《深入理解Windows操作系统》笔记1

C:\ProgramFiles>cd"DebuggingToolsforWindows(x86)"

C:\ProgramFiles\DebuggingToolsforWindows(x86)>dir

驱动器C中的卷没有标签。

卷的序列号是18F6-A188

C:\ProgramFiles\DebuggingToolsforWindows(x86)的目录

2012-02-0214:24<DIR>.

2012-02-0214:24<DIR>..

2012-02-0214:24<DIR>1394

2009-08-2414:3871,168adplus.doc

2010-02-0112:2797,040adplus.exe

2010-02-0112:2729,056adplusext.dll

2010-02-0112:2780,656adplusmanager.exe

2009-08-2414:382,068adplusmanager.exe.config

2010-02-0112:27200,530adplus_old.vbs

2010-02-0112:2736,736agestore.exe

2010-02-0112:2717,168breakin.exe

2010-02-0112:27364,816cdb.exe

2012-02-0214:24<DIR>clr10

2010-02-0112:2732,128convertstore.exe

2010-02-0112:27112,512dbengprx.exe

2010-02-0112:273,557,648dbgeng.dll

2010-02-0112:271,213,200dbghelp.dll

2010-02-0112:2739,184dbgrpc.exe

2010-02-0112:2732,528dbgsrv.exe

2010-02-0112:27151,824dbh.exe

2010-01-0811:07326,336debugger.chi

2010-01-0811:075,117,792debugger.chm

2010-02-0112:27419,088decem.dll

2009-08-2414:3856,832dml.doc

2010-02-0112:2720,864dumpchk.exe

2010-02-0112:2719,840dumpexam.exe

2010-02-0112:27145,168gflags.exe

2010-02-0112:27362,768i386kd.exe

2010-02-0112:27362,768ia64kd.exe

2010-02-0112:27376,080kd.exe

2010-02-0112:2734,576kdbgctrl.exe

2010-02-0112:27170,256kdsrv.exe

2009-08-2414:381,196,032kernel_debugging_tutorial.doc

2010-02-0112:2734,064kill.exe

2009-09-1811:3510,237license.txt

2010-02-0112:2780,768list.exe

2010-02-0112:2728,944logger.exe

2010-02-0112:27211,328logviewer.exe

2010-02-0112:27365,328ntsd.exe

2010-02-0112:2723,312pdbcopy.exe

2010-02-0112:082,819redist.txt

2010-01-2821:2112,615relnotes.txt

2010-02-0112:2769,504remote.exe

2010-02-0112:2725,360rtlist.exe

2012-02-0214:24<DIR>sdk

2012-02-0214:24<DIR>srcsrv

2010-02-0112:2792,944srcsrv.dll

2010-02-0112:2730,992symbolcheck.dll

2010-02-0112:2780,144symchk.exe

2012-02-0214:24<DIR>symproxy

2010-02-0112:27131,856symsrv.dll

2009-08-2414:381symsrv.yes

2010-02-0112:27145,168symstore.exe

2012-02-0214:24<DIR>themes

2010-02-0112:2747,376tlist.exe

2012-02-0214:24<DIR>triage

2010-02-0112:27143,232umdh.exe

2012-02-0214:24<DIR>usb

2010-02-0112:27139,136usbview.exe

2010-02-0112:2774,512vmdemux.exe

2012-02-0214:24<DIR>w2kchk

2012-02-0214:24<DIR>w2kfre

2010-02-0112:27532,752windbg.exe

2012-02-0214:24<DIR>winext

2012-02-0214:24<DIR>winxp

51个文件16,929,054字节

14个目录153,558,147,072可用字节

C:\ProgramFiles\DebuggingToolsforWindows(x86)>tlist.exe/t

SystemProcess(0)

System(4)

smss.exe(460)

csrss.exe(516)

winlogon.exe(1172)

services.exe(1216)

ati2evxx.exe(1388)ATIvideobiospoller

svchost.exe(1420)

svchost.exe(1536)

svchost.exe(1656)

svchost.exe(1676)

svchost.exe(1728)

acs.exe(1764)

inetinfo.exe(1856)

sqlservr.exe(1880)

sqlwriter.exe(2032)

alg.exe(700)

msiexec.exe(3664)

lsass.exe(1228)

ati2evxx.exe(1616)ATIvideobiospollerclient

explorer.exe(1000)ProgramManager

RTHDCPL.EXE(1192)

Probe2.exe(1372)PCProbeII

aaCenter.exe(2500)aacenter

TWCU.exe(1276)TP-LINK无线客户端应用程序-当前配置文件：默认值-TP-LINKWi

relessUSBAdapter

ctfmon.exe(1460)

DTLite.exe(1468)DAEMONToolsAgentwindow

WINWORD.EXE(3952)windows-MicrosoftWord

cmd.exe(2600)命令提示符-tlist.exe/t

tlist.exe(1100)

windbg.exe(2412)Localkernel-WinDbg:6.12.0002.633X86

MOM.exe(1436).NET-BroadcastEventWindow.2.0.0.0.33c0d9d.0

CCC.exe(3748)

conime.exe(2512)

C:\ProgramFiles\DebuggingToolsforWindows(x86)>

Microsoft(R)WindowsDebuggerVersion6.12.0002.633X86

Copyright(c)MicrosoftCorporation.Allrightsreserved.

ConnectedtoWindowsXP2600x86compatibletargetat(ThuFeb214:26:16.1712012(UTC+8:00)),ptr64FALSE

Symbolsearchpathis:***Invalid***

****************************************************************************

*Symbolloadingmaybeunreliablewithoutasymbolsearchpath.*

*Use.symfixtohavethedebuggerchooseasymbolpath.*

*Aftersettingyoursymbolpath,use.reloadtorefreshsymbollocations.*

****************************************************************************

Executablesearchpathis:

*********************************************************************

*Symbolscannotbeloadedbecausesymbolpathisnotinitialized.*

**

*TheSymbolPathcanbesetby:*

*usingthe_NT_SYMBOL_PATHenvironmentvariable.*

*usingthe-y<symbol_path>argumentwhenstartingthedebugger.*

*using.sympathand.sympath+*

*********************************************************************

***ERROR:Symbolfilecouldnotbefound.Defaultedtoexportsymbolsforntkrpamp.exe-

*******************************************************************************

WARNING:Localkerneldebuggingrequiresbootingwithkernel

debuggingsupport(/debugorbcdedit-debugon)toworkoptimally.

*******************************************************************************

WindowsXPKernelVersion2600(ServicePack3)MP(2procs)Freex86compatible

Product:WinNt,suite:TerminalServerSingleUserTS

Builtby:2600.xpsp.080413-2111

MachineName:

Kernelbase=0x804d8000PsLoadedModuleList=0x8055e720

Debugsessiontime:ThuFeb214:26:16.3432012(UTC+8:00)

SystemUptime:0days0:25:11.890

X64用户进程空间：8TB，系统空间6657GB

Itanium用户进程空间：7TB，系统空间6144GB

C:\ProgramFiles\SupportTools>qslice

启动线程查看器，该软件位于Windows2000资源工具包中，XP下需要单独下载安装

C:\ProgramFiles\SupportTools>

C:\ProgramFiles\SupportTools>mstsc.exe

启动远程连接

Windows2000professional不支持终端会话

WindowsXPprofessional支持1个终端会话

Windows2000Server和WindowsServer2003支持2个并发的远程连接，以上版本如企业版支持多个连接，并且可以配置为终端服务器

在WindowsXP中使用键盘Win+L组合键可以快速切换用户，原来的进程等信息均保存在系统中

WindowsXP/2003使用16位宽度的unicode编码，而不是8位asci码，在此之前的windows版本，其亚洲和中东语言版本是美国欧洲核心版本的一个扩展，因此其windowsAPI是一个超集，和原有的版本不同，因此需要在app层面单独构建语言包。而从windows2000开始使用全球统一的语言包了。API也调用一样了

内核调试所需的符号文件必须做到完全匹配。

C:\>livekd

LiveKdv5.0-Executekd/windbgonalivesystem

Sysinternals-www.sysinternals.com

Copyright(C)2000-2010MarkRussinovichandKenJohnson

Symbolsarenotconfigured.WouldyoulikeLiveKdtosetthe_NT_SYMBOL_PATH

directorytoreferencetheMicrosoftsymbolserversothatsymbolscanbe

obtainedautomatically?(y/n)y

Enterthefoldertowhichsymbolsdownload(defaultisc:\symbols):

Symbolsearchpathis:srv*c:\Symbols*http://msdl.microsoft.com/download/symbols

http://msdl.microsoft.com/download/symbols不支持web访问，仅支持终端内核调试访问

windows支持2种多处理器系统：超线程和NUMA非一致性的内存结构。HT超线程是intel的技术，一个物理处理器上提供多个逻辑处理器，每个逻辑处理器有其自己的状态，执行引擎和芯片上的L1，L2,L3等高速缓存共享。

NUMA是将处理器作为更小的单元节点，使用全部的内存

处理器许可：注册表：HKLM\SYSEM\CCS\Contorl\session\manager\licensedprocessors

在64bitwindows上，没有PAE内核。也就是Windows2000的介质下\I386\UNIPROC\WINSRV。DLL文件，表示单处理器版本，在XP和2003中去掉了

检查正在运行的ntoskrnl版本：

1、检查事件查看器中事件ID为6009的日志

2、在引导的注册表中检查HKLM\SYSRTEM\CCS\Control\sessionmanger\memorymanagerment\physicaladdressExtrension如果是1，则从PAE引导，也就是单处理器

3、C:\WINDOWS\system32>ntoskrnl.exeC:\WINDOWS\system32\ntoskrnl.exe应用程序无法在Win32模式中运行。

版本	支持的CPU	支持的物理内存GB
windows2000professional	2	4
windows2000server	4	4
windows2000advancedserver	8	8
windows2000datacenter	32	64
	32位的支持CPU	32位的物理内存支持	64位的CPU	64位内存
windowsxphome	1	4	无	无
windowsXPprofessional	2	4	2	128
windows2003standard	4	4	无	无
windows2003enterprise	8	32	8	64
windows2003datacenter	32	64	64	1024

奇怪吧，windowsXP64bit的内存支持比windows2003企业版64bit还要高！！！

Microsoft(R)WindowsDebuggerVersion6.12.0002.633X86

Copyright(c)MicrosoftCorporation.Allrightsreserved.

ConnectedtoWindowsXP2600x86compatibletargetat(FriFeb312:11:08.2182012(UTC+8:00)),ptr64FALSE

Symbolsearchpathis:C:\WINDOWS\Symbols;srv*c:\Symbols*http://msdl.microsoft.com/download/symbols

Executablesearchpathis:

*******************************************************************************

WARNING:Localkerneldebuggingrequiresbootingwithkernel

debuggingsupport(/debugorbcdedit-debugon)toworkoptimally.

*******************************************************************************

WindowsXPKernelVersion2600(ServicePack3)MP(2procs)Freex86compatible

Product:WinNt,suite:TerminalServerSingleUserTS

Builtby:2600.xpsp.080413-2111

MachineName:

Kernelbase=0x804d8000PsLoadedModuleList=0x8055e720

Debugsessiontime:FriFeb312:11:08.4842012(UTC+8:00)

SystemUptime:0days0:28:38.160

lkd>dtnt!_*

ntkrpamp!_LIST_ENTRY

ntkrpamp!_IMAGE_NT_HEADERS

ntkrpamp!_IMAGE_FILE_HEADER

ntkrpamp!_IMAGE_OPTIONAL_HEADER

ntkrpamp!_LARGE_INTEGER

ntkrpamp!__unnamed

ntkrpamp!_ULARGE_INTEGER

ntkrpamp!__unnamed

ntkrpamp!_LUID

ntkrpamp!_KAPC

ntkrpamp!_KTHREAD

ntkrpamp!_SINGLE_LIST_ENTRY

ntkrpamp!_KSPIN_LOCK_QUEUE_NUMBER

ntkrpamp!_KPRCB

ntkrpamp!_KPROCESSOR_STATE

ntkrpamp!_KSPIN_LOCK_QUEUE

ntkrpamp!_KNODE

ntkrpamp!_PP_LOOKASIDE_LIST

ntkrpamp!_KPRCB

ntkrpamp!_KDPC

ntkrpamp!_FX_SAVE_AREA

ntkrpamp!_PROCESSOR_POWER_STATE

ntkrpamp!_SLIST_HEADER

ntkrpamp!_NPAGED_LOOKASIDE_LIST

ntkrpamp!_GENERAL_LOOKASIDE

ntkrpamp!_PAGED_LOOKASIDE_LIST

ntkrpamp!_FAST_MUTEX

ntkrpamp!_PP_NPAGED_LOOKASIDE_NUMBER

ntkrpamp!_POOL_TYPE

ntkrpamp!_EX_RUNDOWN_REF

ntkrpamp!_EX_FAST_REF

ntkrpamp!_EX_PUSH_LOCK

ntkrpamp!_EX_PUSH_LOCK_WAIT_BLOCK

ntkrpamp!_KEVENT

ntkrpamp!_EX_PUSH_LOCK_CACHE_AWARE

ntkrpamp!_ETHREAD

ntkrpamp!_TERMINATION_PORT

ntkrpamp!_CLIENT_ID

ntkrpamp!_KSEMAPHORE

ntkrpamp!_PS_IMPERSONATION_INFORMATION

ntkrpamp!_DEVICE_OBJECT

ntkrpamp!_EPROCESS

ntkrpamp!_KPROCESS

ntkrpamp!_HANDLE_TABLE

ntkrpamp!_EJOB

ntkrpamp!_EPROCESS_QUOTA_BLOCK

ntkrpamp!_PAGEFAULT_HISTORY

ntkrpamp!_HARDWARE_PTE

ntkrpamp!_PEB

ntkrpamp!_SE_AUDIT_PROCESS_CREATION_INFO

ntkrpamp!_MMSUPPORT

ntkrpamp!_OBJECT_ATTRIBUTES

ntkrpamp!_UNICODE_STRING

ntkrpamp!_OBJECT_TYPE

ntkrpamp!_ERESOURCE

ntkrpamp!_OBJECT_TYPE_INITIALIZER

ntkrpamp!_OBJECT_HANDLE_INFORMATION

ntkrpamp!_DISPATCHER_HEADER

ntkrpamp!_KAPC_STATE

ntkrpamp!_KWAIT_BLOCK

ntkrpamp!_KQUEUE

ntkrpamp!_KTIMER

ntkrpamp!_KTRAP_FRAME

ntkrpamp!_FNSAVE_FORMAT

ntkrpamp!_FXSAVE_FORMAT

ntkrpamp!__unnamed

ntkrpamp!_MMPTE

ntkrpamp!_MMPTE_HIGHLOW

ntkrpamp!_MMPTE_HARDWARE

ntkrpamp!_MMPTE_PROTOTYPE

ntkrpamp!_MMPTE_SOFTWARE

ntkrpamp!_MMPTE_TRANSITION

ntkrpamp!_MMPTE_SUBSECTION

ntkrpamp!_MMPTE_LIST

ntkrpamp!__unnamed

ntkrpamp!_MEMORY_CACHING_TYPE

ntkrpamp!_MI_PFN_CACHE_ATTRIBUTE

ntkrpamp!_EXCEPTION_RECORD64

ntkrpamp!_EXCEPTION_RECORD32

ntkrpamp!_DBGKM_EXCEPTION64

ntkrpamp!_DBGKM_EXCEPTION32

ntkrpamp!_DBGKD_LOAD_SYMBOLS64

ntkrpamp!_DBGKD_LOAD_SYMBOLS32

ntkrpamp!_DBGKD_READ_MEMORY64

ntkrpamp!_DBGKD_READ_MEMORY32

ntkrpamp!_DBGKD_WRITE_MEMORY64

ntkrpamp!_DBGKD_WRITE_MEMORY32

ntkrpamp!_DBGKD_WRITE_BREAKPOINT64

ntkrpamp!_DBGKD_WRITE_BREAKPOINT32

ntkrpamp!_DBGKD_READ_WRITE_IO64

ntkrpamp!_DBGKD_READ_WRITE_IO32

ntkrpamp!_DBGKD_READ_WRITE_IO_EXTENDED64

ntkrpamp!_DBGKD_READ_WRITE_IO_EXTENDED32

ntkrpamp!_DBGKD_SET_SPECIAL_CALL32

ntkrpamp!_DBGKD_SET_SPECIAL_CALL64

ntkrpamp!_DBGKD_SET_INTERNAL_BREAKPOINT32

ntkrpamp!_DBGKD_SET_INTERNAL_BREAKPOINT64

ntkrpamp!_DBGKD_GET_INTERNAL_BREAKPOINT64

ntkrpamp!_DBGKD_GET_INTERNAL_BREAKPOINT32

ntkrpamp!_DBGKD_MANIPULATE_STATE64

ntkrpamp!_DBGKD_GET_CONTEXT

ntkrpamp!_DBGKD_SET_CONTEXT

ntkrpamp!_DBGKD_RESTORE_BREAKPOINT

ntkrpamp!_DBGKD_CONTINUE

ntkrpamp!_DBGKD_CONTINUE2

ntkrpamp!_DBGKD_QUERY_SPECIAL_CALLS

ntkrpamp!_DBGKD_GET_VERSION64

ntkrpamp!_DBGKD_BREAKPOINTEX

ntkrpamp!_DBGKD_READ_WRITE_MSR

ntkrpamp!_DBGKD_SEARCH_MEMORY

ntkrpamp!_DBGKD_GET_SET_BUS_DATA

ntkrpamp!_DBGKD_FILL_MEMORY

ntkrpamp!_DBGKD_QUERY_MEMORY

ntkrpamp!__unnamed

ntkrpamp!_DBGKD_MANIPULATE_STATE32

ntkrpamp!_DBGKD_GET_VERSION32

ntkrpamp!__unnamed

ntkrpamp!_VACB

ntkrpamp!_SHARED_CACHE_MAP

ntkrpamp!__unnamed

ntkrpamp!_FILE_OBJECT

ntkrpamp!_MBCB

ntkrpamp!_CACHE_MANAGER_CALLBACKS

ntkrpamp!_CACHE_UNINITIALIZE_EVENT

ntkrpamp!_PRIVATE_CACHE_MAP

ntkrpamp!_VACB_LEVEL_REFERENCE

ntkrpamp!_HEAP_ENTRY

ntkrpamp!_HEAP

ntkrpamp!_HEAP_TAG_ENTRY

ntkrpamp!_HEAP_UCR_SEGMENT

ntkrpamp!_HEAP_UNCOMMMTTED_RANGE

ntkrpamp!_HEAP_SEGMENT

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!_HEAP_PSEUDO_TAG_ENTRY

ntkrpamp!_HEAP_LOCK

ntkrpamp!_HEAP_SUBSEGMENT

ntkrpamp!_HEAP_USERDATA_HEADER

ntkrpamp!_HEAP_USERDATA_HEADER

ntkrpamp!_INTERLOCK_SEQ

ntkrpamp!_HMAP_TABLE

ntkrpamp!_HMAP_ENTRY

ntkrpamp!_OBJECT_SYMBOLIC_LINK

ntkrpamp!_POOL_BLOCK_HEAD

ntkrpamp!_POOL_HEADER

ntkrpamp!_LDR_DATA_TABLE_ENTRY

ntkrpamp!_VI_DEADLOCK_GLOBALS

ntkrpamp!_VI_DEADLOCK_NODE

ntkrpamp!_PF_SCENARIO_TYPE

ntkrpamp!_THERMAL_INFORMATION

ntkrpamp!_SECTION_OBJECT

ntkrpamp!_SEGMENT_OBJECT

ntkrpamp!_POWER_STATE

ntkrpamp!_SYSTEM_POWER_STATE

ntkrpamp!_DEVICE_POWER_STATE

ntkrpamp!_WMI_LOGGER_CONTEXT

ntkrpamp!_WMI_LOGGER_MODE

ntkrpamp!_GUID

ntkrpamp!_SECURITY_CLIENT_CONTEXT

ntkrpamp!_TRACE_ENABLE_FLAG_EXTENSION

ntkrpamp!_KMUTANT

ntkrpamp!_WMI_BUFFER_HEADER

ntkrpamp!_CONTROL_AREA

ntkrpamp!_SUBSECTION

ntkrpamp!_LARGE_CONTROL_AREA

ntkrpamp!_MMSECTION_FLAGS

ntkrpamp!_MMSUBSECTION_FLAGS

ntkrpamp!_SEGMENT

ntkrpamp!__unnamed

ntkrpamp!_EVENT_COUNTER

ntkrpamp!_HANDLE_TRACE_DEBUG_INFO

ntkrpamp!_MMSUPPORT_FLAGS

ntkrpamp!_MMWSL

ntkrpamp!_EX_WORK_QUEUE

ntkrpamp!_EPROCESS_QUOTA_ENTRY

ntkrpamp!_UNICODE_STRING

ntkrpamp!_PS_JOB_TOKEN_FILTER

ntkrpamp!_IO_COUNTERS

ntkrpamp!_SID_AND_ATTRIBUTES

ntkrpamp!_LUID_AND_ATTRIBUTES

ntkrpamp!_MM_DRIVER_VERIFIER_DATA

ntkrpamp!_VPB

ntkrpamp!_SECTION_OBJECT_POINTERS

ntkrpamp!_IO_COMPLETION_CONTEXT

ntkrpamp!_CALL_HASH_ENTRY

ntkrpamp!_CM_VIEW_OF_FILE

ntkrpamp!_KLOCK_QUEUE_HANDLE

ntkrpamp!_MMLISTS

ntkrpamp!_DEFERRED_WRITE

ntkrpamp!_HIVE_LIST_ENTRY

ntkrpamp!_CMHIVE

ntkrpamp!_SECURITY_IMPERSONATION_LEVEL

ntkrpamp!_DEVICE_NODE

ntkrpamp!_PO_DEVICE_NOTIFY

ntkrpamp!_PNP_DEVNODE_STATE

ntkrpamp!_IRP

ntkrpamp!_CM_RESOURCE_LIST

ntkrpamp!_IO_RESOURCE_REQUIREMENTS_LIST

ntkrpamp!_INTERFACE_TYPE

ntkrpamp!_DEVICE_RELATIONS

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!_RTL_CRITICAL_SECTION

ntkrpamp!__unnamed

ntkrpamp!_KPCR

ntkrpamp!_NT_TIB

ntkrpamp!_KIDTENTRY

ntkrpamp!_KGDTENTRY

ntkrpamp!_KTSS

ntkrpamp!_MMCOLOR_TABLES

ntkrpamp!_PHYSICAL_MEMORY_RUN

ntkrpamp!_MMPFN

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!_MMPFNENTRY

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!_MM_SESSION_SPACE

ntkrpamp!_MM_SESSION_SPACE_FLAGS

ntkrpamp!__unnamed

ntkrpamp!_MM_PAGED_POOL_INFO

ntkrpamp!_MMWSLE

ntkrpamp!_MMSESSION

ntkrpamp!_DRIVER_OBJECT

ntkrpamp!_POOL_DESCRIPTOR

ntkrpamp!_PEB_LDR_DATA

ntkrpamp!_RTL_USER_PROCESS_PARAMETERS

ntkrpamp!_PEB_FREE_BLOCK

ntkrpamp!_HEAP_FREE_ENTRY

ntkrpamp!_OWNER_ENTRY

ntkrpamp!_IO_RESOURCE_LIST

ntkrpamp!_CM_FULL_RESOURCE_DESCRIPTOR

ntkrpamp!_CM_PARTIAL_RESOURCE_LIST

ntkrpamp!_CM_CACHED_VALUE_INDEX

ntkrpamp!_CELL_DATA

ntkrpamp!__unnamed

ntkrpamp!_WNODE_HEADER

ntkrpamp!_WMI_CLIENT_CONTEXT

ntkrpamp!_WMI_BUFFER_STATE

ntkrpamp!_KiIoAccessMap

ntkrpamp!_DEVICE_OBJECT_POWER_EXTENSION

ntkrpamp!_POWER_CHANNEL_SUMMARY

ntkrpamp!_SYSTEM_POWER_POLICY

ntkrpamp!_POP_THERMAL_ZONE

ntkrpamp!_POP_ACTION_TRIGGER

ntkrpamp!_X86_DBGKD_CONTROL_SET

ntkrpamp!_DBGKD_ANY_CONTROL_SET

ntkrpamp!_PROCESSOR_POWER_POLICY

ntkrpamp!_PROCESSOR_POWER_POLICY_INFO

ntkrpamp!_IMAGE_DOS_HEADER

ntkrpamp!_HEAP_VIRTUAL_ALLOC_ENTRY

ntkrpamp!_HEAP_ENTRY_EXTRA

ntkrpamp!_RTL_ATOM_TABLE

ntkrpamp!_RTL_HANDLE_TABLE

ntkrpamp!_RTL_ATOM_TABLE_ENTRY

ntkrpamp!_IMAGE_ROM_OPTIONAL_HEADER

ntkrpamp!_KWAIT_REASON

ntkrpamp!_HHIVE

ntkrpamp!_CM_KEY_SECURITY_CACHE_ENTRY

ntkrpamp!_CM_KEY_CONTROL_BLOCK

ntkrpamp!_WORK_QUEUE_ITEM

ntkrpamp!_CM_CELL_REMAP_BLOCK

ntkrpamp!_HANDLE_TRACE_DB_ENTRY

ntkrpamp!_HBASE_BLOCK

ntkrpamp!_RTL_BITMAP

ntkrpamp!_DUAL

ntkrpamp!_PROCESS_WS_WATCH_INFORMATION

ntkrpamp!_CM_PARTIAL_RESOURCE_DESCRIPTOR

ntkrpamp!_DRIVER_EXTENSION

ntkrpamp!_FAST_IO_DISPATCH

ntkrpamp!_MMFREE_POOL_ENTRY

ntkrpamp!_IO_TIMER

ntkrpamp!_WAIT_CONTEXT_BLOCK

ntkrpamp!__unnamed

ntkrpamp!_KDEVICE_QUEUE

ntkrpamp!_DEVOBJ_EXTENSION

ntkrpamp!_BITMAP_RANGE

ntkrpamp!_KUSER_SHARED_DATA

ntkrpamp!_KSYSTEM_TIME

ntkrpamp!_KSYSTEM_TIME

ntkrpamp!_NT_PRODUCT_TYPE

ntkrpamp!_ALTERNATIVE_ARCHITECTURE_TYPE

ntkrpamp!_GENERIC_MAPPING

ntkrpamp!_OBJECT_DUMP_CONTROL

ntkrpamp!_OB_OPEN_REASON

ntkrpamp!_ACCESS_STATE

ntkrpamp!_SECURITY_QUALITY_OF_SERVICE

ntkrpamp!_SECURITY_OPERATION_CODE

ntkrpamp!_OBJECT_NAME_INFORMATION

ntkrpamp!__unnamed

ntkrpamp!_LARGE_INTEGER

ntkrpamp!_EXCEPTION_REGISTRATION_RECORD

ntkrpamp!_MMVAD_LONG

ntkrpamp!_MMVAD

ntkrpamp!_MMVAD_FLAGS

ntkrpamp!__unnamed

ntkrpamp!_MMVAD_FLAGS2

ntkrpamp!__unnamed

ntkrpamp!_MMADDRESS_LIST

ntkrpamp!__unnamed

ntkrpamp!_MMBANKED_SECTION

ntkrpamp!_MMEXTEND_INFO

ntkrpamp!__unnamed

ntkrpamp!_MMVIEW

ntkrpamp!_MEMORY_CACHING_TYPE_ORIG

ntkrpamp!_EXCEPTION_DISPOSITION

ntkrpamp!_EXCEPTION_RECORD

ntkrpamp!_CONTEXT

ntkrpamp!_POOL_TRACKER_BIG_PAGES

ntkrpamp!_VI_DEADLOCK_RESOURCE

ntkrpamp!_VI_DEADLOCK_THREAD

ntkrpamp!_FLOATING_SAVE_AREA

ntkrpamp!_IMAGE_DATA_DIRECTORY

ntkrpamp!_PCI_PDO_EXTENSION

ntkrpamp!_PCI_MJ_DISPATCH_TABLE

ntkrpamp!_PCI_SLOT_NUMBER

ntkrpamp!_PCI_FDO_EXTENSION

ntkrpamp!_PCI_LOCK

ntkrpamp!_PCI_PMC

ntkrpamp!_HMAP_DIRECTORY

ntkrpamp!_OBJECT_HEADER

ntkrpamp!_OBJECT_CREATE_INFORMATION

ntkrpamp!_QUAD

ntkrpamp!_SECURITY_DESCRIPTOR

ntkrpamp!_ACL

ntkrpamp!_RTLP_RANGE_LIST_ENTRY

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!_OBJECT_HEADER_CREATOR_INFO

ntkrpamp!_HEAP_STOP_ON_VALUES

ntkrpamp!_HEAP_STOP_ON_TAG

ntkrpamp!_KEXECUTE_OPTIONS

ntkrpamp!_MODE

ntkrpamp!_IO_RESOURCE_DESCRIPTOR

ntkrpamp!_RTL_CRITICAL_SECTION_DEBUG

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!_PCI_BUS_INTERFACE_STANDARD

ntkrpamp!_BUS_HANDLER

ntkrpamp!_PCI_COMMON_CONFIG

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!_SYSPTES_HEADER

ntkrpamp!_KDEVICE_QUEUE_ENTRY

ntkrpamp!_IO_ALLOCATION_ACTION

ntkrpamp!_CM_KEY_HASH

ntkrpamp!_CM_NAME_CONTROL_BLOCK

ntkrpamp!_CM_KEY_SECURITY_CACHE

ntkrpamp!_CACHED_CHILD_LIST

ntkrpamp!_CM_INDEX_HINT_BLOCK

ntkrpamp!_PI_RESOURCE_ARBITER_ENTRY

ntkrpamp!_ARBITER_INTERFACE

ntkrpamp!_MDL

ntkrpamp!__unnamed

ntkrpamp!_IO_STATUS_BLOCK

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!_IO_STACK_LOCATION

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!_IMAGE_SECTION_HEADER

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!_POP_TRIGGER_WAIT

ntkrpamp!_FILE_BASIC_INFORMATION

ntkrpamp!_FILE_STANDARD_INFORMATION

ntkrpamp!_FILE_NETWORK_OPEN_INFORMATION

ntkrpamp!_COMPRESSED_DATA_INFO

ntkrpamp!_ETIMER

ntkrpamp!_POLICY_AUDIT_EVENT_TYPE

ntkrpamp!_PM_SUPPORT

ntkrpamp!_MMWSLENTRY

ntkrpamp!__unnamed

ntkrpamp!_EXCEPTION_POINTERS

ntkrpamp!_CURDIR

ntkrpamp!_RTL_DRIVE_LETTER_CURDIR

ntkrpamp!_u

ntkrpamp!_VI_DEADLOCK_RESOURCE_TYPE

ntkrpamp!_MMPFNLIST

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!_OBJECT_HEADER_NAME_INFO

ntkrpamp!_OBJECT_DIRECTORY

ntkrpamp!_KINTERRUPT

ntkrpamp!_KINTERRUPT_MODE

ntkrpamp!_TOKEN_CONTROL

ntkrpamp!_PCI_ARBITER_INSTANCE

ntkrpamp!_PCI_INTERFACE

ntkrpamp!_ARBITER_INSTANCE

ntkrpamp!_MMPAGING_FILE

ntkrpamp!_MMMOD_WRITER_MDL_ENTRY

ntkrpamp!_BUS_EXTENSION_LIST

ntkrpamp!_PI_BUS_EXTENSION

ntkrpamp!_PCI_MN_DISPATCH_TABLE

ntkrpamp!_PCI_DISPATCH_STYLE

ntkrpamp!_PCI_COMMON_EXTENSION

ntkrpamp!_MEMORY_TYPE

ntkrpamp!_OBJECT_DIRECTORY_ENTRY

ntkrpamp!_DEVICE_MAP

ntkrpamp!_HEAP_LOOKASIDE

ntkrpamp!_ARBITER_ACTION

ntkrpamp!_ARBITER_PARAMETERS

ntkrpamp!_CALL_PERFORMANCE_DATA

ntkrpamp!_MMWSLE_HASH

ntkrpamp!_STRING

ntkrpamp!__unnamed

ntkrpamp!_SECTION_IMAGE_INFORMATION

ntkrpamp!__unnamed

ntkrpamp!_PRIVATE_CACHE_MAP_FLAGS

ntkrpamp!_RTL_HANDLE_TABLE_ENTRY

ntkrpamp!_POP_IDLE_HANDLER

ntkrpamp!_TOKEN

ntkrpamp!_TOKEN_SOURCE

ntkrpamp!_SEP_AUDIT_POLICY

ntkrpamp!_TOKEN_TYPE

ntkrpamp!_SECURITY_TOKEN_PROXY_DATA

ntkrpamp!_SECURITY_TOKEN_AUDIT_DATA

ntkrpamp!_TEB

ntkrpamp!_ACTIVATION_CONTEXT_STACK

ntkrpamp!_GDI_TEB_BATCH

ntkrpamp!_Wx86ThreadState

ntkrpamp!_TEB_ACTIVE_FRAME

ntkrpamp!_PCI_HEADER_TYPE_0

ntkrpamp!_PCI_HEADER_TYPE_1

ntkrpamp!_PCI_HEADER_TYPE_2

ntkrpamp!__unnamed

ntkrpamp!_HEAP_FREE_ENTRY_EXTRA

ntkrpamp!_POOL_TRACKER_TABLE

ntkrpamp!_PS_QUOTA_TYPE

ntkrpamp!_flags

ntkrpamp!_PHYSICAL_MEMORY_DESCRIPTOR

ntkrpamp!_IMAGE_DEBUG_DIRECTORY

ntkrpamp!_GUID

ntkrpamp!_INTERFACE

ntkrpamp!__unnamed

ntkrpamp!_MMMOD_WRITER_LISTHEAD

ntkrpamp!_POP_POWER_ACTION

ntkrpamp!_POP_SHUTDOWN_BUG_CHECK

ntkrpamp!_POP_DEVICE_SYS_STATE

ntkrpamp!_POP_HIBER_CONTEXT

ntkrpamp!_LPCP_MESSAGE

ntkrpamp!_PORT_MESSAGE

ntkrpamp!_MMVAD_SHORT

ntkrpamp!_SECURITY_SUBJECT_CONTEXT

ntkrpamp!_INITIAL_PRIVILEGE_SET

ntkrpamp!_PRIVILEGE_SET

ntkrpamp!__unnamed

ntkrpamp!_PNP_DEVICE_EVENT_ENTRY

ntkrpamp!_PNP_VETO_TYPE

ntkrpamp!_PLUGPLAY_EVENT_BLOCK

ntkrpamp!_PNP_DEVICE_EVENT_LIST

ntkrpamp!_KSPECIAL_REGISTERS

ntkrpamp!_SECURITY_DESCRIPTOR_RELATIVE

ntkrpamp!_RTL_RANGE_LIST

ntkrpamp!_ARBITER_ORDERING_LIST

ntkrpamp!_ARBITER_ALLOCATION_STATE

ntkrpamp!_ARBITER_CONFLICT_INFO

ntkrpamp!_RTL_RANGE

ntkrpamp!_BUS_DATA_TYPE

ntkrpamp!_SUPPORTED_RANGES

ntkrpamp!_PO_DEVICE_NOTIFY_ORDER

ntkrpamp!_POP_DEVICE_POWER_IRP

ntkrpamp!_MMSYSTEM_PTE_POOL_TYPE

ntkrpamp!_CM_NAME_HASH

ntkrpamp!_PROXY_CLASS

ntkrpamp!_HANDLE_TABLE_ENTRY

ntkrpamp!_HANDLE_TABLE_ENTRY_INFO

ntkrpamp!_LPCP_PORT_OBJECT

ntkrpamp!_LPCP_PORT_QUEUE

ntkrpamp!_POOL_HACKER

ntkrpamp!_IO_SECURITY_CONTEXT

ntkrpamp!__unnamed

ntkrpamp!_NAMED_PIPE_CREATE_PARAMETERS

ntkrpamp!__unnamed

ntkrpamp!_MAILSLOT_CREATE_PARAMETERS

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!_FILE_INFORMATION_CLASS

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!_FSINFOCLASS

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!_SCSI_REQUEST_BLOCK

ntkrpamp!__unnamed

ntkrpamp!_FILE_GET_QUOTA_INFORMATION

ntkrpamp!__unnamed

ntkrpamp!_DEVICE_RELATION_TYPE

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!_DEVICE_CAPABILITIES

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!_DEVICE_USAGE_NOTIFICATION_TYPE

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!_POWER_SEQUENCE

ntkrpamp!__unnamed

ntkrpamp!_POWER_STATE_TYPE

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!_MI_VERIFIER_POOL_HEADER

ntkrpamp!_MI_VERIFIER_DRIVER_ENTRY

ntkrpamp!_CM_KEY_BODY

ntkrpamp!_CM_NOTIFY_BLOCK

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!_IA64_DBGKD_CONTROL_SET

ntkrpamp!_AMD64_DBGKD_CONTROL_SET

ntkrpamp!_ARBITER_ORDERING

ntkrpamp!_LPCP_NONPAGED_PORT_QUEUE

ntkrpamp!_DUMP_STACK_CONTEXT

ntkrpamp!_PO_MEMORY_RANGE_ARRAY

ntkrpamp!_PO_HIBER_PERF

ntkrpamp!_TEB_ACTIVE_FRAME_CONTEXT

ntkrpamp!_TEB_ACTIVE_FRAME_CONTEXT

ntkrpamp!_SID

ntkrpamp!_DUMP_INITIALIZATION_CONTEXT

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!_IO_CLIENT_EXTENSION

ntkrpamp!_FS_FILTER_CALLBACKS

ntkrpamp!_SID_IDENTIFIER_AUTHORITY

ntkrpamp!_SUPPORTED_RANGE

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!_VI_POOL_ENTRY

ntkrpamp!_SEP_AUDIT_POLICY_CATEGORIES

ntkrpamp!_SEP_AUDIT_POLICY_OVERLAY

ntkrpamp!_PLUGPLAY_EVENT_CATEGORY

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!_ADAPTER_OBJECT

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!_ARBITER_LIST_ENTRY

ntkrpamp!_ARBITER_ALTERNATIVE

ntkrpamp!_PO_NOTIFY_ORDER_LEVEL

ntkrpamp!_FS_FILTER_CALLBACK_DATA

ntkrpamp!_CM_KEY_NODE

ntkrpamp!_CM_KEY_VALUE

ntkrpamp!_CM_KEY_SECURITY

ntkrpamp!_CM_KEY_INDEX

ntkrpamp!_CM_BIG_DATA

ntkrpamp!__unnamed

ntkrpamp!_FS_FILTER_PARAMETERS

ntkrpamp!_VI_POOL_ENTRY_INUSE

ntkrpamp!_DESCRIPTOR

ntkrpamp!_CHILD_LIST

ntkrpamp!_CM_KEY_REFERENCE

ntkrpamp!_ARBITER_REQUEST_SOURCE

ntkrpamp!_ARBITER_RESULT

ntkrpamp!__unnamed

ntkrpamp!__unnamed

ntkrpamp!_FS_FILTER_SECTION_SYNC_TYPE

ntkrpamp!__unnamed

ntkrpamp!__unnamed

lkd>dtnt!_kinterrupt

+0x000Type:Int2B

+0x002Size:Int2B

+0x004InterruptListEntry:_LIST_ENTRY

+0x00cServiceRoutine:Ptr32unsignedchar

+0x010ServiceContext:Ptr32Void

+0x014SpinLock:Uint4B

+0x018TickCount:Uint4B

+0x01cActualLock:Ptr32Uint4B

+0x020DispatchAddress:Ptr32void

+0x024Vector:Uint4B

+0x028Irql:UChar

+0x029SynchronizeIrql:UChar

+0x02aFloatingSave:UChar

+0x02bConnected:UChar

+0x02cNumber:Char

+0x02dShareVector:UChar

+0x030Mode:_KINTERRUPT_MODE

+0x034ServiceCount:Uint4B

+0x038DispatchCount:Uint4B

+0x03cDispatchCode:[106]Uint4B

确认一下是否运行的windows版本是debug版本

需要使用WMI的win32_OperationSystem类的debug属性来获得

编写脚本osversion.vbs

strComputer="."

SetobjWMIService=GetObject("winmgmts:"_

&"{impersonationLevel=impersonate}!\\"&strComputer&"\root\cimv2")

SetcolOSes=objWMIService.ExecQuery("Select*fromWin32_OperatingSystem")

ForEachobjOSincolOSes

Wscript.Echo"ComputerName:"&objOS.CSName

Wscript.Echo"Caption:"&objOS.Caption'Name

Wscript.Echo"Version:"&objOS.Version'Version&build

Wscript.Echo"BuildNumber:"&objOS.BuildNumber'Build

Wscript.Echo"BuildType:"&objOS.BuildType

Wscript.Echo"OSType:"&objOS.OSType

Wscript.Echo"OtherTypeDescription:"&objOS.OtherTypeDescription

WScript.Echo"ServicePack:"&objOS.ServicePackMajorVersion&"."&_

objOS.ServicePackMinorVersion

Next

C:\DocumentsandSettings\jamin\桌面>cscriptosversion.vbs

Microsoft(R)WindowsScriptHostVersion5.7

版权所有(C)MicrosoftCorporation1996-2001。保留所有权利。

ComputerName:AMD6000

Caption:MicrosoftWindowsXPProfessional

Version:5.1.2600

BuildNumber:2600

BuildType:MultiprocessorFree

OSType:18

OtherTypeDescription:

ServicePack:3.0