首页 > WinDriver > WD-内核建立初始进程流程(WRK)
2015四月9

WD-内核建立初始进程流程(WRK)

1.内核的入口函数是_KiSystemStartup

kd> kn
 # ChildEBP RetAddr  
00 0005ff98 809f0927 nt!KdInitSystem+0x365
01 0005ffc8 00414cda nt!KiSystemStartup+0x27b [g:\wrk-v1.2_vs\wrk-v1.2\base\ntos\ke\i386\newsysbg.asm @ 500]

  

2.之后调用KiInitializeKernel,newsysbg.asm的541处开始调用:

stdCall    _KiInitializeKernel,<offset _KiInitialProcess,ebx,edx,dword ptr PCR[PcPrcb],eax,_KeLoaderBlock>

 

3.调用KeInitializeProcess初始化IDLE进程

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
        // Initialize idle thread process object and then set:
        //
        //      1. all the quantum values to the maximum possible.
        //      2. the process in the balance set.
        //      3. the active processor mask to the specified process.
        //
 
        DirectoryTableBase[0] = 0;
        DirectoryTableBase[1] = 0;
        InitializeListHead(&KiProcessListHead);
        KeInitializeProcess(Process,
                            (KPRIORITY)0,
                            (KAFFINITY)(0xffffffff),
                            &DirectoryTableBase[0],
                            FALSE);
kd> dt Process   //IDLE的进程对象
Local var @ 0x808942f4 Type _KPROCESS*
0x80898d80 

4.调用初始化空闲线程

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
    //
    // Initialize idle thread object and then set:
    //
    //      1. the next processor number to the specified processor.
    //      2. the thread priority to the highest possible value.
    //      3. the state of the thread to running.
    //      4. the thread affinity to the specified processor.
    //      5. the specified member in the process active processors set.
    //
 
    KeInitializeThread(Thread,
                       (PVOID)((ULONG64)IdleStack),
                       NULL,
                       NULL,
                       NULL,
                       NULL,
                       NULL,
                       Process);

  

5.ExpInitializeExecutive内部调用PsInitSystem,PsInitSystem再调用PspInitPhase0创建System进程

  ExpInitializeExecutive(Number, LoaderBlock);
  --》  if (PsInitSystem(0, LoaderBlock) == FALSE) // 注意,它传的是0,所以调用PspInitPhase0
  --》  case 0 : return PspInitPhase0(LoaderBlock);

  

6.PspInitPhase0还会启用Phase1Initialization线程(最终变为系统的零页面线程),此后就进入了Phase1Initialization线程阶段,简称Phase1阶段

 if (!NT_SUCCESS (PsCreateSystemThread (&ThreadHandle,
                                           THREAD_ALL_ACCESS,
                                           &ObjectAttributes,
                                           0L,
                                           NULL,
                                           Phase1Initialization,
                                           (PVOID)LoaderBlock))) {

  

7.Phase1阶段,首先运行的是Phase1InitializationDiscard函数

VOID Phase1Initialization (IN PVOID Context )
{
    Phase1InitializationDiscard (Context);
    MmZeroPageThread();
    return;
}

   

8.Phase1InitializationDiscard同样会调到PsInitSystem,PsInitSystem再调用PspInitPhase1

Phase1InitializationDiscard
--》 if (PsInitSystem(1, LoaderBlock) == FALSE) // 注意,它传的是1,所以调用PspInitPhase1
--》  case 1 :return PspInitPhase1(LoaderBlock);

 

9.在PspInitPhase1中,调用PspInitializeSystemDll 函数以初始化系统DLL(即ntdll.dll)

PspInitPhase1
--》  st = PspInitializeSystemDll ();
--》  st = PspLookupSystemDllEntryPoint (dll_entrypoint,(PVOID) &PspSystemDll.LoaderInitRoutine);
--》  return LookupEntryPoint (PspSystemDll.DllBase, NameOfEntryPoint,AddressOfEntryPoint);                          

  

10.在进入PspInitPhase1时,IDLE其实已初始化完成了,可参看下面windbg,和3处的Process比较

kd> x nt!*PsIdle*
808a5e20          nt!PsIdleProcess = 0x80898d80  // 和3处生成的Process指向一样

  

文章作者:hgy413
本文地址:https://hgy413.com/2946.html
版权所有 © 转载时必须以链接形式注明作者和原始出处!

47 Responses to “WD-内核建立初始进程流程(WRK)”

  1. #1 minecraft 回复 | 引用 Post:2018-10-04 19:32

    Hi there to all, it’s really a good for me to pay a visit this website, it includes helpful Information.

  2. We are a group of volunteers and opening a new scheme in our community.
    Your web site offered us with valuable information to work on. You have done an impressive
    job and our whole community will be thankful to you.

  3. #3 Coconut Oil Benefits 回复 | 引用 Post:2018-10-19 03:43

    This design is incredible! You most certainly know how to keep a reader entertained.
    Between your wit and your videos, I was almost moved to start my own blog
    (well, almost…HaHa!) Wonderful job. I really loved what you had to say, and
    more than that, how you presented it. Too cool!

  4. #4 Benefits of Coconut Oil 回复 | 引用 Post:2018-10-24 05:43

    This is really interesting, You are a very skilled blogger.
    I have joined your feed and look forward to seeking more of
    your excellent post. Also, I’ve shared your website in my social networks!

  5. #5 Coconut Oil Benefits 回复 | 引用 Post:2018-10-24 20:26

    Do you have a spam issue on this blog; I also am a blogger, and I was curious about your situation; we have created some nice methods and we are looking to exchange solutions with other folks, be sure to shoot me an e-mail if interested.

  6. #6 Coconut Oil 回复 | 引用 Post:2018-10-29 07:05

    I pay a quick visit each day some blogs and blogs to read content,
    except this website offers quality based posts.

  7. #7 quest bars cheap 回复 | 引用 Post:2018-11-03 22:21

    Howdy! Do you know if they make any plugins to assist with Search Engine Optimization?
    I’m trying to get my blog to rank for some targeted keywords but I’m not seeing very good
    gains. If you know of any please share. Thanks!

  8. If some one desires to be updated with most up-to-date technologies then he must be go to see this web page and be up to
    date everyday.

  9. #9 Sling TV 回复 | 引用 Post:2018-11-10 17:06

    Can I simply just say what a comfort to discover somebody who
    genuinely understands what they’re talking about
    on the web. You actually know how to bring an issue to light
    and make it important. A lot more people should read this
    and understand this side of your story. It’s surprising you’re not more
    popular because you surely possess the gift.

  10. Hi I am so delighted I found your website, I really found you by accident, while I
    was searching on Bing for something else, Anyways I am here now and would just
    like to say thanks a lot for a marvelous post and a
    all round enjoyable blog (I also love the theme/design), I don’t
    have time to go through it all at the minute but I have book-marked it and
    also included your RSS feeds, so when I have time I will be back to read more, Please do keep up the fantastic b.

  11. #11 Sling TV 回复 | 引用 Post:2018-11-15 08:12

    I’m impressed, I have to admit. Seldom do I come across a blog
    that’s both equally educative and amusing, and let me tell you, you have hit the nail on the head.
    The problem is something which not enough folks are speaking intelligently about.
    I’m very happy that I came across this in my search for
    something concerning this.

  12. I blog often and I genuinely thank you for your content.
    Your article has really peaked my interest. I am going to take a note of your site and
    keep checking for new information about once per week.
    I opted in for your RSS feed as well.

  13. Hey! Do you know if they make any plugins to assist with SEO?

    I’m trying to get my blog to rank for some targeted keywords but I’m not seeing very good
    results. If you know of any please share. Appreciate it!

  14. #14 descargar facebook 回复 | 引用 Post:2018-12-06 14:04

    Woah! I’m really enjoying the template/theme of this site.
    It’s simple, yet effective. A lot of times it’s tough to get that “perfect balance” between user friendliness and appearance.
    I must say that you’ve done a great job with this. Also, the blog loads extremely fast for me
    on Internet explorer. Excellent Blog!

  15. #15 0loft 回复 | 引用 Post:2020-05-09 20:32

    cheers a great deal this site will be official plus relaxed

  16. #16 www.question2answer.org 回复 | 引用 Post:2020-05-11 05:21

    Deference to author, some superb entropy.

  17. #17 webben.net 回复 | 引用 Post:2020-05-11 13:38

    Incredible quest there. What occurred after? Take care!

  18. #18 Kathrin 回复 | 引用 Post:2020-05-11 16:09

    Hello, just wanted to mention, I enjoyed this blog post.
    It was practical. Keep on posting!

  19. #19 i5wed 回复 | 引用 Post:2020-05-12 08:17

    i5wed thanks considerably this amazing site is actually elegant in addition to laid-back

  20. #20 וילות באילת 回复 | 引用 Post:2020-05-12 21:22

    Index Search Villas and lofts for rental, search by region, find
    during first minutes a villa rented by city, a variety of
    rooms lofts and villas. Be stunned at the wonderful pictures and
    data that they have to provide you. The website is
    a center for all of you the ads from the field, bachelorette party?
    Enjoy someone who leaves Israel? Whatever the explanation you will need
    to rent a villa for a potential event or just
    friends recreation appropriate for any age. The website is also
    the middle of rooms with the hour, which is already
    another subject, for lovers who are seeking a lavish room equipped for
    discreet entertainment by using a spouse or lover. Regardless of the you want, the 0LOFT website makes a search for you to identify rentals for loft villas and rooms throughout Israel,
    North South and Gush Dan.

  21. Welcome to Israel. In this escort directory section, you will find Israel escorts.

    Euro Girls Escort is the most trusted escort directory and one of many biggest 21girlz directory.
    All content and photos are regularly checked and updated with real
    photos. This ensures, that most escort Ads are usually updated and provides you the most effective experience.

    This section of the catalogue features luxury companions providing escort services.
    Israel escorts works in elite escort agencies, as an independent escorts or in local strip
    clubs, dancing clubs, brothels, lap-dance bars and cabarets.
    A lot of the high class ladies do travel worldwide. You may also want to use call girl services –
    these escort girls can either work incall or outcall.
    Such elite escorts might be invited to a hotel room or
    you can visit them inside their place.

  22. #22 צימרים 回复 | 引用 Post:2020-05-15 04:33

    thanks considerably this amazing site is usually conventional in addition to informal

  23. Excellent post. I used to be checking continuously
    this weblog and I am inspired! Extremely useful info specially the closing
    section :) I take care of such information much.
    I was seeking this certain info for a very long time.

    Thank you and good luck.

  24. #24 וילות באילת 回复 | 引用 Post:2020-05-17 03:07

    Index Search Villas and lofts for rent, search by region, find during first minutes a villa rented by city,
    a number of rooms lofts and villas. Be afraid of
    the photographs and knowledge that the site has to offer
    you. The site is a center for you all the ads from the field, bachelorette party?

    Spend playtime with a buddy who leaves Israel? Whatever the rationale it’s important
    to rent a villa for an upcoming event or just a gaggle recreation ideal for any age.
    The site is also the center of rooms because of the hour,
    which is definitely another subject, for lovers who are looking for
    a deluxe room equipped for discreet entertainment which
    has a spouse or lover. Whatever you are interested in, the
    0LOFT website creates a find you to identify rentals for loft villas
    and rooms throughout Israel, North South and Gush Dan.

  25. Hello, just wanted to tell you, I liked this post.
    It was helpful. Keep on posting!

  26. #26 www.instapaper.com 回复 | 引用 Post:2020-05-18 13:10

    Admiring the time and energy you put into your site
    and detailed information you present. It’s good to come across a blog every once
    in a while that isn’t the same out of date rehashed material.
    Great read! I’ve saved your site and I’m including your RSS feeds to
    my Google account.

  27. thanks a lot considerably this excellent website will be professional as
    well as simple

  28. #28 וילות באילת 回复 | 引用 Post:2020-05-28 09:24

    Index Search Villas and lofts for rental, search by region, find during first minutes a villa rented by city, a range
    of rooms lofts and villas. Be in awe of the pictures and data
    that they have to provide you. The website is a center for everybody the
    ads in the field, bachelorette party? Play with a friend who leaves Israel?
    Regardless of the the reason why you need to rent a villa for
    a future event or maybe a bunch recreation appropriate
    for any age. The site is also center of rooms by way of the hour,
    which is already another subject, for lovers who are seeking an expensive room equipped for discreet entertainment
    by using a spouse or lover. No matter what you are looking at, the
    0LOFT website constitutes a search for you to find rentals for
    loft villas and rooms throughout Israel, North South and Gush Dan.

  29. #29 i5wed 回复 | 引用 Post:2020-05-30 04:51

    i5wed thanks a lot a good deal this web site is actually professional and also casual

  30. Cincinnati Bengals Live Stream

  31. #31 נערות ליווי 回复 | 引用 Post:2020-05-31 23:07

    appreciate it a lot this excellent website is actually elegant plus simple

  32. Kansas City Chiefs Live Stream

  33. Houston Texans Live Stream

  34. Philadelphia Eagles live stream

  35. Dallas Cowboys Live Stream

  36. Buffalo bills live stream

  37. New York Giants live stream

  38. Index Search Villas and lofts to rent, search by
    region, find during first minutes a villa to book by city, various

  39. Thanks for finally writing about > blog topic < Liked it!

  40. I am really glad to glance at this web site posts which consists of plenty of useful information, thanks for providing such
    statistics.

  41. Saved as a favorite, I like your website!

  42. #42 hack mafia city 回复 | 引用 Post:2020-06-08 21:59

    Excellent beat ! I would like to apprentice while you amend your website, how can i subscribe
    for a blog web site? The account aided me a acceptable
    deal. I had been tiny bit acquainted of this your broadcast provided bright clear concept

  43. #43 g two 回复 | 引用 Post:2020-06-10 15:51

    Hi there! Quick question that’s completely off topic.
    Do you know how to make your site mobile friendly?
    My website looks weird when viewing from my iphone4.
    I’m trying to find a theme or plugin that might be able to correct this problem.
    If you have any recommendations, please share.
    Thank you!

  44. #44 how g 回复 | 引用 Post:2020-06-10 20:32

    Attractive section of content. I just stumbled upon your weblog and in accession capital to assert that I acquire in fact enjoyed
    account your blog posts. Any way I will be subscribing to
    your feeds and even I achievement you access consistently quickly.

  45. #45 free steam wallet codes 回复 | 引用 Post:2020-06-12 05:26

    This information is worth everyone’s attention. When can I find out more?

  46. #46 g 回复 | 引用 Post:2020-06-12 22:26

    Heya i am for the first time here. I came across this board
    and I in finding It really helpful & it helped me out much.
    I’m hoping to provide one thing back and aid others such as you helped me.

  47. #47 g 回复 | 引用 Post:2020-06-15 15:04

    When I originally commented I clicked the “Notify me when new comments are added”
    checkbox and now each time a comment is added I get several emails with the same
    comment. Is there any way you can remove people from that service?
    Cheers!

发表评论