64位系统的KPCR结构

查看CPU有多少核

1: kd> dd KeNumberProcessors
fffff807`33979384  00000004 01000000 000a3008 884b0640
fffff807`33979394  ffffbd84 0002625a 00002120 884632c0
fffff807`339793a4  ffffbd84 00000000 00000000 884ea220
fffff807`339793b4  ffffbd84 884b1ae0 ffffbd84 00000000
fffff807`339793c4  00000100 884eb560 ffffbd84 bd9bbdff
fffff807`339793d4  0000246f 00000000 00000000 0002625a
fffff807`339793e4  00001ed6 00010000 00000004 33407000
fffff807`339793f4  fffff807 00000000 00000000 00002307

查看所有的_KPRCB
1: kd> dq KiProcessorBlock
fffff807`3397aac0  fffff807`323ad180 ffff9681`faca3180
fffff807`3397aad0  ffff9681`fad4f180 ffff9681`fa7a0180
fffff807`3397aae0  00000000`00000000 00000000`00000000
fffff807`3397aaf0  00000000`00000000 00000000`00000000
fffff807`3397ab00  00000000`00000000 00000000`00000000
fffff807`3397ab10  00000000`00000000 00000000`00000000
fffff807`3397ab20  00000000`00000000 00000000`00000000
fffff807`3397ab30  00000000`00000000 00000000`00000000

从结构可以看出KPRCB-0x180 就是结构KPCR的起始地址了

nt!_KPCR
   +0x000 NtTib            : _NT_TIB
   +0x000 GdtBase          : 0x00000840`00010001 _KGDTENTRY64
   +0x008 TssBase          : (null) 
   +0x010 UserRsp          : 0
   +0x018 Self             : (null) 
   +0x020 CurrentPrcb      : (null) 
   +0x028 LockArray        : (null) 
   +0x030 Used_Self        : (null) 
   +0x038 IdtBase          : (null) 
   +0x040 Unused           : [2] 0
   +0x050 Irql             : 0 ''
   +0x051 SecondLevelCacheAssociativity : 0 ''
   +0x052 ObsoleteNumber   : 0 ''
   +0x053 Fill0            : 0 ''
   +0x054 Unused0          : [3] 0
   +0x060 MajorVersion     : 0x9000
   +0x062 MinorVersion     : 0x7de2
   +0x064 StallScaleFactor : 0
   +0x068 Unused1          : [3] 0x0007ef40`00000000 Void
   +0x080 KernelReserved   : [15] 0
   +0x0bc SecondLevelCacheSize : 0
   +0x0c0 HalReserved      : [16] 0
   +0x100 Unused2          : 0
   +0x108 KdVersionBlock   : (null) 
   +0x110 Unused3          : (null) 
   +0x118 PcrAlign1        : [24] 0
   +0x180 Prcb             : _KPRCB