第一部分：
kd> p
eax=00a02024 ebx=009c6714 ecx=00000001 edx=000001c4 esi=001182f0 edi=00000003
eip=009efce2 esp=000ef7f4 ebp=000ef82c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
winlogon!SignalManagerValidateSignalDataQueue+0xee:
001b:009efce2 c20c00 ret 0Ch
kd> p
eax=00a02024 ebx=009c6714 ecx=00000001 edx=000001c4 esi=001182f0 edi=00000003
eip=009f01ce esp=000ef804 ebp=000ef82c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
winlogon!SignalManagerResetSignal+0xa2:
001b:009f01ce 3b7e1c cmp edi,dword ptr [esi+1Ch] ds:0023:0011830c=00000022
kd> p
eax=00a02024 ebx=009c6714 ecx=00000001 edx=000001c4 esi=001182f0 edi=00000003
eip=009f01d1 esp=000ef804 ebp=000ef82c iopl=0 nv up ei ng nz na pe cy
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000287
winlogon!SignalManagerResetSignal+0xa5:
001b:009f01d1 7213 jb winlogon!SignalManagerResetSignal+0xba (009f01e6) [br=1]
kd> p
eax=00a02024 ebx=009c6714 ecx=00000001 edx=000001c4 esi=001182f0 edi=00000003
eip=009f01e6 esp=000ef804 ebp=000ef82c iopl=0 nv up ei ng nz na pe cy
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000287
winlogon!SignalManagerResetSignal+0xba:
001b:009f01e6 8b4510 mov eax,dword ptr [ebp+10h] ss:0023:000ef83c={winlogon!g_xWinsrv_Sas_Signal (00a02024)}
kd> p
eax=00a02024 ebx=009c6714 ecx=00000001 edx=000001c4 esi=001182f0 edi=00000003
eip=009f01e9 esp=000ef804 ebp=000ef82c iopl=0 nv up ei ng nz na pe cy
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000287
winlogon!SignalManagerResetSignal+0xbd:
001b:009f01e9 f6400402 test byte ptr [eax+4],2 ds:0023:00a02028=00
kd> p
eax=00a02024 ebx=009c6714 ecx=00000001 edx=000001c4 esi=001182f0 edi=00000003
eip=009f01ed esp=000ef804 ebp=000ef82c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
winlogon!SignalManagerResetSignal+0xc1:
001b:009f01ed 8b4620 mov eax,dword ptr [esi+20h] ds:0023:00118310=001413b8
kd> dd 001182f0
001182f0 001182c8 fffffffe 00000001 000001c4
00118300 00000120 00000000 000000ec 00000022
00118310 001413b8 00141448 00141670 00141700
00118320 00141790 00141820 001418b0 00141940
00118330 001419d0 00141a60 00141af0 00141b80
00118340 00141c10 00141ca0 00141d30 00141dc0
00118350 00141e50 00141ee0 00141f70 00142000
00118360 00142090 00142120 001421b0 00142240
kd> p
eax=001413b8 ebx=009c6714 ecx=00000001 edx=000001c4 esi=001182f0 edi=00000003
eip=009f01f0 esp=000ef804 ebp=000ef82c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
winlogon!SignalManagerResetSignal+0xc4:
001b:009f01f0 0f84c2000000 je winlogon!SignalManagerResetSignal+0x18c (009f02b8) [br=1]
kd> p
eax=001413b8 ebx=009c6714 ecx=00000001 edx=000001c4 esi=001182f0 edi=00000003
eip=009f02b8 esp=000ef804 ebp=000ef82c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
winlogon!SignalManagerResetSignal+0x18c:
001b:009f02b8 8324b800 and dword ptr [eax+edi*4],0 ds:0023:001413c4=00000000 重置信号3
kd> dd 001413b8
001413b8 00000000 00000000 00000000 00000000
001413c8 00000000 00000000 00000000 00000000
001413d8 00000000 00000000 00000000 00000000
第二部分：
winlogon!SignalManagerRemoveSignalDataQueue和信号管理数组的->24h有关
kd> p
eax=001413b8 ebx=009c6714 ecx=00000001 edx=000001c4 esi=001182f0 edi=00000003
eip=009f02bd esp=000ef800 ebp=000ef82c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
winlogon!SignalManagerResetSignal+0x191:
001b:009f02bd 56 push esi
kd> p
eax=001413b8 ebx=009c6714 ecx=00000001 edx=000001c4 esi=001182f0 edi=00000003
eip=009f02be esp=000ef7fc ebp=000ef82c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
winlogon!SignalManagerResetSignal+0x192:
001b:009f02be e827faffff call winlogon!SignalManagerRemoveSignalDataQueue (009efcea)
kd> t
eax=001413b8 ebx=009c6714 ecx=00000001 edx=000001c4 esi=001182f0 edi=00000003
eip=009efcea esp=000ef7f8 ebp=000ef82c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
winlogon!SignalManagerRemoveSignalDataQueue:
001b:009efcea 8bff mov edi,edi
kd> p
eax=001413b8 ebx=009c6714 ecx=00000001 edx=000001c4 esi=001182f0 edi=00000003
eip=009efcec esp=000ef7f8 ebp=000ef82c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
winlogon!SignalManagerRemoveSignalDataQueue+0x2:
001b:009efcec 55 push ebp
kd> p
eax=001413b8 ebx=009c6714 ecx=00000001 edx=000001c4 esi=001182f0 edi=00000003
eip=009efced esp=000ef7f4 ebp=000ef82c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
winlogon!SignalManagerRemoveSignalDataQueue+0x3:
001b:009efced 8bec mov ebp,esp
kd> p
eax=001413b8 ebx=009c6714 ecx=00000001 edx=000001c4 esi=001182f0 edi=00000003
eip=009efcef esp=000ef7f4 ebp=000ef7f4 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
winlogon!SignalManagerRemoveSignalDataQueue+0x5:
001b:009efcef 56 push esi
kd> p
eax=001413b8 ebx=009c6714 ecx=00000001 edx=000001c4 esi=001182f0 edi=00000003
eip=009efcf0 esp=000ef7f0 ebp=000ef7f4 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
winlogon!SignalManagerRemoveSignalDataQueue+0x6:
001b:009efcf0 57 push edi
kd> p
eax=001413b8 ebx=009c6714 ecx=00000001 edx=000001c4 esi=001182f0 edi=00000003
eip=009efcf1 esp=000ef7ec ebp=000ef7f4 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
winlogon!SignalManagerRemoveSignalDataQueue+0x7:
001b:009efcf1 8b7d08 mov edi,dword ptr [ebp+8] ss:0023:000ef7fc=001182f0
kd> p
eax=001413b8 ebx=009c6714 ecx=00000001 edx=000001c4 esi=001182f0 edi=001182f0
eip=009efcf4 esp=000ef7ec ebp=000ef7f4 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
winlogon!SignalManagerRemoveSignalDataQueue+0xa:
001b:009efcf4 85ff test edi,edi
kd> p
eax=001413b8 ebx=009c6714 ecx=00000001 edx=000001c4 esi=001182f0 edi=001182f0
eip=009efcf6 esp=000ef7ec ebp=000ef7f4 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000206
winlogon!SignalManagerRemoveSignalDataQueue+0xc:
001b:009efcf6 7516 jne winlogon!SignalManagerRemoveSignalDataQueue+0x24 (009efd0e) [br=1]
kd> p
eax=001413b8 ebx=009c6714 ecx=00000001 edx=000001c4 esi=001182f0 edi=001182f0
eip=009efd0e esp=000ef7ec ebp=000ef7f4 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000206
winlogon!SignalManagerRemoveSignalDataQueue+0x24:
001b:009efd0e 8b750c mov esi,dword ptr [ebp+0Ch] ss:0023:000ef800=00000003
kd> p
eax=001413b8 ebx=009c6714 ecx=00000001 edx=000001c4 esi=00000003 edi=001182f0
eip=009efd11 esp=000ef7ec ebp=000ef7f4 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000206
winlogon!SignalManagerRemoveSignalDataQueue+0x27:
001b:009efd11 c1e604 shl esi,4
kd> p
eax=001413b8 ebx=009c6714 ecx=00000001 edx=000001c4 esi=00000030 edi=001182f0
eip=009efd14 esp=000ef7ec ebp=000ef7f4 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000206
winlogon!SignalManagerRemoveSignalDataQueue+0x2a:
001b:009efd14 eb23 jmp winlogon!SignalManagerRemoveSignalDataQueue+0x4f (009efd39)
kd> p
eax=001413b8 ebx=009c6714 ecx=00000001 edx=000001c4 esi=00000030 edi=001182f0
eip=009efd39 esp=000ef7ec ebp=000ef7f4 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000206
winlogon!SignalManagerRemoveSignalDataQueue+0x4f:
001b:009efd39 8b4724 mov eax,dword ptr [edi+24h] ds:0023:00118314=00141448
kd> p
eax=00141448 ebx=009c6714 ecx=00000001 edx=000001c4 esi=00000030 edi=001182f0
eip=009efd3c esp=000ef7ec ebp=000ef7f4 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000206
winlogon!SignalManagerRemoveSignalDataQueue+0x52:
001b:009efd3c 837c060c00 cmp dword ptr [esi+eax+0Ch],0 ds:0023:00141484=00000000
kd> dd 001182f0
001182f0 001182c8 fffffffe 00000001 000001c4
00118300 00000120 00000000 000000ec 00000022
00118310 001413b8 00141448 00141670 00141700
00118320 00141790 00141820 001418b0 00141940
00118330 001419d0 00141a60 00141af0 00141b80
00118340 00141c10 00141ca0 00141d30 00141dc0
00118350 00141e50 00141ee0 00141f70 00142000
00118360 00142090 00142120 001421b0 00142240
kd> dd 00141448
00141448 00000000 00000000 00000000 00000000
00141458 00000000 00000000 00000000 00000000
00141468 00000000 00000000 00000000 00000000
00141478 00000000 00000000 00000000 00000000
00141488 00000000 00000000 00000000 00000000
00141498 00000000 00000000 00000000 00000000
cmp dword ptr [esi+eax+0Ch],0 关键处，比较是不是0
kd> p
eax=00141448 ebx=009c6714 ecx=00000001 edx=000001c4 esi=00000030 edi=001182f0
eip=009efd41 esp=000ef7ec ebp=000ef7f4 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
winlogon!SignalManagerRemoveSignalDataQueue+0x57:
001b:009efd41 75d3 jne winlogon!SignalManagerRemoveSignalDataQueue+0x2c (009efd16) [br=0]
kd> p
eax=00141448 ebx=009c6714 ecx=00000001 edx=000001c4 esi=00000030 edi=001182f0
eip=009efd43 esp=000ef7ec ebp=000ef7f4 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
winlogon!SignalManagerRemoveSignalDataQueue+0x59:
001b:009efd43 8b7f24 mov edi,dword ptr [edi+24h] ds:0023:00118314=00141448
kd> p
eax=00141448 ebx=009c6714 ecx=00000001 edx=000001c4 esi=00000030 edi=00141448
eip=009efd46 esp=000ef7ec ebp=000ef7f4 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
winlogon!SignalManagerRemoveSignalDataQueue+0x5c:
001b:009efd46 33c0 xor eax,eax
kd> p
eax=00000000 ebx=009c6714 ecx=00000001 edx=000001c4 esi=00000030 edi=00141448
eip=009efd48 esp=000ef7ec ebp=000ef7f4 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
winlogon!SignalManagerRemoveSignalDataQueue+0x5e:
001b:009efd48 03fe add edi,esi
kd> p
eax=00000000 ebx=009c6714 ecx=00000001 edx=000001c4 esi=00000030 edi=00141478
eip=009efd4a esp=000ef7ec ebp=000ef7f4 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000206
winlogon!SignalManagerRemoveSignalDataQueue+0x60:
001b:009efd4a ab stos dword ptr es:[edi] es:0023:00141478=00000000
kd> p
eax=00000000 ebx=009c6714 ecx=00000001 edx=000001c4 esi=00000030 edi=0014147c
eip=009efd4b esp=000ef7ec ebp=000ef7f4 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000206
winlogon!SignalManagerRemoveSignalDataQueue+0x61:
001b:009efd4b ab stos dword ptr es:[edi] es:0023:0014147c=00000000
kd> p
eax=00000000 ebx=009c6714 ecx=00000001 edx=000001c4 esi=00000030 edi=00141480
eip=009efd4c esp=000ef7ec ebp=000ef7f4 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000206
winlogon!SignalManagerRemoveSignalDataQueue+0x62:
001b:009efd4c ab stos dword ptr es:[edi] es:0023:00141480=00000000
kd> p
eax=00000000 ebx=009c6714 ecx=00000001 edx=000001c4 esi=00000030 edi=00141484
eip=009efd4d esp=000ef7ec ebp=000ef7f4 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000206
winlogon!SignalManagerRemoveSignalDataQueue+0x63:
001b:009efd4d ab stos dword ptr es:[edi] es:0023:00141484=00000000
kd> p
eax=00000000 ebx=00a02cc4 ecx=009f02d6 edx=000001c4 esi=00000003 edi=00141038
eip=009f02d6 esp=000ef830 ebp=000ef9dc iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
winlogon!SignalManagerResetSignal+0x1aa:
001b:009f02d6 c20c00 ret 0Ch
kd> p
eax=00000000 ebx=00a02cc4 ecx=009f02d6 edx=000001c4 esi=00000003 edi=00141038
eip=009ef27c esp=000ef840 ebp=000ef9dc iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
winlogon!StateMachineRun+0x49c:
001b:009ef27c ff45f0 inc dword ptr [ebp-10h] ss:0023:000ef9cc=00000000
第三部分：
循环第二次：
kd> p
eax=0000000d ebx=00a02cc4 ecx=00a03e38 edx=00a02bf0 esi=0000000d edi=00141038
eip=009ef271 esp=000ef840 ebp=000ef9dc iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000206
winlogon!StateMachineRun+0x491:
001b:009ef271 ff3481 push dword ptr [ecx+eax*4] ds:0023:00a03e6c={winlogon!g_xWinsrv_Kill_Scrnsaver_Signal (00a0209c)}
kd> p
eax=0000000d ebx=00a02cc4 ecx=00a03e38 edx=00a02bf0 esi=0000000d edi=00141038
eip=009ef274 esp=000ef83c ebp=000ef9dc iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000206
winlogon!StateMachineRun+0x494:
001b:009ef274 50 push eax
kd> p
eax=0000000d ebx=00a02cc4 ecx=00a03e38 edx=00a02bf0 esi=0000000d edi=00141038
eip=009ef275 esp=000ef838 ebp=000ef9dc iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000206
winlogon!StateMachineRun+0x495:
001b:009ef275 ff37 push dword ptr [edi] ds:0023:00141038=001182f0
kd> p
eax=0000000d ebx=00a02cc4 ecx=00a03e38 edx=00a02bf0 esi=0000000d edi=00141038
eip=009ef277 esp=000ef834 ebp=000ef9dc iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000206
winlogon!StateMachineRun+0x497:
001b:009ef277 e8b00e0000 call winlogon!SignalManagerResetSignal (009f012c)
kd> t
eax=0000000d ebx=00a02cc4 ecx=00a03e38 edx=00a02bf0 esi=0000000d edi=00141038
eip=009f012c esp=000ef830 ebp=000ef9dc iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000206
winlogon!SignalManagerResetSignal:
001b:009f012c 6a08 push 8
kd> dd 000ef830
000ef830 009ef27c 001182f0 0000000d 00a0209c
循环第二次：0000000d
kd> u 00a0209c
winlogon!g_xWinsrv_Kill_Scrnsaver_Signal:
00a0209c 042a add al,2Ah
00a0209e 9c pushfd
00a0209f 0000 add byte ptr [eax],al
00a020a1 0000 add byte ptr [eax],al
00a020a3 000d000000e4 add byte ptr ds:[0E4000000h],cl
00a020a9 299c0000000000 sub dword ptr [eax+eax],ebx
00a020b0 0e push cs
00a020b1 0000 add byte ptr [eax],al
kd> bp winlogon!SignalManagerResetSignal
kd> g
Breakpoint 28 hit
eax=0000001f ebx=00a02cc4 ecx=00a03e38 edx=00a02bf0 esi=0000001f edi=00141038
eip=009f012c esp=000ef830 ebp=000ef9dc iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000206
winlogon!SignalManagerResetSignal:
001b:009f012c 6a08 push 8
kd> dd 000ef830
000ef830 009ef27c 001182f0 0000001f 00a02174
000ef840 00000000 009c2f5c 00a0400c 00142a68
000ef850 00000108 00a02cc4 00000000 00141038
000ef860 00a046f8 00000000 00000000 00000108
000ef870 00000000 00000000 00000000 00000000
000ef880 00000000 00000007 00142b38 0000010c
000ef890 00a032f4 00000000 00141038 00a046f8
000ef8a0 00b60de0 00000000 0000010c 00000000
循环第三次：0000001f
kd> dd 00a02cc4
00a02cc4 009c2290 00000000 009d4d1e 009d4dd8
00a02cd4 00000010 00a02bf0 00000005 00a02cb0
00a02ce4 0000001c 00000000 fffffffe 00000000
00a02cf4 009c2264 009d636f 00000000 00000000
00a02d04 00000001 00a02ce8 00000000 00000000
00a02d14 0000001d 00000000 fffffffe 00000000
00a02d24 009c2238 009d4f39 00000000 00000000
00a02d34 00000001 00a02d18 00000000 00000000
kd> dd 00a02cb0
00a02cb0 00000003 0000000d 0000001f 00000006
00a02cc0 00000011 009c2290 00000000 009d4d1e
kd> g
Breakpoint 28 hit
eax=00000006 ebx=00a02cc4 ecx=00a03e38 edx=00a02bf0 esi=00000006 edi=00141038
eip=009f012c esp=000ef830 ebp=000ef9dc iopl=0 nv up ei ng nz ac pe cy
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000297
winlogon!SignalManagerResetSignal:
001b:009f012c 6a08 push 8
kd> dd 000ef830
000ef830 009ef27c 001182f0 00000006 00a02048
000ef840 00000000 009c2f5c 00a0400c 00142a68
000ef850 00000108 00a02cc4 00000000 00141038
000ef860 00a046f8 00000000 00000000 00000108
000ef870 00000000 00000000 00000000 00000000
000ef880 00000000 00000007 00142b38 0000010c
000ef890 00a032f4 00000000 00141038 00a046f8
000ef8a0 00b60de0 00000000 0000010c 00000000
循环第四次：00000006
kd> g
Breakpoint 28 hit
eax=00000011 ebx=00a02cc4 ecx=00a03e38 edx=00a02bf0 esi=00000011 edi=00141038
eip=009f012c esp=000ef830 ebp=000ef9dc iopl=0 nv up ei pl nz ac pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000216
winlogon!SignalManagerResetSignal:
001b:009f012c 6a08 push 8
kd> dd 000ef830
000ef830 009ef27c 001182f0 00000011 00a020cc
000ef840 00000000 009c2f5c 00a0400c 00142a68
循环第五次：00000011
winlogon!SignalManagerResetSignal