: kd> dd 0x89d266ec+80*3
89d2686c 8966344d b9e93855 6afffffe 2ff9e812
89d2687c cc90fff3 89310fcc 04518901 10ec83c3
89d2688c 0c245c89 08247489 00000000 00000000
89d2689c 00000000 00000000 00000000 00000000
89d268ac 00000000 00000000 00000000 00000000
89d268bc 00000000 00000000 00000000 00000000
89d268cc 00000000 00000000 00000000 00000000
89d268dc 00000000 00000000 00000000 00000000
0: kd> x nt!_KiInterruptTemplate
80b0053b nt!KiInterruptTemplate = unsigned long [106]
80b0053b nt!_KiInterruptTemplate = 0x54 'T'
0: kd> dd 80b0053b
80b0053b 56535554 54ec8357 4489ec8b 4c894424
80b0054b 54894024 44c73c24 ffff4824 44f7ffff
80b0055b 00007024 850f0002 00000135 247c8366
80b0056b 2374086c 5024648c 38245c8c 3424448c
80b0057b 30246c8c 000030bb 0023b800 8e660000
80b0058b d88e66e3 64c08e66 00001d8b c7640000
80b0059b 00000005 ffffff00 245c89ff 00fc814c
80b005ab 0f000100 0000bc82 2444c700 00000064
0: kd> dd 80b0053b+80
80b005bb 0d8b6400 00000124 0341f6fc 2c45c7ff
80b005cb 00000000 5d8b2375 687d8b60 c70c5589
80b005db 0d000845 5d89badb 047d8900000000bf
80b005eb f8efe900498dffff 7045f700 00020000
80b005fb 45f60675 ce74016c 0fc3210f 210fc921
80b0060b 185d89d7 891c4d89 210f207d f1210fdb
80b0061b 89ff210f 4d89245d 89db3328 230f2c7d
80b0062b 3d8b64fb 00000020 02f89f8b 8f8b0000
第二部分：
//
// The following two instructions set the address of current interrupt
// object the the NORMAL dispatching code.
//
pl = (PULONG)((PUCHAR)pl + ((PUCHAR)&KiInterruptTemplateObject -
(PUCHAR)KiInterruptTemplate) -4);
*pl = (ULONG)Interrupt; Interrupt = 0x89d266b0
第三部分：
0: kd> x nt!KiInterruptTemplateObject
80b005ec nt!KiInterruptTemplateObject = 0xfff8efe9
0: kd> x nt!KiInterruptTemplate
80b0053b nt!KiInterruptTemplate = unsigned long [106]
0: kd> ?80b005ec-80b0053b
Evaluate expression: 177 = 000000b1
0: kd> ?80b005ec-80b0053b-4
Evaluate expression: 173 = 000000ad
0: kd> dd 0x89d266ec+ad
89d26799 89d266b0fff8efe9 00498dff 007045f7
89d267a9 75000200 6c45f606 0fce7401 210fc321
89d267b9 d7210fc9 89185d89 7d891c4d db210f20
89d267c9 0ff1210f 5d89ff21 284d8924 7d89db33
89d267d9 fb230f2c 203d8b64 8b000000 0002f89f
89d267e9 fc8f8b00 0f000002 230fc323 009f8bc9
第四部分：验证：
0: kd> u 0x89d266ec
89d266ec 54 push esp
89d266ed 55 push ebp
89d266ee 53 push ebx
89d266ef 56 push esi
89d266f0 57 push edi
89d266f1 83ec54 sub esp,54h
89d266f4 8bec mov ebp,esp
89d266f6 89442444 mov dword ptr [esp+44h],eax
0: kd> u 89d266f6
89d266f6 89442444 mov dword ptr [esp+44h],eax
89d266fa 894c2440 mov dword ptr [esp+40h],ecx
89d266fe 8954243c mov dword ptr [esp+3Ch],edx
89d26702 c7442448ffffffff mov dword ptr [esp+48h],0FFFFFFFFh
89d2670a f744247000000200 test dword ptr [esp+70h],20000h
89d26712 0f8535010000 jne 89d2684d
89d26718 66837c246c08 cmp word ptr [esp+6Ch],8
89d2671e 7423 je 89d26743
0: kd> u 89d2671e
89d2671e 7423 je 89d26743
89d26720 8c642450 mov word ptr [esp+50h],fs
89d26724 8c5c2438 mov word ptr [esp+38h],ds
89d26728 8c442434 mov word ptr [esp+34h],es
89d2672c 8c6c2430 mov word ptr [esp+30h],gs
89d26730 bb30000000 mov ebx,30h
89d26735 b823000000 mov eax,23h
89d2673a 668ee3 mov fs,bx
0: kd> u 89d2673a
89d2673a 668ee3 mov fs,bx
89d2673d 668ed8 mov ds,ax
89d26740 668ec0 mov es,ax
89d26743 648b1d00000000 mov ebx,dword ptr fs:[0]
89d2674a 64c70500000000ffffffff mov dword ptr fs:[0],0FFFFFFFFh
89d26755 895c244c mov dword ptr [esp+4Ch],ebx
89d26759 81fc00000100 cmp esp,10000h
89d2675f 0f82bc000000 jb 89d26821
0: kd> u 89d2675f
89d2675f 0f82bc000000 jb 89d26821
89d26765 c744246400000000 mov dword ptr [esp+64h],0
89d2676d 648b0d24010000 mov ecx,dword ptr fs:[124h]
89d26774 fc cld
89d26775 f64103ff test byte ptr [ecx+3],0FFh
89d26779 c7452c00000000 mov dword ptr [ebp+2Ch],0
89d26780 7523 jne 89d267a5
89d26782 8b5d60 mov ebx,dword ptr [ebp+60h]
0: kd> u 89d26782
89d26782 8b5d60 mov ebx,dword ptr [ebp+60h]
89d26785 8b7d68 mov edi,dword ptr [ebp+68h]
89d26788 89550c mov dword ptr [ebp+0Ch],edx
89d2678b c74508000ddbba mov dword ptr [ebp+8],0BADB0D00h
89d26792 895d00 mov dword ptr [ebp],ebx
89d26795 897d04 mov dword ptr [ebp+4],edi
89d26798 bfb066d289 mov edi,89D266B0h
89d2679d e9eff8ffff jmp 89d26091
第五部分：参考_KiShutUpAssembler代码：
_KiShutUpAssembler proc
public _KiInterruptTemplate
_KiInterruptTemplate label byte
; Save machine state on trap frame
ENTER_INTERRUPT kit_a, kit_t
;
; the following instruction gets the addr of associated interrupt object.
; the value ? will be replaced by REAL interrupt object address at
; interrupt object initialization time.
;mov edi, addr of interrupt object
;
; Template modifications made to support BBT, include replacing bogus
; insructions (created by db and dd) with real instructions.
; This stuff gets overwritten anyway. BBT just needs to see real instructions.
public _KiInterruptTemplate2ndDispatch
_KiInterruptTemplate2ndDispatch equ this dword
mov edi,0
public _KiInterruptTemplateObject
_KiInterruptTemplateObject equ this dword
; the following instruction transfers control to the appropriate dispatcher
; code. The value ? will be replaced by real InterruptObj.DispatchAddr
; at interrupt initialization time. The dispatcher routine will be any one
; of _KiInterruptDispatch, _KiFloatingDispatch, or _KiChainDispatch.
;jmp [IntObj.DispatchAddr]
jmp _KeSynchronizeExecution
public _KiInterruptTemplateDispatch
_KiInterruptTemplateDispatch equ this dword
