Windows XP/2003 系统调用（二）
来源：互联网 发布：sql 某字段相等的数量 编辑：程序博客网 时间：2024/05/19 13:23
上文说到sysenter后进入内核空间后的函数是_KiFastCallEntry，在/WRK-v1.2/base/ntos/ke/i386/trap.asm中，里头有好多定义常量、宏、结构，真是麻烦！先帖几个结构上来：
typedef struct _KTRAP_FRAME {
//
// Following 4 values are only used and defined for DBG systems,
// but are always allocated to make switching from DBG to non-DBG
// and back quicker. They are not DEVL because they have a non-0
// performance impact.
//
ULONG DbgEbp; // Copy of User EBP set up so KB will work.
ULONG DbgEip; // EIP of caller to system call, again, for KB.
ULONG DbgArgMark; // Marker to show no args here.
ULONG DbgArgPointer; // Pointer to the actual args
//
// Temporary values used when frames are edited.
//
//
// NOTE: Any code that want's ESP must materialize it, since it
// is not stored in the frame for kernel mode callers.
//
// And code that sets ESP in a KERNEL mode frame, must put
// the new value in TempEsp, make sure that TempSegCs holds
// the real SegCs value, and put a special marker value into SegCs.
//
ULONG TempSegCs;
ULONG TempEsp;
//
// Debug registers.
//
ULONG Dr0;
ULONG Dr1;
ULONG Dr2;
ULONG Dr3;
ULONG Dr6;
ULONG Dr7;
//
// Segment registers
//
ULONG SegGs;
ULONG SegEs;
ULONG SegDs;
//
// Volatile registers
//
ULONG Edx;
ULONG Ecx;
ULONG Eax;
//
// Nesting state, not part of context record
//
ULONG PreviousPreviousMode;
PEXCEPTION_REGISTRATION_RECORD ExceptionList;
// Trash if caller was user mode.
// Saved exception list if caller
// was kernel mode or we're in
// an interrupt.
//
// FS is TIB/PCR pointer, is here to make save sequence easy
//
ULONG SegFs;
//
// Non-volatile registers
//
ULONG Edi;
ULONG Esi;
ULONG Ebx;
ULONG Ebp;
//
// Control registers
//
ULONG ErrCode;
ULONG Eip;
ULONG SegCs;
ULONG EFlags;
ULONG HardwareEsp; // WARNING - segSS:esp are only here for stacks
ULONG HardwareSegSs; // that involve a ring transition.
ULONG V86Es; // these will be present for all transitions from
ULONG V86Ds; // V86 mode
ULONG V86Fs;
ULONG V86Gs;
} KTRAP_FRAME;
dt _KTHREAD
nt!_KTHREAD
+0x000 Header : _DISPATCHER_HEADER
+0x010 MutantListHead : _LIST_ENTRY
+0x018 InitialStack : Ptr32 Void
+0x01c StackLimit : Ptr32 Void
+0x020 Teb : Ptr32 Void
+0x024 TlsArray : Ptr32 Void
+0x028 KernelStack : Ptr32 Void
+0x02c DebugActive : UChar
+0x02d State : UChar
+0x02e Alerted : [2] UChar
+0x030 Iopl : UChar
+0x031 NpxState : UChar
+0x032 Saturation : Char
+0x033 Priority : Char
+0x034 ApcState : _KAPC_STATE
+0x04c ContextSwitches : Uint4B
+0x050 IdleSwapBlock : UChar
+0x051 Spare0 : [3] UChar
+0x054 WaitStatus : Int4B
+0x058 WaitIrql : UChar
+0x059 WaitMode : Char
+0x05a WaitNext : UChar
+0x05b WaitReason : UChar
+0x05c WaitBlockList : Ptr32 _KWAIT_BLOCK
+0x060 WaitListEntry : _LIST_ENTRY
+0x060 SwapListEntry : _SINGLE_LIST_ENTRY
+0x068 WaitTime : Uint4B
+0x06c BasePriority : Char
+0x06d DecrementCount : UChar
+0x06e PriorityDecrement : Char
+0x06f Quantum : Char
+0x070 WaitBlock : [4] _KWAIT_BLOCK
+0x0d0 LegoData : Ptr32 Void
+0x0d4 KernelApcDisable : Uint4B
+0x0d8 UserAffinity : Uint4B
+0x0dc SystemAffinityActive : UChar
+0x0dd PowerState : UChar
+0x0de NpxIrql : UChar
+0x0df InitialNode : UChar
+0x0e0 ServiceTable : Ptr32 Void
+0x0e4 Queue : Ptr32 _KQUEUE
+0x0e8 ApcQueueLock : Uint4B
+0x0f0 Timer : _KTIMER
+0x118 QueueListEntry : _LIST_ENTRY
+0x120 SoftAffinity : Uint4B
+0x124 Affinity : Uint4B
+0x128 Preempted : UChar
+0x129 ProcessReadyQueue : UChar
+0x12a KernelStackResident : UChar
+0x12b NextProcessor : UChar
+0x12c CallbackStack : Ptr32 Void
+0x130 Win32Thread : Ptr32 Void
+0x134 TrapFrame : Ptr32 _KTRAP_FRAME
+0x138 ApcStatePointer : [2] Ptr32 _KAPC_STATE
+0x140 PreviousMode : Char
+0x141 EnableStackSwap : UChar
+0x142 LargeStack : UChar
+0x143 ResourceIndex : UChar
+0x144 KernelTime : Uint4B
+0x148 UserTime : Uint4B
+0x14c SavedApcState : _KAPC_STATE
+0x164 Alertable : UChar
+0x165 ApcStateIndex : UChar
+0x166 ApcQueueable : UChar
+0x167 AutoAlignment : UChar
+0x168 StackBase : Ptr32 Void
+0x16c SuspendApc : _KAPC
+0x19c SuspendSemaphore : _KSEMAPHORE
+0x1b0 ThreadListEntry : _LIST_ENTRY
+0x1b8 FreezeCount : Char
+0x1b9 SuspendCount : Char
+0x1ba IdealProcessor : UChar
+0x1bb DisableBoost : UChar
dt _KPCR
nt!_KPCR
+0x000 NtTib : _NT_TIB
+0x01c SelfPcr : Ptr32 _KPCR
+0x020 Prcb : Ptr32 _KPRCB
+0x024 Irql : UChar
+0x028 IRR : Uint4B
+0x02c IrrActive : Uint4B
+0x030 IDR : Uint4B
+0x034 KdVersionBlock : Ptr32 Void
+0x038 IDT : Ptr32 _KIDTENTRY
+0x03c GDT : Ptr32 _KGDTENTRY
+0x040 TSS : Ptr32 _KTSS
+0x044 MajorVersion : Uint2B
+0x046 MinorVersion : Uint2B
+0x048 SetMember : Uint4B
+0x04c StallScaleFactor : Uint4B
+0x050 DebugActive : UChar
+0x051 Number : UChar
+0x052 Spare0 : UChar
+0x053 SecondLevelCacheAssociativity : UChar
+0x054 VdmAlert : Uint4B
+0x058 KernelReserved : [14] Uint4B
+0x090 SecondLevelCacheSize : Uint4B
+0x094 HalReserved : [16] Uint4B
+0x0d4 InterruptMode : Uint4B
+0x0d8 Spare1 : UChar
+0x0dc KernelReserved2 : [17] Uint4B
+0x120 PrcbData : _KPRCB
dt _KPRCB
nt!_KPRCB
+0x000 MinorVersion : Uint2B
+0x002 MajorVersion : Uint2B
+0x004 CurrentThread : Ptr32 _KTHREAD
+0x008 NextThread : Ptr32 _KTHREAD
+0x00c IdleThread : Ptr32 _KTHREAD
+0x010 Number : Char
+0x011 Reserved : Char
+0x012 BuildType : Uint2B
+0x014 SetMember : Uint4B
+0x018 CpuType : Char
+0x019 CpuID : Char
+0x01a CpuStep : Uint2B
+0x01c ProcessorState : _KPROCESSOR_STATE
+0x33c KernelReserved : [16] Uint4B
+0x37c HalReserved : [16] Uint4B
+0x3bc PrcbPad0 : [92] UChar
+0x418 LockQueue : [16] _KSPIN_LOCK_QUEUE
+0x498 PrcbPad1 : [8] UChar
+0x4a0 NpxThread : Ptr32 _KTHREAD
+0x4a4 InterruptCount : Uint4B
+0x4a8 KernelTime : Uint4B
+0x4ac UserTime : Uint4B
+0x4b0 DpcTime : Uint4B
+0x4b4 DebugDpcTime : Uint4B
+0x4b8 InterruptTime : Uint4B
…………
…………
typedef struct _SYSTEM_SERVICE_TABLE
{
PNTPROC ServiceTable; // array of entry points
PDWORD CounterTable; // array of usage counters
DWORD ServiceLimit; // number of table entries
PBYTE ArgumentTable; // array of byte counts
}
SYSTEM_SERVICE_TABLE,
*PSYSTEM_SERVICE_TABLE,
**PPSYSTEM_SERVICE_TABLE;
//-----------------------------------------------------------------------------------------------------------
typedef struct _SERVICE_DESCRIPTOR_TABLE
{
SYSTEM_SERVICE_TABLE ntoskrnl; // ntoskrnl.exe ( native api )
SYSTEM_SERVICE_TABLE win32k; // win32k.sys (gdi/user support)
SYSTEM_SERVICE_TABLE Table3; // not used
SYSTEM_SERVICE_TABLE Table4; // not used
}
SYSTEM_DESCRIPTOR_TABLE,
*PSYSTEM_DESCRIPTOR_TABLE,
**PPSYSTEM_DESCRIPTOR_TABLE;
_KiFastCallEntry proc
;
; Sanitize the segment registers
;
mov ecx, KGDT_R3_DATA OR RPL_MASK ;mov ecx, 23h
push KGDT_R0_PCR ;push 30h
pop fs ;FS->PCR
mov ds, ecx ;DS=23h
mov es, ecx ;ES=23h
;
; When we trap into the kernel via fast system call we start on the DPC stack. We need
; shift to the threads stack before enabling interrupts.
;
mov ecx, PCR[PcTss] ;
mov esp, [ecx]+TssEsp0 ;其实DPC栈只是临时过度，基本没有使用，这里才切换为线程相关的内核栈!
push KGDT_R3_DATA OR RPL_MASK ; Push user SS (push 23h),_KTRAP_FRAME.HardwareSegSs
push edx ; 用户栈指针，_KTRAP_FRAME.HardwareEsp
pushfd ;_KTRAP_FRAME.EFags，<1>
Kfsc10:
push 2 ; Sanitize eflags, clear direction, NT etc
add edx, 8 ; (edx) -> arguments
popfd ; 使当前EFLAGS=2
.errnz(EFLAGS_INTERRUPT_MASK AND 0FFFF00FFh)
or byte ptr [esp+1], EFLAGS_INTERRUPT_MASK/0100h ; Enable interrupts in eflags
;or byte ptr [esp+1], 2 ,对应<1>，因为sysenter会清除IF！
push KGDT_R3_CODE OR RPL_MASK ; Push user CS （push 1Bh），_KTRAP_FRAME.SegCs
push dword ptr ds:[USER_SHARED_DATA+UsSystemCallReturn] ; push return address，_KTRAP_FRAME.Eip
push 0 ; put pad dword for error on stack，_KTRAP_FRAME.ErrorCode
push ebp ; save the non-volatile registers，_KTRAP_FRAME.Ebp
push ebx ;_KTRAP_FRAME.Ebx
push esi ;_KTRAP_FRAME.Esi
push edi ;_KTRAP_FRAME.Edi
mov ebx, PCR[PcSelfPcr] ; Get PRCB address,不是PRCB，应该是PCR,(ebx->PCR)
push KGDT_R3_TEB OR RPL_MASK ; Push user mode FS (push 3Bh),_KTRAP_FRAME.SegFs
mov esi, [ebx].PcPrcbData+PbCurrentThread ; get current thread address,(esi->_KTHREAD)
;
; Save the old exception list in trap frame and initialize a new empty
; exception list.
push [ebx].PcExceptionList ; save old exception list,_KTRAP_FRAME.ExceptionList
mov [ebx].PcExceptionList, EXCEPTION_CHAIN_END ; set new empty list,EXCEPTION_CHAIN_END=-1
mov ebp, [esi].ThInitialStack
;
; Save the old previous mode in trap frame, allocate remainder of trap frame,
; and set the new previous mode.
push MODE_MASK ; Save previous mode as user,_KTRAP_FRAME.PreviousPreviousMode=1,UserModel
sub esp,TsPreviousPreviousMode ; allocate remainder of trap frame(sub esp, 48h)
sub ebp, NPX_FRAME_LENGTH + KTRAP_FRAME_LENGTH ;(sub ebp, 29Ch)
;NPX_FRAME_LENGTH=210h,KTRAP_FRAME_LENGTH=8C
mov byte ptr [esi].ThPreviousMode,MODE_MASK ; set new previous mode of user
;
; Now the full trap frame is build.
; Calculate initial stack pointer from thread initial stack to contain NPX and trap.
; If this isn't the same as esp then we are a VX86 thread and we are rejected
cmp ebp, esp
jne short Kfsc91
;
; Set the new trap frame address.
and dword ptr [ebp].TsDr7, 0 ;(and dword ptr [ebp+2Ch], 0),_KTRAP_FRAME.Dr7 = 0
test byte ptr [esi].ThDebugActive, 0ffh ; See if we need to save debug registers
mov [esi].ThTrapFrame, ebp ; set new trap frame address
jnz Dr_FastCallDrSave ; if nz, debugging is active on thread
Dr_FastCallDrReturn:
ife FPO ;;我把原来的SET_DEBUG_DATA宏展开了
;
; This macro is used by ENTER_SYSCALL, ENTER_TRAP and ENTER_INTERRUPT
; and is used at the end of above macros. It is safe to destroy ebx, edi.
;
mov ebx,[ebp]+TsEbp
mov edi,[ebp]+TsEip
mov [ebp]+TsDbgArgPointer,edx
mov [ebp]+TsDbgArgMark,0BADB0D00h
mov [ebp]+TsDbgEbp,ebx
mov [ebp]+TsDbgEip,edi
endif
sti ; enable interrupts，sysenter会把IF清零
?FpoValue = 0
;
; (eax) = Service number
; (edx) = Callers stack pointer
; (esi) = Current thread address
;
; All other registers have been saved and are free.
;
; Check if the service number within valid range
;
_KiSystemServiceRepeat:
mov edi, eax ; copy system service number
shr edi, SERVICE_TABLE_SHIFT ; isolate service table number,SERVICE_TABLE_SHIFT=8H(除以256)
and edi, SERVICE_TABLE_MASK ; SERVICE_TABLE_MASK=10H
mov ecx, edi ; save service table number
add edi, [esi]+ThServiceTable ; compute service descriptor address
mov ebx, eax ; save system service number
and eax, SERVICE_NUMBER_MASK ; isolate service table offset，SERVICE_NUMBER_MASK=00FFFH
;
; If the specified system service number is not within range, then attempt
; to convert the thread to a GUI thread and retry the service dispatch.
;
cmp eax, [edi]+SdLimit ; check if valid service
jae Kss_ErrorHandler ; if ae, try to convert to GUI thread
;
; If the service is a GUI service and the GDI user batch queue is not empty,
; then call the appropriate service to flush the user batch.
;
cmp ecx, SERVICE_TABLE_TEST ; test if GUI service,SERVICE_TABLE_TEST=00010H
jne short Kss40 ; if ne, not GUI service
mov ecx, PCR[PcTeb] ; get current thread TEB address
xor ebx, ebx ; get number of batched GDI calls
KiSystemServiceAccessTeb:
or ebx, [ecx]+TbGdiBatchCount ; may cause an inpage exception
jz short Kss40 ; if z, no batched calls
push edx ; save address of user arguments
push eax ; save service number
call [_KeGdiFlushUserBatch] ; flush GDI user batch
pop eax ; restore service number
pop edx ; restore address of user arguments
;
; The arguments are passed on the stack. Therefore they always need to get
; copied since additional space has been allocated on the stack for the
; machine state frame. Note that we don't check for the zero argument case -
; copy is always done regardless of the number of arguments because the
; zero argument case is very rare.
;
Kss40: inc dword ptr PCR[PcPrcbData+PbSystemCalls] ; system calls
FPOFRAME ?FpoValue, 0
mov esi, edx ; (esi)->User arguments
mov ebx, [edi]+SdNumber ; get argument table address
xor ecx, ecx
mov cl, byte ptr [ebx+eax] ; (ecx) = argument size
mov edi, [edi]+SdBase ; get service table address
mov ebx, [edi+eax*4] ; (ebx)-> service routine
sub esp, ecx ; allocate space for arguments
shr ecx, 2 ; (ecx) = number of argument DWORDs
mov edi, esp ; (edi)->location to receive 1st arg
cmp esi, _MmUserProbeAddress ; check if user address
jae kss80 ; if ae, then not user address
KiSystemServiceCopyArguments:
rep movsd ; copy the arguments to top of stack.
; Since we usually copy more than 3
; arguments. rep movsd is faster than
; mov instructions.
; Make actual call to system service
;
kssdoit:
call ebx ; call system service
上面的_KiFastCallEntry我做了一定的整理，也写了很多注释！只写到 call ebx (call system service),后面的代码以后再看……
KTRAP_FRAME是非常重要的一个结构，不管以何种方式进入内核都要在栈上构造该结构，但红色部分可能是CPU自动完成的：
When the processor performs a call to the exception- or interrupt-handler procedure:
If the handler procedure is going to be executed at a numerically lower privilege
level, a stack switch occurs. When the stack switch occurs:
a. The segment selector and stack pointer for the stack to be used by the
handler are obtained from the TSS for the currently executing task. On this
new stack, the processor pushes the stack segment selector and stack
pointer of the interrupted procedure.
b. The processor then saves the current state of the EFLAGS, CS, and EIP
registers on the new stack (see Figures 5-4).
c. If an exception causes an error code to be saved, it is pushed on the new
stack after the EIP value.
If the handler procedure is going to be executed at the same privilege level as the
interrupted procedure:
a. The processor saves the current state of the EFLAGS, CS, and EIP registers
on the current stack (see Figures 5-4).
b. If an exception causes an error code to be saved, it is pushed on the current
stack after the EIP value.
本文来自CSDN博客，转载请标明出处：http://blog.csdn.net/better0332/archive/2009/06/19/4283313.aspx
- Windows XP/2003 系统调用（二）
- Windows XP/2003 系统调用（二）
- Windows XP/2003 系统调用（一）
- Windows XP/2003 系统调用（一）
- Windows XP 系统调用
- Windows XP系统的一些应用技巧（二）
- windows xp 系统CMD命令大全(二)
- Windows 2003调用Windows XP风格界面
- 系统调用（二）
- Windows XP/2003 系统进程速查表
- 计算机启动过程（windows XP 系统）
- Windows XP系统进程
- Windows XP系统
- windows XP系统自动关机
- windows 装XP系统
- Windows XP系统下载
- Xp系统调用画图快捷方式
- 关于系统调用（二）
- ubuntu+opengl程序设计(2)第一个程序
- JavaEE必须
- Windows XP/2003 系统调用（一）
- JAVA中控制double类型小数点后位数的方法
- 堆和栈的区别（一）
- Windows XP/2003 系统调用（二）
- 以post方式发送链接请求的javascript函数
- Linux 下的串口编程
- C++中的异常
- expr 命令
- 堆与栈的区别（二）
- javascript 调用后台函数(转)
- 常用struts标签使用举例
- 各位朋友对" JavaScript挑战赛--随机颜色"的挑战代码
