第一部分：
NTSTATUS
_IcaPushStack(
IN PICA_STACK pStack,
IN PICA_STACK_PUSH pStackPush
)
{
/*
* Load an instance of the requested stack driver
*/
Status = _IcaLoadSd( pStackPush->StackModuleName, &pSdLink );
if ( !NT_SUCCESS( Status ) )
goto done;
/*
* Call the SD open procedure
*/
Status = _IcaCallSd( pSdLink, SD$OPEN, pSdOpen );
第二部分：
0: kd> g
Breakpoint 0 hit
termsrv!WsxStackIoControl:
001b:7489fb4f 55 push ebp
1: kd> kc
#
00 termsrv!WsxStackIoControl
01 icaapi!_IcaStackIoControl
02 icaapi!IcaStackConnectionWait
03 termsrv!WinStationConnectThread
04 kernel32!BaseThreadStart
1: kd> g
Breakpoint 0 hit
termsrv!WsxStackIoControl:
001b:7489fb4f 55 push ebp
1: kd> kc
#
00 termsrv!WsxStackIoControl
01 icaapi!_IcaStackIoControl
02 icaapi!_IcaPushPd
03 icaapi!_IcaPushStack
04 icaapi!_IcaPushStackAndOpenEndpoint
05 icaapi!IcaStackConnectionAccept
06 termsrv!TransferConnectionToIdleWinStation
07 termsrv!WinStationTransferThread
08 kernel32!BaseThreadStart
1: kd> g
Breakpoint 3 hit
termdd!_IcaPushStack:
baa8e73c 55 push ebp
1: kd> kc
#
00 termdd!_IcaPushStack
01 termdd!IcaDeviceControlStack
02 termdd!IcaDeviceControl
03 termdd!IcaDispatch
04 nt!IofCallDriver
05 nt!IopSynchronousServiceTail
06 nt!IopXxxControlFile
07 nt!NtDeviceIoControlFile
08 nt!_KiSystemService
09 SharedUserData!SystemCallStub
0a ntdll!NtDeviceIoControlFile
0b icaapi!IcaIoControl
0c icaapi!_IcaStackIoControlWorker
0d icaapi!IcaStackIoControl
0e rdpwsx!WsxIcaStackIoControl
0f termsrv!WsxStackIoControl
10 icaapi!_IcaStackIoControl
11 icaapi!_IcaPushPd
12 icaapi!_IcaPushStack
13 icaapi!_IcaPushStackAndOpenEndpoint
14 icaapi!IcaStackConnectionAccept
15 termsrv!TransferConnectionToIdleWinStation
16 termsrv!WinStationTransferThread
17 kernel32!BaseThreadStart
1: kd> dv
pStack = 0x898b79e0
pStackPush = 0xba104738
pSdLink = 0x00000008
1: kd> dx -r1 ((termdd!_ICA_STACK_PUSH *)0xba104738)
((termdd!_ICA_STACK_PUSH *)0xba104738) : 0xba104738 [Type: _ICA_STACK_PUSH *]
[+0x000] StackModuleType : Stack_Module_Pd (0) [Type: _STACKMODULECLASS]
[+0x004] StackModuleName [Type: unsigned short [33]]
[+0x046] OEMId : "" [Type: char [4]]
[+0x04c] WdConfig [Type: _WDCONFIGW]
[+0x178] PdConfig [Type: _PDCONFIGW]
[+0x458] WinStationRegName [Type: unsigned short [33]]
1: kd> dx -r1 (*((termdd!unsigned short (*)[33])0xba104b90))
(*((termdd!unsigned short (*)[33])0xba104b90)) [Type: unsigned short [33]]
[0] : 0x52 [Type: unsigned short]
[1] : 0x44 [Type: unsigned short]
[2] : 0x50 [Type: unsigned short]
[3] : 0x2d [Type: unsigned short]
[4] : 0x54 [Type: unsigned short]
[5] : 0x63 [Type: unsigned short]
[6] : 0x70 [Type: unsigned short]
[7] : 0x0 [Type: unsigned short]
[8] : 0x0 [Type: unsigned short]
[9] : 0x0 [Type: unsigned short]
1: kd> db 0xba104b90
ba104b90 52 00 44 00 50 00 2d 00-54 00 63 00 70 00 00 00 R.D.P.-.T.c.p...
ba104ba0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
ba104bb0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
ba104bc0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
ba104bd0 00 00 00 00 e2 9a f7 aa-c0 46 10 ba 44 6c a2 80 .........F..Dl..
ba104be0 e4 4c 10 ba b8 38 a9 ba-f0 42 a9 ba 00 00 00 00 .L...8...B......
ba104bf0 04 4c 10 ba 9c 99 a8 ba-e0 79 8b 89 b0 be 7d 89 .L.......y....}.
ba104c00 20 bf 7d 89 20 4c 10 ba-a3 a3 a8 ba b0 be 7d 89 .}. L........}.
1: kd> dx -r1 (*((termdd!unsigned short (*)[33])0xba10473c))
(*((termdd!unsigned short (*)[33])0xba10473c)) [Type: unsigned short [33]]
[0] : 0x74 [Type: unsigned short]
[1] : 0x64 [Type: unsigned short]
[2] : 0x74 [Type: unsigned short]
[3] : 0x63 [Type: unsigned short]
[4] : 0x70 [Type: unsigned short]
[5] : 0x0 [Type: unsigned short]
1: kd> db 0xba10473c
ba10473c 74 00 64 00 74 00 63 00-70 00 00 00 00 00 00 00 t.d.t.c.p.......
ba10474c 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
ba10475c 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
ba10476c 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
ba10477c 00 00 00 00 00 00 00 00-4d 00 69 00 63 00 72 00 ........M.i.c.r.
ba10478c 6f 00 73 00 6f 00 66 00-74 00 20 00 52 00 44 00 o.s.o.f.t. .R.D.
ba10479c 50 00 20 00 35 00 2e 00-32 00 00 00 00 00 00 00 P. .5...2.......
ba1047ac 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
第三部分：
1: kd> x termdd!g_TermServProcessID
baa951a8 termdd!g_TermServProcessID = 0x8960d6a0
pSdOpen = ICA_ALLOCATE_POOL( NonPagedPool, sizeof(SD_OPEN) );
if ( pSdOpen == NULL ) {
Status = STATUS_NO_MEMORY;
goto done;
}
1: kd> p
termdd!_IcaPushStack+0x61:
baa8e79d e844c9ffff call termdd!IcaAllocatePool (baa8b0e6)
1: kd> p
termdd!_IcaPushStack+0x66:
baa8e7a2 8bd8 mov ebx,eax
1: kd> r
eax=897fdb80 ebx=00000000 ecx=baa8b1be edx=897fdb68 esi=898b79e0 edi=ba10473c
eip=baa8e7a2 esp=ba1046a0 ebp=ba1046b0 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000282
termdd!_IcaPushStack+0x66:
baa8e7a2 8bd8 mov ebx,eax
1: kd> dt SD_OPEN 897fdb80
termdd!SD_OPEN
+0x000 StackClass : 0xffffffff (No matching name)
+0x004 pStatus : 0xffffffff _PROTOCOLSTATUS
+0x008 pClient : 0xffffffff _CLIENTMODULES
+0x00c WdConfig : _WDCONFIGW
+0x138 PdConfig : _PDCONFIGW
+0x418 OEMId : [4] "???"
+0x41c WinStationRegName : [33] 0xffff
+0x460 DeviceObject : 0xffffffff _DEVICE_OBJECT
+0x464 OutBufHeader : 0xffffffff
+0x468 OutBufTrailer : 0xffffffff
+0x46c SdOutBufHeader : 0xffffffff
+0x470 SdOutBufTrailer : 0xffffffff
第四部分：
1: kd> dv
pStack = 0x898b79e0
pStackPush = 0xba104738
pSdLink = 0x00000000
1: kd> dx -r1 ((termdd!_ICA_STACK_PUSH *)0xba104738)
((termdd!_ICA_STACK_PUSH *)0xba104738) : 0xba104738 [Type: _ICA_STACK_PUSH *]
[+0x000] StackModuleType : Stack_Module_Pd (0) [Type: _STACKMODULECLASS]
[+0x004] StackModuleName [Type: unsigned short [33]]
[+0x046] OEMId : "" [Type: char [4]]
[+0x04c] WdConfig [Type: _WDCONFIGW]
[+0x178] PdConfig [Type: _PDCONFIGW]
[+0x458] WinStationRegName [Type: unsigned short [33]]
1: kd> dx -r1 (*((termdd!unsigned short (*)[33])0xba10473c))
(*((termdd!unsigned short (*)[33])0xba10473c)) [Type: unsigned short [33]]
[0] : 0x74 [Type: unsigned short]
[1] : 0x64 [Type: unsigned short]
[2] : 0x74 [Type: unsigned short]
[3] : 0x63 [Type: unsigned short]
[4] : 0x70 [Type: unsigned short]
[5] : 0x0 [Type: unsigned short]
1: kd> db 0xba10473c
ba10473c 74 00 64 00 74 00 63 00-70 00 00 00 00 00 00 00 t.d.t.c.p.......
第五部分：
1: kd> p
termdd!_IcaPushStack+0x7b:
baa8e7b7 e876f1ffff call termdd!_IcaLoadSd (baa8d932)
1: kd> t
termdd!_IcaLoadSd:
baa8d932 55 push ebp
1: kd> kc 6
#
00 termdd!_IcaLoadSd
01 termdd!_IcaPushStack
02 termdd!IcaDeviceControlStack
03 termdd!IcaDeviceControl
04 termdd!IcaDispatch
05 nt!IofCallDriver
1: kd> dv
SdName = 0xba10473c
ppSdLink = 0xba1046ac
pSdLoad = 0x00000008
Status = 0n-1173338308
1: kd> dx -r1 ((termdd!unsigned short *)0xba10473c)
((termdd!unsigned short *)0xba10473c) : 0xba10473c : 0x74 [Type: unsigned short *]
0x74 [Type: unsigned short]
1: kd> db 0xba10473c
ba10473c 74 00 64 00 74 00 63 00-70 00 00 00 00 00 00 00 t.d.t.c.p.......
1: kd> x termdd!IcaSdLoadListHead
baa952e8 termdd!IcaSdLoadListHead = struct _LIST_ENTRY [ 0x897e8fd8 - 0x8948bd40 ]
1: kd> dx -r1 (*((termdd!_LIST_ENTRY *)0xbaa952e8))
(*((termdd!_LIST_ENTRY *)0xbaa952e8)) [Type: _LIST_ENTRY]
[+0x000] Flink : 0x897e8fd8 [Type: _LIST_ENTRY *]
[+0x004] Blink : 0x8948bd40 [Type: _LIST_ENTRY *]
1: kd> dt SDLOAD 0x897e8fd8
termdd!SDLOAD
+0x000 SdName : [33] 0xbd40
+0x044 RefCount : 0n0
+0x048 Links : _LIST_ENTRY [ 0x0 - 0x0 ]
+0x050 ImageHandle : (null)
+0x054 ImageBase : (null)
+0x058 DriverLoad : (null)
+0x05c FileObject : (null)
+0x060 pUnloadWorkItem : (null)
+0x064 DeviceObject : (null)
1: kd> dt SDLOAD 0x897e8fd8-48
termdd!SDLOAD
+0x000 SdName : [33] 0x72
+0x044 RefCount : 0n2
+0x048 Links : _LIST_ENTRY [ 0x8948bd40 - 0xbaa952e8 ]
+0x050 ImageHandle : (null)
+0x054 ImageBase : 0x00000001 Void
+0x058 DriverLoad : 0xb9ae4e10 long RDPWD!ModuleEntry+0
+0x05c FileObject : 0x89847c78 _FILE_OBJECT
+0x060 pUnloadWorkItem : (null)
+0x064 DeviceObject : 0x894768c8 _DEVICE_OBJECT
1: kd> dx -r1 ((termdd!_LIST_ENTRY *)0x897e8fd8)
((termdd!_LIST_ENTRY *)0x897e8fd8) : 0x897e8fd8 [Type: _LIST_ENTRY *]
[+0x000] Flink : 0x8948bd40 [Type: _LIST_ENTRY *]
[+0x004] Blink : 0xbaa952e8 [Type: _LIST_ENTRY *]
1: kd> dt SDLOAD 0x8948bd40-48
termdd!SDLOAD
+0x000 SdName : [33] 0x74
+0x044 RefCount : 0n2 +0x044 RefCount : 0n2
+0x048 Links : _LIST_ENTRY [ 0xbaa952e8 - 0x897e8fd8 ]
+0x050 ImageHandle : (null)
+0x054 ImageBase : (null)
+0x058 DriverLoad : 0xb9c9da7e long TDTCP!ModuleEntry+0
+0x05c FileObject : 0x8974cf90 _FILE_OBJECT
+0x060 pUnloadWorkItem : (null)
+0x064 DeviceObject : 0x895e78c8 _DEVICE_OBJECT
1: kd> dv
SdName = 0xba10473c
ppSdLink = 0xba1046ac
pSdLoad = 0x00000008
Status = 0n-1173338308
1: kd> dx -r1 ((termdd!_SDLINK * *)0xba1046ac)
((termdd!_SDLINK * *)0xba1046ac) : 0xba1046ac [Type: _SDLINK * *]
0x0 [Type: _SDLINK *]
1: kd> dt SDLINK 0xba1046ac
termdd!SDLINK
+0x000 pStack : (null)
+0x004 pSdLoad : 0xba104bf0 _SDLOAD
+0x008 Links : _LIST_ENTRY [ 0xbaa8f087 - 0x898b79e0 ]
+0x010 RefCount : 0n-1173338312
+0x014 SdContext : _SDCONTEXT
+0x020 Resource : _ERESOURCE
1: kd> dx -id 0,0,8960d6a0 -r1 (*((termdd!_SDCONTEXT *)0xba1046c0))
(*((termdd!_SDCONTEXT *)0xba1046c0)) [Type: _SDCONTEXT]
[+0x000] pProcedures : 0x897dbf20 [Type: void *]
[+0x004] pCallup : 0x897dbeb0 [Type: _SDCALLUP *]
[+0x008] pContext : 0x804edc6c [Type: void *]
/*
* Allocate a SDLINK struct
*/
pSdLink = ICA_ALLOCATE_POOL( NonPagedPool, sizeof(*pSdLink) );
if ( pSdLink == NULL )
return( STATUS_INSUFFICIENT_RESOURCES );
RtlZeroMemory( pSdLink, sizeof(*pSdLink) );
/*
* Look for the requested SD. If found, increment the ref count for it.
*/
Head = &IcaSdLoadListHead;
for ( Next = Head->Flink; Next != Head; Next = Next->Flink ) {
pSdLoad = CONTAINING_RECORD( Next, SDLOAD, Links );
if ( !wcscmp( pSdLoad->SdName, SdName ) ) {
_IcaReferenceSdLoad( pSdLoad );
break;
}
}
1: kd> dv
SdName = 0xba10473c
ppSdLink = 0xba1046ac
pSdLoad = 0x8948bcf8
Status = 0n-1173338308
1: kd> dx -r1 ((termdd!_SDLOAD *)0x8948bcf8)
((termdd!_SDLOAD *)0x8948bcf8) : 0x8948bcf8 [Type: _SDLOAD *]
[+0x000] SdName [Type: unsigned short [33]]
[+0x044] RefCount : 3 [Type: long] //原来是2
[+0x048] Links [Type: _LIST_ENTRY]
[+0x050] ImageHandle : 0x0 [Type: void *]
[+0x054] ImageBase : 0x0 [Type: void *]
[+0x058] DriverLoad : 0xb9c9da7e [Type: long (*)(_SDCONTEXT *,unsigned char)]
[+0x05c] FileObject : 0x8974cf90 [Type: _FILE_OBJECT *]
[+0x060] pUnloadWorkItem : 0x0 [Type: void *]
[+0x064] DeviceObject : 0x895e78c8 : Device for "\Driver\TDTCP" [Type: _DEVICE_OBJECT *]
pSdLink->pSdLoad = pSdLoad;
1: kd> dt _SDLINK 0xba1046ac
termdd!_SDLINK
+0x000 pStack : (null)
+0x004 pSdLoad : 0xba104bf0 _SDLOAD
+0x008 Links : _LIST_ENTRY [ 0xbaa8f087 - 0x898b79e0 ]
+0x010 RefCount : 0n-1173338312
+0x014 SdContext : _SDCONTEXT
+0x020 Resource : _ERESOURCE
第六部分：
/*
* Call the driver load procedure.
* The driver will fill in the fields in the SDCONTEXT structure.
*/
Status = (pSdLoad->DriverLoad)( &pSdLink->SdContext, TRUE );
1: kd> p
termdd!_IcaLoadSd+0xea:
baa8da1c 50 push eax
1: kd> p
termdd!_IcaLoadSd+0xeb:
baa8da1d 8b45fc mov eax,dword ptr [ebp-4]
1: kd> p
termdd!_IcaLoadSd+0xee:
baa8da20 ff5058 call dword ptr [eax+58h]
1: kd> r
eax=8948bcf8 ebx=80a1aa6e ecx=00000000 edx=00000000 esi=895db978 edi=80aed4d0
eip=baa8da20 esp=ba104678 ebp=ba104690 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
termdd!_IcaLoadSd+0xee:
baa8da20 ff5058 call dword ptr [eax+58h] ds:0023:8948bd50={TDTCP!ModuleEntry (b9c9da7e)}
NTSTATUS ModuleEntry(PSDCONTEXT pContext, BOOLEAN fLoad)
{
if (fLoad)
return TdLoad(pContext);
else
return TdUnload(pContext);
}
NTSTATUS TdLoad(PSDCONTEXT pContext)
{
NTSTATUS Status;
PTD pTd;
/*
* Initialize td procedures
*/
pContext->pProcedures = G_pTdProcedures;
1: kd> x TDTCP!G_pTdProcedures
b9ca6010 TDTCP!G_pTdProcedures = <function> *[6]
1: kd> dx -r1 (*((TDTCP!long (*(*)[6])(void *,void *))0xb9ca6010))
(*((TDTCP!long (*(*)[6])(void *,void *))0xb9ca6010)) [Type: long (* [6])(void *,void *)]
[0] : 0xb9c9ca24 [Type: long (*)(void *,void *)]
[1] : 0xb9c9cca0 [Type: long (*)(void *,void *)]
[2] : 0xb9c9dcd6 [Type: long (*)(void *,void *)]
[3] : 0xb9c9cde2 [Type: long (*)(void *,void *)]
[4] : 0xb9c9ce16 [Type: long (*)(void *,void *)]
[5] : 0xb9c9cec2 [Type: long (*)(void *,void *)]
1: kd> u b9c9ca24
TDTCP!TdOpen [d:\srv03rtm\termsrv\drivers\td\common\tdapi.c @ 237]:
b9c9ca24 55 push ebp
b9c9ca25 8bec mov ebp,esp
b9c9ca27 51 push ecx
b9c9ca28 51 push ecx
b9c9ca29 53 push ebx
b9c9ca2a 56 push esi
b9c9ca2b 57 push edi
b9c9ca2c 8b5d08 mov ebx,dword ptr [ebp+8]
1: kd> u b9c9cca0
TDTCP!TdClose [d:\srv03rtm\termsrv\drivers\td\common\tdapi.c @ 299]:
b9c9cca0 55 push ebp
b9c9cca1 8bec mov ebp,esp
b9c9cca3 53 push ebx
b9c9cca4 56 push esi
b9c9cca5 8b7508 mov esi,dword ptr [ebp+8]
b9c9cca8 57 push edi
b9c9cca9 682ecbc9b9 push offset TDTCP!TdOpen+0x10a (b9c9cb2e)
b9c9ccae 6a01 push 1
1: kd> u b9c9dcd6
TDTCP!TdRawWrite [d:\srv03rtm\termsrv\drivers\td\common\tdapi.c @ 414]:
b9c9dcd6 55 push ebp
b9c9dcd7 8bec mov ebp,esp
b9c9dcd9 51 push ecx
b9c9dcda 8b450c mov eax,dword ptr [ebp+0Ch]
b9c9dcdd 8365fc00 and dword ptr [ebp-4],0
b9c9dce1 53 push ebx
b9c9dce2 56 push esi
b9c9dce3 57 push edi
1: kd> u b9c9ce16
TDTCP!TdSyncWrite [d:\srv03rtm\termsrv\drivers\td\common\tdapi.c @ 583]:
b9c9ce16 55 push ebp
b9c9ce17 8bec mov ebp,esp
b9c9ce19 53 push ebx
b9c9ce1a 56 push esi
b9c9ce1b 8b7508 mov esi,dword ptr [ebp+8]
b9c9ce1e 57 push edi
b9c9ce1f 68eacdc9b9 push offset TDTCP!TdChannelWrite+0x8 (b9c9cdea)
b9c9ce24 6a10 push 10h
1: kd> u b9c9cec2
TDTCP!TdIoctl [d:\srv03rtm\termsrv\drivers\td\common\tdapi.c @ 630]:
b9c9cec2 55 push ebp
b9c9cec3 8bec mov ebp,esp
b9c9cec5 53 push ebx
b9c9cec6 8b5d08 mov ebx,dword ptr [ebp+8]
b9c9cec9 56 push esi
b9c9ceca 57 push edi
b9c9cecb 8b7d0c mov edi,dword ptr [ebp+0Ch]
b9c9cece 8b07 mov eax,dword ptr [edi]
1: kd> dv
pContext = 0x895db98c
fLoad = 0x01 ''
1: kd> dx -r1 ((TDTCP!_SDCONTEXT *)0x895db98c)
((TDTCP!_SDCONTEXT *)0x895db98c) : 0x895db98c [Type: _SDCONTEXT *]
[+0x000] pProcedures : 0xb9ca6010 [Type: void *]
[+0x004] pCallup : 0x0 [Type: _SDCALLUP *]
[+0x008] pContext : 0x894e7388 [Type: void *]
1: kd> p
TDTCP!ModuleEntry+0x18:
b9c9da96 5d pop ebp
1: kd> p
TDTCP!ModuleEntry+0x19:
b9c9da97 c20800 ret 8
1: kd> p
termdd!_IcaLoadSd+0xf1:
baa8da23 85c0 test eax,eax
1: kd> p
返回到：termdd!_IcaLoadSd
NTSTATUS
_IcaLoadSd(
IN PDLLNAME SdName,
OUT PSDLINK *ppSdLink
)
{
*ppSdLink = pSdLink;
return( Status );
}
1: kd> dv
SdName = 0x00000000
ppSdLink = 0xba1046ac
pSdLoad = 0x8948bcf8
Status = 0n0
1: kd> dx -r1 ((termdd!_SDLINK * *)0xba1046ac)
((termdd!_SDLINK * *)0xba1046ac) : 0xba1046ac [Type: _SDLINK * *]
0x895db978 [Type: _SDLINK *]
1: kd> dx -r1 ((termdd!_SDLINK *)0x895db978)
((termdd!_SDLINK *)0x895db978) : 0x895db978 [Type: _SDLINK *]
[+0x000] pStack : 0x0 [Type: _ICA_STACK *]
[+0x004] pSdLoad : 0x8948bcf8 [Type: _SDLOAD *]
[+0x008] Links [Type: _LIST_ENTRY]
[+0x010] RefCount : 1 [Type: long]
[+0x014] SdContext [Type: _SDCONTEXT]
[+0x020] Resource [Type: _ERESOURCE]
1: kd> dx -r1 ((termdd!_SDLOAD *)0x8948bcf8)
((termdd!_SDLOAD *)0x8948bcf8) : 0x8948bcf8 [Type: _SDLOAD *]
[+0x000] SdName [Type: unsigned short [33]]
[+0x044] RefCount : 3 [Type: long]
[+0x048] Links [Type: _LIST_ENTRY]
[+0x050] ImageHandle : 0x0 [Type: void *]
[+0x054] ImageBase : 0x0 [Type: void *]
[+0x058] DriverLoad : 0xb9c9da7e [Type: long (*)(_SDCONTEXT *,unsigned char)]
[+0x05c] FileObject : 0x8974cf90 [Type: _FILE_OBJECT *]
[+0x060] pUnloadWorkItem : 0x0 [Type: void *]
[+0x064] DeviceObject : 0x895e78c8 : Device for "\Driver\TDTCP" [Type: _DEVICE_OBJECT *]
1: kd> p
termdd!_IcaLoadSd+0x13b:
baa8da6d c9 leave
1: kd> p
termdd!_IcaLoadSd+0x13c:
baa8da6e c20800 ret 8
1: kd> p
termdd!_IcaPushStack+0x80:
baa8e7bc 8bf8 mov edi,eax
1: kd> p
termdd!_IcaPushStack+0x82:
baa8e7be 85ff test edi,edi
返回到：termdd!_IcaPushStack
第七部分：
1: kd> dv
pStack = 0x898b79e0
pStackPush = 0xba104738
pSdLink = 0x895db978
1: kd> dx -r1 ((termdd!_SDLINK *)0x895db978)
((termdd!_SDLINK *)0x895db978) : 0x895db978 [Type: _SDLINK *]
[+0x000] pStack : 0x0 [Type: _ICA_STACK *]
[+0x004] pSdLoad : 0x8948bcf8 [Type: _SDLOAD *]
[+0x008] Links [Type: _LIST_ENTRY]
[+0x010] RefCount : 1 [Type: long]
[+0x014] SdContext [Type: _SDCONTEXT]
[+0x020] Resource [Type: _ERESOURCE]
1: kd> dx -r1 (*((termdd!_SDCONTEXT *)0x895db98c))
(*((termdd!_SDCONTEXT *)0x895db98c)) [Type: _SDCONTEXT]
[+0x000] pProcedures : 0xb9ca6010 [Type: void *]
[+0x004] pCallup : 0x0 [Type: _SDCALLUP *]
[+0x008] pContext : 0x894e7388 [Type: void *]
[+0x000] pProcedures : 0xb9ca6010 函数指针数组
1: kd> x TDTCP!G_pTdProcedures
b9ca6010 TDTCP!G_pTdProcedures = <function> *[6]
1: kd> dx -r1 (*((TDTCP!long (*(*)[6])(void *,void *))0xb9ca6010))
(*((TDTCP!long (*(*)[6])(void *,void *))0xb9ca6010)) [Type: long (* [6])(void *,void *)]
[0] : 0xb9c9ca24 [Type: long (*)(void *,void *)]
[1] : 0xb9c9cca0 [Type: long (*)(void *,void *)]
[2] : 0xb9c9dcd6 [Type: long (*)(void *,void *)]
[3] : 0xb9c9cde2 [Type: long (*)(void *,void *)]
[4] : 0xb9c9ce16 [Type: long (*)(void *,void *)]
[5] : 0xb9c9cec2 [Type: long (*)(void *,void *)]
函数指针数组
第八部分：
/*
* Increment the stack ref count for this SD,
* and push the new SD on the stack.
*/
IcaReferenceStack( pStack );
InsertHeadList( &pStack->SdLinkHead, &pSdLink->Links );
pSdLink->pStack = pStack;
pStack结构和pSdLink结构相互连接在了一起。
1: kd> dv
pStack = 0x898b79e0
pStackPush = 0xba104738
pSdLink = 0x895db978
1: kd> dx -r1 ((termdd!_SDLINK *)0x895db978)
((termdd!_SDLINK *)0x895db978) : 0x895db978 [Type: _SDLINK *]
[+0x000] pStack : 0x898b79e0 [Type: _ICA_STACK *]
[+0x004] pSdLoad : 0x8948bcf8 [Type: _SDLOAD *]
[+0x008] Links [Type: _LIST_ENTRY]
[+0x010] RefCount : 1 [Type: long]
[+0x014] SdContext [Type: _SDCONTEXT]
[+0x020] Resource [Type: _ERESOURCE]
1: kd> dx -r1 ((termdd!_ICA_STACK *)0x898b79e0)
((termdd!_ICA_STACK *)0x898b79e0) : 0x898b79e0 [Type: _ICA_STACK *]
[+0x000] Header [Type: _ICA_HEADER]
[+0x008] RefCount : 3 [Type: long]
[+0x00c] Resource [Type: _ERESOURCE]
[+0x044] StackClass : Stack_Primary (0) [Type: _STACKCLASS]
[+0x048] StackEntry [Type: _LIST_ENTRY]
[+0x050] SdLinkHead [Type: _LIST_ENTRY]
1: kd> dx -r1 (*((termdd!_LIST_ENTRY *)0x898b7a30))
(*((termdd!_LIST_ENTRY *)0x898b7a30)) [Type: _LIST_ENTRY]
[+0x000] Flink : 0x895db980 [Type: _LIST_ENTRY *]
[+0x004] Blink : 0x895db980 [Type: _LIST_ENTRY *]
0x895db980=0x895db978+[+0x008]
/*
* Initialize the SD open parameters
*/
pSdOpen->StackClass = pStack->StackClass;
pSdOpen->pStatus = &pStack->ProtocolStatus;
pSdOpen->pClient = &pStack->ClientModules;
pSdOpen->WdConfig = pStackPush->WdConfig;
pSdOpen->PdConfig = pStackPush->PdConfig;
pSdOpen->OutBufHeader = pStack->SdOutBufHeader;
pSdOpen->OutBufTrailer = pStack->SdOutBufTrailer;
pSdOpen->DeviceObject = pSdLink->pSdLoad->DeviceObject;
1: kd> p
termdd!_IcaPushStack+0xfb:
baa8e837 897308 mov dword ptr [ebx+8],esi
1: kd> r
eax=898b7be8 ebx=897fdb80 ecx=898b7a30 edx=895db978 esi=898b7a88
1: kd> dt SD_OPEN 897fdb80
RDPWD!SD_OPEN
+0x000 StackClass : 0 ( Stack_Primary )
+0x004 pStatus : 0x898b7be8 _PROTOCOLSTATUS
+0x008 pClient : 0x898b7a88 _CLIENTMODULES
+0x00c WdConfig : _WDCONFIGW
+0x138 PdConfig : _PDCONFIGW
+0x418 OEMId : [4] "???"
+0x41c WinStationRegName : [33] 0xffff
+0x460 DeviceObject : 0x895e78c8 _DEVICE_OBJECT
+0x464 OutBufHeader : 0
+0x468 OutBufTrailer : 0
+0x46c SdOutBufHeader : 0xffffffff
+0x470 SdOutBufTrailer : 0xffffffff
第九部分：
/*
* Call the SD open procedure
*/
Status = _IcaCallSd( pSdLink, SD$OPEN, pSdOpen );
/*=============================================================================
== Stack Driver interface
=============================================================================*/
/*
* Stack Driver (WD/PD/TD) APIs
*/
#define SD$OPEN 0
#define SD$CLOSE 1
#define SD$RAWWRITE 2
#define SD$CHANNELWRITE 3
#define SD$SYNCWRITE 4
#define SD$IOCTL 5
#define SD$COUNT 6
NTSTATUS
_IcaCallSd(
IN PSDLINK pSdLink,
IN ULONG ProcIndex,
IN PVOID pParms
)
{
PSDPROCEDURE pSdProcedure;
NTSTATUS Status;
/*
* If there is no procedure call table, return success.
* This should only happen during load/unload and should not be a problem.
*/
if ( pSdLink->SdContext.pProcedures == NULL )
return( STATUS_SUCCESS );
/*
* Get a pointer to the SD proc based on specified ProcIndex.
* If NULL, then this ProcIndex is not supported by this driver.
*/
pSdProcedure = ((PSDPROCEDURE *)pSdLink->SdContext.pProcedures)[ ProcIndex ];
if ( pSdProcedure == NULL )
return( STATUS_NOT_SUPPORTED );
IcaReferenceSdLink( pSdLink );
Status = (pSdProcedure)( pSdLink->SdContext.pContext, pParms );
IcaDereferenceSdLink( pSdLink );
return( Status );
}
1: kd> p
termdd!_IcaPushStack+0x16d:
baa8e8a9 e816f9ffff call termdd!_IcaCallSd (baa8e1c4)
1: kd> t
termdd!_IcaCallSd:
baa8e1c4 55 push ebp
1: kd> kc 7
#
00 termdd!_IcaCallSd
01 termdd!_IcaPushStack
02 termdd!IcaDeviceControlStack
03 termdd!IcaDeviceControl
04 termdd!IcaDispatch
05 nt!IofCallDriver
06 nt!IopSynchronousServiceTail
1: kd> p
termdd!_IcaCallSd+0x2c:
baa8e1f0 ffd7 call edi
1: kd> dv
pSdLink = 0x895db978
ProcIndex = 0
pParms = 0x897fdb80
1: kd> r
eax=00000002 ebx=897fdb80 ecx=00000000 edx=895db978 esi=895db978 edi=b9c9ca24
eip=baa8e1f0 esp=ba10467c ebp=ba10468c iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000202
termdd!_IcaCallSd+0x2c:
baa8e1f0 ffd7 call edi {TDTCP!TdOpen (b9c9ca24)}
第十部分：
1: kd> t
TDTCP!TdOpen:
b9c9ca24 55 push ebp
1: kd> kc 9
#
00 TDTCP!TdOpen
01 termdd!_IcaCallSd
02 termdd!_IcaPushStack
03 termdd!IcaDeviceControlStack
04 termdd!IcaDeviceControl
05 termdd!IcaDispatch
06 nt!IofCallDriver
07 nt!IopSynchronousServiceTail
08 nt!IopXxxControlFile
1: kd> dv
pTd = 0x894e7388
pSdOpen = 0x897fdb80
SdClose = struct _SD_CLOSE
1: kd> dx -r1 ((TDTCP!_TD *)0x894e7388)
((TDTCP!_TD *)0x894e7388) : 0x894e7388 [Type: _TD *]
[+0x000] pContext : 0x895db98c [Type: _SDCONTEXT *]
[+0x004] PdFlag : 0x0 [Type: unsigned long]
[+0x008] SdClass : SdNone (0) [Type: _SDCLASS]
[+0x00c] Params [Type: _PDPARAMSW]
[+0x244] pClient : 0x0 [Type: _CLIENTMODULES *]
[+0x248] pStatus : 0x0 [Type: _PROTOCOLSTATUS *]
[+0x24c] pFileObject : 0x0 [Type: _FILE_OBJECT *]
[+0x250] pDeviceObject : 0x0 [Type: _DEVICE_OBJECT *]
[+0x254] LastError : 0x0 [Type: unsigned long]
[+0x258] ReadErrorCount : 0x0 [Type: unsigned long]
[+0x25c] ReadErrorThreshold : 0x0 [Type: unsigned long]
[+0x260] WriteErrorCount : 0x0 [Type: unsigned long]
[+0x264] WriteErrorThreshold : 0x0 [Type: unsigned long]
[+0x268] ZeroByteReadCount : 0x0 [Type: unsigned long]
[+0x26c] PortNumber : 0x0 [Type: unsigned long]
[+0x270] OutBufHeader : 0x0 [Type: unsigned long]
[+0x274] OutBufTrailer : 0x0 [Type: unsigned long]
[+0x278] OutBufLength : 0x0 [Type: unsigned long]
[+0x27c] IoBusyOutBuf [Type: _LIST_ENTRY]
[+0x284] SyncWriteEvent [Type: _KEVENT]
[+0x294] pInputThread : 0x0 [Type: _KTHREAD *]
[+0x298] InBufCount : 0 [Type: long]
[+0x29c] InBufListLock : 0x0 [Type: unsigned long]
[+0x2a0] InBufBusyHead [Type: _LIST_ENTRY]
[+0x2a8] InBufDoneHead [Type: _LIST_ENTRY]
[+0x2b0] InBufHeader : 0x0 [Type: unsigned long]
[+0x2b4] InputEvent [Type: _KEVENT]
[+0x2c4 ( 0: 0)] fClosing : 0x0 [Type: unsigned long]
[+0x2c4 ( 1: 1)] fCallbackInProgress : 0x0 [Type: unsigned long]
[+0x2c4 ( 2: 2)] fSyncWriteWaiter : 0x0 [Type: unsigned long]
[+0x2c8] pPrivate : 0x0 [Type: void *]
[+0x2cc] pAfd : 0x0 [Type: void *]
[+0x2d0] WorkItemHead [Type: _LIST_ENTRY]
[+0x2d8] pSelfDeviceObject : 0x0 [Type: _DEVICE_OBJECT *]
[+0x2dc] UserBrokenReason : 0x0 [Type: unsigned long]
1: kd> dx -r1 ((TDTCP!_SD_OPEN *)0x897fdb80)
((TDTCP!_SD_OPEN *)0x897fdb80) : 0x897fdb80 [Type: _SD_OPEN *]
[+0x000] StackClass : Stack_Primary (0) [Type: _STACKCLASS]
[+0x004] pStatus : 0x898b7be8 [Type: _PROTOCOLSTATUS *]
[+0x008] pClient : 0x898b7a88 [Type: _CLIENTMODULES *]
[+0x00c] WdConfig [Type: _WDCONFIGW]
[+0x138] PdConfig [Type: _PDCONFIGW]
[+0x418] OEMId : "" [Type: char [4]]
[+0x41c] WinStationRegName [Type: unsigned short [33]]
[+0x460] DeviceObject : 0x895e78c8 : Device for "\Driver\TDTCP" [Type: _DEVICE_OBJECT *]
[+0x464] OutBufHeader : 0x0 [Type: unsigned long]
[+0x468] OutBufTrailer : 0x0 [Type: unsigned long]
[+0x46c] SdOutBufHeader : 0xffffffff [Type: unsigned long]
[+0x470] SdOutBufTrailer : 0xffffffff [Type: unsigned long]
pTd->pClient = pSdOpen->pClient;
pTd->pStatus = pSdOpen->pStatus;
pTd->PdFlag = pSdOpen->PdConfig.Create.PdFlag;
pTd->OutBufLength = pSdOpen->PdConfig.Create.OutBufLength;
pTd->PortNumber = pSdOpen->PdConfig.Create.PortNumber;
pTd->Params = pSdOpen->PdConfig.Params;
pTd->UserBrokenReason = TD_USER_BROKENREASON_UNEXPECTED;
1: kd> dv
pTd = 0x894e7388
pSdOpen = 0x897fdb80
SdClose = struct _SD_CLOSE
1: kd> dx -r1 ((TDTCP!_SD_OPEN *)0x897fdb80)
((TDTCP!_SD_OPEN *)0x897fdb80) : 0x897fdb80 [Type: _SD_OPEN *]
[+0x000] StackClass : Stack_Primary (0) [Type: _STACKCLASS]
[+0x004] pStatus : 0x898b7be8 [Type: _PROTOCOLSTATUS *]
[+0x008] pClient : 0x898b7a88 [Type: _CLIENTMODULES *]
[+0x00c] WdConfig [Type: _WDCONFIGW]
[+0x138] PdConfig [Type: _PDCONFIGW]
[+0x418] OEMId : "" [Type: char [4]]
[+0x41c] WinStationRegName [Type: unsigned short [33]]
[+0x460] DeviceObject : 0x895e78c8 : Device for "\Driver\TDTCP" [Type: _DEVICE_OBJECT *]
[+0x464] OutBufHeader : 0x0 [Type: unsigned long]
[+0x468] OutBufTrailer : 0x0 [Type: unsigned long]
[+0x46c] SdOutBufHeader : 0xffffffff [Type: unsigned long]
[+0x470] SdOutBufTrailer : 0xffffffff [Type: unsigned long]
1: kd> dx -r1 (*((TDTCP!_PDCONFIGW *)0x897fdcb8))
(*((TDTCP!_PDCONFIGW *)0x897fdcb8)) [Type: _PDCONFIGW]
[+0x000] Create [Type: _PDCONFIG2W]
[+0x0a8] Params [Type: _PDPARAMSW]
1: kd> dx -r1 (*((TDTCP!_PDCONFIG2W *)0x897fdcb8))
(*((TDTCP!_PDCONFIG2W *)0x897fdcb8)) [Type: _PDCONFIG2W]
[+0x000] PdName [Type: unsigned short [33]]
[+0x044] SdClass : SdNetwork (2) [Type: _SDCLASS]
[+0x048] PdDLL [Type: unsigned short [33]]
[+0x08c] PdFlag : 0x4e [Type: unsigned long]
[+0x090] OutBufLength : 0x212 [Type: unsigned long]
[+0x094] OutBufCount : 0x6 [Type: unsigned long]
[+0x098] OutBufDelay : 0x64 [Type: unsigned long]
[+0x09c] InteractiveDelay : 0x32 [Type: unsigned long]
[+0x0a0] PortNumber : 0xd3d [Type: unsigned long] 端口号为：3389！！！
[+0x0a4] KeepAliveTimeout : 0x0 [Type: unsigned long]
1: kd> dx -r1 (*((TDTCP!unsigned short (*)[33])0x897fdcb8))
(*((TDTCP!unsigned short (*)[33])0x897fdcb8)) [Type: unsigned short [33]]
[0] : 0x74 [Type: unsigned short]
[1] : 0x63 [Type: unsigned short]
[2] : 0x70 [Type: unsigned short]
[3] : 0x0 [Type: unsigned short]
1: kd> db 0x897fdcb8
897fdcb8 74 00 63 00 70 00 00 00-00 00 00 00 00 00 00 00 t.c.p...........
第十一部分：
1: kd> p
TDTCP!TdOpen+0x97:
b9c9cabb e8e62d0000 call TDTCP!DeviceOpen (b9c9f8a6)
1: kd> t
TDTCP!DeviceOpen:
b9c9f8a6 55 push ebp
1: kd> kc 11
#
00 TDTCP!DeviceOpen
01 TDTCP!TdOpen
02 termdd!_IcaCallSd
03 termdd!_IcaPushStack
04 termdd!IcaDeviceControlStack
05 termdd!IcaDeviceControl
06 termdd!IcaDispatch
07 nt!IofCallDriver
08 nt!IopSynchronousServiceTail
09 nt!IopXxxControlFile
0a nt!NtDeviceIoControlFile
0b nt!_KiSystemService
0c SharedUserData!SystemCallStub
0d ntdll!NtDeviceIoControlFile
0e icaapi!IcaIoControl
0f icaapi!_IcaStackIoControlWorker
10 icaapi!IcaStackIoControl
TDI（传输驱动接口）是Windows系统中用于网络通信的关键技术，其核心功能是提供网络协议的传输层支持。
在网络编程中，TCP/IP协议栈的初始化、连接建立和数据传输均依赖TDI的实现。
1: kd> p
TDTCP!TdOpen+0x105:
b9c9cb29 5b pop ebx
1: kd> p
TDTCP!TdOpen+0x106:
b9c9cb2a c9 leave
1: kd> p
TDTCP!TdOpen+0x107:
b9c9cb2b c20800 ret 8
1: kd> p
termdd!_IcaCallSd+0x2e:
baa8e1f2 56 push esi
1: kd> p
termdd!_IcaCallSd+0x2f:
baa8e1f3 8bf8 mov edi,eax
1: kd> p
termdd!_IcaCallSd+0x31:
baa8e1f5 e8b0faffff call termdd!IcaDereferenceSdLink (baa8dcaa)
1: kd> p
termdd!_IcaCallSd+0x36:
baa8e1fa 8bc7 mov eax,edi
1: kd> p
termdd!_IcaCallSd+0x38:
baa8e1fc 5f pop edi
1: kd> p
termdd!_IcaCallSd+0x39:
baa8e1fd 5e pop esi
1: kd> p
termdd!_IcaCallSd+0x3a:
baa8e1fe 5d pop ebp
1: kd> p
termdd!_IcaCallSd+0x3b:
baa8e1ff c20c00 ret 0Ch
1: kd> p
termdd!_IcaPushStack+0x172:
baa8e8ae 8bf8 mov edi,eax
1: kd> p
termdd!_IcaPushStack+0x174:
baa8e8b0 3bfe cmp edi,esi
1: kd> p
termdd!_IcaPushStack+0x176:
baa8e8b2 7d20 jge termdd!_IcaPushStack+0x198 (baa8e8d4)
1: kd> p
termdd!_IcaPushStack+0x198:
baa8e8d4 8b8b6c040000 mov ecx,dword ptr [ebx+46Ch]
1: kd> p
termdd!_IcaPushStack+0x19e:
baa8e8da 8b4508 mov eax,dword ptr [ebp+8]
1: kd> p
termdd!_IcaPushStack+0x1a1:
baa8e8dd 0188a0000000 add dword ptr [eax+0A0h],ecx
1: kd> p
termdd!_IcaPushStack+0x1a7:
baa8e8e3 8b8b70040000 mov ecx,dword ptr [ebx+470h]
1: kd> p
termdd!_IcaPushStack+0x1ad:
baa8e8e9 0188a4000000 add dword ptr [eax+0A4h],ecx
1: kd> p
termdd!_IcaPushStack+0x1b3:
baa8e8ef 8b7508 mov esi,dword ptr [ebp+8]
1: kd> p
termdd!_IcaPushStack+0x1b6:
baa8e8f2 85db test ebx,ebx
1: kd> p
termdd!_IcaPushStack+0x1b8:
baa8e8f4 7406 je termdd!_IcaPushStack+0x1c0 (baa8e8fc)
1: kd> p
termdd!_IcaPushStack+0x1ba:
baa8e8f6 53 push ebx
1: kd> p
termdd!_IcaPushStack+0x1bb:
baa8e8f7 e8bec9ffff call termdd!IcaFreePool (baa8b2ba)
1: kd> p
termdd!_IcaPushStack+0x1c0:
baa8e8fc 56 push esi
1: kd> p
termdd!_IcaPushStack+0x1c1:
baa8e8fd e8ccc5ffff call termdd!IcaUnlockStack (baa8aece)
1: kd> p
termdd!_IcaPushStack+0x1c6:
baa8e902 8bc7 mov eax,edi
1: kd> p
termdd!_IcaPushStack+0x1c8:
baa8e904 5f pop edi
1: kd> p
termdd!_IcaPushStack+0x1c9:
baa8e905 5e pop esi
1: kd> p
termdd!_IcaPushStack+0x1ca:
baa8e906 5b pop ebx
1: kd> p
termdd!_IcaPushStack+0x1cb:
baa8e907 c9 leave
1: kd> p
termdd!_IcaPushStack+0x1cc:
baa8e908 c20800 ret 8
1: kd> p
termdd!IcaDeviceControlStack+0x24f:
baa8f087 8b7508 mov esi,dword ptr [ebp+8]
memcpy(&StackPush, IrpSp->Parameters.DeviceIoControl.Type3InputBuffer,
sizeof(ICA_STACK_PUSH));
Status = _IcaPushStack( pStack, &StackPush );
break;
}