[讨论]WINDBG的DX是什么命令
发表于:
2017-6-27 15:33
4339
kd> dt ntdll!_OBJECT_TYPE_INITIALIZER 0xfffff80004059bf0)
+0x000 Length : 0x9650
+0x002 ObjectTypeFlags : 0xfc ''
+0x002 CaseInsensitive : 0y0
+0x002 UnnamedObjectsOnly : 0y0
+0x002 UseDefaultObject : 0y1
+0x002 SecurityRequired : 0y1
+0x002 MaintainHandleCount : 0y1
+0x002 MaintainTypeList : 0y1
+0x002 SupportsObjectCallbacks : 0y1
+0x002 CacheAligned : 0y1
+0x004 ObjectTypeCode : 0xfffff800
+0x008 InvalidAttributes : 7
+0x00c GenericMapping : _GENERIC_MAPPING
+0x01c ValidAccessMask : 0xfffff800
+0x020 RetainAccess : 0x31f52cd0
+0x024 PoolType : 0xfffffa80 (No matching name)
+0x028 DefaultPagedPoolCharge : 0
+0x02c DefaultNonPagedPoolCharge : 0
+0x030 DumpProcedure : (null)
+0x038 OpenProcedure : 0x00000003`00000101 long +300000101
+0x040 CloseProcedure : 0x00000001`00000001 void +100000001
+0x048 DeleteProcedure : 0xfffff880`04cac3e0 void crashdmp!Context+0
+0x050 ParseProcedure : 0x00000001`00000001 long +100000001
+0x058 SecurityProcedure : 0xfffff880`04caf0e4 long crashdmp!CrashdmpInitialize+0
+0x060 QueryNameProcedure : 0xfffff880`04caf3a4 long crashdmp!CrashdmpLoadDumpStack+0
+0x068 OkayToCloseProcedure : 0xfffff880`04ca7008 unsigned char crashdmp!CrashdmpInitDumpStack+0 kd> dx ((ntdll!_OBJECT_TYPE_INITIALIZER *)0xfffff80004059bf0)
((ntdll!_OBJECT_TYPE_INITIALIZER *)0xfffff80004059bf0) : 0xfffff80004059bf0 [Type: _OBJECT_TYPE_INITIALIZER *]
[+0x000] Length : 0x9650 [Type: unsigned short]
[+0x002] ObjectTypeFlags : 0xfc [Type: unsigned char]
[+0x002 ( 0: 0)] CaseInsensitive : 0x0 [Type: unsigned char]
[+0x002 ( 1: 1)] UnnamedObjectsOnly : 0x0 [Type: unsigned char]
[+0x002 ( 2: 2)] UseDefaultObject : 0x1 [Type: unsigned char]
[+0x002 ( 3: 3)] SecurityRequired : 0x1 [Type: unsigned char]
[+0x002 ( 4: 4)] MaintainHandleCount : 0x1 [Type: unsigned char]
[+0x002 ( 5: 5)] MaintainTypeList : 0x1 [Type: unsigned char]
[+0x002 ( 6: 6)] SupportsObjectCallbacks : 0x1 [Type: unsigned char]
[+0x002 ( 7: 7)] CacheAligned : 0x1 [Type: unsigned char]
[+0x004] ObjectTypeCode : 0xfffff800 [Type: unsigned long]
[+0x008] InvalidAttributes : 0x7 [Type: unsigned long]
[+0x00c] GenericMapping [Type: _GENERIC_MAPPING]
[+0x01c] ValidAccessMask : 0xfffff800 [Type: unsigned long]
[+0x020] RetainAccess : 0x31f52cd0 [Type: unsigned long]
[+0x024] PoolType : -1408 [Type: _POOL_TYPE]
[+0x028] DefaultPagedPoolCharge : 0x0 [Type: unsigned long]
[+0x02c] DefaultNonPagedPoolCharge : 0x0 [Type: unsigned long]
[+0x030] DumpProcedure : 0x0 [Type: void (__cdecl*)(void *,_OBJECT_DUMP_CONTROL *)]
[+0x038] OpenProcedure : 0x300000101 [Type: long (__cdecl*)(_OB_OPEN_REASON,char,_EPROCESS *,void *,unsigned long *,unsigned long)]
[+0x040] CloseProcedure : 0x100000001 [Type: void (__cdecl*)(_EPROCESS *,void *,unsigned __int64,unsigned __int64)]
[+0x048] DeleteProcedure : 0xfffff88004cac3e0 [Type: void (__cdecl*)(void *)]
[+0x050] ParseProcedure : 0x100000001 [Type: long (__cdecl*)(void *,void *,_ACCESS_STATE *,char,unsigned long,_UNICODE_STRING *,_UNICODE_STRING *,void *,_SECURITY_QUALITY_OF_SERVICE *,void * *)]
[+0x058] SecurityProcedure : 0xfffff88004caf0e4 [Type: long (__cdecl*)(void *,_SECURITY_OPERATION_CODE,unsigned long *,void *,unsigned long *,void * *,_POOL_TYPE,_GENERIC_MAPPING *,char)]
[+0x060] QueryNameProcedure : 0xfffff88004caf3a4 [Type: long (__cdecl*)(void *,unsigned char,_OBJECT_NAME_INFORMATION *,unsigned long,unsigned long *,char)]
[+0x068] OkayToCloseProcedure : 0xfffff88004ca7008 [Type: unsigned char (__cdecl*)(_EPROCESS *,void *,void *,char)]
解释出来结果还不一样？DX命令更准确，百度不到这命令，求科普……
[培训]科锐逆向工程师培训第53期2025年7月8日开班！
