标签：00 0y0 0x304 线程 fffff800 第二章 nt ffff9789 调试
进程资源
备注： 这里的命令都是基于内核dmp调试
kd> !process 0 0
**** NT ACTIVE PROCESS DUMP ****
PROCESS ffff84898203c440 ->// 内核空间中的EPROCESS（Executive process block， 进程执行块）结构，记录进程的关键信息，包括创建时间等等
SessionId: none Cid: 0004 Peb: 00000000 ParentCid: 0000
DirBase: 001ad002 ObjectTable: ffffe18f2b814040 HandleCount: 2564.
Image: System
PROCESS ffff8489820c6040
SessionId: none Cid: 0078 Peb: 00000000 ParentCid: 0004
DirBase: 99d00002 ObjectTable: ffffe18f2b825b80 HandleCount: 0.
Image: Registry
PROCESS ffff84898205d040
SessionId: none Cid: 01e0 Peb: 3062840000 ParentCid: 0004
DirBase: 77100002 ObjectTable: ffffe18f2c1ab340 HandleCount: 52.
Image: smss.exe
PROCESS ffff848987825580
SessionId: 0 // windows会话的id， 服务程序运行在session 0， 用户运行在session 1， 再切换用户后变为2...
Cid: 02d0 // client id， 进程id
Peb: 9249550000 ParentCid: 028c
DirBase: 40b000002 // 页目录基地址
ObjectTable: ffffe18f2da8fb40 HandleCount: 566.
Image: csrss.exe
...
!process 0 0 msmpeng.exe
PROCESS ffff84898fdd72c0
SessionId: 0 Cid: 1404 Peb: ec4ed48000 ParentCid: 0398
DirBase: 431f50002 ObjectTable: ffffe18f30607c00 HandleCount: 248.
Image: MsMpEng.exe
EPROCESS结构
dt _EPROCESS ffff84898fdd72c0
nt!_EPROCESS
+0x000 Pcb : _KPROCESS // 内核进程块，记录与任务调度有关信息
+0x2d8 ProcessLock : _EX_PUSH_LOCK
+0x2e0 UniqueProcessId : 0x0000000000001404 Void // **pid** +0x2e8 ActiveProcessLinks : _LIST_ENTRY [ 0xffff84898fdf1368 - 0xffff84898fd4b368 ] +0x2f8 RundownProtect : _EX_RUNDOWN_REF +0x300 Flags2 : 0xd000 +0x300 JobNotReallyActive : 0y0 +0x300 AccountingFolded : 0y0 +0x300 NewProcessReported : 0y0 +0x300 ExitProcessReported : 0y0 +0x300 ReportCommitChanges : 0y0 +0x300 LastReportMemory : 0y0 +0x300 ForceWakeCharge : 0y0 +0x300 CrossSessionCreate : 0y0 +0x300 NeedsHandleRundown : 0y0 +0x300 RefTraceEnabled : 0y0 +0x300 PicoCreated : 0y0 +0x300 EmptyJobEvaluated : 0y0 +0x300 DefaultPagePriority : 0y101 +0x300 PrimaryTokenFrozen : 0y1 +0x300 ProcessVerifierTarget : 0y0 +0x300 RestrictSetThreadContext : 0y0 +0x300 AffinityPermanent : 0y0 +0x300 AffinityUpdateEnable : 0y0 +0x300 PropagateNode : 0y0 +0x300 ExplicitAffinity : 0y0 +0x300 ProcessExecutionState : 0y00 +0x300 EnableReadVmLogging : 0y0 +0x300 EnableWriteVmLogging : 0y0 +0x300 FatalAccessTerminationRequested : 0y0 +0x300 DisableSystemAllowedCpuSet : 0y0 +0x300 ProcessStateChangeRequest : 0y00 +0x300 ProcessStateChangeInProgress : 0y0 +0x300 InPrivate : 0y0 +0x304 Flags : 0x144d0c01 +0x304 CreateReported : 0y1 +0x304 NoDebugInherit : 0y0 +0x304 ProcessExiting : 0y0 // **正在退出标志** +0x304 ProcessDelete : 0y0 // **删除标志** +0x304 ManageExecutableMemoryWrites : 0y0 +0x304 VmDeleted : 0y0 +0x304 OutswapEnabled : 0y0 +0x304 Outswapped : 0y0 +0x304 FailFastOnCommitFail : 0y0 +0x304 Wow64VaSpace4Gb : 0y0 +0x304 AddressSpaceInitialized : 0y11 +0x304 SetTimerResolution : 0y0 +0x304 BreakOnTermination : 0y0 +0x304 DeprioritizeViews : 0y0 +0x304 WriteWatch : 0y0 +0x304 ProcessInSession : 0y1 +0x304 OverrideAddressSpace : 0y0 +0x304 HasAddressSpace : 0y1 +0x304 LaunchPrefetched : 0y1 +0x304 Background : 0y0 +0x304 VmTopDown : 0y0 +0x304 ImageNotifyDone : 0y1 +0x304 PdeUpdateNeeded : 0y0 +0x304 VdmAllowed : 0y0 +0x304 ProcessRundown : 0y0 +0x304 ProcessInserted : 0y1 +0x304 DefaultIoPriority : 0y010 +0x304 ProcessSelfDelete : 0y0 +0x304 SetTimerResolutionLink : 0y0 +0x308 **CreateTime** : _LARGE_INTEGER 0x01d48c6521fd25d9 // 创建时间
+0x310 ProcessQuotaUsage : [2] 0x3270
+0x320 ProcessQuotaPeak : [2] 0x3270
+0x330 PeakVirtualSize : 0x0000020104e00000 +0x338 VirtualSize : 0x0000020104de4000
+0x340 SessionProcessLinks : _LIST_ENTRY [ 0xffff84898fdf13c0 - 0xffff84898fd4b3c0 ]
+0x350 ExceptionPortData : 0xffff8489877e3670 Void +0x350 ExceptionPortValue : 0xffff8489877e3670
+0x350 ExceptionPortState : 0y000
+0x358 Token : _EX_FAST_REF // 令牌
+0x360 MmReserved : 0
+0x368 AddressCreationLock : _EX_PUSH_LOCK
+0x370 PageTableCommitmentLock : _EX_PUSH_LOCK
+0x378 RotateInProgress : (null)
+0x380 ForkInProgress : (null)
+0x388 CommitChargeJob : (null)
+0x390 CloneRoot : _RTL_AVL_TREE
+0x398 NumberOfPrivatePages : 0x219
+0x3a0 NumberOfLockedPages : 0
+0x3a8 Win32Process : 0xffff83c602259010 Void +0x3b0 Job : (null) +0x3b8 SectionObject : 0xffffe18f2b828bc0 Void
+0x3c0 SectionBaseAddress : 0x00007ff751b00000 Void +0x3c8 Cookie : 0xde25a48d +0x3d0 WorkingSetWatch : (null) +0x3d8 Win32WindowStation : 0x000000000000004c Void
+0x3e0 InheritedFromUniqueProcessId : 0x0000000000000398 Void +0x3e8 LdtInformation : (null) +0x3f0 OwnerProcessId : 0x39a +0x3f8 Peb : 0x000000ec4ed48000 _PEB // 进程环境块
+0x400 Session : 0xffffb800ff71c000 _MM_SESSION_SPACE +0x408 AweInfo : (null) +0x410 QuotaBlock : 0xfffff800063d1bc0 _EPROCESS_QUOTA_BLOCK
+0x418 ObjectTable : 0xffffe18f30607c00 _HANDLE_TABLE // **对象句柄表** +0x420 DebugPort : (null) // **用户态调试端口** +0x428 WoW64Process : (null) +0x430 DeviceMap : 0xffffe18f2b818ad0 Void
+0x438 EtwDataSource : 0xffff84898fdc80f0 Void +0x440 PageDirectoryPte : 0 +0x448 ImageFilePointer : 0xffff84898fd6ad50 _FILE_OBJECT
+0x450 ImageFileName : [15] "MsMpEng.exe" // 进程名
+0x45f PriorityClass : 0x2 ''
+0x460 SecurityPort : (null)
+0x468 SeAuditProcessCreationInfo : _SE_AUDIT_PROCESS_CREATION_INFO
+0x470 JobLinks : _LIST_ENTRY [ 0x0000000000000000 - 0x0000000000000000 ]
+0x480 HighestUserAddress : 0x00007fffffff0000 Void +0x488 ThreadListHead : _LIST_ENTRY [ 0xffff84898fdd6728 - 0xffff848998572728 ] +0x498 ActiveThreads : 0xa +0x49c ImagePathHash : 0 +0x4a0 DefaultHardErrorProcessing : 0x8000 +0x4a4 LastThreadExitStatus : 0n0 +0x4a8 PrefetchTrace : _EX_FAST_REF +0x4b0 LockedPagesList : (null) +0x4b8 ReadOperationCount : _LARGE_INTEGER 0x4 +0x4c0 WriteOperationCount : _LARGE_INTEGER 0x0 +0x4c8 OtherOperationCount : _LARGE_INTEGER 0x89 +0x4d0 ReadTransferCount : _LARGE_INTEGER 0x5e0 +0x4d8 WriteTransferCount : _LARGE_INTEGER 0x0 +0x4e0 OtherTransferCount : _LARGE_INTEGER 0xdb8 +0x4e8 CommitChargeLimit : 0 +0x4f0 CommitCharge : 0x2e2 +0x4f8 CommitChargePeak : 0x2e2 +0x500 Vm : _MMSUPPORT_FULL +0x610 MmProcessLinks : _LIST_ENTRY [ 0xffff84898fdf1690 - 0xffff84898fd4b690 ] +0x620 ModifiedPageCount : 0x13 +0x624 ExitStatus : 0n259 +0x628 VadRoot : _RTL_AVL_TREE +0x630 VadHint : 0xffff84898fd7f310 Void
+0x638 VadCount : 0x49
+0x640 VadPhysicalPages : 0
+0x648 VadPhysicalPagesLimit : 0
+0x650 AlpcContext : _ALPC_PROCESS_CONTEXT
+0x670 TimerResolutionLink : _LIST_ENTRY [ 0x0000000000000000 - 0x0000000000000000 ]
+0x680 TimerResolutionStackRecord : (null)
+0x688 RequestedTimerResolution : 0
+0x68c SmallestTimerResolution : 0
+0x690 ExitTime : _LARGE_INTEGER 0x0
+0x698 InvertedFunctionTable : (null)
+0x6a0 InvertedFunctionTableLock : _EX_PUSH_LOCK
+0x6a8 ActiveThreadsHighWatermark : 0xa
+0x6ac LargePrivateVadCount : 0
+0x6b0 ThreadListLock : _EX_PUSH_LOCK
+0x6b8 WnfContext : 0xffffe18f2b82a010 Void +0x6c0 ServerSilo : (null) +0x6c8 SignatureLevel : 0x37 '7' +0x6c9 SectionSignatureLevel : 0x8 '' +0x6ca Protection : _PS_PROTECTION +0x6cb HangCount : 0y0000 +0x6cb GhostCount : 0y0000 +0x6cc Flags3 : 0xc000 +0x6cc Minimal : 0y0 +0x6cc ReplacingPageRoot : 0y0 +0x6cc Crashed : 0y0 +0x6cc JobVadsAreTracked : 0y0 +0x6cc VadTrackingDisabled : 0y0 +0x6cc AuxiliaryProcess : 0y0 +0x6cc SubsystemProcess : 0y0 +0x6cc IndirectCpuSets : 0y0 +0x6cc RelinquishedCommit : 0y0 +0x6cc HighGraphicsPriority : 0y0 +0x6cc CommitFailLogged : 0y0 +0x6cc ReserveFailLogged : 0y0 +0x6cc SystemProcess : 0y0 +0x6cc HideImageBaseAddresses : 0y0 +0x6cc AddressPolicyFrozen : 0y1 +0x6cc ProcessFirstResume : 0y1 +0x6cc ForegroundExternal : 0y0 +0x6cc ForegroundSystem : 0y0 +0x6cc HighMemoryPriority : 0y0 +0x6d0 DeviceAsid : 0n0 +0x6d8 SvmData : (null) +0x6e0 SvmProcessLock : _EX_PUSH_LOCK +0x6e8 SvmLock : 0 +0x6f0 SvmProcessDeviceListHead : _LIST_ENTRY [ 0xffff84898fdd79b0 - 0xffff84898fdd79b0 ] +0x700 LastFreezeInterruptTime : 0 +0x708 DiskCounters : 0xffff84898fdd7b08 _PROCESS_DISK_COUNTERS
+0x710 PicoContext : (null)
+0x718 TrustletIdentity : 0
+0x720 EnclaveTable : (null)
+0x728 EnclaveNumber : 0
+0x730 EnclaveLock : _EX_PUSH_LOCK
+0x738 HighPriorityFaultsAllowed : 0
+0x740 EnergyContext : 0xffff84898fdd7b30 _PO_PROCESS_ENERGY_CONTEXT +0x748 VmContext : (null) +0x750 SequenceNumber : 0x79 +0x758 CreateInterruptTime : 0x7454b6c +0x760 CreateUnbiasedInterruptTime : 0x7454b6c +0x768 TotalUnbiasedFrozenTime : 0 +0x770 LastAppStateUpdateTime : 0x7454b6c +0x778 LastAppStateUptime : 0y0000000000000000000000000000000000000000000000000000000000000 (0) +0x778 LastAppState : 0y000 +0x780 SharedCommitCharge : 0x206 +0x788 SharedCommitLock : _EX_PUSH_LOCK +0x790 SharedCommitLinks : _LIST_ENTRY [ 0xffffe18f3061d7f8 - 0xffffe18f3472e5f8 ] +0x7a0 AllowedCpuSets : 0 +0x7a8 DefaultCpuSets : 0 +0x7a0 AllowedCpuSetsIndirect : (null) +0x7a8 DefaultCpuSetsIndirect : (null) +0x7b0 DiskIoAttribution : (null) +0x7b8 DxgProcess : 0xffffe18f306d4a50 Void
+0x7c0 Win32KFilterSet : 0
+0x7c8 ProcessTimerDelay : _PS_INTERLOCKED_TIMER_DELAY_VALUES
+0x7d0 KTimerSets : 0
+0x7d4 KTimer2Sets : 0
+0x7d8 ThreadTimerSets : 2
+0x7e0 VirtualTimerListLock : 0
+0x7e8 VirtualTimerListHead : _LIST_ENTRY [ 0xffff84898fdd7aa8 - 0xffff84898fdd7aa8 ]
+0x7f8 WakeChannel : _WNF_STATE_NAME
+0x7f8 WakeInfo : _PS_PROCESS_WAKE_INFORMATION
+0x828 MitigationFlags : 0x8800a1
+0x828 MitigationFlagsValues :
+0x82c MitigationFlags2 : 0
+0x82c MitigationFlags2Values :
+0x830 PartitionObject : 0xffff8489`820ab800 Void
+0x838 SecurityDomain : 0
+0x840 CoverageSamplerContext : (null)
通过!process [EPROCESS ADDR]显示进程的关键信息，以msmpeng为例：
!process ffff84898fdd72c0
PROCESS ffff84898fdd72c0
SessionId: 0 Cid: 1404 Peb: ec4ed48000 ParentCid: 0398
DirBase: 431f50002 ObjectTable: ffffe18f30607c00 HandleCount: 248.
Image: MsMpEng.exe
VadRoot ffff84898fdd5dd0 Vads 73 Clone 0 Private 537. Modified 19. Locked 0.
DeviceMap ffffe18f2b818ad0
Token ffffe18f30642060
ElapsedTime 00:00:11.334
UserTime 00:00:00.015
KernelTime 00:00:00.015
QuotaPoolUsage[PagedPool] 90088
QuotaPoolUsage[NonPagedPool] 12912
Working Set Sizes (now,min,max) (3181, 50, 345) (12724KB, 200KB, 1380KB)
PeakWorkingSetSize 3112
VirtualSize 2101325 Mb
PeakVirtualSize 2101326 Mb
PageFaultCount 3237
MemoryPriority BACKGROUND
BasePriority 8
CommitCharge 738
THREAD ffff84898fdd6080 Cid 1404.1408 Teb: 000000ec4ed49000 Win32Thread: ffff84898f7b14c0 WAIT: (UserRequest) UserMode Non-Alertable
ffff84898fe45920 SynchronizationEvent
Not impersonating
DeviceMap ffffe18f2b818ad0
Owning Process ffff84898fdd72c0 Image: MsMpEng.exe
Attached Process N/A Image: N/A
Wait Start TickCount 784 Ticks: 722 (0:00:00:11.281)
Context Switch Count 107 IdealProcessor: 1
UserTime 00:00:00.000
KernelTime 00:00:00.015
Win32 Start Address 0x00007ff751b0c120
Stack Init ffff9789579e7b90 Current ffff9789579e75c0
Base ffff9789579e8000 Limit ffff9789579e1000 Call 0000000000000000
Priority 9 BasePriority 8 PriorityDecrement 0 IoPriority 2 PagePriority 5
Child-SP RetAddr Call Site
ffff9789`579e7600 fffff800`060395d6 nt!KiSwapContext+0x76
ffff9789`579e7740 fffff800`06038dcb nt!KiSwapThread+0x2c6
ffff9789`579e7810 fffff800`060384ef nt!KiCommitThreadWait+0x13b
ffff9789`579e78b0 fffff800`064e5f2c nt!KeWaitForSingleObject+0x1ff
ffff9789`579e7990 fffff800`061b9d43 nt!NtWaitForSingleObject+0xfc
ffff9789`579e7a00 00007ffd`84ee9f84 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffff9789`579e7a00)
000000ec`4eb3f988 00000000`00000000 0x00007ffd`84ee9f84
THREAD ffff84898fde2080 Cid 1404.143c Teb: 000000ec4ed4b000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable
ffff84898fde8440 QueueObject
Not impersonating
DeviceMap ffffe18f2b818ad0
Owning Process ffff84898fdd72c0 Image: MsMpEng.exe
Attached Process N/A Image: N/A
Wait Start TickCount 802 Ticks: 704 (0:00:00:11.000)
Context Switch Count 9 IdealProcessor: 3
UserTime 00:00:00.000
KernelTime 00:00:00.000
Win32 Start Address 0x00007ffd84e6f320
Stack Init ffff978957a2fb90 Current ffff978957a2f280
Base ffff978957a30000 Limit ffff978957a29000 Call 0000000000000000
Priority 8 BasePriority 8 PriorityDecrement 0 IoPriority 2 PagePriority 5
Child-SP RetAddr Call Site
ffff9789`57a2f2c0 fffff800`060395d6 nt!KiSwapContext+0x76
ffff9789`57a2f400 fffff800`06038dcb nt!KiSwapThread+0x2c6
ffff9789`57a2f4d0 fffff800`060d7ae2 nt!KiCommitThreadWait+0x13b
ffff9789`57a2f570 fffff800`060d7579 nt!KeRemoveQueueEx+0x262
ffff9789`57a2f620 fffff800`060d6b44 nt!IoRemoveIoCompletion+0x99
ffff9789`57a2f740 fffff800`061b9d43 nt!NtWaitForWorkViaWorkerFactory+0x334
ffff9789`57a2f990 00007ffd`84eed854 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffff9789`57a2fa00)
000000ec`4ebbf938 00000000`00000000 0x00007ffd`84eed854
THREAD ffff84898fe10040 Cid 1404.1448 Teb: 000000ec4ed4d000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable
ffff84898fdab6f0 NotificationEvent
Not impersonating
DeviceMap ffffe18f2b818ad0
Owning Process ffff84898fdd72c0 Image: MsMpEng.exe
Attached Process N/A Image: N/A
Wait Start TickCount 794 Ticks: 712 (0:00:00:11.125)
Context Switch Count 5 IdealProcessor: 5
UserTime 00:00:00.000
KernelTime 00:00:00.000
Win32 Start Address 0x00007ffd84e6f320
Stack Init ffff978957a4fb90 Current ffff978957a4f5c0
Base ffff978957a50000 Limit ffff978957a49000 Call 0000000000000000
Priority 8 BasePriority 8 PriorityDecrement 0 IoPriority 2 PagePriority 5
Child-SP RetAddr Call Site
ffff9789`57a4f600 fffff800`060395d6 nt!KiSwapContext+0x76
ffff9789`57a4f740 fffff800`06038dcb nt!KiSwapThread+0x2c6
ffff9789`57a4f810 fffff800`060384ef nt!KiCommitThreadWait+0x13b
ffff9789`57a4f8b0 fffff800`064e5f2c nt!KeWaitForSingleObject+0x1ff
ffff9789`57a4f990 fffff800`061b9d43 nt!NtWaitForSingleObject+0xfc
ffff9789`57a4fa00 00007ffd`84ee9f84 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffff9789`57a4fa00)
000000ec`4ee7f3e8 00000000`00000000 0x00007ffd`84ee9f84
THREAD ffff84898fe09080 Cid 1404.1460 Teb: 000000ec4ed4f000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable
ffff84898fde8440 QueueObject
Not impersonating
DeviceMap ffffe18f2b818ad0
Owning Process ffff84898fdd72c0 Image: MsMpEng.exe
Attached Process N/A Image: N/A
Wait Start TickCount 800 Ticks: 706 (0:00:00:11.031)
Context Switch Count 6 IdealProcessor: 7
UserTime 00:00:00.000
KernelTime 00:00:00.000
Win32 Start Address 0x00007ffd84e6f320
Stack Init ffff978957a7fb90 Current ffff978957a7f280
Base ffff978957a80000 Limit ffff978957a79000 Call 0000000000000000
Priority 8 BasePriority 8 PriorityDecrement 0 IoPriority 2 PagePriority 5
Child-SP RetAddr Call Site
ffff9789`57a7f2c0 fffff800`060395d6 nt!KiSwapContext+0x76
ffff9789`57a7f400 fffff800`06038dcb nt!KiSwapThread+0x2c6
ffff9789`57a7f4d0 fffff800`060d7ae2 nt!KiCommitThreadWait+0x13b
ffff9789`57a7f570 fffff800`060d7579 nt!KeRemoveQueueEx+0x262
ffff9789`57a7f620 fffff800`060d6b44 nt!IoRemoveIoCompletion+0x99
ffff9789`57a7f740 fffff800`061b9d43 nt!NtWaitForWorkViaWorkerFactory+0x334
ffff9789`57a7f990 00007ffd`84eed854 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffff9789`57a7fa00)
000000ec`4eeff6a8 00000000`00000000 0x00007ffd`84eed854
THREAD ffff84898fec9080 Cid 1404.15ac Teb: 000000ec4ed53000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable
ffff84898fd1ed40 QueueObject
Not impersonating
DeviceMap ffffe18f2b818ad0
Owning Process ffff84898fdd72c0 Image: MsMpEng.exe
Attached Process N/A Image: N/A
Wait Start TickCount 794 Ticks: 712 (0:00:00:11.125)
Context Switch Count 3 IdealProcessor: 2
UserTime 00:00:00.000
KernelTime 00:00:00.000
Win32 Start Address 0x00007ffd84e6f320
Stack Init ffff978957cdfb90 Current ffff978957cdf280
Base ffff978957ce0000 Limit ffff978957cd9000 Call 0000000000000000
Priority 8 BasePriority 8 PriorityDecrement 0 IoPriority 2 PagePriority 5
Child-SP RetAddr Call Site
ffff9789`57cdf2c0 fffff800`060395d6 nt!KiSwapContext+0x76
ffff9789`57cdf400 fffff800`06038dcb nt!KiSwapThread+0x2c6
ffff9789`57cdf4d0 fffff800`060d7ae2 nt!KiCommitThreadWait+0x13b
ffff9789`57cdf570 fffff800`060d7579 nt!KeRemoveQueueEx+0x262
ffff9789`57cdf620 fffff800`060d6b44 nt!IoRemoveIoCompletion+0x99
ffff9789`57cdf740 fffff800`061b9d43 nt!NtWaitForWorkViaWorkerFactory+0x334
ffff9789`57cdf990 00007ffd`84eed854 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffff9789`57cdfa00)
000000ec`4efff588 00000000`00000000 0x00007ffd`84eed854
THREAD ffff8489901b0080 Cid 1404.1758 Teb: 000000ec4ed55000 Win32Thread: ffff84898fbe8b10 WAIT: (WrLpcReply) UserMode Non-Alertable
ffff8489901b06c8 Semaphore Limit 0x1
Waiting for reply to ALPC Message ffffe18f30694ce0 : queued at port ffff84898eb2ce20 : owned by process ffff84898e9c8580
Not impersonating
DeviceMap ffffe18f2b818ad0
Owning Process ffff84898fdd72c0 Image: MsMpEng.exe
Attached Process N/A Image: N/A
Wait Start TickCount 803 Ticks: 703 (0:00:00:10.984)
Context Switch Count 226 IdealProcessor: 4
UserTime 00:00:00.031
KernelTime 00:00:00.046
Win32 Start Address 0x00007ffd8164c490
Stack Init ffff978957ffab90 Current ffff978957ffa2e0
Base ffff978957ffb000 Limit ffff978957ff4000 Call 0000000000000000
Priority 9 BasePriority 8 PriorityDecrement 0 IoPriority 2 PagePriority 5
Child-SP RetAddr Call Site
ffff9789`57ffa320 fffff800`060395d6 nt!KiSwapContext+0x76
ffff9789`57ffa460 fffff800`06038dcb nt!KiSwapThread+0x2c6
ffff9789`57ffa530 fffff800`060384ef nt!KiCommitThreadWait+0x13b
ffff9789`57ffa5d0 fffff800`060283cb nt!KeWaitForSingleObject+0x1ff
ffff9789`57ffa6b0 fffff800`064b6c06 nt!AlpcpSignalAndWait+0x17b
ffff9789`57ffa750 fffff800`064b6882 nt!AlpcpReceiveSynchronousReply+0x56
ffff9789`57ffa7b0 fffff800`064b4872 nt!AlpcpProcessSynchronousRequest+0x372
ffff9789`57ffa8d0 fffff800`061b9d43 nt!NtAlpcSendWaitReceivePort+0x1e2
ffff9789`57ffa990 00007ffd`84eeb034 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffff9789`57ffaa00)
000000ec`4f07eac8 00000000`00000000 0x00007ffd`84eeb034
THREAD ffff8489903b5080 Cid 1404.17a4 Teb: 000000ec4ed57000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable
ffff84898fdd1f00 QueueObject
Not impersonating
DeviceMap ffffe18f2b818ad0
Owning Process ffff84898fdd72c0 Image: MsMpEng.exe
Attached Process N/A Image: N/A
Wait Start TickCount 802 Ticks: 704 (0:00:00:11.000)
Context Switch Count 6 IdealProcessor: 6
UserTime 00:00:00.000
KernelTime 00:00:00.000
Win32 Start Address 0x00007ffd84e6f320
Stack Init ffff97895808fb90 Current ffff97895808f280
Base ffff978958090000 Limit ffff978958089000 Call 0000000000000000
Priority 8 BasePriority 8 PriorityDecrement 0 IoPriority 2 PagePriority 5
Child-SP RetAddr Call Site
ffff9789`5808f2c0 fffff800`060395d6 nt!KiSwapContext+0x76
ffff9789`5808f400 fffff800`06038dcb nt!KiSwapThread+0x2c6
ffff9789`5808f4d0 fffff800`060d7ae2 nt!KiCommitThreadWait+0x13b
ffff9789`5808f570 fffff800`060d7579 nt!KeRemoveQueueEx+0x262
ffff9789`5808f620 fffff800`060d6b44 nt!IoRemoveIoCompletion+0x99
ffff9789`5808f740 fffff800`061b9d43 nt!NtWaitForWorkViaWorkerFactory+0x334
ffff9789`5808f990 00007ffd`84eed854 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffff9789`5808fa00)
000000ec`4ef7f5c8 00000000`00000000 0x00007ffd`84eed854
THREAD ffff848998525700 Cid 1404.1228 Teb: 000000ec4ed59000 Win32Thread: ffff84898fd20710 WAIT: (WrLpcReply) UserMode Non-Alertable
ffff848998525d48 Semaphore Limit 0x1
Waiting for reply to ALPC Message ffffe18f34668ce0 : queued at port ffff84898ed5f1a0 : owned by process ffff84898eb94340
Not impersonating
DeviceMap ffffe18f2b818ad0
Owning Process ffff84898fdd72c0 Image: MsMpEng.exe
Attached Process N/A Image: N/A
Wait Start TickCount 802 Ticks: 704 (0:00:00:11.000)
Context Switch Count 16 IdealProcessor: 1
UserTime 00:00:00.000
KernelTime 00:00:00.000
Win32 Start Address 0x00007ffd8164c490
Stack Init ffff97895812fb90 Current ffff97895812f2e0
Base ffff978958130000 Limit ffff978958129000 Call 0000000000000000
Priority 9 BasePriority 8 PriorityDecrement 0 IoPriority 2 PagePriority 5
Child-SP RetAddr Call Site
ffff9789`5812f320 fffff800`060395d6 nt!KiSwapContext+0x76
ffff9789`5812f460 fffff800`06038dcb nt!KiSwapThread+0x2c6
ffff9789`5812f530 fffff800`060384ef nt!KiCommitThreadWait+0x13b
ffff9789`5812f5d0 fffff800`060283cb nt!KeWaitForSingleObject+0x1ff
ffff9789`5812f6b0 fffff800`064b6c06 nt!AlpcpSignalAndWait+0x17b
ffff9789`5812f750 fffff800`064b6882 nt!AlpcpReceiveSynchronousReply+0x56
ffff9789`5812f7b0 fffff800`064b4872 nt!AlpcpProcessSynchronousRequest+0x372
ffff9789`5812f8d0 fffff800`061b9d43 nt!NtAlpcSendWaitReceivePort+0x1e2
ffff9789`5812f990 00007ffd`84eeb034 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffff9789`5812fa00)
000000ec`4f0fed28 00000000`00000000 0x00007ffd`84eeb034
THREAD ffff848998573080 Cid 1404.1870 Teb: 000000ec4ed5b000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable
ffff84898fdd1f00 QueueObject
Not impersonating
DeviceMap ffffe18f2b818ad0
Owning Process ffff84898fdd72c0 Image: MsMpEng.exe
Attached Process N/A Image: N/A
Wait Start TickCount 802 Ticks: 704 (0:00:00:11.000)
Context Switch Count 1 IdealProcessor: 3
UserTime 00:00:00.000
KernelTime 00:00:00.000
Win32 Start Address 0x00007ffd84e6f320
Stack Init ffff97895824fb90 Current ffff97895824f280
Base ffff978958250000 Limit ffff978958249000 Call 0000000000000000
Priority 8 BasePriority 8 PriorityDecrement 0 IoPriority 2 PagePriority 5
Child-SP RetAddr Call Site
ffff9789`5824f2c0 fffff800`060395d6 nt!KiSwapContext+0x76
ffff9789`5824f400 fffff800`06038dcb nt!KiSwapThread+0x2c6
ffff9789`5824f4d0 fffff800`060d7ae2 nt!KiCommitThreadWait+0x13b
ffff9789`5824f570 fffff800`060d7579 nt!KeRemoveQueueEx+0x262
ffff9789`5824f620 fffff800`060d6b44 nt!IoRemoveIoCompletion+0x99
ffff9789`5824f740 fffff800`061b9d43 nt!NtWaitForWorkViaWorkerFactory+0x334
ffff9789`5824f990 00007ffd`84eed854 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffff9789`5824fa00)
000000ec`4f17f5c8 00000000`00000000 0x00007ffd`84eed854
THREAD ffff848998572080 Cid 1404.1874 Teb: 000000ec4ed5d000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable
ffff848998574100 SynchronizationTimer
Not impersonating
DeviceMap ffffe18f2b818ad0
Owning Process ffff84898fdd72c0 Image: MsMpEng.exe
Attached Process N/A Image: N/A
Wait Start TickCount 803 Ticks: 703 (0:00:00:10.984)
Context Switch Count 1 IdealProcessor: 5
UserTime 00:00:00.000
KernelTime 00:00:00.000
Win32 Start Address 0x00007ffd82446cd0
Stack Init ffff978958257b90 Current ffff978958256d60
Base ffff978958258000 Limit ffff978958251000 Call 0000000000000000
Priority 8 BasePriority 8 PriorityDecrement 0 IoPriority 2 PagePriority 5
Child-SP RetAddr Call Site
ffff9789`58256da0 fffff800`060395d6 nt!KiSwapContext+0x76
ffff9789`58256ee0 fffff800`06038dcb nt!KiSwapThread+0x2c6
ffff9789`58256fb0 fffff800`060384ef nt!KiCommitThreadWait+0x13b
ffff9789`58257050 fffff800`06037d15 nt!KeWaitForSingleObject+0x1ff
ffff9789`58257130 fffff800`064e44e0 nt!KeWaitForMultipleObjects+0x4b5
ffff9789`58257210 fffff800`064e5007 nt!ObWaitForMultipleObjects+0x2a0
ffff9789`58257710 fffff800`061b9d43 nt!NtWaitForMultipleObjects+0xf7
ffff9789`58257990 00007ffd`84eeaa54 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffff9789`58257a00)
000000ec`4f1ff8c8 00000000`00000000 0x00007ffd`84eeaa54
观察Token
!token ffffe18f30642060
_TOKEN 0xffffe18f30642060
TS Session ID: 0
User: S-1-5-18
User Groups:
00 S-1-16-16384
Attributes - GroupIntegrity GroupIntegrityEnabled
01 S-1-1-0
Attributes - Mandatory Default Enabled
02 S-1-5-32-545
Attributes - Mandatory Default Enabled
03 S-1-5-6
Attributes - Mandatory Default Enabled
04 S-1-2-1
Attributes - Mandatory Default Enabled
05 S-1-5-11
Attributes - Mandatory Default Enabled
06 S-1-5-15
Attributes - Mandatory Default Enabled
07 S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736
Attributes - Default Enabled Owner
08 S-1-5-5-0-259255
Attributes - Mandatory Default Enabled Owner LogonId
09 S-1-2-0
Attributes - Mandatory Default Enabled
10 S-1-5-32-544
Attributes - Default Enabled Owner
Primary Group: S-1-5-18
Privs:
03 0x000000003 SeAssignPrimaryTokenPrivilege Attributes - Enabled
05 0x000000005 SeIncreaseQuotaPrivilege Attributes - Enabled
07 0x000000007 SeTcbPrivilege Attributes - Enabled Default
08 0x000000008 SeSecurityPrivilege Attributes - Enabled
09 0x000000009 SeTakeOwnershipPrivilege Attributes - Enabled
10 0x00000000a SeLoadDriverPrivilege Attributes - Enabled
14 0x00000000e SeIncreaseBasePriorityPrivilege Attributes - Enabled Default
17 0x000000011 SeBackupPrivilege Attributes - Enabled
18 0x000000012 SeRestorePrivilege Attributes - Enabled
19 0x000000013 SeShutdownPrivilege Attributes - Enabled
20 0x000000014 SeDebugPrivilege Attributes - Enabled Default
22 0x000000016 SeSystemEnvironmentPrivilege Attributes - Enabled
23 0x000000017 SeChangeNotifyPrivilege Attributes - Enabled Default
29 0x00000001d SeImpersonatePrivilege Attributes - Enabled Default
Authentication ID: (0,3e7)
Impersonation Level: Anonymous
TokenType: Primary
Source: Advapi TokenFlags: 0x2800 ( Token in use )
Token ID: 3f834 ParentToken ID: 0
Modified ID: (0, 452a8)
RestrictedSidCount: 0 RestrictedSids: 0x0000000000000000
OriginatingLogonSession: 3e7
PackageSid: (null)
CapabilityCount: 0 Capabilities: 0x0000000000000000
LowboxNumberEntry: 0x0000000000000000
Security Attributes:
Unable to get the offset of nt!_AUTHZBASEP_SECURITY_ATTRIBUTE.ListLink
Process Token TrustLevelSid: S-1-19-512-1536
线程
标签：00,0y0,0x304,线程,fffff800,第二章,nt,ffff9789,调试 来源： https://www.cnblogs.com/mooooonlight/p/16403705.html
本站声明： 1. iCode9 技术分享网（下文简称本站）提供的所有内容，仅供技术学习、探讨和分享； 2. 关于本站的所有留言、评论、转载及引用，纯属内容发起人的个人观点，与本站观点和立场无关； 3. 关于本站的所有言论和文字，纯属内容发起人的个人观点，与本站观点和立场无关； 4. 本站文章均是网友提供，不完全保证技术分享内容的完整性、准确性、时效性、风险性和版权归属；如您发现该文章侵犯了您的权益，可联系我们第一时间进行删除； 5. 本站为非盈利性的个人网站，所有内容不会用来进行牟利，也不会利用任何形式的广告来间接获益，纯粹是为了广大技术爱好者提供技术内容和技术思想的分享性交流网站。