<ins id="pjuwb"></ins>

<blockquote id="pjuwb"><pre id="pjuwb"></pre></blockquote>

<noscript id="pjuwb"></noscript>

<sup id="pjuwb"><pre id="pjuwb"></pre></sup>

<dd id="pjuwb"></dd>

<abbr id="pjuwb"></abbr>

<code id="coocs"><delect id="coocs"></delect></code><dl id="coocs"></dl>

<rt id="coocs"><tr id="coocs"></tr></rt>

<code id="coocs"></code>

<pre id="coocs"></pre>

<nav id="coocs"><dl id="coocs"></dl></nav>

我生如山

[轉載]解剖XP最核心的dll——NTDLL.dll

原文地址：2.利用GetProcAddress 獲取其函數入口地址
3.利用得到的函數指針調用

但是可以大致的分為幾類吧
1 PropertyLengthAsVariant  它被排在了第一號，但是我就是不明白它是做什么的
2  Csr（configuration status register？ Command and Status Register？）系列
CsrAllocateCaptureBuffer CsrAllocateMessagePointer CsrCaptureMessageBuffer CsrCaptureMessageMultiUnicodeStringsInPlace
CsrCaptureMessageString CsrCaptureTimeout CsrClientCallServer CsrClientConnectToServer CsrFreeCaptureBuffer
CsrGetProcessId CsrIdentifyAlertableThread CsrNewThread CsrProbeForRead CsrProbeForWrite CsrSetPriorityClass

3 Dbg系列調試函數
DbgBreakPoint DbgPrint DbgPrintEx DbgPrintReturnControlC DbgPrompt DbgQueryDebugFilterState DbgSetDebugFilterState
DbgUiConnectToDbg DbgUiContinue DbgUiConvertStateChangeStructure DbgUiDebugActiveProcess DbgUiGetThreadDebugObject
DbgUiIssueRemoteBreakin DbgUiRemoteBreakin DbgUiSetThreadDebugObject DbgUiStopDebugging DbgUiWaitStateChange DbgUserBreakPoint

4 ki系列
KiRaiseUserExceptionDispatcher
KiUserApcDispatcher
KiUserCallbackDispatcher
KiUserExceptionDispatcher

5 Ldr系列  Loader APIs，共34個

API
NTDLL APIs
LoadResource
LdrAccessResource
LdrAlternateResourcesEnabled
DisableThreadLibraryCalls
LdrDisableThreadCalloutsForDll
LdrEnumResources
LdrFindAppCompatVariableInfo
LdrFindEntryForAddress
EnumResourceTypesW
LdrFindResourceDirectory_U
FindResourceExA
LdrFindResource_U
LdrFlushAlternateResourceModules
LdrGetAlternateResourceModuleHandle
GetModuleHandleForUnicodeString
LdrGetDllHandle
GetProcAddress
LdrGetProcedureAddress
LdrInitializeThunk
LoadLibraryEx (LOAD_LIBRARY_AS_DATAFILE)
LdrLoadAlternateResourceModule
LoadLibrary
LdrLoadDll
LdrProcessRelocationBlock
LdrQueryApplicationCompatibilityGoo
LdrQueryImageFileExecutionOptions
LdrQueryProcessModuleInformation
LdrRelocateImage
ExitProcess
LdrShutdownProcess
ExitThread
LdrShutdownThread
LdrUnloadAlternateResourceModule
FreeLibrary
LdrUnloadDll
LdrVerifyImageMatchesChecksum
LdrVerifyMappedImageMatchesChecksum

6 Nls（National Language Support）系列  代碼頁管理
NlsAnsiCodePage
NlsMbCodePageTag
NlsMbOemCodePageTag

7 Nt系列共285個，大部分都是kernel32.dll,user32.dll等的核心實現

NtCreateFile, NtOpenFile, NtClose, NtWaitForSingleObject 是kernel32.dll中許多用戶級代碼的核心實現。

NTSTATUS NtClose( HANDLE  Handle);
竟然是CloseHandle 的原身！唯一的缺點是該函數并沒有導出庫，如果要調用，就必須使用GetProcAddress 來獲得其函數指針然后調用。

NtCreateFile  可以說是DDK的核心

RtlUnwind initiates an unwind of procedure call frames
結構化異常（Structured Exception Handling, SEH ）的核心。

NTSTATUS NtWaitForSingleObject(  HANDLE Handle, BOOLEAN Alertable, PLARGE_INTEGER Timeout);
Waits until the specified object attains a state of signaled
我想，信號同步等，應該與之有莫大的聯系吧

8 pfx 不明白
PfxFindPrefix
PfxInitialize
PfxInsertPrefix
PfxRemovePrefix

9 RestoreEm87Context SaveEm87Context

10 rtl系列共506個。我想，rtl應該是runtime library的縮寫吧。一個很龐大的函數族，
里面包含像 RtlCreateUserProcess 這樣的一些很基本的函數，通常供內核模式的driver等調用
下面是一部分示例
APIs Forwarded to NTDLL

API
Destination
DeleteCriticalSection
Forwarded to NTDLL.RtlDeleteCriticalSection
EnterCriticalSection
Forwarded to NTDLL.RtlEnterCriticalSection
HeapAlloc
Forwarded to NTDLL.RtlAllocateHeap
HeapFree
Forwarded to NTDLL.RtlFreeHeap
HeapReAlloc
Forwarded to NTDLL.RtlReAllocateHeap
HeapSize
Forwarded to NTDLL.RtlSizeHeap
LeaveCriticalSection
Forwarded to NTDLL.RtlLeaveCriticalSection
RtlFillMemory
Forwarded to NTDLL.RtlFillMemory
RtlMoveMemory
Forwarded to NTDLL.RtlMoveMemory
RtlUnwind
Forwarded to NTDLL.RtlUnwind
RtlZeroMemory
Forwarded to NTDLL.RtlZeroMemory
SetCriticalSectionSpinCount
Forwarded to NTDLL.RtlSetCriticalSection- SpinCount
TryEnterCriticalSection
Forwarded to NTDLL.RtlTryEnterCriticalSection
VerSetConditionMask
Forwarded to NTDLL.VerSetConditionMask

11 VerSetConditionMask 用于確認系統信息
The VerSetConditionMask function sets the bits of a 64-bit value to indicate the comparison operator to use for a specified operating system version attribute.
This function is used to build the dwlConditionMask parameter of the VerifyVersionInfo function.

12 Zw系列共284個。前面已經說過，為可執行性系統服務提供內核模式的入口，為NTOSKRNL.EXE 提供實現。由于是內核模式，所以在執行的時候并不檢查用戶是否有執行權限
13 內部函數共116個。具體作用不明，很底層的東西。無法查到任何相關資料。無法得知與其相關的任何信息。
_CIcos
_CIlog
_CIpow
_CIsin
_CIsqrt
__eCommonExceptions
__eEmulatorInit
__eF2XM1
__eFABS
__eFADD32
__eFADD64
__eFADDPreg
__eFADDreg
__eFADDtop
__eFCHS
__eFCOM
__eFCOM32
__eFCOM64
__eFCOMP
__eFCOMP32
__eFCOMP64
__eFCOMPP
__eFCOS
__eFDECSTP
__eFDIV32
__eFDIV64
__eFDIVPreg
__eFDIVR32
__eFDIVR64
__eFDIVRPreg
__eFDIVRreg
__eFDIVRtop
__eFDIVreg
__eFDIVtop
__eFFREE
__eFIADD16
__eFIADD32
__eFICOM16
__eFICOM32
__eFICOMP16
__eFICOMP32
__eFIDIV16
__eFIDIV32
__eFIDIVR16
__eFIDIVR32
__eFILD16
__eFILD32
__eFILD64
__eFIMUL16
__eFIMUL32
__eFINCSTP
__eFINIT
__eFIST16
__eFIST32
__eFISTP16
__eFISTP32
__eFISTP64
__eFISUB16
__eFISUB32
__eFISUBR16
__eFISUBR32
__eFLD1
__eFLD32
__eFLD64
__eFLD80
__eFLDCW
__eFLDENV
__eFLDL2E
__eFLDLN2
__eFLDPI
__eFLDZ
__eFMUL32
__eFMUL64
__eFMULPreg
__eFMULreg
__eFMULtop
__eFPATAN
__eFPREM
__eFPREM1
__eFPTAN
__eFRNDINT
__eFRSTOR
__eFSAVE __eFSCALE __eFSIN __eFSQRT __eFST __eFST32 __eFST64 __eFSTCW __eFSTENV __eFSTP __eFSTP32 __eFSTP64 __eFSTP80
__eFSTSW __eFSUB32 __eFSUB64 __eFSUBPreg __eFSUBR32 __eFSUBR64 __eFSUBRPreg __eFSUBRreg __eFSUBRtop __eFSUBreg __eFSUBtop
__eFTST __eFUCOM __eFUCOMP __eFUCOMPP __eFXAM __eFXCH __eFXTRACT __eFYL2X __eFYL2XP1 __eGetStatusWord

14 一些CRT的基本函數共131個主要是字符串管理，還有些基本的數學函數
__isascii __iscsym __iscsymf __toascii _alldiv _alldvrm _allmul _alloca_probe _allrem _allshl _allshr _atoi64 _aulldiv _aulldvrm _aullrem _aullshr _chkstk _fltused
_ftol _i64toa _i64tow _itoa _itow _lfind _ltoa _ltow _memccpy _memicmp _snprintf _snwprintf _splitpath _strcmpi _stricmp _strlwr _strnicmp _strupr _tolower
_toupper _ui64toa _ui64tow _ultoa _ultow _vsnprintf _vsnwprintf _wcsicmp _wcslwr _wcsnicmp _wcsupr _wtoi _wtoi64 _wtol abs atan atoi atol bsearch ceil
cos fabs floor isalnum isalpha iscntrl isdigit isgraph islower isprint ispunct isspace isupper iswalpha iswctype iswdigit iswlower iswspace iswxdigit isxdigit labs log
mbstowcs memchr memcmp memcpy memmove memset pow qsort sin sprintf sqrt sscanf strcat strchr strcmp strcpy strcspn strlen strncat strncmp strncpy strpbrk
strrchr strspn strstr strtol strtoul swprintf tan tolower toupper towlower towupper vDbgPrintEx vDbgPrintExWithPrefix vsprintf wcscat wcschr wcscmp wcscpy
wcscspn wcslen wcsncat wcsncmp wcsncpy wcspbrk wcsrchr wcsspn wcsstr wcstol wcstombs wcstoul

posted on 2009-05-21 15:23 悟山閱讀(1181) 評論(0) 編輯收藏引用

只有注冊用戶登錄后才能發表評論。
【推薦】100%開源！大型工業跨平臺軟件C++源碼提供，建模，組態！



網站導航: 博客園 IT新聞 BlogJava 博問 Chat2DB 管理

久久99热只有频精品8| 久久国产精品波多野结衣AV| 伊人久久大香线蕉AV一区二区| 久久亚洲精品无码播放| 伊人久久五月天| 久久久青草久久久青草| 老男人久久青草av高清| 99久久er这里只有精品18| 久久91这里精品国产2020| 久久久久久久久久久精品尤物| 久久美女人爽女人爽| 99久久国产亚洲综合精品| 嫩草影院久久99| 久久偷看各类wc女厕嘘嘘| 人妻无码精品久久亚瑟影视| 99麻豆久久久国产精品免费| 一本一道久久a久久精品综合| 国产精品美女久久久| 久久久久亚洲AV无码专区首JN | 国产精品gz久久久| 熟妇人妻久久中文字幕| 中文字幕精品久久久久人妻| 7国产欧美日韩综合天堂中文久久久久 | 武侠古典久久婷婷狼人伊人| 日韩一区二区久久久久久| 麻豆亚洲AV永久无码精品久久 | 久久免费看黄a级毛片| 国产69精品久久久久9999| 国产精品久久久久久影院 | 狠狠人妻久久久久久综合蜜桃| 久久久婷婷五月亚洲97号色 | 亚洲国产成人久久精品99 | 久久久久四虎国产精品| 久久婷婷五月综合97色一本一本| 亚洲女久久久噜噜噜熟女| 97香蕉久久夜色精品国产| 久久久www免费人成精品| 亚洲欧洲久久av| 精品综合久久久久久98| 亚洲综合伊人久久大杳蕉| 亚洲午夜久久久久久噜噜噜|

<center id="okgqi"><acronym id="okgqi"></acronym></center>

<rt id="okgqi"></rt>

<bdo id="okgqi"><tbody id="okgqi"></tbody></bdo>

<code id="okgqi"><tr id="okgqi"></tr></code>

<bdo id="okgqi"></bdo>

<button id="okgqi"></button>

<tfoot id="okgqi"><delect id="okgqi"></delect></tfoot>

<rt id="okgqi"></rt>