|
使用dg命令就可以观察GDT表的各个表项，每个表项是按字段显示的，很友好，例如：
0:000> dg 8 0x40
P Si Gr Pr Lo
Sel Base Limit Type l ze an es ng Flags
---- -------- -------- ---------- - -- -- -- -- --------
0008 00000000 ffffffff Code RE Ac 0 Bg Pg P Nl 00000c9b
0010 00000000 ffffffff Data RW Ac 0 Bg Pg P Nl 00000c93
0018 00000000 ffffffff Code RE Ac 3 Bg Pg P Nl 00000cfb
0020 00000000 ffffffff Data RW Ac 3 Bg Pg P Nl 00000cf3
0028 80042000 000020ab TSS32 Busy 0 Nb By P Nl 0000008b
0030 ffdff000 00001fff Data RW Ac 0 Bg Pg P Nl 00000c93
0038 7ffdf000 00000fff Data RW Ac 3 Bg By P Nl 000004f3
0040 00000400 0000ffff Data RW 3 Nb By P Nl 000000f2
如果要观察GDT表的原始形式，那么可以通过!pcr或者r gdtr得到GDT表的基地址，然后使用内存观察命令观察：
lkd> !pcr
KPCR for Processor 0 at ffdff000:
Major 1 Minor 1
NtTib.ExceptionList: acb74c7c
NtTib.StackBase: acb74df0
NtTib.StackLimit: acb71000
NtTib.SubSystemTib: 00000000
NtTib.Version: 00000000
NtTib.UserPointer: 00000000
NtTib.SelfTib: 7ffde000
SelfPcr: ffdff000
Prcb: ffdff120
Irql: 00000000
IRR: 00000000
IDR: ffffffff
InterruptMode: 00000000
IDT: 8003f400
GDT: 8003f000
TSS: 80042000
CurrentThread: 8946b630
NextThread: 00000000
IdleThread: 80551d20
DpcQueue:
lkd> dd 8003f000
8003f000 00000000 00000000 0000ffff 00cf9b00
8003f010 0000ffff 00cf9300 0000ffff 00cffb00
8003f020 0000ffff 00cff300 200020ab 80008b04
8003f030 f0000001 ffc093df e0000fff 7f40f3fd
8003f040 0400ffff 0000f200 00000000 00000000
8003f050 95000068 80008954 95680068 80008954
8003f060 2f30ffff 00009302 80003fff 0000920b
8003f070 700003ff ff0092ff 0000ffff 80009a40
|