手工查询内核对象的处理函数.
方法一:从\ObjectTypes中获取.
首先确保符号文件已经加载.
0: kd> vertarget
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Built by: 7601.18113.amd64fre.win7sp1_gdr.130318-1533
Machine Name:
Kernel base = 0xfffff800`01661000 PsLoadedModuleList = 0xfffff800`018a46d0
Debug session time: Thu Aug 22 10:59:24.528 2013 (UTC + 8:00)
System Uptime: 0 days 0:04:06.230
0: kd> !object \ObjectTypes
Object: fffff8a000004650 Type: (fffffa8003c8aa90) Directory
ObjectHeader: fffff8a000004620 (new version)
HandleCount: 0 PointerCount: 44
Directory Object: fffff8a000004c30 Name: ObjectTypes
Hash Address Type Name
---- ------- ---- ----
00 fffffa8003cfc500 Type TmTm
01 fffffa8003cfb8a0 Type Desktop
fffffa8003c8baa0 Type Process
03 fffffa8003ce4f30 Type DebugObject
04 fffffa8003cfb750 Type TpWorkerFactory
05 fffffa8003cfb600 Type Adapter
fffffa8003c8be10 Type Token
08 fffffa8003cef8f0 Type EventPair
09 fffffa8004e0c3b0 Type PcwObject
fffffa8003d10350 Type WmiGuid
11 fffffa8003d11350 Type EtwRegistration
12 fffffa8003cfd7a0 Type Session
fffffa8003cfbde0 Type Timer
13 fffffa8003cea740 Type Mutant
16 fffffa8003cfcc90 Type IoCompletion
17 fffffa8003cfb9f0 Type WindowStation
fffffa8003cfbc90 Type Profile
18 fffffa8003cfcb40 Type File
21 fffffa8003cfbf30 Type Semaphore
23 fffffa8003d12350 Type EtwConsumer
25 fffffa8003cfc3b0 Type TmTx
fffffa8003c8a940 Type SymbolicLink
26 fffffa8004dc3f30 Type FilterConnectionPort
fffffa8003cd48f0 Type Key
fffffa8003cfbb40 Type KeyedEvent
fffffa8003cea5f0 Type Callback
28 fffffa8003cb0f30 Type UserApcReserve
fffffa8003c8bbf0 Type Job
29 fffffa8003cfc080 Type Controller
fffffa8003cb0de0 Type IoCompletionReserve
30 fffffa8003cfcf30 Type Device
fffffa8003c8aa90 Type Directory
31 fffffa8003cfd8f0 Type Section
fffffa8003cfdf30 Type TmEn
fffffa8003c8b950 Type Thread
32 fffffa8003c8abe0 Type Type
33 fffffa8004dc3de0 Type FilterCommunicationPort
fffffa8003cd81c0 Type PowerRequest
35 fffffa8003cfc260 Type TmRm
fffffa8003cefa40 Type Event
36 fffffa8003cd8e40 Type ALPC Port
fffffa8003cfcde0 Type Driver
;拿进程来做实验.
0: kd> !object fffffa8003c8baa0
Object: fffffa8003c8baa0 Type: (fffffa8003c8abe0) Type
ObjectHeader: fffffa8003c8ba70 (new version)
HandleCount: 0 PointerCount: 2
Directory Object: fffff8a000004650 Name: Process
有类型和地址了,拿来直接用.
0: kd> dt _object_type fffffa8003c8baa0
nt!_OBJECT_TYPE
+0x000 TypeList : _LIST_ENTRY [ 0xfffffa80`03c8baa0 - 0xfffffa80`03c8baa0 ]
+0x010 Name : _UNICODE_STRING "Process"
+0x020 DefaultObject : (null)
+0x028 Index : 0x7 ''
+0x02c TotalNumberOfObjects : 0x24
+0x030 TotalNumberOfHandles : 0xb9
+0x034 HighWaterNumberOfObjects : 0x28
+0x038 HighWaterNumberOfHandles : 0xc1
+0x040 TypeInfo : _OBJECT_TYPE_INITIALIZER
+0x0b0 TypeLock : _EX_PUSH_LOCK
+0x0b8 Key : 0x636f7250
+0x0c0 CallbackList : _LIST_ENTRY [ 0xfffff8a0`082d4190 - 0xfffff8a0`08da5830 ]
0: kd> dt _OBJECT_TYPE_INITIALIZER fffffa8003c8bae0
nt!_OBJECT_TYPE_INITIALIZER
+0x000 Length : 0x70
+0x002 ObjectTypeFlags : 0x4a 'J'
+0x002 CaseInsensitive : 0y0
+0x002 UnnamedObjectsOnly : 0y1
+0x002 UseDefaultObject : 0y0
+0x002 SecurityRequired : 0y1
+0x002 MaintainHandleCount : 0y0
+0x002 MaintainTypeList : 0y0
+0x002 SupportsObjectCallbacks : 0y1
+0x002 CacheAligned : 0y0
+0x004 ObjectTypeCode : 0
+0x008 InvalidAttributes : 0xb0
+0x00c GenericMapping : _GENERIC_MAPPING
+0x01c ValidAccessMask : 0x1fffff
+0x020 RetainAccess : 0x101000
+0x024 PoolType : 0 ( NonPagedPool )
+0x028 DefaultPagedPoolCharge : 0x1000
+0x02c DefaultNonPagedPoolCharge : 0x528
+0x030 DumpProcedure : (null)
+0x038 OpenProcedure : 0xfffff800`019a9ca0 long nt!PspProcessOpen+0
+0x040 CloseProcedure : 0xfffff800`01990fd0 void nt!PspProcessClose+0
+0x048 DeleteProcedure : 0xfffff800`01990280 void nt!PspProcessDelete+0
+0x050 ParseProcedure : (null)
+0x058 SecurityProcedure : 0xfffff800`019c1cd0 long nt!SeDefaultObjectMethod+0
+0x060 QueryNameProcedure : (null)
+0x068 OkayToCloseProcedure : (null)
0: kd> u nt!PspProcessOpen
nt!PspProcessOpen:
fffff800`019a9ca0 488b4c2428 mov rcx,qword ptr [rsp+28h]
fffff800`019a9ca5 80fa01 cmp dl,1
fffff800`019a9ca8 7516 jne nt!PspProcessOpen+0x20 (fffff800`019a9cc0)
fffff800`019a9caa 410fbaa03c0400000b bt dword ptr [r8+43Ch],0Bh
fffff800`019a9cb3 720b jb nt!PspProcessOpen+0x20 (fffff800`019a9cc0)
fffff800`019a9cb5 410fbaa13c0400000b bt dword ptr [r9+43Ch],0Bh
fffff800`019a9cbe 7211 jb nt!PspProcessOpen+0x31 (fffff800`019a9cd1)
fffff800`019a9cc0 8b01 mov eax,dword ptr [rcx]
关于函数的类型,已有的可以用IDA分析(64位),32位的直接分析出了.没有的是不是可以随意写?
方法二:拿当前进程对象做实验.
0: kd> !process
PROCESS fffffa8003cb0890
SessionId: none Cid: 0004 Peb: 00000000 ParentCid: 0000
DirBase: 00187000 ObjectTable: fffff8a0000019b0 HandleCount: 553.
Image: System
VadRoot fffffa8004ed04e0 Vads 5 Clone 0 Private 8. Modified 3214605. Locked 0.
DeviceMap fffff8a000007eb0
Token fffff8a000004040
ElapsedTime 00:03:32.487
UserTime 00:00:00.000
KernelTime 00:00:02.199
QuotaPoolUsage[PagedPool] 0
QuotaPoolUsage[NonPagedPool] 0
Working Set Sizes (now,min,max) (91, 0, 0) (364KB, 0KB, 0KB)
PeakWorkingSetSize 1412
VirtualSize 3 Mb
PeakVirtualSize 8 Mb
PageFaultCount 25105
MemoryPriority BACKGROUND
BasePriority 8
CommitCharge 28
......显示的内容省略.
0: kd> !object fffffa8003cb0890
Object: fffffa8003cb0890 Type: (fffffa8003c8baa0) Process
ObjectHeader: fffffa8003cb0860 (new version)
HandleCount: 3 PointerCount: 167
0: kd> dt _object_type fffffa8003c8baa0
nt!_OBJECT_TYPE
+0x000 TypeList : _LIST_ENTRY [ 0xfffffa80`03c8baa0 - 0xfffffa80`03c8baa0 ]
+0x010 Name : _UNICODE_STRING "Process"
+0x020 DefaultObject : (null)
+0x028 Index : 0x7 ''
+0x02c TotalNumberOfObjects : 0x24
+0x030 TotalNumberOfHandles : 0xb9
+0x034 HighWaterNumberOfObjects : 0x28
+0x038 HighWaterNumberOfHandles : 0xc1
+0x040 TypeInfo : _OBJECT_TYPE_INITIALIZER
+0x0b0 TypeLock : _EX_PUSH_LOCK
+0x0b8 Key : 0x636f7250
+0x0c0 CallbackList : _LIST_ENTRY [ 0xfffff8a0`082d4190 - 0xfffff8a0`08da5830 ]
0: kd> dt _OBJECT_TYPE_INITIALIZER fffffa8003c8baa0+40
nt!_OBJECT_TYPE_INITIALIZER
+0x000 Length : 0x70
+0x002 ObjectTypeFlags : 0x4a 'J'
+0x002 CaseInsensitive : 0y0
+0x002 UnnamedObjectsOnly : 0y1
+0x002 UseDefaultObject : 0y0
+0x002 SecurityRequired : 0y1
+0x002 MaintainHandleCount : 0y0
+0x002 MaintainTypeList : 0y0
+0x002 SupportsObjectCallbacks : 0y1
+0x002 CacheAligned : 0y0
+0x004 ObjectTypeCode : 0
+0x008 InvalidAttributes : 0xb0
+0x00c GenericMapping : _GENERIC_MAPPING
+0x01c ValidAccessMask : 0x1fffff
+0x020 RetainAccess : 0x101000
+0x024 PoolType : 0 ( NonPagedPool )
+0x028 DefaultPagedPoolCharge : 0x1000
+0x02c DefaultNonPagedPoolCharge : 0x528
+0x030 DumpProcedure : (null)
+0x038 OpenProcedure : 0xfffff800`019a9ca0 long nt!PspProcessOpen+0
+0x040 CloseProcedure : 0xfffff800`01990fd0 void nt!PspProcessClose+0
+0x048 DeleteProcedure : 0xfffff800`01990280 void nt!PspProcessDelete+0
+0x050 ParseProcedure : (null)
+0x058 SecurityProcedure : 0xfffff800`019c1cd0 long nt!SeDefaultObjectMethod+0
+0x060 QueryNameProcedure : (null)
+0x068 OkayToCloseProcedure : (null)
方法三:
跟据上面的进程对象的对象体,减去下面的结构的大小.
0: kd> dt _object_header fffffa8003cb0860
nt!_OBJECT_HEADER
+0x000 PointerCount : 0n167
+0x008 HandleCount : 0n3
+0x008 NextToFree : 0x00000000`00000003 Void
+0x010 Lock : _EX_PUSH_LOCK
+0x018 TypeIndex : 0x7 ''
+0x019 TraceFlags : 0 ''
+0x01a InfoMask : 0 ''
+0x01b Flags : 0x2 ''
+0x020 ObjectCreateInfo : 0xfffff800`01864940 _OBJECT_CREATE_INFORMATION
+0x020 QuotaBlockCharged : 0xfffff800`01864940 Void
+0x028 SecurityDescriptor : 0xfffff8a0`00004e49 Void
+0x030 Body : _QUAD
发现_object_header结构里面没有Type成员,但是有一个TypeIndex.
0: kd> dq nt!obTypeIndexTable
fffff800`01874b80 00000000`00000000 00000000`bad0b0b0
fffff800`01874b90 fffffa80`03c8abe0 fffffa80`03c8aa90
fffff800`01874ba0 fffffa80`03c8a940 fffffa80`03c8be10
fffff800`01874bb0 fffffa80`03c8bbf0 fffffa80`03c8baa0
fffff800`01874bc0 fffffa80`03c8b950 fffffa80`03cb0f30
fffff800`01874bd0 fffffa80`03cb0de0 fffffa80`03ce4f30
fffff800`01874be0 fffffa80`03cefa40 fffffa80`03cef8f0
fffff800`01874bf0 fffffa80`03cea740 fffffa80`03cea5f0
索引从零开始,从这里找到了_OBJECT_TYPE,进而_OBJECT_TYPE_INITIALIZER获取函数的位置.
注意:obTypeIndexTable,这个变量没有导出.
如果要编程获取,还得费一些小周折.
方法四:
例如ObOpenObjectByPointer函数的说明中有一段话:
ObjectType
Pointer to the object type.
If the value of AccessMode is KernelMode, this parameter is optional and can be NULL.
Otherwise, it must be either *ExEventObjectType, *ExSemaphoreObjectType, *IoFileObjectType, *PsThreadType or *SeTokenObjectType.
Note The SeTokenObjectType object type is supported in Windows XP and later operating systems.
这是啥东西呢?继续探索,再看看定义:
extern POBJECT_TYPE *CmKeyObjectType;
extern POBJECT_TYPE *IoFileObjectType;
extern POBJECT_TYPE *ExEventObjectType;
extern POBJECT_TYPE *ExSemaphoreObjectType;
extern POBJECT_TYPE *TmTransactionManagerObjectType;
extern POBJECT_TYPE *TmResourceManagerObjectType;
extern POBJECT_TYPE *TmEnlistmentObjectType;
extern POBJECT_TYPE *TmTransactionObjectType;
extern POBJECT_TYPE *PsProcessType;
extern POBJECT_TYPE *PsThreadType;
extern POBJECT_TYPE *SeTokenObjectType;
其实远不止这些,再看看:
1: kd> x /v /z nt!*type
pub func fffff800`0183a3d8 8 nt!ExDesktopObjectType (<no parameter info>)
pub func fffff800`01842f98 8 nt!TmTransactionManagerObjectType (<no parameter info>)
pub func fffff800`01842fc0 8 nt!TmTransactionObjectType (<no parameter info>)
pub func fffff800`018cc048 8 nt!IoFileObjectType (<no parameter info>)
pub func fffff800`018cc1a8 b nt!IoDriverObjectType (<no parameter info>)
pub func fffff800`018cc020 10 nt!PsProcessType (<no parameter info>)
pub func fffff800`018cc128 11 nt!MmSectionObjectType (<no parameter info>)
pub func fffff800`01842fa0 20 nt!TmResourceManagerObjectType (<no parameter info>)
pub func fffff800`019466a0 20 nt!ObGetObjectType (<no parameter info>)
pub func fffff800`01b61050 20 nt!CmKeyObjectType (<no parameter info>)
pub func fffff800`018cc0b0 50 nt!ExEventObjectType (<no parameter info>)
pub func fffff800`018cc050 60 nt!PsThreadType (<no parameter info>)
pub func fffff800`016b65a8 70 nt!RtlFindAceByType (<no parameter info>)
pub func fffff800`01b61070 c0 nt!SeTokenObjectType (<no parameter info>)
pub func fffff800`018cc938 f0 nt!IoAdapterObjectType (<no parameter info>)
pub func fffff800`018cc2e8 140 nt!PsJobType (<no parameter info>)
pub func fffff800`0188f068 158 nt!LpcPortObjectType (<no parameter info>)
pub func fffff800`018cc428 1e0 nt!ExSemaphoreObjectType (<no parameter info>)
pub func fffff800`016b6324 284 nt!SeComputeAutoInheritByObjectType (<no parameter info>)
pub func fffff800`018cc608 330 nt!IoDeviceObjectType (<no parameter info>)
pub func fffff800`01aa4920 4f0 nt!ObCreateObjectType (<no parameter info>)
pub func fffff800`019473d8 5e4 nt!SeTokenType (<no parameter info>)
pub func fffff800`018ccc38 ee8 nt!IoDeviceHandlerObjectType (<no parameter info>)
pub func fffff800`0183a3e0 8bb8 nt!ExWindowStationObjectType (<no parameter info>)
pub func fffff800`01842fc8 4c0a0 nt!TmEnlistmentObjectType (<no parameter info>)
说明:这些变量或者函数是导出的,可喜的是这些东西可以直接在代码中直接使用,不必再获取了.
根据这些变量或者函数,获取对象的处理函数的2个示例及验证如下:
1: kd> dq MmSectionObjectType
fffff800`018cc128 fffffa80`03cdd6e0 00000000`00000000
fffff800`018cc138 00d5ade9`1100020f 00007530`00000000
fffff800`018cc148 00000000`00000000 fffffa80`03d1e4e0
fffff800`018cc158 00000000`00000000 fffff880`00961000
fffff800`018cc168 00000000`00000000 fffffa80`03cdd850
fffff800`018cc178 00000000`000037ba fffff800`016c1890
fffff800`018cc188 00000000`00000000 00000000`00002710
fffff800`018cc198 00010100`00000064 fffff8bf`ffffffff
1: kd> !object \ObjectTypes
Object: fffff8a000006930 Type: (fffffa8003c6ade0) Directory
ObjectHeader: fffff8a000006900 (new version)
HandleCount: 0 PointerCount: 44
Directory Object: fffff8a000004c90 Name: ObjectTypes
Hash Address Type Name
---- ------- ---- ----
00 fffffa8003cdc1d0 Type TmTm
01 fffffa8003cdb250 Type Desktop
fffffa8003c8fde0 Type Process
03 fffffa8003c8f8a0 Type DebugObject
04 fffffa8003cdc080 Type TpWorkerFactory
05 fffffa8003cdcf30 Type Adapter
fffffa8003c6aaa0 Type Token
08 fffffa8003cd08f0 Type EventPair
09 fffffa8003fa9210 Type PcwObject
fffffa8003d173a0 Type WmiGuid
11 fffffa8003d18330 Type EtwRegistration
12 fffffa8003cdd590 Type Session
fffffa8003cdb790 Type Timer
13 fffffa8003cdb080 Type Mutant
16 fffffa8003cdc9f0 Type IoCompletion
17 fffffa8003cdb3a0 Type WindowStation
fffffa8003cdb640 Type Profile
18 fffffa8003cdc8a0 Type File
21 fffffa8003cdb8e0 Type Semaphore
23 fffffa8003d193a0 Type EtwConsumer
25 fffffa8003cddf30 Type TmTx
fffffa8003c6ac90 Type SymbolicLink
26 fffffa8003f30880 Type FilterConnectionPort
fffffa8003cb37a0 Type Key
fffffa8003cdb4f0 Type KeyedEvent
fffffa8003cdbf30 Type Callback
28 fffffa8003c8fb40 Type UserApcReserve
fffffa8003c8ff30 Type Job
29 fffffa8003cdcde0 Type Controller
fffffa8003c8f9f0 Type IoCompletionReserve
30 fffffa8003cdcc90 Type Device
fffffa8003c6ade0 Type Directory
31 fffffa8003cdd6e0 Type Section
fffffa8003cddc90 Type TmEn
fffffa8003c8fc90 Type Thread
32 fffffa8003c6af30 Type Type
33 fffffa8003f36aa0 Type FilterCommunicationPort
fffffa8003cc2900 Type PowerRequest
35 fffffa8003cddde0 Type TmRm
fffffa8003cd0a40 Type Event
36 fffffa8003cb7ac0 Type ALPC Port
fffffa8003cdcb40 Type Driver
1: kd> dq nt!LpcPortObjectType
fffff800`0188f068 fffffa80`03cb7ac0 00000000`00000288
fffff800`0188f078 00000000`00000000 00000002`00000000
fffff800`0188f088 00000000`00000000 00000000`00000000
fffff800`0188f098 00000000`00000000 00000000`00000c00
fffff800`0188f0a8 00000000`00000d08 00000000`00000000
fffff800`0188f0b8 00000c02`00000106 fffffa80`03ccb500
fffff800`0188f0c8 fffffa80`03cc9500 00000000`00000000
fffff800`0188f0d8 00000000`00000000 00000000`00000000
0: kd> dt _object_type fffffa80`03cdd6e0
nt!_OBJECT_TYPE
+0x000 TypeList : _LIST_ENTRY [ 0xfffffa80`03cdd6e0 - 0xfffffa80`03cdd6e0 ]
+0x010 Name : _UNICODE_STRING "Section"
+0x020 DefaultObject : 0xfffff800`01845220 Void
+0x028 Index : 0x21 '!'
+0x02c TotalNumberOfObjects : 0x3dd
+0x030 TotalNumberOfHandles : 0x1b7
+0x034 HighWaterNumberOfObjects : 0x3e5
+0x038 HighWaterNumberOfHandles : 0x1c3
+0x040 TypeInfo : _OBJECT_TYPE_INITIALIZER
+0x0b0 TypeLock : _EX_PUSH_LOCK
+0x0b8 Key : 0x74636553
+0x0c0 CallbackList : _LIST_ENTRY [ 0xfffffa80`03cdd7a0 - 0xfffffa80`03cdd7a0 ]
0: kd> dt _OBJECT_TYPE_INITIALIZER fffffa80`03cdd6e0+40
nt!_OBJECT_TYPE_INITIALIZER
+0x000 Length : 0x70
+0x002 ObjectTypeFlags : 0x4 ''
+0x002 CaseInsensitive : 0y0
+0x002 UnnamedObjectsOnly : 0y0
+0x002 UseDefaultObject : 0y1
+0x002 SecurityRequired : 0y0
+0x002 MaintainHandleCount : 0y0
+0x002 MaintainTypeList : 0y0
+0x002 SupportsObjectCallbacks : 0y0
+0x002 CacheAligned : 0y0
+0x004 ObjectTypeCode : 0
+0x008 InvalidAttributes : 0x100
+0x00c GenericMapping : _GENERIC_MAPPING
+0x01c ValidAccessMask : 0x1f001f
+0x020 RetainAccess : 0
+0x024 PoolType : 1 ( PagedPool )
+0x028 DefaultPagedPoolCharge : 0x98
+0x02c DefaultNonPagedPoolCharge : 0
+0x030 DumpProcedure : (null)
+0x038 OpenProcedure : (null)
+0x040 CloseProcedure : (null)
+0x048 DeleteProcedure : 0xfffff800`019b4558 void nt!MiSectionDelete+0
+0x050 ParseProcedure : (null)
+0x058 SecurityProcedure : 0xfffff800`0197fcd0 long nt!SeDefaultObjectMethod+0
+0x060 QueryNameProcedure : (null)
+0x068 OkayToCloseProcedure : (null)
0: kd> dt _object_type fffffa80`03cb7ac0
nt!_OBJECT_TYPE
+0x000 TypeList : _LIST_ENTRY [ 0xfffffa80`03cb7ac0 - 0xfffffa80`03cb7ac0 ]
+0x010 Name : _UNICODE_STRING "ALPC Port"
+0x020 DefaultObject : 0x00000000`000000c9 Void
+0x028 Index : 0x24 '$'
+0x02c TotalNumberOfObjects : 0x261
+0x030 TotalNumberOfHandles : 0x260
+0x034 HighWaterNumberOfObjects : 0x30c
+0x038 HighWaterNumberOfHandles : 0x30a
+0x040 TypeInfo : _OBJECT_TYPE_INITIALIZER
+0x0b0 TypeLock : _EX_PUSH_LOCK
+0x0b8 Key : 0x43504c41
+0x0c0 CallbackList : _LIST_ENTRY [ 0xfffffa80`03cb7b80 - 0xfffffa80`03cb7b80 ]
0: kd> dt _OBJECT_TYPE_INITIALIZER fffffa80`03cb7ac0+40
nt!_OBJECT_TYPE_INITIALIZER
+0x000 Length : 0x70
+0x002 ObjectTypeFlags : 0x10 ''
+0x002 CaseInsensitive : 0y0
+0x002 UnnamedObjectsOnly : 0y0
+0x002 UseDefaultObject : 0y0
+0x002 SecurityRequired : 0y0
+0x002 MaintainHandleCount : 0y1
+0x002 MaintainTypeList : 0y0
+0x002 SupportsObjectCallbacks : 0y0
+0x002 CacheAligned : 0y0
+0x004 ObjectTypeCode : 0
+0x008 InvalidAttributes : 0x80
+0x00c GenericMapping : _GENERIC_MAPPING
+0x01c ValidAccessMask : 0x1f0001
+0x020 RetainAccess : 0
+0x024 PoolType : 0 ( NonPagedPool )
+0x028 DefaultPagedPoolCharge : 0
+0x02c DefaultNonPagedPoolCharge : 0x228
+0x030 DumpProcedure : (null)
+0x038 OpenProcedure : 0xfffff800`01973430 long nt!AlpcpOpenPort+0
+0x040 CloseProcedure : 0xfffff800`0193abf8 void nt!AlpcpClosePort+0
+0x048 DeleteProcedure : 0xfffff800`01939730 void nt!AlpcpDeletePort+0
+0x050 ParseProcedure : (null)
+0x058 SecurityProcedure : 0xfffff800`0197fcd0 long nt!SeDefaultObjectMethod+0
+0x060 QueryNameProcedure : (null)
+0x068 OkayToCloseProcedure : (null)
made by correy
made at 2013.08.22
没有评论:
发表评论