inline hook KiFastCallEntry问题

[b571013930]

ULONG display(ULONG ServiceTableBase,ULONG FuncIndex,ULONG OrigFuncAddress)
{
if (ServiceTableBase==(ULONG)KeServiceDescriptorTable.ServiceTableBase)
{//比较当前调用的进程是不是ce
if (!strcmp((char*)PsGetCurrentProcess()+0x174,"cheatengine-i38"))
{
return pNewSSDT->ServiceTableBase[FuncIndex];
}
}
return OrigFuncAddress;
}
__declspec(naked)
void MyKiFastCallEntry()
{
__asm
{
pushad
pushfd
push ebx
push eax
push edi
call display
//再返回前修改堆栈里的数据
mov [esp+0x14],eax
popfd
popad
//恢复以前的代码，以便内核正常运行
sub esp,ecx
shr ecx,2
jmp jmp_ret
}
}
MyKiFastCallEntry是 hook KiFastCallEntry的跳转函数，就是不明白mov [esp+0x14],eax
里的eax
怎么会是对应的ssdt函数地址呢？



这是一段取自KiFastCallEntry的汇编代码：

8053e71c 8b3f mov edi,dword ptr [edi]
8053e71e 8b1c87 mov ebx,dword ptr [edi+eax*4]
8053e721 2be1 sub esp,ecx
8053e723 c1e902 shr ecx,2
8053e726 8bfc mov edi,esp
8053e728 3b35549b5580 cmp esi,dword ptr [nt!MmUserProbeAddress (80559b54)]
8053e72e 0f83a8010000 jae nt!KiSystemCallExit2+0x9f (8053e8dc)
8053e734 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
8053e736 ffd3 call ebx
8053e738 8be5 mov esp,ebp