《深入理解Windows操作系统》笔记2

最新推荐文章于 2022-05-17 00:15:00 发布

chenqunan3231

最新推荐文章于 2022-05-17 00:15:00 发布

阅读量1k

点赞数

文章标签：操作系统

原文链接：https://my.oschina.net/chen106106/blog/45191

版权

在SDK中有一个工具依赖性查找工具depends.exe 可以看到进程的子系统类型。发现这个工具和VS6企业版中的Microsoft Visual Studio 6.0 Tools中的Depends（"C:\Program Files\Microsoft Visual Studio\Common\Tools\DEPENDS.EXE"）是一样的。晕！！

Windows子系统：

1、环境子系统csrss.exe包括下列支持：

a) 控制台文本窗口

b) 创建或删除进程和线程

c) 对16位虚拟DOS机进程的一部分支持

d) 其他一些函数，比如gettempfile，definedosdevice，exitwindowsex等

2、内核模式设备驱动程序win32k.SYS 包含：

a) 窗口管理器，包括采集键盘，鼠标的输入

b) 图形设备接口GDI（在NT4之前，作为用户模式windows子系统的一部分）

3、子系统DLL比如kernel32.DLL，advapi.DLL，user32.DLL，GDI32.dll

4、图形设备驱动程序

将USER和GDI放在内核模式中，windows会不稳定吗？

答：在此NT4之前，一个错误指针会导致系统崩溃，将窗口管理器和GDI从用户模式迁移到了内核模式，不仅提高了性能，而且可以将稳定性降到最低！

Posix子系统

一个基于UNIX的可移植的操作系统接口的首字母缩写，这个POSIX标准有很多，Windows实现的是POSIX.1

POSIX子系统有助于将UNIX应用移植到windows平台上，然而，这个程序仍然被链接为可执行程序，不能调用windows函数。如果你需要unix移植到windows中并且可以调用windows函数，你需要购买UNIX TO WINDOWS的软件，比如www.MKSSOFTWARE.COM

如果要在windows编译链接一个posix程序,需要在SDK的中POSIX头文件和库文件中使用链接库psxdll.DLL。

OS/2子系统

支持有局限，如果OS/2中设计的硬件及高级视频IO代码，在windows上使用该子系统不可用。

原生的OS/2 1.2上有16M的内存限制。而在windows提供的OS/2中可以使用512M

硬件抽象层HAL

C:\WINDOWS\Driver Cache\i386>dir

驱动器 C 中的卷没有标签。

卷的序列号是 18F6-A188

C:\WINDOWS\Driver Cache\i386 的目录

2011-12-05 10:36 <DIR> .

2011-12-05 10:36 <DIR> ..

2008-04-14 20:00 62,857,674 driver.cab

2 个文件 83,085,231 字节

2 个目录 146,253,623,296 可用字节

如果打了SP3补丁，则在此CAB压缩包中有多个版本的HAL.DLL文件

C:\>dir ntoskrnl.exe /a/s

驱动器 C 中的卷没有标签。

卷的序列号是 18F6-A188

C:\WINDOWS\system32 的目录

2008-04-14 20:00 2,144,768 ntoskrnl.exe

1 个文件 2,144,768 字节

所列文件总数:

1 个文件 2,144,768 字节

0 个目录 146,251,362,304 可用字节

其中,我们发现ntoskrnl链接了HAL，HAL又链接了ntoskrnl，相互使用了对方的函数。Ntoskrnl也链接了BOOTVID.DLL，这个是用来实现GUI启动屏幕的引导视频驱动程序，在XP系统以后的环境中还有一个附加的DLL，kdcom.DLL它包含了内核调试器的基础代码，在XP之前，它被包含在ntoskrnl.EXE中。

从WINDOWS 2000开始使用WDM驱动也就是windows驱动程序模型。从WDM来看，有三种驱动程序

1、总线型驱动：总线控制器，适配器，桥，带有子设备的设备提供服务器。比如PCI,USB等

2、功能性驱动：这个是必须的，比如SCSI

3、过滤性驱动，一般只有OEM来提供放在总线型驱动之上。

C:\>pstat |more

Pstat version 0.3: memory: 2882732 kb uptime: 0 3:33:12.531

no page files in use

Memory:2882732K Avail:1809228K TotalWs: 808476K InRam Kernel: 2580K P:59176K

Commit: 872612K/ 718480K Limit:2720228K Peak: 936212K Pool N:48464K P:59484K

User Time Kernel Time Ws Faults Commit Pri Hnd Thd Pid Name

169996 2309601 File Cache

0:00:00.000 6:19:14.046 28 0 0 0 0 2 0 Idle Process

0:00:00.000 0:02:03.828 344 13635 52 8 798 87 4 System

0:00:01.015 0:00:00.031 496 328 232 11 19 3 612 smss.exe

0:00:01.765 0:00:12.421 10584 31486 2340 13 751 13 1124 csrss.exe

0:00:00.140 0:00:00.312 5300 5907 8136 13 526 23 1156 winlogon.exe

0:00:00.656 0:00:01.796 3580 15578 1844 9 321 15 1200 services.exe

0:00:01.640 0:00:03.765 1308 16798 2840 9 425 16 1212 lsass.exe

0:00:41.234 0:00:08.625 15460 533817 123300 8 181 33 1392 avguard.exe

0:00:00.046 0:00:00.015 2476 652 688 8 33 2 1572 avshadow.exe

0:00:00.046 0:00:00.156 3416 912 2076 8 100 4 1592 ati2evxx.exe

0:00:00.062 0:00:00.046 5556 1746 3240 8 226 18 1612 svchost.exe

0:00:00.234 0:00:00.265 5024 1652 2064 8 351 10 1672 svchost.exe

0:00:00.578 0:00:00.890 3904 25888 2236 8 112 5 128 ati2evxx.exe

0:00:01.421 0:00:01.093 21844 14256 13468 8 1516 57 676 svchost.exe

0:00:04.500 0:00:00.656 4400 7844 2032 8 107 6 812 svchost.exe

-- More --

System进程在windows 2000中ID=8,在windows xp和2003中，ID=4

C:\>livekd

LiveKd v5.0 - Execute kd/windbg on a live system

Sysinternals - www.sysinternals.com

Launching C:\Program Files\Debugging Tools for Windows (x86)\kd.exe:

Microsoft (R) Windows Debugger Version 6.12.0002.633 X86

Loading Dump File [C:\WINDOWS\livekd.dmp]

Kernel Complete Dump File: Full address space is available

Comment: 'LiveKD live system view'

Symbol search path is: srv*c:\Symbols*http://msdl.microsoft.com/download/symbols

Executable search path is:

Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible

Product: WinNt, suite: TerminalServer SingleUserTS

Built by: 2600.xpsp.080413-2111

Machine Name:

Kernel base = 0x804d8000 PsLoadedModuleList = 0x8055e720

Debug session time: Sun Feb 13 10:34:57.897 17420 (UTC + 8:00)

System Uptime: 0 days 3:40:13.673

WARNING: Process directory table base 00722000 doesn't match CR3 0A9F06C0

Loading Kernel Symbols

...............................................................

................................................................

............

Loading User Symbols

Loading unloaded module list

...............

0: kd> 0: kd> 0: kd>

0: kd>

0: kd> !stacks 0

Proc.Thread .Thread Ticks ThreadState Blocker

*** ERROR: Module load completed but symbols could not be loaded for LiveKdD.SYS

[8a36ba00 System]

4.00004c 8a362020 ffffef52 Blocked nt!MiGatherPagefilePages+0x40

*** ERROR: Module load completed but symbols could not be loaded for sptd.sys

4.000064 8a392bd8 00ce2c2 Blocked sptd+0x874ee

4.000068 8a392960 00ce74f Blocked sptd+0x874ee

4.00006c 8a3926e8 00ce74f Blocked sptd+0x874ee

*** ERROR: Module load completed but symbols could not be loaded for RtkHDAud.sy

4.00016c 89d3cb08 00ce5fc Blocked RtkHDAud+0x110e

4.000170 89d3c890 00ce5fc Blocked RtkHDAud+0x110e

4.000174 89cc6868 00ce5fc Blocked RtkHDAud+0x110e

4.000178 89cbdb08 00ce5fc Blocked RtkHDAud+0x110e

4.00017c 89cbcda8 00ce5fb Blocked RtkHDAud+0x110e

4.000180 89cbc890 00ce5fb Blocked RtkHDAud+0x110e

4.000184 8a06f6e8 00ce5fb Blocked RtkHDAud+0x110e

4.000188 89cbf7e8 ffffe699 Blocked RtkHDAud+0x110e

4.00018c 89cbf548 0004025 Blocked RtkHDAud+0x49368

4.000190 89cca528 0003f4c Blocked RtkHDAud+0x43c98

!stacks 0可以表示出system进程中的系统线程，可以找出一个线程的当前地址

！Drivers 可以列出每个已经被加载的设备驱动程序的基础地址

第一列表示进程ID和线程ID

第二列表示线程的当前地址

第三列表示线程是wait状态还是就绪状态，还是运行状态，还是运行状态

第四列表示该线程的堆栈中最顶上的地址，可以看出每个线程是哪个驱动程序中被启动起来的。

4.0005ac 87cb3468 00c0e87 Blocked avgntflt+0x16a8

4.0005b0 87cb31f0 0000082 Blocked avgntflt+0x19ab

*** ERROR: Module load completed but symbols could not be loaded for hcmon.sys

4.0000c0 87a07720 00cd9c8 Blocked hcmon+0x1b7d

*** ERROR: Module load completed but symbols could not be loaded for vmx86.sys

4.0000d4 87bc13c8 00cd9c6 Blocked vmx86+0x3a9d

4.000d24 87a25020 fffff285 Blocked HTTP!UlpScavengerThread+0x5d

*** ERROR: Module load completed but symbols could not be loaded for PECKP.SYS

4.000da0 878737f0 00c1ed7 Blocked PECKP+0x1234a

[899a3370 smss.exe]

*** ERROR: Module load completed but symbols could not be loaded for ati2mtag.sy

[88242da0 csrss.exe]

464.000470 884046e8 00ce2c8 Blocked ati2mtag+0x4b1c

464.00047c 88229da8 ffffffe1 Blocked nt!KiFastCallEntry+0xfc

464.00048c 88400d10 ffffd5a6 Blocked nt!KiFastCallEntry+0xfc

464.000494 8821da30 ffffd59b Blocked win32k!xxxMsgWaitForMultipleObjects+0x

464.0004f4 87ce45f0 ffffb3c5 Blocked nt!KiFastCallEntry+0xfc

464.000ff0 8799abf8 ffffb3b4 Blocked nt!KiFastCallEntry+0xfc

[88412470 winlogon.exe]

484.0004ac 8821cda8 ffffd639 Blocked nt!KiFastCallEntry+0xfc

484.0007fc 87c11270 000003b Blocked nt!KiFastCallEntry+0xfc

484.0003b8 87bde408 ffffba64 Blocked nt!KiFastCallEntry+0xfc

484.000ba8 87cd3798 ffffb995 Blocked nt!KiFastCallEntry+0xfc

484.00084c 87ae9020 ffffb94b Blocked nt!KiFastCallEntry+0xfc

484.000cec 8749eda8 ffffbc62 Blocked nt!KiFastCallEntry+0xfc

484.000784 87986bf0 00000fb Blocked

TYPE mismatch for thread object at 87436640

484.------ NO ETHREAD DATA

Unable to read _ETHREAD at fffffe50

[8821b410 services.exe]

4b0.0004cc 87cfcb30 ffffb875 Blocked nt!KiFastCallEntry+0xfc

4b0.00052c 87ccf5d8 ffffbc7c Blocked nt!KiFastCallEntry+0xfc

4b0.000540 87cd1020 ffffb3e1 Blocked nt!KiFastCallEntry+0xfc

4b0.00054c 87650020 ffffb360 Blocked nt!KiFastCallEntry+0xfc

4b0.000cac 87695020 ffffb35f Blocked nt!KiFastCallEntry+0xfc

[87cf3418 lsass.exe]

4bc.0004dc 87cf05f0 ffffb5c0 Blocked nt!KiFastCallEntry+0xfc

4bc.0004f0 87ce4868 ffffbc70 Blocked nt!KiFastCallEntry+0xfc

4bc.000508 8821ebb8 ffffd5cd Blocked +0x8821ebb8

4bc.000528 87cd6da8 ffffb74a Blocked nt!KiFastCallEntry+0xfc

[87cbfb38 avguard.exe]

570.0005a4 87cc1da8 ffffb3a3 Blocked nt!KiFastCallEntry+0xfc

570.0005b4 87cafcd0 ffffb35b Blocked nt!KiFastCallEntry+0xfc

570.0005b8 87c9f8f0 ffffb333 Blocked nt!KiFastCallEntry+0xfc

570.0005bc 87ca94e8 ffffb330 Blocked nt!KiFastCallEntry+0xfc

570.0005dc 87c9dda8 ffffb721 Blocked nt!KiFastCallEntry+0xfc

570.0005e4 87cc3b10 ffffb392 Blocked nt!KiFastCallEntry+0xfc

570.0005ec 87c68020 ffffb5ed Blocked nt!KiFastCallEntry+0xfc

570.0005f4 87ca0458 ffffb46d Blocked nt!KiFastCallEntry+0xfc

570.0005fc 87c8e338 ffffb5b7 Blocked nt!KiFastCallEntry+0xfc

570.000600 87c67718 ffffb344 Blocked nt!KiFastCallEntry+0xfc

[87c56be0 avshadow.exe]

[87c52420 ati2evxx.exe]

[87c38320 svchost.exe]

64c.000678 87c284e8 ffffb536 Blocked nt!KiFastCallEntry+0xfc

64c.00076c 87ae2868 0001208 Blocked nt!KiFastCallEntry+0xfc

64c.000358 8a277be8 0001208 Blocked nt!KiFastCallEntry+0xfc

64c.000764 878f1da8 0001208 Blocked nt!KiFastCallEntry+0xfc

64c.00042c 878f1b30 0001208 Blocked nt!KiFastCallEntry+0xfc

64c.000324 87ae2020 0001208 Blocked nt!KiFastCallEntry+0xfc

64c.00031c 87ae25f0 0001208 Blocked nt!KiFastCallEntry+0xfc

64c.0007b0 8a276328 0000001 Blocked nt!KiFastCallEntry+0xfc

64c.000834 878f0538 0001208 Blocked nt!KiFastCallEntry+0xfc

64c.0001d4 87662020 ffffbb8c Blocked nt!KiFastCallEntry+0xfc

[87c28be0 svchost.exe]

688.000eec 878e8020 ffffb2af Blocked nt!KiFastCallEntry+0xfc

688.000fa8 8768f020 ffffb2ad Blocked nt!KiFastCallEntry+0xfc

688.000dcc 8747ada8 ffffb85f Blocked nt!KiFastCallEntry+0xfc

[87c0da20 ati2evxx.exe]

80.0003cc 87bdcda8 ffffb3f9 Blocked nt!KiFastCallEntry+0xfc

[87c02020 svchost.exe]

2a4.0002a0 87c10020 0001208 Blocked nt!NtReadFile+0x55d

2a4.000320 87bf25c8 0001208 Blocked nt!KiFastCallEntry+0xfc

2a4.0003e0 87bd9718 ffffb91b Blocked nt!KiFastCallEntry+0xfc

2a4.0003e8 87be45a8 0001208 Blocked nt!KiFastCallEntry+0xfc

2a4.0003f8 87bd5020 000041c Blocked nt!KiFastCallEntry+0xfc

2a4.000608 87bd7da8 0001208 Blocked nt!KiFastCallEntry+0xfc

2a4.000658 88424020 0001208 Blocked nt!KiFastCallEntry+0xfc

2a4.0006f8 87a0daa0 ffffdb0f Blocked nt!KiFastCallEntry+0xfc

2a4.0000b8 87bccda8 00000dd Blocked nt!KiFastCallEntry+0xfc

2a4.0000b0 87bcea38 ffffffeb Blocked nt!KiFastCallEntry+0xfc

2a4.0000b4 87a1bc40 ffffe194 Blocked nt!KiFastCallEntry+0xfc

2a4.000534 87928830 0000050 Blocked nt!KiFastCallEntry+0xfc

2a4.000a28 87ae7bf8 ffffb4d8 Blocked nt!KiFastCallEntry+0xfc

2a4.0008e0 87ae4270 ffffb64c Blocked nt!KiFastCallEntry+0xfc

2a4.0008e4 8795f2a0 ffffb64c Blocked nt!KiFastCallEntry+0xfc

2a4.0008e8 87ae2378 0001208 Blocked nt!KiFastCallEntry+0xfc

2a4.000940 8a273868 0001208 Blocked nt!KiFastCallEntry+0xfc

2a4.000978 8a2725d8 0001208 Blocked nt!KiFastCallEntry+0xfc

2a4.000994 8a2716d0 0001208 Blocked nt!KiFastCallEntry+0xfc

2a4.000be0 87c78da8 ffffb4d9 Blocked nt!KiFastCallEntry+0xfc

2a4.000ee4 8a2b9500 0000975 Blocked nt!KiFastCallEntry+0xfc

2a4.0003f4 87875020 ffffd71d Blocked nt!KiFastCallEntry+0xfc

2a4.0009e4 8780c610 ffffb22a Blocked nt!KiFastCallEntry+0xfc

[87bf2348 svchost.exe]

32c.000c38 8766ada8 ffffb30d Blocked nt!KiFastCallEntry+0xfc

32c.000b98 8764c3a0 ffffb2e9 Blocked nt!KiFastCallEntry+0xfc

32c.000b3c 87685020 ffffb2e9 Blocked nt!KiFastCallEntry+0xfc

[87be5be0 svchost.exe]

390.000360 87756c10 ffffb718 Blocked nt!KiFastCallEntry+0xfc

[87bd56a0 sched.exe]

664.0006ac 87bce5c8 0001208 Blocked nt!NtReadFile+0x55d

664.0006b0 87bc9be8 0001208 Blocked nt!KiFastCallEntry+0xfc

664.0006b8 87bce350 0001208 Blocked nt!KiFastCallEntry+0xfc

664.0006d0 87bd6c40 000017d Blocked nt!KiFastCallEntry+0xfc

[87a135a0 inetinfo.exe]

104.000108 87bc8a68 0001208 Blocked nt!NtReadFile+0x55d

104.000130 87a0abe8 ffffd921 Blocked nt!KiFastCallEntry+0xfc

104.00079c 8799d470 ffffb3b7 Blocked nt!KiFastCallEntry+0xfc

104.000388 87996438 ffffb492 Blocked nt!KiFastCallEntry+0xfc

104.0003bc 879a4a50 0001208 Blocked nt!KiFastCallEntry+0xfc

104.0003c0 87b45da8 ffffb478 Blocked nt!KiFastCallEntry+0xfc

[879fe988 jqs.exe]

120.000134 884265e8 0001208 Blocked nt!KiFastCallEntry+0xfc

120.000144 87a104f8 000028b Blocked nt!MiDeferredUnlockPages+0x31

120.0001d8 879f2c18 ffffb193 Blocked nt!KiFastCallEntry+0xfc

[879e6020 sqlservr.exe]

1bc.0002b0 87b86538 ffffb235 Blocked nt!KiFastCallEntry+0xfc

1bc.0002f0 87b77020 ffffb1ed Blocked nt!KiFastCallEntry+0xfc

[87b896a0 sqlwriter.exe]

22c.000230 879ddda8 0001208 Blocked nt!NtReadFile+0x55d

22c.000234 879d7970 0001208 Blocked nt!KiFastCallEntry+0xfc

[879dfbe8 vmware-authd.ex]

25c.000d4c 87be0328 0000076 Blocked nt!KiFastCallEntry+0xfc

25c.000d50 87bcb020 0001208 Blocked nt!KiFastCallEntry+0xfc

25c.000d54 87bcbda8 0001208 Blocked nt!KiFastCallEntry+0xfc

25c.000f90 87b63970 ffffb2cc Blocked nt!KiFastCallEntry+0xfc

[879c8da0 vmount2.exe]

2f8.000338 87b71020 ffffb265 Blocked nt!KiFastCallEntry+0xfc

[879bcda0 vmnat.exe]

[879ae4e0 vmnetdhcp.exe]

[87a5d4e0 explorer.exe]

a88.000ae0 87b03da8 0000b69 Blocked nt!KiFastCallEntry+0xfc

a88.000850 87c0a020 ffffb44b Blocked nt!KiFastCallEntry+0xfc

a88.0001ec 87ade6b0 000054f Blocked nt!KiFastCallEntry+0xfc

[87b20880 RTHDCPL.EXE]

[8796fbe0 MOM.exe]

b1c.000b34 87a36da8 0001208 Blocked nt!KiFastCallEntry+0xfc

b1c.000fec 87b6fda8 ffffb268 Blocked nt!KiFastCallEntry+0xfc

b1c.000444 87978c00 ffffb3a2 Blocked nt!KiFastCallEntry+0xfc

b1c.000458 8823f328 0001208 Blocked nt!KiFastCallEntry+0xfc

b1c.00045c 8823d020 0001208 Blocked nt!KiFastCallEntry+0xfc

b1c.0008a0 87ae8da8 ffffb37b Blocked nt!KiFastCallEntry+0xfc

TYPE mismatch for thread object at 87642020

b1c.------ NO ETHREAD DATA

TYPE mismatch for thread object at 8a308140

b1c.------ NO ETHREAD DATA

Unable to read _ETHREAD at 85ffe53

[8796cb40 GooglePinyinDae]

b2c.000b60 8a1bc4c0 0001208 Blocked nt!KiFastCallEntry+0xfc

b2c.000b64 8a1bc8a8 0001208 Blocked nt!IopXxxControlFile+0x5c5

b2c.000b68 884052c0 ffffd9ae Blocked nt!KiFastCallEntry+0xfc

b2c.000bc4 87bd0bf8 00002ee Blocked nt!KiFastCallEntry+0xfc

b2c.000de0 876ad020 ffffb14f Blocked nt!KiFastCallEntry+0xfc

[88406da0 SetPoint.exe]

b7c.000434 87cb5be8 0001208 Blocked nt!KiFastCallEntry+0xfc

b7c.000644 8a2bb9f8 0001208 Blocked nt!KiFastCallEntry+0xfc

[87bb84c8 avgnt.exe]

bec.000d08 87cb0a30 0001208 Blocked nt!KiFastCallEntry+0xfc

[87970418 GooglePinyinSer]

[87b23da0 ctfmon.exe]

c24.000c28 87bf9618 ffffb2e9 Blocked nt!KiFastCallEntry+0xfc

[87be14e0 YodaoDict.exe]

d44.000228 8a2bc868 00000c0 Blocked nt!KiFastCallEntry+0xfc

d44.000f84 87960020 ffffb25e Blocked nt!KiFastCallEntry+0xfc

d44.000960 8a275748 0001208 Blocked nt!KiFastCallEntry+0xfc

d44.000a60 8a2708b8 ffffb0ad Blocked nt!KiFastCallEntry+0xfc

d44.000a64 88235bf8 0001208 Blocked nt!KiFastCallEntry+0xfc

[87cfba30 vmserverdWin32.]

d5c.000fe4 87c3cda8 ffffb378 Blocked nt!KiFastCallEntry+0xfc

d5c.0007b8 87b44bf0 ffffb7ac Blocked nt!KiFastCallEntry+0xfc

d5c.000ea8 87964bf0 ffffb2e2 Blocked nt!KiFastCallEntry+0xfc

[879c0be0 YoudaoNote.exe]

db4.00043c 87a17480 0000610 Blocked nt!KiFastCallEntry+0xfc

db4.00085c 87c98da8 0001208 Blocked nt!KiFastCallEntry+0xfc

db4.0008fc 8a277970 0001208 Blocked nt!KiFastCallEntry+0xfc

db4.000980 87add460 0001208 Blocked nt!KiFastCallEntry+0xfc

[88411020 klive.exe]

df8.000ff4 87bcbb30 0001208 Blocked nt!KiFastCallEntry+0xfc

df8.000ff8 88411340 0001208 Blocked nt!KiFastCallEntry+0xfc

df8.000d94 87acf850 ffffb111 Blocked nt!KiFastCallEntry+0xfc

df8.000fcc 87bcaa38 0001208 Blocked nt!IopXxxControlFile+0x5c5

df8.0000d8 8799f398 0001208 Blocked nt!IopXxxControlFile+0x5c5

df8.0000ec 89c46aa0 0001208 Blocked nt!IopXxxControlFile+0x5c5

df8.000de4 87aafa78 ffffb069 Blocked nt!KiFastCallEntry+0xfc

df8.000e94 88402868 ffffd5a9 Blocked +0xa3f5ecec

df8.000a6c 8781d868 ffffb2ec Blocked nt!KiFastCallEntry+0xfc

df8.0008f4 87aa7da8 ffffb03f Blocked nt!KiFastCallEntry+0xfc

df8.000594 878a0a28 ffffb04d Blocked nt!KiFastCallEntry+0xfc

df8.0009fc 8789f980 ffffb449 Blocked nt!KiFastCallEntry+0xfc

df8.000a04 8789f490 ffffb416 Blocked nt!KiFastCallEntry+0xfc

df8.000a54 8794f710 ffffb06d Blocked nt!KiFastCallEntry+0xfc

df8.000f34 87a0a870 ffffd9ac Blocked nt!KiFastCallEntry+0xfc

df8.000b28 877f1b38 0001208 Blocked nt!KiFastCallEntry+0xfc

[87a53408 CCC.exe]

414.00034c 8796b4e0 ffffb11b Blocked nt!KiFastCallEntry+0xfc

414.000240 87b6cc48 ffffb341 Blocked nt!KiFastCallEntry+0xfc

414.00012c 87436b30 ffffb5c1 Blocked LiveKdD+0x32fd

[87a52570 KHALMNPR.exe]

4c0.000710 8a27b640 0001208 Blocked nt!KiFastCallEntry+0xfc

4c0.0007e8 87a32788 0001208 Blocked nt!KiFastCallEntry+0xfc

4c0.00080c 8823ada8 0001208 Blocked nt!KiFastCallEntry+0xfc

4c0.000810 87afe748 0001208 Blocked nt!KiFastCallEntry+0xfc

4c0.000820 8823a430 0001208 Blocked nt!KiFastCallEntry+0xfc

4c0.0008d4 878efda8 ffffffe0 Blocked nt!KiFastCallEntry+0xfc

4c0.000400 87ae2c00 0001208 Blocked nt!KiFastCallEntry+0xfc

[8796a3b8 wmiprvse.exe]

[87ae4da0 MDM.EXE]

90c.000930 878eba30 fffffffc Blocked nt!KiFastCallEntry+0xfc

[8a277370 alg.exe]

91c.00095c 87adc4e8 0000603 Blocked nt!KiFastCallEntry+0xfc

[87a8a020 conime.exe]

[8794cbe8 dllhost.exe]

f94.000af8 87a63da8 ffffb0d8 Blocked nt!KiFastCallEntry+0xfc

f94.000eb4 87a76288 ffffafab Blocked nt!KiFastCallEntry+0xfc

f94.00089c 8788ada8 ffffb0aa Blocked nt!KiFastCallEntry+0xfc

f94.000900 87881020 ffffb12a Blocked nt!KiFastCallEntry+0xfc

[8794b6b0 dllhost.exe]

f5c.000f9c 87a37910 0001208 Blocked nt!KiFastCallEntry+0xfc

f5c.000a30 8787a440 ffffd6e2 Blocked nt!KiFastCallEntry+0xfc

f5c.000fe0 878c2628 ffffb235 Blocked nt!KiFastCallEntry+0xfc

f5c.000fa4 877f62d0 ffffb228 Blocked nt!KiFastCallEntry+0xfc

f5c.000c74 87a81928 ffffb14f Blocked nt!KiFastCallEntry+0xfc

[87893da0 msdtc.exe]

[87a959c0 firefox.exe]

9bc.000a74 876cf718 ffffbb31 Blocked nt!KiFastCallEntry+0xfc

[877a9020 plugin-containe]

[8773d258 wps.exe]

a10.000dac 877bf248 ffffaef8 Blocked nt!KiFastCallEntry+0xfc

a10.000788 87479da8 ffffb481 Blocked nt!KiFastCallEntry+0xfc

[877c3020 cmd.exe]

[8743da20 wmiprvse.exe]

TYPE mismatch for thread object at 874a2428

fb4.------ NO ETHREAD DATA

Unable to read _ETHREAD at fe50

[877b05b8 livekd.exe]

[87425800 kd.exe]

f78.000718 87470258 ffffaed9 RUNNING LiveKdD+0x32fd

f78.000bd4 874a6020 fffff013 Blocked nt!KiFastCallEntry+0xfc

Threads Processed: 658

0: kd>

将系统线程映射到一个设备驱动程序上！

使用PE的system进程上双击，可以看到SRV.SYS有多个线程在运行，按下module可以看到描述

会话管理器windows\system32\smss.EXE是系统中第一个创建的用户模式进程

服务有三种名称：进程名，注册表名，services管理工具的显示名。

Windows的关键组件是什么机制在运行：核心组件机制：对象管理器和同步机制。

原文链接： http://blog.csdn.net/jaminwm/article/details/7237068

转载于:https://my.oschina.net/chen106106/blog/45191

chenqunan3231

关注

0
点赞
踩
0

收藏

觉得还不错? 一键收藏
0
评论
复制链接

分享到 QQ

分享到新浪微博

扫一扫