In response to the original question, if all thats desired is to dump
the service table I find this to be easiest.
dps poi(nt!KeServiceDescriptorTableShadow) L
poi(nt!KeServiceDescriptorTableShadow+8)
(or really its the same as…)
kd> dps nt!KiServiceTable L poi nt!KiServiceLimit
80501030 8059849a nt!NtAcceptConnectPort
80501034 805e5666 nt!NtAccessCheck
80501038 805e8ec4 nt!NtAccessCheckAndAuditAlarm
8050103c 805e5698 nt!NtAccessCheckByType
80501040 805e8efe nt!NtAccessCheckByTypeAndAuditAlarm
80501044 805e56ce nt!NtAccessCheckByTypeResultList
80501048 805e8f42 nt!NtAccessCheckByTypeResultListAndAuditAlarm
8050104c 805e8f86 nt!NtAccessCheckByTypeResultListAndAuditAlarmByHandle
80501050 8060a5da nt!NtAddAtom
for the win32k table you need to flip to a non-System process context to
get at win32k
kd> !process 0 0 winlogon.exe
PROCESS 816621a8 SessionId: 0 Cid: 025c Peb: 7ffde000 ParentCid: 016c
DirBase: 05d10060 ObjectTable: e1458620 HandleCount: 630.
Image: winlogon.exe
kd> .process /p 816621a8
Implicit process is now 816621a8
.cache forcedecodeuser done
dps poi(nt!KeServiceDescriptorTableShadow+10) L
poi(nt!KeServiceDescriptorTableShadow+18)
(or)
kd> dps win32k!W32pServiceTable L poi win32k!W32pServiceLimit
bf997600 bf934ffe win32k!NtGdiAbortDoc
bf997604 bf946a92 win32k!NtGdiAbortPath
bf997608 bf8bf295 win32k!NtGdiAddFontResourceW
bf99760c bf93e718 win32k!NtGdiAddRemoteFontToDC
bf997610 bf9480a9 win32k!NtGdiAddFontMemResourceEx
bf997614 bf935262 win32k!NtGdiRemoveMergeFont
bf997618 bf935307 win32k!NtGdiAddRemoteMMInstanceToDC
bf99761c bf839cb5 win32k!NtGdiAlphaBlend
bf997620 bf9479d0 win32k!NtGdiAngleArc
bf997624 bf933a9d win32k!NtGdiAnyLinkedFonts
If you wanna get a little bit more fancy as Drew suggested, use a .for
(sorry for the example, but i like to abuse pseudo-registers =P )
kd> r$t0 = nt!KiServiceTable
kd> r$t1 = poi(nt!KiServiceLimit)
kd> .for ( r$t9=0 ; @$t9 < @$t1 ; r$t9 = @$t9+1 ) { .printf “0x%03x :
%y\n”, @$t9, poi(@$t0); r$t0=@$t0+@$ptrsize }
0x000 : nt!NtAcceptConnectPort (8059849a)
0x001 : nt!NtAccessCheck (805e5666)
0x002 : nt!NtAccessCheckAndAuditAlarm (805e8ec4)
0x003 : nt!NtAccessCheckByType (805e5698)
0x004 : nt!NtAccessCheckByTypeAndAuditAlarm (805e8efe)
0x005 : nt!NtAccessCheckByTypeResultList (805e56ce)
0x006 : nt!NtAccessCheckByTypeResultListAndAuditAlarm (805e8f42)
0x007 : nt!NtAccessCheckByTypeResultListAndAuditAlarmByHandle (805e8f86)
0x008 : nt!NtAddAtom (8060a5da)
0x009 : nt!NtQueryBootOptions (8060b84e)
0x00a : nt!NtAdjustGroupsToken (805e0a08)
0x00b : nt!NtAdjustPrivilegesToken (805e0660)
0x00c : nt!NtAlertResumeThread (805c9684)
bank kus wrote:
not really related to this thread but I recently found this command:
.shell . Awesome.
Lets you interact with the system shell or invoke your fav scripting
language. I loved this feature in gdb and wasnt sure windbg had it too.
“Drew Bliss” > mailto:xxxxx> wrote in message
> news:xxxxx@windbg…
> Alias names must either be surrounded by whitespace or contained
> within ${}. In the below if you put a space between , and
> place the alias will replaced (or use ${place}).
>
> dd displays the address and data values, so you’ll have two
> columns. If you only want to process one you can use the /ps and
> /pS options to .foreach to control which tokens it’ll look at.
> Alternately, you can just use a plain .for to iterate over a set
> of addresses.
>
> You are most likely getting invalid addresses when pulling random
> values from memory.
>
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] *On Behalf Of *raj_r
> Sent: Saturday, July 29, 2006 10:13 AM
> To: Kernel Debugging Interest List
> Subject: Re: [windbg] script file syntax question
>
> On 7/29/06, Drew Bliss > mailto:xxxxx> wrote:
>
> The value after ‘l’ in a range is a full expression, so you
> can use poi(nt!KeServiceDescriptorTable+8) there instead of
> hard-coded 11c.
>
>
>
> Thanks it works fine if I substitue expressions
>
>
>
>
> You can use %y in .printf to do symbol resolution, so .printf
> “Table entry %y\n”, place would show the address and/or symbol
> for place.
>
>
>
> “%y\n”,place doesnt seem to work
>
> lkd> .foreach (place {dd /c 1 poi nt!KeServiceDescriptorTable
> L10}) {.printf “Table entry %y\n”,place}
> Table entry Couldn’t resolve error at ‘place’
>
>
> if i do poi place instead of just place it works but cant read
> some memory i have /debug switch enabled still it cant read
> certain memory
>
> lkd> .foreach (place {dd /c 1 poi nt!KeServiceDescriptorTable
> L10}) {.printf “Table entry %y\n”,poi place}
> Table entry nt!NtAcceptConnectPort (805862de)
> Table entry 00009c68 <---------------------why two results ???
> Table entry nt!NtAccessCheck (8056fded)
> Table entry 8b55ff8b
> Table entry nt!NtAccessCheckAndAuditAlarm (8058945b)
> Table entry 8b55ff8b
> Table entry nt!NtAccessCheckByType (80587080)
> Table entry 8b55ff8b <------------ whats being repeated here it seems
> Table entry nt!NtAccessCheckByTypeAndAuditAlarm (80592a37)
> Table entry 8b55ff8b
> Table entry nt!NtAccessCheckByTypeResultList (806364d0)
> Table entry Memory access error at ‘806364d0’ <------------
>
>
>
>
> while doing a ln place seems to have no problems except that it is
> too much information
>
>
>
>
>
>
> lkd> .foreach (place {dd /c 1 poi nt!KeServiceDescriptorTable
> L10}) {ln place}
> (804e26a8) nt!KiServiceTable | (804e2b18) nt!KiCallUserMode
> Exact matches:
> nt!KiServiceTable =
> (805862de) nt!NtAcceptConnectPort | (80586732)
> nt!LpcpPrepareToWakeClient
> Exact matches:
> nt!NtAcceptConnectPort =
> (804e26a8) nt!KiServiceTable+0x4 | (804e2b18)
> nt!KiCallUserMode
> (8056fded) nt!NtAccessCheck | (8056fe1e) nt!MiDoPoolCopy
> Exact matches:
> nt!NtAccessCheck =
> (804e26a8) nt!KiServiceTable+0x8 | (804e2b18) nt!KiCallUserMode
> (8058945b) nt!NtAccessCheckAndAuditAlarm | (805894ad)
> nt!NtConnectPort
> Exact matches:
> nt!NtAccessCheckAndAuditAlarm =
> (804e26a8) nt!KiServiceTable+0xc | (804e2b18) nt!KiCallUserMode
> (80587080) nt!NtAccessCheckByType | (8058710a)
> nt!IopDeleteIoCompletion
> Exact matches:
> nt!NtAccessCheckByType =
> (804e26a8) nt!KiServiceTable+0x10 | (804e2b18)
> nt!KiCallUserMode
> (80592a37) nt!NtAccessCheckByTypeAndAuditAlarm | (80592ac8)
> nt!NtQuerySystemTime
> Exact matches:
> nt!NtAccessCheckByTypeAndAuditAlarm =
> (804e26a8) nt!KiServiceTable+0x14 | (804e2b18)
> nt!KiCallUserMode
> (806364d0) nt!NtAccessCheckByTypeResultList | (80636530)
> nt!SeAssignSecurityEx
> Exact matches:
> nt!NtAccessCheckByTypeResultList =
> (804e26a8) nt!KiServiceTable+0x18 | (804e2b18)
> nt!KiCallUserMode
> (80638661) nt!NtAccessCheckByTypeResultListAndAuditAlarm |
> (806386aa) nt!NtAccessCheckByTypeResultListAndAuditAlarmByHandle
> Exact matches:
> nt!NtAccessCheckByTypeResultListAndAuditAlarm = > information>
> (804e26a8) nt!KiServiceTable+0x1c | (804e2b18)
> nt!KiCallUserMode
> (806386aa)
> nt!NtAccessCheckByTypeResultListAndAuditAlarmByHandle |
> (80638701) nt!NtDeleteObjectAuditAlarm
> Exact matches:
> nt!NtAccessCheckByTypeResultListAndAuditAlarmByHandle = > type information>
> (804e26a8) nt!KiServiceTable+0x20 | (804e2b18)
> nt!KiCallUserMode
> (8057559b) nt!NtAddAtom | (80575736) nt!NtSetInformationThread
> Exact matches:
> nt!NtAddAtom =
> (804e26a8) nt!KiServiceTable+0x24 | (804e2b18)
> nt!KiCallUserMode
> (80646ecf) nt!NtQueryBootOptions | (80646ee3)
> nt!NtTranslateFilePath
> Exact matches:
> nt!NtQueryBootEntryOrder =
> nt!NtSetBootEntryOrder =
> nt!NtQueryBootOptions =
> nt!NtSetBootOptions =
> nt!NtAddBootEntry =
> nt!NtEnumerateBootEntries =
> (804e26a8) nt!KiServiceTable+0x28 | (804e2b18)
> nt!KiCallUserMode
> (80635c93) nt!NtAdjustGroupsToken | (80592466)
> nt!SepMakeTokenEffectiveOnly
> Exact matches:
> nt!NtAdjustGroupsToken =
> (804e26a8) nt!KiServiceTable+0x2c | (804e2b18)
> nt!KiCallUserMode
> (80591fbe) nt!NtAdjustPrivilegesToken | (80592198)
> nt!SeCaptureLuidAndAttributesArray
> Exact matches:
> nt!NtAdjustPrivilegesToken =
> (804e26a8) nt!KiServiceTable+0x30 | (804e2b18)
> nt!KiCallUserMode
> (8062ddd4) nt!NtAlertResumeThread | (8059bb36)
> nt!PspFoldProcessAccountingIntoJob
> Exact matches:
> nt!NtAlertResumeThread =
> (804e26a8) nt!KiServiceTable+0x34 | (804e2b18)
> nt!KiCallUserMode
> (80579bb8) nt!NtAlertThread | (80579c99)
> nt!ObpDestroySecurityDescriptorHeader
> Exact matches:
> nt!NtAlertThread =
> (804e26a8) nt!KiServiceTable+0x38 | (804e2b18)
> nt!KiCallUserMode
> (8058a6ca) nt!NtAllocateLocallyUniqueId | (8058a72f)
> nt!ObCheckCreateObjectAccess
> Exact matches:
> nt!NtAllocateLocallyUniqueId =
> (804e26a8) nt!KiServiceTable+0x3c | (804e2b18)
> nt!KiCallUserMode
> (80624efd) nt!NtAllocateUserPhysicalPages | (806252b2)
> nt!NtFreeUserPhysicalPages
> Exact matches:
> nt!NtAllocateUserPhysicalPages =
>
> — You are currently subscribed to windbg as:
> xxxxx@winse.microsoft.com To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>
>
> —
> You are currently subscribed to windbg as: unknown lmsubst tag
> argument: ‘’
> To unsubscribe send a blank email to xxxxx@lists.osr.com</mailto:xxxxx></mailto:xxxxx>
