2.3 常见内核数据结构 : 其他一些常见的数据结构

其他一些常见的数据结构:

1. 对象结构

xp sp3下的对象结构

kd> dt ntkrpamp !_OBJECT_HEADER

PointerCount

HandleCount

NextToFree

Type Ptr32 _OBJECT_TYPE

NameInfoOffset

HandleInfoOffset

QuotaInfoOffset

Flags

ObjectCreateInfo Ptr32 _OBJECT_CREATE_INFORMATION

QuotaBlockCharged

SecurityDescriptor

Body _QUAD

win7下的对象结构

kd> dt nt!_object_header

PointerCount

HandleCount

NextToFree

Lock _EX_PUSH_LOCK

TypeIndex

TraceFlags

InfoMask

Flags

ObjectCreateInfo Ptr32 _OBJECT_CREATE_INFORMATION

QuotaBlockCharged

SecurityDescriptor

Body _QUAD

2. 链表结构

kd> dt nt!_LIST_ENTRY

Flink Ptr32 _LIST_ENTRY

Blink Ptr32 _LIST_ENTRY

typedef struct {

// driver-defined members

.

.

.

LIST_ENTRY ListEntry;

// other driver-defined members

.

.

.

} XXX_ENTRY;

3. APC和DPC

APC的数据结构

kd> dt nt!_KAPC

Type

Size

Spare0

Thread Ptr32 _KTHREAD

ApcListEntry _LIST_ENTRY

KernelRoutine

RundownRoutine

NormalRoutine

NormalContext

SystemArgument1

SystemArgument2

ApcStateIndex

ApcMode

Inserted

DPC的数据结构

kd> dt nt!_KDPC

Type

Number

Importance

DpcListEntry _LIST_ENTRY

DeferredRoutine

DeferredContext

SystemArgument1

SystemArgument2

Lock

4. PE文件相关结构

DOS头、PE文件头、块表及块

(1) DOS头

kd> dt nt!_IMAGE_DOS_HEADER

e_magic

e_cblp

e_cp

e_cparhdr

e_minalloc

e_maxalloc

e_ss

e_sp

e_csum

e_ip

e_cs

e_lfarlc

e_ovno

e_res

e_oemid

e_oeminfo

e_res2

e_lfanew

(2) PE文件头

kd> dt nt!_IMAGE_NT_HEADERS

Signature

FileHeader _IMAGE_FILE_HEADER

OptionalHeader _IMAGE_OPTIONAL_HEADER

Signature即"PE"

kd> dt nt!_IMAGE_FILE_HEADER

Machine

NumberOfSections

TimeDateStamp

PointerToSysbolTable

NumberOfSymbols

SizeOfOptionalHeader

Characteristics

kd> dt nt!_IMAGE_OPTIONAL_HEADER

Magic

MajorLinkerVersion

MinorLinkerVersion

SizeOfCode

SizeOfInitializedData

SizeOfUninitializedData

AddressOfEntryPoint

BaseOfCode

BaseOfData

ImageBase

SectionAlignment

FileAlignment

MajorOperatingSystemVersion

MinorOperationSystemVersion

MajorImageVersion

MinorImageVersion

MajorSubsystemVersion

MinorSubsystemVersion

Win32VersionValue

SizeOfImage

SizeOfHeaders

CheckSum

Subsystem

DllCharacteristics

SizeOfStackReserve

SizeOfStackCommit

SizeOfHeapReserve

SizeOfHeapCommit

LoaderFlags

NumberOfRvaAndSizes

DataDirectory [16] _IMAGE_DATA_DIRECTORY

kd> dt nt!_IMAGE_DATA_DIRECTORY

VirtualAddress

Size

(3) 块表

kd> dt nt!_IMAGE_SECTION_HEADER

Name

Misc

PhysicalAddress

VirtualSize

VirtualAddress

SizeOfRawData

PointerToRawData

PointerToRelocations

PointerToLinenumbers

NumberOfRelocations

NumberOfLinenumbers

Characteristics

5. 基于分发器对象的同步对象结构

常见的同步对象如事件、信号灯、定时器，还有线程、进程等，都是基于分发器对象的同步对象，这些同步对象的第一个成员都是分发器头

kd> dt nt!_DISPATCHER_HEADER

Type

Absolute

Size

Inserted

SignalState

WaitListHeader _LIST_ENTRY

WaitListHeader域记录等待该对象的线程链表，可以枚举出等待该对象的所有线程，连接的节点数据结构为KWAIT_BLOCK

kd> dt nt!_KWAIT_BLOCK

WaitListEntry _LIST_ENTRY

Thread

Object

NextWaitBlock Ptr32 _KWAIT_BLOCK

WaitKey

WaitType

6. 内存区对象(SECTION_OBJECT)

kd> dt nt!_SECTION_OBJECT

StartingVa

EndingVa

Parent

LeftChild

RightChild

Segment Ptr32 _SEGMENT_OBJECT

kd> dt nt!_CONTROL_AREA

Segment Ptr32 _SEGMENT

DereferenceList _LIST_ENTRY

NumberOfSectionReferences

NumberOfPfnReferences

NumberOfMaooedViews

NumberOfSubsections

FlushInProgressCount

NumberOfUserReferences

u __unnamed

FilePointer Ptr32 _FILE_OBJECT

WaitingForDeletion Ptr32 _EVENT_COUNTER

ModifiedWriteCount

NumberOfSystemCacheViews

kd> dt nt!_SEGMENT_OBJECT

BaseAddress

TotalNumberOfPtes

SizeOfSegment

NonExtendedPtes

ImageCommitment

ControlArea

Subsection

LargeControlArea

MmSectionFlags

MmSubSectionFlags

kd> dt nt!_SEGMET

ControlArea Ptr32 _CONTROL_AREA

TotalNumberOfPtes

NonExtendedPtes

WritableUserReferences

SizeOfSegment

SegmentPteTemplate _MMPTE

NumberOfCommittedPages

ExtendInfo Ptr32 _MMEXTEND_INFO

SystemImageBase

BasedAddress

u1 __unnamed

u2 __unnamed

PrototypePte Ptr32 _MMPTE

ThePtes [1] _MMPTE