_KPCR&_KPRCB

Windows 内核有个特殊的基本要求，当CPU运行在内核上时，FS会指向一个名为KPCR的结构体。从一个CPU 的KPCR 结构出发，可以直接或间接地找到与该CPU 有关的许多信息。(此文章仅注释部分认为需要了解的)
kd> dt _KPCR
nt!_KPCR
+0x000 NtTib : _NT_TIB //指向_NT_TIB
+0x01c SelfPcr : Ptr32 _KPCR //指向自己
+0x020 Prcb : Ptr32 _KPRCB //向拓展结构体_KPRCB == FS:[120].
+0x024 Irql : UChar //IRQL等级
+0x028 IRR : Uint4B
+0x02c IrrActive : Uint4B
+0x030 IDR : Uint4B
+0x034 KdVersionBlock : Ptr32 Void // 指向_DBGKD_GET_VERSION64
+0x038 IDT : Ptr32 _KIDTENTRY //IDT表
+0x03c GDT : Ptr32 _KGDTENTRY //GDT表
+0x040 TSS : Ptr32 _KTSS //指向TSS
+0x044 MajorVersion : Uint2B
+0x046 MinorVersion : Uint2B
+0x048 SetMember : Uint4B
+0x04c StallScaleFactor : Uint4B
+0x050 DebugActive : UChar
+0x051 Number : UChar //运行在哪个核上
+0x052 Spare0 : UChar
+0x053 SecondLevelCacheAssociativity : UChar
+0x054 VdmAlert : Uint4B
+0x058 KernelReserved : [14] Uint4B
+0x090 SecondLevelCacheSize : Uint4B
+0x094 HalReserved : [16] Uint4B
+0x0d4 InterruptMode : Uint4B
+0x0d8 Spare1 : UChar
+0x0dc KernelReserved2 : [17] Uint4B
+0x120 PrcbData : _KPRCB //指向拓展结构体_KPRCB

ntdll!_NT_TIB
+0x000 ExceptionList : Ptr32 _EXCEPTION_REGISTRATION_RECORD //异常
+0x004 StackBase : Ptr32 Void //内核栈基址
+0x008 StackLimit : Ptr32 Void //内核栈大小
+0x00c SubSystemTib : Ptr32 Void
+0x010 FiberData : Ptr32 Void
+0x010 Version : Uint4B
+0x014 ArbitraryUserPointer : Ptr32 Void
+0x018 Self : Ptr32 _NT_TIB //指向自己

kd> dt _KPRCB
ntdll!_KPRCB
+0x000 MinorVersion : Uint2B
+0x002 MajorVersion : Uint2B
+0x004 CurrentThread : Ptr32 _KTHREAD //当前线程
+0x008 NextThread : Ptr32 _KTHREAD //即将切换的下一个线程
+0x00c IdleThread : Ptr32 _KTHREAD //空闲线程
+0x010 Number : Char
+0x011 Reserved : Char
+0x012 BuildType : Uint2B
+0x014 SetMember : Uint4B
+0x018 CpuType : Char
+0x019 CpuID : Char
+0x01a CpuStep : Uint2B
+0x01c ProcessorState : _KPROCESSOR_STATE //核的状态
+0x33c KernelReserved : [16] Uint4B
+0x37c HalReserved : [16] Uint4B
+0x3bc PrcbPad0 : [92] UChar
+0x418 LockQueue : [16] _KSPIN_LOCK_QUEUE //锁的编号
+0x498 PrcbPad1 : [8] UChar
+0x4a0 NpxThread : Ptr32 _KTHREAD
+0x4a4 InterruptCount : Uint4B //中断次数
+0x4a8 KernelTime : Uint4B //KPCR被创建的时间
+0x4ac UserTime : Uint4B //↑
+0x4b0 DpcTime : Uint4B //
+0x4b4 DebugDpcTime : Uint4B
+0x4b8 InterruptTime : Uint4B //中断时间
+0x4bc AdjustDpcThreshold : Uint4B
+0x4c0 PageColor : Uint4B //页随机值
+0x4c4 SkipTick : Uint4B
+0x4c8 MultiThreadSetBusy : UChar
+0x4c9 Spare2 : [3] UChar
+0x4cc ParentNode : Ptr32 _KNODE
+0x4d0 MultiThreadProcessorSet : Uint4B
+0x4d4 MultiThreadSetMaster : Ptr32 _KPRCB
+0x4d8 ThreadStartCount : [2] Uint4B
+0x4e0 CcFastReadNoWait : Uint4B //Cache manager performance counters.
+0x4e4 CcFastReadWait : Uint4B
+0x4e8 CcFastReadNotPossible : Uint4B
+0x4ec CcCopyReadNoWait : Uint4B
+0x4f0 CcCopyReadWait : Uint4B
+0x4f4 CcCopyReadNoWaitMiss : Uint4B
+0x4f8 KeAlignmentFixupCount : Uint4B //Kernel performance counters.
+0x4fc KeContextSwitches : Uint4B //切换时上下文
+0x500 KeDcacheFlushCount : Uint4B
+0x504 KeExceptionDispatchCount : Uint4B
+0x508 KeFirstLevelTbFills : Uint4B
+0x50c KeFloatingEmulationCount : Uint4B
+0x510 KeIcacheFlushCount : Uint4B
+0x514 KeSecondLevelTbFills : Uint4B
+0x518 KeSystemCalls : Uint4B //系统调用次数
+0x51c SpareCounter0 : [1] Uint4B
+0x520 PPLookasideList : [16] _PP_LOOKASIDE_LIST //每个处理器的非分页后备列表
+0x5a0 PPNPagedLookasideList : [32] _PP_LOOKASIDE_LIST //每个处理器的small池备用列表（不分页）
+0x6a0 PPPagedLookasideList : [32] _PP_LOOKASIDE_LIST //每个处理器的small池备用列表（分页）
+0x7a0 PacketBarrier : Uint4B
+0x7a4 ReverseStall : Uint4B
+0x7a8 IpiFrame : Ptr32 Void
+0x7ac PrcbPad2 : [52] UChar
+0x7e0 CurrentPacket : [3] Ptr32 Void
+0x7ec TargetSet : Uint4B //MP interprocessor request packet and summary
+0x7f0 WorkerRoutine : Ptr32 void
+0x7f4 IpiFrozen : Uint4B
+0x7f8 PrcbPad3 : [40] UChar
+0x820 RequestSummary : Uint4B
+0x824 SignalDone : Ptr32 _KPRCB
+0x828 PrcbPad4 : [56] UChar
+0x860 DpcListHead : _LIST_ENTRY //DPC链表
+0x868 DpcStack : Ptr32 Void
+0x86c DpcCount : Uint4B
+0x870 DpcQueueDepth : Uint4B
+0x874 DpcRoutineActive : Uint4B
+0x878 DpcInterruptRequested : Uint4B
+0x87c DpcLastCount : Uint4B
+0x880 DpcRequestRate : Uint4B
+0x884 MaximumDpcQueueDepth : Uint4B
+0x888 MinimumDpcRate : Uint4B
+0x88c QuantumEnd : Uint4B
+0x890 PrcbPad5 : [16] UChar
+0x8a0 DpcLock : Uint4B
+0x8a4 PrcbPad6 : [28] UChar
+0x8c0 CallDpc : _KDPC
+0x8e0 ChainedInterruptList : Ptr32 Void
+0x8e4 LookasideIrpFloat : Int4B //I/O IRP float.
+0x8e8 SpareFields0 : [6] Uint4B
+0x900 VendorString : [13] UChar //处理器名字
+0x90d InitialApicId : UChar
+0x90e LogicalProcessorsPerPhysicalProcessor : UChar
+0x910 MHz : Uint4B
+0x914 FeatureBits : Uint4B
+0x918 UpdateSignature : _LARGE_INTEGER
+0x920 NpxSaveArea : _FX_SAVE_AREA
+0xb30 PowerState : _PROCESSOR_POWER_STATE //Processors power state

kd> dt _KPROCESSOR_STATE
ntdll!_KPROCESSOR_STATE
+0x000 ContextFrame : _CONTEXT //上下文
+0x2cc SpecialRegisters : _KSPECIAL_REGISTERS