Windows软件调试初探-进程与线程

进程资源

每个进程都有这些资源：

  • 一个虚拟地址空间。
  • 全局唯一Cid，即PID。
  • 一个可执行映像，即该进程可执行文件在内存中的表示。
  • 一个或多个线程。
  • 一个内核空间中的EPROCESS。
  • 一个内核空间中的对象句柄表。
  • 一个用于描述内存目录表起始位置的基地址，即页目录基地址DirBase。当CPU切换到该进程时，将该地址加载到页表基地址寄存器如CR3或TTBR，再由RVA翻译为正确物理地址。
  • 一个用户空间中的PEB。
  • 一个访问令牌。

例如列出系统所有进程：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
6: kd> !process 0 0
**** NT ACTIVE PROCESS DUMP ****
PROCESS ffff84898203c440
    SessionId: none  Cid: 0004    Peb: 00000000  ParentCid: 0000
    DirBase: 001ad002  ObjectTable: ffffe18f2b814040  HandleCount: 2564.
    Image: System

PROCESS ffff8489820c6040
    SessionId: none  Cid: 0078    Peb: 00000000  ParentCid: 0004
    DirBase: 99d00002  ObjectTable: ffffe18f2b825b80  HandleCount:   0.
    Image: Registry

PROCESS ffff84898205d040
    SessionId: none  Cid: 01e0    Peb: 3062840000  ParentCid: 0004
    DirBase: 77100002  ObjectTable: ffffe18f2c1ab340  HandleCount:  52.
    Image: smss.exe
...
6: kd> !process 0 0 wermgr.exe
PROCESS ffff84899855d580
    SessionId: 0  Cid: 1840    Peb: cd79837000  ParentCid: 0644
    DirBase: 173e00002  ObjectTable: ffffe18f347c0d80  HandleCount:  16.
    Image: wermgr.exe

DirBase的高20位为该进程页目录的页帧编号PFN，低12位含义因CR4的PCIDE位第17位不同。PCIDE位1时CPU缓存多个进程页表信息，低12位为进程上下文ID。为应对CPU的Meltdown和Spectry漏洞，NT内核引入KVA影子安全补丁，启用PCIDE功能。

例如：启用了KVA影子，使用模式1，该模式要求PCID功能支持。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
6: kd> dd nt!KiKvaShadow L1
fffff800`06465840  00000001
6: kd> dd nt!KiKvaShadowMode L1
fffff800`0644e4f8  00000001
6: kd> dd nt!KiFlushPcid L1
fffff800`0644e249  00000001
6: kd> .formats cr4
Evaluate expression:
  Hex:     00000000`00170778
  Decimal: 1509240
  Octal:   0000000000000005603570
  Binary:  00000000 00000000 00000000 00000000 00000000 00010111 00000111 01111000
  Chars:   .......x
  Time:    Sun Jan 18 19:14:00 1970
  Float:   low 2.1149e-039 high 0
  Double:  7.45664e-318

已知PFN后，用以下命令列出物理地址到RVA间映射：

1
!ptov 1f350

EPROCESS结构

结构定义如下，这玩意儿变得很勤：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
6: kd> dt _EPROCESS
nt!_EPROCESS
   +0x000 Pcb              : _KPROCESS //内核进程块 与任务调度有关
   +0x2d8 ProcessLock      : _EX_PUSH_LOCK
   +0x2e0 UniqueProcessId  : Ptr64 Void //进程ID
   +0x2e8 ActiveProcessLinks : _LIST_ENTRY
   +0x2f8 RundownProtect   : _EX_RUNDOWN_REF
   +0x300 Flags2           : Uint4B
   +0x300 JobNotReallyActive : Pos 0, 1 Bit
   +0x300 AccountingFolded : Pos 1, 1 Bit
   +0x300 NewProcessReported : Pos 2, 1 Bit
   +0x300 ExitProcessReported : Pos 3, 1 Bit
   +0x300 ReportCommitChanges : Pos 4, 1 Bit
   +0x300 LastReportMemory : Pos 5, 1 Bit
   +0x300 ForceWakeCharge  : Pos 6, 1 Bit
   +0x300 CrossSessionCreate : Pos 7, 1 Bit
   +0x300 NeedsHandleRundown : Pos 8, 1 Bit
   +0x300 RefTraceEnabled  : Pos 9, 1 Bit
   +0x300 PicoCreated      : Pos 10, 1 Bit
   +0x300 EmptyJobEvaluated : Pos 11, 1 Bit
   +0x300 DefaultPagePriority : Pos 12, 3 Bits
   +0x300 PrimaryTokenFrozen : Pos 15, 1 Bit
   +0x300 ProcessVerifierTarget : Pos 16, 1 Bit
   +0x300 RestrictSetThreadContext : Pos 17, 1 Bit
   +0x300 AffinityPermanent : Pos 18, 1 Bit
   +0x300 AffinityUpdateEnable : Pos 19, 1 Bit
   +0x300 PropagateNode    : Pos 20, 1 Bit
   +0x300 ExplicitAffinity : Pos 21, 1 Bit
   +0x300 ProcessExecutionState : Pos 22, 2 Bits
   +0x300 EnableReadVmLogging : Pos 24, 1 Bit
   +0x300 EnableWriteVmLogging : Pos 25, 1 Bit
   +0x300 FatalAccessTerminationRequested : Pos 26, 1 Bit
   +0x300 DisableSystemAllowedCpuSet : Pos 27, 1 Bit
   +0x300 ProcessStateChangeRequest : Pos 28, 2 Bits
   +0x300 ProcessStateChangeInProgress : Pos 30, 1 Bit
   +0x300 InPrivate        : Pos 31, 1 Bit
   +0x304 Flags            : Uint4B
   +0x304 CreateReported   : Pos 0, 1 Bit
   +0x304 NoDebugInherit   : Pos 1, 1 Bit
   +0x304 ProcessExiting   : Pos 2, 1 Bit //正在退出标志
   +0x304 ProcessDelete    : Pos 3, 1 Bit //删除标志
   +0x304 ManageExecutableMemoryWrites : Pos 4, 1 Bit
   +0x304 VmDeleted        : Pos 5, 1 Bit
   +0x304 OutswapEnabled   : Pos 6, 1 Bit
   +0x304 Outswapped       : Pos 7, 1 Bit
   +0x304 FailFastOnCommitFail : Pos 8, 1 Bit
   +0x304 Wow64VaSpace4Gb  : Pos 9, 1 Bit
   +0x304 AddressSpaceInitialized : Pos 10, 2 Bits
   +0x304 SetTimerResolution : Pos 12, 1 Bit
   +0x304 BreakOnTermination : Pos 13, 1 Bit
   +0x304 DeprioritizeViews : Pos 14, 1 Bit
   +0x304 WriteWatch       : Pos 15, 1 Bit
   +0x304 ProcessInSession : Pos 16, 1 Bit
   +0x304 OverrideAddressSpace : Pos 17, 1 Bit
   +0x304 HasAddressSpace  : Pos 18, 1 Bit
   +0x304 LaunchPrefetched : Pos 19, 1 Bit
   +0x304 Background       : Pos 20, 1 Bit
   +0x304 VmTopDown        : Pos 21, 1 Bit
   +0x304 ImageNotifyDone  : Pos 22, 1 Bit
   +0x304 PdeUpdateNeeded  : Pos 23, 1 Bit
   +0x304 VdmAllowed       : Pos 24, 1 Bit
   +0x304 ProcessRundown   : Pos 25, 1 Bit
   +0x304 ProcessInserted  : Pos 26, 1 Bit
   +0x304 DefaultIoPriority : Pos 27, 3 Bits
   +0x304 ProcessSelfDelete : Pos 30, 1 Bit
   +0x304 SetTimerResolutionLink : Pos 31, 1 Bit
   +0x308 CreateTime       : _LARGE_INTEGER //创建时间
   +0x310 ProcessQuotaUsage : [2] Uint8B
   +0x320 ProcessQuotaPeak : [2] Uint8B
   +0x330 PeakVirtualSize  : Uint8B
   +0x338 VirtualSize      : Uint8B
   +0x340 SessionProcessLinks : _LIST_ENTRY
   +0x350 ExceptionPortData : Ptr64 Void //异常端口
   +0x350 ExceptionPortValue : Uint8B
   +0x350 ExceptionPortState : Pos 0, 3 Bits
   +0x358 Token            : _EX_FAST_REF //访问令牌
   +0x360 MmReserved       : Uint8B
   +0x368 AddressCreationLock : _EX_PUSH_LOCK
   +0x370 PageTableCommitmentLock : _EX_PUSH_LOCK
   +0x378 RotateInProgress : Ptr64 _ETHREAD
   +0x380 ForkInProgress   : Ptr64 _ETHREAD
   +0x388 CommitChargeJob  : Ptr64 _EJOB
   +0x390 CloneRoot        : _RTL_AVL_TREE
   +0x398 NumberOfPrivatePages : Uint8B
   +0x3a0 NumberOfLockedPages : Uint8B
   +0x3a8 Win32Process     : Ptr64 Void
   +0x3b0 Job              : Ptr64 _EJOB
   +0x3b8 SectionObject    : Ptr64 Void
   +0x3c0 SectionBaseAddress : Ptr64 Void
   +0x3c8 Cookie           : Uint4B
   +0x3d0 WorkingSetWatch  : Ptr64 _PAGEFAULT_HISTORY
   +0x3d8 Win32WindowStation : Ptr64 Void
   +0x3e0 InheritedFromUniqueProcessId : Ptr64 Void
   +0x3e8 LdtInformation   : Ptr64 Void
   +0x3f0 OwnerProcessId   : Uint8B
   +0x3f8 Peb              : Ptr64 _PEB //进程环境块
   +0x400 Session          : Ptr64 _MM_SESSION_SPACE //所属会话对象
   +0x408 AweInfo          : Ptr64 Void
   +0x410 QuotaBlock       : Ptr64 _EPROCESS_QUOTA_BLOCK
   +0x418 ObjectTable      : Ptr64 _HANDLE_TABLE //对象句柄表
   +0x420 DebugPort        : Ptr64 Void //用户态调试端口
   +0x428 WoW64Process     : Ptr64 _EWOW64PROCESS
   +0x430 DeviceMap        : Ptr64 Void
   +0x438 EtwDataSource    : Ptr64 Void
   +0x440 PageDirectoryPte : Uint8B
   +0x448 ImageFilePointer : Ptr64 _FILE_OBJECT
   +0x450 ImageFileName    : [15] UChar
   +0x45f PriorityClass    : UChar
   +0x460 SecurityPort     : Ptr64 Void
   +0x468 SeAuditProcessCreationInfo : _SE_AUDIT_PROCESS_CREATION_INFO
   +0x470 JobLinks         : _LIST_ENTRY
   +0x480 HighestUserAddress : Ptr64 Void
   +0x488 ThreadListHead   : _LIST_ENTRY //线程列表
   +0x498 ActiveThreads    : Uint4B
   +0x49c ImagePathHash    : Uint4B
   +0x4a0 DefaultHardErrorProcessing : Uint4B
   +0x4a4 LastThreadExitStatus : Int4B
   +0x4a8 PrefetchTrace    : _EX_FAST_REF
   +0x4b0 LockedPagesList  : Ptr64 Void
   +0x4b8 ReadOperationCount : _LARGE_INTEGER
   +0x4c0 WriteOperationCount : _LARGE_INTEGER
   +0x4c8 OtherOperationCount : _LARGE_INTEGER
   +0x4d0 ReadTransferCount : _LARGE_INTEGER
   +0x4d8 WriteTransferCount : _LARGE_INTEGER
   +0x4e0 OtherTransferCount : _LARGE_INTEGER
   +0x4e8 CommitChargeLimit : Uint8B
   +0x4f0 CommitCharge     : Uint8B
   +0x4f8 CommitChargePeak : Uint8B
   +0x500 Vm               : _MMSUPPORT_FULL
   +0x610 MmProcessLinks   : _LIST_ENTRY
   +0x620 ModifiedPageCount : Uint4B
   +0x624 ExitStatus       : Int4B
   +0x628 VadRoot          : _RTL_AVL_TREE //虚拟地址描述符VAD 用!vad查看
   +0x630 VadHint          : Ptr64 Void
   +0x638 VadCount         : Uint8B
   +0x640 VadPhysicalPages : Uint8B
   +0x648 VadPhysicalPagesLimit : Uint8B
   +0x650 AlpcContext      : _ALPC_PROCESS_CONTEXT
   +0x670 TimerResolutionLink : _LIST_ENTRY
   +0x680 TimerResolutionStackRecord : Ptr64 _PO_DIAG_STACK_RECORD
   +0x688 RequestedTimerResolution : Uint4B
   +0x68c SmallestTimerResolution : Uint4B
   +0x690 ExitTime         : _LARGE_INTEGER //退出时间
   +0x698 InvertedFunctionTable : Ptr64 _INVERTED_FUNCTION_TABLE
   +0x6a0 InvertedFunctionTableLock : _EX_PUSH_LOCK
   +0x6a8 ActiveThreadsHighWatermark : Uint4B
   +0x6ac LargePrivateVadCount : Uint4B
   +0x6b0 ThreadListLock   : _EX_PUSH_LOCK
   +0x6b8 WnfContext       : Ptr64 Void
   +0x6c0 ServerSilo       : Ptr64 _EJOB
   +0x6c8 SignatureLevel   : UChar
   +0x6c9 SectionSignatureLevel : UChar
   +0x6ca Protection       : _PS_PROTECTION
   +0x6cb HangCount        : Pos 0, 4 Bits
   +0x6cb GhostCount       : Pos 4, 4 Bits
   +0x6cc Flags3           : Uint4B
   +0x6cc Minimal          : Pos 0, 1 Bit
   +0x6cc ReplacingPageRoot : Pos 1, 1 Bit
   +0x6cc Crashed          : Pos 2, 1 Bit
   +0x6cc JobVadsAreTracked : Pos 3, 1 Bit
   +0x6cc VadTrackingDisabled : Pos 4, 1 Bit
   +0x6cc AuxiliaryProcess : Pos 5, 1 Bit
   +0x6cc SubsystemProcess : Pos 6, 1 Bit
   +0x6cc IndirectCpuSets  : Pos 7, 1 Bit
   +0x6cc RelinquishedCommit : Pos 8, 1 Bit
   +0x6cc HighGraphicsPriority : Pos 9, 1 Bit
   +0x6cc CommitFailLogged : Pos 10, 1 Bit
   +0x6cc ReserveFailLogged : Pos 11, 1 Bit
   +0x6cc SystemProcess    : Pos 12, 1 Bit
   +0x6cc HideImageBaseAddresses : Pos 13, 1 Bit
   +0x6cc AddressPolicyFrozen : Pos 14, 1 Bit
   +0x6cc ProcessFirstResume : Pos 15, 1 Bit
   +0x6cc ForegroundExternal : Pos 16, 1 Bit
   +0x6cc ForegroundSystem : Pos 17, 1 Bit
   +0x6cc HighMemoryPriority : Pos 18, 1 Bit
   +0x6d0 DeviceAsid       : Int4B
   +0x6d8 SvmData          : Ptr64 Void
   +0x6e0 SvmProcessLock   : _EX_PUSH_LOCK
   +0x6e8 SvmLock          : Uint8B
   +0x6f0 SvmProcessDeviceListHead : _LIST_ENTRY
   +0x700 LastFreezeInterruptTime : Uint8B
   +0x708 DiskCounters     : Ptr64 _PROCESS_DISK_COUNTERS
   +0x710 PicoContext      : Ptr64 Void
   +0x718 TrustletIdentity : Uint8B
   +0x720 EnclaveTable     : Ptr64 Void
   +0x728 EnclaveNumber    : Uint8B
   +0x730 EnclaveLock      : _EX_PUSH_LOCK
   +0x738 HighPriorityFaultsAllowed : Uint4B
   +0x740 EnergyContext    : Ptr64 _PO_PROCESS_ENERGY_CONTEXT
   +0x748 VmContext        : Ptr64 Void
   +0x750 SequenceNumber   : Uint8B
   +0x758 CreateInterruptTime : Uint8B
   +0x760 CreateUnbiasedInterruptTime : Uint8B
   +0x768 TotalUnbiasedFrozenTime : Uint8B
   +0x770 LastAppStateUpdateTime : Uint8B
   +0x778 LastAppStateUptime : Pos 0, 61 Bits
   +0x778 LastAppState     : Pos 61, 3 Bits
   +0x780 SharedCommitCharge : Uint8B
   +0x788 SharedCommitLock : _EX_PUSH_LOCK
   +0x790 SharedCommitLinks : _LIST_ENTRY
   +0x7a0 AllowedCpuSets   : Uint8B
   +0x7a8 DefaultCpuSets   : Uint8B
   +0x7a0 AllowedCpuSetsIndirect : Ptr64 Uint8B
   +0x7a8 DefaultCpuSetsIndirect : Ptr64 Uint8B
   +0x7b0 DiskIoAttribution : Ptr64 Void
   +0x7b8 DxgProcess       : Ptr64 Void
   +0x7c0 Win32KFilterSet  : Uint4B
   +0x7c8 ProcessTimerDelay : _PS_INTERLOCKED_TIMER_DELAY_VALUES
   +0x7d0 KTimerSets       : Uint4B
   +0x7d4 KTimer2Sets      : Uint4B
   +0x7d8 ThreadTimerSets  : Uint4B
   +0x7e0 VirtualTimerListLock : Uint8B
   +0x7e8 VirtualTimerListHead : _LIST_ENTRY
   +0x7f8 WakeChannel      : _WNF_STATE_NAME
   +0x7f8 WakeInfo         : _PS_PROCESS_WAKE_INFORMATION
   +0x828 MitigationFlags  : Uint4B
   +0x828 MitigationFlagsValues : <unnamed-tag>
   +0x82c MitigationFlags2 : Uint4B
   +0x82c MitigationFlags2Values : <unnamed-tag>
   +0x830 PartitionObject  : Ptr64 Void
   +0x838 SecurityDomain   : Uint8B
   +0x840 CoverageSamplerContext : Ptr64 Void

显示某个进程关键信息：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
6: kd> !process ffff84898fdf1080
PROCESS ffff84898fdf1080
    SessionId: 0  Cid: 1430    Peb: 65e5a30000  ParentCid: 0398
    DirBase: 438650002  ObjectTable: ffffe18f306d8100  HandleCount: 132.
    Image: WmiApSrv.exe
    VadRoot ffff84898fdf7a30 Vads 56 Clone 0 Private 306. Modified 3. Locked 0.
    DeviceMap ffffe18f2b818ad0
    Token                             ffffe18f306d4060
    ElapsedTime                       00:00:11.319
    UserTime                          00:00:00.000
    KernelTime                        00:00:00.000
    QuotaPoolUsage[PagedPool]         61072
    QuotaPoolUsage[NonPagedPool]      7880
    Working Set Sizes (now,min,max)  (1592, 50, 345) (6368KB, 200KB, 1380KB)
    PeakWorkingSetSize                1536
    VirtualSize                       2101312 Mb
    PeakVirtualSize                   2101312 Mb
    PageFaultCount                    1602
    MemoryPriority                    BACKGROUND
    BasePriority                      8
    CommitCharge                      349

        THREAD ffff84898fdf2080  Cid 1430.1434  Teb: 00000065e5a31000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable
            ffff84898fdaaf40  SynchronizationEvent
        Not impersonating
        DeviceMap                 ffffe18f2b818ad0
        Owning Process            ffff84898fdf1080       Image:         WmiApSrv.exe
        Attached Process          N/A            Image:         N/A
        Wait Start TickCount      787            Ticks: 719 (0:00:00:11.234)
        Context Switch Count      66             IdealProcessor: 3             
        UserTime                  00:00:00.000
        KernelTime                00:00:00.015
        Win32 Start Address 0x00007ff7666696a0
        Stack Init ffff978957a17b90 Current ffff978957a175c0
        Base ffff978957a18000 Limit ffff978957a11000 Call 0000000000000000
        Priority 9 BasePriority 8 PriorityDecrement 0 IoPriority 2 PagePriority 5
        Child-SP          RetAddr               Call Site
        ffff9789`57a17600 fffff800`060395d6     nt!KiSwapContext+0x76
        ffff9789`57a17740 fffff800`06038dcb     nt!KiSwapThread+0x2c6
        ffff9789`57a17810 fffff800`060384ef     nt!KiCommitThreadWait+0x13b
        ffff9789`57a178b0 fffff800`064e5f2c     nt!KeWaitForSingleObject+0x1ff
        ffff9789`57a17990 fffff800`061b9d43     nt!NtWaitForSingleObject+0xfc
        ffff9789`57a17a00 00007ffd`84ee9f84     nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffff9789`57a17a00)
        00000065`e58bf7c8 00000000`00000000     0x00007ffd`84ee9f84
        
...

查Token：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
6: kd> !token ffffe18f306d4060
_TOKEN 0xffffe18f306d4060
TS Session ID: 0
User: S-1-5-18
User Groups: 
 00 S-1-16-16384
    Attributes - GroupIntegrity GroupIntegrityEnabled 
 01 S-1-1-0
    Attributes - Mandatory Default Enabled 
 02 S-1-5-32-545
    Attributes - Mandatory Default Enabled 
 03 S-1-5-6
    Attributes - Mandatory Default Enabled 
 04 S-1-2-1
    Attributes - Mandatory Default Enabled 
 05 S-1-5-11
    Attributes - Mandatory Default Enabled 
 06 S-1-5-15
    Attributes - Mandatory Default Enabled 
 07 S-1-5-80-1851371743-411767070-3743290205-1090512353-603110601
    Attributes - Default Enabled Owner 
 08 S-1-5-5-0-261335
    Attributes - Mandatory Default Enabled Owner LogonId 
 09 S-1-2-0
    Attributes - Mandatory Default Enabled 
 10 S-1-5-32-544
    Attributes - Default Enabled Owner 
Primary Group: S-1-5-18
Privs: 
 03 0x000000003 SeAssignPrimaryTokenPrivilege     Attributes - 
 04 0x000000004 SeLockMemoryPrivilege             Attributes - Enabled Default 
 05 0x000000005 SeIncreaseQuotaPrivilege          Attributes - 
 07 0x000000007 SeTcbPrivilege                    Attributes - Enabled Default 
 08 0x000000008 SeSecurityPrivilege               Attributes - 
 09 0x000000009 SeTakeOwnershipPrivilege          Attributes - 
 10 0x00000000a SeLoadDriverPrivilege             Attributes - 
 11 0x00000000b SeSystemProfilePrivilege          Attributes - Enabled Default 
 12 0x00000000c SeSystemtimePrivilege             Attributes - 
 13 0x00000000d SeProfileSingleProcessPrivilege   Attributes - Enabled Default 
 14 0x00000000e SeIncreaseBasePriorityPrivilege   Attributes - Enabled Default 
 15 0x00000000f SeCreatePagefilePrivilege         Attributes - Enabled Default 
 16 0x000000010 SeCreatePermanentPrivilege        Attributes - Enabled Default 
 17 0x000000011 SeBackupPrivilege                 Attributes - 
 18 0x000000012 SeRestorePrivilege                Attributes - 
 19 0x000000013 SeShutdownPrivilege               Attributes - 
 20 0x000000014 SeDebugPrivilege                  Attributes - Enabled Default 
 21 0x000000015 SeAuditPrivilege                  Attributes - Enabled Default 
 22 0x000000016 SeSystemEnvironmentPrivilege      Attributes - 
 23 0x000000017 SeChangeNotifyPrivilege           Attributes - Enabled Default 
 25 0x000000019 SeUndockPrivilege                 Attributes - 
 28 0x00000001c SeManageVolumePrivilege           Attributes - 
 29 0x00000001d SeImpersonatePrivilege            Attributes - Enabled Default 
 30 0x00000001e SeCreateGlobalPrivilege           Attributes - Enabled Default 
 33 0x000000021 SeIncreaseWorkingSetPrivilege     Attributes - Enabled Default 
 34 0x000000022 SeTimeZonePrivilege               Attributes - Enabled Default 
 35 0x000000023 SeCreateSymbolicLinkPrivilege     Attributes - Enabled Default 
 36 0x000000024 SeDelegateSessionUserImpersonatePrivilege  Attributes - Enabled Default 
Authentication ID:         (0,3e7)
Impersonation Level:       Anonymous
TokenType:                 Primary
Source: Advapi             TokenFlags: 0x2000 ( Token in use )
Token ID: 4000d            ParentToken ID: 0
Modified ID:               (0, 3fd3a)
RestrictedSidCount: 0      RestrictedSids: 0x0000000000000000
OriginatingLogonSession: 3e7
PackageSid: (null)
CapabilityCount: 0      Capabilities: 0x0000000000000000
LowboxNumberEntry: 0x0000000000000000
Security Attributes:
Unable to get the offset of nt!_AUTHZBASEP_SECURITY_ATTRIBUTE.ListLink
Process Token TrustLevelSid: (null)

观察令牌对象：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
6: kd> dt nt!_TOKEN ffffe18f306d4060
   +0x000 TokenSource      : _TOKEN_SOURCE
   +0x010 TokenId          : _LUID
   +0x018 AuthenticationId : _LUID
   +0x020 ParentTokenId    : _LUID
   +0x028 ExpirationTime   : _LARGE_INTEGER 0x06207526`b64ceb90
   +0x030 TokenLock        : 0xffff8489`8fdfbb00 _ERESOURCE
   +0x038 ModifiedId       : _LUID
   +0x040 Privileges       : _SEP_TOKEN_PRIVILEGES
   +0x058 AuditPolicy      : _SEP_AUDIT_POLICY
   +0x078 SessionId        : 0
   +0x07c UserAndGroupCount : 0xc
   +0x080 RestrictedSidCount : 0
   +0x084 VariableLength   : 0x19c
   +0x088 DynamicCharged   : 0x1000
   +0x08c DynamicAvailable : 0
   +0x090 DefaultOwnerIndex : 0
   +0x098 UserAndGroups    : 0xffffe18f`306d44f0 _SID_AND_ATTRIBUTES
   +0x0a0 RestrictedSids   : (null) 
   +0x0a8 PrimaryGroup     : 0xffffe18f`3065e6f0 Void
   +0x0b0 DynamicPart      : 0xffffe18f`3065e6f0  -> 0x101
   +0x0b8 DefaultDacl      : 0xffffe18f`3065e6fc _ACL
   +0x0c0 TokenType        : 1 ( TokenPrimary )
   +0x0c4 ImpersonationLevel : 0 ( SecurityAnonymous )
   +0x0c8 TokenFlags       : 0x2000
   +0x0cc TokenInUse       : 0x1 ''
   +0x0d0 IntegrityLevelIndex : 1
   +0x0d4 MandatoryPolicy  : 3
   +0x0d8 LogonSession     : 0xffffe18f`2b814d50 _SEP_LOGON_SESSION_REFERENCES
   +0x0e0 OriginatingLogonSession : _LUID
   +0x0e8 SidHash          : _SID_AND_ATTRIBUTES_HASH
   +0x1f8 RestrictedSidHash : _SID_AND_ATTRIBUTES_HASH
   +0x308 pSecurityAttributes : 0xffffe18f`306d1880 _AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION
   +0x310 Package          : (null) 
   +0x318 Capabilities     : (null) 
   +0x320 CapabilityCount  : 0
   +0x328 CapabilitiesHash : _SID_AND_ATTRIBUTES_HASH
   +0x438 LowboxNumberEntry : (null) 
   +0x440 LowboxHandlesEntry : (null) 
   +0x448 pClaimAttributes : (null) 
   +0x450 TrustLevelSid    : (null) 
   +0x458 TrustLinkedToken : (null) 
   +0x460 IntegrityLevelSidValue : (null) 
   +0x468 TokenSidValues   : (null) 
   +0x470 IndexEntry       : 0xffffe18f`306d3130 _SEP_LUID_TO_INDEX_MAP_ENTRY
   +0x478 DiagnosticInfo   : (null) 
   +0x480 BnoIsolationHandlesEntry : (null) 
   +0x488 SessionObject    : (null) 
   +0x490 VariablePart     : 0xffffe18f`306d45b0

PEB结构

EPROCESS中PEB结构为：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
6: kd> dt _PEB
nt!_PEB
   +0x000 InheritedAddressSpace : UChar
   +0x001 ReadImageFileExecOptions : UChar
   +0x002 BeingDebugged    : UChar //是否正在被调试
   +0x003 BitField         : UChar
   +0x003 ImageUsesLargePages : Pos 0, 1 Bit
   +0x003 IsProtectedProcess : Pos 1, 1 Bit
   +0x003 IsImageDynamicallyRelocated : Pos 2, 1 Bit
   +0x003 SkipPatchingUser32Forwarders : Pos 3, 1 Bit
   +0x003 IsPackagedProcess : Pos 4, 1 Bit
   +0x003 IsAppContainer   : Pos 5, 1 Bit
   +0x003 IsProtectedProcessLight : Pos 6, 1 Bit
   +0x003 IsLongPathAwareProcess : Pos 7, 1 Bit
   +0x004 Padding0         : [4] UChar
   +0x008 Mutant           : Ptr64 Void
   +0x010 ImageBaseAddress : Ptr64 Void //执行映像基地址
   +0x018 Ldr              : Ptr64 _PEB_LDR_DATA
   +0x020 ProcessParameters : Ptr64 _RTL_USER_PROCESS_PARAMETERS
   +0x028 SubSystemData    : Ptr64 Void
   +0x030 ProcessHeap      : Ptr64 Void //进程堆
   +0x038 FastPebLock      : Ptr64 _RTL_CRITICAL_SECTION
   +0x040 AtlThunkSListPtr : Ptr64 _SLIST_HEADER
   +0x048 IFEOKey          : Ptr64 Void
   +0x050 CrossProcessFlags : Uint4B
   +0x050 ProcessInJob     : Pos 0, 1 Bit
   +0x050 ProcessInitializing : Pos 1, 1 Bit
   +0x050 ProcessUsingVEH  : Pos 2, 1 Bit
   +0x050 ProcessUsingVCH  : Pos 3, 1 Bit
   +0x050 ProcessUsingFTH  : Pos 4, 1 Bit
   +0x050 ProcessPreviouslyThrottled : Pos 5, 1 Bit
   +0x050 ProcessCurrentlyThrottled : Pos 6, 1 Bit
   +0x050 ReservedBits0    : Pos 7, 25 Bits
   +0x054 Padding1         : [4] UChar
   +0x058 KernelCallbackTable : Ptr64 Void
   +0x058 UserSharedInfoPtr : Ptr64 Void
   +0x060 SystemReserved   : Uint4B
   +0x064 AtlThunkSListPtr32 : Uint4B
   +0x068 ApiSetMap        : Ptr64 Void
   +0x070 TlsExpansionCounter : Uint4B
   +0x074 Padding2         : [4] UChar
   +0x078 TlsBitmap        : Ptr64 Void
   +0x080 TlsBitmapBits    : [2] Uint4B
   +0x088 ReadOnlySharedMemoryBase : Ptr64 Void
   +0x090 SharedData       : Ptr64 Void
   +0x098 ReadOnlyStaticServerData : Ptr64 Ptr64 Void
   +0x0a0 AnsiCodePageData : Ptr64 Void
   +0x0a8 OemCodePageData  : Ptr64 Void
   +0x0b0 UnicodeCaseTableData : Ptr64 Void
   +0x0b8 NumberOfProcessors : Uint4B //CPU个数
   +0x0bc NtGlobalFlag     : Uint4B //全局标志
   +0x0c0 CriticalSectionTimeout : _LARGE_INTEGER
   +0x0c8 HeapSegmentReserve : Uint8B //默认进程堆总保留空间
   +0x0d0 HeapSegmentCommit : Uint8B //默认进程堆已提交空间
   +0x0d8 HeapDeCommitTotalFreeThreshold : Uint8B
   +0x0e0 HeapDeCommitFreeBlockThreshold : Uint8B
   +0x0e8 NumberOfHeaps    : Uint4B //堆个数
   +0x0ec MaximumNumberOfHeaps : Uint4B //堆最多个数
   +0x0f0 ProcessHeaps     : Ptr64 Ptr64 Void //保存堆句柄得数组地址
   +0x0f8 GdiSharedHandleTable : Ptr64 Void //GDI共享句柄表
   +0x100 ProcessStarterHelper : Ptr64 Void
   +0x108 GdiDCAttributeList : Uint4B
   +0x10c Padding3         : [4] UChar
   +0x110 LoaderLock       : Ptr64 _RTL_CRITICAL_SECTION
   +0x118 OSMajorVersion   : Uint4B //操作系统主版本号
   +0x11c OSMinorVersion   : Uint4B //操作系统子版本号
   +0x120 OSBuildNumber    : Uint2B //操作系统构建号
   +0x122 OSCSDVersion     : Uint2B //Service Pack版本号
   +0x124 OSPlatformId     : Uint4B //操作系统类别 NT为2 9x为1 WindowsCE为3
   +0x128 ImageSubsystem   : Uint4B //环境子系统ID
   +0x12c ImageSubsystemMajorVersion : Uint4B //环境子系统主版本号
   +0x130 ImageSubsystemMinorVersion : Uint4B //环境子系统子版本号
   +0x134 Padding4         : [4] UChar
   +0x138 ActiveProcessAffinityMask : Uint8B
   +0x140 GdiHandleBuffer  : [60] Uint4B
   +0x230 PostProcessInitRoutine : Ptr64     void 
   +0x238 TlsExpansionBitmap : Ptr64 Void
   +0x240 TlsExpansionBitmapBits : [32] Uint4B
   +0x2c0 SessionId        : Uint4B //所属会话ID
   +0x2c4 Padding5         : [4] UChar
   +0x2c8 AppCompatFlags   : _ULARGE_INTEGER
   +0x2d0 AppCompatFlagsUser : _ULARGE_INTEGER
   +0x2d8 pShimData        : Ptr64 Void
   +0x2e0 AppCompatInfo    : Ptr64 Void
   +0x2e8 CSDVersion       : _UNICODE_STRING
   +0x2f8 ActivationContextData : Ptr64 _ACTIVATION_CONTEXT_DATA
   +0x300 ProcessAssemblyStorageMap : Ptr64 _ASSEMBLY_STORAGE_MAP
   +0x308 SystemDefaultActivationContextData : Ptr64 _ACTIVATION_CONTEXT_DATA
   +0x310 SystemAssemblyStorageMap : Ptr64 _ASSEMBLY_STORAGE_MAP
   +0x318 MinimumStackCommit : Uint8B
   +0x320 FlsCallback      : Ptr64 _FLS_CALLBACK_INFO
   +0x328 FlsListHead      : _LIST_ENTRY
   +0x338 FlsBitmap        : Ptr64 Void
   +0x340 FlsBitmapBits    : [4] Uint4B
   +0x350 FlsHighIndex     : Uint4B
   +0x358 WerRegistrationData : Ptr64 Void
   +0x360 WerShipAssertPtr : Ptr64 Void
   +0x368 pUnused          : Ptr64 Void
   +0x370 pImageHeaderHash : Ptr64 Void
   +0x378 TracingFlags     : Uint4B
   +0x378 HeapTracingEnabled : Pos 0, 1 Bit
   +0x378 CritSecTracingEnabled : Pos 1, 1 Bit
   +0x378 LibLoaderTracingEnabled : Pos 2, 1 Bit
   +0x378 SpareTracingBits : Pos 3, 29 Bits
   +0x37c Padding6         : [4] UChar
   +0x380 CsrServerReadOnlySharedMemoryBase : Uint8B
   +0x388 TppWorkerpListLock : Uint8B
   +0x390 TppWorkerpList   : _LIST_ENTRY
   +0x3a0 WaitOnAddressHashTable : [128] Ptr64 Void
   +0x7a0 TelemetryCoverageHeader : Ptr64 Void
   +0x7a8 CloudFileFlags   : Uint4B
   +0x7ac CloudFileDiagFlags : Uint4B
   +0x7b0 PlaceholderCompatibilityMode : Char
   +0x7b1 PlaceholderCompatibilityModeReserved : [7] Char

也可以用!peb命令观察某地址处PEB结构。

内核模式和用户模式

例如Win32应用程序中调用Kernel32.dll导出的Kernel32!ReadFile后堆参数进行检查，再调用Ntdll!NtReadFile。Ntdll!NtReadFile将系统服务号，如0xa1等放入RAX，参数指针放入EDX，用int 2e发出调用。用!idt 2e看到2e号向量对应服务例程是Nt!KiSystemService，即内核态中用来分发系统调用的例程，在NtOsKrnl.exe中。Nt!KiSystemService进行权限检查和准备内核栈，根据系统服务分发表SSDT查找要调用的服务函数NtReadFile地址和参数描述。KiSystemService通过iret将执行权返回NtDll!NtReadFile。

1
2
3
4
5
6
7
8
9
10
11
12
13
// attributes: thunk
BOOL __stdcall ReadFile(HANDLE hFile, LPVOID lpBuffer, DWORD nNumberOfBytesToRead, LPDWORD lpNumberOfBytesRead, LPOVERLAPPED lpOverlapped) {
    return __imp_ReadFile(hFile, lpBuffer, nNumberOfBytesToRead, lpNumberOfBytesRead, lpOverlapped);
};
__int64 NtReadFile() {
    __int64 result; // rax
    result = 6LL;
    if ((MEMORY[0x7FFE0308] & 1) != 0)
        __asm { int     2Eh; DOS 2 + internal - EXECUTE COMMAND }
    else
        __asm { syscall; Low latency system call }
    return result;
};

从奔腾Ⅱ开始，在Windows XP或Windows Server 2003及以上在启动时检测是否支持快速系统调用命令。IA-32的奔腾Ⅱ引入sysenter/sysexit，AMD K7引入syscall/sysreturn。当支持快速系统调用时，系统启动时在全局描述表GDT中建立4个段描述符，依次排列为sysenter进入内核模式时使用的代码段CS和栈段SS，以及sysexit从内核模式返回用户模式使用的代码段和栈段。然后设置下表所示MSR，SYSENTER_EIP_MSR为sysenter要跳转到的目标例程Nt!KiFastCallEntry，SYSENTER_CS_MSR为Nt!KiFastCallEntry所在代码段KGDT_R0_CODE，SYSENTER_ESP_MSR为新栈指针即SYSENTER_CS_MSR+8。最后将SystemCallStub代码片段复制到SharedUserData内存区，该内存区将被映射到每个Win32进程空间中，每次快速系统调用时NTDLL.DLL中残根stub函数调用SystemCallStub代码片段。

MSR名称 MSR地址 用途
SYSENTER_CS_MSR 174h 目标代码段CS选择子
SYSENTER_ESP_MSR 175h 目标ESP
SYSENTER_EIP_MSR 176h 目标EIP

每个系统MSR都不同，例如：

1
rdmsr 174

快速系统调用模式切换总结为：

发起系统调用 入口内核例程 返回 返回内核例程
int 2e KiSystemService iret KiSystemCallExit
sysenter KiFastCallEntry sysexit KiSystemCallExit2
syscall KiFastCallEntry sysret KiSystemCallExit3

IA-32下快速系统调用实例ReadFile：Win32程序用Kernel32!ReadFile()调用NtDll!NtReadFile()，转到SharedUserData!SystemCallStub用sysenter进入nt!KiFastCallEntry，通过Nt!KiSystemService调用Nt!NtReadFile。返回时Nt!KiSystemService通过Nt!KiSystemCallExit2用sysexit退出内核模式回到SharedUserData!SystemCallStub。

内核模式也可主动调用用户模式例程，称为逆向调用。由Nt!KiCallUserMode发起调用，进入用户模式执行NtDll!KiUserCallbackDispatcher。用户模式完成后执行int 2b返回动作，对应Nt!KiCallbackReturn。

1
2
3
4
5
kd> !idt 2b

Dumping IDT: 80b95400

2b:	82848e50 nt!KiCallbackReturn

线程

类似EPROCESS，在内核模式下也有ETHREAD。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
0: kd> .thread
Implicit thread is now fffff807`10727600
0: kd> dt _ETHREAD fffff807`10727600
ntdll!_ETHREAD
   +0x000 Tcb              : _KTHREAD //线程控制块TCB 供内核调度线程
   +0x430 CreateTime       : _LARGE_INTEGER 0x0
   +0x438 ExitTime         : _LARGE_INTEGER 0x0
   +0x438 KeyedWaitChain   : _LIST_ENTRY [ 0x00000000`00000000 - 0x00000000`00000000 ]
   +0x448 PostBlockList    : _LIST_ENTRY [ 0x00000000`00000000 - 0xfffff807`0fdf8ce0 ]
   +0x448 ForwardLinkShadow : (null) 
   +0x450 StartAddress     : 0xfffff807`0fdf8ce0 Void
   +0x458 TerminationPort  : (null) 
   +0x458 ReaperLink       : (null) 
   +0x458 KeyedWaitValue   : (null) 
   +0x460 ActiveTimerListLock : 0
   +0x468 ActiveTimerListHead : _LIST_ENTRY [ 0x00000000`00000000 - 0x00000000`00000000 ]
   +0x478 Cid              : _CLIENT_ID
   +0x488 KeyedWaitSemaphore : _KSEMAPHORE
   +0x488 AlpcWaitSemaphore : _KSEMAPHORE
   +0x4a8 ClientSecurity   : _PS_CLIENT_SECURITY_CONTEXT
   +0x4b0 IrpList          : _LIST_ENTRY [ 0x00000000`00000000 - 0x00000000`00000000 ]
   +0x4c0 TopLevelIrp      : 0
   +0x4c8 DeviceToVerify   : (null) 
   +0x4d0 Win32StartAddress : 0xfffff807`0fdf8ce0 Void
   +0x4d8 ChargeOnlySession : (null) 
   +0x4e0 LegacyPowerObject : (null) 
   +0x4e8 ThreadListEntry  : _LIST_ENTRY [ 0xffffe600`62472628 - 0xfffff807`10724fe0 ]
   +0x4f8 RundownProtect   : _EX_RUNDOWN_REF
   +0x500 ThreadLock       : _EX_PUSH_LOCK
   +0x508 ReadClusterSize  : 0
   +0x50c MmLockOrdering   : 0n0
   +0x510 CrossThreadFlags : 0x5000
   +0x510 Terminated       : 0y0
   +0x510 ThreadInserted   : 0y0
   +0x510 HideFromDebugger : 0y0
   +0x510 ActiveImpersonationInfo : 0y0
   +0x510 HardErrorsAreDisabled : 0y0
   +0x510 BreakOnTermination : 0y0
   +0x510 SkipCreationMsg  : 0y0
   +0x510 SkipTerminationMsg : 0y0
   +0x510 CopyTokenOnOpen  : 0y0
   +0x510 ThreadIoPriority : 0y000
   +0x510 ThreadPagePriority : 0y101
   +0x510 RundownFail      : 0y0
   +0x510 UmsForceQueueTermination : 0y0
   +0x510 IndirectCpuSets  : 0y0
   +0x510 DisableDynamicCodeOptOut : 0y0
   +0x510 ExplicitCaseSensitivity : 0y0
   +0x510 PicoNotifyExit   : 0y0
   +0x510 DbgWerUserReportActive : 0y0
   +0x510 ForcedSelfTrimActive : 0y0
   +0x510 SamplingCoverage : 0y0
   +0x510 ReservedCrossThreadFlags : 0y00000000 (0)
   +0x514 SameThreadPassiveFlags : 0
   +0x514 ActiveExWorker   : 0y0
   +0x514 MemoryMaker      : 0y0
   +0x514 StoreLockThread  : 0y00
   +0x514 ClonedThread     : 0y0
   +0x514 KeyedEventInUse  : 0y0
   +0x514 SelfTerminate    : 0y0
   +0x514 RespectIoPriority : 0y0
   +0x514 ActivePageLists  : 0y0
   +0x514 SecureContext    : 0y0
   +0x514 ZeroPageThread   : 0y0
   +0x514 WorkloadClass    : 0y0
   +0x514 ReservedSameThreadPassiveFlags : 0y00000000000000000000 (0)
   +0x518 SameThreadApcFlags : 0
   +0x518 OwnsProcessAddressSpaceExclusive : 0y0
   +0x518 OwnsProcessAddressSpaceShared : 0y0
   +0x518 HardFaultBehavior : 0y0
   +0x518 StartAddressInvalid : 0y0
   +0x518 EtwCalloutActive : 0y0
   +0x518 SuppressSymbolLoad : 0y0
   +0x518 Prefetching      : 0y0
   +0x518 OwnsVadExclusive : 0y0
   +0x519 SystemPagePriorityActive : 0y0
   +0x519 SystemPagePriority : 0y000
   +0x519 AllowUserWritesToExecutableMemory : 0y0
   +0x519 AllowKernelWritesToExecutableMemory : 0y0
   +0x519 OwnsVadShared    : 0y0
   +0x51c CacheManagerActive : 0 ''
   +0x51d DisablePageFaultClustering : 0 ''
   +0x51e ActiveFaultCount : 0 ''
   +0x51f LockOrderState   : 0 ''
   +0x520 PerformanceCountLowReserved : 0
   +0x524 PerformanceCountHighReserved : 0n0
   +0x528 AlpcMessageId    : 0
   +0x530 AlpcMessage      : (null) 
   +0x530 AlpcReceiveAttributeSet : 0
   +0x538 AlpcWaitListEntry : _LIST_ENTRY [ 0x00000000`00000000 - 0x00000000`00000000 ]
   +0x548 ExitStatus       : 0n0
   +0x54c CacheManagerCount : 0
   +0x550 IoBoostCount     : 0
   +0x554 IoQoSBoostCount  : 0
   +0x558 IoQoSThrottleCount : 0
   +0x55c KernelStackReference : 0
   +0x560 BoostList        : _LIST_ENTRY [ 0xfffff807`10727b60 - 0xfffff807`10727b60 ]
   +0x570 DeboostList      : _LIST_ENTRY [ 0xfffff807`10727b70 - 0xfffff807`10727b70 ]
   +0x580 BoostListLock    : 0
   +0x588 IrpListLock      : 0
   +0x590 ReservedForSynchTracking : (null) 
   +0x598 CmCallbackListHead : _SINGLE_LIST_ENTRY
   +0x5a0 ActivityId       : (null) 
   +0x5a8 SeLearningModeListHead : _SINGLE_LIST_ENTRY
   +0x5b0 VerifierContext  : (null) 
   +0x5b8 AdjustedClientToken : (null) 
   +0x5c0 WorkOnBehalfThread : (null) 
   +0x5c8 PropertySet      : _PS_PROPERTY_SET
   +0x5e0 PicoContext      : (null) 
   +0x5e8 UserFsBase       : 0
   +0x5f0 UserGsBase       : 0
   +0x5f8 EnergyValues     : (null) 
   +0x600 SelectedCpuSets  : 0
   +0x600 SelectedCpuSetsIndirect : (null) 
   +0x608 Silo             : (null) 
   +0x610 ThreadName       : (null) 
   +0x618 SetContextState  : (null) 
   +0x620 LastExpectedRunTime : 0
   +0x624 HeapData         : 0x98c90000
   +0x628 OwnerEntryListHead : _LIST_ENTRY [ 0x00000000`00000000 - 0x00000000`00000000 ]
   +0x638 DisownedOwnerEntryListLock : 0
   +0x640 DisownedOwnerEntryListHead : _LIST_ENTRY [ 0x00000000`00000000 - 0x00000000`00000000 ]
   +0x650 LockEntries      : [6] _KLOCK_ENTRY
   +0x890 CmDbgInfo        : (null)

第一个成员KTHREAD结构为：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
0: kd> dt _KTHREAD
ntdll!_KTHREAD
   +0x000 Header           : _DISPATCHER_HEADER
   +0x018 SListFaultAddress : Ptr64 Void
   +0x020 QuantumTarget    : Uint8B
   +0x028 InitialStack     : Ptr64 Void
   +0x030 StackLimit       : Ptr64 Void
   +0x038 StackBase        : Ptr64 Void
   +0x040 ThreadLock       : Uint8B
   +0x048 CycleTime        : Uint8B
   +0x050 CurrentRunTime   : Uint4B
   +0x054 ExpectedRunTime  : Uint4B
   +0x058 KernelStack      : Ptr64 Void
   +0x060 StateSaveArea    : Ptr64 _XSAVE_FORMAT
   +0x068 SchedulingGroup  : Ptr64 _KSCHEDULING_GROUP
   +0x070 WaitRegister     : _KWAIT_STATUS_REGISTER
   +0x071 Running          : UChar
   +0x072 Alerted          : [2] UChar
   +0x074 AutoBoostActive  : Pos 0, 1 Bit
   +0x074 ReadyTransition  : Pos 1, 1 Bit
   +0x074 WaitNext         : Pos 2, 1 Bit
   +0x074 SystemAffinityActive : Pos 3, 1 Bit
   +0x074 Alertable        : Pos 4, 1 Bit
   +0x074 UserStackWalkActive : Pos 5, 1 Bit
   +0x074 ApcInterruptRequest : Pos 6, 1 Bit
   +0x074 QuantumEndMigrate : Pos 7, 1 Bit
   +0x074 UmsDirectedSwitchEnable : Pos 8, 1 Bit
   +0x074 TimerActive      : Pos 9, 1 Bit
   +0x074 SystemThread     : Pos 10, 1 Bit
   +0x074 ProcessDetachActive : Pos 11, 1 Bit
   +0x074 CalloutActive    : Pos 12, 1 Bit
   +0x074 ScbReadyQueue    : Pos 13, 1 Bit
   +0x074 ApcQueueable     : Pos 14, 1 Bit
   +0x074 ReservedStackInUse : Pos 15, 1 Bit
   +0x074 UmsPerformingSyscall : Pos 16, 1 Bit
   +0x074 TimerSuspended   : Pos 17, 1 Bit
   +0x074 SuspendedWaitMode : Pos 18, 1 Bit
   +0x074 SuspendSchedulerApcWait : Pos 19, 1 Bit
   +0x074 CetUserShadowStack : Pos 20, 1 Bit
   +0x074 BypassProcessFreeze : Pos 21, 1 Bit
   +0x074 Reserved         : Pos 22, 10 Bits
   +0x074 MiscFlags        : Int4B
   +0x078 ThreadFlagsSpare : Pos 0, 2 Bits
   +0x078 AutoAlignment    : Pos 2, 1 Bit
   +0x078 DisableBoost     : Pos 3, 1 Bit
   +0x078 AlertedByThreadId : Pos 4, 1 Bit
   +0x078 QuantumDonation  : Pos 5, 1 Bit
   +0x078 EnableStackSwap  : Pos 6, 1 Bit
   +0x078 GuiThread        : Pos 7, 1 Bit
   +0x078 DisableQuantum   : Pos 8, 1 Bit
   +0x078 ChargeOnlySchedulingGroup : Pos 9, 1 Bit
   +0x078 DeferPreemption  : Pos 10, 1 Bit
   +0x078 QueueDeferPreemption : Pos 11, 1 Bit
   +0x078 ForceDeferSchedule : Pos 12, 1 Bit
   +0x078 SharedReadyQueueAffinity : Pos 13, 1 Bit
   +0x078 FreezeCount      : Pos 14, 1 Bit
   +0x078 TerminationApcRequest : Pos 15, 1 Bit
   +0x078 AutoBoostEntriesExhausted : Pos 16, 1 Bit
   +0x078 KernelStackResident : Pos 17, 1 Bit
   +0x078 TerminateRequestReason : Pos 18, 2 Bits
   +0x078 ProcessStackCountDecremented : Pos 20, 1 Bit
   +0x078 RestrictedGuiThread : Pos 21, 1 Bit
   +0x078 VpBackingThread  : Pos 22, 1 Bit
   +0x078 ThreadFlagsSpare2 : Pos 23, 1 Bit
   +0x078 EtwStackTraceApcInserted : Pos 24, 8 Bits
   +0x078 ThreadFlags      : Int4B
   +0x07c Tag              : UChar
   +0x07d SystemHeteroCpuPolicy : UChar
   +0x07e UserHeteroCpuPolicy : Pos 0, 7 Bits
   +0x07e ExplicitSystemHeteroCpuPolicy : Pos 7, 1 Bit
   +0x07f Spare0           : UChar
   +0x080 SystemCallNumber : Uint4B
   +0x084 ReadyTime        : Uint4B
   +0x088 FirstArgument    : Ptr64 Void
   +0x090 TrapFrame        : Ptr64 _KTRAP_FRAME
   +0x098 ApcState         : _KAPC_STATE
   +0x098 ApcStateFill     : [43] UChar
   +0x0c3 Priority         : Char
   +0x0c4 UserIdealProcessor : Uint4B
   +0x0c8 WaitStatus       : Int8B
   +0x0d0 WaitBlockList    : Ptr64 _KWAIT_BLOCK
   +0x0d8 WaitListEntry    : _LIST_ENTRY
   +0x0d8 SwapListEntry    : _SINGLE_LIST_ENTRY
   +0x0e8 Queue            : Ptr64 _DISPATCHER_HEADER
   +0x0f0 Teb              : Ptr64 Void
   +0x0f8 RelativeTimerBias : Uint8B
   +0x100 Timer            : _KTIMER
   +0x140 WaitBlock        : [4] _KWAIT_BLOCK
   +0x140 WaitBlockFill4   : [20] UChar
   +0x154 ContextSwitches  : Uint4B
   +0x140 WaitBlockFill5   : [68] UChar
   +0x184 State            : UChar //线程状态
   +0x185 Spare13          : Char
   +0x186 WaitIrql         : UChar
   +0x187 WaitMode         : Char
   +0x140 WaitBlockFill6   : [116] UChar
   +0x1b4 WaitTime         : Uint4B
   +0x140 WaitBlockFill7   : [164] UChar
   +0x1e4 KernelApcDisable : Int2B
   +0x1e6 SpecialApcDisable : Int2B
   +0x1e4 CombinedApcDisable : Uint4B
   +0x140 WaitBlockFill8   : [40] UChar
   +0x168 ThreadCounters   : Ptr64 _KTHREAD_COUNTERS
   +0x140 WaitBlockFill9   : [88] UChar
   +0x198 XStateSave       : Ptr64 _XSTATE_SAVE
   +0x140 WaitBlockFill10  : [136] UChar
   +0x1c8 Win32Thread      : Ptr64 Void
   +0x140 WaitBlockFill11  : [176] UChar
   +0x1f0 Ucb              : Ptr64 _UMS_CONTROL_BLOCK
   +0x1f8 Uch              : Ptr64 _KUMS_CONTEXT_HEADER
   +0x200 ThreadFlags2     : Int4B
   +0x200 BamQosLevel      : Pos 0, 8 Bits
   +0x200 ThreadFlags2Reserved : Pos 8, 24 Bits
   +0x204 Spare21          : Uint4B
   +0x208 QueueListEntry   : _LIST_ENTRY
   +0x218 NextProcessor    : Uint4B
   +0x218 NextProcessorNumber : Pos 0, 31 Bits
   +0x218 SharedReadyQueue : Pos 31, 1 Bit
   +0x21c QueuePriority    : Int4B
   +0x220 Process          : Ptr64 _KPROCESS
   +0x228 UserAffinity     : _GROUP_AFFINITY
   +0x228 UserAffinityFill : [10] UChar
   +0x232 PreviousMode     : Char
   +0x233 BasePriority     : Char
   +0x234 PriorityDecrement : Char
   +0x234 ForegroundBoost  : Pos 0, 4 Bits
   +0x234 UnusualBoost     : Pos 4, 4 Bits
   +0x235 Preempted        : UChar
   +0x236 AdjustReason     : UChar
   +0x237 AdjustIncrement  : Char
   +0x238 AffinityVersion  : Uint8B
   +0x240 Affinity         : _GROUP_AFFINITY
   +0x240 AffinityFill     : [10] UChar
   +0x24a ApcStateIndex    : UChar
   +0x24b WaitBlockCount   : UChar
   +0x24c IdealProcessor   : Uint4B
   +0x250 NpxState         : Uint8B
   +0x258 SavedApcState    : _KAPC_STATE
   +0x258 SavedApcStateFill : [43] UChar
   +0x283 WaitReason       : UChar
   +0x284 SuspendCount     : Char
   +0x285 Saturation       : Char
   +0x286 SListFaultCount  : Uint2B
   +0x288 SchedulerApc     : _KAPC
   +0x288 SchedulerApcFill0 : [1] UChar
   +0x289 ResourceIndex    : UChar
   +0x288 SchedulerApcFill1 : [3] UChar
   +0x28b QuantumReset     : UChar
   +0x288 SchedulerApcFill2 : [4] UChar
   +0x28c KernelTime       : Uint4B
   +0x288 SchedulerApcFill3 : [64] UChar
   +0x2c8 WaitPrcb         : Ptr64 _KPRCB
   +0x288 SchedulerApcFill4 : [72] UChar
   +0x2d0 LegoData         : Ptr64 Void
   +0x288 SchedulerApcFill5 : [83] UChar
   +0x2db CallbackNestingLevel : UChar
   +0x2dc UserTime         : Uint4B
   +0x2e0 SuspendEvent     : _KEVENT
   +0x2f8 ThreadListEntry  : _LIST_ENTRY
   +0x308 MutantListHead   : _LIST_ENTRY
   +0x318 AbEntrySummary   : UChar
   +0x319 AbWaitEntryCount : UChar
   +0x31a AbAllocationRegionCount : UChar
   +0x31b SystemPriority   : Char
   +0x31c SecureThreadCookie : Uint4B
   +0x320 LockEntries      : Ptr64 _KLOCK_ENTRY
   +0x328 PropagateBoostsEntry : _SINGLE_LIST_ENTRY
   +0x330 IoSelfBoostsEntry : _SINGLE_LIST_ENTRY
   +0x338 PriorityFloorCounts : [16] UChar
   +0x348 PriorityFloorCountsReserved : [16] UChar
   +0x358 PriorityFloorSummary : Uint4B
   +0x35c AbCompletedIoBoostCount : Int4B
   +0x360 AbCompletedIoQoSBoostCount : Int4B
   +0x364 KeReferenceCount : Int2B
   +0x366 AbOrphanedEntrySummary : UChar
   +0x367 AbOwnedEntryCount : UChar
   +0x368 ForegroundLossTime : Uint4B
   +0x370 GlobalForegroundListEntry : _LIST_ENTRY
   +0x370 ForegroundDpcStackListEntry : _SINGLE_LIST_ENTRY
   +0x378 InGlobalForegroundList : Uint8B
   +0x380 ReadOperationCount : Int8B
   +0x388 WriteOperationCount : Int8B
   +0x390 OtherOperationCount : Int8B
   +0x398 ReadTransferCount : Int8B
   +0x3a0 WriteTransferCount : Int8B
   +0x3a8 OtherTransferCount : Int8B
   +0x3b0 QueuedScb        : Ptr64 _KSCB
   +0x3b8 ThreadTimerDelay : Uint4B
   +0x3bc ThreadFlags3     : Int4B
   +0x3bc ThreadFlags3Reserved : Pos 0, 8 Bits
   +0x3bc PpmPolicy        : Pos 8, 2 Bits
   +0x3bc ThreadFlags3Reserved2 : Pos 10, 22 Bits
   +0x3c0 TracingPrivate   : [1] Uint8B
   +0x3c8 SchedulerAssist  : Ptr64 Void
   +0x3d0 AbWaitObject     : Ptr64 Void
   +0x3d8 ReservedPreviousReadyTimeValue : Uint4B
   +0x3e0 KernelWaitTime   : Uint8B
   +0x3e8 UserWaitTime     : Uint8B
   +0x3f0 GlobalUpdateVpThreadPriorityListEntry : _LIST_ENTRY
   +0x3f0 UpdateVpThreadPriorityDpcStackListEntry : _SINGLE_LIST_ENTRY
   +0x3f8 InGlobalUpdateVpThreadPriorityList : Uint8B
   +0x400 SchedulerAssistPriorityFloor : Int4B
   +0x404 Spare28          : Uint4B
   +0x408 EndPadding       : [5] Uint8B

上述State状态有：

状态 值 含义 可转换到的状态
Initialized 0 正在创建和初始化 DeferredReady
Ready 1 就绪，可被分发调度运行 Running
Running 2 正在某个CPU上运行 Waiting、Terminated
Standby 3 待命，即下一个要执行的线程 Running、DeferredReady、被抢先Preempt
Terminated 4 结束执行
Waiting 5 等待，如睡眠函数、取消息函数、等待同步对象等，主动放弃执行机会 Transition、DeferredReady、Running
Transition 6 过渡状态，线程已可以运行但内核栈被交换出内存，交换回后进入Standby DeferredReady
DeferredReady 7 延迟就绪，为缩短扫描调度数据库加锁时间，内核把就绪线程设置为次状态 Ready
Gate Wait 8 门状态，等待门分发器对象时进入

上述WaitReason为KWAIT_REASON枚举类型，常见如下：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
1: kd> dt _KWAIT_REASON
nt!_KWAIT_REASON
   Executive = 0n0 //驱动程序调用等待函数时
   FreePage = 0n1 //等待空闲页
   PageIn = 0n2 //等待把交换处的内存页换回
   PoolAllocation = 0n3
   DelayExecution = 0n4 //延迟执行 一般Sleep或NtDelayExecution
   Suspended = 0n5 //线程被挂起
   UserRequest = 0n6 //驱动程序代表应用代码调用等待函数
   WrExecutive = 0n7 //LPC函数用这个常量调用等待函数
   WrFreePage = 0n8 //等待空闲页
   WrPageIn = 0n9 //等待交换出去的内存页换回内存
   WrPoolAllocation = 0n10 //内核池有关
   WrDelayExecution = 0n11 //同DelayExecution
   WrSuspended = 0n12 //同Suspended
   WrUserRequest = 0n13 //同UserRequest
   WrEventPair = 0n14 //服务端和客户端使用一对时间对象时 用此常量调用等待函数
   WrQueue = 0n15 //等待队列对象
   WrLpcReceive = 0n16 //LPC通信时 为接收数据而等待对方发送
   WrLpcReply = 0n17 //LPC通信时 为发送数据而等待对方接收
   WrVirtualMemory = 0n18 //内存管理器用这个函数调用等待函数
   WrPageOut = 0n19 //内存管理器冲洗缓冲区并把内存中数据写入磁盘时用此常量调用等待函数
   WrRendezvous = 0n20
   WrKeyedEvent = 0n21
   WrTerminated = 0n22
   WrProcessInSwap = 0n23
   WrCpuRateControl = 0n24
   WrCalloutStack = 0n25
   WrKernel = 0n26
   WrResource = 0n27
   WrPushLock = 0n28
   WrMutex = 0n29 //等待互斥量
   WrQuantumEnd = 0n30 //时间片用完
   WrDispatchInt = 0n31
   WrPreempted = 0n32 //被剥夺执行权
   WrYieldExecution = 0n33 //主动放弃执行权
   WrFastMutex = 0n34 //等待高速互斥量
   WrGuardedMutex = 0n35 //等待保护互斥量
   WrRundown = 0n36
   WrAlertByThreadId = 0n37
   WrDeferredPreempt = 0n38
   WrPhysicalFault = 0n39
   MaximumWaitReason = 0n40 //最大有效值

每个CPU有一个处理器控制块PRCB，

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
1: kd> dt _KPRCB
ntdll!_KPRCB
   +0x000 MxCsr            : Uint4B
   +0x004 LegacyNumber     : UChar
   +0x005 ReservedMustBeZero : UChar
   +0x006 InterruptRequest : UChar
   +0x007 IdleHalt         : UChar
   +0x008 CurrentThread    : Ptr64 _KTHREAD
   +0x010 NextThread       : Ptr64 _KTHREAD
   +0x018 IdleThread       : Ptr64 _KTHREAD
   +0x020 NestingLevel     : UChar
   +0x021 ClockOwner       : UChar
   +0x022 PendingTickFlags : UChar
   +0x022 PendingTick      : Pos 0, 1 Bit
   +0x022 PendingBackupTick : Pos 1, 1 Bit
   +0x023 IdleState        : UChar
   +0x024 Number           : Uint4B
   +0x028 RspBase          : Uint8B
   +0x030 PrcbLock         : Uint8B
   +0x038 PriorityState    : Ptr64 Char
   +0x040 CpuType          : Char
   +0x041 CpuID            : Char
   +0x042 CpuStep          : Uint2B
   +0x042 CpuStepping      : UChar
   +0x043 CpuModel         : UChar
   +0x044 MHz              : Uint4B
   +0x048 HalReserved      : [8] Uint8B
   +0x088 MinorVersion     : Uint2B
   +0x08a MajorVersion     : Uint2B
   +0x08c BuildType        : UChar
   +0x08d CpuVendor        : UChar
   +0x08e CoresPerPhysicalProcessor : UChar
   +0x08f LogicalProcessorsPerCore : UChar
   +0x090 TscFrequency     : Uint8B
   +0x098 PrcbPad04        : [5] Uint8B
   +0x0c0 ParentNode       : Ptr64 _KNODE
   +0x0c8 GroupSetMember   : Uint8B
   +0x0d0 Group            : UChar
   +0x0d1 GroupIndex       : UChar
   +0x0d2 PrcbPad05        : [2] UChar
   +0x0d4 InitialApicId    : Uint4B
   +0x0d8 ScbOffset        : Uint4B
   +0x0dc ApicMask         : Uint4B
   +0x0e0 AcpiReserved     : Ptr64 Void
   +0x0e8 CFlushSize       : Uint4B
   +0x0ec PrcbFlags        : _KPRCBFLAG
   +0x0f0 TrappedSecurityDomain : Uint8B
   +0x0f8 BpbState         : UChar
   +0x0f8 BpbCpuIdle       : Pos 0, 1 Bit
   +0x0f8 BpbFlushRsbOnTrap : Pos 1, 1 Bit
   +0x0f8 BpbIbpbOnReturn  : Pos 2, 1 Bit
   +0x0f8 BpbIbpbOnTrap    : Pos 3, 1 Bit
   +0x0f8 BpbIbpbOnRetpolineExit : Pos 4, 1 Bit
   +0x0f8 BpbStateReserved : Pos 5, 3 Bits
   +0x0f9 BpbFeatures      : UChar
   +0x0f9 BpbClearOnIdle   : Pos 0, 1 Bit
   +0x0f9 BpbEnabled       : Pos 1, 1 Bit
   +0x0f9 BpbSmep          : Pos 2, 1 Bit
   +0x0f9 BpbFeaturesReserved : Pos 3, 5 Bits
   +0x0fa BpbCurrentSpecCtrl : UChar
   +0x0fb BpbKernelSpecCtrl : UChar
   +0x0fc BpbNmiSpecCtrl   : UChar
   +0x0fd BpbUserSpecCtrl  : UChar
   +0x0fe PairRegister     : Int2B
   +0x0f0 PrcbPad11        : [2] Uint8B
   +0x100 ProcessorState   : _KPROCESSOR_STATE
   +0x6c0 ExtendedSupervisorState : Ptr64 _XSAVE_AREA_HEADER
   +0x6c8 ProcessorSignature : Uint4B
   +0x6cc ProcessorFlags   : Uint4B
   +0x6d0 BpbRetpolineExitSpecCtrl : UChar
   +0x6d1 BpbTrappedRetpolineExitSpecCtrl : UChar
   +0x6d2 BpbTrappedBpbState : UChar
   +0x6d2 BpbTrappedCpuIdle : Pos 0, 1 Bit
   +0x6d2 BpbTrappedFlushRsbOnTrap : Pos 1, 1 Bit
   +0x6d2 BpbTrappedIbpbOnReturn : Pos 2, 1 Bit
   +0x6d2 BpbTrappedIbpbOnTrap : Pos 3, 1 Bit
   +0x6d2 BpbTrappedIbpbOnRetpolineExit : Pos 4, 1 Bit
   +0x6d2 BpbtrappedBpbStateReserved : Pos 5, 3 Bits
   +0x6d3 BpbRetpolineState : UChar
   +0x6d3 BpbRunningNonRetpolineCode : Pos 0, 1 Bit
   +0x6d3 BpbIndirectCallsSafe : Pos 1, 1 Bit
   +0x6d3 BpbRetpolineEnabled : Pos 2, 1 Bit
   +0x6d3 BpbRetpolineStateReserved : Pos 3, 5 Bits
   +0x6d4 PrcbPad12b       : Uint4B
   +0x6d0 PrcbPad12a       : Uint8B
   +0x6d8 PrcbPad12        : [3] Uint8B
   +0x6f0 LockQueue        : [17] _KSPIN_LOCK_QUEUE
   +0x800 PPLookasideList  : [16] _PP_LOOKASIDE_LIST
   +0x900 PPNxPagedLookasideList : [32] _GENERAL_LOOKASIDE_POOL
   +0x1500 PPNPagedLookasideList : [32] _GENERAL_LOOKASIDE_POOL
   +0x2100 PPPagedLookasideList : [32] _GENERAL_LOOKASIDE_POOL
   +0x2d00 PrcbPad20        : Uint8B
   +0x2d08 DeferredReadyListHead : _SINGLE_LIST_ENTRY
   +0x2d10 MmPageFaultCount : Int4B
   +0x2d14 MmCopyOnWriteCount : Int4B
   +0x2d18 MmTransitionCount : Int4B
   +0x2d1c MmDemandZeroCount : Int4B
   +0x2d20 MmPageReadCount  : Int4B
   +0x2d24 MmPageReadIoCount : Int4B
   +0x2d28 MmDirtyPagesWriteCount : Int4B
   +0x2d2c MmDirtyWriteIoCount : Int4B
   +0x2d30 MmMappedPagesWriteCount : Int4B
   +0x2d34 MmMappedWriteIoCount : Int4B
   +0x2d38 KeSystemCalls    : Uint4B
   +0x2d3c KeContextSwitches : Uint4B
   +0x2d40 PrcbPad40        : Uint4B
   +0x2d44 CcFastReadNoWait : Uint4B
   +0x2d48 CcFastReadWait   : Uint4B
   +0x2d4c CcFastReadNotPossible : Uint4B
   +0x2d50 CcCopyReadNoWait : Uint4B
   +0x2d54 CcCopyReadWait   : Uint4B
   +0x2d58 CcCopyReadNoWaitMiss : Uint4B
   +0x2d5c IoReadOperationCount : Int4B
   +0x2d60 IoWriteOperationCount : Int4B
   +0x2d64 IoOtherOperationCount : Int4B
   +0x2d68 IoReadTransferCount : _LARGE_INTEGER
   +0x2d70 IoWriteTransferCount : _LARGE_INTEGER
   +0x2d78 IoOtherTransferCount : _LARGE_INTEGER
   +0x2d80 PacketBarrier    : Int4B
   +0x2d84 TargetCount      : Int4B
   +0x2d88 IpiFrozen        : Uint4B
   +0x2d8c PrcbPad30        : Uint4B
   +0x2d90 IsrDpcStats      : Ptr64 Void
   +0x2d98 DeviceInterrupts : Uint4B
   +0x2d9c LookasideIrpFloat : Int4B
   +0x2da0 InterruptLastCount : Uint4B
   +0x2da4 InterruptRate    : Uint4B
   +0x2da8 PrcbPad31        : Uint8B
   +0x2db0 PairPrcb         : Ptr64 _KPRCB
   +0x2db8 StaticAffinity   : _KSTATIC_AFFINITY_BLOCK
   +0x3058 PrcbPad35        : [5] Uint8B
   +0x3080 InterruptObjectPool : _SLIST_HEADER
   +0x3090 DpcRuntimeHistoryHashTable : Ptr64 _RTL_HASH_TABLE
   +0x3098 DpcRuntimeHistoryHashTableCleanupDpc : Ptr64 _KDPC
   +0x30a0 CurrentDpcRoutine : Ptr64     void 
   +0x30a8 CurrentDpcRuntimeHistoryCached : Uint8B
   +0x30b0 CurrentDpcStartTime : Uint8B
   +0x30b8 PrcbPad41        : [1] Uint8B
   +0x30c0 DpcData          : [2] _KDPC_DATA
   +0x3110 DpcStack         : Ptr64 Void
   +0x3118 MaximumDpcQueueDepth : Int4B
   +0x311c DpcRequestRate   : Uint4B
   +0x3120 MinimumDpcRate   : Uint4B
   +0x3124 DpcLastCount     : Uint4B
   +0x3128 ThreadDpcEnable  : UChar
   +0x3129 QuantumEnd       : UChar
   +0x312a DpcRoutineActive : UChar
   +0x312b IdleSchedule     : UChar
   +0x312c DpcRequestSummary : Int4B
   +0x312c DpcRequestSlot   : [2] Int2B
   +0x312c NormalDpcState   : Int2B
   +0x312e ThreadDpcState   : Int2B
   +0x312c DpcNormalProcessingActive : Pos 0, 1 Bit
   +0x312c DpcNormalProcessingRequested : Pos 1, 1 Bit
   +0x312c DpcNormalThreadSignal : Pos 2, 1 Bit
   +0x312c DpcNormalTimerExpiration : Pos 3, 1 Bit
   +0x312c DpcNormalDpcPresent : Pos 4, 1 Bit
   +0x312c DpcNormalLocalInterrupt : Pos 5, 1 Bit
   +0x312c DpcNormalSpare   : Pos 6, 10 Bits
   +0x312c DpcThreadActive  : Pos 16, 1 Bit
   +0x312c DpcThreadRequested : Pos 17, 1 Bit
   +0x312c DpcThreadSpare   : Pos 18, 14 Bits
   +0x3130 PrcbPad93        : Uint4B
   +0x3134 LastTick         : Uint4B
   +0x3138 ClockInterrupts  : Uint4B
   +0x313c ReadyScanTick    : Uint4B
   +0x3140 InterruptObject  : [256] Ptr64 Void
   +0x3940 TimerTable       : _KTIMER_TABLE
   +0x7b58 PrcbPad92        : [10] Uint4B
   +0x7b80 DpcGate          : _KGATE
   +0x7b98 PrcbPad52        : Ptr64 Void
   +0x7ba0 CallDpc          : _KDPC
   +0x7be0 ClockKeepAlive   : Int4B
   +0x7be4 PrcbPad60        : [2] UChar
   +0x7be6 NmiActive        : UChar
   +0x7be7 MceActive        : UChar
   +0x7be6 CombinedNmiMceActive : Uint2B
   +0x7be8 DpcWatchdogPeriod : Int4B
   +0x7bec DpcWatchdogCount : Int4B
   +0x7bf0 KeSpinLockOrdering : Int4B
   +0x7bf4 DpcWatchdogProfileCumulativeDpcThreshold : Uint4B
   +0x7bf8 CachedPtes       : Ptr64 Void
   +0x7c00 WaitListHead     : _LIST_ENTRY
   +0x7c10 WaitLock         : Uint8B
   +0x7c18 ReadySummary     : Uint4B
   +0x7c1c AffinitizedSelectionMask : Int4B
   +0x7c20 QueueIndex       : Uint4B
   +0x7c24 PrcbPad75        : [2] Uint4B
   +0x7c2c DpcWatchdogSequenceNumber : Uint4B
   +0x7c30 TimerExpirationDpc : _KDPC
   +0x7c70 ScbQueue         : _RTL_RB_TREE
   +0x7c80 DispatcherReadyListHead : [32] _LIST_ENTRY //每个优先级对应的就绪线程
   +0x7e80 InterruptCount   : Uint4B
   +0x7e84 KernelTime       : Uint4B
   +0x7e88 UserTime         : Uint4B
   +0x7e8c DpcTime          : Uint4B
   +0x7e90 InterruptTime    : Uint4B
   +0x7e94 AdjustDpcThreshold : Uint4B
   +0x7e98 DebuggerSavedIRQL : UChar
   +0x7e99 GroupSchedulingOverQuota : UChar
   +0x7e9a DeepSleep        : UChar
   +0x7e9b PrcbPad80        : UChar
   +0x7e9c DpcTimeCount     : Uint4B
   +0x7ea0 DpcTimeLimit     : Uint4B
   +0x7ea4 PeriodicCount    : Uint4B
   +0x7ea8 PeriodicBias     : Uint4B
   +0x7eac AvailableTime    : Uint4B
   +0x7eb0 KeExceptionDispatchCount : Uint4B
   +0x7eb4 ReadyThreadCount : Uint4B
   +0x7eb8 ReadyQueueExpectedRunTime : Uint8B
   +0x7ec0 StartCycles      : Uint8B
   +0x7ec8 TaggedCyclesStart : Uint8B
   +0x7ed0 TaggedCycles     : [3] Uint8B
   +0x7ee8 AffinitizedCycles : Uint8B
   +0x7ef0 ImportantCycles  : Uint8B
   +0x7ef8 UnimportantCycles : Uint8B
   +0x7f00 DpcWatchdogProfileSingleDpcThreshold : Uint4B
   +0x7f04 MmSpinLockOrdering : Int4B
   +0x7f08 CachedStack      : Ptr64 Void
   +0x7f10 PageColor        : Uint4B
   +0x7f14 NodeColor        : Uint4B
   +0x7f18 NodeShiftedColor : Uint4B
   +0x7f1c SecondaryColorMask : Uint4B
   +0x7f20 PrcbPad81        : [6] UChar
   +0x7f26 ExceptionStackActive : UChar
   +0x7f27 TbFlushListActive : UChar
   +0x7f28 ExceptionStack   : Ptr64 Void
   +0x7f30 PrcbPad82        : [1] Uint8B
   +0x7f38 CycleTime        : Uint8B
   +0x7f40 Cycles           : [4] [2] Uint8B
   +0x7f80 CcFastMdlReadNoWait : Uint4B
   +0x7f84 CcFastMdlReadWait : Uint4B
   +0x7f88 CcFastMdlReadNotPossible : Uint4B
   +0x7f8c CcMapDataNoWait  : Uint4B
   +0x7f90 CcMapDataWait    : Uint4B
   +0x7f94 CcPinMappedDataCount : Uint4B
   +0x7f98 CcPinReadNoWait  : Uint4B
   +0x7f9c CcPinReadWait    : Uint4B
   +0x7fa0 CcMdlReadNoWait  : Uint4B
   +0x7fa4 CcMdlReadWait    : Uint4B
   +0x7fa8 CcLazyWriteHotSpots : Uint4B
   +0x7fac CcLazyWriteIos   : Uint4B
   +0x7fb0 CcLazyWritePages : Uint4B
   +0x7fb4 CcDataFlushes    : Uint4B
   +0x7fb8 CcDataPages      : Uint4B
   +0x7fbc CcLostDelayedWrites : Uint4B
   +0x7fc0 CcFastReadResourceMiss : Uint4B
   +0x7fc4 CcCopyReadWaitMiss : Uint4B
   +0x7fc8 CcFastMdlReadResourceMiss : Uint4B
   +0x7fcc CcMapDataNoWaitMiss : Uint4B
   +0x7fd0 CcMapDataWaitMiss : Uint4B
   +0x7fd4 CcPinReadNoWaitMiss : Uint4B
   +0x7fd8 CcPinReadWaitMiss : Uint4B
   +0x7fdc CcMdlReadNoWaitMiss : Uint4B
   +0x7fe0 CcMdlReadWaitMiss : Uint4B
   +0x7fe4 CcReadAheadIos   : Uint4B
   +0x7fe8 MmCacheTransitionCount : Int4B
   +0x7fec MmCacheReadCount : Int4B
   +0x7ff0 MmCacheIoCount   : Int4B
   +0x7ff4 PrcbPad91        : Uint4B
   +0x7ff8 MmInternal       : Ptr64 Void
   +0x8000 PowerState       : _PROCESSOR_POWER_STATE
   +0x8200 HyperPte         : Ptr64 Void
   +0x8208 ScbList          : _LIST_ENTRY
   +0x8218 ForceIdleDpc     : _KDPC
   +0x8258 DpcWatchdogDpc   : _KDPC
   +0x8298 DpcWatchdogTimer : _KTIMER
   +0x82d8 Cache            : [5] _CACHE_DESCRIPTOR
   +0x8314 CacheCount       : Uint4B
   +0x8318 CachedCommit     : Uint4B
   +0x831c CachedResidentAvailable : Uint4B
   +0x8320 WheaInfo         : Ptr64 Void
   +0x8328 EtwSupport       : Ptr64 Void
   +0x8330 ExSaPageArray    : Ptr64 Void
   +0x8338 KeAlignmentFixupCount : Uint4B
   +0x833c PrcbPad95        : Uint4B
   +0x8340 HypercallPageList : _SLIST_HEADER
   +0x8350 StatisticsPage   : Ptr64 Uint8B
   +0x8358 GenerationTarget : Uint8B
   +0x8360 PrcbPad85        : [4] Uint8B
   +0x8380 HypercallCachedPages : Ptr64 Void
   +0x8388 VirtualApicAssist : Ptr64 Void
   +0x8390 PackageProcessorSet : _KAFFINITY_EX
   +0x8438 PackageId        : Uint4B
   +0x843c PrcbPad86        : Uint4B
   +0x8440 SharedReadyQueueMask : Uint8B
   +0x8448 SharedReadyQueue : Ptr64 _KSHARED_READY_QUEUE
   +0x8450 SharedQueueScanOwner : Uint4B
   +0x8454 ScanSiblingIndex : Uint4B
   +0x8458 CoreProcessorSet : Uint8B
   +0x8460 ScanSiblingMask  : Uint8B
   +0x8468 LLCMask          : Uint8B
   +0x8470 CacheProcessorMask : [5] Uint8B
   +0x8498 ProcessorProfileControlArea : Ptr64 _PROCESSOR_PROFILE_CONTROL_AREA
   +0x84a0 ProfileEventIndexAddress : Ptr64 Void
   +0x84a8 DpcWatchdogProfile : Ptr64 Ptr64 Void
   +0x84b0 DpcWatchdogProfileCurrentEmptyCapture : Ptr64 Ptr64 Void
   +0x84b8 SchedulerAssist  : Ptr64 Void
   +0x84c0 SynchCounters    : _SYNCH_COUNTERS
   +0x8578 PrcbPad94        : Uint8B
   +0x8580 FsCounters       : _FILESYSTEM_DISK_COUNTERS
   +0x8590 VendorString     : [13] UChar
   +0x859d PrcbPad100       : [3] UChar
   +0x85a0 FeatureBits      : Uint8B
   +0x85a8 UpdateSignature  : _LARGE_INTEGER
   +0x85b0 PteBitCache      : Uint8B
   +0x85b8 PteBitOffset     : Uint4B
   +0x85bc PrcbPad105       : Uint4B
   +0x85c0 Context          : Ptr64 _CONTEXT
   +0x85c8 ContextFlagsInit : Uint4B
   +0x85cc PrcbPad115       : Uint4B
   +0x85d0 ExtendedState    : Ptr64 _XSAVE_AREA
   +0x85d8 IsrStack         : Ptr64 Void
   +0x85e0 EntropyTimingState : _KENTROPY_TIMING_STATE
   +0x8730 PrcbPad110       : Uint8B
   +0x8738 StibpPairingTrace : <anonymous-tag>
   +0x8770 AbSelfIoBoostsList : _SINGLE_LIST_ENTRY
   +0x8778 AbPropagateBoostsList : _SINGLE_LIST_ENTRY
   +0x8780 AbDpc            : _KDPC
   +0x87c0 IoIrpStackProfilerCurrent : _IOP_IRP_STACK_PROFILER
   +0x8814 IoIrpStackProfilerPrevious : _IOP_IRP_STACK_PROFILER
   +0x8868 SecureFault      : _KSECURE_FAULT_INFORMATION
   +0x8878 PrcbPad120       : Uint8B
   +0x8880 LocalSharedReadyQueue : _KSHARED_READY_QUEUE
   +0x8af0 PrcbPad125       : [2] Uint8B
   +0x8b00 TimerExpirationTraceCount : Uint4B
   +0x8b04 PrcbPad127       : Uint4B
   +0x8b08 TimerExpirationTrace : [16] _KTIMER_EXPIRATION_TRACE
   +0x8c08 PrcbPad128       : [7] Uint8B
   +0x8c40 Mailbox          : Ptr64 _REQUEST_MAILBOX
   +0x8c48 PrcbPad130       : [7] Uint8B
   +0x8c80 McheckContext    : [2] _MACHINE_CHECK_CONTEXT
   +0x8d20 PrcbPad134       : [4] Uint8B
   +0x8d40 SelfmapLockHandle : [4] _KLOCK_QUEUE_HANDLE
   +0x8da0 PrcbPad134a      : [4] Uint8B
   +0x8dc0 PrcbPad138       : [128] UChar
   +0x8e40 PrcbPad138a      : [64] UChar
   +0x8e80 KernelDirectoryTableBase : Uint8B
   +0x8e88 RspBaseShadow    : Uint8B
   +0x8e90 UserRspShadow    : Uint8B
   +0x8e98 ShadowFlags      : Uint4B
   +0x8e9c PrcbPad138b      : Uint4B
   +0x8ea0 PrcbPad138c      : Uint8B
   +0x8ea8 PrcbPad138d      : Uint2B
   +0x8eaa PrcbPad138e      : Uint2B
   +0x8eac DbgMceNestingLevel : Uint4B
   +0x8eb0 DbgMceFlags      : Uint4B
   +0x8eb4 PrcbPad139b      : Uint4B
   +0x8eb8 PrcbPad140       : [505] Uint8B
   +0x9e80 PrcbPad140a      : [8] Uint8B
   +0x9ec0 PrcbPad141       : [504] Uint8B
   +0xae80 PrcbPad141a      : [64] UChar
   +0xaec0 RequestMailbox   : [1] _REQUEST_MAILBOX

其中DispatcherReadyListHead的32个元素对应32个优先级，每个元素为LIST_ENTRY链表头，挂接对应优先级就绪进程。

ETHREAD一般用更为友好的方式显示：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
0: kd> !thread
THREAD fffff80710727600  Cid 0000.0000  Teb: 0000000000000000 Win32Thread: 0000000000000000 RUNNING on processor 0
Not impersonating
DeviceMap                 ffffa48a85247ba0
Owning Process            fffff80710724a00       Image:         Idle
Attached Process          ffff8f8d11476040       Image:         System
Wait Start TickCount      18350          Ticks: 3452 (0:00:00:53.937)
Context Switch Count      46719          IdealProcessor: 0             
UserTime                  00:00:00.000
KernelTime                00:05:19.328
Win32 Start Address nt!KiIdleLoop (0xfffff8070fdf8ce0)
Stack Init fffff80714e7fc90 Current fffff80714e7fc20
Base fffff80714e80000 Limit fffff80714e7a000 Call 0000000000000000
Priority 0 BasePriority 0 PriorityDecrement 0 IoPriority 0 PagePriority 5
Child-SP          RetAddr               : Args to Child                                                           : Call Site
fffff807`14e8dc58 fffff807`0fe93972     : fffff807`0d516180 00000000`00000001 00000000`00000000 00000000`00005529 : nt!DbgBreakPointWithStatus
fffff807`14e8dc60 fffff807`0fe87427     : 00000000`00000000 00000000`00000246 00000000`0000552a fffff807`0d516180 : nt!KdCheckForDebugBreak+0x112216
fffff807`14e8dc90 fffff807`0fd2c2cd     : 00000000`00000000 fffff807`0d516180 00000000`00000246 00000000`0000552a : nt!KeAccumulateTicks+0x15e377
fffff807`14e8dcf0 fffff807`0fd2c871     : 00000000`0000552a 00000000`000032c3 fffff807`0d516180 00000000`00000001 : nt!KiUpdateRunTime+0x5d
fffff807`14e8dd40 fffff807`0fd266e3     : fffff807`14e7f510 00000000`00000000 fffff807`10631650 00000000`00000000 : nt!KiUpdateTime+0x4a1
fffff807`14e8de80 fffff807`0fd2eff2     : fffff807`14e7f510 fffff807`14e7f590 fffff807`14e7f500 00000000`00000000 : nt!KeClockInterruptNotify+0x2e3
fffff807`14e8df30 fffff807`0fc2ecd5     : 00000003`ebc24363 fffff807`106f39e0 fffff807`106f3a90 ffff8f8d`1143d010 : nt!HalpTimerClockInterrupt+0xe2
fffff807`14e8df60 fffff807`0fdf6cba     : fffff807`14e7f590 fffff807`106f39e0 00000000`ffffffff 00000000`00000000 : nt!KiCallInterruptServiceRoutine+0xa5
fffff807`14e8dfb0 fffff807`0fdf7227     : 00000000`00000000 00000000`00000000 ffffe600`6252a100 ffff8f8d`12a2f000 : nt!KiInterruptSubDispatchNoLockNoEtw+0xfa (TrapFrame @ fffff807`14e8de70)
fffff807`14e7f510 fffff807`0fdf100f     : fffff807`0fd8d02e 00000003`ebbfe4a9 fffff807`0d516180 00000000`00000000 : nt!KiInterruptDispatchNoLockNoEtw+0x37 (TrapFrame @ fffff807`14e7f510)
fffff807`14e7f6a8 fffff807`0fd8d02e     : 00000003`ebbfe4a9 fffff807`0d516180 00000000`00000000 000003bb`9a9aa6ef : nt!HalProcessorIdle+0xf
fffff807`14e7f6b0 fffff807`0fd28246     : 00000000`000016e5 00000000`00000000 00000000`00000000 00000000`0000aa54 : nt!PpmIdleGuestExecute+0xe
fffff807`14e7f6f0 fffff807`0fd27004     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!PpmIdleExecuteTransition+0x10c6
fffff807`14e7faf0 fffff807`0fdf8d34     : 00000000`00000000 fffff807`10727600 ffff8f8d`13eed080 00000000`00000723 : nt!PoIdle+0x374
fffff807`14e7fc60 00000000`00000000     : fffff807`14e80000 fffff807`14e7a000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x54

显示就绪状态的线程用!ready。

线程环境块TEBy用!teb获取位置，结构为：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
0:007> !teb
TEB at 0056a000
    ExceptionList:        047cfabc
    StackBase:            047d0000
    StackLimit:           047cc000
    SubSystemTib:         00000000
    FiberData:            00001e00
    ArbitraryUserPointer: 00000000
    Self:                 0056a000
    EnvironmentPointer:   00000000
    ClientId:             0000024c . 00000be4
    RpcHandle:            00000000
    Tls Storage:          00000000
    PEB Address:          00552000
    LastErrorValue:       0
    LastStatusValue:      0
    Count Owned Locks:    0
    HardErrorMode:        0
0: kd> dt _TEB
win32k!_TEB
   +0x000 NtTib            : _NT_TIB
   +0x038 EnvironmentPointer : Ptr64 Void
   +0x040 ClientId         : _CLIENT_ID
   +0x050 ActiveRpcHandle  : Ptr64 Void
   +0x058 ThreadLocalStoragePointer : Ptr64 Void
   +0x060 ProcessEnvironmentBlock : Ptr64 _PEB
   +0x068 LastErrorValue   : Uint4B
   +0x06c CountOfOwnedCriticalSections : Uint4B
   +0x070 CsrClientThread  : Ptr64 Void
   +0x078 Win32ThreadInfo  : Ptr64 Void
   +0x080 User32Reserved   : [26] Uint4B
   +0x0e8 UserReserved     : [5] Uint4B
   +0x100 WOW32Reserved    : Ptr64 Void
   +0x108 CurrentLocale    : Uint4B
   +0x10c FpSoftwareStatusRegister : Uint4B
   +0x110 ReservedForDebuggerInstrumentation : [16] Ptr64 Void
   +0x190 SystemReserved1  : [30] Ptr64 Void
   +0x280 PlaceholderCompatibilityMode : Char
   +0x281 PlaceholderHydrationAlwaysExplicit : UChar
   +0x282 PlaceholderReserved : [10] Char
   +0x28c ProxiedProcessId : Uint4B
   +0x290 _ActivationStack : _ACTIVATION_CONTEXT_STACK
   +0x2b8 WorkingOnBehalfTicket : [8] UChar
   +0x2c0 ExceptionCode    : Int4B
   +0x2c4 Padding0         : [4] UChar
   +0x2c8 ActivationContextStackPointer : Ptr64 _ACTIVATION_CONTEXT_STACK
   +0x2d0 InstrumentationCallbackSp : Uint8B
   +0x2d8 InstrumentationCallbackPreviousPc : Uint8B
   +0x2e0 InstrumentationCallbackPreviousSp : Uint8B
   +0x2e8 TxFsContext      : Uint4B
   +0x2ec InstrumentationCallbackDisabled : UChar
   +0x2ed UnalignedLoadStoreExceptions : UChar
   +0x2ee Padding1         : [2] UChar
   +0x2f0 GdiTebBatch      : _GDI_TEB_BATCH
   +0x7d8 RealClientId     : _CLIENT_ID
   +0x7e8 GdiCachedProcessHandle : Ptr64 Void
   +0x7f0 GdiClientPID     : Uint4B
   +0x7f4 GdiClientTID     : Uint4B
   +0x7f8 GdiThreadLocalInfo : Ptr64 Void
   +0x800 Win32ClientInfo  : [62] Uint8B
   +0x9f0 glDispatchTable  : [233] Ptr64 Void
   +0x1138 glReserved1      : [29] Uint8B
   +0x1220 glReserved2      : Ptr64 Void
   +0x1228 glSectionInfo    : Ptr64 Void
   +0x1230 glSection        : Ptr64 Void
   +0x1238 glTable          : Ptr64 Void
   +0x1240 glCurrentRC      : Ptr64 Void
   +0x1248 glContext        : Ptr64 Void
   +0x1250 LastStatusValue  : Uint4B
   +0x1254 Padding2         : [4] UChar
   +0x1258 StaticUnicodeString : _UNICODE_STRING
   +0x1268 StaticUnicodeBuffer : [261] Wchar
   +0x1472 Padding3         : [6] UChar
   +0x1478 DeallocationStack : Ptr64 Void
   +0x1480 TlsSlots         : [64] Ptr64 Void
   +0x1680 TlsLinks         : _LIST_ENTRY
   +0x1690 Vdm              : Ptr64 Void
   +0x1698 ReservedForNtRpc : Ptr64 Void
   +0x16a0 DbgSsReserved    : [2] Ptr64 Void
   +0x16b0 HardErrorMode    : Uint4B
   +0x16b4 Padding4         : [4] UChar
   +0x16b8 Instrumentation  : [11] Ptr64 Void
   +0x1710 ActivityId       : _GUID
   +0x1720 SubProcessTag    : Ptr64 Void
   +0x1728 PerflibData      : Ptr64 Void
   +0x1730 EtwTraceData     : Ptr64 Void
   +0x1738 WinSockData      : Ptr64 Void
   +0x1740 GdiBatchCount    : Uint4B
   +0x1744 CurrentIdealProcessor : _PROCESSOR_NUMBER
   +0x1744 IdealProcessorValue : Uint4B
   +0x1744 ReservedPad0     : UChar
   +0x1745 ReservedPad1     : UChar
   +0x1746 ReservedPad2     : UChar
   +0x1747 IdealProcessor   : UChar
   +0x1748 GuaranteedStackBytes : Uint4B
   +0x174c Padding5         : [4] UChar
   +0x1750 ReservedForPerf  : Ptr64 Void
   +0x1758 ReservedForOle   : Ptr64 Void
   +0x1760 WaitingOnLoaderLock : Uint4B
   +0x1764 Padding6         : [4] UChar
   +0x1768 SavedPriorityState : Ptr64 Void
   +0x1770 ReservedForCodeCoverage : Uint8B
   +0x1778 ThreadPoolData   : Ptr64 Void
   +0x1780 TlsExpansionSlots : Ptr64 Ptr64 Void
   +0x1788 DeallocationBStore : Ptr64 Void
   +0x1790 BStoreLimit      : Ptr64 Void
   +0x1798 MuiGeneration    : Uint4B
   +0x179c IsImpersonating  : Uint4B
   +0x17a0 NlsCache         : Ptr64 Void
   +0x17a8 pShimData        : Ptr64 Void
   +0x17b0 HeapData         : Uint4B
   +0x17b4 Padding7         : [4] UChar
   +0x17b8 CurrentTransactionHandle : Ptr64 Void
   +0x17c0 ActiveFrame      : Ptr64 _TEB_ACTIVE_FRAME
   +0x17c8 FlsData          : Ptr64 Void
   +0x17d0 PreferredLanguages : Ptr64 Void
   +0x17d8 UserPrefLanguages : Ptr64 Void
   +0x17e0 MergedPrefLanguages : Ptr64 Void
   +0x17e8 MuiImpersonation : Uint4B
   +0x17ec CrossTebFlags    : Uint2B
   +0x17ec SpareCrossTebBits : Pos 0, 16 Bits
   +0x17ee SameTebFlags     : Uint2B
   +0x17ee SafeThunkCall    : Pos 0, 1 Bit
   +0x17ee InDebugPrint     : Pos 1, 1 Bit
   +0x17ee HasFiberData     : Pos 2, 1 Bit
   +0x17ee SkipThreadAttach : Pos 3, 1 Bit
   +0x17ee WerInShipAssertCode : Pos 4, 1 Bit
   +0x17ee RanProcessInit   : Pos 5, 1 Bit
   +0x17ee ClonedThread     : Pos 6, 1 Bit
   +0x17ee SuppressDebugMsg : Pos 7, 1 Bit
   +0x17ee DisableUserStackWalk : Pos 8, 1 Bit
   +0x17ee RtlExceptionAttached : Pos 9, 1 Bit
   +0x17ee InitialThread    : Pos 10, 1 Bit
   +0x17ee SessionAware     : Pos 11, 1 Bit
   +0x17ee LoadOwner        : Pos 12, 1 Bit
   +0x17ee LoaderWorker     : Pos 13, 1 Bit
   +0x17ee SkipLoaderInit   : Pos 14, 1 Bit
   +0x17ee SpareSameTebBits : Pos 15, 1 Bit
   +0x17f0 TxnScopeEnterCallback : Ptr64 Void
   +0x17f8 TxnScopeExitCallback : Ptr64 Void
   +0x1800 TxnScopeContext  : Ptr64 Void
   +0x1808 LockCount        : Uint4B
   +0x180c WowTebOffset     : Int4B
   +0x1810 ResourceRetValue : Ptr64 Void
   +0x1818 ReservedForWdf   : Ptr64 Void
   +0x1820 ReservedForCrt   : Uint8B
   +0x1828 EffectiveContainerId : _GUID

WoW进程

x86与x64运行模式转化（用户层）：

1
2
3
4
~ //当前进程所有线程
~0s //转到0号线程上下文
.effmach amd64 //转为x64运行模式 栈帧回溯将出现wow64、wow64cpu、wow64win等转接层DLL
.effmach x86 //切换为32位模式

在x86模式下查看栈帧时，能看到俩ntdll模块，一个64位一个32位，32位的加上基地址后缀如“ntdll_77700000”。WoW进程中每个进程俩PEB，每个线程俩TEB，俩栈，如：

1
!wow64exts.info

其中Guest指x86，Native指x64。在32位NTDLL.DLL中如NtReadFile跳转WoW64SystemServiceCall，进入wow64cpu!KiFastSystemCall，跳转33号段选择子，即32位兼容模式过度64位模式方法。

系统对WoW进程注册表访问实施注册表重定向，如”HKEY_LOCAL_MACHINE\Software”重定向到“HKEY_LOACL_MACHINE\Software\Wow6432Node”等。一些COM组件有关等表键修改时同时修改32位和64位表键，这叫“注册表反射”。WoW进程访问系统文件目录时被自动重定向到SysWOW64或SysArm32目录中，这叫文件系统重定向。

最小进程是一类并列于NT进程的特殊进程，只需创建进程时指定一个特殊标志，但资料有限未完全研究清楚。该进程只创建进程空间，不自动想进程空间中添加内容。目前只有内存压缩技术、基于虚拟化的安全VBS和注册表进程Registry使用了最小进程。当某进程的EPROCESS结构的Flags字段的Flags3为1表示该进程为最小进程。内存压缩技术打开方式如下，有MemCompression进程创建。内存压缩进程在任务管理器中不显示。

1
Enable-MMAgent-mc

Registry进程有3个线程，两个线程入口函数为CmpLazyWriteWorker用于把修改过的注册表数据成批写回硬盘工作线程。另一个线程叫CmpDummyThreadRoutine，启动后等待CmpDummpyThreadEvent事件，等待成功则用KeBugCheckEx触发蓝屏崩溃，其用途为占位，不让内存管理器把它内存页交换出去。Registry进程在任务管理器中有时显示。

Pico进程时最小进程一个子类，但运行时并列于NT进程和最小进程，与NT内核之间交互需要PICO提供器，如WSL子系统核心驱动LXCORE。

在WSL启动早期，LXCORE用nt!PsRegisterPicoProvider注册Pico提供器，它有俩参数为结构指针，第一个字段表示大小，后面是LXCORE提供给内核的回调函数。如Pico进程执行系统调用时，NT内核逆向调用LXCORE!PicoSystemCallDispatch转交给LXCORE继续分发处理。当Pico进程内发生错误时，NT内核nt!KiDispatchException逆向调用LXCORE!PicoDispatchException。注册成功后NT内核也返回一个类似结构供Pico提供器调用。

WSL中每个Linux进程都是一个Pico进程，EPROCESS显示为System Process，该结构Flags2的第10位PicoCreated标志位为，PicoContext字段指向Pico提供器使用的Pico上下文结构。