JIURL玩玩Win2k 地址空间的布局

地址空间的布局，每个进程有4G的地址空间，其中低2G是用户地址空间，高2G是系统地址空间。 用户地址空间的布局

    每个进程有自己的用户地址空间(低2G)，在用户地址空间中有，进程的环境变量，进程的参数，进程的堆(Heap)，进程载入的模组，进程PEB，线程的堆栈(Stack)，线程TEB等等。我写了一个叫 JiurlL2gLayoutSee 的程序，可以获得一个指定进程的用户地址空间布局情况。下面是使用 JiurlL2gLayoutSee 获得的一个记事本的用户地址空间布局情况。 NOTEPAD.EXE: // 通过进程的VAD我们可以了解到进程保留了哪些用户地址空间。 VADs: #define MEM_IMAGE 0x001 #define MEM_PRIVATE 0x800 #define PAGE_READONLY 0x010 #define PAGE_READWRITE 0x040 #define PAGE_WRITECOPY 0x050 #define PAGE_EXECUTE 0x020 #define PAGE_EXECUTE_READ 0x030 #define PAGE_EXECUTE_READWRITE 0x060 #define PAGE_EXECUTE_WRITECOPY 0x070 0x00010000 - 0x00011000 Flags= 0xc40 0x00020000 - 0x00021000 Flags= 0xc40 0x00030000 - 0x00070000 Flags= 0x840 0x00070000 - 0x00170000 Flags= 0x840 0x00170000 - 0x00180000 Flags= 0x040 0x00180000 - 0x00196000 Flags= 0x010 0x001a0000 - 0x001cf000 Flags= 0x010 0x001d0000 - 0x00211000 Flags= 0x010 0x00220000 - 0x00224000 Flags= 0x010 0x00230000 - 0x00271000 Flags= 0x010 0x00280000 - 0x00348000 Flags= 0x034 0x00350000 - 0x00393000 Flags= 0x014 0x003a0000 - 0x006a0000 Flags= 0x034 0x006a0000 - 0x006a1000 Flags= 0xc44 0x006b0000 - 0x006b1000 Flags= 0xc44 0x006c0000 - 0x006d0000 Flags= 0x840 0x006d0000 - 0x006d2000 Flags= 0x010 0x006e0000 - 0x006e1000 Flags= 0x040 0x006f0000 - 0x00770000 Flags= 0x840 0x00770000 - 0x00780000 Flags= 0x840 0x00780000 - 0x00b80000 Flags= 0x840 0x00b90000 - 0x00b91000 Flags= 0xc44 0x00bb0000 - 0x00bc2000 Flags= 0xc44 0x00bd0000 - 0x00bd5000 Flags= 0xc44 0x00be0000 - 0x00be5000 Flags= 0x010 0x00bf0000 - 0x00c30000 Flags= 0x840 0x00d40000 - 0x00d5c000 Flags= 0x071 0x00d60000 - 0x00d70000 Flags= 0x840 0x00d70000 - 0x00dc3000 Flags= 0x071 0x00dd0000 - 0x00de0000 Flags= 0x840 0x00de0000 - 0x00f84000 Flags= 0x040 0x01000000 - 0x01010000 Flags= 0x071 0x01010000 - 0x011f0000 Flags= 0x010 0x011f0000 - 0x01201000 Flags= 0x010 0x01210000 - 0x01310000 Flags= 0x840 0x10000000 - 0x10019000 Flags= 0x071 0x6dd30000 - 0x6dd36000 Flags= 0x071 0x75e00000 - 0x75e1a000 Flags= 0x071 0x76af0000 - 0x76b2e000 Flags= 0x071 0x77560000 - 0x777a0000 Flags= 0x071 0x777c0000 - 0x777dd000 Flags= 0x071 0x77990000 - 0x77a25000 Flags= 0x071 0x77a30000 - 0x77b24000 Flags= 0x071 0x77b30000 - 0x77bba000 Flags= 0x071 0x77c50000 - 0x77c9a000 Flags= 0x071 0x77ca0000 - 0x77d20000 Flags= 0x071 0x77d20000 - 0x77d8f000 Flags= 0x071 0x77d90000 - 0x77dea000 Flags= 0x071 0x77df0000 - 0x77e54000 Flags= 0x071 0x77e60000 - 0x77f35000 Flags= 0x071 0x77f40000 - 0x77f7c000 Flags= 0x071 0x77f80000 - 0x77ff9000 Flags= 0x071 0x78000000 - 0x78046000 Flags= 0x071 0x7f6f0000 - 0x7f7f0000 Flags= 0x034 0x7ffa0000 - 0x7ffd3000 Flags= 0x014 0x7ffdd000 - 0x7ffde000 Flags= 0xc64 0x7ffde000 - 0x7ffdf000 Flags= 0xc64 0x7ffdf000 - 0x7ffe0000 Flags= 0xc64 // 布局情况 Layout: // 环境变量 0x00010000 - 0x00011000 Environment // 进程参数 0x00020000 - 0x00021000 ProcessParameters // 进程堆 0x00070000 - 0x00170000 ProcessHeap 0 0x00170000 - 0x00270000 ProcessHeap 1 0x006c0000 - 0x007c0000 ProcessHeap 2 0x00770000 - 0x00870000 ProcessHeap 3 0x00d60000 - 0x00e60000 ProcessHeap 4 0x00dd0000 - 0x00ed0000 ProcessHeap 5 // 进程载入的模组，以及模组中的各节 0x00d70000 - 0x00dc3000 upengine.dll 0x00d71000 - 0x00d8b000 .text 0x00d8b000 - 0x00da0000 .rdata 0x00da0000 - 0x00db2000 .data 0x00db2000 - 0x00db3000 .idata 0x00db3000 - 0x00dbf000 .share_d 0x00dbf000 - 0x00dc1000 .rsrc 0x00dc1000 - 0x00dc3000 .reloc 0x00d40000 - 0x00d5c000 unispim.ime 0x00d41000 - 0x00d4e000 .text 0x00d4e000 - 0x00d51000 .rdata 0x00d51000 - 0x00d55000 .data 0x00d55000 - 0x00d56000 .SharedD 0x00d56000 - 0x00d5a000 .rsrc 0x00d5a000 - 0x00d5c000 .reloc 0x77ca0000 - 0x77d20000 CLBCATQ.DLL 0x77ca1000 - 0x77d0f000 .text 0x77d0f000 - 0x77d19000 .data 0x77d19000 - 0x77d1b000 .rsrc 0x77d1b000 - 0x77d20000 .reloc 0x77990000 - 0x77a25000 OLEAUT32.DLL 0x77991000 - 0x77a16000 .text 0x77a16000 - 0x77a1d000 .data 0x77a1d000 - 0x77a1e000 .rsrc 0x77a1e000 - 0x77a25000 .reloc 0x77a30000 - 0x77b24000 OLE32.DLL 0x77a31000 - 0x77b08000 .text 0x77b08000 - 0x77b11000 .orpc 0x77b11000 - 0x77b17000 .data 0x77b17000 - 0x77b19000 .rsrc 0x77b19000 - 0x77b24000 .reloc 0x6dd30000 - 0x6dd36000 INDICDLL.dll 0x6dd31000 - 0x6dd33000 .text 0x6dd33000 - 0x6dd34000 .data 0x6dd34000 - 0x6dd35000 .rsrc 0x6dd35000 - 0x6dd36000 .reloc 0x10000000 - 0x10019000 NVDESK32.DLL 0x10001000 - 0x1000f000 .text 0x1000f000 - 0x10010000 .rdata 0x10010000 - 0x10012000 .data 0x10012000 - 0x10014000 .shared 0x10014000 - 0x10015000 .notshar 0x10015000 - 0x10017000 .rsrc 0x10017000 - 0x10019000 .reloc 0x75e00000 - 0x75e1a000 IMM32.DLL 0x75e01000 - 0x75e13000 .text 0x75e13000 - 0x75e14000 .data 0x75e14000 - 0x75e19000 .rsrc 0x75e19000 - 0x75e1a000 .reloc 0x777c0000 - 0x777dd000 WINSPOOL.DRV 0x777c1000 - 0x777d8000 .text 0x777d8000 - 0x777db000 .data 0x777db000 - 0x777dc000 .rsrc 0x777dc000 - 0x777dd000 .reloc 0x78000000 - 0x78046000 MSVCRT.DLL 0x78001000 - 0x78033000 .text 0x78033000 - 0x7803b000 .rdata 0x7803b000 - 0x78042000 .data 0x78042000 - 0x78043000 .rsrc 0x78043000 - 0x78046000 .reloc 0x77560000 - 0x777a0000 SHELL32.DLL 0x77561000 - 0x7767c000 .text 0x7767c000 - 0x77680000 .data 0x77680000 - 0x77791000 .rsrc 0x77791000 - 0x777a0000 .reloc 0x77b30000 - 0x77bba000 COMCTL32.DLL 0x77b31000 - 0x77b96000 .text 0x77b96000 - 0x77b97000 .data 0x77b97000 - 0x77bb6000 .rsrc 0x77bb6000 - 0x77bba000 .reloc 0x77d20000 - 0x77d8f000 RPCRT4.DLL 0x77d21000 - 0x77d81000 .text 0x77d81000 - 0x77d89000 .orpc 0x77d89000 - 0x77d8a000 .data 0x77d8a000 - 0x77d8b000 .rsrc 0x77d8b000 - 0x77d8f000 .reloc 0x77d90000 - 0x77dea000 ADVAPI32.DLL 0x77d91000 - 0x77de1000 .text 0x77de1000 - 0x77de4000 .data 0x77de4000 - 0x77de6000 .rsrc 0x77de6000 - 0x77dea000 .reloc 0x77df0000 - 0x77e54000 USER32.DLL 0x77df1000 - 0x77e48000 .text 0x77e48000 - 0x77e49000 .data 0x77e49000 - 0x77e51000 .rsrc 0x77e51000 - 0x77e54000 .reloc 0x77e60000 - 0x77f35000 KERNEL32.DLL 0x77e61000 - 0x77ebf000 .text 0x77ebf000 - 0x77ec1000 .data 0x77ec1000 - 0x77f31000 .rsrc 0x77f31000 - 0x77f35000 .reloc 0x77f40000 - 0x77f7c000 GDI32.DLL 0x77f41000 - 0x77f78000 .text 0x77f78000 - 0x77f79000 .data 0x77f79000 - 0x77f7a000 .rsrc 0x77f7a000 - 0x77f7c000 .reloc 0x77c50000 - 0x77c9a000 SHLWAPI.DLL 0x77c51000 - 0x77c94000 .text 0x77c94000 - 0x77c95000 .data 0x77c95000 - 0x77c97000 .rsrc 0x77c97000 - 0x77c9a000 .reloc 0x76af0000 - 0x76b2e000 comdlg32.dll 0x76af1000 - 0x76b1b000 .text 0x76b1b000 - 0x76b1f000 .data 0x76b1f000 - 0x76b2b000 .rsrc 0x76b2b000 - 0x76b2e000 .reloc 0x77f80000 - 0x77ff9000 ntdll.dll 0x77f81000 - 0x77fc4000 .text 0x77fc4000 - 0x77fc9000 ECODE 0x77fc9000 - 0x77fcd000 PAGE 0x77fcd000 - 0x77fd0000 .data 0x77fd0000 - 0x77ff7000 .rsrc 0x77ff7000 - 0x77ff9000 .reloc 0x01000000 - 0x01010000 NOTEPAD.EXE 0x01001000 - 0x01008000 .text 0x01008000 - 0x0100a000 .data 0x0100a000 - 0x01010000 .rsrc // 进程PEB 0x7ffdf000 - 0x7ffe0000 PEB // 线程堆栈(Stack)，以及线程TEB 0x0006a000 - 0x00070000 Stack Thread 0x118 0x7ffde000 - 0x7ffdf000 TEB Thread 0x118 0x00c2f000 - 0x00c30000 Stack Thread 0x2a8 0x7ffdd000 - 0x7ffde000 TEB Thread 0x2a8 系统地址空间的布局

    所有进程的系统地址空间中的内容，大部分是一样的。系统地址空间中有，系统代码，当前进程的页表，当前进程的页目录，当前进程的 Working Set，Paged pool （可以被换出物理内存的系统堆），Nonpaged pool （不能被换出物理内存的系统堆，NonPagedPool 有两部分，一部分位于系统地址空间的低处，一部分位于系统地址空间的高处），驱动程序等等。 下面我们来看一看当前我的系统地址空间的大概布局 HAL.dll 0x80001000 - 0x80011220 ntoskrnl.exe 0x80400000 - 0x80590900 MmNonPagedPoolStart 8103e000 win32k.sys 0xa0000000 - 0xa01a6000 当前进程的页表，页目录 0xc0000000 - 0xc03fffff MmSystemCacheStart c1000000 MmSystemCacheEnd e0ffffff MmPagedPoolStart e1000000 MmPagedPoolEnd e77fffff MmNonPagedSystemStart e7800000 MmNonPagedPoolExpansionStart fcd6c000 MmNonPagedPoolEnd ffbe0000 其中 MmNonPagedPoolStart，MmSystemCacheStart，MmSystemCacheEnd，MmPagedPoolStart，MmPagedPoolEnd，MmNonPagedSystemStart，MmNonPagedPoolEnd 是全局变量，使用 kd 我们可以得到这些全局变量的值。 kd> dd MmNonPagedPoolStart l 1 dd MmNonPagedPoolStart l 1 8047e750 8103e000 kd> dd MmSystemCacheStart l 1 dd MmSystemCacheStart l 1 8046ac00 c1000000 kd> dd MmSystemCacheEnd l 1 dd MmSystemCacheEnd l 1 8047efd8 e0ffffff kd> dd MmPagedPoolStart l 1 dd MmPagedPoolStart l 1 80471038 e1000000 kd> dd MmPagedPoolEnd l 1 dd MmPagedPoolEnd l 1 8047e738 e77fffff kd> dd MmNonPagedSystemStart l 1 dd MmNonPagedSystemStart l 1 8047f62c e7800000 kd> dd MmNonPagedPoolExpansionStart l 1 dd MmNonPagedPoolExpansionStart l 1 8047e8dc fcd6c000 kd> dd MmNonPagedPoolEnd l 1 dd MmNonPagedPoolEnd l 1 8046a85c ffbe0000 我写了一个叫 JiurlSystemModulesSee 的程序，可以获得系统地址空间载入的模组的信息。系统地址空间中载入的模组包括，ntoskrnl.exe，hal.dll，win32k.sys 以及驱动程序。 // 当前我的系统地址空间中载入的模组，以及模组中的各节 0x80400000 - 0x80590900 ntoskrnl.exe 0x804004c0 - 0x80466c69 .text 0x80466c80 - 0x804677df POOLCODE 0x80467800 - 0x80468a10 POOLMI 0x80468a40 - 0x8046912c MISYSPTE 0x80469140 - 0x80480ba4 .data 0x80480bc0 - 0x8048c2f8 PAGELK 0x8048c300 - 0x8052c481 PAGE 0x8052c4c0 - 0x8053275f PAGEVRFY 0x80532780 - 0x80535b39 PAGEKD 0x80535b40 - 0x80538430 PAGEHYDR 0x80538440 - 0x80538e4c PAGESPEC 0x80538e80 - 0x80541f87 .edata 0x80541fc0 - 0x80542cec PAGE 0x80542d00 - 0x80543090 PAGEVRFY 0x805430c0 - 0x805470e0 PAGEKD 0x80547100 - 0x805471ac PAGELK 0x805471c0 - 0x80569020 INIT 0x80569040 - 0x80583dd0 .rsrc 0x80583e00 - 0x805908c8 .reloc 0x80001000 - 0x80011220 hal.dll 0x80001340 - 0x80007835 .text 0x80007840 - 0x80008fb0 .data 0x80008fc0 - 0x8000a93b PAGELK 0x8000a940 - 0x8000a998 PAGELK16 0x8000a9a0 - 0x8000cecc PAGE 0x8000cee0 - 0x8000da93 .edata 0x8000daa0 - 0x80010298 INIT 0x800102a0 - 0x80010670 .rsrc 0x80010680 - 0x80011204 .reloc 0xf0810000 - 0xf0813000 BOOTVID.DLL 0xf08102c0 - 0xf08118d4 .text 0xf08118e0 - 0xf081226c .data 0xf0812280 - 0xf08123d8 .edata 0xf08123e0 - 0xf0812514 INIT 0xf0812520 - 0xf08128d0 .rsrc 0xf08128e0 - 0xf0812a04 .reloc 0xfcd43000 - 0xfcd6b000 ACPI.sys 0xfcd43320 - 0xfcd59ac4 .text 0xfcd59ae0 - 0xfcd5a3c0 .rdata 0xfcd5a3c0 - 0xfcd5c6b4 .data 0xfcd5c6c0 - 0xfcd66c74 PAGE 0xfcd66c80 - 0xfcd67091 PAGE 0xfcd670a0 - 0xfcd681e2 INIT 0xfcd68200 - 0xfcd68a18 .rsrc 0xfcd68a20 - 0xfcd6ab30 .reloc 0xf09c8000 - 0xf09c9000 WMILIB.SYS 0xf09c82e0 - 0xf09c84cd .text 0xf09c84e0 - 0xf09c8570 .rdata 0xf09c8580 - 0xf09c89e3 PAGE 0xf09c8a00 - 0xf09c8a82 .edata 0xf09c8aa0 - 0xf09c8b58 INIT 0xf09c8b60 - 0xf09c8f30 .rsrc 0xf09c8f40 - 0xf09c8f80 .reloc 0xf0400000 - 0xf040f000 pci.sys 0xf04002e0 - 0xf040346a .text 0xf0403480 - 0xf0403868 .rdata 0xf0403880 - 0xf0403e70 .data 0xf0403e80 - 0xf040b891 PAGE 0xf040b8a0 - 0xf040ca8a INIT 0xf040caa0 - 0xf040db18 .rsrc 0xf040db20 - 0xf040e33a .reloc 0xf0410000 - 0xf041c000 isapnp.sys 0xf04102e0 - 0xf0413ae2 .text 0xf0413b00 - 0xf0413d88 .rdata 0xf0413da0 - 0xf04140d4 .data 0xf04140e0 - 0xf0419a64 PAGE 0xf0419a80 - 0xf041a272 INIT 0xf041a280 - 0xf041ad28 .rsrc 0xf041ad40 - 0xf041b576 .reloc 0xf09c9000 - 0xf09ca000 intelide.sys 0xf09c92c0 - 0xf09c999a .text 0xf09c99a0 - 0xf09c9a20 .rdata 0xf09c9a20 - 0xf09c9a35 .data 0xf09c9a40 - 0xf09c9ac0 INIT 0xf09c9ac0 - 0xf09c9f00 .rsrc 0xf09c9f00 - 0xf09c9f26 .reloc 0xf0680000 - 0xf0686000 PCIIDEX.SYS 0xf0680340 - 0xf06811d0 NONPAGE 0xf06811e0 - 0xf06814e6 .text 0xf0681500 - 0xf0681968 .rdata 0xf0681980 - 0xf0681b60 .data 0xf0681b60 - 0xf0684611 PAGE 0xf0684620 - 0xf06846c4 .edata 0xf06846e0 - 0xf0684d24 INIT 0xf0684d40 - 0xf0685110 .rsrc 0xf0685120 - 0xf0685494 .reloc 0xf0688000 - 0xf0690000 MountMgr.sys 0xf06882c0 - 0xf06886e4 .text 0xf0688700 - 0xf06888b0 .rdata 0xf06888c0 - 0xf068e08d PAGE 0xf068e0a0 - 0xf068e904 INIT 0xf068e920 - 0xf068ecd8 .rsrc 0xf068ece0 - 0xf068f176 .reloc 0xfcd26000 - 0xfcd43000 ftdisk.sys 0xfcd26300 - 0xfcd2751a .text 0xfcd27520 - 0xfcd27c30 .rdata 0xfcd27c40 - 0xfcd27c54 .data 0xfcd27c60 - 0xfcd33237 PAGE 0xfcd33240 - 0xfcd3efab PAGELK 0xfcd3efc0 - 0xfcd3fce8 INIT 0xfcd3fd00 - 0xfcd40fd8 .rsrc 0xfcd40fe0 - 0xfcd420be .reloc 0xf0900000 - 0xf0902000 Diskperf.sys 0xf09002e0 - 0xf090099c .text 0xf09009a0 - 0xf0900ab0 .rdata 0xf0900ac0 - 0xf0900ad8 .data 0xf0900ae0 - 0xf09012bf PAGE 0xf09012c0 - 0xf09016e2 INIT 0xf0901700 - 0xf0901ac8 .rsrc 0xf0901ae0 - 0xf0901bfc .reloc 0xf0902000 - 0xf0904000 dmload.sys 0xf09022c0 - 0xf0902de0 .text 0xf0902de0 - 0xf0902ec0 .rdata 0xf0902ec0 - 0xf0902ef8 .data 0xf0902f00 - 0xf090314a INIT 0xf0903160 - 0xf0903a90 .rsrc 0xf0903aa0 - 0xf0903b7e .reloc 0xfcd04000 - 0xfcd26000 dmio.sys 0xfcd042c0 - 0xfcd1db9a .text 0xfcd1dba0 - 0xfcd1de40 .rdata 0xfcd1de40 - 0xfcd21978 .data 0xfcd21980 - 0xfcd22416 INIT 0xfcd22420 - 0xfcd23e58 .rsrc 0xfcd23e60 - 0xfcd2521e .reloc 0xf0814000 - 0xf0817000 PartMgr.sys 0xf08142c0 - 0xf08144ea .text 0xf0814500 - 0xf0814640 .rdata 0xf0814640 - 0xf081602a PAGE 0xf0816040 - 0xf0816582 INIT 0xf08165a0 - 0xf0816958 .rsrc 0xf0816960 - 0xf0816b6c .reloc 0xfccef000 - 0xfcd04000 atapi.sys 0xfccef360 - 0xfccf7e98 .text 0xfccf7ea0 - 0xfccf99eb NONPAGE 0xfccf9a00 - 0xfccfa900 .rdata 0xfccfa900 - 0xfccfb630 .data 0xfccfb640 - 0xfccfc61f PAGESCAN 0xfccfc620 - 0xfcd008c5 PAGE 0xfcd008e0 - 0xfcd00b59 PAGE_ATA 0xfcd00b60 - 0xfcd02b0e INIT 0xfcd02b20 - 0xfcd02ed8 .rsrc 0xfcd02ee0 - 0xfcd03ac6 .reloc 0xf0690000 - 0xf0697000 disk.sys 0xf06902e0 - 0xf0692290 .text 0xf06922a0 - 0xf0692830 .rdata 0xf0692840 - 0xf06928d8 .data 0xf06928e0 - 0xf06950c7 PAGE 0xf06950e0 - 0xf06961ee INIT 0xf0696200 - 0xf06965b8 .rsrc 0xf06965c0 - 0xf0696a1e .reloc 0xf0420000 - 0xf0429000 CLASSPNP.SYS 0xf0420300 - 0xf0423b56 .text 0xf0423b60 - 0xf0423d8c .rdata 0xf0423da0 - 0xf0423dc4 .data 0xf0423de0 - 0xf042695f PAGE 0xf0426960 - 0xf042709e .edata 0xf04270a0 - 0xf04279ca INIT 0xf04279e0 - 0xf0427da8 .rsrc 0xf0427dc0 - 0xf042825c .reloc 0xfccca000 - 0xfccef000 Fastfat.sys 0xfccca2e0 - 0xfcccc3c1 .text 0xfcccc3e0 - 0xfcccd29c .rdata 0xfcccd2a0 - 0xfcccd660 .data 0xfcccd660 - 0xfccea9d4 PAGE 0xfccea9e0 - 0xfccec8ba INIT 0xfccec8c0 - 0xfccecc88 .rsrc 0xfccecca0 - 0xfccee038 .reloc 0xfccb9000 - 0xfccca000 KSecDD.sys 0xfccb9360 - 0xfccbe98f .text 0xfccbe9a0 - 0xfccbef7c .rdata 0xfccbef80 - 0xfccc08a0 .data 0xfccc08a0 - 0xfccc3cd0 PAGE 0xfccc3ce0 - 0xfccc7420 PAGEMSG 0xfccc7420 - 0xfccc7863 .edata 0xfccc7880 - 0xfccc8880 PAGER32D 0xfccc8880 - 0xfccc8eca INIT 0xfccc8ee0 - 0xfccc92c8 .rsrc 0xfccc92e0 - 0xfccc9b6e .reloc 0xfcc90000 - 0xfccb9000 NDIS.sys 0xfcc904a0 - 0xfcc9342e .text 0xfcc93440 - 0xfcc93850 .rdata 0xfcc93860 - 0xfcc93d90 .data 0xfcc93da0 - 0xfcc99f74 PAGENPNP 0xfcc99f80 - 0xfcc9f0b3 PAGENDSM 0xfcc9f0c0 - 0xfcca7f10 PAGENDSI 0xfcca7f20 - 0xfccaa475 PAGENDSP 0xfccaa480 - 0xfccab3fc PAGENDSW 0xfccab400 - 0xfccad828 PAGENDCO 0xfccad840 - 0xfccaea97 PAGENDST 0xfccaeaa0 - 0xfccb068e PAGENDSF 0xfccb06a0 - 0xfccb1bbf PAGENDSE 0xfccb1bc0 - 0xfccb2ba9 PAGENDSA 0xfccb2bc0 - 0xfccb55f5 .edata 0xfccb5600 - 0xfccb6190 PAGE 0xfccb61a0 - 0xfccb76e6 INIT 0xfccb7700 - 0xfccb7ab8 .rsrc 0xfccb7ac0 - 0xfccb8e2c .reloc 0xf0430000 - 0xf0439000 ohci1394.sys 0xf04302c0 - 0xf0436fa6 .text 0xf0436fc0 - 0xf0437130 .rdata 0xf0437140 - 0xf0437f9f PAGE 0xf0437fa0 - 0xf043863c INIT 0xf0438640 - 0xf0438a10 .rsrc 0xf0438a20 - 0xf0438dfe .reloc 0xf0440000 - 0xf044b000 1394BUS.SYS 0xf0440300 - 0xf044526f .text 0xf0445280 - 0xf04453c0 .rdata 0xf04453c0 - 0xf0445400 .data 0xf0445400 - 0xf04491c5 PAGE 0xf04491e0 - 0xf0449238 .edata 0xf0449240 - 0xf0449772 INIT 0xf0449780 - 0xf0449b40 .rsrc 0xf0449b40 - 0xf044a08a .reloc 0xfcc7a000 - 0xfcc90000 Mup.sys 0xfcc7a2e0 - 0xfcc7bc88 .text 0xfcc7bca0 - 0xfcc7c1bc .rdata 0xfcc7c1c0 - 0xfcc7dbcc .data 0xfcc7dbe0 - 0xfcc8cdcc PAGE 0xfcc8cde0 - 0xfcc8d9f2 INIT 0xfcc8da00 - 0xfcc8ddc0 .rsrc 0xfcc8ddc0 - 0xfcc8f130 .reloc 0xf0698000 - 0xf069d000 agp440.sys 0xf06982e0 - 0xf0699411 .text 0xf0699420 - 0xf0699540 .rdata 0xf0699540 - 0xf0699554 .data 0xf0699560 - 0xf069c422 PAGE 0xf069c440 - 0xf069c7f6 INIT 0xf069c800 - 0xf069cbb8 .rsrc 0xf069cbc0 - 0xf069cf94 .reloc 0xf0470000 - 0xf047d000 VIDEOPRT.SYS 0xf0470340 - 0xf0471bb2 .text 0xf0471bc0 - 0xf047224c .rdata 0xf0472260 - 0xf04722b8 .data 0xf04722c0 - 0xf04799cf PAGE 0xf04799e0 - 0xf047a62b .edata 0xf047a640 - 0xf047a7e8 PAGE_DAT 0xf047a800 - 0xf047b854 INIT 0xf047b860 - 0xf047bc20 .rsrc 0xf047bc20 - 0xf047c3f4 .reloc 0xf032a000 - 0xf03e0000 nv4_mini.sys 0xf032a340 - 0xf0391472 .text 0xf0391480 - 0xf0391fc9 _NVTEXT3 0xf0391fe0 - 0xf039304c .rdata 0xf0393060 - 0xf03d5ee0 .data 0xf03d5ee0 - 0xf03d996b PAGE 0xf03d9980 - 0xf03dc46a PAGE 0xf03dc480 - 0xf03dcc54 INIT 0xf03dcc60 - 0xf03dd098 .rsrc 0xf03dd0a0 - 0xf03df67a .reloc 0xf06c0000 - 0xf06c7000 fdc.sys 0xf06c02e0 - 0xf06c4972 .text 0xf06c4980 - 0xf06c4b40 .rdata 0xf06c4b40 - 0xf06c4c2a .data 0xf06c4c40 - 0xf06c4d7d PAGE 0xf06c4d80 - 0xf06c5c78 INIT 0xf06c5c80 - 0xf06c6040 .rsrc 0xf06c6040 - 0xf06c6530 .reloc 0xf0480000 - 0xf0490000 serial.sys 0xf0480320 - 0xf0482555 .text 0xf0482560 - 0xf0482700 .rdata 0xf0482700 - 0xf04827f4 .data 0xf0482800 - 0xf0486b66 PAGESRP0 0xf0486b80 - 0xf048a2e8 PAGESER 0xf048a300 - 0xf048c7ba INIT 0xf048c7c0 - 0xf048eaf8 .rsrc 0xf048eb00 - 0xf048f2d4 .reloc 0xf0878000 - 0xf087c000 serenum.sys 0xf0878320 - 0xf0878af6 .text 0xf0878b00 - 0xf0878c50 .rdata 0xf0878c60 - 0xf0878c64 .data 0xf0878c80 - 0xf0879e09 PAGE 0xf0879e20 - 0xf087a9a5 PAGESENM 0xf087a9c0 - 0xf087aeea INIT 0xf087af00 - 0xf087b2c0 .rsrc 0xf087b2c0 - 0xf087b492 .reloc 0xf06d8000 - 0xf06df000 parport.sys 0xf06d82e0 - 0xf06dc346 .text 0xf06dc360 - 0xf06dc948 .rdata 0xf06dc960 - 0xf06dcb40 .data 0xf06dcb40 - 0xf06dcc5b PAGEPARW 0xf06dcc60 - 0xf06dd368 INIT 0xf06dd380 - 0xf06ddd00 .rsrc 0xf06ddd00 - 0xf06de0dc .reloc 0xf0490000 - 0xf049c000 i8042prt.sys 0xf0490300 - 0xf04928aa .text 0xf04928c0 - 0xf04938f0 .rdata 0xf0493900 - 0xf0493d08 .data 0xf0493d20 - 0xf04973bd PAGE 0xf04973c0 - 0xf04987da PAGEMOUC 0xf04987e0 - 0xf049958c INIT 0xf04995a0 - 0xf049b258 .rsrc 0xf049b260 - 0xf049b970 .reloc 0xf06e8000 - 0xf06ee000 mouclass.sys 0xf06e82e0 - 0xf06e9b1a .text 0xf06e9b20 - 0xf06e9cf0 .rdata 0xf06e9d00 - 0xf06ea068 .data 0xf06ea080 - 0xf06eb4a3 PAGE 0xf06eb4c0 - 0xf06ec2ec INIT 0xf06ec300 - 0xf06ecf50 .rsrc 0xf06ecf60 - 0xf06ed3f4 .reloc 0xf06f8000 - 0xf06fe000 kbdclass.sys 0xf06f82e0 - 0xf06f9df2 .text 0xf06f9e00 - 0xf06f9fe0 .rdata 0xf06f9fe0 - 0xf06fa364 .data 0xf06fa380 - 0xf06fbe3b PAGE 0xf06fbe40 - 0xf06fccfa INIT 0xf06fcd00 - 0xf06fd960 .rsrc 0xf06fd960 - 0xf06fde92 .reloc 0xf04a0000 - 0xf04ad000 Cdr4_2K.SYS 0xf04a02c0 - 0xf04ab762 .text 0xf04ab780 - 0xf04ab8e8 .rdata 0xf04ab900 - 0xf04abdfc .data 0xf04abe00 - 0xf04ac41e INIT 0xf04ac420 - 0xf04ac780 .rsrc 0xf04ac780 - 0xf04acccc .reloc 0xf0710000 - 0xf0717000 cdrom.sys 0xf0710360 - 0xf07147ec .text 0xf0714800 - 0xf07149ec .rdata 0xf0714a00 - 0xf0714a2c .data 0xf0714a40 - 0xf071559b PAGE 0xf07155a0 - 0xf07155d9 PAGEHIT2 0xf07155e0 - 0xf0715750 PAGEHITA 0xf0715760 - 0xf0715962 PAGETOSH 0xf0715980 - 0xf071628c INIT 0xf07162a0 - 0xf0716660 .rsrc 0xf0716660 - 0xf07169c4 .reloc 0xf0720000 - 0xf0726000 Cdralw2k.SYS 0xf07202c0 - 0xf0723e94 .text 0xf0723ea0 - 0xf0724064 .rdata 0xf0724080 - 0xf0724210 .data 0xf0724220 - 0xf0724abe INIT 0xf0724ac0 - 0xf0724e40 .rsrc 0xf0724e40 - 0xf0725238 .reloc 0xf0740000 - 0xf0745000 USBD.SYS 0xf0740300 - 0xf074202e .text 0xf0742040 - 0xf07421a0 .rdata 0xf07421a0 - 0xf07423b1 .data 0xf07423c0 - 0xf0743ee9 PAGE 0xf0743f00 - 0xf07443aa .edata 0xf07443c0 - 0xf07448d4 INIT 0xf07448e0 - 0xf0744ca0 .rsrc 0xf0744ca0 - 0xf0744f4a .reloc 0xf0730000 - 0xf0738000 uhcd.sys 0xf07302e0 - 0xf0736014 .text 0xf0736020 - 0xf07361a0 .rdata 0xf07361a0 - 0xf0736208 .data 0xf0736220 - 0xf0736eab PAGE 0xf0736ec0 - 0xf073757a INIT 0xf0737580 - 0xf0737950 .rsrc 0xf0737960 - 0xf0737c70 .reloc 0xf04b0000 - 0xf04be000 mf.sys 0xf04b02e0 - 0xf04b14e8 .text 0xf04b1500 - 0xf04b7b38 .rdata 0xf04b7b40 - 0xf04b99a8 .data 0xf04b99c0 - 0xf04bca07 PAGE 0xf04bca20 - 0xf04bcf16 INIT 0xf04bcf20 - 0xf04bd2d8 .rsrc 0xf04bd2e0 - 0xf04bde4a .reloc 0xf0758000 - 0xf075d000 RTL8139.SYS 0xf0758400 - 0xf075b1af .text 0xf075b200 - 0xf075b2fd .data 0xf075b400 - 0xf075b7ce PAGE 0xf075b800 - 0xf075bda0 INIT 0xf075be00 - 0xf075c3a0 .rsrc 0xf075c400 - 0xf075c668 .reloc 0xf0888000 - 0xf088b000 fsvga.sys 0xf08882c0 - 0xf0889ce4 .text 0xf0889d00 - 0xf0889e2c .rdata 0xf0889e40 - 0xf0889e88 .data 0xf0889ea0 - 0xf088a694 INIT 0xf088a6a0 - 0xf088adf0 .rsrc 0xf088ae00 - 0xf088af3c .reloc 0xf09d6000 - 0xf09d7000 audstub.sys 0xf09d62c0 - 0xf09d6360 .rdata 0xf09d6360 - 0xf09d64ed PAGE 0xf09d6500 - 0xf09d6640 INIT 0xf09d6640 - 0xf09d69f0 .rsrc 0xf09d6a00 - 0xf09d6a3c .reloc 0xf04c0000 - 0xf04cd000 rasl2tp.sys 0xf04c02c0 - 0xf04cafa7 .text 0xf04cafc0 - 0xf04cb0fc .rdata 0xf04cb100 - 0xf04cb2a0 .data 0xf04cb2a0 - 0xf04cbc06 INIT 0xf04cbc20 - 0xf04cc000 .rsrc 0xf04cc000 - 0xf04cc55c .reloc 0xf0890000 - 0xf0893000 ndistapi.sys 0xf08902e0 - 0xf0891490 .text 0xf08914a0 - 0xf089159c .rdata 0xf08915a0 - 0xf08915f4 .data 0xf0891600 - 0xf08916c0 .edata 0xf08916c0 - 0xf0891be2 INIT 0xf0891c00 - 0xf0891fe0 .rsrc 0xf0891fe0 - 0xf089221c .reloc 0xf0313000 - 0xf032a000 ndiswan.sys 0xf03132c0 - 0xf0324893 .text 0xf03248a0 - 0xf0325868 .rdata 0xf0325880 - 0xf0326114 .data 0xf0326120 - 0xf0327f22 INIT 0xf0327f40 - 0xf0328330 .rsrc 0xf0328340 - 0xf032916c .reloc 0xf089c000 - 0xf08a0000 TDI.SYS 0xf089c300 - 0xf089e9ba .text 0xf089e9c0 - 0xf089eb4e .rdata 0xf089eb60 - 0xf089ec8c .data 0xf089eca0 - 0xf089edbc PAGE 0xf089edc0 - 0xf089f419 .edata 0xf089f420 - 0xf089f94a INIT 0xf089f960 - 0xf089fcf8 .rsrc 0xf089fd00 - 0xf089ff28 .reloc 0xf04d0000 - 0xf04dc000 raspptp.sys 0xf04d02c0 - 0xf04da138 .text 0xf04da140 - 0xf04da393 .rdata 0xf04da3a0 - 0xf04da6b8 .data 0xf04da6c0 - 0xf04dae4e INIT 0xf04dae60 - 0xf04db230 .rsrc 0xf04db240 - 0xf04db9d0 .reloc 0xf0780000 - 0xf0785000 ptilink.sys 0xf07802e0 - 0xf078352d .text 0xf0783540 - 0xf0783670 .rdata 0xf0783680 - 0xf078371c .data 0xf0783720 - 0xf078383d .edata 0xf0783840 - 0xf0783d10 INIT 0xf0783d20 - 0xf0784120 .rsrc 0xf0784120 - 0xf07843c4 .reloc 0xf0790000 - 0xf0795000 raspti.sys 0xf07902c0 - 0xf0792e40 .text 0xf0792e40 - 0xf0792fd0 .rdata 0xf0792fe0 - 0xf0793240 .data 0xf0793240 - 0xf0793aa0 INIT 0xf0793aa0 - 0xf0793e98 .rsrc 0xf0793ea0 - 0xf07940ce .reloc 0xf04e0000 - 0xf04ef000 parallel.sys 0xf04e02e0 - 0xf04ebdb2 .text 0xf04ebdc0 - 0xf04ec6b8 .rdata 0xf04ec6c0 - 0xf04eced4 .data 0xf04ecee0 - 0xf04ed04d PAGEPARW 0xf04ed060 - 0xf04ed9cc INIT 0xf04ed9e0 - 0xf04ee000 .rsrc 0xf04ee000 - 0xf04ee998 .reloc 0xf07a8000 - 0xf07b0000 RMSPPPOE.SYS 0xf07a82c0 - 0xf07ae542 .text 0xf07ae560 - 0xf07ae942 .rdata 0xf07ae960 - 0xf07ae9e0 .data 0xf07ae9e0 - 0xf07af21e INIT 0xf07af220 - 0xf07af658 .rsrc 0xf07af660 - 0xf07af938 .reloc 0xf02cd000 - 0xf02eb000 ks.sys 0xf02cd360 - 0xf02d3512 .text 0xf02d3520 - 0xf02d3d39 .rdata 0xf02d3d40 - 0xf02d3d6c .data 0xf02d3d80 - 0xf02e5167 PAGE 0xf02e5180 - 0xf02e6fa9 .edata 0xf02e6fc0 - 0xf02e8054 PAGECONS 0xf02e8060 - 0xf02e90b0 INIT 0xf02e90c0 - 0xf02e94a8 .rsrc 0xf02e94c0 - 0xf02eaa00 .reloc 0xf09d7000 - 0xf09d8000 swenum.sys 0xf09d72c0 - 0xf09d739e .text 0xf09d73a0 - 0xf09d7445 .rdata 0xf09d7460 - 0xf09d7684 PAGE 0xf09d76a0 - 0xf09d78d2 INIT 0xf09d78e0 - 0xf09d7d00 .rsrc 0xf09d7d00 - 0xf09d7d76 .reloc 0xf02b8000 - 0xf02cd000 update.sys 0xf02b8320 - 0xf02b8524 .text 0xf02b8540 - 0xf02b85ac .rdata 0xf02b85c0 - 0xf02b85dc .data 0xf02b85e0 - 0xf02b8e51 PAGE 0xf02b8e60 - 0xf02cbe60 PAGELK 0xf02cbe60 - 0xf02cc172 INIT 0xf02cc180 - 0xf02cc7f0 .rsrc 0xf02cc800 - 0xf02cc884 .reloc 0xf07c0000 - 0xf07c5000 flpydisk.sys 0xf07c02e0 - 0xf07c097a .text 0xf07c0980 - 0xf07c0b1c .rdata 0xf07c0b20 - 0xf07c0fb8 .data 0xf07c0fc0 - 0xf07c3b83 PAGE 0xf07c3ba0 - 0xf07c4374 INIT 0xf07c4380 - 0xf07c4730 .rsrc 0xf07c4740 - 0xf07c4a66 .reloc 0xf0510000 - 0xf051a000 usbhub.sys 0xf05102e0 - 0xf0513b1e .text 0xf0513b20 - 0xf0513e2e .rdata 0xf0513e40 - 0xf0513f78 .data 0xf0513f80 - 0xf051883f PAGE 0xf0518840 - 0xf0519080 INIT 0xf0519080 - 0xf0519448 .rsrc 0xf0519460 - 0xf0519b36 .reloc 0xef206000 - 0xef22b000 portcls.sys 0xef206320 - 0xef210515 .text 0xef210520 - 0xef2131c0 .rdata 0xef2131c0 - 0xef215ad8 .data 0xef215ae0 - 0xef226f8b PAGE 0xef226fa0 - 0xef227642 .edata 0xef227660 - 0xef2286cc INIT 0xef2286e0 - 0xef228ad8 .rsrc 0xef228ae0 - 0xef22a48c .reloc 0xef22b000 - 0xef2b8000 adm8820.sys 0xef22b320 - 0xef26f5b0 .text 0xef26f5c0 - 0xef2723dc .rdata 0xef2723e0 - 0xef2b3d48 .data 0xef2b3d60 - 0xef2b3d64 .CRT 0xef2b3d80 - 0xef2b4631 PAGE 0xef2b4640 - 0xef2b4f90 INIT 0xef2b4fa0 - 0xef2b5380 .rsrc 0xef2b5380 - 0xef2b7938 .reloc 0xf08a4000 - 0xf08a7000 admjoy.sys 0xf08a42c0 - 0xf08a47fd .text 0xf08a4800 - 0xf08a4920 .rdata 0xf08a4920 - 0xf08a5b92 PAGE 0xf08a5ba0 - 0xf08a600c INIT 0xf08a6020 - 0xf08a6420 .rsrc 0xf08a6420 - 0xf08a65b4 .reloc 0xf0520000 - 0xf052a000 NDProxy.SYS 0xf05202c0 - 0xf0527d5c .text 0xf0527d60 - 0xf0527ed0 .rdata 0xf0527ee0 - 0xf05286e8 .data 0xf0528700 - 0xf0529080 INIT 0xf0529080 - 0xf0529428 .rsrc 0xf0529440 - 0xf0529cca .reloc 0xf0910000 - 0xf0912000 Fs_Rec.SYS 0xf09102e0 - 0xf09102f2 .text 0xf0910300 - 0xf0910416 .rdata 0xf0910420 - 0xf0910474 .data 0xf0910480 - 0xf091110b PAGE 0xf0911120 - 0xf09116fe INIT 0xf0911700 - 0xf0911ad0 .rsrc 0xf0911ae0 - 0xf0911bb4 .reloc 0xf09d8000 - 0xf09d9000 Null.SYS 0xf09d82c0 - 0xf09d8350 .rdata 0xf09d8360 - 0xf09d8447 PAGE 0xf09d8460 - 0xf09d85f2 INIT 0xf09d8600 - 0xf09d89a0 .rsrc 0xf09d89a0 - 0xf09d89cc .reloc 0xf09d9000 - 0xf09da000 Beep.SYS 0xf09d9280 - 0xf09d96b8 .text 0xf09d96c0 - 0xf09d97a0 .rdata 0xf09d97a0 - 0xf09d9a76 INIT 0xf09d9a80 - 0xf09d9e20 .rsrc 0xf09d9e20 - 0xf09d9ece .reloc 0xf08c0000 - 0xf08c4000 vga.sys 0xf08c02e0 - 0xf08c03c0 .text 0xf08c03c0 - 0xf08c0490 .rdata 0xf08c04a0 - 0xf08c27ec PAGE 0xf08c2800 - 0xf08c2c3a PAGE_DAT 0xf08c2c40 - 0xf08c2ffc INIT 0xf08c3000 - 0xf08c33b8 .rsrc 0xf08c33c0 - 0xf08c3564 .reloc 0xf09da000 - 0xf09db000 mnmdd.SYS 0xf09da2e0 - 0xf09da2ec .text 0xf09da300 - 0xf09da3a0 .rdata 0xf09da3a0 - 0xf09da6c3 PAGE 0xf09da6e0 - 0xf09daa0c PAGE 0xf09daa20 - 0xf09dab52 INIT 0xf09dab60 - 0xf09daf28 .rsrc 0xf09daf40 - 0xf09daf80 .reloc 0xf07e8000 - 0xf07ee000 Msfs.SYS 0xf07e82e0 - 0xf07e84a8 .text 0xf07e84c0 - 0xf07e891c .rdata 0xf07e8920 - 0xf07e8930 .data 0xf07e8940 - 0xf07ec222 PAGE 0xf07ec240 - 0xf07ec884 INIT 0xf07ec8a0 - 0xf07ecc48 .rsrc 0xf07ecc60 - 0xf07ed22a .reloc 0xf0540000 - 0xf0549000 Npfs.SYS 0xf05402e0 - 0xf0541c2a .text 0xf0541c40 - 0xf05421f4 .rdata 0xf0542200 - 0xf05422b4 .data 0xf05422c0 - 0xf0547617 PAGE 0xf0547620 - 0xf0548282 INIT 0xf05482a0 - 0xf0548640 .rsrc 0xf0548640 - 0xf0548f98 .reloc 0xf091c000 - 0xf091e000 rasacd.sys 0xf091c2e0 - 0xf091d0e0 .text 0xf091d0e0 - 0xf091d1c0 .rdata 0xf091d1c0 - 0xf091d2d4 .data 0xf091d2e0 - 0xf091d3f7 PAGE 0xf091d400 - 0xf091d84a INIT 0xf091d860 - 0xf091dc30 .rsrc 0xf091dc40 - 0xf091de32 .reloc 0xef15b000 - 0xef1a6000 tcpip.sys 0xef15b340 - 0xef1934da .text 0xef1934e0 - 0xef1939d4 .rdata 0xef1939e0 - 0xef196950 .data 0xef196960 - 0xef19a2d3 PAGE 0xef19a2e0 - 0xef19d2ad PAGEIPMc 0xef19d2c0 - 0xef19d580 .edata 0xef19d580 - 0xef1a1f7a INIT 0xef1a1f80 - 0xef1a2348 .rsrc 0xef1a2360 - 0xef1a5844 .reloc 0xf0550000 - 0xf0559000 msgpc.sys 0xf05502e0 - 0xf0557104 .text 0xf0557120 - 0xf05571d0 .rdata 0xf05571e0 - 0xf05576d0 .data 0xf05576e0 - 0xf055789d PAGE 0xf05578a0 - 0xf0557c8e INIT 0xf0557ca0 - 0xf0558068 .rsrc 0xf0558080 - 0xf05586c4 .reloc 0xf07f8000 - 0xf0800000 wanarp.sys 0xf07f82e0 - 0xf07fcf5c .text 0xf07fcf60 - 0xf07fd100 .rdata 0xf07fd100 - 0xf07fd408 .data 0xf07fd420 - 0xf07fe181 PAGE 0xf07fe1a0 - 0xf07feb7c INIT 0xf07feb80 - 0xf07fef60 .rsrc 0xf07fef60 - 0xf07ff950 .reloc 0xef136000 - 0xef15b000 netbt.sys 0xef136320 - 0xef14e8b8 .text 0xef14e8c0 - 0xef14eb5a .rdata 0xef14eb60 - 0xef14f124 .data 0xef14f140 - 0xef1568ac PAGE 0xef1568c0 - 0xef156f2b PAGENBT 0xef156f40 - 0xef15850c INIT 0xef158520 - 0xef1588d8 .rsrc 0xef1588e0 - 0xef15a4c4 .reloc 0xf0560000 - 0xf0569000 netbios.sys 0xf05602e0 - 0xf0563b94 .text 0xf0563ba0 - 0xf0563d34 .rdata 0xf0563d40 - 0xf0563ff4 .data 0xf0564000 - 0xf0566d49 PAGE 0xf0566d60 - 0xf0567646 INIT 0xf0567660 - 0xf0567a28 .rsrc 0xf0567a40 - 0xf056818c .reloc 0xef078000 - 0xef096000 Siwvid.SYS 0xef0782e0 - 0xef078387 _LTEXT 0xef0783a0 - 0xef081172 .text 0xef081180 - 0xef093878 .data 0xef093880 - 0xef093888 _LDATA 0xef0938a0 - 0xef093e7c INIT 0xef093e80 - 0xef094248 .rsrc 0xef094260 - 0xef095314 .reloc 0xef056000 - 0xef078000 rdbss.sys 0xef056300 - 0xef05cf8f .text 0xef05cfa0 - 0xef05d706 .rdata 0xef05d720 - 0xef05deb4 .data 0xef05dec0 - 0xef073139 PAGE 0xef073140 - 0xef073ec4 .edata 0xef073ee0 - 0xef075e2e INIT 0xef075e40 - 0xef076240 .rsrc 0xef076240 - 0xef077394 .reloc 0xeefe6000 - 0xef044000 mrxsmb.sys 0xeefe63c0 - 0xeeffc707 .text 0xeeffc720 - 0xeeffc983 SECUR 0xeeffc9a0 - 0xeeffda17 .rdata 0xeeffda20 - 0xef002f51 .data 0xef002f60 - 0xef03b767 PAGE 0xef03b780 - 0xef03cac0 PAGE4BRO 0xef03cac0 - 0xef03cefc PAGE5NET 0xef03cf00 - 0xef03cf33 .edata 0xef03cf40 - 0xef03cf8c PAGE 0xef03cfa0 - 0xef03f6a2 INIT 0xef03f6c0 - 0xef03fa80 .rsrc 0xef03fa80 - 0xef0431e0 .reloc 0xa0000000 - 0xa01a6000 win32k.sys JiurlReadProcessMemory Failed 0xecdd8000 - 0xecfae000 nv4_disp.dll 0xecdd8320 - 0xecf2222a .text 0xecf22240 - 0xecf484e4 .rdata 0xecf48500 - 0xecf8fed8 .data 0xecf8fee0 - 0xecf8fee8 .CRT 0xecf8ff00 - 0xecf8ffba .edata 0xecf8ffc0 - 0xecf90656 INIT 0xecf90660 - 0xecf90ae0 .rsrc 0xecf90ae0 - 0xecfada14 .reloc 0xeba25000 - 0xeba3f000 afd.sys 0xeba25320 - 0xeba26a5c .text 0xeba26a60 - 0xeba27348 .rdata 0xeba27360 - 0xeba278cc .data 0xeba278e0 - 0xeba35fa5 PAGEAFD 0xeba35fc0 - 0xeba3b8e1 PAGE 0xeba3b900 - 0xeba3d248 INIT 0xeba3d260 - 0xeba3d630 .rsrc 0xeba3d640 - 0xeba3e978 .reloc 0xf0932000 - 0xf0934000 ParVdm.SYS 0xf09322c0 - 0xf09327d4 .text 0xf09327e0 - 0xf09328c8 .rdata 0xf09328e0 - 0xf09328f4 .data 0xf0932900 - 0xf093310a INIT 0xf0933120 - 0xf0933778 .rsrc 0xf0933780 - 0xf0933846 .reloc 0xebb47000 - 0xebb4b000 Aspi32.SYS 0xebb47240 - 0xebb49d2a .text 0xebb49d40 - 0xebb49e94 .data 0xebb49ea0 - 0xebb4a504 INIT 0xebb4a520 - 0xebb4a894 .rsrc 0xebb4a8a0 - 0xebb4ab7c .reloc 0xf06f0000 - 0xf06f7000 cis1284.sys 0xf06f0280 - 0xf06f57e0 .text 0xf06f57e0 - 0xf06f6008 .data 0xf06f6020 - 0xf06f6552 INIT 0xf06f6560 - 0xf06f6920 .rsrc 0xf06f6920 - 0xf06f6d1a .reloc 0xeb9c2000 - 0xeb9d5000 wdmaud.sys 0xeb9c2340 - 0xeb9c4522 .text 0xeb9c4540 - 0xeb9c4838 .rdata 0xeb9c4840 - 0xeb9c573c .data 0xeb9c5740 - 0xeb9d289b PAGE 0xeb9d28a0 - 0xeb9d28bc PAGEDATA 0xeb9d28c0 - 0xeb9d2d00 PAGECONS 0xeb9d2d00 - 0xeb9d35d2 INIT 0xeb9d35e0 - 0xeb9d39a8 .rsrc 0xeb9d39c0 - 0xeb9d40a0 .reloc 0xebad7000 - 0xebae3000 sysaudio.sys 0xebad7340 - 0xebad7650 .text 0xebad7660 - 0xebad8210 .rdata 0xebad8220 - 0xebad82a0 .data 0xebad82a0 - 0xebae0a41 PAGE 0xebae0a60 - 0xebae109c PAGEDATA 0xebae10a0 - 0xebae1340 PAGECONS 0xebae1340 - 0xebae1d7c INIT 0xebae1d80 - 0xebae2148 .rsrc 0xebae2160 - 0xebae2798 .reloc 0xebac7000 - 0xebad4000 swmidi.sys 0xebac7320 - 0xebac8558 .text 0xebac8560 - 0xebac8c70 .rdata 0xebac8c80 - 0xebac8e80 .data 0xebac8e80 - 0xebad0560 PAGE 0xebad0560 - 0xebad2ba0 PAGEDATA 0xebad2ba0 - 0xebad3198 INIT 0xebad31a0 - 0xebad35a8 .rsrc 0xebad35c0 - 0xebad39d6 .reloc 0xebab7000 - 0xebac4000 DMusic.sys 0xebab72c0 - 0xebac0d7c .text 0xebac0d80 - 0xebac27d0 .rdata 0xebac27e0 - 0xebac29bc .data 0xebac29c0 - 0xebac2da2 INIT 0xebac2dc0 - 0xebac3200 .rsrc 0xebac3200 - 0xebac36a6 .reloc 0xeb8d6000 - 0xeb8fa000 kmixer.sys 0xeb8d6340 - 0xeb8d9051 .text 0xeb8d9060 - 0xeb8daa68 .rdata 0xeb8daa80 - 0xeb8e3494 .data 0xeb8e34a0 - 0xeb8f6d50 PAGE 0xeb8f6d60 - 0xeb8f8584 PAGEDATA 0xeb8f85a0 - 0xeb8f86d0 PAGECONS 0xeb8f86e0 - 0xeb8f90d6 INIT 0xeb8f90e0 - 0xeb8f94a0 .rsrc 0xeb8f94a0 - 0xeb8f9fd8 .reloc 0xf07a0000 - 0xf07a5000 JiurlDriver.sys 0xf07a1000 - 0xf07a13ac .text 0xf07a2000 - 0xf07a216b .rdata 0xf07a3000 - 0xf07a30f2 INIT 0xf07a4000 - 0xf07a405c .reloc