nt!MiInitializeSystemCache函数分析之PointerPte-＞u.List.NextEntry的由来

第一部分：

1: kd> dd 0xc0304200

c0304200 c10c0000 00000000 00000000 00000000

c0304210 00000000 00000000 00000000 00000000

c0304220 00000000 00000000 00000000 00000000

c0304230 00000000 00000000 00000000 00000000

c0304240 00000000 00000000 00000000 00000000

c0304250 00000000 00000000 00000000 00000000

c0304260 00000000 00000000 00000000 00000000

c0304270 00000000 00000000 00000000 00000000

1: kd> dd 0xc0304300

c0304300 c1100000 00000000 00000000 00000000

c0304310 00000000 00000000 00000000 00000000

c0304320 00000000 00000000 00000000 00000000

c0304330 00000000 00000000 00000000 00000000

c0304340 00000000 00000000 00000000 00000000

c0304350 00000000 00000000 00000000 00000000

c0304360 00000000 00000000 00000000 00000000

c0304370 00000000 00000000 00000000 00000000

1: kd> dd 0xc0304400

c0304400 c1140000 00000000 00000000 00000000

c0304410 00000000 00000000 00000000 00000000

c0304420 00000000 00000000 00000000 00000000

c0304430 00000000 00000000 00000000 00000000

c0304440 00000000 00000000 00000000 00000000

第二部分：

VOID

MiInitializeSystemCache (

IN ULONG MinimumWorkingSet,

IN ULONG MaximumWorkingSet

)

// Build a free list structure in the PTEs for the system cache.

MmSystemCachePteBase = MI_PTE_BASE_FOR_LOWEST_KERNEL_ADDRESS;

SizeOfSystemCacheInPages = MI_COMPUTE_PAGES_SPANNED (MmSystemCacheStart,

(PCHAR)MmSystemCacheEnd - (PCHAR)MmSystemCacheStart + 1);

HunksOf256KInCache = SizeOfSystemCacheInPages / (X256K / PAGE_SIZE);

PointerPte = MiGetPteAddress (MmSystemCacheStart);

MmFirstFreeSystemCache = PointerPte;

for (i = 0; i < HunksOf256KInCache; i += 1) {

PointerPte->u.List.NextEntry = (PointerPte + (X256K / PAGE_SIZE)) - MmSystemCachePteBase;

PointerPte += X256K / PAGE_SIZE;

}

PointerPte->u.List.NextEntry = (PointerPte + (X256K / PAGE_SIZE)) - MmSystemCachePteBase;

(PointerPte + (X256K / PAGE_SIZE))表示指针，MmSystemCachePteBase表示指针
减完要除以4，表示个数，右移2位

第三部分：

#define PAGE_SIZE 0x1000

#define X256K 0x40000

1: kd> ?0x40000/0x1000

Evaluate expression: 64 = 00000040

0100 0000

0100 0000 00

01 00 00 00 00 = 0x100

0xc0304000+0x100=0xc0304100

0xc0304100-0xc0000000=0x304100

304100

0011 00 00 0100 0001 0000 0000

11 00 00 0100 0001 0000 00

11 00 00 01 00 00 01 00 00 00

c1040

+0x000 List : _MMPTE_LIST

+0x000 Valid : Pos 0, 1 Bit

+0x000 OneEntry : Pos 1, 1 Bit

+0x000 filler0 : Pos 2, 8 Bits

+0x000 Prototype : Pos 10, 1 Bit

+0x000 filler1 : Pos 11, 1 Bit

+0x000 NextEntry : Pos 12, 20 Bits

1: kd> x nt!MmSystemCachePteBase

80b2358c nt!MmSystemCachePteBase = 0xc0000000

1: kd> dd 0xc0304000

c0304000 c1040000

第四部分：

0xc0304200

0xc0304300

304300

0011 0000 0100 0011 0000 0000

11 0000 0100 0011 0000 0000 00

11 00 00 01 00 00 11 00 00 00 00 00

c10c0