ffdff000 处的结构 KPCR

imquestion imquestion 博客等级 墨衍会员 · AI 创作全网分发 墨衍智能分发 本文由作者通过墨衍一键同步至各平台 1分发平台 6.1k累计阅读 6.1k平均单平台 已同步平台 优快云 微信公众号 微博 知乎 掘金 百家号 博客园 抖音 小红书 你的文章也可以这样分发 墨衍会员 ¥399起/年，写一次发全网 我也要 码龄25年
关注
原创 最新推荐文章于 2026-04-07 09:20:59 发布 6.1k 阅读 AI 写同款· GEO 优化 ›
论文研究-基于KPCR结构的Windows物理内存分析方法.pdf 介绍了计算机在线取证方式的优势，总结了目前国外在计算机物理内存分析的研究现状及其存在的不足，在此基础上提出了一种新的Windows物理内存分析方法——基于KPCR结构的物理内存分析方法。与传统的物理内存方法相比，这种方法更为可靠，适用范围更广，具有很高的实用价值。 立即下载

ffdff000 处的结构 KPCR

作者: JIURL

                主页: http://jiurl.yeah.net

    日期: 2003-11-13

    ffdff000 处是一个叫做 KPCR 的结构，PCR 即 Processor Control Region ，处理器控制域。这是一个很有用的结构。系统本身就大量使用。

    下面是从 WinDbg 中得到的 win2k build 2195 的 KPCR 结构

struct _KPCR (sizeof=2832)
+000 struct _NT_TIB NtTib
+000 struct _EXCEPTION_REGISTRATION_RECORD *ExceptionList
+004 void *StackBase
+008 void *StackLimit
+00c void *SubSystemTib
+010 void *FiberData
+010 uint32 Version
+014 void *ArbitraryUserPointer
+018 struct _NT_TIB *Self
+01c struct _KPCR *SelfPcr
+020 struct _KPRCB *Prcb
+024 byte Irql
+028 uint32 IRR
+02c uint32 IrrActive
+030 uint32 IDR
+034 uint32 Reserved2
+038 struct _KIDTENTRY *IDT
+03c struct _KGDTENTRY *GDT
+040 struct _KTSS *TSS
+044 uint16 MajorVersion
+046 uint16 MinorVersion
+048 uint32 SetMember
+04c uint32 StallScaleFactor
+050 byte DebugActive
+051 byte Number
+052 byte VdmAlert
+053 byte Reserved[1]
+054 uint32 KernelReserved[15]
+090 uint32 SecondLevelCacheSize
+094 uint32 HalReserved[16]
+0d4 uint32 InterruptMode
+0d8 byte Spare1
+0dc uint32 KernelReserved2[17]
+120 struct _KPRCB PrcbData
+120 uint16 MinorVersion
+122 uint16 MajorVersion
+124 struct _KTHREAD *CurrentThread
+128 struct _KTHREAD *NextThread
+12c struct _KTHREAD *IdleThread
+130 char Number
+131 char Reserved
+132 uint16 BuildType
+134 uint32 SetMember
+138 char CpuType
+139 char CpuID
+13a uint16 CpuStep
+13c struct _KPROCESSOR_STATE ProcessorState
+13c struct _CONTEXT ContextFrame
+13c uint32 ContextFlags
+140 uint32 Dr0
+144 uint32 Dr1
+148 uint32 Dr2
+14c uint32 Dr3
+150 uint32 Dr6
+154 uint32 Dr7
+158 struct _FLOATING_SAVE_AREA FloatSave
+158 uint32 ControlWord
+15c uint32 StatusWord
+160 uint32 TagWord
+164 uint32 ErrorOffset
+168 uint32 ErrorSelector
+16c uint32 DataOffset
+170 uint32 DataSelector
+174 byte RegisterArea[80]
+1c4 uint32 Cr0NpxState
+1c8 uint32 SegGs
+1cc uint32 SegFs
+1d0 uint32 SegEs
+1d4 uint32 SegDs
+1d8 uint32 Edi
+1dc uint32 Esi
+1e0 uint32 Ebx
+1e4 uint32 Edx
+1e8 uint32 Ecx
+1ec uint32 Eax
+1f0 uint32 Ebp
+1f4 uint32 Eip
+1f8 uint32 SegCs
+1fc uint32 EFlags
+200 uint32 Esp
+204 uint32 SegSs
+208 byte ExtendedRegisters[512]
+408 struct _KSPECIAL_REGISTERS SpecialRegisters
+408 uint32 Cr0
+40c uint32 Cr2
+410 uint32 Cr3
+414 uint32 Cr4
+418 uint32 KernelDr0
+41c uint32 KernelDr1
+420 uint32 KernelDr2
+424 uint32 KernelDr3
+428 uint32 KernelDr6
+42c uint32 KernelDr7
+430 struct _DESCRIPTOR Gdtr
+430 uint16 Pad
+432 uint16 Limit
+434 uint32 Base
+438 struct _DESCRIPTOR Idtr
+438 uint16 Pad
+43a uint16 Limit
+43c uint32 Base
+440 uint16 Tr
+442 uint16 Ldtr
+444 uint32 Reserved[6]
+45c uint32 KernelReserved[16]
+49c uint32 HalReserved[16]
+4dc struct _KSPIN_LOCK_QUEUE LockQueue[16]
struct _KSPIN_LOCK_QUEUE *Next
uint32 *Lock
+55c struct _KTHREAD *NpxThread
+560 uint32 InterruptCount
+564 uint32 KernelTime
+568 uint32 UserTime
+56c uint32 DpcTime
+570 uint32 InterruptTime
+574 uint32 ApcBypassCount
+578 uint32 DpcBypassCount
+57c uint32 AdjustDpcThreshold
+580 uint32 DebugDpcTime
+584 uint32 Spare2[4]
+594 uint32 ThreadStartCount[2]
+59c void *SpareHotData[2]
+5a4 uint32 CcFastReadNoWait
+5a8 uint32 CcFastReadWait
+5ac uint32 CcFastReadNotPossible
+5b0 uint32 CcCopyReadNoWait
+5b4 uint32 CcCopyReadWait
+5b8 uint32 CcCopyReadNoWaitMiss
+5bc uint32 KeAlignmentFixupCount
+5c0 uint32 KeContextSwitches
+5c4 uint32 KeDcacheFlushCount
+5c8 uint32 KeExceptionDispatchCount
+5cc uint32 KeFirstLevelTbFills
+5d0 uint32 KeFloatingEmulationCount
+5d4 uint32 KeIcacheFlushCount
+5d8 uint32 KeSecondLevelTbFills
+5dc uint32 KeSystemCalls
+5e0 uint32 ReservedCounter[8]
+600 void *SmallIrpFreeEntry
+604 void *LargeIrpFreeEntry
+608 void *MdlFreeEntry
+60c void *CreateInfoFreeEntry
+610 void *NameBufferFreeEntry
+614 void *SharedCacheMapEntry
+618 uint32 CachePad0[2]
+620 struct _PP_LOOKASIDE_LIST PPLookasideList[16]
struct _NPAGED_LOOKASIDE_LIST *P
struct _NPAGED_LOOKASIDE_LIST *L
+6a0 struct _PP_LOOKASIDE_LIST PPNPagedLookasideList[8]
struct _NPAGED_LOOKASIDE_LIST *P
struct _NPAGED_LOOKASIDE_LIST *L
+6e0 struct _PP_LOOKASIDE_LIST PPPagedLookasideList[8]
struct _NPAGED_LOOKASIDE_LIST *P
struct _NPAGED_LOOKASIDE_LIST *L
+720 byte ReservedPad[128]
+7a0 void *CurrentPacket[3]
+7ac uint32 TargetSet
+7b0 function *WorkerRoutine
+7b4 uint32 IpiFrozen
+7b8 uint32 CachePad1[2]
+7c0 uint32 RequestSummary
+7c4 struct _KPRCB *SignalDone
+7c8 uint32 ReverseStall
+7cc void *IpiFrame
+7d0 uint32 CachePad2[4]
+7e0 uint32 DpcInterruptRequested
+7e4 void *ChainedInterruptList
+7e8 uint32 CachePad3[2]
+7f0 uint32 MaximumDpcQueueDepth
+7f4 uint32 MinimumDpcRate
+7f8 uint32 CachePad4[2]
+800 struct _LIST_ENTRY DpcListHead
+800 struct _LIST_ENTRY *Flink
+804 struct _LIST_ENTRY *Blink
+808 uint32 DpcQueueDepth
+80c uint32 DpcRoutineActive
+810 uint32 DpcCount
+814 uint32 DpcLastCount
+818 uint32 DpcRequestRate
+81c void *DpcStack
+820 uint32 KernelReserved2[10]
+848 uint32 DpcLock
+84c byte SkipTick
+84d byte VendorString[13]
+85c uint32 MHz
+860 uint32 FeatureBits
+868 union _LARGE_INTEGER UpdateSignature
+868 uint32 LowPart
+86c int32 HighPart
+868 struct __unnamed3 u
+868 uint32 LowPart
+86c int32 HighPart
+868 int64 QuadPart
+870 uint32 QuantumEnd
+878 struct _PROCESSOR_POWER_STATE PowerState
+878 function *IdleFunction
+87c uint32 Idle0KernelTimeLimit
+880 uint32 Idle0LastTime
+884 void *IdleState
+888 uint64 LastCheck
+890 struct PROCESSOR_IDLE_TIMES IdleTimes
+890 uint64 StartTime
+898 uint64 EndTime
+8a0 uint32 IdleHandlerReserved[4]
+8b0 uint32 IdleTime1
+8b4 uint32 PromotionCheck
+8b8 uint32 IdleTime2
+8bc byte CurrentThrottle
+8bd byte ThrottleLimit
+8be byte Spare1[2]
+8c0 uint32 SetMember
+8c4 void *AbortThrottle
+8c8 uint64 DebugDelta
+8d0 uint32 DebugCount
+8d4 uint32 LastSysTime
+8d8 uint32 Spare2[10]
+900 struct _FX_SAVE_AREA NpxSaveArea
+900 union __unnamed63 U
+900 struct _FNSAVE_FORMAT FnArea
+900 uint32 ControlWord
+904 uint32 StatusWord
+908 uint32 TagWord
+90c uint32 ErrorOffset
+910 uint32 ErrorSelector
+914 uint32 DataOffset
+918 uint32 DataSelector
+91c byte RegisterArea[80]
+900 struct _FXSAVE_FORMAT FxArea
+900 uint16 ControlWord
+902 uint16 StatusWord
+904 uint16 TagWord
+906 uint16 ErrorOpcode
+908 uint32 ErrorOffset
+90c uint32 ErrorSelector
+910 uint32 DataOffset
+914 uint32 DataSelector
+918 uint32 MXCsr
+91c uint32 Reserved2
+920 byte RegisterArea[128]
+9a0 byte Reserved3[128]
+a20 byte Reserved4[224]
+b00 byte Align16Byte[8]
+b08 uint32 NpxSavedCpu
+b0c uint32 Cr0NpxState

某一时刻 KPCR 中的值
struct _KPCR (sizeof=2832)
+000 struct _NT_TIB NtTib
+000 struct _EXCEPTION_REGISTRATION_RECORD *ExceptionList = 8046F7CC
+004 void *StackBase = 8046FE30
+008 void *StackLimit = 8046D040
+00c void *SubSystemTib = 00000000
+010 void *FiberData = 00000000
+010 uint32 Version = 00000000
+014 void *ArbitraryUserPointer = 00000000
+018 struct _NT_TIB *Self = 00000000
+01c struct _KPCR *SelfPcr = FFDFF000
+020 struct _KPRCB *Prcb = FFDFF120
+024 byte Irql = 00 .
+028 uint32 IRR = 00000000
+02c uint32 IrrActive = 00000000
+030 uint32 IDR = ffffffff
+034 uint32 Reserved2 = 00000000
+038 struct _KIDTENTRY *IDT = 80036400
+03c struct _KGDTENTRY *GDT = 80036000
+040 struct _KTSS *TSS = 80223000
+044 uint16 MajorVersion = 0001
+046 uint16 MinorVersion = 0001
+048 uint32 SetMember = 00000001
+04c uint32 StallScaleFactor = 00000064
+050 byte DebugActive = 00 .
+051 byte Number = 00 .
+052 byte VdmAlert = 00 .
+053 byte Reserved[1] = 00 .
+054 uint32 KernelReserved[15] = 00000000 00000000 00000000 00000000 .... .... .... ....
00000000 00000000 00000000 00000000 .... .... .... ....
00000000 00000000 00000000 00000000 .... .... .... ....
00000000 00000000 00000000 .... .... ....
+090 uint32 SecondLevelCacheSize = 00020000
+094 uint32 HalReserved[16] = 00000000 00000000 00000000 00000000 .... .... .... ....
00000000 00000000 00000000 00000000 .... .... .... ....
00000000 00000000 00000000 00000000 .... .... .... ....
00000000 00000000 00000000 00000000 .... .... .... ....
+0d4 uint32 InterruptMode = 00000000
+0d8 byte Spare1 = 00 .
+0dc uint32 KernelReserved2[17] = 00000000 00000000 00000000 00000000 .... .... .... ....
00000000 00000000 00000000 00000000 .... .... .... ....
00000000 00000000 00000000 00000000 .... .... .... ....
00000000 00000000 00000000 00000000 .... .... .... ....
00000000 ....
+120 struct _KPRCB PrcbData
+120 uint16 MinorVersion = 0001
+122 uint16 MajorVersion = 0001
+124 struct _KTHREAD *CurrentThread = 8046BDF0
+128 struct _KTHREAD *NextThread = 00000000
+12c struct _KTHREAD *IdleThread = 8046BDF0
+130 char Number = 00 .
+131 char Reserved = 00 .
+132 uint16 BuildType = 0002
+134 uint32 SetMember = 00000001
+138 char CpuType = 06 .
+139 char CpuID = 01 .
+13a uint16 CpuStep = 0608
+13c struct _KPROCESSOR_STATE ProcessorState
+13c struct _CONTEXT ContextFrame
+13c uint32 ContextFlags = 00010017
+140 uint32 Dr0 = 00000000
+144 uint32 Dr1 = 00000000
+148 uint32 Dr2 = 00000000
+14c uint32 Dr3 = 00000000
+150 uint32 Dr6 = 00000023
+154 uint32 Dr7 = 00000000
+158 struct _FLOATING_SAVE_AREA FloatSave
+158 uint32 ControlWord = 00000000
+15c uint32 StatusWord = 00000000
+160 uint32 TagWord = 00000000
+164 uint32 ErrorOffset = 00000000
+168 uint32 ErrorSelector = 00000000
+16c uint32 DataOffset = 00000000
+170 uint32 DataSelector = 00000000
+174 byte RegisterArea[80] = 00 00 00 00 18 fc 46 80 . . . . . . F .
70 00 43 80 00 fc 46 80 p . C . . . F .
00 00 00 00 8c f8 46 80 . . . . . . F .
17 00 01 00 00 00 00 00 . . . . . . . .
+1c4 uint32 Cr0NpxState = 00000023
+1c8 uint32 SegGs = 00000000
+1cc uint32 SegFs = 00000030
+1d0 uint32 SegEs = 00000023
+1d4 uint32 SegDs = 00000023
+1d8 uint32 Edi = fe4cf228
+1dc uint32 Esi = fe4f50e0
+1e0 uint32 Ebx = ffffffff
+1e4 uint32 Edx = 8047e684
+1e8 uint32 Ecx = 000000b1
+1ec uint32 Eax = 00000001
+1f0 uint32 Ebp = 8046fc8c
+1f4 uint32 Eip = fe1c2806
+1f8 uint32 SegCs = 00000008
+1fc uint32 EFlags = 00000246
+200 uint32 Esp = 8046fc88
+204 uint32 SegSs = 00000010
+208 byte ExtendedRegisters[512] = 10 00 00 00 10 00 00 00 . . . . . . . .
10 00 00 00 9c 6a 06 80 . . . . . j . .
9c 6a 06 80 fe 03 00 00 . j . . . . . .
00 00 00 00 88 a4 06 80 . . . . . . . .
+408 struct _KSPECIAL_REGISTERS SpecialRegisters
+408 uint32 Cr0 = 8001003b
+40c uint32 Cr2 = 77e1fe01
+410 uint32 Cr3 = 00030000
+414 uint32 Cr4 = 000002d1
+418 uint32 KernelDr0 = 00000000
+41c uint32 KernelDr1 = 00000000
+420 uint32 KernelDr2 = 00000000
+424 uint32 KernelDr3 = 00000000
+428 uint32 KernelDr6 = ffff0ff0
+42c uint32 KernelDr7 = 00000400
+430 struct _DESCRIPTOR Gdtr
+430 uint16 Pad = 0000
+432 uint16 Limit = 03ff
+434 uint32 Base = 80036000
+438 struct _DESCRIPTOR Idtr
+438 uint16 Pad = 0000
+43a uint16 Limit = 07ff
+43c uint32 Base = 80036400
+440 uint16 Tr = 0028
+442 uint16 Ldtr = 0000
+444 uint32 Reserved[6] = 00000000 00000000 00000000 00000000 .... .... .... ....
00000000 00000000 .... ....
+45c uint32 KernelReserved[16] = 00000000 00000000 00000000 00000000 .... .... .... ....
00000000 00000000 00000000 00000000 .... .... .... ....
00000000 00000000 00000000 00000000 .... .... .... ....
00000000 00000000 00000000 00000000 .... .... .... ....
+49c uint32 HalReserved[16] = 00000000 00001010 00000000 00000000 .... .... .... ....
00000000 00000000 00000000 00000000 .... .... .... ....
00000000 00000000 00000000 00000000 .... .... .... ....
00000000 00000000 00000000 00000000 .... .... .... ....
+4dc struct _KSPIN_LOCK_QUEUE LockQueue[16]
+4dc LockQueue[0]
+4dc struct _KSPIN_LOCK_QUEUE *Next = 00000000
+4e0 uint32 *Lock = 00000000
+4e4 LockQueue[1]
+4e4 struct _KSPIN_LOCK_QUEUE *Next = 00000000
+4e8 uint32 *Lock = 00000000
+4ec LockQueue[2]
+4ec struct _KSPIN_LOCK_QUEUE *Next = 00000000
+4f0 uint32 *Lock = 00000000
+4f4 LockQueue[3]
+4f4 struct _KSPIN_LOCK_QUEUE *Next = 00000000
+4f8 uint32 *Lock = 00000000
+4fc LockQueue[4]
+4fc struct _KSPIN_LOCK_QUEUE *Next = 00000000
+500 uint32 *Lock = 00000000
+504 LockQueue[5]
+504 struct _KSPIN_LOCK_QUEUE *Next = 00000000
+508 uint32 *Lock = 00000000
+50c LockQueue[6]
+50c struct _KSPIN_LOCK_QUEUE *Next = 00000000
+510 uint32 *Lock = 00000000
+514 LockQueue[7]
+514 struct _KSPIN_LOCK_QUEUE *Next = 00000000
+518 uint32 *Lock = 00000000
+51c LockQueue[8]
+51c struct _KSPIN_LOCK_QUEUE *Next = 00000000
+520 uint32 *Lock = 00000000
+524 LockQueue[9]
+524 struct _KSPIN_LOCK_QUEUE *Next = 00000000
+528 uint32 *Lock = 00000000
+52c LockQueue[10]
+52c struct _KSPIN_LOCK_QUEUE *Next = 00000000
+530 uint32 *Lock = 00000000
+534 LockQueue[11]
+534 struct _KSPIN_LOCK_QUEUE *Next = 00000000
+538 uint32 *Lock = 00000000
+53c LockQueue[12]
+53c struct _KSPIN_LOCK_QUEUE *Next = 00000000
+540 uint32 *Lock = 00000000
+544 LockQueue[13]
+544 struct _KSPIN_LOCK_QUEUE *Next = 00000000
+548 uint32 *Lock = 00000000
+54c LockQueue[14]
+54c struct _KSPIN_LOCK_QUEUE *Next = 00000000
+550 uint32 *Lock = 00000000
+554 LockQueue[15]
+554 struct _KSPIN_LOCK_QUEUE *Next = 00000000
+558 uint32 *Lock = 00000000
+55c struct _KTHREAD *NpxThread = 00000000
+560 uint32 InterruptCount = 00004aca
+564 uint32 KernelTime = 00003396
+568 uint32 UserTime = 000002d9
+56c uint32 DpcTime = 0000007b
+570 uint32 InterruptTime = 000003fb
+574 uint32 ApcBypassCount = 00001709
+578 uint32 DpcBypassCount = 00000000
+57c uint32 AdjustDpcThreshold = 00000014
+580 uint32 DebugDpcTime = 00000000
+584 uint32 Spare2[4] = 00000000 00000000 00000000 00000000 .... .... .... ....
+594 uint32 ThreadStartCount[2] = 00000000 00000000 .... ....
+59c void *SpareHotData[2] = 00000000
00000000
+5a4 uint32 CcFastReadNoWait = 00000000
+5a8 uint32 CcFastReadWait = 00000000
+5ac uint32 CcFastReadNotPossible = 00000000
+5b0 uint32 CcCopyReadNoWait = 00000000
+5b4 uint32 CcCopyReadWait = 00000000
+5b8 uint32 CcCopyReadNoWaitMiss = 00000000
+5bc uint32 KeAlignmentFixupCount = 00000000
+5c0 uint32 KeContextSwitches = 0000b897
+5c4 uint32 KeDcacheFlushCount = 00000000
+5c8 uint32 KeExceptionDispatchCount = 000007fe
+5cc uint32 KeFirstLevelTbFills = 00000000
+5d0 uint32 KeFloatingEmulationCount = 00000000
+5d4 uint32 KeIcacheFlushCount = 00000000
+5d8 uint32 KeSecondLevelTbFills = 00000000
+5dc uint32 KeSystemCalls = 00050211
+5e0 uint32 ReservedCounter[8] = 00000000 00000000 00000000 00000000 .... .... .... ....
00000000 00000000 00000000 00000000 .... .... .... ....
+600 void *SmallIrpFreeEntry = 00000000
+604 void *LargeIrpFreeEntry = 00000000
+608 void *MdlFreeEntry = 00000000
+60c void *CreateInfoFreeEntry = 00000000
+610 void *NameBufferFreeEntry = 00000000
+614 void *SharedCacheMapEntry = 00000000
+618 uint32 CachePad0[2] = 00000000 00000000 .... ....
+620 struct _PP_LOOKASIDE_LIST PPLookasideList[16]
+620 PPLookasideList[0]
+620 struct _NPAGED_LOOKASIDE_LIST *P = FE4EC808
+624 struct _NPAGED_LOOKASIDE_LIST *L = 804758A0
+628 PPLookasideList[1]
+628 struct _NPAGED_LOOKASIDE_LIST *P = FE4EC868
+62c struct _NPAGED_LOOKASIDE_LIST *L = 804756A0
+630 PPLookasideList[2]
+630 struct _NPAGED_LOOKASIDE_LIST *P = FE4EC7A8
+634 struct _NPAGED_LOOKASIDE_LIST *L = 80475740
+638 PPLookasideList[3]
+638 struct _NPAGED_LOOKASIDE_LIST *P = FE4F4748
+63c struct _NPAGED_LOOKASIDE_LIST *L = 8047F8A0
+640 PPLookasideList[4]
+640 struct _NPAGED_LOOKASIDE_LIST *P = FE4F46E8
+644 struct _NPAGED_LOOKASIDE_LIST *L = 8047F900
+648 PPLookasideList[5]
+648 struct _NPAGED_LOOKASIDE_LIST *P = FE4F1168
+64c struct _NPAGED_LOOKASIDE_LIST *L = 80472100
+650 PPLookasideList[6]
+650 struct _NPAGED_LOOKASIDE_LIST *P = FE4EC8C8
+654 struct _NPAGED_LOOKASIDE_LIST *L = 80475800
+658 PPLookasideList[7]
+658 struct _NPAGED_LOOKASIDE_LIST *P = 00000000
+65c struct _NPAGED_LOOKASIDE_LIST *L = 00000000
+660 PPLookasideList[8]
+660 struct _NPAGED_LOOKASIDE_LIST *P = 00000000
+664 struct _NPAGED_LOOKASIDE_LIST *L = 00000000
+668 PPLookasideList[9]
+668 struct _NPAGED_LOOKASIDE_LIST *P = 00000000
+66c struct _NPAGED_LOOKASIDE_LIST *L = 00000000
+670 PPLookasideList[10]
+670 struct _NPAGED_LOOKASIDE_LIST *P = 00000000
+674 struct _NPAGED_LOOKASIDE_LIST *L = 00000000
+678 PPLookasideList[11]
+678 struct _NPAGED_LOOKASIDE_LIST *P = 00000000
+67c struct _NPAGED_LOOKASIDE_LIST *L = 00000000
+680 PPLookasideList[12]
+680 struct _NPAGED_LOOKASIDE_LIST *P = 00000000
+684 struct _NPAGED_LOOKASIDE_LIST *L = 00000000
+688 PPLookasideList[13]
+688 struct _NPAGED_LOOKASIDE_LIST *P = 00000000
+68c struct _NPAGED_LOOKASIDE_LIST *L = 00000000
+690 PPLookasideList[14]
+690 struct _NPAGED_LOOKASIDE_LIST *P = 00000000
+694 struct _NPAGED_LOOKASIDE_LIST *L = 00000000
+698 PPLookasideList[15]
+698 struct _NPAGED_LOOKASIDE_LIST *P = 00000000
+69c struct _NPAGED_LOOKASIDE_LIST *L = 00000000
+6a0 struct _PP_LOOKASIDE_LIST PPNPagedLookasideList[8]
+6a0 PPNPagedLookasideList[0]
+6a0 struct _NPAGED_LOOKASIDE_LIST *P = FE4F2308
+6a4 struct _NPAGED_LOOKASIDE_LIST *L = 80472A00
+6a8 PPNPagedLookasideList[1]
+6a8 struct _NPAGED_LOOKASIDE_LIST *P = FE4F1BA8
+6ac struct _NPAGED_LOOKASIDE_LIST *L = 80472A50
+6b0 PPNPagedLookasideList[2]
+6b0 struct _NPAGED_LOOKASIDE_LIST *P = FE4F1AE8
+6b4 struct _NPAGED_LOOKASIDE_LIST *L = 80472AA0
+6b8 PPNPagedLookasideList[3]
+6b8 struct _NPAGED_LOOKASIDE_LIST *P = FE4F1A28
+6bc struct _NPAGED_LOOKASIDE_LIST *L = 80472AF0
+6c0 PPNPagedLookasideList[4]
+6c0 struct _NPAGED_LOOKASIDE_LIST *P = FE4F1968
+6c4 struct _NPAGED_LOOKASIDE_LIST *L = 80472B40
+6c8 PPNPagedLookasideList[5]
+6c8 struct _NPAGED_LOOKASIDE_LIST *P = FE4F18A8
+6cc struct _NPAGED_LOOKASIDE_LIST *L = 80472B90
+6d0 PPNPagedLookasideList[6]
+6d0 struct _NPAGED_LOOKASIDE_LIST *P = FE4F17E8
+6d4 struct _NPAGED_LOOKASIDE_LIST *L = 80472BE0
+6d8 PPNPagedLookasideList[7]
+6d8 struct _NPAGED_LOOKASIDE_LIST *P = FE4F1728
+6dc struct _NPAGED_LOOKASIDE_LIST *L = 80472C30
+6e0 struct _PP_LOOKASIDE_LIST PPPagedLookasideList[8]
+6e0 PPPagedLookasideList[0]
+6e0 struct _NPAGED_LOOKASIDE_LIST *P = FE4F22A8
+6e4 struct _NPAGED_LOOKASIDE_LIST *L = 80472CA0
+6e8 PPPagedLookasideList[1]
+6e8 struct _NPAGED_LOOKASIDE_LIST *P = FE4F1B48
+6ec struct _NPAGED_LOOKASIDE_LIST *L = 80472CF0
+6f0 PPPagedLookasideList[2]
+6f0 struct _NPAGED_LOOKASIDE_LIST *P = FE4F1A88
+6f4 struct _NPAGED_LOOKASIDE_LIST *L = 80472D40
+6f8 PPPagedLookasideList[3]
+6f8 struct _NPAGED_LOOKASIDE_LIST *P = FE4F19C8
+6fc struct _NPAGED_LOOKASIDE_LIST *L = 80472D90
+700 PPPagedLookasideList[4]
+700 struct _NPAGED_LOOKASIDE_LIST *P = FE4F1908
+704 struct _NPAGED_LOOKASIDE_LIST *L = 80472DE0
+708 PPPagedLookasideList[5]
+708 struct _NPAGED_LOOKASIDE_LIST *P = FE4F1848
+70c struct _NPAGED_LOOKASIDE_LIST *L = 80472E30
+710 PPPagedLookasideList[6]
+710 struct _NPAGED_LOOKASIDE_LIST *P = FE4F1788
+714 struct _NPAGED_LOOKASIDE_LIST *L = 80472E80
+718 PPPagedLookasideList[7]
+718 struct _NPAGED_LOOKASIDE_LIST *P = FE4F16C8
+71c struct _NPAGED_LOOKASIDE_LIST *L = 80472ED0
+720 byte ReservedPad[128] = 00 00 00 00 00 00 00 00 . . . . . . . .
00 00 00 00 00 00 00 00 . . . . . . . .
00 00 00 00 00 00 00 00 . . . . . . . .
00 00 00 00 00 00 00 00 . . . . . . . .
+7a0 void *CurrentPacket[3] = 00000000
00000000
00000000
+7ac uint32 TargetSet = 00000000
+7b0 function *WorkerRoutine = 00000000
+7b4 uint32 IpiFrozen = 00000000
+7b8 uint32 CachePad1[2] = 00000000 00000000 .... ....
+7c0 uint32 RequestSummary = 00000000
+7c4 struct _KPRCB *SignalDone = 00000000
+7c8 uint32 ReverseStall = 00000004
+7cc void *IpiFrame = 00000000
+7d0 uint32 CachePad2[4] = 00000000 00000000 00000000 00000000 .... .... .... ....
+7e0 uint32 DpcInterruptRequested = 00000001
+7e4 void *ChainedInterruptList = 00000000
+7e8 uint32 CachePad3[2] = 00000000 00000000 .... ....
+7f0 uint32 MaximumDpcQueueDepth = 00000001
+7f4 uint32 MinimumDpcRate = 00000003
+7f8 uint32 CachePad4[2] = 00000000 00000000 .... ....
+800 struct _LIST_ENTRY DpcListHead
+800 struct _LIST_ENTRY *Flink = 8047E684
+804 struct _LIST_ENTRY *Blink = FE4F5260
+808 uint32 DpcQueueDepth = 00000002
+80c uint32 DpcRoutineActive = 00000000
+810 uint32 DpcCount = 000023c1
+814 uint32 DpcLastCount = 000023c0
+818 uint32 DpcRequestRate = 00000000
+81c void *DpcStack = F9024000
+820 uint32 KernelReserved2[10] = 00000000 00000000 00000000 00000000 .... .... .... ....
00000000 00000000 00000000 00000000 .... .... .... ....
00000000 00000000 .... ....
+848 uint32 DpcLock = 00000000
+84c byte SkipTick = 00 .
+84d byte VendorString[13] = 47 65 6e 75 69 6e 65 49 G e n u i n e I
6e 74 65 6c 00 n t e l .
+85c uint32 MHz = 00000227
+860 uint32 FeatureBits = 00000fff
+868 union _LARGE_INTEGER UpdateSignature
+868 uint32 LowPart = 00000000
+86c int32 HighPart = 00000000
+868 struct __unnamed3 u
+868 uint32 LowPart = 00000000
+86c int32 HighPart = 00000000
+868 int64 QuadPart = 0000000000000000
+870 uint32 QuantumEnd = 00000000
+878 struct _PROCESSOR_POWER_STATE PowerState
+878 function *IdleFunction = 80450804
+87c uint32 Idle0KernelTimeLimit = ffffffff
+880 uint32 Idle0LastTime = 00000000
+884 void *IdleState = 00000000
+888 uint64 LastCheck = 0000000000000000
+890 struct PROCESSOR_IDLE_TIMES IdleTimes
+890 uint64 StartTime = 0000000000000000
+898 uint64 EndTime = 0000000000000000
+8a0 uint32 IdleHandlerReserved[4] = 00000000 00000000 00000000 00000000 .... .... .... ....
+8b0 uint32 IdleTime1 = 00000000
+8b4 uint32 PromotionCheck = 00000000
+8b8 uint32 IdleTime2 = 00000000
+8bc byte CurrentThrottle = 08 .
+8bd byte ThrottleLimit = 08 .
+8be byte Spare1[2] = 00 00 . .
+8c0 uint32 SetMember = 00000001
+8c4 void *AbortThrottle = 00000000
+8c8 uint64 DebugDelta = 0000000000000000
+8d0 uint32 DebugCount = 00000000
+8d4 uint32 LastSysTime = 00000000
+8d8 uint32 Spare2[10] = 00000000 00000000 00000000 00000000 .... .... .... ....
00000000 00000000 00000000 00000000 .... .... .... ....
00000000 00000000 .... ....
+900 struct _FX_SAVE_AREA NpxSaveArea
+900 union __unnamed63 U
+900 struct _FNSAVE_FORMAT FnArea
+900 uint32 ControlWord = 00000000
+904 uint32 StatusWord = 00000000
+908 uint32 TagWord = 00000000
+90c uint32 ErrorOffset = 00000000
+910 uint32 ErrorSelector = 00000000
+914 uint32 DataOffset = 00000000
+918 uint32 DataSelector = 00000000
+91c byte RegisterArea[80] = 00 00 00 00 00 00 00 00 . . . . . . . .
00 00 00 00 00 00 00 00 . . . . . . . .
00 00 00 00 00 00 00 00 . . . . . . . .
00 00 00 00 00 00 00 00 . . . . . . . .
+900 struct _FXSAVE_FORMAT FxArea
+900 uint16 ControlWord = 0000
+902 uint16 StatusWord = 0000
+904 uint16 TagWord = 0000
+906 uint16 ErrorOpcode = 0000
+908 uint32 ErrorOffset = 00000000
+90c uint32 ErrorSelector = 00000000
+910 uint32 DataOffset = 00000000
+914 uint32 DataSelector = 00000000
+918 uint32 MXCsr = 00000000
+91c uint32 Reserved2 = 00000000
+920 byte RegisterArea[128] = 00 00 00 00 00 00 00 00 . . . . . . . .
00 00 00 00 00 00 00 00 . . . . . . . .
00 00 00 00 00 00 00 00 . . . . . . . .
00 00 00 00 00 00 00 00 . . . . . . . .
+9a0 byte Reserved3[128] = 00 00 00 00 00 00 00 00 . . . . . . . .
00 00 00 00 00 00 00 00 . . . . . . . .
00 00 00 00 00 00 00 00 . . . . . . . .
00 00 00 00 00 00 00 00 . . . . . . . .
+a20 byte Reserved4[224] = 00 00 00 00 00 00 00 00 . . . . . . . .
00 00 00 00 00 00 00 00 . . . . . . . .
00 00 00 00 00 00 00 00 . . . . . . . .
00 00 00 00 00 00 00 00 . . . . . . . .
+b00 byte Align16Byte[8] = 00 00 00 00 00 00 00 00 . . . . . . . .
+b08 uint32 NpxSavedCpu = 00000000
+b0c uint32 Cr0NpxState = 00000000

使用 WinDbg 的 !pcr 命令可以得到一个简单的 pcr 的输出

某一时刻使用 !pcr 的输出

kd> !pcr
PCR Processor 0 @ffdff000
NtTib.ExceptionList: 8046f7cc
NtTib.StackBase: 8046fe30
NtTib.StackLimit: 8046d040
NtTib.SubSystemTib: 00000000
NtTib.Version: 00000000
NtTib.UserPointer: 00000000
NtTib.SelfTib: 00000000

SelfPcr: ffdff000
Prcb: ffdff120
Irql: 00000000
IRR: 00000000
IDR: ffffffff
InterruptMode: 00000000
IDT: 80036400
GDT: 80036000
TSS: 80223000

CurrentThread: 8046bdf0
NextThread: 00000000
IdleThread: 8046bdf0

DpcQueue: 0x8047e680 0x80431669 nt!KiTimerExpiration
0xfe4f525c 0xfe1c1190 i8042prt!I8042KeyboardIsrDpc

欢迎交流，欢迎交朋友，
欢迎访问 http://jiurl.yeah.net http://jiurl.cosoft.org.cn/forum

　

　

标签
#struct #list #byte #descriptor #c
#exception
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
HFSS新手避坑指南：从零搭建T形波导功分器（含参数扫描与优化实战） 本文为HFSS新手提供T形波导功分器设计的详细指南，涵盖基础设置、建模技巧、参数扫描与优化实战。重点解析内场分析中的常见陷阱，如单位设置、波端口定义和布尔运算错误，并分享优化设计的关键步骤，帮助工程师快速掌握HFSS在微波器件设计中的应用。 阅读详情

相关推荐

Multisim14.3主数据库访问冲突：Windows更新KB5065426卸载与系统兼容性修复指南

本文针对Multisim14.3在Windows更新KB5065426后出现的主数据库访问冲突问题，提供了详细的解决方案。通过卸载问题更新、修复系统兼容性及调整权限设置，帮助用户快速恢复元器件库的正常访问，确保电路仿真设计的连续性。

lstm7chronicler的博客 514

windows内核下的一些东西

内核地址0xFFDF0000和用户地址0x7FFE0000都指向同一物理页面。 内核地址是可写的，但用户地址则不能。也就说是说，我们可以在ring0层把信息写入到0xFFDF0000~0xFFDF0FFF的4K虚拟页面空间，由于用户地址0x7FFE0000也指向这个物理页面，所以我们在0xFFDF0000~0xFFDF0FFF地址写入的代码，在用户空间可以访问到。该共享区域的大小是4K。内核占用其中一部分，内存区域的名称是KUSER_SHARED_DATA。可以在WinDbg中看看。   lkd>  d

菜鸟蛋的专栏 1040

DAZ STUDIO 快速渲染技巧

DAZ STUDIO 快速渲染技巧： 本文将向您展示几个快速渲染技巧。您将学习如何使您的Daz Iray渲染和照明在Daz工作室内更快。 当你有一个大场景，这可能需要很多小时进行渲染。 但是如果你想大幅度降低渲染时间呢？这篇文章的提示应该能让你达到这个目标。 首先，我们需要弄清楚一件事——没有“完美的环境或设置”这样的东西。是因为渲染设置是高度个性化和主观性的东西，这主要取决于场景和硬件。如果你有一个功能强大的计算机，你可以允许更多的低渲染时间，反之亦然。因此，一切都取决于您尝试渲染的对象和机器。

DAZSTUDIO的博客 9650

windows第三大结构体--KPCR

前面我们介绍了windows的两大结构体，一个是进程结构体，一个是线程结构体。KPCR是什么呢，是用于描述CPU的结构体。每一个CPU都有一个这样的结构体来描述CPU干了什么事。这三个成员和线程切换有关，第一个描述了当前在跑的线程，第二个描述了一会要切换的线程是谁，第三个是当没有线程需要执行的时候，执行的空闲线程是谁。在KPCR最后一个成员叫PrcbData,他是一个扩展结构体，也是放了很多有用的信息。1.在当线程切换的时候，也就是线程从3环进入0环时，FS：[0]->TEB切换成KPCR。

qq_30528603的博客 970

PIV实验流场流速云图（MALAB contour函数用法）

clear;clc; for k=1:5 str1=['filename1']; str2=['filename2']; str3=['filename3']; str=eval(['str',num2str(k)]); load(str); [m n]=size(y); y=flipud(y); v=-v; x=x-x(1,...

Nick_Cui的博客 3224

国产谷歌地球，地形分析秒杀同款地图软件

咱们做地质、林业、水文、水利、电力、GIS、地图、水保、环境的，需要经常用到各种数据，比如影像、地形、矢量、模型等，但目前80%的规划大数据展示都离不开ArcGIS，令人头大的是很多朋友连ArcGIS软件安装起来都费劲。。。 那不会ArcGIS又装不了Google Earth怎么开展工作？ 今天推荐大家一款国产免费专业地图浏览下载测量分析神器—图新地球 图新地球，国产三维gis软件。可以查看高清卫星影像地形以及其他很多常用电子地图，对地图需求的掌握远胜过Google Maps，而且上手比国外软件要简单

GISWorld3D的博客 3686

进程线程001 进程线程结构体和KPCR

文章目录前言EPROCESSKPROCESS主要成员EPROCESS其他成员ETHREADKTHREAD主要成员介绍ETHREAD其他成员介绍KPCRKPCR介绍_NT_TIB主要成员介绍KPCR的其他成员介绍KPRCB成员介绍KPRCB成员介绍 前言 进程线程的知识点很多，如果我们想了解问题的本质，就要从一些关键的结构体学起，先来介绍一个与进程密切相关的结构体 EPROCESS 每个进程在零环都...

鬼手的博客 1903

从零搭建一个虚拟ECU：手把手用Autosar CP模块模拟汽车灯控系统（基于Vector工具链）

本文详细介绍了如何使用Vector工具链从零搭建一个基于Autosar CP架构的虚拟ECU系统，模拟汽车灯光控制功能。通过环境搭建、模块配置、通信栈设置到灯光控制逻辑实现的全流程指导，帮助开发者掌握Autosar CP模块术语的实际应用，并提供了系统集成与测试的实用方案。

weixin_42628688的博客 314

Windows内核解析之KPCR结构体和FS:[0]

Windows内核解析之KPCR结构体和FS:[0]；

bcbobo21cn的专栏 914

RAG面试内容整理-8. 文档分块策略（滑动窗口、语义切分）

RAG系统通常面对长文档或整篇知识库资料的检索需求，但大模型一次处理的文本长度有限，向量索引也需固定大小的文本片段。因此，将长文档拆分成合适片段是必不可少的步骤，被称为文档分块（chunking）策略。

不务正业的猿 691

知识图谱-KGE-语义匹配-双线性模型-2018：SimplE

【paper】 SimplE Embedding for Link Prediction in Knowledge Graphs 【简介】 本文是加拿大英属哥伦比亚大学的两位学者发表在 NIPS 2018 上的工作，文章提出了 SimplE（Simple Embedding）。这篇和前面一篇差不多，也是对 1927 年的 CP 进行改进（简化），传统CP为实体分配的两个向量是独立训练的，SimplE利用关系的逆在三元组打分函数中加上了一个对称项，使得每个实体的两个向量依赖学习，并且 SimplE 的复杂度随

u013250861的博客 958

系统调用之_KPCR与_KPRCB

查看KPCR地址：(当前查到的地址指向的是KPCR偏移0x120位置，所以需要减去0x120才是KPCR地址)段寄存器FS:[0]在驱动层指向_KPCR结构，当前运行核上的上下文环境。段寄存器FS:[0]在用户层指向TEB线程环境块，当前运行线程上下文。每一个CPU核都有一个KPCR结构体（一个CPU核心一个KPCR）WIN7x86 _KPRCB结构。WIN7x86 _KPCR结构。

wxy_xx1的博客 571

【嵌入式DIY实例ESP32篇】-步数计数器

在本项目中，我们将使用 ESP32 微控制器和博世的 BMI160 加速度计陀螺仪模块构建一款便携式计步器

视觉与物联智能 803

php.inl拒绝访问,zyustc

ffdff000 处是一个叫做 KPCR 的结构，PCR 即 Processor Control Region ，处理器控制域。这是一个很有用的结构。系统本身就大量使用。下面是从 WinDbg 中得到的 win2k build 2195 的 KPCR 结构struct _KPCR (sizeof=2832)+000 struct _NT_TIB NtTib+000 struct _EXCEPTIO...

weixin_28760183的博客 359

SIMATIC S7-1200, S7-1500 PID 控制[手册]

SIMATIC S7-1200, S7-1500 PID 控制[手册]

计算机控制技术及应用

《计算机控制技术及应用》通过总结作者的科研成果和吸收国内外的先进理论、方法和技术，以计算机控制系统的网络化、开放化、智能化和集成化发展趋势为主线索，主要介绍计算机控制系统的基本概念和计算机控制系统的典型形式，计算机控制系统的数学描述与基本分析方法，以及数字PID控制器、最少拍控制系统、达林算法、状态变量设计法等设计方法及其各种改进算法。重点突出计算机控制系统输入输出通道接口的设计方法和典型控制系统的设计案例与实现方法等。

(17)[系统调用]追踪系统调用(0环)

上一次跟到这里，这一次从这里出发，继续追踪首先我们先看熟悉的int2E，int2E会走一个中断门，而中断门再此之前先找到文件ntoskrnl.exe，大概是在C/windows/system32里

qq_50332504的博客 468

visio安装包

Microsoft Office Visio 是一款专业的制图软件。利用经过更新的形状、协作工具和数据链接图表，创建专业级图表以简化复杂的信息。

【2021.04.27】API函数的调用过程(保存现场)

内容回顾 前文提到了API进入0环以后会调用的函数：KiSystemService()、KiFastCallEntry()。 前文的练习 进入0环后，原来的寄存器存在哪里？ 如何根据系统调用号(EAX寄存器中储存)找到要执行的内核函数？ 调用时的参数是储存到3环的堆栈，如何传递给内核函数？ 2种调用方式入口(KiSystemService()、KiFastCallEntry())是不一样的，它们是如何返回到3环的？ 进入0环后，原来的寄存器存在哪里？本文将以KiSystemService(

oalken的博客 949

最新的sdio 4.0 spec 协议标准 带书签 高清完整PDF版

Part-E1-SDIO-Specification-Ver4.00-Final-120220.pdf：最新的sdio 4.0 spec 协议标准 带书签 高清完整PDF版，包括SDIO 接口的外设，SDIO 接口官方协议等。

自己查看的WINDBG GDTR

kd> r gdtr gdtr=8003f000 kd> dd 8003f000 8003f000  00000000 00000000 0000ffff 00cf9b00 8003f010  0000ffff 00cf9300 0000ffff 00cffb00 8003f020  0000ffff 00cff300 200020ab 80008b04 8003f030  f0000

whowho的专栏 2764

从FS找进程页目录表基地址

前言当前进程的CR3是当前进程页目录表基地址 用WinDbg从FS寄存器开始，可以找到指定进程页目录表基地址. 如果是查找非当前进程的页目录表基地址，就不能看CR3. 要直接去FS中找，直到找到_KPROCESS.DirectoryTableBase.根据CR3是当前进程的页目录表的规定，通过!process 0 0, 可以知道当前进程是哪个.记录kd> r fs fs=00000030kd>

博客标题不能为空 1554

3.API的调用过程（保存现场）

_KTrap_Frame 结构 kd> dt _KTrap_Frame ntdll!_KTRAP_FRAME +0x000 DbgEbp : Uint4B +0x004 DbgEip : Uint4B +0x008 DbgArgMark : Uint4B +0x00c DbgArgPointer : Uint4...

My classmates 1346

Windows系统调用学习笔记（三）—— 保存现场

Windows系统调用学习笔记（三）—— 保存现场前言要点回顾API进入0环后调用的函数：基本概念Trap Frame结构线程相关的结构体ETHREADKTHREADCPU相关的结构体KPCR_NT_TIBKPRCB 前言 一、学习自滴水编程达人中级班课程，官网：https://bcdaren.com 二、海东老师牛逼！ 要点回顾 API进入0环后调用的函数： 中断门 – KiSystemSe...

lzyddf的博客 2678

PspCidTable攻与防

PspCidTable的攻与防,其实就是进程隐藏与检测所涉及到的一部分工作~~ 不管基于PspCidTable的进线程检测,还是抹PspCidTable进行进程对象的隐藏,都涉及到对PspCidTable的遍历. 所以如何安全正确地遍历PspCidTable才是该技术的关键 一、获取PspCidTable的地址 常用的方法是从前面提到的三个查询PspCidTable的函数中特征搜索. PsLook...

xlaomlng的博客 1122

PCR和PRCB

在Ring0下，fs指向PCR，而PRCB是PCR的一个扩展。 可以用!pcr和!prcb命令查看，例如： kd> !pcr KPCR for Processor 0 at ffdff000: Major 1 Minor 1 NtTib.ExceptionList: 80551158 NtTib.StackBase: 80551970...

weixin_34351321的博客 1338

内核知识第十讲,内核结构体简介.以及自己实现内存读写功能.

　　　　　　　　　　　　内核知识第十讲,内核结构体简介.以及自己实现内存读写功能. 前言: 　　不知道大家学习逆向技术的时候.有没有听说过什么驱动过保护.什么驱动读写xxx的.而今天就讲解一下其原理. 　　PS:讲解原理还有简单的Demo.请大家学习逆向技术.并做好信息安全.而不是要求大家去做黑产. 　　PS:只讲今天表中有用的结构体.不会每个成员都会介绍. 一丶Rea...

weixin_30765319的博客 343

为什么进程、线程一些重要信息可以通过FS寄存器简单的取到？

这两天稍微学习了一下寄存器相关知识，

zfdyq 1217

系统调用002 KiSystemService函数逆向分析

文章目录前言保存现场_KTRAP_FRAMEKRPCExceptionList_KTHREAD结构体先前模式抬高堆栈判断当前权限更新_KTRAP_FRAME保存三环的寄存器环境判断调试状态 前言 之前我们详细了解了API从三环进到零环的过程，API会通过两种方式进入到零环，如果通过中断门的方式进入零环，最终会进入到KiSystemService这个函数。接下来就来分析KiSystemService...

鬼手的博客 2454

(转)获取 pspCidTable 地址

http://hi.baidu.com/zapline/item/512059e3bd963ea9ce2d4f36 kd> dg @fs P Si Gr Pr Lo Sel Base Limit Type l ze an es ng Flags ---- -------- -...

weixin_30235225的博客 227
上一篇： 借助VMware实现单机使用WinDbg
下一篇： JIURL键盘驱动 1
点赞 0
评论 0
书签 书签 1
imquestion
imquestion
博客等级 码龄25年 50粉丝 34原创
+ 关注
评论
成就一亿技术人!
拼手气红包6.0元
还能输入1000个字符
 
表情包 插入表情
表情包 代码片
 条评论被折叠 查看
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值