《重要》从用户模式切换到内核模式的完整过程分析

野性酷女 2022-08-13 13:48 455阅读 0赞

[Home][] > 《重要》从用户模式切换到内核模式的完整过程分析

# 《重要》从用户模式切换到内核模式的完整过程分析 #

[AloneMonkey][] 2014年7月20日 [0][]

Windows定义了两种访问模式：用户模式和内核模式。应用程序代码运行在用户模式下，操作系统代码运行在内核模式下。

内核模式对应处理器的最高权限级别。在内核模式下执行的代码可以访问所有资源并可以执行所有特权指令。用户模式具有较低的优先级，用户模式只能访问用户空间，且不能执行特权指令。

如果用户代码不慎访问了系统空间的数据或执行了特权指令将会导致保护性异常的发生。但是用户代码可以通过调用系统服务来间接的访问系统空间中的数据或间接执行系统空间中的代码。当调用系统服务时，调用线程会从用户模式切换到内核模式，调用结束后再返回用户代码。这就是所谓的模式切换，也被称为上下文切换。

一、使用 INT 2E 切换到内核模式

2e 号向量号专门被用来做系统调用。在 windbg 中可以输入： !idt 2e 来查看该向量号在 IDT 对应的异常处理函数。如：

[![image][]][image 1]

可以看到 2e 号向量对应的异常处理函数为： nt!KiSystemService。该函数是内核中用以分发系统调用的。

下面我们以调用 ReadFile 为例来展示使用 int2e 指令进行系统调用的步骤：

[![image][image 2]][image_image 2]

因为 ReadFile 是从 Kernel32 导出的，所以我们看到调用首先转到了Kernel32 的 ReadFile 函数。在 ReadFile 中又调用了 ntdll!NtReadFile 函数 ntdll.dll是内核空间和用户控件的桥梁，用户空间的代码通过这个 dll 来调用内核空间的系统服务。它会被加载到所有用户进程的进程空间中，且位于同一位置。

下图为 ntdll !NtReadFile 函数反汇编代码：

[![image][image 3]][image_image 3]

通过反汇编代码可以看到 ntdll!NtReadFile 非常的短，首先将请求的读文件的系统调用的系统服务号 0xa1 放入 eax 寄存器，然后便通过 INT 2e 指令引发系统调用异常。 INT 2e 会导致陷阱异常 。异常发生时，发生异常代码处得 CS 和EIP 寄存器会被压入堆栈，用于在处理完异常后的返回。然后系统会在 IDT 表中查询 2e 号向量对应的异常处理函数，得到 KiSystemService 函数地址。

在调用内核态的 KiSystemService 函数值前， cpu 会做一些模式切换工作。包括权限检查和准备内核态使用的栈空间。 N t!KisystemService ，得到传入的系统调用号，并将传入的参数从用户态复制到内核态，调用系统读取文件的系统调用。执行完毕后， nt!KiSystemService 会将操作结果复制到用户态。弹出 CS 和EIP 将执行权交给 NtReadFile 用以执行 INT 2e 后面的指令。

二、快速系统调用

前面介绍了 Windows 使用 INT 2e 来实现系统调用。但是它是使用中断机制实现的，伴随着中断产生的还有权限检查和查询 IDT 表等操作，这会导致额外的开销。因此在最新版本的 Windows 中，微软采用了被称为快速系统调用的机制。这主要是得益于 Intel 从奔腾 2 开始在处理器新加的三个特殊的 MSR 寄存器以及sysenter 和 sysexit 指令。

现在我们通过Windows API OpenProcess的调用过程，来看看Windows 7中快速系统调用过程：

前面的部分还是一样的：因为OpenProcess是从Kernel32导出的，所以调用首先转到了Kernel32的OpenProcess函数。在OpenProcess中又调用了ntdll!NtOpenProcess函数。

我们再来看看ntdll!NtOpenProcess的反汇编代码。

[![image][image 4]][image_image 4]

eax中保存系统调用号，此处NtOpenProcess的为BEh；edx是SharedUserData!SystemCallStub的地址，里面保存着KiFastSystemCall的地址。SharedUserData总是存放在0x7ffe0000处，其偏移0×300处正是SystemCall。

[![image][image 5]][image_image 5]

我们来看看0x7ffe0300处到底是不是SystemCall。

[![image][image 6]][image_image 6]

好了，我们看到了sysenter！！！

Sysenter时eax中保存着系统调用号，edx中保存着用户空间线程栈栈顶地址即保存着NtOpenProcess中call KiFastSystemCall的返回地址。

与指令对INT/IRET不同，快速系统调用指令对SYSENTER/SYSEXIT不具有调用、返回关系，因为指令SYSENTER并不会为指令SYSEXIT保存任何返回信息，不指示SYSEXIT返回到何处继续执行，也就是说指令SYSEXIT并不一定返回到指令SYSENTER后的下一个条指令继续执行。这两条指令所需的相关信息由处理器内部的一组相关的寄存器（MSR）提供，这些寄存器的名称及用途如下。

MSR\_IA32\_SYSENTER\_CS：保存了系统调用处理过程所使用的内核态代码段的段选择子，用于在通过指令SYSENTER进入内核态时，设置代码段段选择子寄存器cs。同时，紧随在该寄存器所指示段描述符后面的三个段描述符被依次认为是内核数据段、用户代码段、用户数据段的段描述符（这些段描述符保存在全局描述符表GDT中，有先后次序）。快速系统调用指令SYSENTER/SYSEXIT依赖这些次序来完成内核态、用户态执行环境的设置工作。

MSR\_IA32\_SYSENTER\_EIP：保存了系统调用处理过程的入口地址，用于在通过指令SYSENTER进入内核态时，设置指令指针寄存器eip。

MSR\_IA32\_SYSENTER\_ESP：保存了系统调用处理过程所使用内核态的栈指针信息，用于在通过指令SYSENTER进入内核态时，设置内核态栈的栈指针寄存器esp。

1．请求快速系统调用处理过程

在用户态的代码执行了SYSENTER指令之后，处理器中的控制单元将会完成以下操作，然后进入内核态进行系统调用的处理。

（1）将寄存器MSR\_IA32\_SYSENTER\_CS所指示的段描述符装载到代码段段选择子寄存器cs中。

（2）将寄存器MSR\_IA32\_SYSENTER\_EIP的值装载到指令指针寄存器eip中。

（3）将寄存器MSR\_IA32\_SYSENTER\_CS的值加8作为一个段选择子，然后将该段选择子对应的段描述符装载到栈基址寄存器ss中。

（4）将寄存器MSR\_IA32\_SYSENTER\_ESP的值装载到栈指针寄存器esp中。

2．快速系统调用返回处理过程

在内核态对系统调用服务完毕之后，执行指令SYSEXIT完成系统调用的返回过程。在该过程中处理器的控制单元完成以下处理，设置用户态的执行环境。

（1）将寄存器MSR\_IA32\_SYSENTER\_CS的值加16作为一个段选择子，然后将该段选择子对应的段描述符装载到代码段段选择子寄存器cs中。

（2）将寄存器edx的值装载到指令指针寄存器eip中。

（3）将寄存器MSR\_IA32\_SYSENTER\_CS的值加24作为一个段选择子，然后将该段选择子对应的段描述符装载到栈段段选择子寄存器ss中。

（4）将寄存器ecx的值装载到栈指针寄存器esp中。

由上面的分析可知，在使用指令SYSENTER请求快速系统调用之前，需要初始化好相关的型号相关寄存器；在使用指令SYSEXIT进行快速系统调用返回之前，还要保证寄存器ecx、 edx的正确性，以便能正确地返回到用户态继续运行。

在内核的初始化过程中，函数enable\_sep\_cpu()负责完成这组寄存器的初始化：

WRMSR可以设置上面说的MSR寄存器,对应关系如下：  
SYSENTER\_CS\_MSR 174H

SYSENTER\_ESP\_MSR 175H

SYSENTER\_EIP\_MSR 176H

我们来看看MSR寄存器相应位置保存的什么：

[![image][image 7]][image_image 7]

sysenter切换堆栈时是从用户栈切换到DPC栈，这是因为MSR寄存器中的值是操作系统安排好的固定的值，它与具体的线程上下文无关，所以需要在DPC栈中再切换到线程的内核栈。

<table style="margin:0px 0px 1.5rem; padding:0px; vertical-align:baseline; outline:0px; font-size:13px; background-color:transparent; border:0px; border-collapse:collapse; border-spacing:0px; width:1308px; line-height:1.4em"> 
 <tbody style="margin:0px; padding:0px; vertical-align:baseline; outline:0px; background-color:transparent; border:0px; line-height:1.4em"> 
 <tr style="margin:0px; padding:0px; vertical-align:baseline; outline:0px; background-color:transparent; border:0px; line-height:1.4em"> 
 <td style="margin:0px; padding:5px; vertical-align:baseline; outline:0px; font-size:13px; background-color:rgb(238,238,238); border-width:0px 1px 0px 0px; border-right-style:solid; border-right-color:rgb(159,159,159); text-align:right; color:rgb(136,136,136); line-height:1.4em; font-family:Monaco,'Lucida Console',monospace"> 
 <div style="margin:0px; padding:0px; vertical-align:baseline; outline:0px; background-color:transparent; border:0px; line-height:1.4em; width:23px">
 1 
 2 
 3 
 4 
 5 
 6 
 7 
 8 
 9 
 10 
 11 
 12 
 13 
 14 
 15 
 16 
 17 
 18 
 19 
 20 
 21 
 22 
 23 
 24 
 25 
 26 
 27 
 28 
 29 
 30 
 31 
 32 
 33 
 34 
 35 
 36 
 37 
 38 
 39 
 40 
 41 
 42 
 43 
 44 
 45 
 46 
 47 
 48 
 49 
 50 
 51 
 52 
 53 
 54 
 55 
 56 
 57 
 58 
 59 
 60 
 61 
 62 
 63 
 64 
 65 
 66 
 67 
 68 
 69 
 70 
 71 
 72 
 73 
 74 
 75 
 76 
 77 
 78 
 79 
 80 
 81 
 82 
 83 
 84 
 85 
 86 
 87 
 88 
 89 
 90 
 91 
 92 
 93 
 94 
 95 
 96 
 97 
 98 
 99 
 100 
 101 
 102 
 103 
 104 
 105 
 106 
 107 
 108 
 109 
 110 
 111 
 112 
 113 
 114 
 115 
 116 
 117 
 118 
 119 
 120 
 121 
 122 
 123 
 124 
 125 
 126 
 127 
 128 
 129 
 130 
 131 
 132 
 133 
 134 
 
 </div> </td> 
 <td style="margin:0px; padding:0px; vertical-align:baseline; outline:0px; font-size:13px; background-color:rgb(252,252,252); border:0px; color:rgb(133,133,133); line-height:1.4em; font-family:Monaco,'Lucida Console',monospace"> 
 <div style="margin:0px; padding:5px; vertical-align:baseline; outline:0px; background-color:rgb(241,241,241); border:0px; line-height:1.4em; color:rgb(0,0,0)">
 kd 
 &gt;&nbsp;u KiFastCallEntry l&nbsp; 
 80 
 nt 
 !KiFastCallEntry 
 : 
 8288a300 b923000000 &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; ecx 
 ,23h &nbsp;&nbsp; 
 ;&nbsp;KGDT_R3_DATA&nbsp; 
 0x23&nbsp; 
 =&nbsp; 
 0x20&nbsp; 
 +&nbsp;011b 
 (CPL Ring3 
 ) 
 8288a305 6a30 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;push &nbsp; &nbsp;30h &nbsp; &nbsp; 
 ;&nbsp;KGDT_R0_PCR &nbsp; 
 0x30&nbsp; 
 =&nbsp; 
 0x30&nbsp; 
 +&nbsp;000b 
 (CPL Ring0 
 ) 
 ,&nbsp;DPC Stack 
 8288a307 0fa1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;pop &nbsp; &nbsp; fs &nbsp; &nbsp;&nbsp; 
 ;&nbsp;DPC Stack 
 8288a309 8ed9 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; ds 
 ,cx 
 8288a30b 8ec1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; es 
 ,cx 
 8288a30d 648b0d40000000 &nbsp;mov &nbsp; &nbsp; ecx 
 ,dword ptr fs 
 : 
 [40h 
 ]&nbsp;&nbsp; 
 ;fs Base 
 :ffdff000 Limit 
 :1fff Data RW 
 ,&nbsp;KPCR&nbsp; 
 0x40处为TSS Ptr32 _KTSS 
 8288a314 8b6104 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; esp 
 ,dword ptr&nbsp; 
 [ecx 
 + 
 4 
 ]&nbsp;&nbsp;&nbsp; 
 ;&nbsp;KTSS&nbsp; 
 0x4处为Esp0 Uint4B 
 ,&nbsp;Ring0下的esp 
 8288a317 6a23 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;push &nbsp; &nbsp;23h &nbsp; &nbsp;&nbsp; 
 ;&nbsp;此时已在内核堆栈 
 ,&nbsp;Ring3下的ss 
 ,&nbsp;KTRAP_FRAME. 
 HardwareSegSs 
 8288a319&nbsp; 
 52&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;push &nbsp; &nbsp;edx &nbsp; &nbsp;&nbsp; 
 ;&nbsp;Ring3下的esp 
 ,&nbsp;KTRAP_FRAME. 
 HardwareEsp 
 8288a31a 9c &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;pushfd &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
 ;&nbsp;eflags &nbsp; 
 ;&nbsp;KTRAP_FRAME. 
 EFlags 
 8288a31b 6a02 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;push &nbsp; &nbsp; 
 2 
 8288a31d 83c208 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;add &nbsp; &nbsp; edx 
 , 
 8&nbsp;&nbsp;&nbsp; 
 ;&nbsp;Ring3堆栈的参数 
 8288a320 9d &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;popfd &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; 
 ;&nbsp;初始eflags为 
 2 
 ,&nbsp;即各位清零 
 8288a321 804c240102 &nbsp; &nbsp; &nbsp;or &nbsp; &nbsp; &nbsp;byte ptr&nbsp; 
 [esp 
 + 
 1 
 ] 
 , 
 2&nbsp;&nbsp; &nbsp;&nbsp; 
 ;&nbsp; 
 4字节eflags第二个字节的IF中断允许位置 
 1 
 8288a326 6a1b &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;push &nbsp; &nbsp;1Bh &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
 ;&nbsp;KGDT_R3_CODE&nbsp; 
 0x1B&nbsp; 
 =&nbsp; 
 0x18&nbsp; 
 +&nbsp;011b 
 (CPL Ring3 
 ) 
 ,&nbsp;KTRAP_FRAME. 
 SegCs 
 8288a328 ff350403dfff &nbsp; &nbsp;push &nbsp; &nbsp;dword ptr ds 
 : 
 [0FFDF0304h 
 ]&nbsp;&nbsp;&nbsp; 
 ;&nbsp;KTRAP_FRAME. 
 EIP 
 ,&nbsp; 
 0x7ffe0000与 
 0xffdf000映射到同一块物理内存 
 ,&nbsp; 
 0xffdf0304处存放的是KiFastSystemCallRet 
 8288a32e 6a00 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;push &nbsp; &nbsp; 
 0&nbsp;&nbsp; &nbsp; 
 ;&nbsp;KTRAP_FRAME. 
 ErrCode 
 
 ;&nbsp;以下四个寄存器从Ring3到Ring0没修改过 
 ,&nbsp;直接保存 
 8288a330&nbsp; 
 55&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;push &nbsp; &nbsp;ebp 
 8288a331&nbsp; 
 53&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;push &nbsp; &nbsp;ebx 
 8288a332&nbsp; 
 56&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;push &nbsp; &nbsp;esi 
 8288a333&nbsp; 
 57&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;push &nbsp; &nbsp;edi 
 8288a334 648b1d1c000000 &nbsp;mov &nbsp; &nbsp; ebx 
 ,dword ptr fs 
 : 
 [1Ch 
 ]&nbsp;&nbsp; &nbsp;&nbsp; 
 ;&nbsp;指向自己的指针 
 ,&nbsp;头部即是TIB 
 8288a33b 6a3b &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;push &nbsp; &nbsp;3Bh &nbsp; &nbsp; &nbsp; &nbsp; 
 ;&nbsp;KTRAP_FRAME. 
 SegFs 
 ,&nbsp;fs Base 
 : 
 00000000&nbsp;Limit 
 :fff Data RW 
 ,&nbsp;Ring3 
 8288a33d 8bb324010000 &nbsp; &nbsp;mov &nbsp; &nbsp; esi 
 ,dword ptr&nbsp; 
 [ebx 
 +124h 
 ]&nbsp;&nbsp; &nbsp;&nbsp; 
 ;&nbsp;KPCR. 
 SelfPcr 
 -&gt;PrcbData. 
 CurrentThead&nbsp;Ptr32 _KTHREAD 
 8288a343 ff33 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;push &nbsp; &nbsp;dword ptr&nbsp; 
 [ebx 
 ]&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp; 
 ;&nbsp;KTRAP_FRAME. 
 ExceptionList 
 ,&nbsp;TIB的头部即是ExceptionList 
 8288a345 c703ffffffff &nbsp; &nbsp;mov &nbsp; &nbsp; dword ptr&nbsp; 
 [ebx 
 ] 
 ,0FFFFFFFFh 
 8288a34b 8b6e28 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; ebp 
 ,dword ptr&nbsp; 
 [esi 
 +28h 
 ]&nbsp;&nbsp; &nbsp;&nbsp; 
 ;&nbsp;KTHREAD. 
 InitialStack&nbsp;Ptr32 Void 
 8288a34e 6a01 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;push &nbsp; &nbsp; 
 1&nbsp;&nbsp; &nbsp; &nbsp;&nbsp; 
 ;&nbsp;KTRAP_FRAME. 
 PreviousPreviousMode 
 8288a350 83ec48 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;sub &nbsp; &nbsp; esp 
 ,48h &nbsp; &nbsp;&nbsp; 
 ;&nbsp;预留KTRAP_FRAME中Eax到DbgEbp的空间 
 8288a353 81ed9c020000 &nbsp; &nbsp;sub &nbsp; &nbsp; ebp 
 ,29Ch 
 8288a359 c6863a01000001 &nbsp;mov &nbsp; &nbsp; byte ptr&nbsp; 
 [esi 
 +13Ah 
 ] 
 , 
 1&nbsp;&nbsp; &nbsp; 
 ;&nbsp;KTHREAD. 
 PreviousMode 
 8288a360 3bec &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;cmp &nbsp; &nbsp; ebp 
 ,esp 
 8288a362&nbsp; 
 7597&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;jne &nbsp; &nbsp; nt 
 !KiFastCallEntry2 
 + 
 0x49&nbsp; 
 (8288a2fb 
 ) 
 8288a364 83652c00 &nbsp; &nbsp; &nbsp; &nbsp;and &nbsp; &nbsp; dword ptr&nbsp; 
 [ebp 
 +2Ch 
 ] 
 , 
 0&nbsp;&nbsp;&nbsp; 
 ;&nbsp;KTRAP_FRAME第 
 12个 
 ( 
 0x2C 
 / 
 4 
 + 
 1 
 )参数Dr7 
 8288a368 f64603df &nbsp; &nbsp; &nbsp; &nbsp;test &nbsp; &nbsp;byte ptr&nbsp; 
 [esi 
 + 
 3 
 ] 
 ,0DFh &nbsp; &nbsp; 
 ;&nbsp;KTHREAD. 
 DebugActive 
 8288a36c 89ae28010000 &nbsp; &nbsp;mov &nbsp; &nbsp; dword ptr&nbsp; 
 [esi 
 +128h 
 ] 
 ,ebp &nbsp; &nbsp; 
 ;&nbsp;KTHREAD. 
 TrapFrame&nbsp;Ptr32 _KTRAP_FRAME 
 8288a372 0f8538feffff &nbsp; &nbsp;jne &nbsp; &nbsp; nt 
 !Dr_FastCallDrSave&nbsp; 
 (8288a1b0 
 )&nbsp;&nbsp;&nbsp; 
 ;&nbsp; 
 if 
 (KTHREAD. 
 DebugActive&nbsp; 
 !=&nbsp; 
 0 
 )&nbsp;... 
 8288a378 8b5d60 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; ebx 
 ,dword ptr&nbsp; 
 [ebp 
 +60h 
 ] 
 8288a37b 8b7d68 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; edi 
 ,dword ptr&nbsp; 
 [ebp 
 +68h 
 ] 
 8288a37e 89550c &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; dword ptr&nbsp; 
 [ebp 
 +0Ch 
 ] 
 ,edx &nbsp; &nbsp;&nbsp; 
 ;&nbsp;将Ring3参数地址赋给KTRAP_FRAME. 
 DbgArgPointer 
 8288a381 c74508000ddbba &nbsp;mov &nbsp; &nbsp; dword ptr&nbsp; 
 [ebp 
 + 
 8 
 ] 
 ,0BADB0D00h &nbsp;&nbsp; 
 ;&nbsp;KTRAP_FRAME. 
 DbgArgMark&nbsp; 
 =&nbsp; 
 0xBADB0D00 
 8288a388 895d00 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; dword ptr&nbsp; 
 [ebp 
 ] 
 ,ebx &nbsp; &nbsp; &nbsp; 
 ;&nbsp;KTRAP_FRAME. 
 DbgEbp&nbsp; 
 =&nbsp;KTRAP_FRAME. 
 Ebp 
 8288a38b 897d04 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; dword ptr&nbsp; 
 [ebp 
 + 
 4 
 ] 
 ,edi &nbsp; &nbsp; 
 ;&nbsp;KTRAP_FRAME. 
 DbgEip&nbsp; 
 =&nbsp;KTRAP_FRAME. 
 Eip 
 8288a38e fb &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;sti 
 
 ;&nbsp;当调用KeServiceDescriptorTableShadow中的系统服务时 
 ,&nbsp;eax是系统调用号再加 
 0x1000 
 8288a38f 8bf8 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; edi 
 ,eax 
 8288a391 c1ef08 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;shr &nbsp; &nbsp; edi 
 , 
 8 
 8288a394&nbsp; 
 83e710&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;and &nbsp; &nbsp; edi 
 ,10h 
 8288a397 8bcf &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; ecx 
 ,edi 
 
 ;&nbsp;经过以上 
 4条指令后 
 ,&nbsp;若ecx为 
 0则为调用KeServiceDescriptorTable中的系统服务 
 ,&nbsp;否则ecx为 
 0x10调用KeServiceDescriptorTableShadow中的系统服务 
 8288a399 03bebc000000 &nbsp; &nbsp;add &nbsp; &nbsp; edi 
 ,dword ptr&nbsp; 
 [esi 
 +0BCh 
 ]&nbsp;&nbsp; &nbsp;&nbsp; 
 ;&nbsp;edi&nbsp; 
 =&nbsp;KTHREAD. 
 ServiceTable&nbsp; 
 +&nbsp; 
 0x00或 
 0x10 
 8288a39f 8bd8 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; ebx 
 ,eax 
 8288a3a1 25ff0f0000 &nbsp; &nbsp; &nbsp;and &nbsp; &nbsp; eax 
 ,0FFFh &nbsp;&nbsp; 
 ;&nbsp;系统调用号 
 8288a3a6 3b4708 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;cmp &nbsp; &nbsp; eax 
 ,dword ptr&nbsp; 
 [edi 
 + 
 8 
 ]&nbsp;&nbsp; &nbsp; 
 ;&nbsp;系统调用号必须小于系统服务数 
 8288a3a9 0f8333fdffff &nbsp; &nbsp;jae &nbsp; &nbsp; nt 
 !KiBBTUnexpectedRange&nbsp; 
 (8288a0e2 
 ) 
 8288a3af 83f910 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;cmp &nbsp; &nbsp; ecx 
 ,10h 
 8288a3b2 751a &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;jne &nbsp; &nbsp; nt 
 !KiFastCallEntry 
 + 
 0xce&nbsp; 
 (8288a3ce 
 )&nbsp;&nbsp;&nbsp; 
 ;&nbsp;KeServiceDescriptorTable 
 8288a3b4 8b8e88000000 &nbsp; &nbsp;mov &nbsp; &nbsp; ecx 
 ,dword ptr&nbsp; 
 [esi 
 +88h 
 ] 
 8288a3ba 33f6 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;xor &nbsp; &nbsp; esi 
 ,esi 
 8288a3bc 0bb1700f0000 &nbsp; &nbsp;or &nbsp; &nbsp; &nbsp;esi 
 ,dword ptr&nbsp; 
 [ecx 
 +0F70h 
 ]&nbsp;&nbsp; &nbsp; 
 ;&nbsp;TEB. 
 GdiBatchCount 
 8288a3c2 740a &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;je &nbsp; &nbsp; &nbsp;nt 
 !KiFastCallEntry 
 + 
 0xce&nbsp; 
 (8288a3ce 
 )&nbsp;&nbsp; &nbsp; 
 ;&nbsp;KeServiceDescriptorTable 
 8288a3c4&nbsp; 
 52&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;push &nbsp; &nbsp;edx &nbsp; &nbsp; 
 ;&nbsp;Ring3参数地址 
 8288a3c5&nbsp; 
 50&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;push &nbsp; &nbsp;eax &nbsp; &nbsp; 
 ;&nbsp;系统调用号 
 8288a3c6 ff154cf99a82 &nbsp; &nbsp;call &nbsp; &nbsp;dword ptr&nbsp; 
 [nt 
 !KeGdiFlushUserBatch&nbsp; 
 (829af94c 
 ) 
 ] 
 8288a3cc&nbsp; 
 58&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;pop &nbsp; &nbsp; eax 
 8288a3cd 5a &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;pop &nbsp; &nbsp; edx 
 8288a3ce 64ff05b0060000 &nbsp;inc &nbsp; &nbsp; dword ptr fs 
 : 
 [6B0h 
 ]&nbsp;&nbsp; &nbsp; 
 ;&nbsp;KeServiceDescriptorTable直接跳转到这来 
 ,&nbsp; 
 ++KPCR. 
 KPRCB. 
 KeSystemCalls 
 8288a3d5 8bf2 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; esi 
 ,edx 
 8288a3d7 33c9 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;xor &nbsp; &nbsp; ecx 
 ,ecx 
 8288a3d9 8b570c &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; edx 
 ,dword ptr&nbsp; 
 [edi 
 +0Ch 
 ]&nbsp;&nbsp;&nbsp; 
 ;&nbsp;SSDT参数表的地址 
 8288a3dc 8b3f &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; edi 
 ,dword ptr&nbsp; 
 [edi 
 ]&nbsp;&nbsp;&nbsp; 
 ;&nbsp;系统服务表地址 
 8288a3de 8a0c10 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; cl 
 ,byte ptr&nbsp; 
 [eax 
 +edx 
 ]&nbsp;&nbsp; &nbsp; 
 ;&nbsp;该系统调用的参数个数 
 8288a3e1 8b1487 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; edx 
 ,dword ptr&nbsp; 
 [edi 
 +eax 
 * 
 4 
 ]&nbsp;&nbsp;&nbsp; 
 ;&nbsp;该系统服务地址 
 8288a3e4 2be1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;sub &nbsp; &nbsp; esp 
 ,ecx &nbsp;&nbsp; 
 ;&nbsp;在内核栈中分配参数空间 
 8288a3e6 c1e902 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;shr &nbsp; &nbsp; ecx 
 , 
 2&nbsp;&nbsp;&nbsp; 
 ;&nbsp;参数以DWORD大小拷贝 
 8288a3e9 8bfc &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; edi 
 ,esp 
 8288a3eb 3b351cf79a82 &nbsp; &nbsp;cmp &nbsp; &nbsp; esi 
 ,dword ptr&nbsp; 
 [nt 
 !MmUserProbeAddress&nbsp; 
 (829af71c 
 ) 
 ] 
 8288a3f1 0f832e020000 &nbsp; &nbsp;jae &nbsp; &nbsp; nt 
 !KiSystemCallExit2 
 + 
 0xa5&nbsp; 
 (8288a625 
 )&nbsp;&nbsp; &nbsp; 
 ;&nbsp;若参数地址超过用户空间地址 
 ( 
 0x7fff0000 
 ) 
 8288a3f7 f3a5 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;rep movs dword ptr es 
 : 
 [edi 
 ] 
 ,dword ptr&nbsp; 
 [esi 
 ] 
 8288a3f9 f6456c01 &nbsp; &nbsp; &nbsp; &nbsp;test &nbsp; &nbsp;byte ptr&nbsp; 
 [ebp 
 +6Ch 
 ] 
 , 
 1 
 8288a3fd&nbsp; 
 7416&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;je &nbsp; &nbsp; &nbsp;nt 
 !KiFastCallEntry 
 + 
 0x115&nbsp; 
 (8288a415 
 ) 
 8288a3ff 648b0d24010000 &nbsp;mov &nbsp; &nbsp; ecx 
 ,dword ptr fs 
 : 
 [124h 
 ] 
 8288a406 8b3c24 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; edi 
 ,dword ptr&nbsp; 
 [esp 
 ] 
 8288a409 89993c010000 &nbsp; &nbsp;mov &nbsp; &nbsp; dword ptr&nbsp; 
 [ecx 
 +13Ch 
 ] 
 ,ebx 
 8288a40f 89b92c010000 &nbsp; &nbsp;mov &nbsp; &nbsp; dword ptr&nbsp; 
 [ecx 
 +12Ch 
 ] 
 ,edi 
 8288a415 8bda &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; ebx 
 ,edx 
 8288a417 f60588c8978240 &nbsp;test &nbsp; &nbsp;byte ptr&nbsp; 
 [nt 
 !PerfGlobalGroupMask 
 + 
 0x8&nbsp; 
 (8297c888 
 ) 
 ] 
 ,40h 
 8288a41e 0f954512 &nbsp; &nbsp; &nbsp; &nbsp;setne &nbsp; byte ptr&nbsp; 
 [ebp 
 +12h 
 ] 
 8288a422 0f858c030000 &nbsp; &nbsp;jne &nbsp; &nbsp; nt 
 !KiServiceExit2 
 + 
 0x17b&nbsp; 
 (8288a7b4 
 ) 
 8288a428 ffd3 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;call &nbsp; &nbsp;ebx &nbsp; &nbsp; &nbsp;&nbsp; 
 ;&nbsp;调用 
 ! 
 8288a42a f6456c01 &nbsp; &nbsp; &nbsp; &nbsp;test &nbsp; &nbsp;byte ptr&nbsp; 
 [ebp 
 +6Ch 
 ] 
 , 
 1 
 8288a42e&nbsp; 
 7434&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;je &nbsp; &nbsp; &nbsp;nt 
 !KiFastCallEntry 
 + 
 0x164&nbsp; 
 (8288a464 
 ) 
 8288a430 8bf0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; esi 
 ,eax 
 8288a432 ff1568818482 &nbsp; &nbsp;call &nbsp; &nbsp;dword ptr&nbsp; 
 [nt 
 !_imp__KeGetCurrentIrql&nbsp; 
 ( 
 82848168 
 ) 
 ] 
 8288a438 0ac0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;or &nbsp; &nbsp; &nbsp;al 
 ,al 
 8288a43a 0f853b030000 &nbsp; &nbsp;jne &nbsp; &nbsp; nt 
 !KiServiceExit2 
 + 
 0x142&nbsp; 
 (8288a77b 
 ) 
 8288a440 8bc6 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; eax 
 ,esi 
 8288a442 648b0d24010000 &nbsp;mov &nbsp; &nbsp; ecx 
 ,dword ptr fs 
 : 
 [124h 
 ] 
 8288a449 f68134010000ff &nbsp;test &nbsp; &nbsp;byte ptr&nbsp; 
 [ecx 
 +134h 
 ] 
 ,0FFh 
 8288a450 0f8543030000 &nbsp; &nbsp;jne &nbsp; &nbsp; nt 
 !KiServiceExit2 
 + 
 0x160&nbsp; 
 (8288a799 
 ) 
 8288a456 8b9184000000 &nbsp; &nbsp;mov &nbsp; &nbsp; edx 
 ,dword ptr&nbsp; 
 [ecx 
 +84h 
 ] 
 8288a45c 0bd2 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;or &nbsp; &nbsp; &nbsp;edx 
 ,edx 
 8288a45e 0f8535030000 &nbsp; &nbsp;jne &nbsp; &nbsp; nt 
 !KiServiceExit2 
 + 
 0x160&nbsp; 
 (8288a799 
 ) 
 8288a464 8be5 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; esp 
 ,ebp 
 8288a466 807d1200 &nbsp; &nbsp; &nbsp; &nbsp;cmp &nbsp; &nbsp; byte ptr&nbsp; 
 [ebp 
 +12h 
 ] 
 , 
 0 
 8288a46a 0f8550030000 &nbsp; &nbsp;jne &nbsp; &nbsp; nt 
 !KiServiceExit2 
 + 
 0x187&nbsp; 
 (8288a7c0 
 ) 
 8288a470 648b0d24010000 &nbsp;mov &nbsp; &nbsp; ecx 
 ,dword ptr fs 
 : 
 [124h 
 ] 
 8288a477 8b553c &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; edx 
 ,dword ptr&nbsp; 
 [ebp 
 +3Ch 
 ] 
 8288a47a&nbsp; 
 899128010000&nbsp;&nbsp; &nbsp;mov &nbsp; &nbsp; dword ptr&nbsp; 
 [ecx 
 +128h 
 ] 
 ,edx 
 nt 
 !KiServiceExit 
 : 
 8288a480 fa &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;cli 
 8288a481 f6457202 &nbsp; &nbsp; &nbsp; &nbsp;test &nbsp; &nbsp;byte ptr&nbsp; 
 [ebp 
 +72h 
 ] 
 , 
 2&nbsp;&nbsp; &nbsp; &nbsp;&nbsp; 
 ;&nbsp;eflags是否是Virtual 
 - 
 8086&nbsp;Mode 
 8288a485&nbsp; 
 7506&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;jne &nbsp; &nbsp; nt 
 !KiServiceExit 
 + 
 0xd&nbsp; 
 (8288a48d 
 )&nbsp;&nbsp; &nbsp;&nbsp; 
 ;&nbsp;非Virtual 
 - 
 8086&nbsp;Mode则跳 
 8288a487 f6456c01 &nbsp; &nbsp; &nbsp; &nbsp;test &nbsp; &nbsp;byte ptr&nbsp; 
 [ebp 
 +6Ch 
 ] 
 , 
 1 
 8288a48b&nbsp; 
 7467&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;je &nbsp; &nbsp; &nbsp;nt 
 !KiServiceExit 
 + 
 0x74&nbsp; 
 (8288a4f4 
 )&nbsp;&nbsp; &nbsp; &nbsp; 
 ;&nbsp;KTRAP_FRAME. 
 SegCs 
 ,&nbsp;CPL为Ring0则跳 
 8288a48d 648b1d24010000 &nbsp;mov &nbsp; &nbsp; ebx 
 ,dword ptr fs 
 : 
 [124h 
 ]&nbsp;&nbsp;&nbsp; 
 ;&nbsp;非Virtual 
 - 
 8086&nbsp;Mode 
 ,&nbsp;以及下面的交付APC 
 ,&nbsp;跳到这来 
 8288a494 f6430202 &nbsp; &nbsp; &nbsp; &nbsp;test &nbsp; &nbsp;byte ptr&nbsp; 
 [ebx 
 + 
 2 
 ] 
 , 
 2 
 8288a498&nbsp; 
 7408&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;je &nbsp; &nbsp; &nbsp;nt 
 !KiServiceExit 
 + 
 0x22&nbsp; 
 (8288a4a2 
 ) 
 8288a49a&nbsp; 
 50&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;push &nbsp; &nbsp;eax 
 8288a49b&nbsp; 
 53&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;push &nbsp; &nbsp;ebx 
 8288a49c e8a4dc0900 &nbsp; &nbsp; &nbsp;call &nbsp; &nbsp;nt 
 !KiCopyCounters&nbsp; 
 ( 
 82928145 
 ) 
 8288a4a1&nbsp; 
 58&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;pop &nbsp; &nbsp; eax 
 8288a4a2 c6433a00 &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; byte ptr&nbsp; 
 [ebx 
 +3Ah 
 ] 
 , 
 0&nbsp;&nbsp; &nbsp;&nbsp; 
 ;&nbsp;KPCR. 
 KPRCB. 
 CurrentThread 
 -&gt;Alerted&nbsp; 
 =&nbsp; 
 0 
 8288a4a6 807b5600 &nbsp; &nbsp; &nbsp; &nbsp;cmp &nbsp; &nbsp; byte ptr&nbsp; 
 [ebx 
 +56h 
 ] 
 , 
 0 
 8288a4aa&nbsp; 
 7448&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;je &nbsp; &nbsp; &nbsp;nt 
 !KiServiceExit 
 + 
 0x74&nbsp; 
 (8288a4f4 
 )&nbsp;&nbsp; &nbsp;&nbsp; 
 ;&nbsp; 
 if 
 (KPCR. 
 KPRCB. 
 CurrentThread 
 -&gt;ApcState. 
 UserApcPending&nbsp; 
 ==&nbsp; 
 0 
 )跳 
 8288a4ac 8bdd &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; ebx 
 ,ebp 
 8288a4ae&nbsp; 
 894344&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; dword ptr&nbsp; 
 [ebx 
 +44h 
 ] 
 ,eax &nbsp; &nbsp; 
 ;&nbsp;KTRAP_FRAME. 
 Eax 
 ,&nbsp;系统调用号 
 8288a4b1 c743503b000000 &nbsp;mov &nbsp; &nbsp; dword ptr&nbsp; 
 [ebx 
 +50h 
 ] 
 ,3Bh &nbsp; &nbsp; 
 ;&nbsp;KTRAP_FRAME. 
 SegFs&nbsp; 
 =&nbsp; 
 0x3B 
 8288a4b8 c7433823000000 &nbsp;mov &nbsp; &nbsp; dword ptr&nbsp; 
 [ebx 
 +38h 
 ] 
 ,23h &nbsp; &nbsp; 
 ;&nbsp;KTRAP_FRAME. 
 SegDs&nbsp; 
 =&nbsp;KGDT_R3_DATA 
 8288a4bf c7433423000000 &nbsp;mov &nbsp; &nbsp; dword ptr&nbsp; 
 [ebx 
 +34h 
 ] 
 ,23h &nbsp; &nbsp; 
 ;&nbsp;KTRAP_FRAME. 
 SegEs&nbsp; 
 =&nbsp;KGDT_R3_DATA 
 8288a4c6 c7433000000000 &nbsp;mov &nbsp; &nbsp; dword ptr&nbsp; 
 [ebx 
 +30h 
 ] 
 , 
 0&nbsp;&nbsp; &nbsp; &nbsp; 
 ;&nbsp;KTRAP_FRAME. 
 SegGs&nbsp; 
 =&nbsp; 
 0 
 </div> </td> 
 </tr> 
 </tbody> 
</table>

[![image][image 8]][image_image 8]

下图为快速系统调用的完整过程：

[![image][image 9]][image_image 9]

现在我相信大家对用户模式到内核模式的切换有了一个比较清晰的认识。

本文链接：[http://www.blogfshare.com/sysenter-sysexit.html][http_www.blogfshare.com_sysenter-sysexit.html]

转载提示：除非注明，AloneMonkey的文章均为原创，转载请以链接形式注明作者和出处。谢谢合作！

[Home]: http://www.blogfshare.com/
[AloneMonkey]: http://www.blogfshare.com/author/AloneMonkey
[0]: http://www.blogfshare.com/sysenter-sysexit.html#respond
[image]: http://www.blogfshare.com/wp-content/uploads/images/16efa82c7ad5_10ECC/image_thumb.png
[image 1]: http://www.blogfshare.com/wp-content/uploads/images/16efa82c7ad5_10ECC/image.png
[image 2]: http://www.blogfshare.com/wp-content/uploads/images/16efa82c7ad5_10ECC/image_thumb_3.png
[image_image 2]: http://www.blogfshare.com/wp-content/uploads/images/16efa82c7ad5_10ECC/image_3.png
[image 3]: http://www.blogfshare.com/wp-content/uploads/images/16efa82c7ad5_10ECC/image_thumb_4.png
[image_image 3]: http://www.blogfshare.com/wp-content/uploads/images/16efa82c7ad5_10ECC/image_4.png
[image 4]: http://www.blogfshare.com/wp-content/uploads/images/16efa82c7ad5_10ECC/image_thumb_5.png
[image_image 4]: http://www.blogfshare.com/wp-content/uploads/images/16efa82c7ad5_10ECC/image_5.png
[image 5]: http://www.blogfshare.com/wp-content/uploads/images/16efa82c7ad5_10ECC/image_thumb_6.png
[image_image 5]: http://www.blogfshare.com/wp-content/uploads/images/16efa82c7ad5_10ECC/image_6.png
[image 6]: http://www.blogfshare.com/wp-content/uploads/images/16efa82c7ad5_10ECC/image_thumb_7.png
[image_image 6]: http://www.blogfshare.com/wp-content/uploads/images/16efa82c7ad5_10ECC/image_7.png
[image 7]: http://www.blogfshare.com/wp-content/uploads/images/16efa82c7ad5_10ECC/image_thumb_8.png
[image_image 7]: http://www.blogfshare.com/wp-content/uploads/images/16efa82c7ad5_10ECC/image_8.png
[image 8]: http://www.blogfshare.com/wp-content/uploads/images/16efa82c7ad5_10ECC/image_thumb_9.png
[image_image 8]: http://www.blogfshare.com/wp-content/uploads/images/16efa82c7ad5_10ECC/image_9.png
[image 9]: http://www.blogfshare.com/wp-content/uploads/images/16efa82c7ad5_10ECC/image_thumb_10.png
[image_image 9]: http://www.blogfshare.com/wp-content/uploads/images/16efa82c7ad5_10ECC/image_10.png
[http_www.blogfshare.com_sysenter-sysexit.html]: http://www.blogfshare.com/sysenter-sysexit.html