authui!CFieldData::SetState函数分析authui!CFieldData+0x24为1则显示字段为0则不显示字段

 

kd> g
Breakpoint 15 hit
eax=7269536c ebx=00000000 ecx=0123e7e8 edx=00000d28 esi=003aff10 edi=0123e7e8
eip=726be0d8 esp=0017f4f8 ebp=0017f534 iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000206
authui!CSetFieldStateEventJob::Do:
001b:726be0d8 8bff            mov     edi,edi
kd> g
Breakpoint 16 hit
eax=012319b8 ebx=003d2d60 ecx=012319b8 edx=00000008 esi=0123e7f0 edi=01235378
eip=726b8513 esp=0017f490 ebp=0017f4a4 iopl=0         nv up ei ng nz ac pe cy
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000297
authui!CFieldData::SetState:
001b:726b8513 8bff            mov     edi,edi
kd> kc
 #
00 authui!CFieldData::SetState
01 authui!UserList::_OnCredentialSetFieldState
02 authui!UserList::UIJobEvent
03 authui!CLogonFrame::UIJobEvent
04 authui!CSetFieldStateEventJob::Do
05 authui!CJobQueue<IUIJobEvent *>::DoJob
06 authui!CCredentialJobQueue::_ProcessJobs
07 authui!CCredentialJobQueue::HandleMessage
08 authui!CLogonFrame::_OnDefaultWndProc
09 authui!CLogonFrame::WndProc
0a USER32!InternalCallWinProc
0b USER32!UserCallWinProcCheckWow
0c USER32!CallWindowProcAorW
0d USER32!CallWindowProcW
0e DUser!ExtraInfoWndProc
0f USER32!InternalCallWinProc
10 USER32!UserCallWinProcCheckWow
11 USER32!DispatchMessageWorker
12 USER32!DispatchMessageW
13 authui!CLogonFrame::DoModal
14 authui!CLogonUI_CreateThenDoModalThenDestroy
15 authui!CLogonUI::DoModal
16 LogonUI!wWinMain
17 LogonUI!_initterm_e
18 kernel32!BaseThreadInitThunk
19 ntdll!__RtlUserThreadStart
1a ntdll!_RtlUserThreadStart
kd> r
eax=012319b8 ebx=003d2d60 ecx=012319b8 edx=00000008 esi=0123e7f0 edi=01235378
eip=726b8513 esp=0017f490 ebp=0017f4a4 iopl=0         nv up ei ng nz ac pe cy
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000297
authui!CFieldData::SetState:
001b:726b8513 8bff            mov     edi,edi
kd> dd 0017f490
0017f490  726c5c27 00000000 0000000a 0039f290
0017f4a0  00000000 0017f4b4 726c707f 00000008
0017f4b0  00000000 0017f4dc 726e87fc 0000000a
0017f4c0  00000000 0123e7f0 00000000 0123e7e8
0017f4d0  003aff10 0039f290 abcdef42 0017f4f4
0017f4e0  726be0f0 0000000a 00000000 0123e7f0
0017f4f0  00000000 0017f534 726c40e2 0039f324
0017f500  1369af5e 00008002 003afea8 00000000
kd> ed 0017f490+4 1
kd> p
eax=012319b8 ebx=003d2d60 ecx=012319b8 edx=00000008 esi=0123e7f0 edi=01235378
eip=726b8515 esp=0017f490 ebp=0017f4a4 iopl=0         nv up ei ng nz ac pe cy
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000297
authui!CFieldData::SetState+0x2:
001b:726b8515 55              push    ebp
kd> p
eax=012319b8 ebx=003d2d60 ecx=012319b8 edx=00000008 esi=0123e7f0 edi=01235378
eip=726b8516 esp=0017f48c ebp=0017f4a4 iopl=0         nv up ei ng nz ac pe cy
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000297
authui!CFieldData::SetState+0x3:
001b:726b8516 8bec            mov     ebp,esp
kd> p
eax=012319b8 ebx=003d2d60 ecx=012319b8 edx=00000008 esi=0123e7f0 edi=01235378
eip=726b8518 esp=0017f48c ebp=0017f48c iopl=0         nv up ei ng nz ac pe cy
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000297
authui!CFieldData::SetState+0x5:
001b:726b8518 8b4508          mov     eax,dword ptr [ebp+8] ss:0023:0017f494=00000001
kd> p
eax=00000001 ebx=003d2d60 ecx=012319b8 edx=00000008 esi=0123e7f0 edi=01235378
eip=726b851b esp=0017f48c ebp=0017f48c iopl=0         nv up ei ng nz ac pe cy
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000297
authui!CFieldData::SetState+0x8:
001b:726b851b 894124          mov     dword ptr [ecx+24h],eax ds:0023:012319dc=00000000
kd> dd 012319b8
012319b8  72693b9c 00000001 00000008 00000003
012319c8  012319f8 00000000 00000000 00000000
012319d8  00000000 00000000 00000000 01231a88
012319e8  00000000 00000000 00010009 08030008
012319f8  00720043 00610065 00650074 00610020
01231a08  00700020 00730061 00770073 0072006f
01231a18  00200064 00650072 00650073 00200074
01231a28  00690064 006b0073 002e002e 0000002e
kd> dds 012319b8
012319b8  72693b9c authui!CFieldData::`vftable'
012319bc  00000001
012319c0  00000008
012319c4  00000003
012319c8  012319f8
012319cc  00000000
012319d0  00000000

kd> dds 72693b9c
72693b9c  726bc396 authui!CFieldData::`vector deleting destructor'
72693ba0  00690046
72693ba4  006c0065

下面的+10和+2c一个是label的值，一个是字段的值

kd> db 012319f8
012319f8  43 00 72 00 65 00 61 00-74 00 65 00 20 00 61 00  C.r.e.a.t.e. .a.
01231a08  20 00 70 00 61 00 73 00-73 00 77 00 6f 00 72 00   .p.a.s.s.w.o.r.
01231a18  64 00 20 00 72 00 65 00-73 00 65 00 74 00 20 00  d. .r.e.s.e.t. .
01231a28  64 00 69 00 73 00 6b 00-2e 00 2e 00 2e 00 00 00  d.i.s.k.........
01231a38  09 00 01 00 09 00 03 08-b8 53 23 01 58 16 23 01  .........S#.X.#.
01231a48  b8 16 23 01 68 17 23 01-a8 17 23 01 10 18 23 01  ..#.h.#...#...#.
01231a58  80 18 23 01 e8 18 23 01-b8 19 23 01 20 f2 22 01  ..#...#...#. .".
01231a68  60 f2 22 01 30 f3 22 01-d0 f3 22 01 10 f4 22 01  `.".0."..."...".
kd> db 01231a88
01231a88  43 00 72 00 65 00 61 00-74 00 65 00 20 00 61 00  C.r.e.a.t.e. .a.
01231a98  20 00 70 00 61 00 73 00-73 00 77 00 6f 00 72 00   .p.a.s.s.w.o.r.
01231aa8  64 00 20 00 72 00 65 00-73 00 65 00 74 00 20 00  d. .r.e.s.e.t. .
01231ab8  64 00 69 00 73 00 6b 00-2e 00 2e 00 2e 00 00 00  d.i.s.k.........
01231ac8  02 00 01 00 09 00 03 08-68 0b 23 01 b8 33 23 01  ........h.#..3#.
01231ad8  0a 00 01 00 02 00 03 0a-48 00 6f 00 77 00 20 00  ........H.o.w. .
01231ae8  64 00 6f 00 20 00 49 00-20 00 6c 00 6f 00 67 00  d.o. .I. .l.o.g.
01231af8  20 00 6f 00 6e 00 20 00-74 00 6f 00 20 00 61 00   .o.n. .t.o. .a.
kd> dd 01231a88
01231a88  00720043 00610065 00650074 00610020
01231a98  00700020 00730061 00770073 0072006f
01231aa8  00200064 00650072 00650073 00200074
01231ab8  00690064 006b0073 002e002e 0000002e
01231ac8  00010002 08030009 01230b68 012333b8
01231ad8  0001000a 0a030002 006f0048 00200077
01231ae8  006f0064 00490020 006c0020 0067006f
01231af8  006f0020 0020006e 006f0074 00610020
kd> ed 01231a88 00720063