当前位置：首页 > news >正文

nt!MiSessionAddProcess函数分析和nt!MmSessionSpace全局变量的关系

news 来源：原创 2025/5/5 7:49:11

第一部分：
1: kd> g
Breakpoint 42 hit
nt!MiSessionAddProcess:
80ab2fbe 55 push ebp
1: kd> kc
#
00 nt!MiSessionAddProcess
01 nt!MmCreateProcessAddressSpace
02 nt!PspCreateProcess
03 nt!NtCreateProcessEx
04 nt!_KiSystemService
05 SharedUserData!SystemCallStub
06 ntdll!NtCreateProcessEx
07 kernel32!CreateProcessInternalW
08 kernel32!CreateProcessW
09 winlogon!StartSystemProcess
0a winlogon!ExecSystemProcesses
0b winlogon!WinMain
0c winlogon!WinMainCRTStartup

#define SESSION_GLOBAL(_Session) (_Session->GlobalVirtualAddress)

第二部分：
1: kd> x nt!MmSessionSpace
80bf0048          nt!MmSessionSpace = 0xbf7f0000
1: kd> dx -r1 ((ntkrnlmp!_MM_SESSION_SPACE *)0xbf7f0000)
((ntkrnlmp!_MM_SESSION_SPACE *)0xbf7f0000)                 : 0xbf7f0000 [Type: _MM_SESSION_SPACE *]
    [+0x000] GlobalVirtualAddress : 0xf79b1000 [Type: _MM_SESSION_SPACE *]

0xf79b1000

1: kd> dx -r1 ((ntkrnlmp!_MM_SESSION_SPACE *)0xbf7f0000)
((ntkrnlmp!_MM_SESSION_SPACE *)0xbf7f0000)                 : 0xbf7f0000 [Type: _MM_SESSION_SPACE *]
    [+0x000] GlobalVirtualAddress : 0xf79b1000 [Type: _MM_SESSION_SPACE *]
    [+0x004] ReferenceCount   : 0x2 [Type: unsigned long]
    [+0x008] u                [Type: __unnamed]
    [+0x00c] SessionId        : 0x0 [Type: unsigned long]
    [+0x010] ProcessList      [Type: _LIST_ENTRY]
    [+0x018] LastProcessSwappedOutTime : {0} [Type: _LARGE_INTEGER]
    [+0x020] SessionPageDirectoryIndex : 0x7b44e [Type: unsigned long]
    [+0x024] NonPagablePages : 0x10 [Type: unsigned long]
    [+0x028] CommittedPages   : 0x3e [Type: unsigned long]
    [+0x02c] PagedPoolStart   : 0xbc000000 [Type: void *]
    [+0x030] PagedPoolEnd     : 0xbc3fffff [Type: void *]
    [+0x034] PagedPoolBasePde : 0xc0300bc0 [Type: _MMPTE *]
    [+0x038] Color            : 0x37 [Type: unsigned long]
    [+0x03c] ProcessOutSwapCount : 0x0 [Type: unsigned long]
    [+0x040] SessionPoolAllocationFailures [Type: unsigned long [4]]
    [+0x050] ImageList        [Type: _LIST_ENTRY]
    [+0x058] LocaleId         : 0x409 [Type: unsigned long]
    [+0x05c] AttachCount      : 0x0 [Type: unsigned long]
    [+0x060] AttachEvent      [Type: _KEVENT]
    [+0x070] LastProcess      : 0x0 [Type: _EPROCESS *]
    [+0x074] ProcessReferenceToSession : 2 [Type: long]
    [+0x078] WsListEntry      [Type: _LIST_ENTRY]
    [+0x080] Lookaside        [Type: _GENERAL_LOOKASIDE [26]]
    [+0xd80] Session          [Type: _MMSESSION]
    [+0xdc0] PagedPoolMutex   [Type: _KGUARDED_MUTEX]
    [+0xde0] PagedPoolInfo    [Type: _MM_PAGED_POOL_INFO]
    [+0xe00] Vm               [Type: _MMSUPPORT]
    [+0xe60] Wsle             : 0xbf400038 [Type: _MMWSLE *]
    [+0xe64] Win32KDriverUnload : 0xbf8aaad0 [Type: void (*)(_DRIVER_OBJECT *)]
    [+0xe68] PagedPool        [Type: _POOL_DESCRIPTOR]
    [+0x1e98] PageTables       : 0x89579e00 [Type: _MMPTE *]
    [+0x1e9c] ImageLoadingCount : 0 [Type: long]
    [+0x1ea0] Debug            [Type: unsigned long [56]]
    [+0x1f80] Debug2           [Type: _MM_SESSION_MEMORY_COUNTERS [8]]

第三部分：
1: kd> dt nt!MmSessionPoolSize
0x400000
1: kd> dt nt!MiSessionPoolStart
0xbc000000
1: kd> dt nt!MiSessionViewStart
0xbc400000

1: kd> lm
start end module name
bf800000 bfa9a000 win32k (private pdb symbols) j:\retail-checked\sys\win32k.pdb

1: kd> dt nt!MiSessionImageStart
0xbf800000

BOOLEAN
MmInitSystem (
    IN ULONG Phase,
    IN PLOADER_PARAMETER_BLOCK LoaderBlock
    )
{

        //
        // Initialize some global session variables.
        //

MmSessionSpace = (PMM_SESSION_SPACE)((ULONG_PTR)MmSessionBase + MmSessionSize - MmSessionImageSize - MI_SESSION_SPACE_STRUCT_SIZE);

MmSessionSpace=0xbc000000+0x4000000-0x800000-0x10000=0xbf7f0000

1: kd> dt nt!MmSessionBase
0xbc000000
1: kd> dt nt!MmSessionSize
0x4000000
1: kd> dt nt!MmSessionImageSize
0x800000
#define MI_SESSION_SPACE_STRUCT_SIZE MM_ALLOCATION_GRANULARITY
#define MM_ALLOCATION_GRANULARITY ((ULONG)0x10000)

Virtual memory layout of session space when loaded down from 0xC0000000.

Note that the sizes of mapped views, paged pool and images are registry
tunable on 32-bit systems (if NOT booted /3GB, as 3GB has very limited
address space).

                 +------------------------------------+
        C0000000 |                                    |
                 | win32k.sys, video drivers and any |
                 | rebased NT4 printer drivers.       |
                 |                                    |
                 |             (8MB)                  |
                 |                                    |
                 +------------------------------------+
        BF800000 |                                    |
                 |   MM_SESSION_SPACE & Session WSLs |
                 |              (4MB)                 |
                 |                                    |
                 +------------------------------------+
        BF400000 |                                    |
                 |   Mapped views for this session    |
                 |     (20MB by default, but is       |
                 |      registry configurable)        |
                 |                                    |
                 +------------------------------------+
        BE000000 |                                    |
                 |   Paged pool for this session      |
                 |     (16MB by default, but is       |
                 |      registry configurable)        |
                 |                                    |
        BD000000 +------------------------------------+

第四部分：函数返回后

1: kd> dx -r1 (*((ntkrnlmp!_LIST_ENTRY *)0xbf7f0010))
(*((ntkrnlmp!_LIST_ENTRY *)0xbf7f0010))                 [Type: _LIST_ENTRY]
    [+0x000] Flink            : 0x895ea304 [Type: _LIST_ENTRY *]
    [+0x004] Blink            : 0x89544304 [Type: _LIST_ENTRY *]
1: kd> dx -r1 ((ntkrnlmp!_LIST_ENTRY *)0x895ea304)
((ntkrnlmp!_LIST_ENTRY *)0x895ea304)                 : 0x895ea304 [Type: _LIST_ENTRY *]
    [+0x000] Flink            : 0x895140d4 [Type: _LIST_ENTRY *]
    [+0x004] Blink            : 0xf79b1010 [Type: _LIST_ENTRY *]
1: kd> dx -r1 ((ntkrnlmp!_LIST_ENTRY *)0x89544304)
((ntkrnlmp!_LIST_ENTRY *)0x89544304)                 : 0x89544304 [Type: _LIST_ENTRY *]
    [+0x000] Flink            : 0xf79b1010 [Type: _LIST_ENTRY *]
    [+0x004] Blink            : 0x895140d4 [Type: _LIST_ENTRY *]