NTDLL

ntdll.dll是最基本的Dll，不但其他Dll的动态链接要由这个Dll完成，连系统调用也需要通过这个Dll进入内核。Windows内核在初始化阶段首次需要装入这个Dll的时候为其创建了一个文件映射区对象，并使用一个全局指针PspSystemDllSection指向该对象的数据结构。

 

 

 

 

 

 

nt!PspSystemDll

 

kd> dd nt!PspSystemDll
809d3378  e12f4b00 7c930000 7c952556 00000000
809d3388  fbd3e280 ffffffff 00000001 809c104c
809d3398  00000064 00000001 00000000 00000000
809d33a8  00000000 00000000 00000000 00000000
809d33b8  00000000 00001388 00000006 00000005
809d33c8  809d33c8 809d33c8 00000014 00000001
809d33d8  000f8cc0 00000000 00000000 0000066c
809d33e8  23030200 00000001 00000000 00000000

 

kd> dt _section e12f4b00
nt!_SECTION
   +0x000 Address          : _MMADDRESS_NODE
   +0x014 Segment          : 0xe132f440 _SEGMENT
   +0x018 SizeOfSection    : _LARGE_INTEGER 0xd0000
   +0x020 u                : __unnamed
   +0x024 InitialPageProtection : 0x10

 

kd> dt  _SEGMENT  0xe132f440
nt!_SEGMENT
   +0x000 ControlArea      : 0x81f972f8 _CONTROL_AREA
   +0x004 TotalNumberOfPtes : 0xd0
   +0x008 NonExtendedPtes  : 0xd0
   +0x00c Spare0           : 0
   +0x010 SizeOfSegment    : 0xd0000
   +0x018 SegmentPteTemplate : _MMPTE
   +0x01c NumberOfCommittedPages : 0
   +0x020 ExtendInfo       : (null)
   +0x024 SegmentFlags     : _SEGMENT_FLAGS
   +0x028 BasedAddress     : 0x7c930000
   +0x02c u1               : __unnamed
   +0x030 u2               : __unnamed
   +0x034 PrototypePte     : 0xe132f478 _MMPTE
   +0x038 ThePtes          : [1] _MMPTE

 

kd> dd 0xe132f440+38  //ThePtes
e132f478  1f63d121 1f63f121 1f800121 1f601121
e132f488  1f842121 1f603121 1f844121 1f645121
e132f498  1f886121 1f647121 1f888121 1f649121
e132f4a8  1f88a121 1f64b121 1f88c121 1f64d121
e132f4b8  1f88e121 1f64f121 1f890121 1f651121
e132f4c8  1f892121 1f653121 1f854121 1f655121
e132f4d8  1f896121 1f617121 1f8d8121 1f659121
e132f4e8  1f95a121 1f65b121 1f8dc121 1f65d121 

 

kd> !dc 1f63d000
#1f63d000 00905a4d 00000003 00000004 0000ffff MZ..............
#1f63d010 000000b8 00000000 00000040 00000000 ........@.......
#1f63d020 00000000 00000000 00000000 00000000 ................
#1f63d030 00000000 00000000 00000000 000000d0 ................
#1f63d040 0eba1f0e cd09b400 4c01b821 685421cd ........!..L.!Th
#1f63d050 70207369 72676f72 63206d61 6f6e6e61 is program canno
#1f63d060 65622074 6e757220 206e6920 20534f44 t be run in DOS
#1f63d070 65646f6d 0a0d0d2e 00000024 00000000 mode....$.......

正好对应NTDLL文件的头0-400位置的内容

 

 

kd> !dc 1f63f000  //对应0X400-0X1399位置的内容
#1f63f000 8d1075ff e850f045 0002f23b 8c0fc085 .u..E.P.;.......
#1f63f010 00044a98 f045b70f e9f84589 00008a87 .J....E..E......
#1f63f020 8310758b 3c8d02c1 c1c18b18 a5f302e9 .u.....<........
#1f63f030 e183c88b e9a4f303 00008b2b ff50b5ff ........+.....P.
#1f63f040 3d89ffff 7c9b9f68 9b9f7068 15b9e87c ...=h..|hp..|...
#1f63f050 83660002 9b9f7005 9ce9fe7c 0f0000e1 ..f..p..|.......
#1f63f060 b70ffeb6 da8b783c 8304ebc1 fb030fe3 ....<x..........
#1f63f070 783cb70f e383da8b 66fb030f 66783c8b ..<x.......f.<xf
kd> !dc 1f800121
#1f800120 850fc085 00081dd5 5f40c033 c2c95b5e ........3.@_^[..
#1f800130 c0330010 c88fe940 90900000 8b909090 ..3.@...........
#1f800140 ec8b55ff 0244ec81 28a10000 537c9b9d .U....D....(..|S
#1f800150 56085d8b 5710758b f73bff33 89fc4589 .].V.u.W3.;..E..
#1f800160 fffdf0b5 390974ff 850f147d 0007b8dc .....t.9}.......
#1f800170 82b9c033 8d000000 fffdf4bd 68abf3ff 3..............h
#1f800180 00000104 fdf4858d e850ffff 00001721 ..........P.!...
#1f800190 c73bff33 b973840f f8830007 74820f02 3.;...s........t
kd> !dc 1f800000
#1f800000 b3e8e900 7d830000 850f03e0 0000b58c .......}........
#1f800010 0000b768 b58de900 90900000 8b909090 h...............
#1f800020 ec8b55ff 8b4cec83 33530845 66c33bdb .U....L.E.S3.;.f
#1f800030 5cfc45c7 5d896600 ef840ffe 5300081d .E.\.f.].......S
#1f800040 f44d8d53 cee85051 840002ee e3840fc0 S.M.QP..........
#1f800050 5600081d 57f8758b 685f186a 00800021 ...V.u.Wj._h!...
#1f800060 89f4458d 036adc45 50ec458d 50d4458d .E..E.j..E.P.E.P
#1f800070 10000168 08458d00 d47d8950 c7d85d89 h.....E.P.}..]..

 

kd> dt  _CONTROL_AREA 0x81f972f8
nt!_CONTROL_AREA
   +0x000 Segment          : 0xe132f440 _SEGMENT
   +0x004 DereferenceList  : _LIST_ENTRY [ 0x0 - 0x0 ]
   +0x00c NumberOfSectionReferences : 1
   +0x010 NumberOfPfnReferences : 0xce
   +0x014 NumberOfMappedViews : 0x15
   +0x018 NumberOfSystemCacheViews : 0
   +0x01c NumberOfUserReferences : 0x16
   +0x020 u                : __unnamed
   +0x024 FilePointer      : 0x81f50bc8 _FILE_OBJECT
   +0x028 WaitingForDeletion : (null)
   +0x02c ModifiedWriteCount : 0
   +0x02e FlushInProgressCount : 0
   +0x030 WritableUserReferences : 0
   +0x034 QuadwordPad      : 0

 

kd> dt  _FILE_OBJECT  0x81f50bc8
nt!_FILE_OBJECT
   +0x000 Type             : 5
   +0x002 Size             : 0x70
   +0x004 DeviceObject     : 0x81faf030 _DEVICE_OBJECT
   +0x008 Vpb              : 0x81fa4da0 _VPB
   +0x00c FsContext        : 0xe12ed8e8
   +0x010 FsContext2       : 0xe12eda30
   +0x014 SectionObjectPointer : 0x81f0d2c4 _SECTION_OBJECT_POINTERS
   +0x018 PrivateCacheMap  : (null)
   +0x01c FinalStatus      : 0
   +0x020 RelatedFileObject : (null)
   +0x024 LockOperation    : 0 ''
   +0x025 DeletePending    : 0 ''
   +0x026 ReadAccess       : 0x1 ''
   +0x027 WriteAccess      : 0 ''
   +0x028 DeleteAccess     : 0 ''
   +0x029 SharedRead       : 0x1 ''
   +0x02a SharedWrite      : 0 ''
   +0x02b SharedDelete     : 0 ''
   +0x02c Flags            : 0x44040
   +0x030 FileName         : _UNICODE_STRING "\WINDOWS\system32\ntdll.dll"
   +0x038 CurrentByteOffset : _LARGE_INTEGER 0x0
   +0x040 Waiters          : 0
   +0x044 Busy             : 0
   +0x048 LastLock         : (null)
   +0x04c Lock             : _KEVENT
   +0x05c Event            : _KEVENT
   +0x06c CompletionContext : (null)