win7 x64怎么枚举所有快捷键呢

在http://www.wasm.ru/print.php?article=gui_subsystem

中，提供了32位系统的驱动枚举所有快捷键的程序，但是转到win7 64位下会有各种问题。

win7 x64不支持inline的汇编。。。那个驱动都无法编译。。。我对汇编也不熟，不能把汇编提成函数放到单独的asm里面。

唉。只能学习一下windbg的内核调试过程了。

debug到gphkHashTable却得不到这个变量的数据类型。。。

lkd> !process 0 0 //枚举所有进程

**** NT ACTIVE PROCESS DUMP ****
PROCESS fffffa80039689e0
    SessionId: none  Cid: 0004    Peb: 00000000  ParentCid: 0000
    DirBase: 00187000  ObjectTable: fffff8a000001770  HandleCount: 731.
    Image: System


PROCESS fffffa8004fdbb30
    SessionId: none  Cid: 0124    Peb: 7fffffd8000  ParentCid: 0004
    DirBase: 98077000  ObjectTable: fffff8a001e8b5e0  HandleCount:  32.
    Image: smss.exe


PROCESS fffffa8005e6eb30
    SessionId: 0  Cid: 01bc    Peb: 7fffffda000  ParentCid: 0188
    DirBase: 7650f000  ObjectTable: fffff8a0026f36a0  HandleCount: 703.
    Image: csrss.exe


PROCESS fffffa80069ea710
    SessionId: 0  Cid: 021c    Peb: 7fffffdf000  ParentCid: 0188
    DirBase: 736d5000  ObjectTable: fffff8a002822af0  HandleCount:  78.
    Image: wininit.exe


PROCESS fffffa8006ab6060
    SessionId: 1  Cid: 0230    Peb: 7fffffdc000  ParentCid: 0224
    DirBase: 73554000  ObjectTable: fffff8a0028315b0  HandleCount: 902.
    Image: csrss.exe


PROCESS fffffa8006b0b910
    SessionId: 0  Cid: 0264    Peb: 7fffffdf000  ParentCid: 021c
    DirBase: 834f8000  ObjectTable: fffff8a0029c0f90  HandleCount: 325.
    Image: services.exe


PROCESS fffffa8006afdb30
    SessionId: 0  Cid: 0274    Peb: 7fffffdf000  ParentCid: 021c
    DirBase: 71c9f000  ObjectTable: fffff8a0028244b0  HandleCount: 978.
    Image: lsass.exe


PROCESS fffffa8006b0e710
    SessionId: 0  Cid: 027c    Peb: 7fffffdf000  ParentCid: 021c
    DirBase: 823e5000  ObjectTable: fffff8a0029e2d20  HandleCount: 176.
    Image: lsm.exe


PROCESS fffffa8006b82b30
    SessionId: 1  Cid: 02f0    Peb: 7fffffd5000  ParentCid: 0224
    DirBase: 70c5a000  ObjectTable: fffff8a00266f980  HandleCount: 117.
    Image: winlogon.exe


PROCESS fffffa8006b8f060
    SessionId: 0  Cid: 0318    Peb: 7fffffd6000  ParentCid: 0264
    DirBase: 80efa000  ObjectTable: fffff8a00294ef30  HandleCount: 396.
    Image: svchost.exe


PROCESS fffffa8006bd4420
    SessionId: 0  Cid: 0394    Peb: 7fffffdb000  ParentCid: 0264
    DirBase: 803ea000  ObjectTable: fffff8a002bb0a00  HandleCount: 117.
    Image: nvvsvc.exe


PROCESS fffffa8006bfa060
    SessionId: 0  Cid: 03d4    Peb: 7efdf000  ParentCid: 0264
    DirBase: 70640000  ObjectTable: fffff8a002c00d90  HandleCount: 458.
    Image: QQPCRTP.exe


PROCESS fffffa8006c38b30
    SessionId: 0  Cid: 0140    Peb: 7fffffd9000  ParentCid: 0264
    DirBase: 6e30d000  ObjectTable: fffff8a002c6ed70  HandleCount: 389.
    Image: svchost.exe


PROCESS fffffa8006c501b0
    SessionId: 0  Cid: 01c8    Peb: 7fffffdd000  ParentCid: 0264
    DirBase: 6dd13000  ObjectTable: fffff8a002d03140  HandleCount: 431.
    Image: MsMpEng.exe


PROCESS fffffa8006cc6b30
    SessionId: 0  Cid: 038c    Peb: 7fffffdf000  ParentCid: 0264
    DirBase: 6d0de000  ObjectTable: fffff8a002dd3170  HandleCount: 522.
    Image: svchost.exe


PROCESS fffffa8006ccc740
    SessionId: 0  Cid: 0430    Peb: 7fffffdf000  ParentCid: 0264
    DirBase: 7cbea000  ObjectTable: fffff8a002e70e50  HandleCount: 523.
    Image: svchost.exe


PROCESS fffffa8006111060
    SessionId: 0  Cid: 045c    Peb: 7fffffd3000  ParentCid: 0264
    DirBase: 7be70000  ObjectTable: fffff8a002ea2af0  HandleCount: 1323.
    Image: svchost.exe


PROCESS fffffa8006dea280
    SessionId: 0  Cid: 04d8    Peb: 7fffffd5000  ParentCid: 038c
    DirBase: 7a33f000  ObjectTable: fffff8a002ef1d70  HandleCount: 133.
    Image: audiodg.exe


PROCESS fffffa8006e04420
    SessionId: 0  Cid: 0500    Peb: 7fffffda000  ParentCid: 0264
    DirBase: 79b35000  ObjectTable: fffff8a002888770  HandleCount: 370.
    Image: svchost.exe


PROCESS fffffa80052f0b30
    SessionId: 1  Cid: 0638    Peb: 7fffffdf000  ParentCid: 0394
    DirBase: 71c36000  ObjectTable: fffff8a0029dea40  HandleCount: 211.
    Image: nvxdsync.exe


PROCESS fffffa80053d1430
    SessionId: 1  Cid: 0644    Peb: 7fffffd4000  ParentCid: 0394
    DirBase: 71e3b000  ObjectTable: fffff8a002eadb40  HandleCount: 175.
    Image: nvvsvc.exe


PROCESS fffffa8006e8d7a0
    SessionId: 0  Cid: 069c    Peb: 7fffffd8000  ParentCid: 0264
    DirBase: 71176000  ObjectTable: fffff8a002ba3150  HandleCount: 664.
    Image: svchost.exe


PROCESS fffffa8005dcb340
    SessionId: 0  Cid: 0744    Peb: 7fffffd3000  ParentCid: 0264
    DirBase: 606da000  ObjectTable: fffff8a003043f90  HandleCount: 330.
    Image: spoolsv.exe


PROCESS fffffa8005e6e060
    SessionId: 0  Cid: 0760    Peb: 7fffffdf000  ParentCid: 0264
    DirBase: 60416000  ObjectTable: fffff8a002ec4290  HandleCount: 321.
    Image: svchost.exe


PROCESS fffffa8006f8bb30
    SessionId: 0  Cid: 05d4    Peb: 7fffffd4000  ParentCid: 0264
    DirBase: 5bf47000  ObjectTable: fffff8a00300dcf0  HandleCount:  94.
    Image: svchost.exe


PROCESS fffffa8006f94b30
    SessionId: 0  Cid: 060c    Peb: 7efdf000  ParentCid: 0264
    DirBase: 5c3cd000  ObjectTable: fffff8a002de0950  HandleCount: 209.
    Image: AppleMobileDeviceService.exe


PROCESS fffffa8005f09340
    SessionId: 0  Cid: 08b0    Peb: 7efdf000  ParentCid: 0264
    DirBase: 53117000  ObjectTable: fffff8a00338a610  HandleCount:  75.
    Image: BrowserDataServices.exe


PROCESS fffffa8007137580
    SessionId: 0  Cid: 08fc    Peb: 7efdf000  ParentCid: 0264
    DirBase: 51920000  ObjectTable: fffff8a0032ca120  HandleCount:  86.
    Image: InjectWinSockServiceV6.exe


PROCESS fffffa80071e2330
    SessionId: 0  Cid: 0938    Peb: 7fffffd3000  ParentCid: 0264
    DirBase: 4d1c8000  ObjectTable: fffff8a0031c4e80  HandleCount:  91.
    Image: HeciServer.exe


PROCESS fffffa80071f3530
    SessionId: 0  Cid: 0950    Peb: 7efdf000  ParentCid: 0264
    DirBase: 4df4e000  ObjectTable: fffff8a0031866d0  HandleCount: 102.
    Image: Jhi_service.exe


PROCESS fffffa80071eaaa0
    SessionId: 0  Cid: 0970    Peb: fffdf000  ParentCid: 0264
    DirBase: 4de14000  ObjectTable: fffff8a002f020a0  HandleCount: 414.
    Image: sqlservr.exe


PROCESS fffffa8004cc5b30
    SessionId: 0  Cid: 09c8    Peb: fffdf000  ParentCid: 0264
    DirBase: 60561000  ObjectTable: fffff8a003425c50  HandleCount: 32727.
    Image: mysqld.exe


PROCESS fffffa8006fe2b30
    SessionId: 0  Cid: 09e4    Peb: 7fffffd8000  ParentCid: 0264
    DirBase: 5f328000  ObjectTable: fffff8a003155790  HandleCount:  60.
    Image: svchost.exe


PROCESS fffffa8006fd9b30
    SessionId: 0  Cid: 0a04    Peb: 7fffffdc000  ParentCid: 0264
    DirBase: 5ea6d000  ObjectTable: fffff8a003481500  HandleCount:  59.
    Image: svchost.exe


PROCESS fffffa80072099d0
    SessionId: 0  Cid: 0a18    Peb: 7fffffdc000  ParentCid: 0264
    DirBase: 5eaf3000  ObjectTable: fffff8a0034968b0  HandleCount: 105.
    Image: TCPSVCS.EXE


PROCESS fffffa80072efb30
    SessionId: 0  Cid: 0a2c    Peb: 7fffffdf000  ParentCid: 0264
    DirBase: 5ea39000  ObjectTable: fffff8a0034a3320  HandleCount:  84.
    Image: sqlwriter.exe


PROCESS fffffa80073056e0
    SessionId: 0  Cid: 0a50    Peb: 7fffffde000  ParentCid: 0264
    DirBase: 5e87f000  ObjectTable: fffff8a002b41cc0  HandleCount: 102.
    Image: svchost.exe


PROCESS fffffa800732eb30
    SessionId: 0  Cid: 0a74    Peb: 7fffffdf000  ParentCid: 0264
    DirBase: 46704000  ObjectTable: fffff8a0034b8740  HandleCount: 151.
    Image: svchost.exe


PROCESS fffffa8007391210
    SessionId: 0  Cid: 0af4    Peb: 7efdf000  ParentCid: 0264
    DirBase: 5af70000  ObjectTable: fffff8a003509e40  HandleCount: 185.
    Image: wlcommsvc.exe


PROCESS fffffa8007389b30
    SessionId: 0  Cid: 0b08    Peb: 7fffffdf000  ParentCid: 0264
    DirBase: 5b6b6000  ObjectTable: fffff8a002bfd950  HandleCount: 347.
    Image: WLIDSVC.EXE


PROCESS fffffa80073cc060
    SessionId: 1  Cid: 0b58    Peb: 7fffffdb000  ParentCid: 0264
    DirBase: 5bafd000  ObjectTable: fffff8a0020ae7b0  HandleCount: 212.
    Image: taskhost.exe


PROCESS fffffa800787cb30
    SessionId: 0  Cid: 07ac    Peb: fffdf000  ParentCid: 0264
    DirBase: 5866b000  ObjectTable: fffff8a0026d9340  HandleCount: 220.
    Image: BuildService.exe


PROCESS fffffa80078aeb30
    SessionId: 0  Cid: 0888    Peb: 7fffffd5000  ParentCid: 0b08
    DirBase: 540bf000  ObjectTable: fffff8a00340eb00  HandleCount:  60.
    Image: WLIDSVCM.EXE


PROCESS fffffa8007933060
    SessionId: 1  Cid: 0c50    Peb: 7fffffd3000  ParentCid: 0430
    DirBase: 37a11000  ObjectTable: fffff8a00408d630  HandleCount: 131.
    Image: dwm.exe


PROCESS fffffa800794e1c0
    SessionId: 1  Cid: 0c68    Peb: 7fffffdc000  ParentCid: 0c34
    DirBase: 51eb0000  ObjectTable: fffff8a004163bb0  HandleCount: 862.
    Image: explorer.exe


PROCESS fffffa800799b400
    SessionId: 1  Cid: 0ce8    Peb: 7fffffdf000  ParentCid: 0c68
    DirBase: 2fd47000  ObjectTable: fffff8a0042354e0  HandleCount: 253.
    Image: RAVCpl64.exe


PROCESS fffffa8007443060
    SessionId: 0  Cid: 0d94    Peb: 7fffffdf000  ParentCid: 0264
    DirBase: 464bc000  ObjectTable: fffff8a0043dc840  HandleCount: 245.
    Image: NisSrv.exe


PROCESS fffffa8007b0c780
    SessionId: 0  Cid: 0dd0    Peb: 7fffffd9000  ParentCid: 0264
    DirBase: 2b1c6000  ObjectTable: fffff8a004400590  HandleCount: 102.
    Image: svchost.exe


PROCESS fffffa8007c16780
    SessionId: 1  Cid: 0f18    Peb: 7fffffdb000  ParentCid: 0c68
    DirBase: 3ebb5000  ObjectTable: fffff8a0040481e0  HandleCount: 180.
    Image: RAVBg64.exe


PROCESS fffffa8007c4a960
    SessionId: 0  Cid: 0f28    Peb: 7fffffdc000  ParentCid: 0264
    DirBase: 3e0f6000  ObjectTable: fffff8a005a61f90  HandleCount: 922.
    Image: SearchIndexer.exe


PROCESS fffffa8007cb7a30
    SessionId: 1  Cid: 0f90    Peb: 7fffffda000  ParentCid: 0c68
    DirBase: 3d2f9000  ObjectTable: fffff8a006d0c350  HandleCount: 109.
    Image: TSVNCache.exe


PROCESS fffffa8006b9fb30
    SessionId: 1  Cid: 0c78    Peb: 7fffffdf000  ParentCid: 0638
    DirBase: 6b25b000  ObjectTable: fffff8a00342b0a0  HandleCount:  96.
    Image: nvtray.exe


PROCESS fffffa8007cc2060
    SessionId: 1  Cid: 0d80    Peb: 7efdf000  ParentCid: 03d4
    DirBase: 3a1e5000  ObjectTable: fffff8a006c46110  HandleCount: 771.
    Image: QQPCTray.exe


PROCESS fffffa8006bffb30
    SessionId: 1  Cid: 0dcc    Peb: 7fffffda000  ParentCid: 0c68
    DirBase: 7ac34000  ObjectTable: fffff8a002d0fe10  HandleCount: 216.
    Image: SynTPEnh.exe


PROCESS fffffa8007df7060
    SessionId: 1  Cid: 124c    Peb: 7fffffdf000  ParentCid: 0c68
    DirBase: 0074c000  ObjectTable: fffff8a004d02db0  HandleCount: 263.
    Image: msseces.exe


PROCESS fffffa8007e4b5b0
    SessionId: 1  Cid: 12b4    Peb: 7fffffdf000  ParentCid: 0c68
    DirBase: 00f58000  ObjectTable: fffff8a000130ae0  HandleCount: 177.
    Image: hkcmd.exe


PROCESS fffffa8005d2a360
    SessionId: 1  Cid: 12bc    Peb: 7fffffdf000  ParentCid: 0c68
    DirBase: 12415e000  ObjectTable: fffff8a004d02800  HandleCount: 163.
    Image: igfxpers.exe


PROCESS fffffa8006e2ab30
    SessionId: 1  Cid: 1334    Peb: 7efdf000  ParentCid: 0c68
    DirBase: 1e164000  ObjectTable: fffff8a002fdd480  HandleCount: 1282.
    Image: msnmsgr.exe


PROCESS fffffa8007e48350
    SessionId: 1  Cid: 1374    Peb: 7fffffde000  ParentCid: 0dcc
    DirBase: 123998000  ObjectTable: fffff8a00422a340  HandleCount:  20.
    Image: SynTPHelper.exe


PROCESS fffffa8006b76620
    SessionId: 1  Cid: 13cc    Peb: 7efdf000  ParentCid: 0c68
    DirBase: 1cf2e000  ObjectTable: fffff8a0051ab3b0  HandleCount: 473.
    Image: YodaoDict.exe


PROCESS fffffa8006f69490
    SessionId: 1  Cid: 1010    Peb: 7efdf000  ParentCid: 0c68
    DirBase: 19dba000  ObjectTable: fffff8a003960790  HandleCount: 806.
    Image: Fetion.exe


PROCESS fffffa8003b6c710
    SessionId: 1  Cid: 1038    Peb: 7efdf000  ParentCid: 0c68
    DirBase: 193a4000  ObjectTable: fffff8a0043d0150  HandleCount:  47.
    Image: ONENOTEM.EXE


PROCESS fffffa8003bae580
    SessionId: 1  Cid: 11a0    Peb: 7fffffdf000  ParentCid: 1024
    DirBase: 11c586000  ObjectTable: fffff8a004c89990  HandleCount: 218.
    Image: pcee4.exe


PROCESS fffffa8003ba2b30
    SessionId: 1  Cid: 03c4    Peb: 7efdf000  ParentCid: 1124
    DirBase: 174ba000  ObjectTable: fffff8a0051a95b0  HandleCount: 107.
    Image: xgTrayIcon.exe


PROCESS fffffa8003bde060
    SessionId: 1  Cid: 00e0    Peb: 7efdf000  ParentCid: 1024
    DirBase: 1616d000  ObjectTable: fffff8a004975180  HandleCount: 351.
    Image: QDesk.exe


PROCESS fffffa8003cdd770
    SessionId: 1  Cid: 1364    Peb: 7efdf000  ParentCid: 0d80
    DirBase: 1161a0000  ObjectTable: fffff8a00402f580  HandleCount: 263.
    Image: QQPCWebShield.exe


PROCESS fffffa8003d87b30
    SessionId: 1  Cid: 02c8    Peb: 7efdf000  ParentCid: 13cc
    DirBase: 110389000  ObjectTable: fffff8a004283f90  HandleCount: 168.
    Image: WordBook.exe


PROCESS fffffa8003e3d1b0
    SessionId: 0  Cid: 0d64    Peb: 7fffffd8000  ParentCid: 0264
    DirBase: 09f71000  ObjectTable: fffff8a00585d540  HandleCount: 173.
    Image: svchost.exe


PROCESS fffffa8003bc0b30
    SessionId: 1  Cid: 13f4    Peb: 7fffffd3000  ParentCid: 13cc
    DirBase: 119f22000  ObjectTable: fffff8a004aec650  HandleCount:  53.
    Image: YoudaoEH.exe


PROCESS fffffa8004075060
    SessionId: 0  Cid: 1428    Peb: 7efdf000  ParentCid: 0264
    DirBase: b8a5c000  ObjectTable: fffff8a0056558d0  HandleCount: 104.
    Image: LMS.exe


PROCESS fffffa800406a060
    SessionId: 0  Cid: 1480    Peb: 7efdf000  ParentCid: 0264
    DirBase: 10caed000  ObjectTable: fffff8a00594c5a0  HandleCount: 162.
    Image: daemonu.exe


PROCESS fffffa80040a15b0
    SessionId: 1  Cid: 1494    Peb: 7fffffda000  ParentCid: 0264
    DirBase: 10c577000  ObjectTable: fffff8a0056328f0  HandleCount: 139.
    Image: InputPersonalization.exe


PROCESS fffffa8004226b30
    SessionId: 0  Cid: 1678    Peb: 7efdf000  ParentCid: 0264
    DirBase: 82005000  ObjectTable: fffff8a0074d4e80  HandleCount: 257.
    Image: UNS.exe


PROCESS fffffa80044bcab0
    SessionId: 1  Cid: 05f8    Peb: fffdf000  ParentCid: 0c68
    DirBase: 7ab82000  ObjectTable: fffff8a0039155d0  HandleCount: 3858.
    Image: devenv.exe


PROCESS fffffa8004463b30
    SessionId: 1  Cid: 0e50    Peb: 7efdf000  ParentCid: 0c68
    DirBase: 04d2e000  ObjectTable: fffff8a00f6cb890  HandleCount: 3237.
    Image: OUTLOOK.EXE


PROCESS fffffa80044cd060
    SessionId: 0  Cid: 0770    Peb: 7fffffd4000  ParentCid: 0264
    DirBase: 65a67000  ObjectTable: fffff8a006e39240  HandleCount: 145.
    Image: OSPPSVC.EXE


PROCESS fffffa8004b5e060
    SessionId: 1  Cid: 0bec    Peb: 7efdf000  ParentCid: 0d80
    DirBase: b14fc000  ObjectTable: 00000000  HandleCount:   0.
    Image: QQPCMgrUpdate.exe


PROCESS fffffa8004d5b6b0
    SessionId: 1  Cid: 10f4    Peb: fffdf000  ParentCid: 0318
    DirBase: 43ae3000  ObjectTable: fffff8a00f6e3140  HandleCount: 555.
    Image: wlcomm.exe


PROCESS fffffa8005a1cb30
    SessionId: 1  Cid: 1b3c    Peb: 7efdf000  ParentCid: 0d80
    DirBase: 5b78a000  ObjectTable: 00000000  HandleCount:   0.
    Image: QQPCMgrUpdate.exe


PROCESS fffffa80060af060
    SessionId: 1  Cid: 0518    Peb: 7fffffdd000  ParentCid: 0264
    DirBase: 76298000  ObjectTable: fffff8a011c499d0  HandleCount:  96.
    Image: taskhost.exe


PROCESS fffffa8007af0640
    SessionId: 1  Cid: 1030    Peb: 7efdf000  ParentCid: 0c68
    DirBase: 4513e000  ObjectTable: 00000000  HandleCount:   0.
    Image: chrome.exe


PROCESS fffffa80083e4060
    SessionId: 1  Cid: 14b8    Peb: 7efdf000  ParentCid: 00e0
    DirBase: 1145ac000  ObjectTable: fffff8a003038370  HandleCount:  68.
    Image: goagent.exe


PROCESS fffffa80044d9a70
    SessionId: 1  Cid: 114c    Peb: 7fffffdf000  ParentCid: 0230
    DirBase: 21cf1000  ObjectTable: fffff8a0031bb830  HandleCount:  60.
    Image: conhost.exe


PROCESS fffffa800460e920
    SessionId: 1  Cid: 1ae8    Peb: 7efdf000  ParentCid: 14b8
    DirBase: 1523c000  ObjectTable: fffff8a004326f90  HandleCount: 207.
    Image: proxy.exe


PROCESS fffffa800469db30
    SessionId: 1  Cid: 1bc8    Peb: 7efdf000  ParentCid: 0c68
    DirBase: 5353c000  ObjectTable: fffff8a010783d00  HandleCount: 1480.
    Image: QQ.exe


PROCESS fffffa800596e060
    SessionId: 1  Cid: 15c4    Peb: 7efdf000  ParentCid: 0318
    DirBase: 705e6000  ObjectTable: fffff8a005689850  HandleCount:  88.
    Image: TXPlatform.exe


PROCESS fffffa8003e7f850
    SessionId: 1  Cid: 07f0    Peb: fffdf000  ParentCid: 05f8
    DirBase: 3246a000  ObjectTable: 00000000  HandleCount:   0.
    Image: BuildSystem.exe


PROCESS fffffa80065f8660
    SessionId: 1  Cid: 12d4    Peb: 7efdf000  ParentCid: 1bc8
    DirBase: a06ed000  ObjectTable: fffff8a0026c5590  HandleCount: 356.
    Image: QQExternal.exe


PROCESS fffffa8004e687e0
    SessionId: 1  Cid: 1b78    Peb: 7efdf000  ParentCid: 1bc8
    DirBase: b18d1000  ObjectTable: 00000000  HandleCount:   0.
    Image: txupd.exe


PROCESS fffffa8007b9e2e0
    SessionId: 1  Cid: 10b4    Peb: 7efdf000  ParentCid: 1010
    DirBase: 14764000  ObjectTable: fffff8a0055e13c0  HandleCount: 478.
    Image: fxWebBrowser.exe


PROCESS fffffa80045616f0
    SessionId: 1  Cid: 00c8    Peb: 7fffffdc000  ParentCid: 0c68
    DirBase: 46781000  ObjectTable: fffff8a010b64e50  HandleCount: 221.
    Image: windbg.exe


PROCESS fffffa8004d57060
    SessionId: 0  Cid: 17bc    Peb: 7fffffd8000  ParentCid: 0f28
    DirBase: 43bc3000  ObjectTable: fffff8a0078903b0  HandleCount: 283.
    Image: SearchProtocolHost.exe


PROCESS fffffa800818a060
    SessionId: 0  Cid: 1610    Peb: 7fffffd8000  ParentCid: 0f28
    DirBase: 116709000  ObjectTable: fffff8a011caf840  HandleCount: 103.
    Image: SearchFilterHost.exe
    
lkd> .process fffffa800469db30
Implicit process is now fffffa80`0469db30
lkd> dd win32k!gphkHashTable //需要reload
Couldn't resolve error at 'win32k!gphkHashTable'
lkd> .reload 
Connected to Windows 7 7601 x64 target at (Thu Jun 28 10:33:36.409 2012 (UTC + 8:00)), ptr64 TRUE
Loading Kernel Symbols
...............................................................
................................................................
.........................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 00000000`7efdf018).  Type ".hh dbgerr001" for details
Loading unloaded module list
.....


lkd> dd win32k!gphkHashTable
fffff960`00390c20  c2ec5450 fffff900 00000000 00000000
fffff960`00390c30  00000000 00000000 00000000 00000000
fffff960`00390c40  00000000 00000000 00000000 00000000
fffff960`00390c50  00000000 00000000 00000000 00000000
fffff960`00390c60  00000000 00000000 c1ef3360 fffff900
fffff960`00390c70  00000000 00000000 00000000 00000000
fffff960`00390c80  00000000 00000000 c300b360 fffff900
fffff960`00390c90  00000000 00000000 00000000 00000000
lkd> dd fffff900`c2ec5450
fffff900`c2ec5450  c24d1010 fffff900 00000000 00000000
fffff900`c2ec5460  c08fe0f0 fffff90000000002 00000000//可能表示MOD_CONTROL0x0002，快捷键包含CTRL
fffff900`c2ec5470  0000c0a7 fffff900 c06368e0 fffff900
fffff900`c2ec5480  230f0004 34616c47 c2ec5480 fffff900
fffff900`c2ec5490  33041e4d 00000000 00000000 80000000
fffff900`c2ec54a0  03e68b50 fffffa80 000000d8 00000000//这是一个线程号
fffff900`c2ec54b0  00000000 6c777355 c2ec5530 fffff900
fffff900`c2ec54c0  c2ec54c0 fffff900 c2ec54c0 fffff900//其他这些数据要怎么解析呢。。。。
lkd> dt _KTHREAD fffffa80`03e68b50 
nt!_KTHREAD
   +0x000 Header           : _DISPATCHER_HEADER
   +0x018 CycleTime        : 0x2c`b7f805d1
   +0x020 QuantumTarget    : 0x2c`ba2aca3e
   +0x028 InitialStack     : 0xfffff880`0be8bc70 Void
   +0x030 StackLimit       : 0xfffff880`0be82000 Void
   +0x038 KernelStack      : 0xfffff880`0be8b730 Void
   +0x040 ThreadLock       : 0
   +0x048 WaitRegister     : _KWAIT_STATUS_REGISTER
   +0x049 Running          : 0 ''
   +0x04a Alerted          : [2]  ""
   +0x04c KernelStackResident : 0y1
   +0x04c ReadyTransition  : 0y0
   +0x04c ProcessReadyQueue : 0y0
   +0x04c WaitNext         : 0y0
   +0x04c SystemAffinityActive : 0y0
   +0x04c Alertable        : 0y0
   +0x04c GdiFlushActive   : 0y0
   +0x04c UserStackWalkActive : 0y0
   +0x04c ApcInterruptRequest : 0y0
   +0x04c ForceDeferSchedule : 0y0
   +0x04c QuantumEndMigrate : 0y0
   +0x04c UmsDirectedSwitchEnable : 0y0
   +0x04c TimerActive      : 0y0
   +0x04c SystemThread     : 0y0
   +0x04c Reserved         : 0y000000000000000000 (0)
   +0x04c MiscFlags        : 0n1
   +0x050 ApcState         : _KAPC_STATE
   +0x050 ApcStateFill     : [43]  "???"
   +0x07b Priority         : 10 ''
   +0x07c NextProcessor    : 0
   +0x080 DeferredProcessor : 0
   +0x088 ApcQueueLock     : 0
   +0x090 WaitStatus       : 0n0
   +0x098 WaitBlockList    : 0xfffffa80`03e68c58 _KWAIT_BLOCK
   +0x0a0 WaitListEntry    : _LIST_ENTRY [ 0xfffffa80`04156bf0 - 0xfffffa80`06e44100 ]
   +0x0a0 SwapListEntry    : _SINGLE_LIST_ENTRY
   +0x0b0 Queue            : (null) 
   +0x0b8 Teb              : 0x00000000`7efdb000 Void
   +0x0c0 Timer            : _KTIMER
   +0x100 AutoAlignment    : 0y1
   +0x100 DisableBoost     : 0y0
   +0x100 EtwStackTraceApc1Inserted : 0y0
   +0x100 EtwStackTraceApc2Inserted : 0y0
   +0x100 CalloutActive    : 0y0
   +0x100 ApcQueueable     : 0y1
   +0x100 EnableStackSwap  : 0y1
   +0x100 GuiThread        : 0y1
   +0x100 UmsPerformingSyscall : 0y0
   +0x100 VdmSafe          : 0y0
   +0x100 UmsDispatched    : 0y0
   +0x100 ReservedFlags    : 0y000000000000000000000 (0)
   +0x100 ThreadFlags      : 0n225
   +0x104 Spare0           : 0
   +0x108 WaitBlock        : [4] _KWAIT_BLOCK
   +0x108 WaitBlockFill4   : [44]  "???"
   +0x134 ContextSwitches  : 0x18b9e5
   +0x108 WaitBlockFill5   : [92]  "???"
   +0x164 State            : 0x5 ''
   +0x165 NpxState         : 5 ''
   +0x166 WaitIrql         : 0 ''
   +0x167 WaitMode         : 1 ''
   +0x108 WaitBlockFill6   : [140]  "???"
   +0x194 WaitTime         : 0x5797d
   +0x108 WaitBlockFill7   : [168]  "???"
   +0x1b0 TebMappedLowVa   : (null) 
   +0x1b8 Ucb              : (null) 
   +0x108 WaitBlockFill8   : [188]  "???"
   +0x1c4 KernelApcDisable : 0n0
   +0x1c6 SpecialApcDisable : 0n0
   +0x1c4 CombinedApcDisable : 0
   +0x1c8 QueueListEntry   : _LIST_ENTRY [ 0x00000000`00000000 - 0x0 ]
   +0x1d8 TrapFrame        : 0xfffff880`0be8bae0 _KTRAP_FRAME
   +0x1e0 FirstArgument    : (null) 
   +0x1e8 CallbackStack    : (null) 
   +0x1e8 CallbackDepth    : 0
   +0x1f0 ApcStateIndex    : 0 ''
   +0x1f1 BasePriority     : 8 ''
   +0x1f2 PriorityDecrement : 2 ''
   +0x1f2 ForegroundBoost  : 0y0010
   +0x1f2 UnusualBoost     : 0y0000
   +0x1f3 Preempted        : 0 ''
   +0x1f4 AdjustReason     : 0 ''
   +0x1f5 AdjustIncrement  : 2 ''
   +0x1f6 PreviousMode     : 1 ''
   +0x1f7 Saturation       : 0 ''
   +0x1f8 SystemCallNumber : 0x100c
   +0x1fc FreezeCount      : 0
   +0x200 UserAffinity     : _GROUP_AFFINITY
   +0x210 Process          : 0xfffffa80`0469db30 _KPROCESS //这应该是快捷键所在进程。可以从!process 0 0的结果中得到，这个进程是QQ.exe
   +0x218 Affinity         : _GROUP_AFFINITY 
   +0x228 IdealProcessor   : 0
   +0x22c UserIdealProcessor : 0
   +0x230 ApcStatePointer  : [2] 0xfffffa80`03e68ba0 _KAPC_STATE
   +0x240 SavedApcState    : _KAPC_STATE
   +0x240 SavedApcStateFill : [43]  "???"
   +0x26b WaitReason       : 0xd ''
   +0x26c SuspendCount     : 0 ''
   +0x26d Spare1           : 0 ''
   +0x26e CodePatchInProgress : 0 ''
   +0x270 Win32Thread      : 0xfffff900`c24d1010 Void
   +0x278 StackBase        : 0xfffff880`0be8c000 Void
   +0x280 SuspendApc       : _KAPC
   +0x280 SuspendApcFill0  : [1]  "??????"
   +0x281 ResourceIndex    : 0x1 ''
   +0x280 SuspendApcFill1  : [3]  "???"
   +0x283 QuantumReset     : 0x12 ''
   +0x280 SuspendApcFill2  : [4]  "???"
   +0x284 KernelTime       : 0x4e5
   +0x280 SuspendApcFill3  : [64]  "???"
   +0x2c0 WaitPrcb         : 0xfffff800`05042e80 _KPRCB
   +0x280 SuspendApcFill4  : [72]  "???"
   +0x2c8 LegoData         : (null) 
   +0x280 SuspendApcFill5  : [83]  "???"
   +0x2d3 LargeStack       : 0x1 ''
   +0x2d4 UserTime         : 0x52d
   +0x2d8 SuspendSemaphore : _KSEMAPHORE
   +0x2d8 SuspendSemaphorefill : [28]  "???"
   +0x2f4 SListFaultCount  : 0
   +0x2f8 ThreadListEntry  : _LIST_ENTRY [ 0xfffffa80`079ab358 - 0xfffffa80`0469db60 ]
   +0x308 MutantListHead   : _LIST_ENTRY [ 0xfffffa80`05de7978 - 0xfffffa80`04486268 ]
   +0x318 SListFaultAddress : (null) 
   +0x320 ReadOperationCount : 0n27284
   +0x328 WriteOperationCount : 0n1031
   +0x330 OtherOperationCount : 0n152123
   +0x338 ReadTransferCount : 0n18422004
   +0x340 WriteTransferCount : 0n6614868
   +0x348 OtherTransferCount : 0n44429885
   +0x350 ThreadCounters   : (null) 
   +0x358 StateSaveArea    : 0xfffff880`0be8bcc0 _XSAVE_FORMAT
   +0x360 XStateSave       : (null)