win7下winlogon.exe调试记录
第一部分：
kd> !PROCESS fffffa8021520630
PROCESS fffffa8021520630
SessionId: 1 Cid: 01fc Peb: 7fffffd9000 ParentCid: 018c
DirBase: 4fafa000 ObjectTable: fffff8a000e6b920 HandleCount: 0.
Image: winlogon.exe
VadRoot fffffa8021522d30 Vads 10 Clone 0 Private 15. Modified 0. Locked 0.
DeviceMap 0000000000000000
Token fffff8a000e7c680
ElapsedTime 00:00:00.390
UserTime 00:00:00.000
KernelTime 00:00:00.000
QuotaPoolUsage[PagedPool] 13568
QuotaPoolUsage[NonPagedPool] 1080
Working Set Sizes (now,min,max) (21, 50, 345) (84KB, 200KB, 1380KB)
PeakWorkingSetSize 21
VirtualSize 5 Mb
PeakVirtualSize 5 Mb
PageFaultCount 16
MemoryPriority BACKGROUND
BasePriority 8
CommitCharge 734
THREAD fffffa802150c660 Cid 01fc.0200 Teb: 000007fffffde000 Win32Thread: 0000000000000000 READY on processor 0
Not impersonating
Owning Process fffffa8021520630 Image: winlogon.exe
Attached Process N/A Image: N/A
Wait Start TickCount 275087847 Ticks: 25 (0:00:00:00.390)
Context Switch Count 0 IdealProcessor: 0
UserTime 00:00:00.000
KernelTime 00:00:00.000
Win32 Start Address 0x00000000ff3ed124
Stack Init fffff880042dad70 Current fffff880042daa60
Base fffff880042db000 Limit fffff880042d5000 Call 0000000000000000
Priority 8 BasePriority 8 PriorityDecrement 0 IoPriority 2 PagePriority 5
Child-SP RetAddr Call Site
fffff880`042daaa0 fffff800`02a6bad7 nt!KiStartUserThread
fffff880`042dabe0 00000000`777b943c nt!KiStartUserThreadReturn (TrapFrame @ fffff880`042dabe0)
00000000`000afac8 00000000`00000000 0x777b943c
第二部分：
kd> t
Breakpoint 9 hit
winlogon!WinMainCRTStartup:
0033:00000000`ff3ed124 ?? ???
kd> kc
# Call Site
00 winlogon!WinMainCRTStartup
01 kernel32!BaseThreadInitThunk
02 ntdll!RtlUserThreadStart
kd> kc
# Call Site
00 winlogon!WinMainCRTStartup
01 kernel32!BaseThreadInitThunk
02 ntdll!RtlUserThreadStart
kd> pc
winlogon!WinMainCRTStartup+0x4:
0033:00000000`ff3ed128 e8e3020000 call winlogon!_security_init_cookie (00000000`ff3ed410)
kd> p
winlogon!WinMainCRTStartup+0x9:
0033:00000000`ff3ed12d 4883c428 add rsp,28h
kd> pc
winlogon!DbgSetLoggingOption+0xc0:
0033:00000000`ff3ece10 ?? ???
kd> pc
winlogon!DbgSetLoggingOption+0xdd:
0033:00000000`ff3ece2d ff15a544fbff call qword ptr [winlogon!_imp_GetStartupInfoW (00000000`ff3a12d8)]
kd> pc
winlogon!DbgSetLoggingOption+0x16a:
0033:00000000`ff3eceba ffd1 call rcx
kd> r
rax=0000000000000000 rbx=0000000000000000 rcx=00000000ff3ed04c
rdx=00000000000af9d0 rsi=0000000000000000 rdi=00000000ff3a1be8
rip=00000000ff3eceba rsp=00000000000af990 rbp=0000000000000000
r8=00000000002621e0 r9=0000000000000000 r10=0000000000000000
r11=ffffed13852b8d76 r12=00000000ff3a1bf8 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000202
winlogon!DbgSetLoggingOption+0x16a:
0033:00000000`ff3eceba ffd1 call rcx {winlogon!DbgSetLoggingOption+0x2fc (00000000`ff3ed04c)}
kd> pc
winlogon!DbgSetLoggingOption+0x16a:
0033:00000000`ff3eceba ffd1 call rcx
kd> r
rax=0000000000000000 rbx=0000000000000000 rcx=00000000ff3ed1fc
rdx=00000000ff3a0000 rsi=0000000000000000 rdi=00000000ff3a1bf0
rip=00000000ff3eceba rsp=00000000000af990 rbp=0000000000000000
r8=0000000000000000 r9=0000000000000000 r10=0000000000000000
r11=ffffffffffffffff r12=00000000ff3a1bf8 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000206
winlogon!DbgSetLoggingOption+0x16a:
0033:00000000`ff3eceba ffd1 call rcx {winlogon!_CxxSetUnhandledExceptionFilter (00000000`ff3ed1fc)}
kd> pc
winlogon!DbgSetLoggingOption+0x1ac:
0033:00000000`ff3ecefc e827040000 call winlogon!initterm (00000000`ff3ed328)
第三部分：
kd> !process fffffa80`21520630
PROCESS fffffa8021520630
SessionId: 1 Cid: 01fc Peb: 7fffffd9000 ParentCid: 018c
DirBase: 4fafa000 ObjectTable: fffff8a000e6b920 HandleCount: 13.
Image: winlogon.exe
VadRoot fffffa8021522d30 Vads 38 Clone 0 Private 128. Modified 0. Locked 0.
DeviceMap fffff8a000009aa0
Token fffff8a000e7c680
ElapsedTime 00:00:06.177
UserTime 00:00:00.000
KernelTime 00:00:00.000
QuotaPoolUsage[PagedPool] 51032
QuotaPoolUsage[NonPagedPool] 4440
Working Set Sizes (now,min,max) (726, 50, 345) (2904KB, 200KB, 1380KB)
PeakWorkingSetSize 726
VirtualSize 22 Mb
PeakVirtualSize 22 Mb
PageFaultCount 738
MemoryPriority BACKGROUND
BasePriority 8
CommitCharge 800
THREAD fffffa802150c660 Cid 01fc.0200 Teb: 000007fffffde000 Win32Thread: fffff900c011d3a0 RUNNING on processor 0
Not impersonating
DeviceMap fffff8a000009aa0
Owning Process fffffa8021520630 Image: winlogon.exe
Attached Process N/A Image: N/A
Wait Start TickCount 275088243 Ticks: 0
Context Switch Count 89 IdealProcessor: 0 LargeStack
UserTime 00:00:00.000
KernelTime 00:00:04.742
Win32 Start Address winlogon!WinMainCRTStartup (0x00000000ff3ed124)
Stack Init fffff8800422cd70 Current fffff8800422baa0
Base fffff8800422d000 Limit fffff88004225000 Call 0000000000000000
Priority 9 BasePriority 8 PriorityDecrement 0 IoPriority 2 PagePriority 5
Child-SP RetAddr Call Site
fffff880`0422bd68 fffff800`033730b7 nt!PspCreateThread
fffff880`0422bd70 fffff800`02a70e13 nt!NtCreateThreadEx+0x31f
fffff880`0422c4c0 fffff800`02a6aa40 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0422c530)
fffff880`0422c6c8 fffff800`0337f688 nt!KiServiceLinkage
fffff880`0422c6d0 fffff800`0340a02b nt!RtlpCreateUserThreadEx+0x174
fffff880`0422c820 fffff800`03409597 nt!EtwpInjectThread+0xdf
fffff880`0422c8a0 fffff800`034091d0 nt!EtwpQueueNotification+0x3a7
fffff880`0422c940 fffff800`033fd00b nt!EtwpSendDataBlock+0x1f8
fffff880`0422c9f0 fffff800`03401617 nt!EtwpEnableGuid+0x5a7
fffff880`0422cae0 fffff800`02a70e13 nt!NtTraceControl+0x453
fffff880`0422cb70 00000000`7785b9fe nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0422cbe0)
00000000`000af368 00000000`778240c3 ntdll!NtTraceControl+0x1e
00000000`000af370 000007fe`fe283c32 ntdll!EtwSendNotification+0x8f
00000000`000af490 000007fe`fe2838ef ADVAPI32!EnableTraceEx2+0x326
00000000`000af5b0 000007fe`fe283828 ADVAPI32!EnableTraceEx+0xbb
00000000`000af640 00000000`ff3b1575 ADVAPI32!EnableTrace+0x4c
00000000`000af6a0 00000000`ff3b1a78 winlogon!WppStart+0x4d9
00000000`000af800 00000000`ff3ecf9e winlogon!WinMain+0x194
00000000`000af990 00000000`776cb701 winlogon!DbgSetLoggingOption+0x24e
00000000`000afa50 00000000`777b9461 kernel32!BaseThreadInitThunk+0x1d
00000000`000afa80 00000000`00000000 ntdll!RtlUserThreadStart+0x25
第四部分：
kd> g
Breakpoint 14 hit
winlogon!WppStart+0x4d9:
0033:00000000`ff3b1575 89442438 mov dword ptr [rsp+38h],eax
kd> kc
# Call Site
00 winlogon!WppStart
01 winlogon!WinMain
02 winlogon!DbgSetLoggingOption
03 kernel32!BaseThreadInitThunk
04 ntdll!RtlUserThreadStart
kd> pc
winlogon!WppStart+0x4fe:
0033:00000000`ff3b159a ff1588a50400 call qword ptr [winlogon!_imp_EnableTrace (00000000`ff3fbb28)]
kd> pc
winlogon!WppStart+0x4fe:
0033:00000000`ff3b159a ff1588a50400 call qword ptr [winlogon!_imp_EnableTrace (00000000`ff3fbb28)]
kd> pc
winlogon!WppStart+0x529:
0033:00000000`ff3b15c5 ff155da50400 call qword ptr [winlogon!_imp_EnableTrace (00000000`ff3fbb28)]
kd> pc
winlogon!WppStart+0x541:
0033:00000000`ff3b15dd ff1515fcfeff call qword ptr [winlogon!_imp_LocalFree (00000000`ff3a11f8)]
kd> pc
winlogon!WppStart+0x554:
0033:00000000`ff3b15f0 e85bbb0300 call winlogon!_security_check_cookie (00000000`ff3ed150)
kd> pc
winlogon!WinMain+0x1a7:
0033:00000000`ff3b1a8b ff1577fefeff call qword ptr [winlogon!_imp_EtwEventRegister (00000000`ff3a1908)]
kd> pc
winlogon!WinMain+0x1ad:
0033:00000000`ff3b1a91 e81e330300 call winlogon!UmsHlprInit (00000000`ff3e4db4)
kd> pc
winlogon!WinMain+0x21e:
0033:00000000`ff3b1b02 ff1558f6feff call qword ptr [winlogon!_imp_HeapCreate (00000000`ff3a1160)]
kd> pc
winlogon!WinMain+0x2a9:
0033:00000000`ff3b1b8d e8eecfffff call winlogon!SetProcessPriority (00000000`ff3aeb80)
kd> pc
winlogon!WinMain+0x325:
0033:00000000`ff3b1c09 ff1551f5feff call qword ptr [winlogon!_imp_HeapCreate (00000000`ff3a1160)]
kd> pc
winlogon!WinMain+0x3c3:
0033:00000000`ff3b1ca7 e8a0950100 call winlogon!JobManagerInitialize (00000000`ff3cb24c)
kd> pc
winlogon!WinMain+0x454:
0033:00000000`ff3b1d38 ff15d2f2feff call qword ptr [winlogon!_imp_RegOpenKeyExW (00000000`ff3a1010)]
kd> pc
winlogon!WinMain+0x466:
0033:00000000`ff3b1d4a ff15b0f2feff call qword ptr [winlogon!_imp_RegCloseKey (00000000`ff3a1000)]
kd> pc
winlogon!WinMain+0x47d:
0033:00000000`ff3b1d61 e862cbffff call winlogon!InitializeData (00000000`ff3ae8c8)
kd> pc
winlogon!WinMain+0x52b:
0033:00000000`ff3b1e0f ff15fbf1feff call qword ptr [winlogon!_imp_RegOpenKeyExW (00000000`ff3a1010)]
第五部分：
kd> pc
winlogon!WinMain+0x67a:
0033:00000000`ff3b1f5e e8911b0100 call winlogon!CGlobalStore::RegQueryWinlogonDWORD (00000000`ff3c3af4)
kd> pc
winlogon!WinMain+0x68a:
0033:00000000`ff3b1f6e e86d3e0300 call winlogon!InitDebugHelpers (00000000`ff3e5de0)
kd> pc
Breakpoint 0 hit
nt!PspCreateThread:
fffff800`03355e40 4c8bdc mov r11,rsp
kd> kc
# Call Site
00 nt!PspCreateThread
01 nt!NtCreateThreadEx
02 nt!KiSystemServiceCopyEnd
03 ntdll!NtCreateThreadEx
04 ntdll!RtlpCreateUserThreadEx
05 ntdll!TppWaiterpSpinupThread
06 ntdll!TppWaiterAllocWaitSlot
07 ntdll!TppWaitAlloc
08 ntdll!TppTimerpInitTimerQueueQueue
09 ntdll!TppTimerpAllocTimerQueue
0a ntdll!TppTimerpAcquirePoolTimerQueue
0b ntdll!TppTimerAlloc
0c ntdll!TpAllocTimer
0d ntdll!RtlCreateTimer
0e KERNELBASE!CreateTimerQueueTimer
0f kernel32!SetTimerQueueTimer
10 winlogon!InitDebugHelpers
11 winlogon!WinMain
12 winlogon!DbgSetLoggingOption
13 kernel32!BaseThreadInitThunk
14 ntdll!RtlUserThreadStart
kd> !process fffffa80`21520630
PROCESS fffffa8021520630
SessionId: 1 Cid: 01fc Peb: 7fffffd9000 ParentCid: 018c
DirBase: 4fafa000 ObjectTable: fffff8a000e6b920 HandleCount: 25.
Image: winlogon.exe
VadRoot fffffa8021522d30 Vads 48 Clone 0 Private 154. Modified 0. Locked 0.
DeviceMap fffff8a000009aa0
Token fffff8a000e7c680
ElapsedTime 00:00:10.062
UserTime 00:00:00.000
KernelTime 00:00:00.000
QuotaPoolUsage[PagedPool] 51928
QuotaPoolUsage[NonPagedPool] 5704
Working Set Sizes (now,min,max) (789, 50, 345) (3156KB, 200KB, 1380KB)
PeakWorkingSetSize 789
VirtualSize 26 Mb
PeakVirtualSize 27 Mb
PageFaultCount 801
MemoryPriority BACKGROUND
BasePriority 13
CommitCharge 857
THREAD fffffa802150c660 Cid 01fc.0200 Teb: 000007fffffde000 Win32Thread: fffff900c011d3a0 WAIT: (WrKeyedEvent) UserMode Non-Alertable
fffffa802150ca20 Semaphore Limit 0x1
Not impersonating
DeviceMap fffff8a000009aa0
Owning Process fffffa8021520630 Image: winlogon.exe
Attached Process N/A Image: N/A
Wait Start TickCount 275088482 Ticks: 10 (0:00:00:00.156)
Context Switch Count 119 IdealProcessor: 0 LargeStack
UserTime 00:00:00.000
KernelTime 00:00:08.455
Win32 Start Address winlogon!WinMainCRTStartup (0x00000000ff3ed124)
Stack Init fffff8800422cd70 Current fffff8800422c860
Base fffff8800422d000 Limit fffff88004225000 Call 0000000000000000
Priority 15 BasePriority 15 PriorityDecrement 0 IoPriority 2 PagePriority 5
Child-SP RetAddr Call Site
fffff880`0422c8a0 fffff800`028e5eb4 nt!KiSwapContext+0x7a
fffff880`0422c9e0 fffff800`028e795d nt!KiSwapThread+0x324
fffff880`0422ca30 fffff800`028d3d9a nt!KiCommitThreadWait+0x4e5
fffff880`0422caa0 fffff800`03437116 nt!KeWaitForSingleObject+0x532
fffff880`0422cb40 fffff800`02a70e13 nt!NtWaitForKeyedEvent+0x3b6
fffff880`0422cbe0 00000000`7785bb5e nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0422cbe0)
00000000`000af1a8 00000000`77831a69 ntdll!ZwWaitForKeyedEvent+0x1e
00000000`000af1b0 00000000`77831c97 ntdll!TppWaitpSet+0x419
00000000`000af260 00000000`7782e70a ntdll!TpSetWait+0x1bb
00000000`000af360 00000000`7782ea31 ntdll!TppTimerpInitTimerQueueQueue+0x102
00000000`000af3c0 00000000`7782ed76 ntdll!TppTimerpAllocTimerQueue+0x195
00000000`000af420 00000000`7782efc7 ntdll!TppTimerpAcquirePoolTimerQueue+0x52
00000000`000af460 00000000`7782f236 ntdll!TppTimerAlloc+0x19b
00000000`000af4f0 00000000`7783c57e ntdll!TpAllocTimer+0xf6
00000000`000af600 000007fe`fd91d835 ntdll!RtlCreateTimer+0x1b6
00000000`000af6e0 00000000`776e19ac KERNELBASE!CreateTimerQueueTimer+0x61
00000000`000af740 00000000`ff3e5f3d kernel32!SetTimerQueueTimer+0x4c
00000000`000af7a0 00000000`ff3b1f73 winlogon!InitDebugHelpers+0x15d
00000000`000af800 00000000`ff3ecf9e winlogon!WinMain+0x68f
00000000`000af990 00000000`776cb701 winlogon!DbgSetLoggingOption+0x24e
00000000`000afa50 00000000`777b9461 kernel32!BaseThreadInitThunk+0x1d
00000000`000afa80 00000000`00000000 ntdll!RtlUserThreadStart+0x25
You can troubleshoot most symbol related issues by turning on symbol loading diagnostics (!sym noisy) and repeating the command that caused symbols to be loaded.
You should also verify that your symbol search path (.sympath) is correct.
kd> kc
# Call Site
00 winlogon!WinMain
01 winlogon!DbgSetLoggingOption
02 kernel32!BaseThreadInitThunk
03 ntdll!RtlUserThreadStart
第六部分：
kd> pc
winlogon!WinMain+0x6e6:
0033:00000000`ff3b1fca e87d3f0300 call winlogon!SetProfilesLocation (00000000`ff3e5f4c)
kd> pc
winlogon!WinMain+0x6ed:
0033:00000000`ff3b1fd1 e822330000 call winlogon!SetupBasicEnvironment (00000000`ff3b52f8)
kd> pc
winlogon!WinMain+0x6f2:
0033:00000000`ff3b1fd6 e8bde20000 call winlogon!AsyncLogoffSupportInit (00000000`ff3c0298)
kd> pc
winlogon!WinMain+0x74c:
0033:00000000`ff3b2030 ?? ???
kd> pc
winlogon!WinMain+0x755:
0033:00000000`ff3b2039 e896290000 call winlogon!WMsgClntInitialize (00000000`ff3b49d4)
kd> pc
Breakpoint 0 hit
nt!PspCreateThread:
fffff800`03355e40 4c8bdc mov r11,rsp
kd> kc
# Call Site
00 nt!PspCreateThread
01 nt!NtCreateThreadEx
02 nt!KiSystemServiceCopyEnd
03 nt!KiServiceLinkage
04 nt!RtlpCreateUserThreadEx
05 nt!ExpWorkerFactoryCreateThread
06 nt!ExpWorkerFactoryCheckCreate
07 nt!NtSetInformationWorkerFactory
08 nt!KiSystemServiceCopyEnd
09 ntdll!NtSetInformationWorkerFactory
0a ntdll!TpBindAlpcToDirect
0b ntdll!TppAllocAlpcCompletion
0c ntdll!TpAllocAlpcCompletionEx
0d RPCRT4!RPC_THREAD_POOL::CreateAlpc
0e RPCRT4!LRPC_ADDRESS::ServerStartingToListen
0f RPCRT4!RPC_SERVER::UseRpcProtocolSequence
10 RPCRT4!I_RpcServerUseProtseqEp2W
11 RPCRT4!RpcServerUseProtseqEpExW
12 RPCRT4!RpcServerUseProtseqEpW
13 winlogon!StartWMsgKServer
14 winlogon!WMsgClntInitialize
15 winlogon!WinMain
16 winlogon!DbgSetLoggingOption
17 kernel32!BaseThreadInitThunk
18 ntdll!RtlUserThreadStart
kd> bp 00000000`ff3b203e
kd> g
Breakpoint 16 hit
winlogon!WinMain+0x75a:
0033:00000000`ff3b203e 89442440 mov dword ptr [rsp+40h],eax
kd> pc
winlogon!WinMain+0x7cc:
0033:00000000`ff3b20b0 ff1582f9feff call qword ptr [winlogon!_imp_EtwEventEnabled (00000000`ff3a1a38)]
第七部分：
kd> g
Breakpoint 16 hit
winlogon!WinMain+0x75a:
0033:00000000`ff3b203e 89442440 mov dword ptr [rsp+40h],eax
kd> pc
winlogon!WinMain+0x7cc:
0033:00000000`ff3b20b0 ff1582f9feff call qword ptr [winlogon!_imp_EtwEventEnabled (00000000`ff3a1a38)]
kd> p
winlogon!WinMain+0x7d2:
0033:00000000`ff3b20b6 3ac3 cmp al,bl
kd> pc
winlogon!WinMain+0x7ea:
0033:00000000`ff3b20ce ff156cf9feff call qword ptr [winlogon!_imp_EtwEventWrite (00000000`ff3a1a40)]
kd> pc
winlogon!WinMain+0x81c:
0033:00000000`ff3b2100 e82bfd0000 call winlogon!CSession::CreatePrimaryTerminal (00000000`ff3c1e30)
kd> !PROCESS fffffa8021520630
PROCESS fffffa8021520630
SessionId: 1 Cid: 01fc Peb: 7fffffd9000 ParentCid: 018c
DirBase: 4fafa000 ObjectTable: fffff8a000e6b920 HandleCount: 42.
Image: winlogon.exe
VadRoot fffffa8021522d30 Vads 55 Clone 0 Private 274. Modified 1. Locked 0.
DeviceMap fffff8a000009aa0
Token fffff8a000e7c680
ElapsedTime 00:00:13.041
UserTime 00:00:00.000
KernelTime 00:00:00.093
QuotaPoolUsage[PagedPool] 51248
QuotaPoolUsage[NonPagedPool] 6544
Working Set Sizes (now,min,max) (1096, 50, 345) (4384KB, 200KB, 1380KB)
PeakWorkingSetSize 1104
VirtualSize 28 Mb
PeakVirtualSize 60 Mb
PageFaultCount 1276
MemoryPriority BACKGROUND
BasePriority 13
CommitCharge 991
THREAD fffffa802150c660 Cid 01fc.0200 Teb: 000007fffffde000 Win32Thread: fffff900c011d3a0 WAIT: (WrLpcReply) KernelMode Non-Alertable
fffffa802150ca20 Semaphore Limit 0x1
Waiting for reply to ALPC Message fffffa80214e1c70 : queued at port fffffa802150dbd0 : owned by process fffffa801bbc6150
Not impersonating
DeviceMap fffff8a000009aa0
Owning Process fffffa8021520630 Image: winlogon.exe
Attached Process N/A Image: N/A
Wait Start TickCount 275088683 Ticks: 0
Context Switch Count 129 IdealProcessor: 0 LargeStack
UserTime 00:00:00.000
KernelTime 00:00:10.218
Win32 Start Address winlogon!WinMainCRTStartup (0x00000000ff3ed124)
Stack Init fffff8800422cd70 Current fffff8800422b8e0
Base fffff8800422d000 Limit fffff88004224000 Call 0000000000000000
Priority 15 BasePriority 15 PriorityDecrement 0 IoPriority 2 PagePriority 5
Child-SP RetAddr Call Site
fffff880`0422b920 fffff800`028e5eb4 nt!KiSwapContext+0x7a
fffff880`0422ba60 fffff800`028e795d nt!KiSwapThread+0x324
fffff880`0422bab0 fffff800`028d3d9a nt!KiCommitThreadWait+0x4e5
fffff880`0422bb20 fffff800`028ef0db nt!KeWaitForSingleObject+0x532
fffff880`0422bbc0 fffff800`031cbd85 nt!AlpcpSignalAndWait+0x277
fffff880`0422bc80 fffff800`03217474 nt!AlpcpReceiveSynchronousReply+0xf9
fffff880`0422bd80 fffff800`031615cd nt!AlpcpProcessSynchronousRequest+0xf10
fffff880`0422beb0 fffff800`03162d51 nt!LpcpRequestWaitReplyPort+0x249
fffff880`0422bf50 fffff960`001e5a13 nt!LpcRequestWaitReplyPort+0x55
fffff880`0422bfa0 fffff960`001e5f80 win32k!xxxInitTerminal+0x267
fffff880`0422c100 fffff960`00183c57 win32k!xxxCreateWindowStation+0x354
fffff880`0422c4f0 fffff800`02a70e13 win32k!NtUserCreateWindowStation+0x457
fffff880`0422cb70 00000000`775c08fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0422cbe0)
00000000`000af098 00000000`77540694 USER32!NtUserCreateWindowStation+0xa
00000000`000af0a0 00000000`7754078b USER32!CommonCreateWindowStation+0x3f4
00000000`000af6f0 00000000`ff3e6a77 USER32!CreateWindowStationW+0x3b
00000000`000af730 00000000`ff3c1fc6 winlogon!CreatePrimaryTerminal+0xbb
00000000`000af7b0 00000000`ff3b2105 winlogon!CSession::CreatePrimaryTerminal+0x196
00000000`000af800 00000000`ff3ecf9e winlogon!WinMain+0x821
00000000`000af990 00000000`776cb701 winlogon!DbgSetLoggingOption+0x24e
00000000`000afa50 00000000`777b9461 kernel32!BaseThreadInitThunk+0x1d
00000000`000afa80 00000000`00000000 ntdll!RtlUserThreadStart+0x25
第八部分：
winlogon!CreatePrimaryTerminal
kd> .process
Implicit process is now fffffa80`1da53b30
kd> g
Breakpoint 17 hit
winlogon!WinMain+0x821:
0033:00000000`ff3b2105 89442440 mov dword ptr [rsp+40h],eax
kd> kc
# Call Site
00 winlogon!WinMain
01 winlogon!DbgSetLoggingOption
02 kernel32!BaseThreadInitThunk
03 ntdll!RtlUserThreadStart
kd> pc
winlogon!WinMain+0x838:
0033:00000000`ff3b211c ff1516f9feff call qword ptr [winlogon!_imp_EtwEventEnabled (00000000`ff3a1a38)]
kd> pc
winlogon!WinMain+0x856:
0033:00000000`ff3b213a ff1500f9feff call qword ptr [winlogon!_imp_EtwEventWrite (00000000`ff3a1a40)]
kd> pc
winlogon!WinMain+0x959:
0033:00000000`ff3b223d e8faecffff call winlogon!WLEventWrite (00000000`ff3b0f3c)
kd> pc
winlogon!WinMain+0x960:
0033:00000000`ff3b2244 ff156ef3feff call qword ptr [winlogon!_imp_UpdatePerUserSystemParameters (00000000`ff3a15b8)]
第九部分：
kd> pc
winlogon!WinMain+0x96f:
0033:00000000`ff3b2253 e8e4ecffff call winlogon!WLEventWrite (00000000`ff3b0f3c)
kd> pc
winlogon!WinMain+0x99a:
0033:00000000`ff3b227e e8bd530200 call winlogon!SbBootPrompt (00000000`ff3d7640)
kd> pc
winlogon!WinMain+0xa1e:
0033:00000000`ff3b2302 e8d1bfffff call winlogon!WPP_SF_ (00000000`ff3ae2d8)
第十部分：
kd> t
winlogon!WPP_SF_:
0033:00000000`ff3ae2d8 488bc4 mov rax,rsp
kd> pc
winlogon!WPP_SF_+0x21:
0033:00000000`ff3ae2f9 e8f6f20300 call winlogon!EtwTraceMessage (00000000`ff3ed5f4)
kd> pc
winlogon!WinMain+0xa36:
0033:00000000`ff3b231a ff1518f7feff call qword ptr [winlogon!_imp_EtwEventEnabled (00000000`ff3a1a38)]
kd> pc
winlogon!WinMain+0xa54:
0033:00000000`ff3b2338 ff1502f7feff call qword ptr [winlogon!_imp_EtwEventWrite (00000000`ff3a1a40)]
kd> pc
winlogon!WinMain+0xa5a:
0033:00000000`ff3b233e e8afc10300 call winlogon!WinStationWaitForConnect (00000000`ff3ee4f2)
kd> t
Breakpoint 10 hit
winlogon!WinStationWaitForConnect:
0033:00000000`ff3ee4f2 ff252832fbff jmp qword ptr [winlogon!_imp__WinStationWaitForConnect (00000000`ff3a1720)]
kd> kc
# Call Site
00 winlogon!WinStationWaitForConnect
01 winlogon!WinMain
02 winlogon!DbgSetLoggingOption
03 kernel32!BaseThreadInitThunk
04 ntdll!RtlUserThreadStart
第十一部分：
kd> pc
WINSTA!WinStationWaitForConnect+0x1d:
0033:000007fe`fcf8de21 e8927a0000 call WINSTA!_DbgPrintMessage (000007fe`fcf958b8)
kd> p
WINSTA!WinStationWaitForConnect+0x22:
0033:000007fe`fcf8de26 e835bc0000 call WINSTA!WaitForLsmStart (000007fe`fcf99a60)
kd> pc
Breakpoint 7 hit
nt!KiStartUserThread:
fffff800`02a6bb3f b901000000 mov ecx,1
kd> !PROCESS fffffa8021520630
PROCESS fffffa8021520630
SessionId: 1 Cid: 01fc Peb: 7fffffd9000 ParentCid: 018c
DirBase: 4fafa000 ObjectTable: fffff8a000e6b920 HandleCount: 52.
Image: winlogon.exe
VadRoot fffffa8021522d30 Vads 56 Clone 0 Private 287. Modified 3. Locked 0.
DeviceMap fffff8a000009aa0
Token fffff8a000e7c680
ElapsedTime 00:00:14.601
UserTime 00:00:00.000
KernelTime 00:00:00.093
QuotaPoolUsage[PagedPool] 59696
QuotaPoolUsage[NonPagedPool] 6792
Working Set Sizes (now,min,max) (1205, 50, 345) (4820KB, 200KB, 1380KB)
PeakWorkingSetSize 1258
VirtualSize 29 Mb
PeakVirtualSize 60 Mb
PageFaultCount 1575
MemoryPriority BACKGROUND
BasePriority 13
CommitCharge 1004
THREAD fffffa802150c660 Cid 01fc.0200 Teb: 000007fffffde000 Win32Thread: fffff900c011d3a0 WAIT: (UserRequest) UserMode Non-Alertable
fffffa801f3abae0 NotificationEvent
Not impersonating
DeviceMap fffff8a000009aa0
Owning Process fffffa8021520630 Image: winlogon.exe
Attached Process N/A Image: N/A
Wait Start TickCount 275088782 Ticks: 1 (0:00:00:00.015)
Context Switch Count 141 IdealProcessor: 0 LargeStack
UserTime 00:00:00.000
KernelTime 00:00:11.606
Win32 Start Address winlogon!WinMainCRTStartup (0x00000000ff3ed124)
Stack Init fffff8800422cd70 Current fffff8800422c890
Base fffff8800422d000 Limit fffff88004224000 Call 0000000000000000
Priority 15 BasePriority 15 PriorityDecrement 0 IoPriority 2 PagePriority 5
Child-SP RetAddr Call Site
fffff880`0422c8d0 fffff800`028e5eb4 nt!KiSwapContext+0x7a
fffff880`0422ca10 fffff800`028e795d nt!KiSwapThread+0x324
fffff880`0422ca60 fffff800`028d3d9a nt!KiCommitThreadWait+0x4e5
fffff880`0422cad0 fffff800`0331f9af nt!KeWaitForSingleObject+0x532
fffff880`0422cb70 fffff800`02a70e13 nt!NtWaitForSingleObject+0xf7
fffff880`0422cbe0 00000000`778589fe nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0422cbe0)
00000000`000af6c8 000007fe`fd925ee4 ntdll!NtWaitForSingleObject+0x1e
00000000`000af6d0 000007fe`fcf99ad8 KERNELBASE!WaitForSingleObjectEx+0xe4
00000000`000af780 000007fe`fcf8de2b WINSTA!WaitForLsmStart+0x78
00000000`000af7b0 00000000`ff3b2343 WINSTA!WinStationWaitForConnect+0x27
00000000`000af800 00000000`ff3ecf9e winlogon!WinMain+0xa5f
00000000`000af990 00000000`776cb701 winlogon!DbgSetLoggingOption+0x24e
00000000`000afa50 00000000`777b9461 kernel32!BaseThreadInitThunk+0x1d
00000000`000afa80 00000000`00000000 ntdll!RtlUserThreadStart+0x25
00000000`000af6d0 000007fe`fcf99ad8 KERNELBASE!WaitForSingleObjectEx+0xe4
00000000`000af780 000007fe`fcf8de2b WINSTA!WaitForLsmStart+0x78
kd> bp 000007fe`fcf99ad8
kd> !PROCESS fffffa801f3f9b30
PROCESS fffffa801f3f9b30
SessionId: 0 Cid: 01e0 Peb: 7fffffdd000 ParentCid: 0194
DirBase: 4daae000 ObjectTable: fffff8a000e782c0 HandleCount: 25.
Image: lsm.exe
VadRoot fffffa801f3ec7a0 Vads 29 Clone 0 Private 168. Modified 0. Locked 0.
DeviceMap fffff8a000009aa0
Token fffff8a000e7d060
ElapsedTime 00:00:16.473
UserTime 00:00:00.000
KernelTime 00:00:00.000
QuotaPoolUsage[PagedPool] 24600
QuotaPoolUsage[NonPagedPool] 3360
Working Set Sizes (now,min,max) (655, 50, 345) (2620KB, 200KB, 1380KB)
PeakWorkingSetSize 655
VirtualSize 11 Mb
PeakVirtualSize 12 Mb
PageFaultCount 652
MemoryPriority BACKGROUND
BasePriority 8
CommitCharge 844
THREAD fffffa801f3ffb60 Cid 01e0.01e4 Teb: 000007fffffde000 Win32Thread: 0000000000000000 WAIT: (WrLpcReply) UserMode Non-Alertable
fffffa801f3fff20 Semaphore Limit 0x1
Waiting for reply to ALPC Message fffffa80215a0c70 : queued at port fffffa8021597e40 : owned by process fffffa801da55b30
Not impersonating
DeviceMap fffff8a000009aa0
Owning Process fffffa801f3f9b30 Image: lsm.exe
Attached Process N/A Image: N/A
Wait Start TickCount 275088846 Ticks: 15 (0:00:00:00.234)
Context Switch Count 25 IdealProcessor: 0
UserTime 00:00:00.000
KernelTime 00:00:00.124
Win32 Start Address lsm!mainCRTStartup (0x00000000ff413e7c)
Stack Init fffff880042c5d70 Current fffff880042c54d0
Base fffff880042c6000 Limit fffff880042c0000 Call 0000000000000000
Priority 9 BasePriority 8 PriorityDecrement 0 IoPriority 2 PagePriority 5
Child-SP RetAddr Call Site
fffff880`042c5510 fffff800`028e5eb4 nt!KiSwapContext+0x7a
fffff880`042c5650 fffff800`028e795d nt!KiSwapThread+0x324
fffff880`042c56a0 fffff800`028d3d9a nt!KiCommitThreadWait+0x4e5
fffff880`042c5710 fffff800`028ef0db nt!KeWaitForSingleObject+0x532
fffff880`042c57b0 fffff800`031cbd85 nt!AlpcpSignalAndWait+0x277
fffff880`042c5870 fffff800`03217474 nt!AlpcpReceiveSynchronousReply+0xf9
fffff880`042c5970 fffff800`0321ae1a nt!AlpcpProcessSynchronousRequest+0xf10
fffff880`042c5aa0 fffff800`02a70e13 nt!NtAlpcSendWaitReceivePort+0x20e
fffff880`042c5b70 00000000`77859a1e nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`042c5be0)
00000000`0014f1d8 000007fe`fe46838d ntdll!NtAlpcSendWaitReceivePort+0x1e
00000000`0014f1e0 000007fe`fe47f5d7 RPCRT4!LRPC_CASSOCIATION::AlpcSendWaitReceivePort+0x249
00000000`0014f260 000007fe`fe47c154 RPCRT4!LRPC_BASE_CCALL::DoSendReceive+0x1cf
00000000`0014f2f0 000007fe`fe484ee1 RPCRT4!LRPC_BASE_CCALL::SendReceive+0xac
00000000`0014f360 000007fe`fe41c421 RPCRT4!LRPC_CCALL::SendReceive+0x31
00000000`0014f390 000007fe`fe4c75ce RPCRT4!I_RpcSendReceive+0xf1
00000000`0014f3c0 000007fe`fe518b54 RPCRT4!NdrSendReceive+0x72
00000000`0014f3f0 000007fe`fe518904 RPCRT4!NdrpClientCall2+0x244
00000000`0014f9d0 000007fe`fe30bd0f RPCRT4!NdrClientCall2+0x28
00000000`0014fa00 00000000`ff3d6d02 sechost!OpenSCManagerW+0x73
00000000`0014fa70 00000000`ff3d6be4 lsm!CService::Start+0x4e
00000000`0014fae0 00000000`ff413d2d lsm!main+0x260
00000000`0014fb50 00000000`776cb701 lsm!CRegistry::WriteRegString+0x255
00000000`0014fb90 00000000`777b9461 kernel32!BaseThreadInitThunk+0x1d
00000000`0014fbc0 00000000`00000000 ntdll!RtlUserThreadStart+0x25
第十二部分：
kd> !PROCESS fffffa8021520630
PROCESS fffffa8021520630
SessionId: 1 Cid: 01fc Peb: 7fffffd9000 ParentCid: 018c
DirBase: 4fafa000 ObjectTable: fffff8a000e6b920 HandleCount: 52.
Image: winlogon.exe
VadRoot fffffa8021522d30 Vads 56 Clone 0 Private 287. Modified 3. Locked 0.
DeviceMap fffff8a000009aa0
Token fffff8a000e7c680
ElapsedTime 00:00:15.818
UserTime 00:00:00.000
KernelTime 00:00:00.093
QuotaPoolUsage[PagedPool] 59696
QuotaPoolUsage[NonPagedPool] 6792
Working Set Sizes (now,min,max) (1205, 50, 345) (4820KB, 200KB, 1380KB)
PeakWorkingSetSize 1258
VirtualSize 29 Mb
PeakVirtualSize 60 Mb
PageFaultCount 1575
MemoryPriority BACKGROUND
BasePriority 13
CommitCharge 1004
THREAD fffffa802150c660 Cid 01fc.0200 Teb: 000007fffffde000 Win32Thread: fffff900c011d3a0 WAIT: (UserRequest) UserMode Non-Alertable
fffffa801f3abae0 NotificationEvent
Not impersonating
DeviceMap fffff8a000009aa0
Owning Process fffffa8021520630 Image: winlogon.exe
Attached Process N/A Image: N/A
Wait Start TickCount 275088782 Ticks: 79 (0:00:00:01.232)
Context Switch Count 141 IdealProcessor: 0 LargeStack
UserTime 00:00:00.000
KernelTime 00:00:11.606
Win32 Start Address winlogon!WinMainCRTStartup (0x00000000ff3ed124)
Stack Init fffff8800422cd70 Current fffff8800422c890
Base fffff8800422d000 Limit fffff88004224000 Call 0000000000000000
Priority 15 BasePriority 15 PriorityDecrement 0 IoPriority 2 PagePriority 5
Child-SP RetAddr Call Site
fffff880`0422c8d0 fffff800`028e5eb4 nt!KiSwapContext+0x7a
fffff880`0422ca10 fffff800`028e795d nt!KiSwapThread+0x324
fffff880`0422ca60 fffff800`028d3d9a nt!KiCommitThreadWait+0x4e5
fffff880`0422cad0 fffff800`0331f9af nt!KeWaitForSingleObject+0x532
fffff880`0422cb70 fffff800`02a70e13 nt!NtWaitForSingleObject+0xf7
fffff880`0422cbe0 00000000`778589fe nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0422cbe0)
00000000`000af6c8 000007fe`fd925ee4 ntdll!NtWaitForSingleObject+0x1e
00000000`000af6d0 000007fe`fcf99ad8 KERNELBASE!WaitForSingleObjectEx+0xe4
00000000`000af780 000007fe`fcf8de2b WINSTA!WaitForLsmStart+0x78
00000000`000af7b0 00000000`ff3b2343 WINSTA!WinStationWaitForConnect+0x27
00000000`000af800 00000000`ff3ecf9e winlogon!WinMain+0xa5f
00000000`000af990 00000000`776cb701 winlogon!DbgSetLoggingOption+0x24e
00000000`000afa50 00000000`777b9461 kernel32!BaseThreadInitThunk+0x1d
00000000`000afa80 00000000`00000000 ntdll!RtlUserThreadStart+0x25
kd> g
Breakpoint 18 hit
WINSTA!WaitForLsmStart+0x78:
0033:000007fe`fcf99ad8 b801000000 mov eax,1
kd> g
Breakpoint 3 hit
ntdll!RtlUserThreadStart:
0033:00000000`777b943c 4c8bdc mov r11,rsp
kd> !process fffffa80`21520630
PROCESS fffffa8021520630
SessionId: 1 Cid: 01fc Peb: 7fffffd9000 ParentCid: 018c
DirBase: 4fafa000 ObjectTable: fffff8a000e6b920 HandleCount: 48.
Image: winlogon.exe
VadRoot fffffa8021522d30 Vads 56 Clone 0 Private 286. Modified 3. Locked 0.
DeviceMap fffff8a000009aa0
Token fffff8a000e7c680
ElapsedTime 01:38:48.795
UserTime 00:00:00.000
KernelTime 00:00:00.405
QuotaPoolUsage[PagedPool] 59696
QuotaPoolUsage[NonPagedPool] 6792
Working Set Sizes (now,min,max) (1205, 50, 345) (4820KB, 200KB, 1380KB)
PeakWorkingSetSize 1258
VirtualSize 29 Mb
PeakVirtualSize 60 Mb
PageFaultCount 1584
MemoryPriority BACKGROUND
BasePriority 13
CommitCharge 1004
THREAD fffffa802150c660 Cid 01fc.0200 Teb: 000007fffffde000 Win32Thread: fffff900c011d3a0 WAIT: (Executive) KernelMode Non-Alertable
fffffa801bbda560 NotificationEvent
Not impersonating
DeviceMap fffff8a000009aa0
Owning Process fffffa8021520630 Image: winlogon.exe
Attached Process N/A Image: N/A
Wait Start TickCount 275104493 Ticks: 2 (0:00:00:00.031)
Context Switch Count 143 IdealProcessor: 0 LargeStack
UserTime 00:00:00.000
KernelTime 00:00:11.637
Win32 Start Address winlogon!WinMainCRTStartup (0x00000000ff3ed124)
Stack Init fffff8800422cd70 Current fffff8800422be00
Base fffff8800422d000 Limit fffff88004227000 Call 0000000000000000
Priority 15 BasePriority 15 PriorityDecrement 0 IoPriority 2 PagePriority 5
Child-SP RetAddr Call Site
fffff880`0422be40 fffff800`028e5eb4 nt!KiSwapContext+0x7a
fffff880`0422bf80 fffff800`028e795d nt!KiSwapThread+0x324
fffff880`0422bfd0 fffff800`028d3d9a nt!KiCommitThreadWait+0x4e5
fffff880`0422c040 fffff800`030e302b nt!KeWaitForSingleObject+0x532
fffff880`0422c0e0 fffff800`028df3ca nt!DbgkpSendErrorMessage+0x16f
fffff880`0422c230 fffff800`02a71202 nt!KiDispatchException+0x2e6
fffff880`0422ca00 fffff800`02a6f034 nt!KiExceptionDispatch+0xc2
fffff880`0422cbe0 000007fe`fcf8de2c nt!KiBreakpointTrap+0xf4 (TrapFrame @ fffff880`0422cbe0)
00000000`000af7b0 00000000`00000000 WINSTA!WinStationWaitForConnect+0x28
kd> bd 3
kd> g
Breakpoint 18 hit
WINSTA!WaitForLsmStart+0x78:
0033:000007fe`fcf99ad8 b801000000 mov eax,1
kd> kc
# Call Site
00 WINSTA!WaitForLsmStart
01 WINSTA!OpenLocalLSM
02 WINSTA!CPublicBinding::GetLSMBinding
03 WINSTA!WinStationIsSessionRemoteable
04 0x0
kd> .process
Implicit process is now fffffa80`1da53b30
kd> bd 0
kd> g
Break instruction exception - code 80000003 (first chance)
WINSTA!WinStationWaitForConnect+0x27:
0033:000007fe`fcf8de2b 33f6 xor esi,esi
kd> bd 0
kd> kc
# Call Site
00 WINSTA!WinStationWaitForConnect
01 winlogon!WinMain
02 winlogon!DbgSetLoggingOption
03 kernel32!BaseThreadInitThunk
04 ntdll!RtlUserThreadStart
kd> pc
WINSTA!WinStationWaitForConnect+0x34:
0033:000007fe`fcf8de38 e8611b0100 call WINSTA!operator new (000007fe`fcf9f99e)
kd> pc
Breakpoint 18 hit
WINSTA!WaitForLsmStart+0x78:
0033:000007fe`fcf99ad8 b801000000 mov eax,1
kd> kc
# Call Site
00 WINSTA!WaitForLsmStart
01 WINSTA!OpenLocalLSM
02 WINSTA!CPublicBinding::GetLSMBinding
03 WINSTA!WinStationIsSessionRemoteable
04 0x0
kd> pc
WINSTA!WinStationWaitForConnect+0x4b:
0033:000007fe`fcf8de4f e84c77ffff call WINSTA!CPublicBinding::CPublicBinding (000007fe`fcf855a0)
kd> pc
Breakpoint 18 hit
WINSTA!WaitForLsmStart+0x78:
0033:000007fe`fcf99ad8 b801000000 mov eax,1
kd> kc
# Call Site
00 WINSTA!WaitForLsmStart
01 WINSTA!OpenLocalLSM
02 WINSTA!CPublicBinding::GetLSMBinding
03 WINSTA!WinStationIsSessionRemoteable
04 0x0
kd> g
Breakpoint 20 hit
WINSTA!WinStationWaitForConnect+0x51:
0033:000007fe`fcf8de55 8bf8 mov edi,eax
kd> p
WINSTA!WinStationWaitForConnect+0x53:
0033:000007fe`fcf8de57 4889442430 mov qword ptr [rsp+30h],rax
kd> pc
WINSTA!WinStationWaitForConnect+0xa6:
0033:000007fe`fcf8deaa e891bf0000 call WINSTA!CPublicBinding::GetLSMBinding (000007fe`fcf99e40)
kd> !process fffffa80`21520630
PROCESS fffffa8021520630
SessionId: 1 Cid: 01fc Peb: 7fffffd9000 ParentCid: 018c
DirBase: 4fafa000 ObjectTable: fffff8a000e6b920 HandleCount: 49.
Image: winlogon.exe
VadRoot fffffa8021522d30 Vads 55 Clone 0 Private 288. Modified 3. Locked 0.
DeviceMap fffff8a000009aa0
Token fffff8a000e7c680
ElapsedTime 01:39:49.245
UserTime 00:00:00.000
KernelTime 00:00:00.499
QuotaPoolUsage[PagedPool] 59696
QuotaPoolUsage[NonPagedPool] 6672
Working Set Sizes (now,min,max) (1283, 50, 345) (5132KB, 200KB, 1380KB)
PeakWorkingSetSize 1283
VirtualSize 2076 Mb
PeakVirtualSize 2077 Mb
PageFaultCount 1666
MemoryPriority BACKGROUND
BasePriority 13
CommitCharge 526300
THREAD fffffa802150c660 Cid 01fc.0200 Teb: 000007fffffde000 Win32Thread: fffff900c011d3a0 WAIT: (Executive) KernelMode Non-Alertable
fffffa801bbda560 NotificationEvent
Not impersonating
DeviceMap fffff8a000009aa0
Owning Process fffffa8021520630 Image: winlogon.exe
Attached Process N/A Image: N/A
Wait Start TickCount 275108370 Ticks: 0
Context Switch Count 158 IdealProcessor: 0 LargeStack
UserTime 00:00:00.000
KernelTime 00:00:12.074
Win32 Start Address winlogon!WinMainCRTStartup (0x00000000ff3ed124)
Stack Init fffff8800422cd70 Current fffff8800422be00
Base fffff8800422d000 Limit fffff88004227000 Call 0000000000000000
Priority 15 BasePriority 15 PriorityDecrement 0 IoPriority 2 PagePriority 5
Child-SP RetAddr Call Site
fffff880`0422be40 fffff800`028e5eb4 nt!KiSwapContext+0x7a
fffff880`0422bf80 fffff800`028e795d nt!KiSwapThread+0x324
fffff880`0422bfd0 fffff800`028d3d9a nt!KiCommitThreadWait+0x4e5
fffff880`0422c040 fffff800`030e302b nt!KeWaitForSingleObject+0x532
fffff880`0422c0e0 fffff800`028df3ca nt!DbgkpSendErrorMessage+0x16f
fffff880`0422c230 fffff800`02a71202 nt!KiDispatchException+0x2e6
fffff880`0422ca00 fffff800`02a6f034 nt!KiExceptionDispatch+0xc2
fffff880`0422cbe0 000007fe`fcf99ad9 nt!KiBreakpointTrap+0xf4 (TrapFrame @ fffff880`0422cbe0)
00000000`000af6d0 000007fe`fcf99cc5 WINSTA!WaitForLsmStart+0x79
00000000`000af700 000007fe`fcf99ef1 WINSTA!OpenLocalLSM+0xe5
00000000`000af770 000007fe`fcf8deaf WINSTA!CPublicBinding::GetLSMBinding+0xb1
00000000`000af7b0 00000000`ff3b2343 WINSTA!WinStationWaitForConnect+0xab
00000000`000af800 00000000`ff3ecf9e winlogon!WinMain+0xa5f
00000000`000af990 00000000`776cb701 winlogon!DbgSetLoggingOption+0x24e
00000000`000afa50 00000000`777b9461 kernel32!BaseThreadInitThunk+0x1d
00000000`000afa80 00000000`00000000 ntdll!RtlUserThreadStart+0x25
第十三部分：
THREAD fffffa801e840b60 Cid 0204.0208 Teb: 000007fffffde000 Win32Thread: fffff900c01184b0 WAIT: (UserRequest) UserMode Non-Alertable
fffffa801e408c70 SynchronizationEvent
Not impersonating
DeviceMap fffff8a000009aa0
Owning Process fffffa801d44c210 Image: winlogon.exe
Attached Process N/A Image: N/A
Wait Start TickCount 275087392 Ticks: 44 (0:00:00:00.686)
Context Switch Count 83 IdealProcessor: 0 LargeStack
UserTime 00:00:00.000
KernelTime 00:00:00.078
Win32 Start Address winlogon!WinMainCRTStartup (0x00000000ffb7d124)
Stack Init fffff88003012d70 Current fffff88003012890
Base fffff88003013000 Limit fffff8800300a000 Call 0000000000000000
Priority 15 BasePriority 15 PriorityDecrement 0 IoPriority 2 PagePriority 5
Child-SP RetAddr Call Site
fffff880`030128d0 fffff800`028edeb4 nt!KiSwapContext+0x7a
fffff880`03012a10 fffff800`028ef95d nt!KiSwapThread+0x324
fffff880`03012a60 fffff800`028dbd9a nt!KiCommitThreadWait+0x4e5
fffff880`03012ad0 fffff800`033279af nt!KeWaitForSingleObject+0x532
fffff880`03012b70 fffff800`02a78e13 nt!NtWaitForSingleObject+0xf7
fffff880`03012be0 00000000`777989fe nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`03012be0)
00000000`001bf1d8 000007fe`fd555ee4 ntdll!NtWaitForSingleObject+0x1e
00000000`001bf1e0 00000000`ffb6cf4d KERNELBASE!WaitForSingleObjectEx+0xe4
00000000`001bf290 00000000`ffb6bb4b winlogon!SignalManagerWaitForSignal+0x201
00000000`001bf2f0 00000000`ffb42cbc winlogon!StateMachineRun+0x54f
00000000`001bf610 00000000`ffb7cf9e winlogon!WinMain+0x13d8
00000000`001bf7a0 00000000`7760b701 winlogon!DbgSetLoggingOption+0x24e
00000000`001bf860 00000000`776f9461 kernel32!BaseThreadInitThunk+0x1d
00000000`001bf890 00000000`00000000 ntdll!RtlUserThreadStart+0x25
THREAD fffffa801e883060 Cid 0204.0234 Teb: 000007fffffd5000 Win32Thread: fffff900c1c7f460 WAIT: (DelayExecution) UserMode Non-Alertable
fffffa801e883420 Semaphore Limit 0x1
Not impersonating
DeviceMap fffff8a000009aa0
Owning Process fffffa801d44c210 Image: winlogon.exe
Attached Process N/A Image: N/A
Wait Start TickCount 275087426 Ticks: 10 (0:00:00:00.156)
Context Switch Count 39 IdealProcessor: 0 LargeStack
UserTime 00:00:00.000
KernelTime 00:00:00.031
Win32 Start Address ntdll!TppWorkerThread (0x0000000077778b74)
Stack Init fffff880032bcd70 Current fffff880032bc8e0
Base fffff880032bd000 Limit fffff880032b4000 Call 0000000000000000
Priority 14 BasePriority 13 PriorityDecrement 0 IoPriority 2 PagePriority 5
Child-SP RetAddr Call Site
fffff880`032bc920 fffff800`028edeb4 nt!KiSwapContext+0x7a
fffff880`032bca60 fffff800`028ef95d nt!KiSwapThread+0x324
fffff880`032bcab0 fffff800`028da436 nt!KiCommitThreadWait+0x4e5
fffff880`032bcb20 fffff800`0343dc7e nt!KeDelayExecutionThread+0x352
fffff880`032bcba0 fffff800`02a78e13 nt!NtDelayExecution+0x6e
fffff880`032bcbe0 00000000`77798ffe nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`032bcbe0)
00000000`00daef38 000007fe`fd559559 ntdll!ZwDelayExecution+0x1e
00000000`00daef40 00000000`ffb6f9c2 KERNELBASE!SleepEx+0xe5
00000000`00daefe0 00000000`ffb70b88 winlogon!ConnectToSubscriber+0x1ce
00000000`00daf060 00000000`ffb4774e winlogon!InternalNotifyExecute+0x458
00000000`00daf410 00000000`ffb6a941 winlogon!WLGeneric_NotifyCreateSession_Execute+0x1d2
00000000`00daf460 00000000`77774186 winlogon!StateMachineWorkerCallback+0x8d
00000000`00daf490 00000000`7777954e ntdll!TppWorkpExecuteCallback+0x1ea
00000000`00daf500 00000000`7760b701 ntdll!TppWorkerThread+0x9da
00000000`00daf820 00000000`776f9461 kernel32!BaseThreadInitThunk+0x1d
00000000`00daf850 00000000`00000000 ntdll!RtlUserThreadStart+0x25
第十四部分：修改administrator密码后，在登录界面的进程快照
THREAD fffffa801d633060 Cid 01c4.01c8 Teb: 000007fffffde000 Win32Thread: fffff900c01184b0 WAIT: (UserRequest) UserMode Non-Alertable
fffffa801d7f5d60 SynchronizationEvent
Not impersonating
DeviceMap fffff8a000009aa0
Owning Process fffffa801d628b30 Image: winlogon.exe
Attached Process N/A Image: N/A
Wait Start TickCount 275088542 Ticks: 148 (0:00:00:02.308)
Context Switch Count 227 IdealProcessor: 0 LargeStack
UserTime 00:00:00.000
KernelTime 00:00:00.093
Win32 Start Address winlogon!WinMainCRTStartup (0x00000000ffd1d124)
Stack Init fffff8800429fd70 Current fffff8800429f890
Base fffff880042a0000 Limit fffff88004296000 Call 0000000000000000
Priority 15 BasePriority 15 PriorityDecrement 0 IoPriority 2 PagePriority 5
Child-SP RetAddr Call Site
fffff880`0429f8d0 fffff800`02891eb4 nt!KiSwapContext+0x7a
fffff880`0429fa10 fffff800`0289395d nt!KiSwapThread+0x324
fffff880`0429fa60 fffff800`0287fd9a nt!KiCommitThreadWait+0x4e5
fffff880`0429fad0 fffff800`032cb9af nt!KeWaitForSingleObject+0x532
fffff880`0429fb70 fffff800`02a1ce13 nt!NtWaitForSingleObject+0xf7
fffff880`0429fbe0 00000000`778389fe nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0429fbe0)
00000000`001df368 000007fe`fd905ee4 ntdll!NtWaitForSingleObject+0x1e
00000000`001df370 00000000`ffd0cf4d KERNELBASE!WaitForSingleObjectEx+0xe4
00000000`001df420 00000000`ffd0bb4b winlogon!SignalManagerWaitForSignal+0x201
00000000`001df480 00000000`ffce2cbc winlogon!StateMachineRun+0x54f
00000000`001df7a0 00000000`ffd1cf9e winlogon!WinMain+0x13d8
00000000`001df930 00000000`776ab701 winlogon!DbgSetLoggingOption+0x24e
00000000`001df9f0 00000000`77799461 kernel32!BaseThreadInitThunk+0x1d
00000000`001dfa20 00000000`00000000 ntdll!RtlUserThreadStart+0x25
THREAD fffffa801d632060 Cid 01c4.01d0 Teb: 000007fffffdc000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable
fffffa801bbc6d80 SynchronizationTimer
fffffa801bbc6ef0 SynchronizationTimer
fffffa801d635da0 SynchronizationTimer
fffffa801e348150 NotificationEvent
Not impersonating
DeviceMap fffff8a000009aa0
Owning Process fffffa801d628b30 Image: winlogon.exe
Attached Process N/A Image: N/A
Wait Start TickCount 275088542 Ticks: 148 (0:00:00:02.308)
Context Switch Count 8 IdealProcessor: 0
UserTime 00:00:00.000
KernelTime 00:00:00.000
Win32 Start Address ntdll!TppWaiterpThread (0x000000007781abb4)
Stack Init fffff88004234d70 Current fffff88004233f50
Base fffff88004235000 Limit fffff8800422f000 Call 0000000000000000
Priority 15 BasePriority 13 PriorityDecrement 0 IoPriority 2 PagePriority 5
Child-SP RetAddr Call Site
fffff880`04233f90 fffff800`02891eb4 nt!KiSwapContext+0x7a
fffff880`042340d0 fffff800`0289395d nt!KiSwapThread+0x324
fffff880`04234120 fffff800`0287ee48 nt!KiCommitThreadWait+0x4e5
fffff880`04234190 fffff800`032cbee8 nt!KeWaitForMultipleObjects+0x80c
fffff880`04234450 fffff800`032cc162 nt!ObpWaitForMultipleObjects+0x508
fffff880`04234920 fffff800`02a1ce13 nt!NtWaitForMultipleObjects+0x146
fffff880`04234b70 00000000`778394de nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04234be0)
00000000`00e7f908 00000000`7781afc1 ntdll!NtWaitForMultipleObjects+0x1e
00000000`00e7f910 00000000`776ab701 ntdll!TppWaiterpThread+0x40d
00000000`00e7fc50 00000000`77799461 kernel32!BaseThreadInitThunk+0x1d
00000000`00e7fc80 00000000`00000000 ntdll!RtlUserThreadStart+0x25
THREAD fffffa801d63c060 Cid 01c4.01d4 Teb: 000007fffffda000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable
fffffa801d608dc0 QueueObject
Not impersonating
DeviceMap fffff8a000009aa0
Owning Process fffffa801d628b30 Image: winlogon.exe
Attached Process N/A Image: N/A
Wait Start TickCount 275088542 Ticks: 148 (0:00:00:02.308)
Context Switch Count 8 IdealProcessor: 0
UserTime 00:00:00.000
KernelTime 00:00:00.000
Win32 Start Address ntdll!TppWorkerThread (0x0000000077818b74)
Stack Init fffff8800428cd70 Current fffff8800428c750
Base fffff8800428d000 Limit fffff88004287000 Call 0000000000000000
Priority 15 BasePriority 13 PriorityDecrement 0 IoPriority 2 PagePriority 5
Child-SP RetAddr Call Site
fffff880`0428c790 fffff800`02891eb4 nt!KiSwapContext+0x7a
fffff880`0428c8d0 fffff800`0289395d nt!KiSwapThread+0x324
fffff880`0428c920 fffff800`0288727c nt!KiCommitThreadWait+0x4e5
fffff880`0428c990 fffff800`030b19bf nt!KeRemoveQueueEx+0x844
fffff880`0428ca20 fffff800`029f5f02 nt!IoRemoveIoCompletion+0x7b
fffff880`0428cad0 fffff800`02a1ce13 nt!NtWaitForWorkViaWorkerFactory+0x3ca
fffff880`0428cbe0 00000000`7783bb7e nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0428cbe0)
00000000`0138fbe8 00000000`77818f25 ntdll!NtWaitForWorkViaWorkerFactory+0x1e
00000000`0138fbf0 00000000`776ab701 ntdll!TppWorkerThread+0x3b1
00000000`0138ff10 00000000`77799461 kernel32!BaseThreadInitThunk+0x1d
00000000`0138ff40 00000000`00000000 ntdll!RtlUserThreadStart+0x25
THREAD fffffa801d63c600 Cid 01c4.01d8 Teb: 000007fffffd7000 Win32Thread: fffff900c1c7d460 WAIT: (WrLpcReply) UserMode Non-Alertable
fffffa801d63c9c0 Semaphore Limit 0x1
Waiting for reply to ALPC Message fffffa801e331c70 : queued at port fffffa801e48b950 : owned by process fffffa801d7bdb30
Not impersonating
DeviceMap fffff8a000009aa0
Owning Process fffffa801d628b30 Image: winlogon.exe
Attached Process N/A Image: N/A
Wait Start TickCount 275088542 Ticks: 148 (0:00:00:02.308)
Context Switch Count 224 IdealProcessor: 0 LargeStack
UserTime 00:00:00.046
KernelTime 00:00:00.280
Win32 Start Address ntdll!TppWorkerThread (0x0000000077818b74)
Stack Init fffff880030a9d70 Current fffff880030a94d0
Base fffff880030aa000 Limit fffff880030a1000 Call 0000000000000000
Priority 15 BasePriority 13 PriorityDecrement 0 IoPriority 2 PagePriority 5
Child-SP RetAddr Call Site
fffff880`030a9510 fffff800`02891eb4 nt!KiSwapContext+0x7a
fffff880`030a9650 fffff800`0289395d nt!KiSwapThread+0x324
fffff880`030a96a0 fffff800`0287fd9a nt!KiCommitThreadWait+0x4e5
fffff880`030a9710 fffff800`0289b0db nt!KeWaitForSingleObject+0x532
fffff880`030a97b0 fffff800`03177d85 nt!AlpcpSignalAndWait+0x277
fffff880`030a9870 fffff800`031c3474 nt!AlpcpReceiveSynchronousReply+0xf9
fffff880`030a9970 fffff800`031c6e1a nt!AlpcpProcessSynchronousRequest+0xf10
fffff880`030a9aa0 fffff800`02a1ce13 nt!NtAlpcSendWaitReceivePort+0x20e
fffff880`030a9b70 00000000`77839a1e nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`030a9be0)
00000000`0128eb28 000007fe`feef838d ntdll!NtAlpcSendWaitReceivePort+0x1e
00000000`0128eb30 000007fe`fef0f5d7 RPCRT4!LRPC_CASSOCIATION::AlpcSendWaitReceivePort+0x249
00000000`0128ebb0 000007fe`fef0c154 RPCRT4!LRPC_BASE_CCALL::DoSendReceive+0x1cf
00000000`0128ec40 000007fe`fef14ee1 RPCRT4!LRPC_BASE_CCALL::SendReceive+0xac
00000000`0128ecb0 000007fe`feeac421 RPCRT4!LRPC_CCALL::SendReceive+0x31
00000000`0128ece0 000007fe`fef575ce RPCRT4!I_RpcSendReceive+0xf1
00000000`0128ed10 000007fe`fefa3331 RPCRT4!NdrSendReceive+0x72
00000000`0128ed40 000007fe`fefa3129 RPCRT4!NdrpClientCall3+0x1e5
00000000`0128f000 00000000`ffd1335f RPCRT4!NdrClientCall3+0x89
00000000`0128f380 00000000`ffce807a winlogon!WluiRequestCredentials+0x7b
00000000`0128f3f0 00000000`ffd0a941 winlogon!WLGeneric_Request_Logon_Credz_Execute+0x1ae
00000000`0128f470 00000000`77814186 winlogon!StateMachineWorkerCallback+0x8d
00000000`0128f4a0 00000000`7781954e ntdll!TppWorkpExecuteCallback+0x1ea
00000000`0128f510 00000000`776ab701 ntdll!TppWorkerThread+0x9da
00000000`0128f830 00000000`77799461 kernel32!BaseThreadInitThunk+0x1d
00000000`0128f860 00000000`00000000 ntdll!RtlUserThreadStart+0x25
THREAD fffffa801e24b930 Cid 01c4.037c Teb: 000007fffffd5000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable
fffffa801d608dc0 QueueObject
Not impersonating
DeviceMap fffff8a000009aa0
Owning Process fffffa801d628b30 Image: winlogon.exe
Attached Process N/A Image: N/A
Wait Start TickCount 275088542 Ticks: 148 (0:00:00:02.308)
Context Switch Count 11 IdealProcessor: 0
UserTime 00:00:00.000
KernelTime 00:00:00.000
Win32 Start Address ntdll!TppWorkerThread (0x0000000077818b74)
Stack Init fffff880042a6d70 Current fffff880042a6750
Base fffff880042a7000 Limit fffff880042a1000 Call 0000000000000000
Priority 15 BasePriority 13 PriorityDecrement 0 IoPriority 2 PagePriority 5
Child-SP RetAddr Call Site
fffff880`042a6790 fffff800`02891eb4 nt!KiSwapContext+0x7a
fffff880`042a68d0 fffff800`0289395d nt!KiSwapThread+0x324
fffff880`042a6920 fffff800`0288727c nt!KiCommitThreadWait+0x4e5
fffff880`042a6990 fffff800`030b19bf nt!KeRemoveQueueEx+0x844
fffff880`042a6a20 fffff800`029f5f02 nt!IoRemoveIoCompletion+0x7b
fffff880`042a6ad0 fffff800`02a1ce13 nt!NtWaitForWorkViaWorkerFactory+0x3ca
fffff880`042a6be0 00000000`7783bb7e nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`042a6be0)
00000000`015bf9b8 00000000`77818f25 ntdll!NtWaitForWorkViaWorkerFactory+0x1e
00000000`015bf9c0 00000000`776ab701 ntdll!TppWorkerThread+0x3b1
00000000`015bfce0 00000000`77799461 kernel32!BaseThreadInitThunk+0x1d
00000000`015bfd10 00000000`00000000 ntdll!RtlUserThreadStart+0x25