Re: nt!MmSessionSpace

Windows内核调试

nt!MmSessionSpace

---

yushang 2009-08-11, 14:23 下午
这是一个什么结构啊

Re: nt!MmSessionSpace

---

王宇 2009-08-12, 09:07 上午
\mm\mi.h

extern PMM_SESSION_SPACE MmSessionSpace;

0: kd> dt nt!_MM_SESSION_SPACE
+0x000 ReferenceCount : Uint4B
+0x004 u : __unnamed
+0x008 SessionId : Uint4B
+0x00c SessionPageDirectoryIndex : Uint4B
+0x010 GlobalVirtualAddress : Ptr32 _MM_SESSION_SPACE
+0x014 ProcessList : _LIST_ENTRY
+0x01c NonPagedPoolBytes : Uint4B
+0x020 PagedPoolBytes : Uint4B
+0x024 NonPagedPoolAllocations : Uint4B
+0x028 PagedPoolAllocations : Uint4B
+0x02c NonPagablePages : Uint4B
+0x030 CommittedPages : Uint4B
+0x038 LastProcessSwappedOutTime : _LARGE_INTEGER
+0x040 PageTables : Ptr32 _MMPTE
+0x044 PagedPoolMutex : _FAST_MUTEX
+0x064 PagedPoolStart : Ptr32 Void
+0x068 PagedPoolEnd : Ptr32 Void
+0x06c PagedPoolBasePde : Ptr32 _MMPTE
+0x070 PagedPoolInfo : _MM_PAGED_POOL_INFO
+0x094 Color : Uint4B
+0x098 ProcessOutSwapCount : Uint4B
+0x09c ImageList : _LIST_ENTRY
+0x0a4 GlobalPteEntry : Ptr32 _MMPTE
+0x0a8 CopyOnWriteCount : Uint4B
+0x0ac SessionPoolAllocationFailures : [4] Uint4B
+0x0bc AttachCount : Uint4B
+0x0c0 AttachEvent : _KEVENT
+0x0d0 LastProcess : Ptr32 _EPROCESS
+0x0d8 Vm : _MMSUPPORT
+0x118 Wsle : Ptr32 _MMWSLE
+0x11c WsLock : _ERESOURCE
+0x154 WsListEntry : _LIST_ENTRY
+0x15c Session : _MMSESSION
+0x198 Win32KDriverObject : _DRIVER_OBJECT
+0x240 WorkingSetLockOwner : Ptr32 _ETHREAD
+0x244 PagedPool : _POOL_DESCRIPTOR
+0x126c ProcessReferenceToSession : Int4B
+0x1270 LocaleId : Uint4B

Re: nt!MmSessionSpace

---

yushang 2010-05-17, 22:37 下午
感谢感谢