winlogon源代码分析之原子表的创建xxxCreateWindowStation函数中会调用CreateGlobalAtomTable函数创建工作站原子表
第一部分：
ds\security\gina\winlogon\winlogon.c
int WINAPI WinMain (HINSTANCE hInstance, HINSTANCE hPrevInstance,
LPSTR lpCmdLine, int nCmdShow)
{
......
//
// Create the primary terminal.
//
1 2 | if (!CreatePrimaryTerminal())
{
|
第2部分：
BOOL CreatePrimaryTerminal (void)
{
......
//
// Create the window station
//
pWS->hwinsta = CreateWindowStationW (WINDOW_STATION_NAME, 0, MAXIMUM_ALLOWED, NULL);
if (!pWS->hwinsta) {
DebugLog((DEB_ERROR, "Could not create the interactive windowstation\n"));
goto failCreateTerminal;
}
第3部分：
HWINSTA xxxCreateWindowStation(
POBJECT_ATTRIBUTES ObjectAttributes,
KPROCESSOR_MODE OwnershipMode,
DWORD dwDesiredAccess,
HANDLE hKbdLayoutFile,
DWORD offTable,
PKBDTABLE_MULTI_INTERNAL pKbdTableMulti,
PCWSTR pwszKLID,
UINT uKbdInputLocale)
{
1 2 3 4 5 6 7 8 9 10 11 12 | }
/*
* Create the global atom table and populate it with the default OLE atoms
* Pin each atom so they can't be deleted by bogus applications like Winword
*/
Status = CreateGlobalAtomTable(&pwinsta->pGlobalAtomTable);
if (!NT_SUCCESS(Status)) {
UserAssert(pwinsta->pGlobalAtomTable == NULL);
RIPNTERR0(Status, RIP_WARNING, "CreateGlobalAtomTable failed");
goto create_error;
}
|
第4部分：
static CONST LPCWSTR lpszStdFormats[] = {
L"StdExit", 第一个
L"StdNewDocument",
L"StdOpenDocument",
L"StdEditDocument",
L"StdNewfromTemplate", 第五个
L"StdCloseDocument",
L"StdShowItem",
L"StdDoVerbItem",
L"System",
L"OLEsystem",
L"StdDocumentName",
L"Protocols",
L"Topics",
L"Formats",
L"Status",
L"EditEnvItems",
L"True",
L"False",
L"Change",
L"Save",
L"Close",
L"MSDraw"
};
第5部分：
第一个：
1: kd> dt nt!_RTL_ATOM_TABLE_ENTRY e14914b0
+0x000 HashLink : 0xe15d7440 _RTL_ATOM_TABLE_ENTRY
+0x004 HandleIndex : 1
+0x006 Atom : 0xc001
+0x008 ReferenceCount : 1
+0x00a Flags : 0x1 ''
+0x00b NameLength : 0x7 ''
+0x00c Name : [1] 0x53
1: kd> dx -id 0,0,896d1020 -r1 (((ntkrnlmp!unsigned short ()[1])0xe14914bc))
(((ntkrnlmp!unsigned short ()[1])0xe14914bc)) [Type: unsigned short [1]]
[0] : 0x53 [Type: unsigned short]
1: kd> db 0xe14914bc
e14914bc 53 00 74 00 64 00 45 00-78 00 69 00 74 00 00 00 S.t.d.E.x.i.t...
第5个：
1: kd> dt nt!_RTL_ATOM_TABLE_ENTRY e15abcc8
+0x000 HashLink : (null)
+0x004 HandleIndex : 5
+0x006 Atom : 0xc005
+0x008 ReferenceCount : 1
+0x00a Flags : 0x1 ''
+0x00b NameLength : 0x12 ''
+0x00c Name : [1] 0x53
1: kd> dx -id 0,0,896d1020 -r1 (((ntkrnlmp!unsigned short ()[1])0xe15abcd4))
(((ntkrnlmp!unsigned short ()[1])0xe15abcd4)) [Type: unsigned short [1]]
[0] : 0x53 [Type: unsigned short]
1: kd> db 0xe15abcd4
e15abcd4 53 00 74 00 64 00 4e 00-65 00 77 00 66 00 72 00 S.t.d.N.e.w.f.r.
e15abce4 6f 00 6d 00 54 00 65 00-6d 00 70 00 6c 00 61 00 o.m.T.e.m.p.l.a.
e15abcf4 74 00 65 00 00 00 00 00-78 00 00 00 09 04 09 0c t.e.....x.......
————————————————
1 2 | 版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
|
原文链接：156K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6T1L8r3!0Y4i4K6u0W2j5%4y4V1L8W2)9J5k6h3&6W2N6q4)9J5c8X3!0D9k6r3I4A6L8Y4g2^5i4K6u0r3j5i4u0@1K9h3y4D9k6g2)9J5c8X3c8W2N6r3q4A6L8s2y4Q4x3V1j5I4y4o6j5H3z5e0R3K6y4o6p5`.
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
