BATTLE OF SKM AND IUM
blackhat2015
blackhat2015
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
<strong>SKM</strong> STRUCTURES<br />
• <strong>SKM</strong> has a PCR at gs:[0], but with a different structure than NTOS<br />
• CurrentThread is at offset 0x08, CurrentProcess is at offset 0x48<br />
• Hypervisor data is at offset 0x10<br />
• We call this SKPCR<br />
• The CurrentThread is similar to a KTHREAD structure, but again, specific to <strong>SKM</strong><br />
• PreviousMode is at offset 0x30, for example, the TEB at offset 0x68<br />
• We call this SKTHREAD<br />
• CurrentProcess is akin to KPROCESS<br />
• NTOS KTHREAD is at 0x58<br />
• PID at 0x48, PEB at 0xA0, Handle Table at 0xA8, Mailbox Slots at 0xD0, etc…<br />
• We call this SKPROCESS