win7winlogon调试指南winlogon!SignalManagerResetSignal需要运行多少次

运行屏幕保护程序之前得到超时信号后

第一部分A：

kd> g
Breakpoint 0 hit
eax=00bbf9cc ebx=00000000 ecx=00d58b20 edx=00bbfa1c esi=00d53844 edi=00bbf9d4
eip=00acf97b esp=00bbf9b8 ebp=00bbf9d0 iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000206
winlogon!WMsgKMessageHandler:
001b:00acf97b 8bff            mov     edi,edi
kd> g
Breakpoint 2 hit
eax=00000007 ebx=00ac62cc ecx=00b03e38 edx=00bbfa1c esi=00228580 edi=76ff9dd0
eip=00aefe64 esp=00bbf954 ebp=00bbf974 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
winlogon!SignalManagerSetSignal:
001b:00aefe64 6a1c            push    1Ch
kd> g
Breakpoint 8 hit
eax=00000000 ebx=76ff9dd0 ecx=74ee25eb edx=76fda084 esi=00ac6714 edi=00251038
eip=00aefb2b esp=0010f7d4 ebp=0010f7e8 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
winlogon!SignalManagerWaitForSignal+0x171:
001b:00aefb2b 8945fc          mov     dword ptr [ebp-4],eax ss:0023:0010f7e4=00000000
kd> g
Breakpoint 4 hit
eax=0010f998 ebx=00b02cc4 ecx=74ee25eb edx=76fda084 esi=0010f88c edi=00228580
eip=00af03ed esp=0010f7ec ebp=0010f9a4 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
winlogon!SignalManagerGetSignal:
001b:00af03ed 8bff            mov     edi,edi
kd> g
Breakpoint 5 hit
eax=00000003 ebx=00b02cc4 ecx=00b03e38 edx=00b02bf0 esi=00000003 edi=00228580
eip=00af012c esp=0010f7f8 ebp=0010f9a4 iopl=0         nv up ei ng nz ac pe cy
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000297
winlogon!SignalManagerResetSignal:
001b:00af012c 6a08            push    8
kd> dd 0010f7f8
0010f7f8  00aef27c 00251038 00000003 00b02024
0010f808  00000000 00ac2f5c 00b0400c 002527d8
0010f818  00000108 00b02cc4 00000000 00228580
0010f828  00b046f8 00000000 00000000 00000108
0010f838  00000000 00000000 00000000 00000000
0010f848  00000000 00000007 00252890 0000010c
0010f858  00b032f4 00000000 00228580 00b046f8
0010f868  00ed0de0 00000000 0000010c 00000000
kd> dd 00b02cc4
00b02cc4  00ac2290 00000000 00ad4d1e 00ad4dd8
00b02cd4  00000010 00b02bf0 00000005 00b02cb0
00b02ce4  0000001c 00000000 fffffffe 00000000
00b02cf4  00ac2264 00ad636f 00000000 00000000
00b02d04  00000001 00b02ce8 00000000 00000000
00b02d14  0000001d 00000000 fffffffe 00000000
00b02d24  00ac2238 00ad4f39 00000000 00000000
00b02d34  00000001 00b02d18 00000000 00000000
kd> dd 00b02cb0
00b02cb0  00000003 0000000d 0000001f 00000006
00b02cc0  00000011 00ac2290 00000000 00ad4d1e
00b02cd0  00ad4dd8 00000010 00b02bf0 00000005
00b02ce0  00b02cb0 0000001c 00000000 fffffffe
00b02cf0  00000000 00ac2264 00ad636f 00000000
00b02d00  00000000 00000001 00b02ce8 00000000
00b02d10  00000000 0000001d 00000000 fffffffe
00b02d20  00000000 00ac2238 00ad4f39 00000000
kd> g
Breakpoint 5 hit
eax=0000000d ebx=00b02cc4 ecx=00b03e38 edx=00b02bf0 esi=0000000d edi=00228580
eip=00af012c esp=0010f7f8 ebp=0010f9a4 iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000206
winlogon!SignalManagerResetSignal:
001b:00af012c 6a08            push    8
kd> dd 0010f7f8
0010f7f8  00aef27c 00251038 0000000d 00b0209c
0010f808  00000000 00ac2f5c 00b0400c 002527d8
0010f818  00000108 00b02cc4 00000000 00228580
0010f828  00b046f8 00000000 00000000 00000108
0010f838  00000000 00000000 00000000 00000000
0010f848  00000000 00000007 00252890 0000010c
0010f858  00b032f4 00000000 00228580 00b046f8
0010f868  00ed0de0 00000000 0000010c 00000000
kd> g
Breakpoint 5 hit
eax=0000001f ebx=00b02cc4 ecx=00b03e38 edx=00b02bf0 esi=0000001f edi=00228580
eip=00af012c esp=0010f7f8 ebp=0010f9a4 iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000206
winlogon!SignalManagerResetSignal:
001b:00af012c 6a08            push    8
kd> dd 0010f7f8
0010f7f8  00aef27c 00251038 0000001f 00b02174
0010f808  00000000 00ac2f5c 00b0400c 002527d8
0010f818  00000108 00b02cc4 00000000 00228580
0010f828  00b046f8 00000000 00000000 00000108
0010f838  00000000 00000000 00000000 00000000
0010f848  00000000 00000007 00252890 0000010c
0010f858  00b032f4 00000000 00228580 00b046f8
0010f868  00ed0de0 00000000 0000010c 00000000
kd> g
Breakpoint 5 hit
eax=00000006 ebx=00b02cc4 ecx=00b03e38 edx=00b02bf0 esi=00000006 edi=00228580
eip=00af012c esp=0010f7f8 ebp=0010f9a4 iopl=0         nv up ei ng nz ac pe cy
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000297
winlogon!SignalManagerResetSignal:
001b:00af012c 6a08            push    8
kd> dd 0010f7f8
0010f7f8  00aef27c 00251038 00000006 00b02048
0010f808  00000000 00ac2f5c 00b0400c 002527d8
0010f818  00000108 00b02cc4 00000000 00228580
0010f828  00b046f8 00000000 00000000 00000108
0010f838  00000000 00000000 00000000 00000000
0010f848  00000000 00000007 00252890 0000010c
0010f858  00b032f4 00000000 00228580 00b046f8
0010f868  00ed0de0 00000000 0000010c 00000000
kd> g
Breakpoint 5 hit
eax=00000011 ebx=00b02cc4 ecx=00b03e38 edx=00b02bf0 esi=00000011 edi=00228580
eip=00af012c esp=0010f7f8 ebp=0010f9a4 iopl=0         nv up ei pl nz ac pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000216
winlogon!SignalManagerResetSignal:
001b:00af012c 6a08            push    8
kd> dd 0010f7f8
0010f7f8  00aef27c 00251038 00000011 00b020cc
0010f808  00000000 00ac2f5c 00b0400c 002527d8
0010f818  00000108 00b02cc4 00000000 00228580
0010f828  00b046f8 00000000 00000000 00000108
0010f838  00000000 00000000 00000000 00000000
0010f848  00000000 00000007 00252890 0000010c
0010f858  00b032f4 00000000 00228580 00b046f8
0010f868  00ed0de0 00000000 0000010c 00000000

第一部分B：

kd> g
Breakpoint 5 hit
eax=00b02000 ebx=00b02cc4 ecx=00af02d6 edx=00000edc esi=00000000 edi=00228580
eip=00af012c esp=0010f7f8 ebp=0010f9a4 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
winlogon!SignalManagerResetSignal:
001b:00af012c 6a08            push    8
kd> dd 0010f7f8
0010f7f8  00aef2a3 00251038 00000000 00b02000
0010f808  00000000 00ac2f5c 00b0400c 002527d8
0010f818  00000108 00b02cc4 00000000 00228580
0010f828  00b046f8 00000000 00000000 00000108
0010f838  00000000 00000000 00000000 00000000
0010f848  00000000 00000007 00252890 0000010c
0010f858  00b032f4 00000000 00228580 00b046f8
0010f868  00ed0de0 00000000 0000010c 00000000
kd> g
Breakpoint 5 hit
eax=00b0200c ebx=00b02cc4 ecx=00af02d6 edx=00000edc esi=00000001 edi=00228580
eip=00af012c esp=0010f7f8 ebp=0010f9a4 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
winlogon!SignalManagerResetSignal:
001b:00af012c 6a08            push    8
kd> dd 0010f7f8
0010f7f8  00aef2a3 00251038 00000001 00b0200c
0010f808  00000000 00ac2f5c 00b0400c 002527d8
0010f818  00000108 00b02cc4 00000000 00228580
0010f828  00b046f8 00000000 00000000 00000108
0010f838  00000000 00000000 00000000 00000000
0010f848  00000000 00000007 00252890 0000010c
0010f858  00b032f4 00000000 00228580 00b046f8
0010f868  00ed0de0 00000000 0000010c 00000000
kd> g
Breakpoint 5 hit
eax=00b020f0 ebx=00b02cc4 ecx=00af02d6 edx=00000edc esi=00000014 edi=00228580
eip=00af012c esp=0010f7f8 ebp=0010f9a4 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
winlogon!SignalManagerResetSignal:
001b:00af012c 6a08            push    8
kd> dd 0010f7f8
0010f7f8  00aef2a3 00251038 00000014 00b020f0
0010f808  00000000 00ac2f5c 00b0400c 002527d8
0010f818  00000108 00b02cc4 00000000 00228580
0010f828  00b046f8 00000000 00000000 00000108
0010f838  00000000 00000000 00000000 00000000
0010f848  00000000 00000007 00252890 0000010c
0010f858  00b032f4 00000000 00228580 00b046f8
0010f868  00ed0de0 00000000 0000010c 00000000
kd> g
Breakpoint 5 hit
eax=00b02120 ebx=00b02cc4 ecx=00af02d6 edx=00000edc esi=00000018 edi=00228580
eip=00af012c esp=0010f7f8 ebp=0010f9a4 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
winlogon!SignalManagerResetSignal:
001b:00af012c 6a08            push    8
kd> dd 0010f7f8
0010f7f8  00aef2a3 00251038 00000018 00b02120
0010f808  00000000 00ac2f5c 00b0400c 002527d8
0010f818  00000108 00b02cc4 00000000 00228580
0010f828  00b046f8 00000000 00000000 00000108
0010f838  00000000 00000000 00000000 00000000
0010f848  00000000 00000007 00252890 0000010c
0010f858  00b032f4 00000000 00228580 00b046f8
0010f868  00ed0de0 00000000 0000010c 00000000
kd> g
Breakpoint 5 hit
eax=00b0212c ebx=00b02cc4 ecx=00af02d6 edx=00000edc esi=00000019 edi=00228580
eip=00af012c esp=0010f7f8 ebp=0010f9a4 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
winlogon!SignalManagerResetSignal:
001b:00af012c 6a08            push    8
kd> dd 0010f7f8
0010f7f8  00aef2a3 00251038 00000019 00b0212c
0010f808  00000000 00ac2f5c 00b0400c 002527d8
0010f818  00000108 00b02cc4 00000000 00228580
0010f828  00b046f8 00000000 00000000 00000108
0010f838  00000000 00000000 00000000 00000000
0010f848  00000000 00000007 00252890 0000010c
0010f858  00b032f4 00000000 00228580 00b046f8
0010f868  00ed0de0 00000000 0000010c 00000000
kd> g
Breakpoint 5 hit
eax=00b02138 ebx=00b02cc4 ecx=00af02d6 edx=00000edc esi=0000001a edi=00228580
eip=00af012c esp=0010f7f8 ebp=0010f9a4 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
winlogon!SignalManagerResetSignal:
001b:00af012c 6a08            push    8
kd> dd 0010f7f8
0010f7f8  00aef2a3 00251038 0000001a 00b02138
0010f808  00000000 00ac2f5c 00b0400c 002527d8
0010f818  00000108 00b02cc4 00000000 00228580
0010f828  00b046f8 00000000 00000000 00000108
0010f838  00000000 00000000 00000000 00000000
0010f848  00000000 00000007 00252890 0000010c
0010f858  00b032f4 00000000 00228580 00b046f8
0010f868  00ed0de0 00000000 0000010c 00000000
kd> g
Breakpoint 5 hit
eax=00b02144 ebx=00b02cc4 ecx=00af02d6 edx=00000edc esi=0000001b edi=00228580
eip=00af012c esp=0010f7f8 ebp=0010f9a4 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
winlogon!SignalManagerResetSignal:
001b:00af012c 6a08            push    8
kd> dd 0010f7f8
0010f7f8  00aef2a3 00251038 0000001b 00b02144
0010f808  00000000 00ac2f5c 00b0400c 002527d8
0010f818  00000108 00b02cc4 00000000 00228580
0010f828  00b046f8 00000000 00000000 00000108
0010f838  00000000 00000000 00000000 00000000
0010f848  00000000 00000007 00252890 0000010c
0010f858  00b032f4 00000000 00228580 00b046f8
0010f868  00ed0de0 00000000 0000010c 00000000
kd> g
Breakpoint 5 hit
eax=00b02150 ebx=00b02cc4 ecx=00af02d6 edx=00000edc esi=0000001c edi=00228580
eip=00af012c esp=0010f7f8 ebp=0010f9a4 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
winlogon!SignalManagerResetSignal:
001b:00af012c 6a08            push    8
kd> dd 0010f7f8
0010f7f8  00aef2a3 00251038 0000001c 00b02150
0010f808  00000000 00ac2f5c 00b0400c 002527d8
0010f818  00000108 00b02cc4 00000000 00228580
0010f828  00b046f8 00000000 00000000 00000108
0010f838  00000000 00000000 00000000 00000000
0010f848  00000000 00000007 00252890 0000010c
0010f858  00b032f4 00000000 00228580 00b046f8
0010f868  00ed0de0 00000000 0000010c 00000000
kd> g
Breakpoint 5 hit
eax=00b0215c ebx=00b02cc4 ecx=00af02d6 edx=00000edc esi=0000001d edi=00228580
eip=00af012c esp=0010f7f8 ebp=0010f9a4 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
winlogon!SignalManagerResetSignal:
001b:00af012c 6a08            push    8
kd> dd 0010f7f8
0010f7f8  00aef2a3 00251038 0000001d 00b0215c
0010f808  00000000 00ac2f5c 00b0400c 002527d8
0010f818  00000108 00b02cc4 00000000 00228580
0010f828  00b046f8 00000000 00000000 00000108
0010f838  00000000 00000000 00000000 00000000
0010f848  00000000 00000007 00252890 0000010c
0010f858  00b032f4 00000000 00228580 00b046f8
0010f868  00ed0de0 00000000 0000010c 00000000
kd> g
Breakpoint 5 hit
eax=00b02168 ebx=00b02cc4 ecx=00af02d6 edx=00000edc esi=0000001e edi=00228580
eip=00af012c esp=0010f7f8 ebp=0010f9a4 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
winlogon!SignalManagerResetSignal:
001b:00af012c 6a08            push    8
kd> dd 0010f7f8
0010f7f8  00aef2a3 00251038 0000001e 00b02168
0010f808  00000000 00ac2f5c 00b0400c 002527d8
0010f818  00000108 00b02cc4 00000000 00228580
0010f828  00b046f8 00000000 00000000 00000108
0010f838  00000000 00000000 00000000 00000000
0010f848  00000000 00000007 00252890 0000010c
0010f858  00b032f4 00000000 00228580 00b046f8
0010f868  00ed0de0 00000000 0000010c 00000000
kd> g
Breakpoint 5 hit
eax=00b02180 ebx=00b02cc4 ecx=00af02d6 edx=00000edc esi=00000020 edi=00228580
eip=00af012c esp=0010f7f8 ebp=0010f9a4 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
winlogon!SignalManagerResetSignal:
001b:00af012c 6a08            push    8
kd> dd 0010f7f8
0010f7f8  00aef2a3 00251038 00000020 00b02180
0010f808  00000000 00ac2f5c 00b0400c 002527d8
0010f818  00000108 00b02cc4 00000000 00228580
0010f828  00b046f8 00000000 00000000 00000108
0010f838  00000000 00000000 00000000 00000000
0010f848  00000000 00000007 00252890 0000010c
0010f858  00b032f4 00000000 00228580 00b046f8
0010f868  00ed0de0 00000000 0000010c 00000000
kd> g
Breakpoint 5 hit
eax=00b0218c ebx=00b02cc4 ecx=00af02d6 edx=00000edc esi=00000021 edi=00228580
eip=00af012c esp=0010f7f8 ebp=0010f9a4 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
winlogon!SignalManagerResetSignal:
001b:00af012c 6a08            push    8
kd> dd 0010f7f8
0010f7f8  00aef2a3 00251038 00000021 00b0218c
0010f808  00000000 00ac2f5c 00b0400c 002527d8
0010f818  00000108 00b02cc4 00000000 00228580
0010f828  00b046f8 00000000 00000000 00000108
0010f838  00000000 00000000 00000000 00000000
0010f848  00000000 00000007 00252890 0000010c
0010f858  00b032f4 00000000 00228580 00b046f8
0010f868  00ed0de0 00000000 0000010c 00000000

运行屏幕保护程序之后

kd> g
Breakpoint 9 hit
eax=00b032f4 ebx=0010f8c8 ecx=0010f8d8 edx=82b8e93c esi=00b0400c edi=00ac62bc
eip=00ae8802 esp=00bbfcec ebp=00bbfd00 iopl=0         nv up ei ng nz ac pe cy
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000297
winlogon!WLGeneric_TimeoutHandler_Logged_On_Execute:
001b:00ae8802 6870020000      push    270h
kd> g
Breakpoint 1 hit
eax=00bbfa68 ebx=00000001 ecx=00000001 edx=00000680 esi=00000000 edi=00b0400c
eip=00ae374c esp=00bbfa48 ebp=00bbfce8 iopl=0         nv up ei ng nz ac po cy
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000293
winlogon!RunScreenSaver:
001b:00ae374c 6a60            push    60h
kd> g
Breakpoint 2 hit
eax=00000000 ebx=00ac62cc ecx=00b03e38 edx=76fda084 esi=00228580 edi=76ff9dd0
eip=00aefe64 esp=00bbfa14 ebp=00bbfa34 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
winlogon!SignalManagerSetSignal:
001b:00aefe64 6a1c            push    1Ch
kd> g
Breakpoint 8 hit
eax=00000000 ebx=76ff9dd0 ecx=74ee25eb edx=76fda084 esi=00ac6714 edi=00251038
eip=00aefb2b esp=0010f7d4 ebp=0010f7e8 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
winlogon!SignalManagerWaitForSignal+0x171:
001b:00aefb2b 8945fc          mov     dword ptr [ebp-4],eax ss:0023:0010f7e4=00000000
kd> g
Breakpoint 4 hit
eax=0010f998 ebx=00b032f4 ecx=74ee25eb edx=76fda084 esi=0010f8c8 edi=00228580
eip=00af03ed esp=0010f7ec ebp=0010f9a4 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
winlogon!SignalManagerGetSignal:
001b:00af03ed 8bff            mov     edi,edi

第二部分A：

kd> g
Breakpoint 5 hit
eax=00000007 ebx=00b032f4 ecx=00b03e38 edx=00b03318 esi=00000007 edi=00228580
eip=00af012c esp=0010f7f8 ebp=0010f9a4 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
winlogon!SignalManagerResetSignal:
001b:00af012c 6a08            push    8
kd> dd 0010f7f8
0010f7f8  00aef27c 00251038 00000007 00b02054
0010f808  00000000 00ac2f5c 00b0400c 002527d8
0010f818  00000108 00b02cc4 00000000 00228580
0010f828  00b046f8 00000000 00000000 00000108
0010f838  00000000 00000000 00000000 00000000
0010f848  00000000 00000007 00252890 0000010c
0010f858  00b032f4 00000000 00228580 00b046f8
0010f868  00ed0de0 00000000 0000010c 00000000

kd> g
Breakpoint 5 hit
eax=00000003 ebx=00b032f4 ecx=00b03e38 edx=00b03318 esi=00000003 edi=00228580
eip=00af012c esp=0010f7f8 ebp=0010f9a4 iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000206
winlogon!SignalManagerResetSignal:
001b:00af012c 6a08            push    8
kd> dd 0010f7f8
0010f7f8  00aef27c 00251038 00000003 00b02024
0010f808  00000000 00ac2f5c 00b0400c 002527d8
0010f818  00000108 00b02cc4 00000000 00228580
0010f828  00b046f8 00000000 00000000 00000108
0010f838  00000000 00000000 00000000 00000000
0010f848  00000000 00000007 00252890 0000010c
0010f858  00b032f4 00000000 00228580 00b046f8
0010f868  00ed0de0 00000000 0000010c 00000000
kd> g
Breakpoint 5 hit
eax=0000000d ebx=00b032f4 ecx=00b03e38 edx=00b03318 esi=0000000d edi=00228580
eip=00af012c esp=0010f7f8 ebp=0010f9a4 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
winlogon!SignalManagerResetSignal:
001b:00af012c 6a08            push    8
kd> dd 0010f7f8
0010f7f8  00aef27c 00251038 0000000d 00b0209c
0010f808  00000000 00ac2f5c 00b0400c 002527d8
0010f818  00000108 00b02cc4 00000000 00228580
0010f828  00b046f8 00000000 00000000 00000108
0010f838  00000000 00000000 00000000 00000000
0010f848  00000000 00000007 00252890 0000010c
0010f858  00b032f4 00000000 00228580 00b046f8
0010f868  00ed0de0 00000000 0000010c 00000000
kd> g
Breakpoint 5 hit
eax=0000000c ebx=00b032f4 ecx=00b03e38 edx=00b03318 esi=0000000c edi=00228580
eip=00af012c esp=0010f7f8 ebp=0010f9a4 iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000206
winlogon!SignalManagerResetSignal:
001b:00af012c 6a08            push    8
kd> dd 0010f7f8
0010f7f8  00aef27c 00251038 0000000c 00b02090
0010f808  00000000 00ac2f5c 00b0400c 002527d8
0010f818  00000108 00b02cc4 00000000 00228580
0010f828  00b046f8 00000000 00000000 00000108
0010f838  00000000 00000000 00000000 00000000
0010f848  00000000 00000007 00252890 0000010c
0010f858  00b032f4 00000000 00228580 00b046f8
0010f868  00ed0de0 00000000 0000010c 00000000

kd> u 00b032f4
winlogon!g_xWLGeneric_TimeoutHandler_Logged_On_State:
00b032f4 40              inc     eax
00b032f5 1f              pop     ds
00b032f6 ac              lods    byte ptr [esi]
00b032f7 0000            add     byte ptr [eax],al
00b032f9 0000            add     byte ptr [eax],al
00b032fb 0002            add     byte ptr [edx],al
00b032fd 88ae008080ae    mov     byte ptr [esi-517F8000h],ch
00b03303 0008            add     byte ptr [eax],cl

kd> dd 00b032f4
00b032f4  00ac1f40 00000000 00ae8802 00ae8080
00b03304  00000008 00b03318 00000004 00b03378
00b03314  00000031 00000002 0000001c 00000002
00b03324  00000017 0000001c 00000002 00000012
00b03334  00000033 00000002 00000004 0000001c
00b03344  00000002 0000000b 0000001c 00000002
00b03354  00000003 00000029 00000000 0000000d
00b03364  00000032 00000000 00000000 0000001c

kd> dd 00b03378
00b03378  00000007 00000003 0000000d 0000000c
00b03388  00000000 00000039 00000000 00000001
00b03398  0000001c 00000000 00000003 0000000d
00b033a8  0000000c 0000001f 00ac1f08 00000000
00b033b8  00ae3378 00000000 00000002 00b03388
00b033c8  00000004 00b033a0 00000032 00000012
00b033d8  0000001c 00000002 00ac1ee8 00ae80bd
00b033e8  00000000 00000000 00000001 00b033d4
kd> dd 00b03318+80
00b03398  0000001c 00000000 00000003 0000000d
00b033a8  0000000c 0000001f 00ac1f08 00000000
00b033b8  00ae3378 00000000 00000002 00b03388
00b033c8  00000004 00b033a0 00000032 00000012
00b033d8  0000001c 00000002 00ac1ee8 00ae80bd
00b033e8  00000000 00000000 00000001 00b033d4
00b033f8  00000000 00000000 00000033 0000000c
00b03408  00000003 0000000d 00000002 00000038

第二部分B：

kd> g
Breakpoint 5 hit
eax=00b02000 ebx=00b032f4 ecx=00af02d6 edx=00000edc esi=00000000 edi=00228580
eip=00af012c esp=0010f7f8 ebp=0010f9a4 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
winlogon!SignalManagerResetSignal:
001b:00af012c 6a08            push    8
kd> dd 0010f7f8
0010f7f8  00aef2a3 00251038 00000000 00b02000
0010f808  00000000 00ac2f5c 00b0400c 002527d8
0010f818  00000108 00b02cc4 00000000 00228580
0010f828  00b046f8 00000000 00000000 00000108
0010f838  00000000 00000000 00000000 00000000
0010f848  00000000 00000007 00252890 0000010c
0010f858  00b032f4 00000000 00228580 00b046f8
0010f868  00ed0de0 00000000 0000010c 00000000
kd> g
Breakpoint 5 hit
eax=00b0200c ebx=00b032f4 ecx=00af02d6 edx=00000edc esi=00000001 edi=00228580
eip=00af012c esp=0010f7f8 ebp=0010f9a4 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
winlogon!SignalManagerResetSignal:
001b:00af012c 6a08            push    8
kd> dd 0010f7f8
0010f7f8  00aef2a3 00251038 00000001 00b0200c
0010f808  00000000 00ac2f5c 00b0400c 002527d8
0010f818  00000108 00b02cc4 00000000 00228580
0010f828  00b046f8 00000000 00000000 00000108
0010f838  00000000 00000000 00000000 00000000
0010f848  00000000 00000007 00252890 0000010c
0010f858  00b032f4 00000000 00228580 00b046f8
0010f868  00ed0de0 00000000 0000010c 00000000
kd> g
Breakpoint 5 hit
eax=00b020f0 ebx=00b032f4 ecx=00af02d6 edx=00000edc esi=00000014 edi=00228580
eip=00af012c esp=0010f7f8 ebp=0010f9a4 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
winlogon!SignalManagerResetSignal:
001b:00af012c 6a08            push    8
kd> dd 0010f7f8
0010f7f8  00aef2a3 00251038 00000014 00b020f0
0010f808  00000000 00ac2f5c 00b0400c 002527d8
0010f818  00000108 00b02cc4 00000000 00228580
0010f828  00b046f8 00000000 00000000 00000108
0010f838  00000000 00000000 00000000 00000000
0010f848  00000000 00000007 00252890 0000010c
0010f858  00b032f4 00000000 00228580 00b046f8
0010f868  00ed0de0 00000000 0000010c 00000000
kd> g
Breakpoint 5 hit
eax=00b02120 ebx=00b032f4 ecx=00af02d6 edx=00000edc esi=00000018 edi=00228580
eip=00af012c esp=0010f7f8 ebp=0010f9a4 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
winlogon!SignalManagerResetSignal:
001b:00af012c 6a08            push    8
kd> dd 0010f7f8
0010f7f8  00aef2a3 00251038 00000018 00b02120
0010f808  00000000 00ac2f5c 00b0400c 002527d8
0010f818  00000108 00b02cc4 00000000 00228580
0010f828  00b046f8 00000000 00000000 00000108
0010f838  00000000 00000000 00000000 00000000
0010f848  00000000 00000007 00252890 0000010c
0010f858  00b032f4 00000000 00228580 00b046f8
0010f868  00ed0de0 00000000 0000010c 00000000
kd> g
Breakpoint 5 hit
eax=00b0212c ebx=00b032f4 ecx=00af02d6 edx=00000edc esi=00000019 edi=00228580
eip=00af012c esp=0010f7f8 ebp=0010f9a4 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
winlogon!SignalManagerResetSignal:
001b:00af012c 6a08            push    8
kd> dd 0010f7f8
0010f7f8  00aef2a3 00251038 00000019 00b0212c
0010f808  00000000 00ac2f5c 00b0400c 002527d8
0010f818  00000108 00b02cc4 00000000 00228580
0010f828  00b046f8 00000000 00000000 00000108
0010f838  00000000 00000000 00000000 00000000
0010f848  00000000 00000007 00252890 0000010c
0010f858  00b032f4 00000000 00228580 00b046f8
0010f868  00ed0de0 00000000 0000010c 00000000
kd> g
Breakpoint 5 hit
eax=00b02138 ebx=00b032f4 ecx=00af02d6 edx=00000edc esi=0000001a edi=00228580
eip=00af012c esp=0010f7f8 ebp=0010f9a4 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
winlogon!SignalManagerResetSignal:
001b:00af012c 6a08            push    8
kd> dd 0010f7f8
0010f7f8  00aef2a3 00251038 0000001a 00b02138
0010f808  00000000 00ac2f5c 00b0400c 002527d8
0010f818  00000108 00b02cc4 00000000 00228580
0010f828  00b046f8 00000000 00000000 00000108
0010f838  00000000 00000000 00000000 00000000
0010f848  00000000 00000007 00252890 0000010c
0010f858  00b032f4 00000000 00228580 00b046f8
0010f868  00ed0de0 00000000 0000010c 00000000
kd> g
Breakpoint 5 hit
eax=00b02144 ebx=00b032f4 ecx=00af02d6 edx=00000edc esi=0000001b edi=00228580
eip=00af012c esp=0010f7f8 ebp=0010f9a4 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
winlogon!SignalManagerResetSignal:
001b:00af012c 6a08            push    8
kd> dd 0010f7f8
0010f7f8  00aef2a3 00251038 0000001b 00b02144
0010f808  00000000 00ac2f5c 00b0400c 002527d8
0010f818  00000108 00b02cc4 00000000 00228580
0010f828  00b046f8 00000000 00000000 00000108
0010f838  00000000 00000000 00000000 00000000
0010f848  00000000 00000007 00252890 0000010c
0010f858  00b032f4 00000000 00228580 00b046f8
0010f868  00ed0de0 00000000 0000010c 00000000
kd> g
Breakpoint 5 hit
eax=00b02150 ebx=00b032f4 ecx=00af02d6 edx=00000edc esi=0000001c edi=00228580
eip=00af012c esp=0010f7f8 ebp=0010f9a4 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
winlogon!SignalManagerResetSignal:
001b:00af012c 6a08            push    8
kd> dd 0010f7f8
0010f7f8  00aef2a3 00251038 0000001c 00b02150
0010f808  00000000 00ac2f5c 00b0400c 002527d8
0010f818  00000108 00b02cc4 00000000 00228580
0010f828  00b046f8 00000000 00000000 00000108
0010f838  00000000 00000000 00000000 00000000
0010f848  00000000 00000007 00252890 0000010c
0010f858  00b032f4 00000000 00228580 00b046f8
0010f868  00ed0de0 00000000 0000010c 00000000
kd> g
Breakpoint 5 hit
eax=00b0215c ebx=00b032f4 ecx=00af02d6 edx=00000edc esi=0000001d edi=00228580
eip=00af012c esp=0010f7f8 ebp=0010f9a4 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
winlogon!SignalManagerResetSignal:
001b:00af012c 6a08            push    8
kd> dd 0010f7f8
0010f7f8  00aef2a3 00251038 0000001d 00b0215c
0010f808  00000000 00ac2f5c 00b0400c 002527d8
0010f818  00000108 00b02cc4 00000000 00228580
0010f828  00b046f8 00000000 00000000 00000108
0010f838  00000000 00000000 00000000 00000000
0010f848  00000000 00000007 00252890 0000010c
0010f858  00b032f4 00000000 00228580 00b046f8
0010f868  00ed0de0 00000000 0000010c 00000000
kd> g
Breakpoint 5 hit
eax=00b02168 ebx=00b032f4 ecx=00af02d6 edx=00000edc esi=0000001e edi=00228580
eip=00af012c esp=0010f7f8 ebp=0010f9a4 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
winlogon!SignalManagerResetSignal:
001b:00af012c 6a08            push    8
kd> dd 0010f7f8
0010f7f8  00aef2a3 00251038 0000001e 00b02168
0010f808  00000000 00ac2f5c 00b0400c 002527d8
0010f818  00000108 00b02cc4 00000000 00228580
0010f828  00b046f8 00000000 00000000 00000108
0010f838  00000000 00000000 00000000 00000000
0010f848  00000000 00000007 00252890 0000010c
0010f858  00b032f4 00000000 00228580 00b046f8
0010f868  00ed0de0 00000000 0000010c 00000000
kd> g
Breakpoint 5 hit
eax=00b02180 ebx=00b032f4 ecx=00af02d6 edx=00000edc esi=00000020 edi=00228580
eip=00af012c esp=0010f7f8 ebp=0010f9a4 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
winlogon!SignalManagerResetSignal:
001b:00af012c 6a08            push    8
kd> dd 0010f7f8
0010f7f8  00aef2a3 00251038 00000020 00b02180
0010f808  00000000 00ac2f5c 00b0400c 002527d8
0010f818  00000108 00b02cc4 00000000 00228580
0010f828  00b046f8 00000000 00000000 00000108
0010f838  00000000 00000000 00000000 00000000
0010f848  00000000 00000007 00252890 0000010c
0010f858  00b032f4 00000000 00228580 00b046f8
0010f868  00ed0de0 00000000 0000010c 00000000
kd> g
Breakpoint 5 hit
eax=00b0218c ebx=00b032f4 ecx=00af02d6 edx=00000edc esi=00000021 edi=00228580
eip=00af012c esp=0010f7f8 ebp=0010f9a4 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
winlogon!SignalManagerResetSignal:
001b:00af012c 6a08            push    8

kd> u 00b032f4
winlogon!g_xWLGeneric_TimeoutHandler_Logged_On_State:
00b032f4 40              inc     eax
00b032f5 1f              pop     ds
00b032f6 ac              lods    byte ptr [esi]
00b032f7 0000            add     byte ptr [eax],al
00b032f9 0000            add     byte ptr [eax],al
00b032fb 0002            add     byte ptr [edx],al
00b032fd 88ae008080ae    mov     byte ptr [esi-517F8000h],ch
00b03303 0008            add     byte ptr [eax],cl
kd> x winlogon!g_rpWLGeneric_Signals
00b03e38          winlogon!g_rpWLGeneric_Signals = <no type information>
kd> dd 00b03e38
00b03e38  00b02000 00b0200c 00b02018 00b02024
00b03e48  00b02030 00b0203c 00b02048 00b02054
00b03e58  00b02060 00b0206c 00b02078 00b02084
00b03e68  00b02090 00b0209c 00b020a8 00b020b4
00b03e78  00b020c0 00b020cc 00b020d8 00b020e4
00b03e88  00b020f0 00b020fc 00b02108 00b02114
00b03e98  00b02120 00b0212c 00b02138 00b02144
00b03ea8  00b02150 00b0215c 00b02168 00b02174
kd> dd 00b02000
00b02000  00ac2bdc 00000001 00000000 00ac2bc0
00b02010  00000001 00000001 00ac2b90 00000000
00b02020  00000002 00ac2b78 00000000 00000003
00b02030  00ac2b50 00000000 00000004 00ac2b28
00b02040  00000000 00000005 00ac2af8 00000000
00b02050  00000006 00ac2ad8 00000000 00000007
00b02060  00ac2ab0 00000000 00000008 00ac2a88
00b02070  00000000 00000009 00ac2a60 00000000
kd> dd 00b02000+80
00b02080  0000000a 00ac2a48 00000000 0000000b
00b02090  00ac2a30 00000000 0000000c 00ac2a04
00b020a0  00000000 0000000d 00ac29e4 00000000
00b020b0  0000000e 00ac29c4 00000000 0000000f
00b020c0  00ac29a4 00000002 00000010 00ac2988
00b020d0  00000000 00000011 00ac2968 00000000
00b020e0  00000012 00ac2948 00000000 00000013
00b020f0  00ac2918 00000001 00000014 00ac28ec
kd> dd 00b02000+80*2
00b02100  00000000 00000015 00ac28c8 00000000
00b02110  00000016 00ac2898 00000000 00000017
00b02120  00ac2880 00000001 00000018 00ac2868
00b02130  00000001 00000019 00ac2848 00000001
00b02140  0000001a 00ac282c 00000001 0000001b
00b02150  00ac2814 00000001 0000001c 00ac27f4
00b02160  00000001 0000001d 00ac27c8 00000001
00b02170  0000001e 00ac27b0 00000000 0000001f
kd> dd 00b02000+80*3
00b02180  00ac2790 00000001 00000020 00ac2768
00b02190  00000001 00000021 00000000 00000001
00b021a0  00000000 00000002 0000004f 00000000
00b021b0  00000001 ffffffff 00000000 00000012
00b021c0  ffffffff 00000000 0000001b ffffffff
00b021d0  00000000 00000009 00000008 00000001
00b021e0  00ac275c 00000000 00ad2154 00ad22ed
00b021f0  00000006 00b02198 00000000 00000000