我在用DriverStudioV3.2逆向checked版xp sp2 pro中的ntoskrnl.exe时,将hal和kernel的符号加载上,但仍然只有函数的名称,而没有内核变量的名称在汇编代码中出现。例如《Undocumented Windows NT》中函数_KeI386AllocateGdtSelectors有名叫_KiNumberFreeSelectors$S10229的变量,但我这里只显示地址!
二楼的,看看我在这里发的自制xp sp2 pro checked盘的帖子吧,我用的就是我自己制作的,没钱买msdn。除此之外,你还可以按照msdn上介绍的方法在Free版系统上安装checked版内核文件。我试过,均能成功。^_^,我不会象驱动开发网的某些所谓的牛人那样吝啬自己的一张checked盘。
//
// The reason of having these variables defined in here is to isolate
// ABIOS from current system.
//
//
// KiNumberFreeSelectors defines the number of available selectors for
// ABIOS specific drivers. This number should be the same across all
// the processors.
//
static USHORT KiNumberFreeSelectors = 0;
感觉就在ntoskrnl.exe中。
//
// i386 misc routines
//
NTSTATUS
NTAPI
KeI386AllocateGdtSelectors(
OUT PUSHORT SelectorArray,
IN USHORT NumberOfSelectors
);
NTSTATUS
KeI386AllocateGdtSelectors(
OUT PUSHORT SelectorArray,
IN USHORT NumberOfSelectors
)
/*++
Routine Description:
This function allocates a set of GDT selectors for a device driver to use.
Usually this allocation is performed at device driver initialization time
to reserve the selectors for later use.
Arguments:
SelectorArray - Supplies a pointer to an array of USHORT to be filled
in with the GDT selectors allocated.
NumberOfSelectors - Specifies the number of selectors to be allocated.
Return Value:
STATUS_SUCCESS - If the requested selectors are allocated.
STATUS_ABIOS_SELECTOR_NOT_AVAILABLE - if system can not allocate the number
of selectors requested.
--*/
{
PKFREE_GDT_ENTRY GdtEntry;
KIRQL OldIrql;
if (KiNumberFreeSelectors >= NumberOfSelectors) {
ExAcquireSpinLock(&KiAbiosGdtLock, &OldIrql);
//
// The Free Gdt link list is maintained on Processor 0's GDT ONLY.
// Because the 'selector' is an offset to the beginning of GDT and
// it should be the same across all the processors.
//