实际上我觉得这玩意就是个PE文件的导出表：
kd> u nt!ZwQuerySystemInformation
nt!ZwQuerySystemInformation:
81f82778 b89a000000 mov eax,9Ah
81f8277d 8d542404 lea edx,[esp+4]
81f82781 9c pushfd
81f82782 6a08 push 8
81f82784 e8dc010100 call nt!ExfUnblockPushLock+0x12c5 (81f92965)
81f82789 c21000 ret 10h
nt!ZwQuerySystemEnvironmentValueEx:
81f8278c b89b000000 mov eax,9Bh
81f82791 8d542404 lea edx,[esp+4]
kd> dd KeServiceDescriptorTable
820cf2c0 81f843b8 00000000 000001b9 81f84aa0
820cf2d0 00000000 00000000 00000000 00000000
820cf2e0 a3cd3fff 00000001 ffffffff 81f980f7
820cf2f0 00000000 00000000 00000001 00000000
820cf300 9084246c 01d435c6 00000000 00000000
820cf310 86140d80 82e89000 8603eaf8 00001000
820cf320 00010000 7ffeffff 80000000 83600000
820cf330 7fff0000 8296a000 8602c010 00001c1d
kd> dd 81f843b8
81f843b8 81eac66e 81ec934e 821a0d06 81e99a00
81f843c8 82114dca 82323a50 8218a016 8210e0a0
81f843d8 8223a612 8223a612 81f1b730 821c77e0
81f843e8 8232f409 821c7690 821a1064 822efc5c
81f843f8 82185fd4 8235cf90 8218cb92 821b7e32
81f84408 8218909e 821890c0 81f49620 82193298
81f84418 821767f8 8220a48a 8223a20a 822fe2b4
81f84428 82321564 82375032 81e91fd0 8211c150
kd> u 81eac66e
nt!RtlLookupEntryHashTable+0xbe:
81eac66e 8bff mov edi,edi
81eac670 55 push ebp
81eac671 8bec mov ebp,esp
81eac673 8b4d08 mov ecx,dword ptr [ebp+8]
81eac676 33c0 xor eax,eax
81eac678 50 push eax
81eac679 ff7524 push dword ptr [ebp+24h]
81eac67c 33d2 xor edx,edx
kd> dd 81f84620 //9Ah*4+81f843b8
81f84620 8213d7b0 8220cf4e 823741af 82189160
81f84630 82375be1 82137e46 8213f6c0 821a8a9a
81f84640 822fb5ce 8223ac9e 8218c5c4 822da5fd
81f84650 822da3d9 82182e10 823780a5 821044c2
81f84660 82179f32 821d97a0 822fa322 821e9db6
81f84670 8219ff28 820728d3 81e7d36c 81e7d366
81f84680 8213f970 8210ff80 81e7d360 821bcd60
81f84690 8232388e 8215acac 821c9870 81e7d35a
kd> u 8213d7b0
nt!NtQuerySystemInformation:
8213d7b0 8bff mov edi,edi
8213d7b2 55 push ebp
8213d7b3 8bec mov ebp,esp
8213d7b5 8b4d08 mov ecx,dword ptr [ebp+8]
8213d7b8 83f94a cmp ecx,4Ah
8213d7bb 7c1c jl nt!NtQuerySystemInformation+0x29 (8213d7d9)
8213d7bd 83f953 cmp ecx,53h
8213d7c0 7d17 jge nt!NtQuerySystemInformation+0x29 (8213d7d9)
x64如下：
计算公式如下：
Ssdt为KeServiceDescriptorTable地址，Index为索引值
FunAddr =ssdt+(ssdt+4 * Index)>>4
0: kd> uf nt!zwopenprocess
Flow analysis was incomplete, some code may be missing
nt!ZwOpenProcess:
fffff802`7fd68370 488bc4 mov rax,rsp
fffff802`7fd68373 fa cli
fffff802`7fd68374 4883ec10 sub rsp,10h
fffff802`7fd68378 50 push rax
fffff802`7fd68379 9c pushfq
fffff802`7fd6837a 6a10 push 10h
fffff802`7fd6837c 488d05fd600000 lea rax,[nt!KiServiceLinkage (fffff802`7fd6e480)]
fffff802`7fd68383 50 push rax
fffff802`7fd68384 b826000000 mov eax,26h
fffff802`7fd68389 e9b2d50000 jmp nt!KiServiceInternal (fffff802`7fd75940) Branch
nt!KiServiceInternal:
fffff802`7fd75940 4883ec08 sub rsp,8
fffff802`7fd75944 55 push rbp
fffff802`7fd75945 4881ec58010000 sub rsp,158h
fffff802`7fd7594c 488dac2480000000 lea rbp,[rsp+80h]
fffff802`7fd75954 48899dc0000000 mov qword ptr [rbp+0C0h],rbx
fffff802`7fd7595b 4889bdc8000000 mov qword ptr [rbp+0C8h],rdi
fffff802`7fd75962 4889b5d0000000 mov qword ptr [rbp+0D0h],rsi
fffff802`7fd75969 fb sti
fffff802`7fd7596a 65488b1c2588010000 mov rbx,qword ptr gs:[188h]
fffff802`7fd75973 0f0d8b90000000 prefetchw [rbx+90h]
fffff802`7fd7597a 0fb6bb32020000 movzx edi,byte ptr [rbx+232h]
fffff802`7fd75981 40887da8 mov byte ptr [rbp-58h],dil
fffff802`7fd75985 c6833202000000 mov byte ptr [rbx+232h],0
fffff802`7fd7598c 4c8b9390000000 mov r10,qword ptr [rbx+90h]
fffff802`7fd75993 4c8995b8000000 mov qword ptr [rbp+0B8h],r10
fffff802`7fd7599a 4c8d1d4f010000 lea r11,[nt!KiSystemServiceStart (fffff802`7fd75af0)]
fffff802`7fd759a1 41ffe3 jmp r11
0: kd> dq KeServiceDescriptorTable
fffff802`7ffe0740 fffff802`7ff23020 00000000`00000000
fffff802`7ffe0750 00000000`000001b9 fffff802`7ff23dec
fffff802`7ffe0760 00000000`00000000 00000000`00000000
fffff802`7ffe0770 00000000`00000000 00000000`00000000
fffff802`7ffe0780 00000000`00000000 00000000`00000000
fffff802`7ffe0790 00000000`009c19c2 00007ffe`8dd556f0
fffff802`7ffe07a0 ffffe001`015763f0 ffffe001`01578c60
fffff802`7ffe07b0 00000000`00000000 00000000`00000000
0: kd> dd fffff802`7ff23020+98h //26h*4=98h
fffff802`7ff230b8 0102d600 fdc03501 010bbc06 019ce7c7
fffff802`7ff230c8 0108c240 01a97f01 018e1600 03df8400
fffff802`7ff230d8 022720c5 014d4901 020bfe00 0211b180
fffff802`7ff230e8 01388e02 017a9b42 00f5f900 01d73707
fffff802`7ff230f8 01040800 02118100 03df6e41 0185b146
fffff802`7ff23108 02264f81 021a66c0 01450003 020cf900
fffff802`7ff23118 0208d000 0128e601 0216e140 019f3a02
fffff802`7ff23128 014d02c2 fe48c500 02460600 021eb2c1
0: kd> u fffff802`7ff23020+0102d60 //0102d600>>4=0102d60
nt!NtOpenProcess:
fffff802`80025d80 4883ec38 sub rsp,38h
fffff802`80025d84 65488b042588010000 mov rax,qword ptr gs:[188h]
fffff802`80025d8d 440fb69032020000 movzx r10d,byte ptr [rax+232h]
fffff802`80025d95 4488542428 mov byte ptr [rsp+28h],r10b
fffff802`80025d9a 4488542420 mov byte ptr [rsp+20h],r10b
fffff802`80025d9f e80c000000 call nt!PsOpenProcess (fffff802`80025db0)
fffff802`80025da4 4883c438 add rsp,38h
fffff802`80025da8 c3 ret
测试修改SSDT后是否蓝屏（patch guard作用）：
0: kd> uf nt!ZwQuerySystemInformation
Flow analysis was incomplete, some code may be missing
nt!ZwQuerySystemInformation:
fffff802`c5fdc570 488bc4 mov rax,rsp
fffff802`c5fdc573 fa cli
fffff802`c5fdc574 4883ec10 sub rsp,10h
fffff802`c5fdc578 50 push rax
fffff802`c5fdc579 9c pushfq
fffff802`c5fdc57a 6a10 push 10h
fffff802`c5fdc57c 488d05fd5e0000 lea rax,[nt!KiServiceLinkage (fffff802`c5fe2480)]
fffff802`c5fdc583 50 push rax
fffff802`c5fdc584 b836000000 mov eax,36h
fffff802`c5fdc589 e9b2d30000 jmp nt!KiServiceInternal (fffff802`c5fe9940) Branch
nt!KiServiceInternal:
fffff802`c5fe9940 4883ec08 sub rsp,8
fffff802`c5fe9944 55 push rbp
fffff802`c5fe9945 4881ec58010000 sub rsp,158h
fffff802`c5fe994c 488dac2480000000 lea rbp,[rsp+80h]
fffff802`c5fe9954 48899dc0000000 mov qword ptr [rbp+0C0h],rbx
fffff802`c5fe995b 4889bdc8000000 mov qword ptr [rbp+0C8h],rdi
fffff802`c5fe9962 4889b5d0000000 mov qword ptr [rbp+0D0h],rsi
fffff802`c5fe9969 fb sti
fffff802`c5fe996a 65488b1c2588010000 mov rbx,qword ptr gs:[188h]
fffff802`c5fe9973 0f0d8b90000000 prefetchw [rbx+90h]
fffff802`c5fe997a 0fb6bb32020000 movzx edi,byte ptr [rbx+232h]
fffff802`c5fe9981 40887da8 mov byte ptr [rbp-58h],dil
fffff802`c5fe9985 c6833202000000 mov byte ptr [rbx+232h],0
fffff802`c5fe998c 4c8b9390000000 mov r10,qword ptr [rbx+90h]
fffff802`c5fe9993 4c8995b8000000 mov qword ptr [rbp+0B8h],r10
fffff802`c5fe999a 4c8d1d4f010000 lea r11,[nt!KiSystemServiceStart (fffff802`c5fe9af0)]
fffff802`c5fe99a1 41ffe3 jmp r11
0: kd> dq KeServiceDescriptorTable
fffff802`c6254740 fffff802`c6197020 00000000`00000000
fffff802`c6254750 00000000`000001b9 fffff802`c6197dec
fffff802`c6254760 00000000`00000000 00000000`00000000
fffff802`c6254770 00000000`00000000 00000000`00000000
fffff802`c6254780 00000000`00000000 00000000`00000000
fffff802`c6254790 00000000`009c19c2 00007ffb`8c4c56f0
fffff802`c62547a0 ffffe001`f0574360 ffffe001`f0576b00
fffff802`c62547b0 00000000`00000000 00000000`00000000
0: kd> dd fffff802`c6197020+d8h
fffff802`c61970f8 01040800 02118100 03df6e41 0185b146
fffff802`c6197108 02264f81 021a66c0 01450003 020cf900
fffff802`c6197118 0208d000 0128e601 0216e140 019f3a02
fffff802`c6197128 014d02c2 fe48c500 02460600 021eb2c1
fffff802`c6197138 fd030300 03e74980 0102c301 01d6c501
fffff802`c6197148 01409e03 02247680 01ef4780 02355305
fffff802`c6197158 03aeda84 016b01c0 010ceb01 021fdd81
fffff802`c6197168 012f6580 012e8240 038ee042 017aa207
0: kd> u fffff802`c6197020+0104080
nt!NtQuerySystemInformation:
fffff802`c629b0a0 4883ec38 sub rsp,38h
fffff802`c629b0a4 458bd0 mov r10d,r8d
fffff802`c629b0a7 4c8bda mov r11,rdx
fffff802`c629b0aa 83f94a cmp ecx,4Ah
fffff802`c629b0ad 7c21 jl nt!NtQuerySystemInformation+0x30 (fffff802`c629b0d0)
fffff802`c629b0af 83f953 cmp ecx,53h
fffff802`c629b0b2 7d1c jge nt!NtQuerySystemInformation+0x30 (fffff802`c629b0d0)
fffff802`c629b0b4 33d2 xor edx,edx
0: kd> ed fffff802`c61970f8 02118100
0: kd> dd fffff802`c61970f8
fffff802`c61970f8 02118100 02118100 03df6e41 0185b146
fffff802`c6197108 02264f81 021a66c0 01450003 020cf900
fffff802`c6197118 0208d000 0128e601 0216e140 019f3a02
fffff802`c6197128 014d02c2 fe48c500 02460600 021eb2c1
fffff802`c6197138 fd030300 03e74980 0102c301 01d6c501
fffff802`c6197148 01409e03 02247680 01ef4780 02355305
fffff802`c6197158 03aeda84 016b01c0 010ceb01 021fdd81
fffff802`c6197168 012f6580 012e8240 038ee042 017aa207
0: kd> g开调试可以关patch guard，因为int3会修改内核，如果pg还发挥作用就会蓝屏，没法调试了，所以调试即可关pg。bat代码如下：
Bcdedit /debug ON
Bcdedit /dbgsettings SERIAL DEBUGPORT:1 BAUDRATE:115200 /start AUTOENABLE /noumex 
