authui!CFieldData::SetString函数分析调用函数authui!StringStringAllocCopy设置字段的值
kd> g
Breakpoint 7 hit
eax=0122f220 ebx=003d2d60 ecx=0122f220 edx=00000009 esi=01230998 edi=01235378
eip=726bbcf2 esp=0017f490 ebp=0017f4a4 iopl=0 nv up ei ng nz ac po cy
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000293
authui!CFieldData::SetString:
001b:726bbcf2 6a0c push 0Ch
kd> kc
#
00 authui!CFieldData::SetString
01 authui!UserList::_OnCredentialSetFieldString
02 authui!UserList::UIJobEvent
03 authui!CLogonFrame::UIJobEvent
04 authui!CSetStringEventJob::Do
05 authui!CJobQueue<IUIJobEvent *>::DoJob
06 authui!CCredentialJobQueue::_ProcessJobs
07 authui!CCredentialJobQueue::HandleMessage
08 authui!CLogonFrame::_OnDefaultWndProc
09 authui!CLogonFrame::WndProc
0a USER32!InternalCallWinProc
0b USER32!UserCallWinProcCheckWow
0c USER32!CallWindowProcAorW
0d USER32!CallWindowProcW
0e DUser!ExtraInfoWndProc
0f USER32!InternalCallWinProc
10 USER32!UserCallWinProcCheckWow
11 USER32!DispatchMessageWorker
12 USER32!DispatchMessageW
13 authui!CLogonFrame::DoModal
14 authui!CLogonUI_CreateThenDoModalThenDestroy
15 authui!CLogonUI::DoModal
16 LogonUI!wWinMain
17 LogonUI!_initterm_e
18 kernel32!BaseThreadInitThunk
19 ntdll!__RtlUserThreadStart
1a ntdll!_RtlUserThreadStart
kd> bp authui!CFieldData::SetState
kd> p
eax=0122f220 ebx=003d2d60 ecx=0122f220 edx=00000009 esi=01230998 edi=01235378
eip=726bbcf4 esp=0017f48c ebp=0017f4a4 iopl=0 nv up ei ng nz ac po cy
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000293
authui!CFieldData::SetString+0x2:
001b:726bbcf4 68a0137272 push offset authui!`PTpgDebug'::`2'::`dynamic atexit destructor for 'debug''+0x80c (727213a0)
kd> p
eax=0122f220 ebx=003d2d60 ecx=0122f220 edx=00000009 esi=01230998 edi=01235378
eip=726bbcf9 esp=0017f488 ebp=0017f4a4 iopl=0 nv up ei ng nz ac po cy
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000293
authui!CFieldData::SetString+0x7:
001b:726bbcf9 e89e870100 call authui!_SEH_prolog4 (726d449c)
kd> p
eax=0017f47c ebx=003d2d60 ecx=0122f220 edx=00000009 esi=01230998 edi=01235378
eip=726bbcfe esp=0017f460 ebp=0017f48c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
authui!CFieldData::SetString+0xc:
001b:726bbcfe 8bf1 mov esi,ecx
kd> p
eax=0017f47c ebx=003d2d60 ecx=0122f220 edx=00000009 esi=0122f220 edi=01235378
eip=726bbd00 esp=0017f460 ebp=0017f48c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
authui!CFieldData::SetString+0xe:
001b:726bbd00 8975e4 mov dword ptr [ebp-1Ch],esi ss:0023:0017f470=0017f45c
kd> p
eax=0017f47c ebx=003d2d60 ecx=0122f220 edx=00000009 esi=0122f220 edi=01235378
eip=726bbd03 esp=0017f460 ebp=0017f48c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
authui!CFieldData::SetString+0x11:
001b:726bbd03 8d4608 lea eax,[esi+8]
kd> p
eax=0122f228 ebx=003d2d60 ecx=0122f220 edx=00000009 esi=0122f220 edi=01235378
eip=726bbd06 esp=0017f460 ebp=0017f48c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
authui!CFieldData::SetString+0x14:
001b:726bbd06 50 push eax
kd> p
eax=0122f228 ebx=003d2d60 ecx=0122f220 edx=00000009 esi=0122f220 edi=01235378
eip=726bbd07 esp=0017f45c ebp=0017f48c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
authui!CFieldData::SetString+0x15:
001b:726bbd07 e83bd0ffff call authui!FieldHasStringValue (726b8d47)
kd> p
eax=00000001 ebx=003d2d60 ecx=0122f220 edx=00000009 esi=0122f220 edi=01235378
eip=726bbd0c esp=0017f460 ebp=0017f48c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
authui!CFieldData::SetString+0x1a:
001b:726bbd0c 84c0 test al,al
kd> p
eax=00000001 ebx=003d2d60 ecx=0122f220 edx=00000009 esi=0122f220 edi=01235378
eip=726bbd0e esp=0017f460 ebp=0017f48c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
authui!CFieldData::SetString+0x1c:
001b:726bbd0e 7557 jne authui!CFieldData::SetString+0x75 (726bbd67) [br=1]
kd> p
eax=00000001 ebx=003d2d60 ecx=0122f220 edx=00000009 esi=0122f220 edi=01235378
eip=726bbd67 esp=0017f460 ebp=0017f48c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
authui!CFieldData::SetString+0x75:
001b:726bbd67 83c62c add esi,2Ch
kd> p
eax=00000001 ebx=003d2d60 ecx=0122f220 edx=00000009 esi=0122f24c edi=01235378
eip=726bbd6a esp=0017f460 ebp=0017f48c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
authui!CFieldData::SetString+0x78:
001b:726bbd6a 56 push esi
kd> p
eax=00000001 ebx=003d2d60 ecx=0122f220 edx=00000009 esi=0122f24c edi=01235378
eip=726bbd6b esp=0017f45c ebp=0017f48c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
authui!CFieldData::SetString+0x79:
001b:726bbd6b e805ffffff call authui!TSafeFreeAndNull<unsigned short> (726bbc75)
kd> p
eax=00000001 ebx=003d2d60 ecx=726bbcea edx=00000d28 esi=0122f24c edi=01235378
eip=726bbd70 esp=0017f460 ebp=0017f48c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
authui!CFieldData::SetString+0x7e:
001b:726bbd70 8b4508 mov eax,dword ptr [ebp+8] ss:0023:0017f494=003ee9f8
kd> p
eax=003ee9f8 ebx=003d2d60 ecx=726bbcea edx=00000d28 esi=0122f24c edi=01235378
eip=726bbd73 esp=0017f460 ebp=0017f48c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
authui!CFieldData::SetString+0x81:
001b:726bbd73 85c0 test eax,eax
kd> p
eax=003ee9f8 ebx=003d2d60 ecx=726bbcea edx=00000d28 esi=0122f24c edi=01235378
eip=726bbd75 esp=0017f460 ebp=0017f48c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
authui!CFieldData::SetString+0x83:
001b:726bbd75 740f je authui!CFieldData::SetString+0x94 (726bbd86) [br=0]
kd> p
eax=003ee9f8 ebx=003d2d60 ecx=726bbcea edx=00000d28 esi=0122f24c edi=01235378
eip=726bbd77 esp=0017f460 ebp=0017f48c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
authui!CFieldData::SetString+0x85:
001b:726bbd77 66833800 cmp word ptr [eax],0 ds:0023:003ee9f8=004c
kd> p
eax=003ee9f8 ebx=003d2d60 ecx=726bbcea edx=00000d28 esi=0122f24c edi=01235378
eip=726bbd7b esp=0017f460 ebp=0017f48c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
authui!CFieldData::SetString+0x89:
001b:726bbd7b 7409 je authui!CFieldData::SetString+0x94 (726bbd86) [br=0]
kd> p
eax=003ee9f8 ebx=003d2d60 ecx=726bbcea edx=00000d28 esi=0122f24c edi=01235378
eip=726bbd7d esp=0017f460 ebp=0017f48c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
authui!CFieldData::SetString+0x8b:
001b:726bbd7d 56 push esi
kd> p
eax=003ee9f8 ebx=003d2d60 ecx=726bbcea edx=00000d28 esi=0122f24c edi=01235378
eip=726bbd7e esp=0017f45c ebp=0017f48c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
authui!CFieldData::SetString+0x8c:
001b:726bbd7e 50 push eax
kd> p
eax=003ee9f8 ebx=003d2d60 ecx=726bbcea edx=00000d28 esi=0122f24c edi=01235378
eip=726bbd7f esp=0017f458 ebp=0017f48c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
authui!CFieldData::SetString+0x8d:
001b:726bbd7f e86f190000 call authui!StringStringAllocCopy (726bd6f3)
kd> t
Breakpoint 0 hit
eax=003ee9f8 ebx=003d2d60 ecx=726bbcea edx=00000d28 esi=0122f24c edi=01235378
eip=726bd6f3 esp=0017f454 ebp=0017f48c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
authui!StringStringAllocCopy:
001b:726bd6f3 6a08 push 8
kd> kc
#
00 authui!StringStringAllocCopy
01 authui!CFieldData::SetString
02 authui!UserList::_OnCredentialSetFieldString
03 authui!UserList::UIJobEvent
04 authui!CLogonFrame::UIJobEvent
05 authui!CSetStringEventJob::Do
06 authui!CJobQueue<IUIJobEvent *>::DoJob
07 authui!CCredentialJobQueue::_ProcessJobs
08 authui!CCredentialJobQueue::HandleMessage
09 authui!CLogonFrame::_OnDefaultWndProc
0a authui!CLogonFrame::WndProc
0b USER32!InternalCallWinProc
0c USER32!UserCallWinProcCheckWow
0d USER32!CallWindowProcAorW
0e USER32!CallWindowProcW
0f DUser!ExtraInfoWndProc
10 USER32!InternalCallWinProc
11 USER32!UserCallWinProcCheckWow
12 USER32!DispatchMessageWorker
13 USER32!DispatchMessageW
14 authui!CLogonFrame::DoModal
15 authui!CLogonUI_CreateThenDoModalThenDestroy
16 authui!CLogonUI::DoModal
17 LogonUI!wWinMain
18 LogonUI!_initterm_e
19 kernel32!BaseThreadInitThunk
1a ntdll!__RtlUserThreadStart
1b ntdll!_RtlUserThreadStart
kd> r
eax=003ee9f8 ebx=003d2d60 ecx=726bbcea edx=00000d28 esi=0122f24c edi=01235378
eip=726bd6f3 esp=0017f454 ebp=0017f48c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
authui!StringStringAllocCopy:
001b:726bd6f3 6a08 push 8
kd> dd 0017f454
0017f454 726bbd84 003ee9f8 0122f24c 1369aee6
0017f464 01235378 01230998 003d2d60 0122f220
0017f474 0017f460 0017f524 0017f524 726d44fa
0017f484 610c49ca fffffffe 0017f4a4 726c5ceb
0017f494 003ee9f8 0000000c 0039f290 00000000
0017f4a4 0017f4b4 726c709f 00000009 00000000
0017f4b4 0017f4dc 726e87fc 0000000c 00000000
0017f4c4 01230998 00000000 01230990 003aff10
kd> db 003ee9f8
003ee9f8 4c 00 6f 00 67 00 20 00-6f 00 6e 00 20 00 74 00 L.o.g. .o.n. .t.
003eea08 6f 00 3a 00 20 00 57 00-49 00 4e 00 2d 00 33 00 o.:. .W.I.N.-.3.
003eea18 53 00 50 00 47 00 32 00-44 00 4b 00 48 00 55 00 S.P.G.2.D.K.H.U.
003eea28 4b 00 4b 00 00 00 61 00-16 00 00 00 08 00 00 00 K.K...a.........
authui!CFieldData::SetString函数分析调用函数authui!StringStringAllocCopy设置字段的值
于 2025-10-20 07:57:55 首次发布