XP系统桌面DC对应的显存位置获取方法

以下代码在XP下编写测试

1. 获取桌面DC的Bitmap
m_hDesk = GetDesktopWindow();
m_hDeskDc = GetDC(m_hDesk);
m_hDeskBitmap = (HBITMAP)GetCurrentObject(m_hDeskDc, OBJ_BITMAP);

2. 获取GDI的内核对象
pPeb = (Nntdll::PEB *)Nntdll::GetPEB();
m_pGdiTable = (GDI_TABLE_ENTRY *)pPeb->GdiSharedHandleTable;
dwCurPid = GetCurrentProcessId();
for(i=0; i<OS_MAXGDI_COUNT; i++)
{
if(m_pGdiTable[i].dwProcessId && m_pGdiTable[i].dwProcessId != dwCurPid)
continue;
hCurObj = (HGDIOBJ)(__int64)MAKELONG(i, m_pGdiTable[i].uFullUnique);
if(hCurObj != m_hDeskBitmap)
continue;
m_pKrnObj = m_pGdiTable[i].pKernelData;
if(m_pKrnObj == NULL)
break;
return TRUE;
}

3. 读取内核对象BITMAPOBJ 
typedef struct _SURFOBJ
{
DHSURF dhsurf;
HSURF hsurf;
DHPDEV dhpdev;
HDEV hdev;
SIZEL sizlBitmap;
ULONG cjBits;
PVOID pvBits;
PVOID pvScan0;
LONG lDelta;
ULONG iUniq;
ULONG iBitmapFormat;
USHORT iType;
USHORT fjBitmap;
}SURFOBJ;

typedef struct _BITMAPOBJ
{
 BASEOBJECT  BaseObject;
 SURFOBJ     SurfObj;
 FLONG      flHooks;
 FLONG       flFlags;
 SIZE        dimension;    /* For SetBitmapDimension(), do NOT use to get width/height of bitmap, use
  bitmap.bmWidth/bitmap.bmHeight for that */
 struct _FAST_MUTEX *BitsLock;     /* You need to hold this lock before you touch the actual bits in the bitmap */
 /* For device-independent bitmaps: */
 DIBSECTION *dib;
 HPALETTE hDIBPalette;
 HDC hDC; // Doc in "Undocumented Windows", page 546, seems to be supported with XP.
}BITMAPOBJ, *PBITMAPOBJ;

NNtKrn::BITMAPOBJ m_bmKrnObj
ywkc.ReadKrnMem(m_pKrnObj, &m_bmKrnObj, sizeof(m_bmKrnObj));

4. 映射到用户地址
m_pDataMap = ywkc.MapKernelAddr(m_bmKrnObj.SurfObj.pvBits, m_dwDataSize);
//MmMapLockedPagesSpecifyCache

m_pDataMap就是指向桌面的显存, 可以直接使用