tailieunhanh - Windows Internals covering windows server 2008 and windows vista- P17

Windows Internals covering windows server 2008 and windows vista- P17: In this chapter, we’ll introduce the key Microsoft Windows operating system concepts and terms we’ll be using throughout this book, such as the Windows API, processes, threads, virtual memory, kernel mode and user mode, objects, handles, security, and the registry. | 4. Section Ref 1 Pfn Ref 46 Mapped Views 4 5. User Ref 0 WaitForDel 0 Flush Count 0 6. File Object 86960228 ModWriteCount 0 System Views 0 7. Flags 8008080 File WasPurged Accessed 8. File Program Files Debugging Tools for Windows x86 Next look at the file object referenced by the control area with this command 1. lkd dt nt _FILE_OBJECT 0x86960228 2. 0x000 Type 5 3. 0x002 Size 128 4. 0x004 DeviceObject 0x84a69a18 _DEVICE_OBJECT 5. 0x008 Vpb 0x84a63278 _VPB 6. 0x00c FsContext 0x9ae3e768 7. 0x010 FsContext2 0xad4a0c78 8. 0x014 SectionObjectPointer 0x86724504 _SECTION_OBJECT_POINTERS 9. 0x018 PrivateCacheMap 0x86b48460 10. 0x01c FinalStatus 0 11. 0x020 RelatedFileObject null 12. 0x024 LockOperation 0 13. . The private cache map is at offset 0x18 1. lkd dt nt _PRIVATE_CACHE_MAP 0x86b48460 2. 0x000 NodeTypeCode 766 3. 0x000 Flags _PRIVATE_CACHE_MAP_FLAGS 4. 0x000 UlongFlags 0x1402fe 5. 0x004 ReadAheadMask 0xffff 6. 0x008 FileObject 0x86960228 _FILE_OBJECT 7. 0x010 FileOffset1 _LARGE_INTEGER 0x146 8. 0x018 BeyondLastByte 1 _LARGE_INTEGER 0x14a 9. 0x020 FileOffset2 _LARGE_INTEGER 0x14a 10. 0x028 BeyondLastByte2 _LARGE_INTEGER 0x156 11. 0x030 ReadAheadOffset 2 _LARGE_INTEGER 0x0 12. 0x040 ReadAheadLength 2 0 13. 0x048 ReadAheadSpinLock 0 14. 0x04c PrivateLinks _LIST_ENTRY 0x86b48420 - 0x86b48420 15. 0x054 ReadAheadWorkItem null Finally you can locate the shared cache map in the SectionObjectPointer field of the file object and then view its contents 1. lkd dt nt _SECTION_OBJECT_POINTERS 0x86724504 2. 0x000 DataSectionObject 0x867548f0 3. 0x004 SharedCacheMap 0x86b48388 4. 0x008 ImageSectionObject null 790 Please purchase PDF Split-Merge on to remove this watermark. 5. 6. 7. 8. lkd dt nt _SHARED_CACHE_MAP 0x86b48388 0x000 NodeTypeCode 767 0x002 NodeByteSize 320 0x004 OpenCount 1 9. 0x008 FileSize _LARGE_INTEGER 0x125726 10. 0x010 BcbList _LIST_ENTRY 0x86b48398 - 0x86b48398 11. 0x018 SectionSize _LARGE_INTEGER 0x140000 12. 0x020 ValidDataLength .