View shadow ssdt in windbg

The kernel has exported the keservicedescriptortable. You can run the DD command in windbg to view the shadow serving Service. The second is to view the win32k. sys service.

In ring3, three important system DLL, kernel32.dll, user32.dll, and gdi32.dll, correspond to kernel32.dll-> ntoskrnl.exe, user32.dll, gdi32.dll-> win32k. SYS. to view win32k. sys service table, must enterProcess context with user session(However, if you want to use the U command for the function in shadowssdt to switch to a process with a GUI), win32k. sys will be loaded. The specific command process is as follows:

1 .! Process 0 0 // enumeration process ,! Command

2. Process/p xxxxxxxx // XXXXXXXX indicates _ eprocess address,. Command

3. dd poi [KeServiceDescriptorTable-0x40 + 0x10] // + 0x10 indicates skipping ntoskrnl system_service_table

 

If you find that the shadow ssdt kids shoes cannot be viewed in windbg, refer to ^_^.

 

Update: 2011-11-22 correct the process context error. Thank you for your advice from the honkerhzt brothers.