[toc] 进程&线程 滴水中级上 001.进程结构体 每个windows进程在0环都有一个对应的结构体：EPROCESS ，这个结构体包含了进程所有重要的信息。 EPROCESS kd> dt _EPROCESS ntdll!_EPROCESS +0x000 Pcb : _KPROCESS +0x06c ProcessLock : _EX_PUSH_LOCK +0x070 CreateTime : _LARGE_INTEGER//进程的创建时间 +0x078 ExitTime : _L

[toc] 001.驱动开发环境配置 vs2010:https://learn.microsoft.com/zh-cn/visualstudio/releasenotes/vs2010-sp1-vs wdk7600:https://www.microsoft.com/en-us/download/details.aspx?id=11800 添加项目属性表： <?xml version="1.0" encoding="utf-8"?> <Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> <ImportGroup Label="PropertySheets" /> <PropertyGroup Label="UserMacros" /> <PropertyGroup> <ExecutablePath>D:\WinDDK\7600.16385.1\bin\x86;$(ExecutablePath)</ExecutablePath> </PropertyGroup> <PropertyGroup> <IncludePath>D:\WinDDK\7600.16385.1\inc\api;D:\WinDDK\7600.16385.1\inc\ddk;D:\WinDDK\7600.16385.1\inc\crt;$(IncludePath)</IncludePath> </PropertyGroup> <PropertyGroup> <LibraryPath>D:\WinDDK\7600.16385.1\lib\wxp\i386;$(LibraryPath)</LibraryPath> <TargetExt>.sys</TargetExt> <LinkIncremental>false</LinkIncremental> <GenerateManifest>false</GenerateManifest> </PropertyGroup> <ItemDefinitionGroup> <ClCompile> <PreprocessorDefinitions>_X86_;DBG</PreprocessorDefinitions> <CallingConvention>StdCall</CallingConvention> <ExceptionHandling>false</ExceptionHandling> <BasicRuntimeChecks>Default</BasicRuntimeChecks> <BufferSecurityCheck>false</BufferSecurityCheck> <CompileAs>Default</CompileAs> <DebugInformationFormat>ProgramDatabase</DebugInformationFormat> <AssemblerOutput>All</AssemblerOutput> </ClCompile> <Link> <AdditionalDependencies>ntoskrnl.lib;wdm.lib;wdmsec.lib;wmilib.lib;ndis.lib;Hal.lib;MSVCRT.LIB;LIBCMT.LIB;%(AdditionalDependencies)</AdditionalDependencies> </Link> <Link> <IgnoreAllDefaultLibraries>true</IgnoreAllDefaultLibraries> <EnableUAC>false</EnableUAC> <SubSystem>Native</SubSystem> <EntryPointSymbol>DriverEntry</EntryPointSymbol> <BaseAddress>0x10000</BaseAddress> <RandomizedBaseAddress> </RandomizedBaseAddress> <DataExecutionPrevention> </DataExecutionPrevention> <GenerateDebugInformation>true</GenerateDebugInformation> <Driver>Driver</Driver> </Link> </ItemDefinitionGroup> <ItemGroup /> </Project>002.第一个驱动程序 驱动开发流程： 代码 => 生成sys文

[toc] 本文是windows内核系列的第三部分，本来应该是放到第二部分后面的，但是第二部分会用到这部分的相关内容 ，就先放第三部分了。 001.API函数的调用过程(3环部分) 主要是存放在 C:\WINDOWS\system32 下面所有的dll 几个重要的DLL Kernel32.dll:最