windbg调xp的calc(手工虚拟地址到物理地址转换练习)

原文地址：/article/7973858.html

上篇记录的够详细了，本篇只记数据。

计算器中放入123456。

符号文件路径填入这个;C:\symbols\dsds.pdb;srv*c:\symbols*http://msdl.microsoft.com/download/symbols;C:\symbols

用户模式数据：

WARNING: Non-directory path:'C:\symbols\dsds.pdb'

WARNING: Whitespace at end of path element

0:002> .reload

Reloading current modules

.........................

0:002> xcalc!g*

01014f08 calc!ghwndTimeOutDlg = <no typeinformation>

01014d9c calc!g_fHighContrast = <no typeinformation>

0100514d calc!GetKeyColor = <no typeinformation>

01014ef8 calc!gfExiting = <no typeinformation>

0100518d calc!GetHelpID = <no typeinformation>

01014c70 calc!ghnoPrecNum = <no typeinformation>

01014c08 calc!ghnoParNum = <no typeinformation>

01014038 calc!gszSep = <no typeinformation>

01014eec calc!ghcurOld = <no typeinformation>

01014d38 calc!g_ahnoChopNumbers = <notype information>

01014f00 calc!ghCalcDone = <no typeinformation>

01014db0 calc!gpszNum = <no type information>

01014f0c calc!gnPendingError = <no typeinformation>

01014000 calc!gnDecGrouping = <no typeinformation>

01014dc0 calc!gcio = <no typeinformation>

01014d98 calc!ghnoLastNum = <no typeinformation>

01014f04 calc!ghDogThread = <no typeinformation>

01014d80 calc!g_hDecMenu = <no typeinformation>

01014f48 calc!gbinexact = <no typeinformation>

01014d7c calc!g_hHexMenu = <no typeinformation>

01014efc calc!ghCalcStart = <no typeinformation>

01014da0 calc!g_fLayoutRTL = <no typeinformation>

01014db8 calc!gbRecord = <no typeinformation>

010149d8 calc!gcIntDigits = <no typeinformation>

01014d6c calc!g_hwndDlg = <no typeinformation>

01014d4c calc!gbUseSep = <no typeinformation>

01014d94 calc!ghnoMem = <no typeinformation>

010044b4 calc!GroupDigits = <no typeinformation>

01014f4c calc!gllfact = <no typeinformation>

01014d90 calc!ghnoNum = <no typeinformation>

01014064 calc!gldPrevious = <no typeinformation>

0:002> ddcalc!gpszNum

01014db0 000b0ff0 00000000 00000001 00000000

01014dc0 00000000 ffffffff 0000000000000000

01014dd0 00000006 00320031 0034003300360035

01014de0 00000000 00000000 0000000000000000

01014df0 00000000 00000000 0000000000000000

01014e00 00000000 00000000 0000000000000000

01014e10 00000000 00000000 0000000000000000

01014e20 00000000 00000000 0000000000000000

0:002> dd000b0ff0

000b0ff0 0032003100340033 00360035 0000002e

000b1000 00000000 00000000 00040094000c01ba

000b1010 74687130 00000001 bebacc9446625cd3

000b1020 31f3e0a1 69364999 58c99d9642ce2f9b

000b1030 ef37be91 82f86018 0002000300000000

000b1040 8a008bed 00000000 0000000000000000

000b1050 00000000 00000000 0000000000000000

000b1060 00000000 00000000 00000000 00000000

0:002> .formats 000b0ff0

Evaluateexpression:

Hex: 000b0ff0

Decimal: 724976

Octal: 00002607760

Binary: 00000000 00001011 00001111 11110000

Chars: ....

Time: Fri Jan 0917:22:56 1970

Float: low1.01591e-039 high 0

Double:3.58186e-318

再打开一个windbg进入内核模式：

lkd>.reload

Connected toWindows XP 2600 x86 compatible target, ptr64 FALSE

Loading KernelSymbols

......................................................................................................................

Loading UserSymbols

..............................

Loadingunloaded module list

............

lkd> !process 0 0

**** NT ACTIVEPROCESS DUMP ****

PROCESS81bbd830 SessionId: none Cid: 0004 Peb: 00000000 ParentCid: 0000

DirBase:00039000 ObjectTable: e1000cc0 HandleCount: 243.

Image: System

PROCESS81894020 SessionId: none Cid: 015c Peb: 7ffd4000 ParentCid: 0004

DirBase:0856f000 ObjectTable: e14341c0 HandleCount: 21.

Image:smss.exe

PROCESS818a4020 SessionId: 0 Cid: 018c Peb: 7ffdc000 ParentCid: 015c

DirBase:0912e000 ObjectTable: e153ba40 HandleCount: 339.

Image:csrss.exe

PROCESS81899020 SessionId: 0 Cid: 01a4 Peb: 7ffdd000 ParentCid: 015c

DirBase:094f3000 ObjectTable: e1526508 HandleCount: 453.

Image:winlogon.exe

PROCESS818bc5c0 SessionId: 0 Cid: 01d0 Peb: 7ffdd000 ParentCid: 01a4

DirBase:09946000 ObjectTable: e183bc78 HandleCount: 259.

Image:services.exe

PROCESS81a5c6b0 SessionId: 0 Cid: 01dc Peb: 7ffd5000 ParentCid: 01a4

DirBase:09950000 ObjectTable: e183d898 HandleCount: 335.

Image:lsass.exe

PROCESS81aba808 SessionId: 0 Cid: 0270 Peb: 7ffd6000 ParentCid: 01d0

DirBase:09fa5000 ObjectTable: e18987b0 HandleCount: 24.

Image:vmacthlp.exe

PROCESS81ab3a20 SessionId: 0 Cid: 0288 Peb: 7ffdf000 ParentCid: 01d0

DirBase:0a26f000 ObjectTable: e18c0ec0 HandleCount: 200.

Image:svchost.exe

PROCESS819b0888 SessionId: 0 Cid: 02cc Peb: 7ffdc000 ParentCid: 01d0

DirBase:0a464000 ObjectTable: e19152d0 HandleCount: 226.

Image:svchost.exe

PROCESS81aaf650 SessionId: 0 Cid: 0324 Peb: 7ffd8000 ParentCid: 01d0

DirBase:0a9ed000 ObjectTable: e19b4038 HandleCount: 1187.

Image:svchost.exe

PROCESS819a4390 SessionId: 0 Cid: 0374 Peb: 7ffdb000 ParentCid: 01d0

DirBase:0adc3000 ObjectTable: e17f4bd0 HandleCount: 57.

Image:svchost.exe

PROCESS819ad768 SessionId: 0 Cid: 03d4 Peb: 7ffd6000 ParentCid: 01d0

DirBase:0af90000 ObjectTable: e1db0260 HandleCount: 198.

Image:svchost.exe

PROCESS81b7a020 SessionId: 0 Cid: 0480 Peb: 7ffde000 ParentCid: 0448

DirBase:0bc03000 ObjectTable: e17a53a0 HandleCount: 335.

Image:explorer.exe

PROCESS819feb68 SessionId: 0 Cid: 04d0 Peb: 7ffdc000 ParentCid: 01d0

DirBase:0bf55000 ObjectTable: e1e48680 HandleCount: 135.

Image:spoolsv.exe

PROCESS8198f4e8 SessionId: 0 Cid: 059c Peb: 7ffd9000 ParentCid: 0480

DirBase:0c65b000 ObjectTable: e1836920 HandleCount: 36.

Image:VMwareTray.exe

PROCESS81990880 SessionId: 0 Cid: 05a4 Peb: 7ffd6000 ParentCid: 0480

DirBase:0c52e000 ObjectTable: e191a510 HandleCount: 173.

Image:VMwareUser.exe

PROCESS81a13b18 SessionId: 0 Cid: 05ac Peb: 7ffdf000 ParentCid: 0480

DirBase:0c679000 ObjectTable: e1ead320 HandleCount: 88.

Image:ctfmon.exe

PROCESS81941180 SessionId: 0 Cid: 0708 Peb: 7ffd5000 ParentCid: 0480

DirBase: 0eba7000 ObjectTable: e1980c90 HandleCount: 47.

Image: calc.exe

PROCESS 81960340SessionId: 0 Cid: 074c Peb: 7ffdf000 ParentCid: 0480

DirBase:0fd9a000 ObjectTable: e19837b8 HandleCount: 106.

Image:windbg.exe

PROCESS8196bbe0 SessionId: 0 Cid: 07f8 Peb: 7ffd5000 ParentCid: 01d0

DirBase:0ae7e000 ObjectTable: e14ed2d0 HandleCount: 130.

Image:VMwareService.exe

PROCESS8194bda0 SessionId: 0 Cid: 0308 Peb: 7ffd4000 ParentCid: 0324

DirBase:0a6fb000 ObjectTable: e1e623c8 HandleCount: 134.

Image:wuauclt.exe

PROCESS818fc528 SessionId: 0 Cid: 053c Peb: 7ffdb000 ParentCid: 01d0

DirBase:0a45f000 ObjectTable: e2011bb0 HandleCount: 101.

Image: alg.exe

PROCESS818fda80 SessionId: 0 Cid: 05f0 Peb: 7ffde000 ParentCid: 0324

DirBase:0c932000 ObjectTable: e202ebc8 HandleCount: 38.

Image: wscntfy.exe

PROCESS81975a88 SessionId: 0 Cid: 035c Peb: 7ffd9000 ParentCid: 0480

DirBase:0f957000 ObjectTable: e1de5130 HandleCount: 72.

Image:windbg.exe

lkd> !dd 0eba7000

# eba7000 0ef9b067 0edd8067 0f01b067 0efff067

# eba70100ee96067 00000000 00000000 00000000

# eba702000000000 00000000 00000000 00000000

# eba703000000000 00000000 00000000 00000000

# eba704000000000 00000000 00000000 00000000

# eba705000000000 00000000 00000000 00000000

# eba706000000000 00000000 00000000 00000000

# eba707000000000 00000000 00000000 00000000

lkd> !dd 0ef9b000+b0*4

# ef9b2c0 0ef75067 0ee77067 0ef38067 0eef9067

# ef9b2d00f07a067 0f03b067 0efbd067 0ee3e067

# ef9b2e000000080 00000000 00000000 00000000

# ef9b2f000000000 00000000 00000000 00000000

# ef9b30000000000 00000000 00000000 00000000

# ef9b31000000000 00000000 00000000 00000000

# ef9b32000000000 00000000 00000000 00000000

# ef9b33000000000 00000000 00000000 00000000

lkd> !dd 0ef75000+ff0

# ef75ff0 00320031 00340033 00360035 0000002e

# ef7600000000000 00000000 00000000 00000000

# ef7601000000000 00000000 00000000 00000000

# ef7602000000000 00000000 00000000 00000000

# ef7603000000000 00000000 00000000 00000000

# ef7604000000000 00000000 00000000 00000000

# ef7605000000000 00000000 00000000 00000000

# ef7606000000000 00000000 00000000 00000000

虚拟地址000b0ff0经过手工转换后得到物理地址0ef75000+ff0,可以看到在物理地址中放的确实是123456。