[收藏本方案]

《Undocumented Windows 2000 Secrets》翻译 --- 第五章（1）[9]

[入库：2005年8月19日] [更新：2007年3月24日]

本文简介：选择自 kendiv 的 blog
首页 上页 下页 尾页 [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] [17] [18] [19] [20] [21] [22] [23] [24] [25] [26] [27] [28] [29] [30] [31] [32] [33] [34] [35] [36] [37] [38] [39] [40] [41] [42] [43] [44] [45] [46] [47] [48] [49] [50] [51] [52] [53] [54] [55] [56] [57] [58] [59] [60] [61] [62] [63] [64] [65] [66] [67] [68] [69] [70] [71] [72] [73] [74] [75] [76] [77] [78] [79] [80] [81] [82] [83] [84] [85] [86] [87] [88] [89] [90] [91] [92] [93] [94]

n style="font-family: 宋体; mso-ascii-font-family: 'times new roman'; mso-hansi-font-family: 'times new roman'">处理的native api调用，因此kisystemservice()使用第一个sdt。如果第12位为1并且第13位为0，kisystemservice()使用第二个sdt，这个sdt并没有被当前系统使用。这意味着native api调用的索引值的潜在范围是：0x0000 --- 0x0ffff，win32k.sys调用使用的索引范围是：0x1000 --- 0x1fff。因此，0x2000 --- 0x2fff和0x3000 --- 0x3fff保留给剩下的两个sdt。在windows 2000中，native api服务表包含248个项，win32k.sys表包含639个项。

 

图5-2.  keservicedescriptortableshadow的结构图

 

首页 上页 下页 尾页 [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] [17] [18] [19] [20] [21] [22] [23] [24] [25] [26] [27] [28] [29] [30] [31] [32] [33] [34] [35] [36] [37] [38] [39] [40] [41] [42] [43] [44] [45] [46] [47] [48] [49] [50] [51] [52] [53] [54] [55] [56] [57] [58] [59] [60] [61] [62] [63] [64] [65] [66] [67] [68] [69] [70] [71] [72] [73] [74] [75] [76] [77] [78] [79] [80] [81] [82] [83] [84] [85] [86] [87] [88] [89] [90] [91] [92] [93] [94]
本文关键：《Undocumented Windows 2000 Secrets》翻译 --- 第五章（1）
　　相关方案
Google
 

本站最佳浏览方式为 分辨率 1024x768 IE 6.0（或更高版本的 IE浏览器）

go top