Hello Srin,
Ya, those are heavy compile / linker optimizations or whatever.
Some very common pieces of code , for which the compiler generates
same code, are discarded, and only one instance of that code is kept.
So you can have 2 functions like (very simple example)
NTSTATUS a (VOID) {
return STATUS_SUCCESS;
}
NTSTATUS b (VOID) {
return STATUS_SUCCESS;
}
getting compiled in .exe to something like:
proc a
jmp do_status_success
endp
proc b
jmp do_status_success
endp
do_status_success:
xor eax, eax
retn
now , I think that for full symbolic + source debugging some of the
original layout is keept in *.pdb files.
Switch to a checked kernel build.
Tuesday, July 8, 2003, 11:06:18 PM, you wrote:
SNc> Dan,
SNc> The disassembly exactly looks like what you said. The symbols
SNc> are used from symbol server. Here is the output for you again. Seeing
SNc> the below output this looks like some compiler optimization or some
SNc> disassembly bug in windbg.
SNc> -Srin.
SNc> Symbol search path is:
SNc> SRV*e:\symbols\websymbols*http://msdl.microsoft.com/download/symbols;e:\
SNc> symbols\localtest
SNc> Microsoft (R) Windows Debugger Version 6.2.0007.4
SNc> Copyright (c) Microsoft Corporation. All rights reserved.
SNc> Connected to Windows XP 2600 x86 compatible target, ptr64 FALSE
SNc> Symbol search path is:
SNc> SRV*e:\symbols\websymbols*http://msdl.microsoft.com/download/symbols;e:\
SNc> symbols\localtest
SNc> Executable search path is:
SNc> ************************************************************************
SNc> *******
SNc> WARNING: Local kernel debugging requires booting with /debug to work
SNc> optimally.
SNc> ************************************************************************
SNc> *******
SNc> Windows XP Kernel Version 2600 (Service Pack 1) UP Free x86 compatible
SNc> Product: WinNt, suite: TerminalServer SingleUserTS
SNc> Built by: 2600.xpsp1.020828-1920
SNc> Kernel base = 0x804d0000 PsLoadedModuleList = 0x80547e30
SNc> Debug session time: Tue Jul 08 14:57:34 2003
SNc> System Uptime: 0 days 0:07:01.213
SNc> Symbol search path is:
SNc> SRV*e:\symbols\websymbols*http://msdl.microsoft.com/download/symbols;e:\
SNc> symbols\localtest
lkd>> lmi
SNc> start end module name
SNc> 804d0000 806c2980 nt (pdb symbols) ntoskrnl.exe
SNc> Unloaded modules:
SNc> f1b59000 f1b80000 kmixer.sys
SNc> f25c7000 f25ee000 kmixer.sys
SNc> f8b44000 f8b45000 drmkaud.sys
SNc> f25ee000 f2611000 aec.sys
SNc> f2761000 f276e000 DMusic.sys
SNc> f2771000 f277f000 swmidi.sys
SNc> f8af8000 f8afa000 splitter.sys
SNc> f891e000 f8923000 Cdaudio.SYS
SNc> f8a02000 f8a05000 Sfloppy.SYS
lkd>> x nt!*PsTerminate*
SNc> 80573b15 nt!PsTerminateSystemThread
SNc> 80633fdf nt!PsTerminateProcess
lkd>> !sym noisy
SNc> noisy mode - symbol prompts on
lkd>> .reload ntoskrnl.exe
lkd>> .reload /u ntoskrnl.exe
SNc> Unloaded ntoskrnl.exe
lkd>> .reload ntoskrnl.exe
lkd>> lmi
SNc> start end module name
SNc> 804d0000 806c2980 nt (deferred)
SNc> Unloaded modules:
SNc> f1a92000 f1ab9000 kmixer.sys
SNc> f1b59000 f1b80000 kmixer.sys
SNc> f25c7000 f25ee000 kmixer.sys
SNc> f8b44000 f8b45000 drmkaud.sys
SNc> f25ee000 f2611000 aec.sys
SNc> f2761000 f276e000 DMusic.sys
SNc> f2771000 f277f000 swmidi.sys
SNc> f8af8000 f8afa000 splitter.sys
SNc> f891e000 f8923000 Cdaudio.SYS
SNc> f8a02000 f8a05000 Sfloppy.SYS
lkd>> .reload nt
SNc> DBGHELP: nt - public symbols
SNc> e:\symbols\websymbols\ntoskrnl.pdb\C95EC79CFBFB4220AF2B6E9D09551A1F2\nto
SNc> skrnl.pdb
lkd>> u nt!PsTerminateSystemThread
SNc> nt!PsTerminateSystemThread:
SNc> 80573b15 64a124010000 mov eax,fs:[00000124]
SNc> 80573b1b f6804802000010 test byte ptr [eax+0x248],0x10
SNc> 80573b22 0f8485c00600 je nt!PsTerminateSystemThread+0xf
SNc> (805dfbad)
SNc> 80573b28 ff742404 push dword ptr [esp+0x4]
SNc> 80573b2c 50 push eax
SNc> 80573b2d e85e300100 call nt!PspTerminateThreadByPointer
SNc> (80586b90)
SNc> 80573b32 c20400 ret 0x4
SNc> 80573b35 807dff00 cmp byte ptr [ebp-0x1],0x0
lkd>> u 805dfbad
SNc> nt!PsTerminateSystemThread+f:
SNc> 805dfbad b80d0000c0 mov eax,0xc000000d
SNc> 805dfbb2 e97b3ff9ff jmp nt!PsTerminateSystemThread+0x20
SNc> (80573b32)
SNc> 805dfbb7 b8180000c0 mov eax,0xc0000018
SNc> 805dfbbc e9777bfaff jmp nt!PspMapSystemDll+0x3f (80587738)
SNc> 805dfbc1 c705849f548002000000 mov dword ptr [nt!PsPrioritySeperation
SNc> (80549f84)],0x2
SNc> 805dfbcb e920dafcff jmp nt!PsChangeQuantumTable+0x21
SNc> (805ad5f0)
SNc> 805dfbd0 803d9c40668000 cmp byte ptr [nt!PspUseJobSchedulingClasses
SNc> (8066409c)],0x0
SNc> 805dfbd7 0f84c2dafcff je nt!PsChangeQuantumTable+0xe1
SNc> (805ad69f)
> -----Original Message-----
> From: xxxxx@rdsor.ro [mailto:xxxxx@rdsor.ro]
> Sent: Tuesday, July 08, 2003 1:07 PM
> To: NT Developers Interest List
> Subject: [ntdev] Re: Disassembler question?
>
> Whatever tool you use, the output is bogus.
>
> Either symbolic name or address is incorectly computed.
> The target of this jump should some code like
>
> mov eax, ErrorStatus
> ret 0x4
>
> or similar constructs. It basicaly bails put for a non-system thread.
> Its coded here to prevent this API to be called on win32 threads.
>
>
>
>
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@nai.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
SNc> —
SNc> You are currently subscribed to ntdev as: xxxxx@rdsor.ro
SNc> To unsubscribe send a blank email to xxxxx@lists.osr.com
–
Best regards,
Dan mailto:xxxxx@rdsor.ro
I