kd> !process 0 0
**** NT ACTIVE PROCESS DUMP ****
PROCESS 856e0340 SessionId: none Cid: 0004 Peb: 00000000 ParentCid: 0000
DirBase: 00185000 ObjectTable: 82603000 HandleCount: <Data Not Accessible>
Image: System
PROCESS 865f68c0 SessionId: none Cid: 01f4 Peb: 7fa03000 ParentCid: 0004
DirBase: 28a04020 ObjectTable: 8b863980 HandleCount: <Data Not Accessible>
Image: smss.exe
//csrss.exe进程并没有启动,Win32k模块在系统中没有加载。
kd> lm vm win32k
start end module name //这里可以看到确实win32k没有起来。
kd> lm
start end module name
770e0000 770e0000 ntdll (no symbols)
kd> !process 0 0
**** NT ACTIVE PROCESS DUMP ****
PROCESS 856e0340 SessionId: none Cid: 0004 Peb: 00000000 ParentCid: 0000
DirBase: 00185000 ObjectTable: 82603000 HandleCount: <Data Not Accessible>
Image: System
PROCESS 865f68c0 SessionId: none Cid: 01f4 Peb: 7fa03000 ParentCid: 0004
DirBase: 28a04020 ObjectTable: 8b863980 HandleCount: <Data Not Accessible>
Image: smss.exe
PROCESS 86420c40 SessionId: 0 Cid: 0244 Peb: 7f525000 ParentCid: 01f4
DirBase: 28a04040 ObjectTable: 8ee5cac0 HandleCount: <Data Not Accessible>
Image: smss.exe
GetServiceDescriptorTableShadowAddress proc uses esi edi ebx
local dwThreadId:DWORD
xor ebx, ebx ; = NULL. Assume ServiceDescriptorTableShadow will be not found
mov eax, KeServiceDescriptorTable
mov esi, [eax]
; Find KTHREAD.ServiceTable field
; For non-GUI threads this field == KeServiceDescriptorTable
; and it points to ServiceDescriptorTable
; For GUI threads
; ServiceDescriptorTableShadow
invoke KeGetCurrentThread
mov edi, 200h-4
.while edi
.break .if dword ptr [eax][edi] == esi
dec edi
.endw
.if edi != 0
; edi = offset to ServiceTable field in KTHREAD structure
mov dwThreadId, 080h
.while dwThreadId < 400h
push eax ; reserve DWORD on stack
invoke PsLookupThreadByThreadId, dwThreadId, esp
pop ecx ; -> ETHREAD/KTHREAD
.if eax == STATUS_SUCCESS
push dword ptr [ecx][edi]
fastcall ObfDereferenceObject, ecx
pop eax
.if eax != esi
mov edx, MmSystemRangeStart
mov edx, [edx]
mov edx, [edx]
.if eax > edx ; some stupid error checking
mov ebx, eax
invoke DbgPrint, $CTA0("FindShadowTable: Found in thread with ID: %X\n"), dwThreadId
.break
.endif
.endif
.endif
add dwThreadId, 4
.endw
.endif
2。 ; For non-GUI threads this field == KeServiceDescriptorTable
这个方法的判断GUI线程的方法和我的方法不一样。他是比对ServiceTable是否为KeServiceDescriptorTable来判断THREAD是否是GUI线程的,而我的方法是判断THREAD中Win32Thread这个成员来判断GUI线程的。这个判断出发点就不同。这怎么能说是一种方法呢?
[QUOTE=啤酒肚;1246010]从我分析的结果看,这位老兄的观点,System和smss是 Session外进程所以不能看到,win32k模块是完全错误的。[/QUOTE]
kd> !process 0 0 system
PROCESS 85a67040 SessionId: none Cid: 0004 Peb: 00000000 ParentCid: 0000
DirBase: 00185000 ObjectTable: 88403000 HandleCount: <Data Not Accessible>
Image: System
kd> .process /i 85a67040; g
You need to continue execution (press 'g' <enter>) for the context
to be switched. When the debugger breaks in again, you will be in
the new process context.
Break instruction exception - code 80000003 (first chance)
nt!RtlpBreakWithStatusInstruction:
81d083a4 cc int 3
kd> !process -1 0; lm m win32k
PROCESS 85a67040 SessionId: none Cid: 0004 Peb: 00000000 ParentCid: 0000
DirBase: 00185000 ObjectTable: 88403000 HandleCount: <Data Not Accessible>
Image: System
start end module name
8f845000 8fb96000 win32k (export symbols) win32k.sys
kd> dd poi(nt!KeServiceDescriptorTableShadow+10) l4
8fb37000 ???????? ???????? ???????? ????????
kd> .process /i 86fc4cc0; g
You need to continue execution (press 'g' <enter>) for the context
to be switched. When the debugger breaks in again, you will be in
the new process context.
Break instruction exception - code 80000003 (first chance)
nt!RtlpBreakWithStatusInstruction:
81d083a4 cc int 3
kd> !process -1 0; lm m win32k
PROCESS 86fc4cc0 SessionId: none Cid: 0200 Peb: 7f2cf000 ParentCid: 0004
DirBase: 3e1be020 ObjectTable: 8c048580 HandleCount: <Data Not Accessible>
Image: smss.exe
start end module name
8f845000 8fb96000 win32k (export symbols) win32k.sys
kd> dd poi(nt!KeServiceDescriptorTableShadow+10) l4
8fb37000 ???????? ???????? ???????? ????????
kd> .process /i 85b0bc00; g
You need to continue execution (press 'g' <enter>) for the context
to be switched. When the debugger breaks in again, you will be in
the new process context.
Break instruction exception - code 80000003 (first chance)
nt!RtlpBreakWithStatusInstruction:
81d083a4 cc int 3
kd> !process -1 0; lm m win32k
PROCESS 85b0bc00 SessionId: 1 Cid: 0298 Peb: 7f3ad000 ParentCid: 0200
DirBase: 3e1be080 ObjectTable: 00000000 HandleCount: 0.
Image: smss.exe
start end module name
8f845000 8fb96000 win32k (export symbols) win32k.sys
kd> dd poi(nt!KeServiceDescriptorTableShadow+10) l4
8fb37000 8fa2a1a3 8fa8de22 8fa8e2bc 8fa8ff6d
...
... thread id 4-1268, win32Thread 0, service table 0x81e9d600
thread id 1276-1272, win32Thread 2172687208, service table 0x81e9d5c0
process 0x8900a040 msdtc.exe, pid:1276, path C:\Windows\System32\msdtc.exe
thread id 1184-1280, win32Thread 0, service table 0x81e9d600
thread id 2004-1284, win32Thread 2705825120, service table 0x81e9d5c0
process 0x88e46040 vmtoolsd.exe, pid:1288, path C:\Program Files\VMware\VMware Tools\vmtoolsd.exe
thread id 1288-1292, win32Thread 2409460656, service table 0x81e9d5c0
thread id 1276-1296, win32Thread 2172688592, service table 0x81e9d5c0
thread id 788-1312, win32Thread 0, service table 0x81e9d600
thread id 788-1316, win32Thread 0, service table 0x81e9d600
thread id 996-1332, win32Thread 0, service table 0x81e9d600
thread id 996-1336, win32Thread 0, service table 0x81e9d600
thread id 2004-1340, win32Thread 2408911616, service table 0x81e9d5c0
thread id 344-1344, win32Thread 2409476528, service table 0x81e9d5c0
thread id 1424-1356, win32Thread 0, service table 0x81e9d600
thread id 996-1360, win32Thread 0, service table 0x81e9d600
thread id 996-1364, win32Thread 0, service table 0x81e9d600
thread id 3748-1368, win32Thread 0, service table 0x81e9d600
thread id 828-1372, win32Thread 2409427672, service table 0x81e9d5c0
thread id 728-1376, win32Thread 0, service table 0x81e9d600
thread id 996-1380, win32Thread 0, service table 0x81e9d600
thread id 1276-1400, win32Thread 0, service table 0x81e9d600
thread id 768-1412, win32Thread 0, service table 0x81e9d600
thread id 1288-1420, win32Thread 2409550632, service table 0x81e9d5c0
process 0x88e88040 MsMpEng.exe, pid:1424, path C:\Program Files\Windows Defender\MsMpEng.exe
thread id 1424-1428, win32Thread 2409487224, service table 0x81e9d5c0
thread id 1424-1436, win32Thread 0, service table 0x81e9d600
thread id 3748-1440, win32Thread 0, service table 0x81e9d600
thread id 1424-1444, win32Thread 0, service table 0x81e9d600
thread id 1424-1448, win32Thread 0, service table 0x81e9d600