第3章 Windows运行机理-3.1 内核分析(5)

每个宏都有与它相对应的结束宏,例如,如果要在源文件中定义一个_LTEXT段,应该写成如下:

VxD_LOCKED_CODE_SEG

(把你的代码写在这里)

VxD_LOCKED_CODE_ENDS

我们可以用VC++ Dump工具提供的DUMPBIN工具来分析以下VxD的文件结构和组织机理。可以进入MS_DOS输入如下的命令行(在光碟上的第三章\cpu降温\COOLCPU\BIN路径下的STHVxD):

DUMPBIN /ALL STHVxD.VxD

就可以看到如下的信息:

Microsoft (R) COFF Binary File Dumper Version 6.00.8447

Copyright (C) Microsoft Corp 1992-1998. All rights reserved.

Dump of file sthvxd.vxd

File Type: VXD

454C magic number

0 byte order

0 word order

0 executable format level

2 CPU type (**)

4 operating system (**)

0 module version

38000 module flags

4 number of memory pages

2 object number of entry point

0 offset of entry point

0 object number of stack

0 offset of stack

200 memory page size

2C bytes on last page

61 fixup section size

0 fixup section checksum

6C loader section size

0 loader section checksum

C4 object table

3 object table entries

10C object map

0 iterated data map

0 resource table

0 resource table entries

11C resident names table

126 entry table

0 module directives table

0 module directives entries

130 fixup page table

144 fixup record table

191 imported modules name table

0 imported modules

191 imported procedures name table

0 page checksum table

1000 enumerated data pages

2 preload page count

162C non-resident name table

4E non-resident name table size

0 non-resident name checksum

0 automatic data object

0 debug information

0 debug information size

0 preload instance page count

0 demand instance page count

0 extra heap allocation

0 offset of Windows resources

0 size of Windows resources

ABC device id

400 DDK version

OBJECT HEADER #1

23C virtual size

0 virtual address

2045 flags

Execute Read

Has preload pages

32-bit

1 map index

2 map size

444F434C reserved

OBJECT PAGE MAP #1

Logical Physical File Flags

Page Page Offset Flags


00000001 00000001 00001000 Valid

00000002 00000002 00001200 Valid

RAW DATA #1

00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

00000010: 00 00 00 00 00 04 BC 0A 05 00 00 00 53 74 68 56 ............SthV

00000020: 58 44 20 20 00 00 00 80 00 00 00 00 00 00 00 00 XD ...�........

00000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

00000040: 00 00 00 00 00 00 00 00 00 00 00 00 76 65 72 50 ............verP

00000050: 50 00 00 00 31 76 73 52 32 76 73 52 33 76 73 52 P...1vsR2vsR3vsR

00000060: 8B 4C 24 08 85 C9 75 05 33 C0 C2 14 00 83 F9 FF .L$...u.3.......

00000070: 75 08 E8 69 00 00 00 C2 14 00 83 F9 03 76 08 B8 u..i.........v..

00000080: 32 00 00 00 C2 14 00 8B 44 24 14 8B 54 24 10 50 2.......D..T.P

00000090: 52 8B 44 24 14 8B 54 24 0C 50 52 FF 14 8D FC FF R.D..T.PR.....

000000A0: FF FF C2 14 00 CC CC CC CC CC CC CC CC CC CC CC ................

000000B0: A1 00 00 00 00 8B 4C 24 10 8B 49 18 85 C9 74 08 ......L$..I...t.

000000C0: 8B 09 89 0D 00 00 00 00 C2 10 00 CC CC CC CC CC ................

000000D0: E8 2A 01 00 00 B8 01 00 00 00 C3 CC CC CC CC CC .*..............

000000E0: B8 01 00 00 00 C3 CC CC CC CC CC CC CC CC CC CC ................

000000F0: 8B 44 24 04 83 F8 01 74 0A 83 F8 02 74 15 33 C0 .D$....t....t.3.

00000100: C2 0C 00 8B 44 24 08 50 E8 63 00 00 00 83 C4 04 ....D$.P.c......

00000110: C2 0C 00 8B 44 24 0C 8B 4C 24 08 50 51 E8 5E 00 ....D..L.PQ.^.

00000120: 00 00 83 C4 08 C2 0C 00 CC CC CC CC CC CC CC CC ................

00000130: 8B 44 24 04 83 F8 01 74 0A 83 F8 02 74 15 33 C0 .D$....t....t.3.

00000140: C2 0C 00 8B 44 24 08 50 E8 43 00 00 00 83 C4 04 ....D$.P.C......

00000150: C2 0C 00 8B 44 24 0C 8B 4C 24 08 50 51 E8 3E 00 ....D..L.PQ.>.

00000160: 00 00 83 C4 08 C2 0C 00 CC CC CC CC CC CC CC CC ................

00000170: B8 01 00 00 00 C3 CC CC CC CC CC CC CC CC CC CC ................

00000180: B8 02 00 00 00 C3 CC CC CC CC CC CC CC CC CC CC ................

00000190: B8 01 00 00 00 C3 CC CC CC CC CC CC CC CC CC CC ................

000001A0: B8 02 00 00 00 C3 CC CC 83 F8 1B 75 09 E8 00 00 ...........u....

000001B0: 00 00 83 F8 01 C3 83 F8 1C 75 09 E8 10 FF FF FF .........u......

000001C0: 83 F8 01 C3 83 F8 23 75 0E 56 52 53 51 55 E8 8D ......#u.VRSQU..

000001D0: FE FF FF 83 F8 01 C3 F8 C3 A1 00 00 00 00 85 C0 ................

000001E0: 75 02 F9 C3 FB F4 F9 C3 56 8D 35 00 00 00 00 CD u.......V.5.....

000001F0: 20 3A 00 01 00 5E B8 00 00 00 00 0F 93 C0 C3 56 :...^.........V

00000200: 8D 35 00 00 00 00 CD 20 2B 01 01 00 5E B8 00 00 .5..... +...^...

00000210: 00 00 0F 93 C0 C3 FF 75 18 FF 75 10 FF 75 1C E8 .......u..u..u..

00000220: CC FE FF FF 89 45 1C C3 FF 75 18 FF 75 10 FF 75 .....E...u..u..u

00000230: 1C E8 FA FE FF FF 89 45 1C C3 CC CC .......E....

OBJECT HEADER #2

B virtual size

0 virtual address

1005 flags

Execute Read

16:16 alias

3 map index

1 map size

444F4352 reserved

OBJECT PAGE MAP #2

Logical Physical File Flags

Page Page Offset Flags


00000001 00000003 00001400 Valid

RAW DATA #2

00020000: 33 DB 33 F6 66 33 D2 B8 00 00 C3 3.3.f3.....

OBJECT HEADER #3

2C virtual size

0 virtual address

2015 flags

Execute Read

Discardable

32-bit

4 map index

1 map size

444F4349 reserved

OBJECT PAGE MAP #3

Logical Physical File Flags

Page Page Offset Flags


00000001 00000004 00001600 Valid

RAW DATA #3

00000000: 0D 0A 44 5F 45 5F 42 5F 55 5F 47 3D 3D 3D 3E 53 ..D_E_B_U_G===>S

00000010: 74 68 56 58 44 3C 3D 3D 3D 0D 0A CC CC CC CC CC thVXD<===.......

00000020: E8 00 00 00 00 B8 01 00 00 00 C3 CC ............

Summary

相关推荐
宇木灵3 小时前
C语言基础-五、数组
c语言·开发语言·学习·算法
宇木灵4 小时前
C语言基础-三、流程控制语句
java·c语言·前端
StandbyTime5 小时前
C语言学习-菜鸟教程C经典100例-练习79
c语言
EmbedLinX8 小时前
C语言标准库stdlib.h
c语言·开发语言·笔记
我命由我123459 小时前
Visual Studio 文件的编码格式不一致问题:错误 C2001 常量中有换行符
c语言·开发语言·c++·ide·学习·学习方法·visual studio
小龙报10 小时前
【算法通关指南:数据结构与算法篇】二叉树相关算法题:1.二叉树深度 2.求先序排列
c语言·开发语言·数据结构·c++·算法·贪心算法·动态规划
Once_day11 小时前
GCC编译(6)静态库工具AR
c语言·ar·编译和链接
宇木灵11 小时前
C语言基础-六、指针
c语言·开发语言·学习·算法
二年级程序员11 小时前
一篇文章掌握“栈”
c语言·数据结构