Question

我使用WinDBG来获取句柄信息：

if (location.hash) {
    setTimeout(function() {
        var matches = window.location.hash.match(/^#([0-9]+)$/);
        if (matches) {
            var number = matches[1];
            $('html, body').animate({
                scrollTop: $('#' + number).offset().top -180
            }, 500);
            console.log('enter');
        }
    }, 1);
}

我知道大多数数据来自_FILE_OBJECT，但我无法确定如何确定{HarddiskVolume2}。 WinDBG如何获取此信息？

Answer 1

它是硬盘中分区的设备对象名称

kd> !object \Device\HardDisk0\
Object: e13d5f58  Type: (812bd3c8) Directory
    ObjectHeader: e13d5f40 (old version)
    HandleCount: 1  PointerCount: 6
    Directory Object: e10077a0  Name: Harddisk0

    Hash Address  Type          Name
    ---- -------  ----          ----
     21  8123e5e0 Device        DR0
     33  e13d3a50 SymbolicLink  Partition0
     34  e13d3030 SymbolicLink  Partition1
     36  8126b030 Device        DP(1)0x7e00-0xfff2e4400+1
kd> !object \Device\HardDisk0\Partition1
Object: e13d3030  Type: (812bd1f8) SymbolicLink
    ObjectHeader: e13d3018 (old version)
    HandleCount: 0  PointerCount: 1
    Directory Object: e13d5f58  Name: Partition1
    Target String is '\Device\HarddiskVolume1'

你也可以使用！driveinfo [dosdevicename]

查询反向

kd> !driveinfo c:
Drive c:, DriveObject e13d3770
    Directory Object: e1004890  Name: C:
        Target String is '\Device\HarddiskVolume1'
        Drive Letter Index is 3 (C:)
    Volume DevObj: 8126bd98
    Vpb: 8123db20  DeviceObject: 8121b020
    FileSystem: \FileSystem\Ntfs

获取所有驱动器映射的python脚本

from ctypes import *
ntdevs = create_string_buffer(15000)
b=windll.kernel32.GetLogicalDriveStringsA(sizeof(ntdevs),byref(ntdevs))
for i in range(0,b):
    print ntdevs[i],
print "\n"
dosdevs = create_string_buffer(15000)
for j in range(0,b,4):
    a=windll.Kernel32.QueryDosDeviceA(ntdevs[j]+ntdevs[j+1],byref(dosdevs),sizeof(dosdevs))
    for i in range(0,a):
        print dosdevs[i],
    print "\n"

EXEC

python qdd.py
C : \   D : \   E : \   F : \   G : \

\ D e v i c e \ H a r d d i s k V o l u m e 2

\ D e v i c e \ H a r d d i s k V o l u m e 3

\ D e v i c e \ H a r d d i s k V o l u m e 4

\ D e v i c e \ C d R o m 0

\ D e v i c e \ H a r d d i s k V o l u m e 5

编辑

如果您使用的是xp-sp3，这个脚本可以帮助您了解windbg如何检索{hardiskvolume1}这个脚本还假设某些内容如kernel_handle_table等级，如果有很多句柄你可能无法盲目索引比如handle * size + start of table

在后来的os中，OBJECT_HEADER结构不同没有NameInfoOffset字段
在OBJECT_HEADER结构中，您可能需要TypeIndex 修改此脚本以适应os＆gt; xp

r $t0 = (@@c++((sizeof(nt!_HANDLE_TABLE_ENTRY) / sizeof(unsigned long))) * ${$arg1})
r $t1 = (@$t0 + poi(poi(nt!ObpKernelHandleTable)))
r $t2 = (@@c++(#FIELD_OFFSET(nt!_OBJECT_HEADER  ,Body)))
r $t3 = (@@c++(#FIELD_OFFSET(nt!_FILE_OBJECT    ,DeviceObject)))
r $t4 = (@@c++(#FIELD_OFFSET(nt!_OBJECT_HEADER  ,NameInfoOffset)))
r $t5 = ((poi(@$t1) & 0xfffffff8 ) + @$t2)
r $t6 = (poi(@$t5 + @$t3) - @$t2 - @$t4)
.printf "%mu {%msu}" , @@c++(((nt!_FILE_OBJECT *) @@masm( @$t5 ))->FileName.Buffer ) ,  @$t6

像这样执行

kd> $$>a< "xxx\getfilename.txt" 294
\Documents and Settings\NetworkService\NTUSER.DAT {HarddiskVolume1}

使用！handle 294确认

PROCESS 80559c20  SessionId: none  Cid: 0000    Peb: 00000000  ParentCid: 0000
    DirBase: 00039000  ObjectTable: e1000b78  HandleCount: 230.
    Image: Idle

Kernel handle table at e1002000 with 230 entries in use

0294: Object: 810c20e0  GrantedAccess: 00000003 (Protected) Entry: e1002528
Object: 810c20e0  Type: (8127b900) File
    ObjectHeader: 810c20c8 (old version)
        HandleCount: 1  PointerCount: 4
        Directory Object: 00000000  Name: \Documents and Settings\NetworkService\NTUSER.DAT {HarddiskVolume1}

处理卷的信息

1 个答案: