Hello,
It looks like there is some confusion on this topic.
Let me provide some details, which will probably clear
up the confusion.
The KeServiceDescriptorTable and
KeServiceDescriptorTableShadow are 4 element array of
structures. The structure defination for each array
element is as follows.
typedef struct ServiceDescriptorEntry {
unsigned int *ServiceTableBase; //SSDT
unsigned int *ServiceCounterTableBase; //Used only in
checked build
unsigned int NumberOfServices;
unsigned char *ParamTableBase; //SSPT
} ServiceDescriptorTableEntry_t
When NTOSKNRL.EXE is loaded, only first element of
this array (KeServiceDescriptorTable and
KeServiceDescriptorTableShadow) in filled and points
to SSDT and SSPT for kernel services (Ntxx functions
from NTOSKRNL.EXE). Rest of the 3 elements in both the
arrays are empty.
When Win32K.sys driver is loaded, it calls a function
called KeAddSystemServiceTable from NTOSKRNL.EXE
passing it the SSDT and SSPT for Win32k.sys services.
This function fills the second element in
KeServiceDescriptorTableShadow array. The
KeServiceDescriptorTable still contains only one
element.
The system call handler (int 2eh) handle is written in
such a way that the, the 12th and 13th (0 based index)
bit of the system service decides the array index
which will be used for dispatching the service through
correponding SSDT. Hence, system services starting
from 0 will end up using SSDT structure pointed by
first array element, system services starting with
0x1000 will end up using SSDT structure pointed by
second array element, serivces starting 0x2000 will
end up in third array element and 0x3000 will end up
in fourth array element.
int 2eh handler while dispatching the service also
subtract the base service id (correponding to the
array index used) from the service id passed in EAX
register and then indexes in SSDT. e.g. even though
win32k.sys services are say from 0x1000 to 0x120A, the
SSDT only contains 0x20A entries. There are no empty
slots in SSDT or SSPT.
Starting IIS 4.0, Microsoft has added a kernel mode
support driver (SPUD.SYS). This driver also calls
KeAddSystemServiceTable function to add its own system
services. This fills an entry in third array element
of KeServiceDescriptorTableShadow. Hence, its services
will start from 0x3000.
In any case, KeServiceDescriptorTable array contains
only 1 element. KeServiceDescriptorTableShadow will
contain at least 2 elements and 3 elements if IIS >=
4.0 is installed.
Now, let us see how KeServiceDescriptorTable and
KeServiceDescriptorTableShadow are used. Every thread
which begins its execution has its TEB pointing to
KeServiceDescriptorTable. When any system call is made
with a service id > 0x1000, system
(PsConvertToGuiThread) allocates a block of memory of
sizeof(KeServiceDescriptorTableShadow), copies
KeServiceDescriptorTableShadow array to this memory
block and changes the TEB to point to this. Note: In
later service packs of NT 4.0 (i don’t recall exact
service pack) and in Windows 2000, this copying is
avoided and only TEB is changed to point to
KeServiceDescriptorTableShadow. Once this is done, int
2eh starts using KeServiceDescriptorTableShadow for
dispatching the system service.
This is the reason, when you add new system services,
it is essential to update both of these tables,
otherwise newly added services are visible only for
console applications and not to GUI applications.
Please let me know if there is still any confusion.
Thanks.
-Prasad
sajeev sas wrote:
> It looks like the shadow table came into existence
> only during Winnt4.0 to accomodate GDI/User calls in
> Kernel. So as long as a thread is not using any GUI
> call it will pt to only the base table and on making
> a
> GUI call it points to the shadow table. IIRC this is
> meant as a optimization, but not sure how.
>
> -Sajeev.
>
>
> — Argus wrote: > I think that
> the “thousands” digit is used to
> > index into an array of
> > tables, so that when it sees 1001 it uses the
> second
> > entry in the second
> > table. (Which is in the win32 range.) I think
> the
> > shadow table is just the
> > one used for win32 processes. So what we end up
> > with is this:
> > >
> > >
> > > —
> > > You are currently subscribed to ntdev as:
> > argus@vt.edu
> > > To unsubscribe send a blank email to
> > leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> >
> >
> > —
> > You are currently subscribed to ntdev as:
> > xxxxx@yahoo.com
> > To unsubscribe send a blank email to
> leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
>
______________________
> For Stock Quotes, Finance News, Insurance, Tax
> Planners, Mutual Funds…
> Visit http://in.finance.yahoo.com/
>
> —
> You are currently subscribed to ntdev as:
> xxxxx@yahoo.com
> To unsubscribe send a blank email to
leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
=====
Prasad S. Dabak
Chief Software Architect
Ensim India Private Limited
http://www.ensim.com
Co-author of the book “Undocumented Windows NT”
ISBN 0764545698
Do You Yahoo!?
Send your FREE holiday greetings online!
http://greetings.yahoo.com
—
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com