第3章 Windows运行机理-3.1 内核分析(5)

每个宏都有与它相对应的结束宏,例如,如果要在源文件中定义一个_LTEXT段,应该写成如下:

VxD_LOCKED_CODE_SEG

(把你的代码写在这里)

VxD_LOCKED_CODE_ENDS

我们可以用VC++ Dump工具提供的DUMPBIN工具来分析以下VxD的文件结构和组织机理。可以进入MS_DOS输入如下的命令行(在光碟上的第三章\cpu降温\COOLCPU\BIN路径下的STHVxD):

DUMPBIN /ALL STHVxD.VxD

就可以看到如下的信息:

Microsoft (R) COFF Binary File Dumper Version 6.00.8447

Copyright (C) Microsoft Corp 1992-1998. All rights reserved.

Dump of file sthvxd.vxd

File Type: VXD

454C magic number

0 byte order

0 word order

0 executable format level

2 CPU type (**)

4 operating system (**)

0 module version

38000 module flags

4 number of memory pages

2 object number of entry point

0 offset of entry point

0 object number of stack

0 offset of stack

200 memory page size

2C bytes on last page

61 fixup section size

0 fixup section checksum

6C loader section size

0 loader section checksum

C4 object table

3 object table entries

10C object map

0 iterated data map

0 resource table

0 resource table entries

11C resident names table

126 entry table

0 module directives table

0 module directives entries

130 fixup page table

144 fixup record table

191 imported modules name table

0 imported modules

191 imported procedures name table

0 page checksum table

1000 enumerated data pages

2 preload page count

162C non-resident name table

4E non-resident name table size

0 non-resident name checksum

0 automatic data object

0 debug information

0 debug information size

0 preload instance page count

0 demand instance page count

0 extra heap allocation

0 offset of Windows resources

0 size of Windows resources

ABC device id

400 DDK version

OBJECT HEADER #1

23C virtual size

0 virtual address

2045 flags

Execute Read

Has preload pages

32-bit

1 map index

2 map size

444F434C reserved

OBJECT PAGE MAP #1

Logical Physical File Flags

Page Page Offset Flags


00000001 00000001 00001000 Valid

00000002 00000002 00001200 Valid

RAW DATA #1

00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

00000010: 00 00 00 00 00 04 BC 0A 05 00 00 00 53 74 68 56 ............SthV

00000020: 58 44 20 20 00 00 00 80 00 00 00 00 00 00 00 00 XD ...�........

00000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

00000040: 00 00 00 00 00 00 00 00 00 00 00 00 76 65 72 50 ............verP

00000050: 50 00 00 00 31 76 73 52 32 76 73 52 33 76 73 52 P...1vsR2vsR3vsR

00000060: 8B 4C 24 08 85 C9 75 05 33 C0 C2 14 00 83 F9 FF .L$...u.3.......

00000070: 75 08 E8 69 00 00 00 C2 14 00 83 F9 03 76 08 B8 u..i.........v..

00000080: 32 00 00 00 C2 14 00 8B 44 24 14 8B 54 24 10 50 2.......D..T.P

00000090: 52 8B 44 24 14 8B 54 24 0C 50 52 FF 14 8D FC FF R.D..T.PR.....

000000A0: FF FF C2 14 00 CC CC CC CC CC CC CC CC CC CC CC ................

000000B0: A1 00 00 00 00 8B 4C 24 10 8B 49 18 85 C9 74 08 ......L$..I...t.

000000C0: 8B 09 89 0D 00 00 00 00 C2 10 00 CC CC CC CC CC ................

000000D0: E8 2A 01 00 00 B8 01 00 00 00 C3 CC CC CC CC CC .*..............

000000E0: B8 01 00 00 00 C3 CC CC CC CC CC CC CC CC CC CC ................

000000F0: 8B 44 24 04 83 F8 01 74 0A 83 F8 02 74 15 33 C0 .D$....t....t.3.

00000100: C2 0C 00 8B 44 24 08 50 E8 63 00 00 00 83 C4 04 ....D$.P.c......

00000110: C2 0C 00 8B 44 24 0C 8B 4C 24 08 50 51 E8 5E 00 ....D..L.PQ.^.

00000120: 00 00 83 C4 08 C2 0C 00 CC CC CC CC CC CC CC CC ................

00000130: 8B 44 24 04 83 F8 01 74 0A 83 F8 02 74 15 33 C0 .D$....t....t.3.

00000140: C2 0C 00 8B 44 24 08 50 E8 43 00 00 00 83 C4 04 ....D$.P.C......

00000150: C2 0C 00 8B 44 24 0C 8B 4C 24 08 50 51 E8 3E 00 ....D..L.PQ.>.

00000160: 00 00 83 C4 08 C2 0C 00 CC CC CC CC CC CC CC CC ................

00000170: B8 01 00 00 00 C3 CC CC CC CC CC CC CC CC CC CC ................

00000180: B8 02 00 00 00 C3 CC CC CC CC CC CC CC CC CC CC ................

00000190: B8 01 00 00 00 C3 CC CC CC CC CC CC CC CC CC CC ................

000001A0: B8 02 00 00 00 C3 CC CC 83 F8 1B 75 09 E8 00 00 ...........u....

000001B0: 00 00 83 F8 01 C3 83 F8 1C 75 09 E8 10 FF FF FF .........u......

000001C0: 83 F8 01 C3 83 F8 23 75 0E 56 52 53 51 55 E8 8D ......#u.VRSQU..

000001D0: FE FF FF 83 F8 01 C3 F8 C3 A1 00 00 00 00 85 C0 ................

000001E0: 75 02 F9 C3 FB F4 F9 C3 56 8D 35 00 00 00 00 CD u.......V.5.....

000001F0: 20 3A 00 01 00 5E B8 00 00 00 00 0F 93 C0 C3 56 :...^.........V

00000200: 8D 35 00 00 00 00 CD 20 2B 01 01 00 5E B8 00 00 .5..... +...^...

00000210: 00 00 0F 93 C0 C3 FF 75 18 FF 75 10 FF 75 1C E8 .......u..u..u..

00000220: CC FE FF FF 89 45 1C C3 FF 75 18 FF 75 10 FF 75 .....E...u..u..u

00000230: 1C E8 FA FE FF FF 89 45 1C C3 CC CC .......E....

OBJECT HEADER #2

B virtual size

0 virtual address

1005 flags

Execute Read

16:16 alias

3 map index

1 map size

444F4352 reserved

OBJECT PAGE MAP #2

Logical Physical File Flags

Page Page Offset Flags


00000001 00000003 00001400 Valid

RAW DATA #2

00020000: 33 DB 33 F6 66 33 D2 B8 00 00 C3 3.3.f3.....

OBJECT HEADER #3

2C virtual size

0 virtual address

2015 flags

Execute Read

Discardable

32-bit

4 map index

1 map size

444F4349 reserved

OBJECT PAGE MAP #3

Logical Physical File Flags

Page Page Offset Flags


00000001 00000004 00001600 Valid

RAW DATA #3

00000000: 0D 0A 44 5F 45 5F 42 5F 55 5F 47 3D 3D 3D 3E 53 ..D_E_B_U_G===>S

00000010: 74 68 56 58 44 3C 3D 3D 3D 0D 0A CC CC CC CC CC thVXD<===.......

00000020: E8 00 00 00 00 B8 01 00 00 00 C3 CC ............

Summary

相关推荐
听风说ml16 小时前
socket编程 【C语言】
c语言·udp·tcp·socket编程
学逆向的17 小时前
C 局部静态变量
c语言·开发语言·网络安全
Zwawa1 天前
从 printf 到曲线:把数据送上 VOFA+
c语言·单片机·嵌入式
二十七日秋1 天前
算法刷题笔记「Day 1|四道 OJ 入门题里的深坑」
c语言·汇编·数据结构·c++·笔记·python·算法
abc light1 天前
ARM 裸机开发(1)——ARM 体系结构
c语言·arm开发
Navigator_Z1 天前
LeetCode //C - 1309. Decrypt String from Alphabet to Integer Mapping
c语言·算法·leetcode
爱聊灵光的维C1 天前
C语言初阶:关于函数设计的详细讲解和注意事项
c语言·开发语言·青少年编程·蓝桥杯·学习方法
wuminyu1 天前
JVM规范学习总结:class执行性能差异
java·linux·c语言·jvm·c++
C++ 老炮儿的技术栈1 天前
Linux 动态库踩坑:明明重新编译了 .so,调用函数返回值却一直不变(libfjrobot.so 版本号异常排查实录)
linux·c语言·网络·c++·visual studio
小向是个Der2 天前
嵌入式进阶——MCU上电后的动作
c语言·单片机·mcu·学习·链接脚本