请问用windbg看handle的一个问题，谢谢！

Windows内核调试

请问用windbg看handle的一个问题，谢谢！

---

jlflyfox 2010-07-13, 18:13 下午
代码中创建一个socket，
SOCKET socketServer=socket(AF_INET, SOCK_STREAM, 0);
然后运行，用Mark写的sysinternals里面那个handle来看进程的handle，有
700: File (---) \Device\Tcp

我用windgb内核本地调试，却看不见“\Device\Tcp”
0700: Object: 84dccec0 GrantedAccess: 001f01ff Entry: e38cbe00
Object: 84dccec0 Type: (89b8b900) File
ObjectHeader: 84dccea8 (old version)
HandleCount: 2 PointerCount: 3
用Object看不到
lkd> !Object 84dccec0
Object: 84dccec0 Type: (89b8b900) File
ObjectHeader: 84dccea8 (old version)
HandleCount: 2 PointerCount: 3
lkd> dt _object_header 84dccea8
nt!_OBJECT_HEADER
+0x000 PointerCount : 3
+0x004 HandleCount : 2
+0x004 NextToFree : 0x00000002
+0x008 Type : 0x89b8b900 _OBJECT_TYPE
+0x00c NameInfoOffset : 0 ''
+0x00d HandleInfoOffset : 0x8 ''
+0x00e QuotaInfoOffset : 0 ''
+0x00f Flags : 0x2 ''
+0x010 ObjectCreateInfo : 0x00000001 _OBJECT_CREATE_INFORMATION
+0x010 QuotaBlockCharged : 0x00000001
+0x014 SecurityDescriptor : (null)
+0x018 Body : _QUAD

lkd> dt _object_header 84dccea8
nt!_OBJECT_HEADER
+0x000 PointerCount : 3
+0x004 HandleCount : 2
+0x004 NextToFree : 0x00000002
+0x008 Type : 0x89b8b900 _OBJECT_TYPE
+0x00c NameInfoOffset : 0 ''
+0x00d HandleInfoOffset : 0x8 ''
+0x00e QuotaInfoOffset : 0 ''
+0x00f Flags : 0x2 ''
+0x010 ObjectCreateInfo : 0x00000001 _OBJECT_CREATE_INFORMATION
+0x010 QuotaBlockCharged : 0x00000001
+0x014 SecurityDescriptor : (null)
+0x018 Body : _QUAD
看object_type只能看到是file
lkd> dt _object_type 0x89b8b900
nt!_OBJECT_TYPE
+0x000 Mutex : _ERESOURCE
+0x038 TypeList : _LIST_ENTRY [ 0x89b8b938 - 0x89b8b938 ]
+0x040 Name : _UNICODE_STRING "File"
+0x048 DefaultObject : 0x0000005c
+0x04c Index : 0x1c
+0x050 TotalNumberOfObjects : 0x26f4
+0x054 TotalNumberOfHandles : 0xea1
+0x058 HighWaterNumberOfObjects : 0x71e5
+0x05c HighWaterNumberOfHandles : 0xf84
+0x060 TypeInfo : _OBJECT_TYPE_INITIALIZER
+0x0ac Key : 0x656c6946
+0x0b0 ObjectLocks : [4] _ERESOURCE

用FILE_OBJECT也看不到名字
lkd> dt nt!_FILE_OBJECT 84dccec0
+0x000 Type : 5
+0x002 Size : 112
+0x004 DeviceObject : 0x861e2f18 _DEVICE_OBJECT
+0x008 Vpb : (null)
+0x00c FsContext : 0x842ec6b0
+0x010 FsContext2 : 0x00000001
+0x014 SectionObjectPointer : (null)
+0x018 PrivateCacheMap : (null)
+0x01c FinalStatus : 0
+0x020 RelatedFileObject : (null)
+0x024 LockOperation : 0 ''
+0x025 DeletePending : 0 ''
+0x026 ReadAccess : 0 ''
+0x027 WriteAccess : 0 ''
+0x028 DeleteAccess : 0 ''
+0x029 SharedRead : 0 ''
+0x02a SharedWrite : 0 ''
+0x02b SharedDelete : 0 ''
+0x02c Flags : 0x40000
+0x030 FileName : _UNICODE_STRING ""
+0x038 CurrentByteOffset : _LARGE_INTEGER 0x0
+0x040 Waiters : 0
+0x044 Busy : 0
+0x048 LastLock : (null)
+0x04c Lock : _KEVENT
+0x05c Event : _KEVENT
+0x06c CompletionContext : (null)


怎么找不到\Device\Tcp这个名字
而“\Device\Afd”用windbg就能看到


0710: Object: 84f197b8 GrantedAccess: 001f01ff Entry: e38cbe20
Object: 84f197b8 Type: (89b8b900) File
ObjectHeader: 84f197a0 (old version)
HandleCount: 1 PointerCount: 2
Directory Object: 00000000 Name: \Endpoint {Afd}

lkd> dt nt!_FILE_OBJECT 84f197b8
+0x000 Type : 5
+0x002 Size : 112
+0x004 DeviceObject : 0x86186290 _DEVICE_OBJECT
+0x008 Vpb : (null)
+0x00c FsContext : 0x84d60510
+0x010 FsContext2 : (null)
+0x014 SectionObjectPointer : (null)
+0x018 PrivateCacheMap : 0xffffffff
+0x01c FinalStatus : 0
+0x020 RelatedFileObject : (null)
+0x024 LockOperation : 0 ''
+0x025 DeletePending : 0 ''
+0x026 ReadAccess : 0 ''
+0x027 WriteAccess : 0 ''
+0x028 DeleteAccess : 0 ''
+0x029 SharedRead : 0 ''
+0x02a SharedWrite : 0 ''
+0x02b SharedDelete : 0 ''
+0x02c Flags : 0x40000
+0x030 FileName : _UNICODE_STRING "\Endpoint"
+0x038 CurrentByteOffset : _LARGE_INTEGER 0x0
+0x040 Waiters : 0
+0x044 Busy : 0
+0x048 LastLock : (null)
+0x04c Lock : _KEVENT
+0x05c Event : _KEVENT
+0x06c CompletionContext : (null)