-
-
很久没来这里发帖了，提个最近碰到的问题
-
发表于: 2008-3-25 14:09
-
最近调试某软件时发现其Display Driver中DrvEnableDriver设置了index = 77L、即标号为INDEX_DrvReserved1的支持例程，调试win32k后发现win32k在NtUserRemoteConnect中载入了Display Driver，并在ldevLoadDriver返回之前以四个参数调用了这个保留的支持例程（xp_2600_2180的代码位置如下）
text:BF8942E6 loc_BF8942E6: ; CODE XREF: ldevLoadDriver(ushort *,_LDEVTYPE)+BCj
.text:BF8942E6 push ?G_PerformanceStatistics@@3PAEA ; uchar * G_PerformanceStatistics
.text:BF8942EC push ?G_RemoteVideoFileObject@@3PAU_FILE_OBJECT@@A ; _FILE_OBJECT * G_RemoteVideoFileObject
.text:BF8942F2 push ?G_RemoteConnectionFileObject@@3PAU_FILE_OBJECT@@A ; _FILE_OBJECT * G_RemoteConnectionFileObject
.text:BF8942F8 push ?G_RemoteConnectionChannel@@3PAXA ; void * G_RemoteConnectionChannel
.text:BF8942FE call eax
我想找一下关于这个例程的资料，可惜wrk里面貌似没有任何相关的说明
text:BF8942E6 loc_BF8942E6: ; CODE XREF: ldevLoadDriver(ushort *,_LDEVTYPE)+BCj
.text:BF8942E6 push ?G_PerformanceStatistics@@3PAEA ; uchar * G_PerformanceStatistics
.text:BF8942EC push ?G_RemoteVideoFileObject@@3PAU_FILE_OBJECT@@A ; _FILE_OBJECT * G_RemoteVideoFileObject
.text:BF8942F2 push ?G_RemoteConnectionFileObject@@3PAU_FILE_OBJECT@@A ; _FILE_OBJECT * G_RemoteConnectionFileObject
.text:BF8942F8 push ?G_RemoteConnectionChannel@@3PAXA ; void * G_RemoteConnectionChannel
.text:BF8942FE call eax
我想找一下关于这个例程的资料，可惜wrk里面貌似没有任何相关的说明
