WinDBG查看内核数据结构

    查看详细的模块信息：!lmi nt

枚举所有内核数据结构：dt nt!_*

查看数据结构详细信息：dt nt!_xxx

// !lmi nt  [查看详细的模块信息]
kd>  !lmi nt
Loaded Module Info: [nt] 
         Module: ntkrnlpa
   Base Address: 804d8000
     Image Name: ntkrnlpa.exe
   Machine Type: 332 (I386)
     Time Stamp: 4802516a Mon Apr 14 02:31:06 2008
           Size: 1f8480
       CheckSum: 2050d3
Characteristics: 12e  
Debug Data Dirs: Type  Size     VA  Pointer
             CODEVIEW    25,  9578,    9578 RSDS - GUID: {30B5FB31-AE7E-4ACA-ABA7-50AA241FF331}
               Age: 1, Pdb: ntkrnlpa.pdb
     Image Type: MEMORY   - Image read successfully from loaded memory.
    Symbol Type: PDB      - Symbols loaded successfully from symbol search path.
                 d:\symbol\exe\ntkrnlpa.pdb
    Load Report: public symbols , not source indexed 
                 d:\symbol\exe\ntkrnlpa.pdb
// dt nt!_*  [查看所有内核数据结构]
kd> dt nt!_*
          ntkrnlp