学习-认识CPU的GDT

路人甲 2014-04-04 20:00:00
逆向安全 其他

学习/认识CPU的GDT

0x00 关于GDT

CPU相信大家都知道是啥玩意，哪三个单词缩写。GDT对于一些不搞底层的人知道的可能还有一些。

GDT就是global descriptor table的缩写。相应的还有个local descriptor tables(LDT)，这个不再此文的讨论范围内。

这在保护模式教程中经常看到，但是这和咱们程序员有啥关系呢？1.留后门

就是进入R0后设置（R3）进入R0的后门（如：调用门，中断门，任务门等）。

2.了解/编写操作系统

人家微软的Windows操作系统经历了很多变化，如今到了WIN10。（对于天天研究Windows的人）这对咱有意思吗？顶多认识了解和应用/利用。 好像有不少的变化（PC端）都是基于硬件的。基于软件的算法不说。

3.虚拟化

如：intel-VT就要设置许多段（如：cs,ss,ds,es,fs,gs等）的Base，Limit，access rights，Selectors等。

好了，废话不多进入正题。

0x01 开始分析

以Windows系统为例进行分析。

kd> vertarget 
Windows XP Kernel Version 2600 (Service Pack 3) MP (1 procs) Free x86 compatible
Built by: 2600.xpsp_sp3_qfe.130704-0421
Machine Name:
Kernel base = 0x804d8000 PsLoadedModuleList = 0x8055e720
Debug session time: Thu Aug  6 14:25:16.468 2015 (UTC + 8:00)
System Uptime: 0 days 0:01:19.984

这是操作系统的环境信息。

GDT是由GDTR指向的。

kd> r gdtr
gdtr=8003f000

其大小为：

kd> r gdtl
gdtl=000003ff

其全部的内容为：

kd> db 8003f000 L(000003ff + 1)
8003f000  00 00 00 00 00 00 00 00-ff ff 00 00 00 9b cf 00  ................
8003f010  ff ff 00 00 00 93 cf 00-ff ff 00 00 00 fb cf 00  ................
8003f020  ff ff 00 00 00 f3 cf 00-ab 20 00 20 04 8b 00 80  ......... . ....
8003f030  01 00 00 f0 df 93 c0 ff-ff 0f 00 00 00 f3 40 00  ..............@.
8003f040  ff ff 00 04 00 f2 00 00-00 00 00 00 00 00 00 00  ................
8003f050  68 00 00 27 55 89 00 80-68 00 68 27 55 89 00 80  h..'U...h.h'U...
8003f060  ff ff 40 2f 02 93 00 00-ff 3f 00 80 0b 92 00 00  ..@/.....?......
8003f070  ff 03 00 70 ff 92 00 ff-ff ff 00 00 40 9a 00 80  ...p........@...
8003f080  ff ff 00 00 40 92 00 80-00 00 00 00 00 92 00 00  ....@...........
8003f090  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
8003f0a0  68 00 b8 16 38 89 00 82-00 00 00 00 00 00 00 00  h...8...........
8003f0b0  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
8003f0c0  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
8003f0d0  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
8003f0e0  ff ff 00 f0 50 9f 00 f8-ff ff 00 00 00 92 00 00  ....P...........
8003f0f0  b7 03 40 d0 4f 98 00 80-ff ff 00 00 00 92 00 00  ..@.O...........
8003f100  ff ff 00 24 4d 93 40 ba-ff ff 00 24 4d 93 40 ba  ...$M.@....$M.@.
8003f110  ff ff 00 24 4d 93 40 ba-20 f1 03 80 00 00 00 00  ...$M.@. .......
8003f120  28 f1 03 80 00 00 00 00-30 f1 03 80 00 00 00 00  (.......0.......
8003f130  38 f1 03 80 00 00 00 00-40 f1 03 80 00 00 00 00  8.......@.......
8003f140  48 f1 03 80 00 00 00 00-50 f1 03 80 00 00 00 00  H.......P.......
8003f150  58 f1 03 80 00 00 00 00-60 f1 03 80 00 00 00 00  X.......`.......
8003f160  68 f1 03 80 00 00 00 00-70 f1 03 80 00 00 00 00  h.......p.......
8003f170  78 f1 03 80 00 00 00 00-80 f1 03 80 00 00 00 00  x...............
8003f180  88 f1 03 80 00 00 00 00-90 f1 03 80 00 00 00 00  ................
8003f190  98 f1 03 80 00 00 00 00-a0 f1 03 80 00 00 00 00  ................
8003f1a0  a8 f1 03 80 00 00 00 00-b0 f1 03 80 00 00 00 00  ................
8003f1b0  b8 f1 03 80 00 00 00 00-c0 f1 03 80 00 00 00 00  ................
8003f1c0  c8 f1 03 80 00 00 00 00-d0 f1 03 80 00 00 00 00  ................
8003f1d0  d8 f1 03 80 00 00 00 00-e0 f1 03 80 00 00 00 00  ................
8003f1e0  e8 f1 03 80 00 00 00 00-f0 f1 03 80 00 00 00 00  ................
8003f1f0  f8 f1 03 80 00 00 00 00-00 f2 03 80 00 00 00 00  ................
8003f200  08 f2 03 80 00 00 00 00-10 f2 03 80 00 00 00 00  ................
8003f210  18 f2 03 80 00 00 00 00-20 f2 03 80 00 00 00 00  ........ .......
8003f220  28 f2 03 80 00 00 00 00-30 f2 03 80 00 00 00 00  (.......0.......
8003f230  38 f2 03 80 00 00 00 00-40 f2 03 80 00 00 00 00  8.......@.......
8003f240  48 f2 03 80 00 00 00 00-50 f2 03 80 00 00 00 00  H.......P.......
8003f250  58 f2 03 80 00 00 00 00-60 f2 03 80 00 00 00 00  X.......`.......
8003f260  68 f2 03 80 00 00 00 00-70 f2 03 80 00 00 00 00  h.......p.......
8003f270  78 f2 03 80 00 00 00 00-80 f2 03 80 00 00 00 00  x...............
8003f280  88 f2 03 80 00 00 00 00-90 f2 03 80 00 00 00 00  ................
8003f290  98 f2 03 80 00 00 00 00-a0 f2 03 80 00 00 00 00  ................
8003f2a0  a8 f2 03 80 00 00 00 00-b0 f2 03 80 00 00 00 00  ................
8003f2b0  b8 f2 03 80 00 00 00 00-c0 f2 03 80 00 00 00 00  ................
8003f2c0  c8 f2 03 80 00 00 00 00-d0 f2 03 80 00 00 00 00  ................
8003f2d0  d8 f2 03 80 00 00 00 00-e0 f2 03 80 00 00 00 00  ................
8003f2e0  e8 f2 03 80 00 00 00 00-f0 f2 03 80 00 00 00 00  ................
8003f2f0  f8 f2 03 80 00 00 00 00-00 f3 03 80 00 00 00 00  ................
8003f300  08 f3 03 80 00 00 00 00-10 f3 03 80 00 00 00 00  ................
8003f310  18 f3 03 80 00 00 00 00-20 f3 03 80 00 00 00 00  ........ .......
8003f320  28 f3 03 80 00 00 00 00-30 f3 03 80 00 00 00 00  (.......0.......
8003f330  38 f3 03 80 00 00 00 00-40 f3 03 80 00 00 00 00  8.......@.......
8003f340  48 f3 03 80 00 00 00 00-50 f3 03 80 00 00 00 00  H.......P.......
8003f350  58 f3 03 80 00 00 00 00-60 f3 03 80 00 00 00 00  X.......`.......
8003f360  68 f3 03 80 00 00 00 00-70 f3 03 80 00 00 00 00  h.......p.......
8003f370  78 f3 03 80 00 00 00 00-80 f3 03 80 00 00 00 00  x...............
8003f380  88 f3 03 80 00 00 00 00-90 f3 03 80 00 00 00 00  ................
8003f390  98 f3 03 80 00 00 00 00-a0 f3 03 80 00 00 00 00  ................
8003f3a0  a8 f3 03 80 00 00 00 00-b0 f3 03 80 00 00 00 00  ................
8003f3b0  b8 f3 03 80 00 00 00 00-c0 f3 03 80 00 00 00 00  ................
8003f3c0  c8 f3 03 80 00 00 00 00-d0 f3 03 80 00 00 00 00  ................
8003f3d0  d8 f3 03 80 00 00 00 00-e0 f3 03 80 00 00 00 00  ................
8003f3e0  e8 f3 03 80 00 00 00 00-f0 f3 03 80 00 00 00 00  ................
8003f3f0  f8 f3 03 80 00 00 00 00-00 00 00 00 00 00 00 00  ................

注意：是8字节对齐并是8的整数倍。

不过这些数据不好看，要解析，这就是我们的任务。

其实也可以这样看：

kd> dg 0 3ff
                                  P Si Gr Pr Lo
Sel    Base     Limit     Type    l ze an es ng Flags
---- -------- -------- ---------- - -- -- -- -- --------
0000 00000000 00000000 <Reserved> 0 Nb By Np Nl 00000000
0008 00000000 ffffffff Code RE Ac 0 Bg Pg P  Nl 00000c9b
0010 00000000 ffffffff Data RW Ac 0 Bg Pg P  Nl 00000c93
0018 00000000 ffffffff Code RE Ac 3 Bg Pg P  Nl 00000cfb
0020 00000000 ffffffff Data RW Ac 3 Bg Pg P  Nl 00000cf3
0028 80042000 000020ab TSS32 Busy 0 Nb By P  Nl 0000008b
0030 ffdff000 00001fff Data RW Ac 0 Bg Pg P  Nl 00000c93
0038 00000000 00000fff Data RW Ac 3 Bg By P  Nl 000004f3
0040 00000400 0000ffff Data RW    3 Nb By P  Nl 000000f2
0048 00000000 00000000 <Reserved> 0 Nb By Np Nl 00000000
0050 80552700 00000068 TSS32 Avl  0 Nb By P  Nl 00000089
0058 80552768 00000068 TSS32 Avl  0 Nb By P  Nl 00000089
0060 00022f40 0000ffff Data RW Ac 0 Nb By P  Nl 00000093
0068 000b8000 00003fff Data RW    0 Nb By P  Nl 00000092
0070 ffff7000 000003ff Data RW    0 Nb By P  Nl 00000092
0078 80400000 0000ffff Code RE    0 Nb By P  Nl 0000009a
0080 80400000 0000ffff Data RW    0 Nb By P  Nl 00000092
0088 00000000 00000000 Data RW    0 Nb By P  Nl 00000092
0090 00000000 00000000 <Reserved> 0 Nb By Np Nl 00000000
0098 00000000 00000000 <Reserved> 0 Nb By Np Nl 00000000
00A0 823816b8 00000068 TSS32 Avl  0 Nb By P  Nl 00000089
00A8 00000000 00000000 <Reserved> 0 Nb By Np Nl 00000000
00B0 00000000 00000000 <Reserved> 0 Nb By Np Nl 00000000
00B8 00000000 00000000 <Reserved> 0 Nb By Np Nl 00000000
00C0 00000000 00000000 <Reserved> 0 Nb By Np Nl 00000000
00C8 00000000 00000000 <Reserved> 0 Nb By Np Nl 00000000
00D0 00000000 00000000 <Reserved> 0 Nb By Np Nl 00000000
00D8 00000000 00000000 <Reserved> 0 Nb By Np Nl 00000000
00E0 f850f000 0000ffff Code RE Ac 0 Nb By P  Nl 0000009f
00E8 00000000 0000ffff Data RW    0 Nb By P  Nl 00000092
00F0 804fd040 000003b7 Code EO    0 Nb By P  Nl 00000098
00F8 00000000 0000ffff Data RW    0 Nb By P  Nl 00000092
0100 ba4d2400 0000ffff Data RW Ac 0 Bg By P  Nl 00000493
0108 ba4d2400 0000ffff Data RW Ac 0 Bg By P  Nl 00000493
0110 ba4d2400 0000ffff Data RW Ac 0 Bg By P  Nl 00000493
0118 00008003 0000f120 <Reserved> 0 Nb By Np Nl 00000000
0120 00008003 0000f128 <Reserved> 0 Nb By Np Nl 00000000
0128 00008003 0000f130 <Reserved> 0 Nb By Np Nl 00000000
0130 00008003 0000f138 <Reserved> 0 Nb By Np Nl 00000000
0138 00008003 0000f140 <Reserved> 0 Nb By Np Nl 00000000
0140 00008003 0000f148 <Reserved> 0 Nb By Np Nl 00000000
0148 00008003 0000f150 <Reserved> 0 Nb By Np Nl 00000000
0150 00008003 0000f158 <Reserved> 0 Nb By Np Nl 00000000
0158 00008003 0000f160 <Reserved> 0 Nb By Np Nl 00000000
0160 00008003 0000f168 <Reserved> 0 Nb By Np Nl 00000000
0168 00008003 0000f170 <Reserved> 0 Nb By Np Nl 00000000
0170 00008003 0000f178 <Reserved> 0 Nb By Np Nl 00000000
0178 00008003 0000f180 <Reserved> 0 Nb By Np Nl 00000000
0180 00008003 0000f188 <Reserved> 0 Nb By Np Nl 00000000
0188 00008003 0000f190 <Reserved> 0 Nb By Np Nl 00000000
0190 00008003 0000f198 <Reserved> 0 Nb By Np Nl 00000000
0198 00008003 0000f1a0 <Reserved> 0 Nb By Np Nl 00000000
01A0 00008003 0000f1a8 <Reserved> 0 Nb By Np Nl 00000000
01A8 00008003 0000f1b0 <Reserved> 0 Nb By Np Nl 00000000
01B0 00008003 0000f1b8 <Reserved> 0 Nb By Np Nl 00000000
01B8 00008003 0000f1c0 <Reserved> 0 Nb By Np Nl 00000000
01C0 00008003 0000f1c8 <Reserved> 0 Nb By Np Nl 00000000
01C8 00008003 0000f1d0 <Reserved> 0 Nb By Np Nl 00000000
01D0 00008003 0000f1d8 <Reserved> 0 Nb By Np Nl 00000000
01D8 00008003 0000f1e0 <Reserved> 0 Nb By Np Nl 00000000
01E0 00008003 0000f1e8 <Reserved> 0 Nb By Np Nl 00000000
01E8 00008003 0000f1f0 <Reserved> 0 Nb By Np Nl 00000000
01F0 00008003 0000f1f8 <Reserved> 0 Nb By Np Nl 00000000
01F8 00008003 0000f200 <Reserved> 0 Nb By Np Nl 00000000
0200 00008003 0000f208 <Reserved> 0 Nb By Np Nl 00000000
0208 00008003 0000f210 <Reserved> 0 Nb By Np Nl 00000000
0210 00008003 0000f218 <Reserved> 0 Nb By Np Nl 00000000
0218 00008003 0000f220 <Reserved> 0 Nb By Np Nl 00000000
0220 00008003 0000f228 <Reserved> 0 Nb By Np Nl 00000000
0228 00008003 0000f230 <Reserved> 0 Nb By Np Nl 00000000
0230 00008003 0000f238 <Reserved> 0 Nb By Np Nl 00000000
0238 00008003 0000f240 <Reserved> 0 Nb By Np Nl 00000000
0240 00008003 0000f248 <Reserved> 0 Nb By Np Nl 00000000
0248 00008003 0000f250 <Reserved> 0 Nb By Np Nl 00000000
0250 00008003 0000f258 <Reserved> 0 Nb By Np Nl 00000000
0258 00008003 0000f260 <Reserved> 0 Nb By Np Nl 00000000
0260 00008003 0000f268 <Reserved> 0 Nb By Np Nl 00000000
0268 00008003 0000f270 <Reserved> 0 Nb By Np Nl 00000000
0270 00008003 0000f278 <Reserved> 0 Nb By Np Nl 00000000
0278 00008003 0000f280 <Reserved> 0 Nb By Np Nl 00000000
0280 00008003 0000f288 <Reserved> 0 Nb By Np Nl 00000000
0288 00008003 0000f290 <Reserved> 0 Nb By Np Nl 00000000
0290 00008003 0000f298 <Reserved> 0 Nb By Np Nl 00000000
0298 00008003 0000f2a0 <Reserved> 0 Nb By Np Nl 00000000
02A0 00008003 0000f2a8 <Reserved> 0 Nb By Np Nl 00000000
02A8 00008003 0000f2b0 <Reserved> 0 Nb By Np Nl 00000000
02B0 00008003 0000f2b8 <Reserved> 0 Nb By Np Nl 00000000
02B8 00008003 0000f2c0 <Reserved> 0 Nb By Np Nl 00000000
02C0 00008003 0000f2c8 <Reserved> 0 Nb By Np Nl 00000000
02C8 00008003 0000f2d0 <Reserved> 0 Nb By Np Nl 00000000
02D0 00008003 0000f2d8 <Reserved> 0 Nb By Np Nl 00000000
02D8 00008003 0000f2e0 <Reserved> 0 Nb By Np Nl 00000000
02E0 00008003 0000f2e8 <Reserved> 0 Nb By Np Nl 00000000
02E8 00008003 0000f2f0 <Reserved> 0 Nb By Np Nl 00000000
02F0 00008003 0000f2f8 <Reserved> 0 Nb By Np Nl 00000000
02F8 00008003 0000f300 <Reserved> 0 Nb By Np Nl 00000000
0300 00008003 0000f308 <Reserved> 0 Nb By Np Nl 00000000
0308 00008003 0000f310 <Reserved> 0 Nb By Np Nl 00000000
0310 00008003 0000f318 <Reserved> 0 Nb By Np Nl 00000000
0318 00008003 0000f320 <Reserved> 0 Nb By Np Nl 00000000
0320 00008003 0000f328 <Reserved> 0 Nb By Np Nl 00000000
0328 00008003 0000f330 <Reserved> 0 Nb By Np Nl 00000000
0330 00008003 0000f338 <Reserved> 0 Nb By Np Nl 00000000
0338 00008003 0000f340 <Reserved> 0 Nb By Np Nl 00000000
0340 00008003 0000f348 <Reserved> 0 Nb By Np Nl 00000000
0348 00008003 0000f350 <Reserved> 0 Nb By Np Nl 00000000
0350 00008003 0000f358 <Reserved> 0 Nb By Np Nl 00000000
0358 00008003 0000f360 <Reserved> 0 Nb By Np Nl 00000000
0360 00008003 0000f368 <Reserved> 0 Nb By Np Nl 00000000
0368 00008003 0000f370 <Reserved> 0 Nb By Np Nl 00000000
0370 00008003 0000f378 <Reserved> 0 Nb By Np Nl 00000000
0378 00008003 0000f380 <Reserved> 0 Nb By Np Nl 00000000
0380 00008003 0000f388 <Reserved> 0 Nb By Np Nl 00000000
0388 00008003 0000f390 <Reserved> 0 Nb By Np Nl 00000000
0390 00008003 0000f398 <Reserved> 0 Nb By Np Nl 00000000
0398 00008003 0000f3a0 <Reserved> 0 Nb By Np Nl 00000000
03A0 00008003 0000f3a8 <Reserved> 0 Nb By Np Nl 00000000
03A8 00008003 0000f3b0 <Reserved> 0 Nb By Np Nl 00000000
03B0 00008003 0000f3b8 <Reserved> 0 Nb By Np Nl 00000000
03B8 00008003 0000f3c0 <Reserved> 0 Nb By Np Nl 00000000
03C0 00008003 0000f3c8 <Reserved> 0 Nb By Np Nl 00000000
03C8 00008003 0000f3d0 <Reserved> 0 Nb By Np Nl 00000000
03D0 00008003 0000f3d8 <Reserved> 0 Nb By Np Nl 00000000
03D8 00008003 0000f3e0 <Reserved> 0 Nb By Np Nl 00000000
03E0 00008003 0000f3e8 <Reserved> 0 Nb By Np Nl 00000000
03E8 00008003 0000f3f0 <Reserved> 0 Nb By Np Nl 00000000
03F0 00008003 0000f3f8 <Reserved> 0 Nb By Np Nl 00000000
03F8 00000000 00000000 <Reserved> 0 Nb By Np Nl 00000000

我们的功能就是要解析出这样的格式。

注意，另外一个话题是：也可以手动分析出这个格式，如：

kd> r cs 
cs=00000008

然后根据一定的算法得出的结论要如下（一种思路是根据_KGDTENTRY的定义）：

kd> dg cs 
                                  P Si Gr Pr Lo
Sel    Base     Limit     Type    l ze an es ng Flags
---- -------- -------- ---------- - -- -- -- -- --------
0008 00000000 ffffffff Code RE Ac 0 Bg Pg P  Nl 00000c9b

这个算法就不说了，相信你会的。

0x02 总结

简单说下吧！

GDT就是一个（数组格式的）表，里面的每一项是一个Segment Descriptors。

关于这个的格式，可见：Intel? 64 and IA-32 Architectures Software Developer’s Manual（Order Number: 325462-055US June 2015）的Volume 3: System Programming Guide的3.4.5 Segment Descriptors小节及附图。

这个Segment Descriptors具体的分两大类：

一类是：application (code or data) descriptor。这就是常见的代码/数据段，如：大多数的CS，DS都指向这里。 一类是：system descriptor

这里又分为：system-segment descriptors（LDT and TSS segments）。gate descriptors（call, interrupt, and trap gates）。

但是，这些结构在Windows下的定义是啥样呢？

经查WRK和WINDBG，结果如下：

// Special Registers for i386
typedef struct _X86_DESCRIPTOR {
    USHORT  Pad;
    USHORT  Limit;
    ULONG   Base;
} X86_DESCRIPTOR, *PX86_DESCRIPTOR;

// GDT Entry
typedef struct _KGDTENTRY {
    USHORT  LimitLow;
    USHORT  BaseLow;
    union {
        struct {
            UCHAR   BaseMid;
            UCHAR   Flags1;     // Declare as bytes to avoid alignment
            UCHAR   Flags2;     // Problems.
            UCHAR   BaseHi;
        } Bytes;
        struct {
            ULONG   BaseMid : 8;
            ULONG   Type : 5;//把S位包含进去了，也就是是否为系统段描述符的位。
            ULONG   Dpl : 2;
            ULONG   Pres : 1;
            ULONG   LimitHi : 4;
            ULONG   Sys : 1;//即AVL，系统软件自定义的。
            ULONG   Reserved_0 : 1;//LongMode
            ULONG   Default_Big : 1;//即INTEL的D/B (default operation size/default stack pointer size and/or upper bound) flag。
            ULONG   Granularity : 1;
            ULONG   BaseHi : 8;
        } Bits;
    } HighWord;
} KGDTENTRY, *PKGDTENTRY;

为啥定义的名字是KGDTENTRY呢？其实你想想结构的位置。 这个其实就是Segment Descriptors，但是定义的和INTEL的不完全一样。

kd> dt nt!_KGDTENTRY 
   +0x000 LimitLow         : Uint2B
   +0x002 BaseLow          : Uint2B
   +0x004 HighWord         : __unnamed
kd> dt nt!_KGDTENTRY -b
   +0x000 LimitLow         : Uint2B
   +0x002 BaseLow          : Uint2B
   +0x004 HighWord         : __unnamed
      +0x000 Bytes            : __unnamed
         +0x000 BaseMid          : UChar
         +0x001 Flags1           : UChar
         +0x002 Flags2           : UChar
         +0x003 BaseHi           : UChar
      +0x000 Bits             : __unnamed
         +0x000 BaseMid          : Pos 0, 8 Bits
         +0x000 Type             : Pos 8, 5 Bits
         +0x000 Dpl              : Pos 13, 2 Bits
         +0x000 Pres             : Pos 15, 1 Bit
         +0x000 LimitHi          : Pos 16, 4 Bits
         +0x000 Sys              : Pos 20, 1 Bit
         +0x000 Reserved_0       : Pos 21, 1 Bit
         +0x000 Default_Big      : Pos 22, 1 Bit
         +0x000 Granularity      : Pos 23, 1 Bit
         +0x000 BaseHi           : Pos 24, 8 Bits

具体的算法请参见： 1.INTEL的资料。 2.WRK的算法。 3.本文的代码。

上面分析的是32位下的Windows系统，再看看64位下Windows的GDT。

0: kd> vertarget 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Built by: 7601.18869.amd64fre.win7sp1_gdr.150525-0603
Machine Name:
Kernel base = 0xfffff800`01e64000 PsLoadedModuleList = 0xfffff800`020ab730
Debug session time: Thu Aug  6 14:37:33.359 2015 (UTC + 8:00)
System Uptime: 0 days 0:13:15.757
0: kd> r gdtr
gdtr=fffff80001d51000
0: kd> r gdtl
gdtl=007f
0: kd> db fffff80001d51000 L(007f + 1)
fffff800`01d51000  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
fffff800`01d51010  00 00 00 00 00 9b 20 00-ff ff 00 00 00 93 cf 00  ...... .........
fffff800`01d51020  ff ff 00 00 00 fb cf 00-ff ff 00 00 00 f3 cf 00  ................
fffff800`01d51030  00 00 00 00 00 fb 20 00-00 00 00 00 00 00 00 00  ...... .........
fffff800`01d51040  67 00 80 20 d5 8b 00 01-00 f8 ff ff 00 00 00 00  g.. ............
fffff800`01d51050  00 3c 00 a0 f9 f3 40 ff-00 00 00 00 00 00 00 00  .<....@.........
fffff800`01d51060  ff ff 00 00 00 9a cf 00-00 00 00 00 00 00 00 00  ................
fffff800`01d51070  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
0: kd> dg 0 80
                                                    P Si Gr Pr Lo
Sel        Base              Limit          Type    l ze an es ng Flags
---- ----------------- ----------------- ---------- - -- -- -- -- --------
0000 00000000`00000000 00000000`00000000 <Reserved> 0 Nb By Np Nl 00000000
0008 00000000`00000000 00000000`00000000 <Reserved> 0 Nb By Np Nl 00000000
0010 00000000`00000000 00000000`00000000 Code RE Ac 0 Nb By P  Lo 0000029b
0018 00000000`00000000 00000000`ffffffff Data RW Ac 0 Bg Pg P  Nl 00000c93
0020 00000000`00000000 00000000`ffffffff Code RE Ac 3 Bg Pg P  Nl 00000cfb
0028 00000000`00000000 00000000`ffffffff Data RW Ac 3 Bg Pg P  Nl 00000cf3
0030 00000000`00000000 00000000`00000000 Code RE Ac 3 Nb By P  Lo 000002fb
0038 00000000`00000000 00000000`00000000 <Reserved> 0 Nb By Np Nl 00000000
0040 00000000`01d52080 00000000`00000067 TSS32 Busy 0 Nb By P  Nl 0000008b
0048 00000000`0000ffff 00000000`0000f800 <Reserved> 0 Nb By Np Nl 00000000
0050 ffffffff`fff9a000 00000000`00003c00 Data RW Ac 3 Bg By P  Nl 000004f3
0058 00000000`00000000 00000000`00000000 <Reserved> 0 Nb By Np Nl 00000000
0060 00000000`00000000 00000000`ffffffff Code RE    0 Bg Pg P  Nl 00000c9a
0068 00000000`00000000 00000000`00000000 <Reserved> 0 Nb By Np Nl 00000000
0070 00000000`00000000 00000000`00000000 <Reserved> 0 Nb By Np Nl 00000000
0078 00000000`00000000 00000000`00000000 <Reserved> 0 Nb By Np Nl 00000000
0080 Unable to get descriptor

WRK及WINDBG的相关（验证）信息如下：

// Special Registers for AMD64.
typedef struct _AMD64_DESCRIPTOR {
    USHORT  Pad[3];
    USHORT  Limit;
    ULONG64 Base;
} AMD64_DESCRIPTOR, *PAMD64_DESCRIPTOR;

typedef union _KGDTENTRY64 {
    struct {
        USHORT  LimitLow;
        USHORT  BaseLow;
        union {
            struct {
                UCHAR   BaseMiddle;
                UCHAR   Flags1;
                UCHAR   Flags2;
                UCHAR   BaseHigh;
            } Bytes;

            struct {
                ULONG   BaseMiddle : 8;
                ULONG   Type : 5;//把S位包含进去了，也就是是否为系统段描述符的位。
                ULONG   Dpl : 2;
                ULONG   Present : 1;
                ULONG   LimitHigh : 4;
                ULONG   System : 1;//即AVL，系统软件自定义的。
                ULONG   LongMode : 1;
                ULONG   DefaultBig : 1;//即INTEL的D/B (default operation size/default stack pointer size and/or upper bound) flag。
                ULONG   Granularity : 1;
                ULONG   BaseHigh : 8;
            } Bits;
        };

        //ULONG BaseUpper;
        //ULONG MustBeZero;
    };

    //ULONG64 Alignment;
} KGDTENTRY64, *PKGDTENTRY64;

0: kd> dt _KGDTENTRY64
hal!_KGDTENTRY64
   +0x000 LimitLow         : Uint2B
   +0x002 BaseLow          : Uint2B
   +0x004 Bytes            : <unnamed-tag>
   +0x004 Bits             : <unnamed-tag>
   +0x008 BaseUpper        : Uint4B
   +0x00c MustBeZero       : Uint4B
   +0x000 Alignment        : Uint8B
0: kd> dt _KGDTENTRY64 -b
hal!_KGDTENTRY64
   +0x000 LimitLow         : Uint2B
   +0x002 BaseLow          : Uint2B
   +0x004 Bytes            : <unnamed-tag>
      +0x000 BaseMiddle       : UChar
      +0x001 Flags1           : UChar
      +0x002 Flags2           : UChar
      +0x003 BaseHigh         : UChar
   +0x004 Bits             : <unnamed-tag>
      +0x000 BaseMiddle       : Pos 0, 8 Bits
      +0x000 Type             : Pos 8, 5 Bits
      +0x000 Dpl              : Pos 13, 2 Bits
      +0x000 Present          : Pos 15, 1 Bit
      +0x000 LimitHigh        : Pos 16, 4 Bits
      +0x000 System           : Pos 20, 1 Bit
      +0x000 LongMode         : Pos 21, 1 Bit
      +0x000 DefaultBig       : Pos 22, 1 Bit
      +0x000 Granularity      : Pos 23, 1 Bit
      +0x000 BaseHigh         : Pos 24, 8 Bits
   +0x008 BaseUpper        : Uint4B
   +0x00c MustBeZero       : Uint4B
   +0x000 Alignment        : Uint8B

注意：1.以上只分析一个CPU的情况，如果一个计算机有多个CPU要分别处理。

2.为了和WINDBG的DG命令处理/显示的相似，特意根据INTEL的Table 3-1. Code- and Data-Segment Types，制作一个字符串数组。还有待改善。

3.GetGdtLimit的这个功能没有相应的C代码，只有汇编代码（.asm文件），包括（X86和X64）。这个代码就不附带了，相信你能做到的。

最后只有代码了，请看代码：

/*
功能：显示每个CPU的GDT信息。
注释：一下结构摘自WRK。

made by correy.
QQ:112426112.
homepage:http://correy.webs.com 注释：需翻墙，有的翻墙软件也打不开。

2008年夏天开始学习CPU的保护模式。
2015.01.11起稿。
2015年夏修改存档，尽管还有一些不完美的地方。
*/

#include <ntifs.h>
#include <windef.h>


#if defined(_AMD64_) || defined(_IA64_) //defined(_WIN64)

// Special Registers for AMD64.
typedef struct _AMD64_DESCRIPTOR {
    USHORT  Pad[3];
    USHORT  Limit;
    ULONG64 Base;
} AMD64_DESCRIPTOR, *PAMD64_DESCRIPTOR;

typedef union _KGDTENTRY64 {
    struct {
        USHORT  LimitLow;
        USHORT  BaseLow;
        union {
            struct {
                UCHAR   BaseMiddle;
                UCHAR   Flags1;
                UCHAR   Flags2;
                UCHAR   BaseHigh;
            } Bytes;

            struct {
                ULONG   BaseMiddle : 8;
                ULONG   Type : 5;//把S位包含进去了，也就是是否为系统段描述符的位。
                ULONG   Dpl : 2;
                ULONG   Present : 1;
                ULONG   LimitHigh : 4;
                ULONG   System : 1;//即AVL，系统软件自定义的。
                ULONG   LongMode : 1;
                ULONG   DefaultBig : 1;//即INTEL的D/B (default operation size/default stack pointer size and/or upper bound) flag。
                ULONG   Granularity : 1;
                ULONG   BaseHigh : 8;
            } Bits;
        };

        //ULONG BaseUpper;/*经观察，64下的结构的长度是6字节，不是上面定义的16字节。*/
        //ULONG MustBeZero;
    };

    //ULONG64 Alignment;
} KGDTENTRY64, *PKGDTENTRY64;


#else 

// Special Registers for i386
typedef struct _X86_DESCRIPTOR {
    USHORT  Pad;
    USHORT  Limit;
    ULONG   Base;
} X86_DESCRIPTOR, *PX86_DESCRIPTOR;

// GDT Entry
typedef struct _KGDTENTRY {
    USHORT  LimitLow;
    USHORT  BaseLow;
    union {
        struct {
            UCHAR   BaseMid;
            UCHAR   Flags1;     // Declare as bytes to avoid alignment
            UCHAR   Flags2;     // Problems.
            UCHAR   BaseHi;
        } Bytes;
        struct {
            ULONG   BaseMid : 8;
            ULONG   Type : 5;//把S位包含进去了，也就是是否为系统段描述符的位。
            ULONG   Dpl : 2;
            ULONG   Pres : 1;
            ULONG   LimitHi : 4;
            ULONG   Sys : 1;//即AVL，系统软件自定义的。
            ULONG   Reserved_0 : 1;//LongMode
            ULONG   Default_Big : 1;//即INTEL的D/B (default operation size/default stack pointer size and/or upper bound) flag。
            ULONG   Granularity : 1;
            ULONG   BaseHi : 8;
        } Bits;
    } HighWord;
} KGDTENTRY, *PKGDTENTRY;

#endif

/*
根据：Table 3-1. Code- and Data-Segment Types，仿照WINDBG的dg命令定义。
*/
char SegmentTypes[][256] = {
    "<Reserved>",//Data Read-Only缩写是：Data RO，也可认为是： <Reserved>。如果结构（UINT64）全部为零，也可认为是Reserved。
    "Data RO AC",//Data Read-Only, accessed
    "Data RW",//Data Read/Write
    "Data RW AC",//Data Read/Write, accessed
    "Data RO ED",//Data Read-Only, expand-down
    "Data RO ED AC",//Data Read-Only, expand-down, accessed
    "Data RW ED",//Data Read/Write, expand-down
    "Data RW ED AC",//Data Read/Write, expand-down, accessed

    "Code EO",//Code Execute-Only
    "Code EO AC",//Code Execute-Only, accessed
    "Code RE",//Code Execute/Read 加空格以便显示的对齐。
    "Code RE AC",//Code Execute/Read, accessed
    "Code EO CO",//Code Execute-Only, conforming
    "Code EO CO AC",//Code Execute-Only, conforming, accessed
    "Code RE CO",//Code Execute/Read, conforming
    "Code RE CO AC",//Code Execute/Read, conforming, accessed
    "TSS32 Busy ",//这个也可显示只要识别了TSS及内容。
    "TSS32 Avl" //这个在X86上出现了。
};  


DRIVER_UNLOAD DriverUnload;
VOID DriverUnload(__in PDRIVER_OBJECT DriverObject)
{   

}


#ifdef _X86_
__forceinline PKPCR KeGetPcr (VOID)
{
    return (PKPCR)__readfsdword(FIELD_OFFSET(KPCR, SelfPcr));
}
#endif


USHORT NTAPI GetGdtLimit ();//汇编函数。


#if defined(_WIN64)
void show_gdt(int i)
    /*
    i的取值可以是0.
    */
{
    //SIZE_T IDTR;
    //X86_DESCRIPTOR gdtr = {0};//A pointer to the memory location where the IDTR is stored.
    //KGDTENTRY * GDT = 0;
    USHORT GdtLimit = 0;

    SIZE_T r = 0;
    PVOID p = 0;
    int index = 0;
    int maximun = 0;

    PKGDTENTRY64 pkgdte;
    SIZE_T ISR = 0;

    KeSetSystemAffinityThread(i + 1);
    pkgdte = KeGetPcr()->GdtBase;//没有__sgdt,也不用sgdt汇编指令的办法。但是这个获取的没有长度。
    GdtLimit = GetGdtLimit ();//一般等于0x7f.
    KeRevertToUserAffinityThread();

    //p = &gdtr.Limit;
    //r = * (SIZE_T *)p;
    //pkgdte = (PKGDTENTRY)r; 

    /*
    其实直接：
    maximun = (idtr.Base + 1) / sizeof(KIDTENTRY);
    也可以。
    maximun一般等于256.
    */
    //if (gdtr.Pad % sizeof(KIDTENTRY) == 0) {
    //    maximun = gdtr.Pad / sizeof(KIDTENTRY);
    //} else {
    //    maximun = gdtr.Pad / sizeof(KIDTENTRY);
    //    maximun++;
    //}

    //if (GdtLimit % sizeof(KGDTENTRY64) == 0) {
    //    maximun = GdtLimit / sizeof(KGDTENTRY64);
    //} else {
    //    maximun = GdtLimit / sizeof(KGDTENTRY64);
    //    maximun++;//一般是128.
    //}

    maximun = (GdtLimit + 1) / sizeof(KGDTENTRY64);

    /*
    显示格式：    
    CPU SN Sel        Base              Limit          Type    Pl Size Gran Pres Long Flags
    --- -- ---- ----------------- ----------------- ---------- -- ---- ---- ---- ---- --------

    注释：CPU和SN是自己添加的。SN即Segment Name,如：CS，DS，FS等.
    */
    KdPrint(("Sel        Base             Limit             Type   DPl Size Gran Pres Long Flags\n"));//CPU SN 
    KdPrint(("---- ---------------- ---------------- ------------- --- ---- ---- ---- ---- --------\n"));//--- -- 
    KdPrint(("\n"));

    for ( ;index < maximun ;index++ ) 
    {
        PKGDTENTRY64 pkgdte_t = &pkgdte[index];
        SIZE_T Base = 0;
        SIZE_T Limit = 0;
        ULONG  Type = 0;
        char * size = NULL;
        char * Granularity = NULL;
        char * Present = NULL;
        char * LongMode = NULL;
        int    Flags = 0;        

        Base = pkgdte_t->Bits.BaseHigh;
        Base = (Base << 24);
        Base += (pkgdte_t->BaseLow + (pkgdte_t->Bits.BaseMiddle << 16));

        Limit = pkgdte_t->LimitLow + (pkgdte_t->Bits.LimitHigh << 16);

        if (pkgdte_t->Bits.DefaultBig && Base)
        {
            //扩充高位为1.即F.
            Base += 0xffffffff00000000;
        }      

        if (pkgdte_t->Bits.DefaultBig && pkgdte_t->Bits.Granularity)
        {
            //扩充高位为1.即F.
            SIZE_T t = Limit;
            Limit = (Limit << 12);
            Limit += PAGE_SIZE - 1;
        } 

        Type = pkgdte_t->Bits.Type;
        _bittestandreset(&Type, 4);//因为这个包含了S位，所以要清除这个位标志。

        if (pkgdte_t->Bits.DefaultBig)
        {
            size = "Bg  ";//Big 加空格是为了对齐显示。
        }
        else
        {
            size = "Nb  ";//Not Big 加空格是为了对齐显示。
        }

        if (pkgdte_t->Bits.Granularity)
        {
            Granularity = "Pg  ";//Page 加空格是为了对齐显示。
        }
        else
        {
            Granularity = "By  ";//Byte 加空格是为了对齐显示。
        }

        if (pkgdte_t->Bits.Present)
        {
            Present = "P   ";//Present 加空格是为了对齐显示。
        }
        else
        {
            Present = "NP  ";//NO Present 加空格是为了对齐显示。
        }

        if (pkgdte_t->Bits.LongMode)
        {
            LongMode = "Lo  ";//Long 加空格是为了对齐显示。
        }
        else
        {
            LongMode = "Nl  ";//NO long 加空格是为了对齐显示。
        }

        Flags = (pkgdte_t->Bytes.Flags2 >> 4);//去掉Segment limit的那几位。
        Flags = Flags << 8;
        Flags = Flags + pkgdte_t->Bytes.Flags1;

        KdPrint(("%04x %p %p %13s %03x %s %s %s %s 0x%04x\n", 
            index * 8, //sizeof (KGDTENTRY)
            Base, 
            Limit,
            SegmentTypes[Type],
            pkgdte_t->Bits.Dpl,
            size,
            Granularity,
            Present,            
            LongMode,
            Flags
            ));
    }
}
#else 
void show_gdt(int i)
    /*
    i的取值可以是0.
    */
{
    //SIZE_T IDTR;
    //X86_DESCRIPTOR gdtr = {0};//A pointer to the memory location where the IDTR is stored.
    //KGDTENTRY * GDT = 0;
    USHORT GdtLimit = 0;

    SIZE_T r = 0;
    PVOID p = 0;
    int index = 0;
    int maximun = 0;

    PKGDTENTRY pkgdte;
    SIZE_T ISR = 0;

    KeSetSystemAffinityThread(i + 1);
    pkgdte = KeGetPcr()->GDT;//没有__sgdt,也不用sgdt汇编指令的办法。但是这个获取的没有长度。
    GdtLimit = GetGdtLimit ();//一般等于0x3ff.
    KeRevertToUserAffinityThread();

    //p = &gdtr.Limit;
    //r = * (SIZE_T *)p;
    //pkgdte = (PKGDTENTRY)r; 

    /*
    其实直接：
    maximun = (idtr.Base + 1) / sizeof(KIDTENTRY);
    也可以。
    maximun一般等于256.
    */
    //if (gdtr.Pad % sizeof(KIDTENTRY) == 0) {
    //    maximun = gdtr.Pad / sizeof(KIDTENTRY);
    //} else {
    //    maximun = gdtr.Pad / sizeof(KIDTENTRY);
    //    maximun++;
    //}

    if (GdtLimit % sizeof(KGDTENTRY) == 0) {
        maximun = GdtLimit / sizeof(KGDTENTRY);
    } else {
        maximun = GdtLimit / sizeof(KGDTENTRY);
        maximun++;//一般是128.
    }

    /*
    显示格式：    
    CPU SN Sel        Base              Limit          Type    Pl Size Gran Pres Long Flags
    --- -- ---- ----------------- ----------------- ---------- -- ---- ---- ---- ---- --------

    注释：CPU和SN是自己添加的。SN即Segment Name,如：CS，DS，FS等.
    */
    KdPrint(("Sel  Base             Limit          Type DPl Size Gran Pres Long Flags\n"));//CPU SN 
    KdPrint(("---- -------- ------------- ------------- --- ---- ---- ---- ---- --------\n"));//--- -- 
    KdPrint(("\n"));

    for ( ;index < maximun ;index++ ) 
    {
        PKGDTENTRY pkgdte_t = &pkgdte[index];
        SIZE_T Base = 0;
        SIZE_T Limit = 0;
        ULONG  Type = 0;
        char * size = NULL;
        char * Granularity = NULL;
        char * Present = NULL;
        char * LongMode = NULL;
        int    Flags = 0;   

        //注意：0x38处的值不停的变化。
        USHORT  BaseLow = pkgdte_t->BaseLow;
        ULONG   BaseMid = pkgdte_t->HighWord.Bits.BaseMid;
        ULONG   BaseHi = pkgdte_t->HighWord.Bits.BaseHi;
        Base = (BaseHi << 24) + (BaseMid << 16) + BaseLow;//其实用位与更快 | 。

        if (pkgdte_t->HighWord.Bits.Granularity && BooleanFlagOn(pkgdte_t->HighWord.Bits.Type, 2 ) ) {//关于标志位及算法，见权威资料。
            Limit = pkgdte_t->LimitLow + (pkgdte_t->HighWord.Bits.LimitHi << 16);
            Limit *= PAGE_SIZE;
            Limit += PAGE_SIZE - 1;
        } else {
            Limit = pkgdte_t->LimitLow + (pkgdte_t->HighWord.Bits.LimitHi << 16);
        }

        Type = pkgdte_t->HighWord.Bits.Type;
        _bittestandreset(&Type, 4);//因为这个包含了S位，所以要清除这个位标志。

        if (pkgdte_t->HighWord.Bits.Default_Big)
        {
            size = "Bg  ";//Big 加空格是为了对齐显示。
        }
        else
        {
            size = "Nb  ";//Not Big 加空格是为了对齐显示。
        }

        if (pkgdte_t->HighWord.Bits.Granularity)
        {
            Granularity = "Pg  ";//Page 加空格是为了对齐显示。
        }
        else
        {
            Granularity = "By  ";//Byte 加空格是为了对齐显示。
        }

        if (pkgdte_t->HighWord.Bits.Pres)
        {
            Present = "P   ";//Present 加空格是为了对齐显示。
        }
        else
        {
            Present = "NP  ";//NO Present 加空格是为了对齐显示。
        }

        if (pkgdte_t->HighWord.Bits.Reserved_0)
        {
            LongMode = "Lo  ";//Long 加空格是为了对齐显示。
        }
        else
        {
            LongMode = "Nl  ";//NO long 加空格是为了对齐显示。
        }

        Flags = (pkgdte_t->HighWord.Bytes.Flags2 >> 4);//去掉Segment limit的那几位。
        Flags = Flags << 8;
        Flags = Flags + pkgdte_t->HighWord.Bytes.Flags1;

        KdPrint(("%04x %p %p %13s %03x %s %s %s %s 0x%04x\n", 
            index * 8, //sizeof (KGDTENTRY)
            Base, 
            Limit,
            SegmentTypes[Type],
            pkgdte_t->HighWord.Bits.Dpl,
            size,
            Granularity,
            Present,            
            LongMode,
            Flags
            ));
    }
}
#endif


#pragma INITCODE
DRIVER_INITIALIZE DriverEntry;
NTSTATUS DriverEntry(__in struct _DRIVER_OBJECT * DriverObject, __in PUNICODE_STRING RegistryPath)
{
    int i = 0;

    KdBreakPoint();

    DriverObject->DriverUnload = DriverUnload;

    for ( ;i < KeNumberProcessors ;i++ )//KeQueryMaximumProcessorCount()  KeGetCurrentProcessorNumber
    {        
        show_gdt(i);        
    }

    return STATUS_SUCCESS;
}

结果及验证：

32位Windows的结果：

kd> g
Sel  Base             Limit          Type DPl Size Gran Pres Long Flags
---- -------- ------------- ------------- --- ---- ---- ---- ---- --------

0000 00000000 00000000    <Reserved> 000 Nb   By   NP   Nl   0x0000
0008 00000000 FFFFFFFF    Code RE AC 000 Bg   Pg   P    Nl   0x0c9b
0010 00000000 FFFFFFFF    Data RW AC 000 Bg   Pg   P    Nl   0x0c93
0018 00000000 FFFFFFFF    Code RE AC 003 Bg   Pg   P    Nl   0x0cfb
0020 00000000 FFFFFFFF    Data RW AC 003 Bg   Pg   P    Nl   0x0cf3
0028 80042000 000020AB    Code RE AC 000 Nb   By   P    Nl   0x008b
0030 FFDFF000 00001FFF    Data RW AC 000 Bg   Pg   P    Nl   0x0c93
0038 00000000 00000FFF    Data RW AC 003 Bg   By   P    Nl   0x04f3
0040 00000400 0000FFFF       Data RW 003 Nb   By   P    Nl   0x00f2
0048 00000000 00000000    <Reserved> 000 Nb   By   NP   Nl   0x0000
0050 80552700 00000068    Code EO AC 000 Nb   By   P    Nl   0x0089
0058 80552768 00000068    Code EO AC 000 Nb   By   P    Nl   0x0089
0060 00022F40 0000FFFF    Data RW AC 000 Nb   By   P    Nl   0x0093
0068 000B8000 00003FFF       Data RW 000 Nb   By   P    Nl   0x0092
0070 FFFF7000 000003FF       Data RW 000 Nb   By   P    Nl   0x0092
0078 80400000 0000FFFF       Code RE 000 Nb   By   P    Nl   0x009a
0080 80400000 0000FFFF       Data RW 000 Nb   By   P    Nl   0x0092
0088 00000000 00000000       Data RW 000 Nb   By   P    Nl   0x0092
0090 00000000 00000000    <Reserved> 000 Nb   By   NP   Nl   0x0000
0098 00000000 00000000    <Reserved> 000 Nb   By   NP   Nl   0x0000
00a0 823816B8 00000068    Code EO AC 000 Nb   By   P    Nl   0x0089
00a8 00000000 00000000    <Reserved> 000 Nb   By   NP   Nl   0x0000
00b0 00000000 00000000    <Reserved> 000 Nb   By   NP   Nl   0x0000
00b8 00000000 00000000    <Reserved> 000 Nb   By   NP   Nl   0x0000
00c0 00000000 00000000    <Reserved> 000 Nb   By   NP   Nl   0x0000
00c8 00000000 00000000    <Reserved> 000 Nb   By   NP   Nl   0x0000
00d0 00000000 00000000    <Reserved> 000 Nb   By   NP   Nl   0x0000
00d8 00000000 00000000    <Reserved> 000 Nb   By   NP   Nl   0x0000
00e0 F850F000 0000FFFF Code RE CO AC 000 Nb   By   P    Nl   0x009f
00e8 00000000 0000FFFF       Data RW 000 Nb   By   P    Nl   0x0092
00f0 804FD040 000003B7       Code EO 000 Nb   By   P    Nl   0x0098
00f8 00000000 0000FFFF       Data RW 000 Nb   By   P    Nl   0x0092
0100 BA4D2400 0000FFFF    Data RW AC 000 Bg   By   P    Nl   0x0493
0108 BA4D2400 0000FFFF    Data RW AC 000 Bg   By   P    Nl   0x0493
0110 BA4D2400 0000FFFF    Data RW AC 000 Bg   By   P    Nl   0x0493
0118 00008003 0000F120    <Reserved> 000 Nb   By   NP   Nl   0x0000
0120 00008003 0000F128    <Reserved> 000 Nb   By   NP   Nl   0x0000
0128 00008003 0000F130    <Reserved> 000 Nb   By   NP   Nl   0x0000
0130 00008003 0000F138    <Reserved> 000 Nb   By   NP   Nl   0x0000
0138 00008003 0000F140    <Reserved> 000 Nb   By   NP   Nl   0x0000
0140 00008003 0000F148    <Reserved> 000 Nb   By   NP   Nl   0x0000
0148 00008003 0000F150    <Reserved> 000 Nb   By   NP   Nl   0x0000
0150 00008003 0000F158    <Reserved> 000 Nb   By   NP   Nl   0x0000
0158 00008003 0000F160    <Reserved> 000 Nb   By   NP   Nl   0x0000
0160 00008003 0000F168    <Reserved> 000 Nb   By   NP   Nl   0x0000
0168 00008003 0000F170    <Reserved> 000 Nb   By   NP   Nl   0x0000
0170 00008003 0000F178    <Reserved> 000 Nb   By   NP   Nl   0x0000
0178 00008003 0000F180    <Reserved> 000 Nb   By   NP   Nl   0x0000
0180 00008003 0000F188    <Reserved> 000 Nb   By   NP   Nl   0x0000
0188 00008003 0000F190    <Reserved> 000 Nb   By   NP   Nl   0x0000
0190 00008003 0000F198    <Reserved> 000 Nb   By   NP   Nl   0x0000
0198 00008003 0000F1A0    <Reserved> 000 Nb   By   NP   Nl   0x0000
01a0 00008003 0000F1A8    <Reserved> 000 Nb   By   NP   Nl   0x0000
01a8 00008003 0000F1B0    <Reserved> 000 Nb   By   NP   Nl   0x0000
01b0 00008003 0000F1B8    <Reserved> 000 Nb   By   NP   Nl   0x0000
01b8 00008003 0000F1C0    <Reserved> 000 Nb   By   NP   Nl   0x0000
01c0 00008003 0000F1C8    <Reserved> 000 Nb   By   NP   Nl   0x0000
01c8 00008003 0000F1D0    <Reserved> 000 Nb   By   NP   Nl   0x0000
01d0 00008003 0000F1D8    <Reserved> 000 Nb   By   NP   Nl   0x0000
01d8 00008003 0000F1E0    <Reserved> 000 Nb   By   NP   Nl   0x0000
01e0 00008003 0000F1E8    <Reserved> 000 Nb   By   NP   Nl   0x0000
01e8 00008003 0000F1F0    <Reserved> 000 Nb   By   NP   Nl   0x0000
01f0 00008003 0000F1F8    <Reserved> 000 Nb   By   NP   Nl   0x0000
01f8 00008003 0000F200    <Reserved> 000 Nb   By   NP   Nl   0x0000
0200 00008003 0000F208    <Reserved> 000 Nb   By   NP   Nl   0x0000
0208 00008003 0000F210    <Reserved> 000 Nb   By   NP   Nl   0x0000
0210 00008003 0000F218    <Reserved> 000 Nb   By   NP   Nl   0x0000
0218 00008003 0000F220    <Reserved> 000 Nb   By   NP   Nl   0x0000
0220 00008003 0000F228    <Reserved> 000 Nb   By   NP   Nl   0x0000
0228 00008003 0000F230    <Reserved> 000 Nb   By   NP   Nl   0x0000
0230 00008003 0000F238    <Reserved> 000 Nb   By   NP   Nl   0x0000
0238 00008003 0000F240    <Reserved> 000 Nb   By   NP   Nl   0x0000
0240 00008003 0000F248    <Reserved> 000 Nb   By   NP   Nl   0x0000
0248 00008003 0000F250    <Reserved> 000 Nb   By   NP   Nl   0x0000
0250 00008003 0000F258    <Reserved> 000 Nb   By   NP   Nl   0x0000
0258 00008003 0000F260    <Reserved> 000 Nb   By   NP   Nl   0x0000
0260 00008003 0000F268    <Reserved> 000 Nb   By   NP   Nl   0x0000
0268 00008003 0000F270    <Reserved> 000 Nb   By   NP   Nl   0x0000
0270 00008003 0000F278    <Reserved> 000 Nb   By   NP   Nl   0x0000
0278 00008003 0000F280    <Reserved> 000 Nb   By   NP   Nl   0x0000
0280 00008003 0000F288    <Reserved> 000 Nb   By   NP   Nl   0x0000
0288 00008003 0000F290    <Reserved> 000 Nb   By   NP   Nl   0x0000
0290 00008003 0000F298    <Reserved> 000 Nb   By   NP   Nl   0x0000
0298 00008003 0000F2A0    <Reserved> 000 Nb   By   NP   Nl   0x0000
02a0 00008003 0000F2A8    <Reserved> 000 Nb   By   NP   Nl   0x0000
02a8 00008003 0000F2B0    <Reserved> 000 Nb   By   NP   Nl   0x0000
02b0 00008003 0000F2B8    <Reserved> 000 Nb   By   NP   Nl   0x0000
02b8 00008003 0000F2C0    <Reserved> 000 Nb   By   NP   Nl   0x0000
02c0 00008003 0000F2C8    <Reserved> 000 Nb   By   NP   Nl   0x0000
02c8 00008003 0000F2D0    <Reserved> 000 Nb   By   NP   Nl   0x0000
02d0 00008003 0000F2D8    <Reserved> 000 Nb   By   NP   Nl   0x0000
02d8 00008003 0000F2E0    <Reserved> 000 Nb   By   NP   Nl   0x0000
02e0 00008003 0000F2E8    <Reserved> 000 Nb   By   NP   Nl   0x0000
02e8 00008003 0000F2F0    <Reserved> 000 Nb   By   NP   Nl   0x0000
02f0 00008003 0000F2F8    <Reserved> 000 Nb   By   NP   Nl   0x0000
02f8 00008003 0000F300    <Reserved> 000 Nb   By   NP   Nl   0x0000
0300 00008003 0000F308    <Reserved> 000 Nb   By   NP   Nl   0x0000
0308 00008003 0000F310    <Reserved> 000 Nb   By   NP   Nl   0x0000
0310 00008003 0000F318    <Reserved> 000 Nb   By   NP   Nl   0x0000
0318 00008003 0000F320    <Reserved> 000 Nb   By   NP   Nl   0x0000
0320 00008003 0000F328    <Reserved> 000 Nb   By   NP   Nl   0x0000
0328 00008003 0000F330    <Reserved> 000 Nb   By   NP   Nl   0x0000
0330 00008003 0000F338    <Reserved> 000 Nb   By   NP   Nl   0x0000
0338 00008003 0000F340    <Reserved> 000 Nb   By   NP   Nl   0x0000
0340 00008003 0000F348    <Reserved> 000 Nb   By   NP   Nl   0x0000
0348 00008003 0000F350    <Reserved> 000 Nb   By   NP   Nl   0x0000
0350 00008003 0000F358    <Reserved> 000 Nb   By   NP   Nl   0x0000
0358 00008003 0000F360    <Reserved> 000 Nb   By   NP   Nl   0x0000
0360 00008003 0000F368    <Reserved> 000 Nb   By   NP   Nl   0x0000
0368 00008003 0000F370    <Reserved> 000 Nb   By   NP   Nl   0x0000
0370 00008003 0000F378    <Reserved> 000 Nb   By   NP   Nl   0x0000
0378 00008003 0000F380    <Reserved> 000 Nb   By   NP   Nl   0x0000
0380 00008003 0000F388    <Reserved> 000 Nb   By   NP   Nl   0x0000
0388 00008003 0000F390    <Reserved> 000 Nb   By   NP   Nl   0x0000
0390 00008003 0000F398    <Reserved> 000 Nb   By   NP   Nl   0x0000
0398 00008003 0000F3A0    <Reserved> 000 Nb   By   NP   Nl   0x0000
03a0 00008003 0000F3A8    <Reserved> 000 Nb   By   NP   Nl   0x0000
03a8 00008003 0000F3B0    <Reserved> 000 Nb   By   NP   Nl   0x0000
03b0 00008003 0000F3B8    <Reserved> 000 Nb   By   NP   Nl   0x0000
03b8 00008003 0000F3C0    <Reserved> 000 Nb   By   NP   Nl   0x0000
03c0 00008003 0000F3C8    <Reserved> 000 Nb   By   NP   Nl   0x0000
03c8 00008003 0000F3D0    <Reserved> 000 Nb   By   NP   Nl   0x0000
03d0 00008003 0000F3D8    <Reserved> 000 Nb   By   NP   Nl   0x0000
03d8 00008003 0000F3E0    <Reserved> 000 Nb   By   NP   Nl   0x0000
03e0 00008003 0000F3E8    <Reserved> 000 Nb   By   NP   Nl   0x0000
03e8 00008003 0000F3F0    <Reserved> 000 Nb   By   NP   Nl   0x0000
03f0 00008003 0000F3F8    <Reserved> 000 Nb   By   NP   Nl   0x0000
03f8 00000000 00000000    <Reserved> 000 Nb   By   NP   Nl   0x0000

验证，可以和前面的显示做对比。

64位Windows的结果：

0: kd> g
Sel        Base             Limit             Type   DPl Size Gran Pres Long Flags
---- ---------------- ---------------- ------------- --- ---- ---- ---- ---- --------

0000 0000000000000000 0000000000000000    <Reserved> 000 Nb   By   NP   Nl   0x0000
0008 0000000000000000 0000000000000000    <Reserved> 000 Nb   By   NP   Nl   0x0000
0010 0000000000000000 0000000000000000    Code RE AC 000 Nb   By   P    Lo   0x029b
0018 0000000000000000 00000000FFFFFFFF    Data RW AC 000 Bg   Pg   P    Nl   0x0c93
0020 0000000000000000 00000000FFFFFFFF    Code RE AC 003 Bg   Pg   P    Nl   0x0cfb
0028 0000000000000000 00000000FFFFFFFF    Data RW AC 003 Bg   Pg   P    Nl   0x0cf3
0030 0000000000000000 0000000000000000    Code RE AC 003 Nb   By   P    Lo   0x02fb
0038 0000000000000000 0000000000000000    <Reserved> 000 Nb   By   NP   Nl   0x0000
0040 0000000001D52080 0000000000000067    Code RE AC 000 Nb   By   P    Nl   0x008b
0048 000000000000FFFF 000000000000F800    <Reserved> 000 Nb   By   NP   Nl   0x0000
0050 FFFFFFFFFFFA0000 0000000000003C00    Data RW AC 003 Bg   By   P    Nl   0x04f3
0058 0000000000000000 0000000000000000    <Reserved> 000 Nb   By   NP   Nl   0x0000
0060 0000000000000000 00000000FFFFFFFF       Code RE 000 Bg   Pg   P    Nl   0x0c9a
0068 0000000000000000 0000000000000000    <Reserved> 000 Nb   By   NP   Nl   0x0000
0070 0000000000000000 0000000000000000    <Reserved> 000 Nb   By   NP   Nl   0x0000
0078 0000000000000000 0000000000000000    <Reserved> 000 Nb   By   NP   Nl   0x0000
Sel        Base             Limit             Type   DPl Size Gran Pres Long Flags
---- ---------------- ---------------- ------------- --- ---- ---- ---- ---- --------

0000 0000000000000000 0000000000000000    <Reserved> 000 Nb   By   NP   Nl   0x0000
0008 0000000000000000 0000000000000000    <Reserved> 000 Nb   By   NP   Nl   0x0000
0010 0000000000000000 0000000000000000    Code RE AC 000 Nb   By   P    Lo   0x029b
0018 0000000000000000 00000000FFFFFFFF    Data RW AC 000 Bg   Pg   P    Nl   0x0c93
0020 0000000000000000 00000000FFFFFFFF    Code RE AC 003 Bg   Pg   P    Nl   0x0cfb
0028 0000000000000000 00000000FFFFFFFF    Data RW AC 003 Bg   Pg   P    Nl   0x0cf3
0030 0000000000000000 0000000000000000    Code RE AC 003 Nb   By   P    Lo   0x02fb
0038 0000000000000000 0000000000000000    <Reserved> 000 Nb   By   NP   Nl   0x0000
0040 00000000009F7E40 0000000000000067    Code RE AC 000 Nb   By   P    Nl   0x008b
0048 000000000000FFFF 000000000000F880    <Reserved> 000 Nb   By   NP   Nl   0x0000
0050 FFFFFFFFFFFE0000 0000000000007C00    Data RW AC 003 Bg   By   P    Nl   0x04f3
0058 0000000000000000 0000000000000000    <Reserved> 000 Nb   By   NP   Nl   0x0000
0060 0000000000000000 00000000FFFFFFFF       Code RE 000 Bg   Pg   P    Nl   0x0c9a
0068 0000000000000000 0000000000000000    <Reserved> 000 Nb   By   NP   Nl   0x0000
0070 0000000000000000 0000000000000000    <Reserved> 000 Nb   By   NP   Nl   0x0000
0078 0000000000000000 0000000000000000    <Reserved> 000 Nb   By   NP   Nl   0x0000

验证，可以和前面（某个）的显示做对比。

这里显示2个，是因为有两个CPU。

细心的你应该（从对比中）还会发现一些不足和不一样的地方，期待你的改正，剩下的任务也就是你要改正的地方。

如：添加显示CPU的个数，及段的名字（特别是系统段，各种门）等。

不当之处，敬请指出。

评论

路

路人甲

真正的路人甲.

twitter weibo github wechat

随机分类

软件安全 文章：17 篇
SQL注入 文章：39 篇
事件分析 文章：223 篇
CTF 文章：62 篇
运维安全 文章：62 篇

扫码关注公众号

WeChat Offical Account QRCode

最新评论

Article_kelp

因为这里的静态目录访功能应该理解为绑定在static路径下的内置路由，你需要用s

N

Nas

师傅您好！_static_url_path那 flag在当前目录下 通过原型链污

Z

zhangy

你好，为什么我也是用windows2016和win10，但是流量是smb3，加密

K

k0uaz

foniw师傅提到的setfge当在类的字段名成是age时不会自动调用。因为获取

Yukong

🐮皮

目录