滥用 Windows KeUserModeCallback 的 Ring-3

#!/usr/bin/env python3
"""
kernel_callback_dump.py
基于 PEB 偏移 0x58 提取并解析 USER32!apfnDispatch 中的所有回调函数指针。
"""

import ctypes
from ctypes import wintypes

# Windows 数据类型定义
ULONG_PTR = wintypes.WPARAM
PVOID = ctypes.c_void_p

# PEB 结构（32位简化版）
classPEB_32(ctypes.Structure):
    _fields_ = [
        ("InheritedAddressSpace",    wintypes.BYTE),
        ("ReadImageFileExecOptions", wintypes.BYTE),
        ("BeingDebugged",            wintypes.BYTE),
        ("SpareBool",                wintypes.BYTE),
        ("Mutant",                   wintypes.HANDLE),
        ("ImageBaseAddress",         PVOID),
        ("Ldr",                      PVOID),
        ("ProcessParameters",        PVOID),
        ("SubSystemData",            PVOID),
        ("ProcessHeap",              PVOID),
        ("FastPebLock",              PVOID),
        ("AtlThunkSListPtr",         PVOID),
        ("IFEOKey",                  PVOID),
        ("CrossProcessFlags",        wintypes.DWORD),
        ("UserSharedInfoPtr",        PVOID),
        ("SystemReserved",           wintypes.DWORD),
        ("AtlThunkSListPtr32",       wintypes.DWORD),
        ("ApiSetMap",                PVOID),
        ("TlsExpansionCounter",      wintypes.DWORD),
        ("TlsBitmap",                PVOID),
        ("TlsBitmapBits",            wintypes.DWORD * 2),
        ("ReadOnlySharedMemoryBase", PVOID),
        ("SharedData",               PVOID),
        ("ReadOnlyStaticServerData", PVOID),
        ("AnsiCodePageData",         PVOID),
        ("OemCodePageData",          PVOID),
        ("UnicodeCaseTableData",     PVOID),
        ("NumberOfProcessors",       wintypes.DWORD),
        ("NtGlobalFlag",             wintypes.DWORD),
        ("CriticalSectionTimeout",   wintypes.LARGE_INTEGER),
        ("HeapSegmentReserve",       ULONG_PTR),
        ("HeapSegmentCommit",        ULONG_PTR),
        ("HeapDeCommitTotalFreeThreshold", ULONG_PTR),
        ("HeapDeCommitFreeBlockThreshold", ULONG_PTR),
        ("NumberOfHeaps",            wintypes.DWORD),
        ("MaximumNumberOfHeaps",     wintypes.DWORD),
        ("ProcessHeaps",             PVOID),
        ("GdiSharedHandleTable",     PVOID),
        ("ProcessStarterHelper",     PVOID),
        ("GdiDCAttributeList",       wintypes.DWORD),
        ("LoaderLock",               PVOID),
        ("OSMajorVersion",           wintypes.DWORD),
        ("OSMinorVersion",           wintypes.DWORD),
        ("OSBuildNumber",            wintypes.WORD),
        ("OSCSDVersion",             wintypes.WORD),
        ("OSPlatformId",             wintypes.DWORD),
        ("ImageSubsystem",           wintypes.DWORD),
        ("ImageSubsystemMajorVersion", wintypes.DWORD),
        ("ImageSubsystemMinorVersion", wintypes.DWORD),
        ("ActiveProcessAffinityMask", ULONG_PTR),
        ("GdiHandleBuffer",          wintypes.DWORD * 34),
        ("PostProcessInitRoutine",   PVOID),
        ("TlsExpansionBitmap",       PVOID),
        ("TlsExpansionBitmapBits",   wintypes.DWORD * 32),
        ("SessionId",                wintypes.DWORD),
        ("AppCompatFlags",           wintypes.ULARGE_INTEGER),
        ("AppCompatFlagsUser",       wintypes.ULARGE_INTEGER),
        ("pShimData",                PVOID),
        ("AppCompatInfo",            PVOID),
        ("CSDVersion",               wintypes.UNICODE_STRING),
        ("ActivationContextData",    PVOID),
        ("ProcessAssemblyStorageMap", PVOID),
        ("SystemDefaultActivationContextData", PVOID),
        ("SystemAssemblyStorageMap", PVOID),
        ("MinimumStackCommit",       ULONG_PTR),
        ("SparePointers",            PVOID * 4),
        ("SpareUlongs",              wintypes.DWORD * 5),
        ("WerRegistrationData",      PVOID),
        ("WerShipAssertPtr",         PVOID),
        ("pUnused",                  PVOID),
        ("pImageHeaderHash",         PVOID),
        ("TracingFlags",             wintypes.DWORD),
        ("CsrServerReadOnlySharedMemoryBase", wintypes.ULONGLONG),
        ("TppWorkerpListLock",       PVOID),
        ("TppWorkerpList",           wintypes.LIST_ENTRY),
        ("WaitOnAddressHashTable",   PVOID * 128),
        ("TelemetryCoverageHeader",  PVOID),
        ("CloudFileFlags",           wintypes.DWORD),
    ]

defget_kernel_callback_table(self):
"""读取 KernelCallbackTable（偏移 0x2C 之后）"""
# 32位 PEB 中 KernelCallbackTable 的偏移需要动态计算
# 此处使用简化方法
        peb_bytes = (ctypes.c_byte * ctypes.sizeof(self)).from_address(
            ctypes.addressof(self))
# KernelCallbackTable 存储为 PEB 中的一个 PVOID 字段
# 在 32位 Windows 10 中，其偏移约为 0x2C（相对于 PEB 起始）
        offset = 0x2C
return ctypes.cast(
            peb_bytes[offset:offset+4],
            ctypes.POINTER(ULONG_PTR)
        ).contents.value


defdump_kernel_callback_table():
"""通过内联汇编读取 fs:[0x18] 获取 TEB，进一步获取 PEB"""
# 在真实利用中通过 fs 段寄存器获取 PEB
# 此处以 PEB 获取逻辑展示回调表解析的核心概念

# 获取 PEB 基址（概念代码 — 实际需通过 __readfsdword 或 NtQueryInformationProcess）
    print("[*] KernelCallbackTable 解析器")
    print("[*] 目标: 32 位 Windows 进程")
    print("=" * 60)

# 模拟回调表条目（实际使用中从 PEB->KernelCallbackTable 读取）
    callback_names = [
"_fnCOPYDATA",
"_fnCOPYGLOBALDATA",
"_fnDWORD",
"_fnNCDESTROY",
"_fnDWORDOPTINLPMSG",
"_fnINOUTDRAG",
"_fnGETTEXTLENGTHS",
"_fnINCNTOUTSTRING",
"_fnINCNTOUTSTRINGNULL",
    ]

    print("\n[+] KernelCallbackTable 布局 (USER32!apfnDispatch):")
    print(f"    {'索引':<6}{'名称':<30}{'描述'}")
    print(f"    {'-'*6}{'-'*30}{'-'*20}")
for i, name in enumerate(callback_names):
        desc = {
"_fnCOPYDATA": "WM_COPYDATA 消息处理",
"_fnCOPYGLOBALDATA": "全局数据拷贝",
"_fnDWORD": "通用 DWORD 消息（含滚动条、按钮）",
"_fnNCDESTROY": "非客户区销毁通知",
"_fnDWORDOPTINLPMSG": "可选的 DWORD 消息",
"_fnINOUTDRAG": "拖放操作",
"_fnGETTEXTLENGTHS": "文本长度查询",
"_fnINCNTOUTSTRING": "字符串输入/输出",
"_fnINCNTOUTSTRINGNULL": "字符串输入/输出（可空）",
        }.get(name, "其他回调")
        print(f"    [{i:<4}] {name:<30}{desc}")


if __name__ == "__main__":
    dump_kernel_callback_table()