📄 00000000.htm
字号:
0014:00000000 28 00 <-- LDT 所指的Selector为0028 <BR>根据 GDT 的资料查表得到下表 ,但是由於 0028 这段落禁止观看 ,所以我改看0030 <BR>的段落 ,因为它的 Base 是一样的。 <BR> <BR>#0028 Base=00C12000 Limit=00000000 Flags=82 Page granularity <BR>#0030 Base=00C12000 Limit=00000000 Flags=93 USE32 Page granularity <BR> <BR>-D 30:0 <BR>0030:00000000 FF 00 F0 CE 09 92 40 00-31 00 00 00 CA 9B C0 00 <A HREF="mailto:..pN..@.1...J.@.">..pN..@.1...J.@.</A> <BR>0030:00000010 31 00 00 00 CA 93 C0 00-FF FF 00 80 0B 92 40 00 <A HREF="mailto:1...J.@.......@.">1...J.@.......@.</A> <BR>0030:00000020 FF 00 F0 CE 09 92 40 00-4D 00 90 CE 09 92 40 00 <A HREF="mailto:..pN..@.M..N..@.">..pN..@.M..N..@.</A> <BR>0030:00000030 44 01 00 00 00 93 C0 00-00 00 00 00 00 92 40 00 <A HREF="mailto:D.....@.......@.">D.....@.......@.</A> <BR>0030:00000040 FF FF 00 80 0B 92 40 00-00 00 00 00 00 92 40 00 <A HREF="mailto:......@.......@.">......@.......@.</A> <BR>0030:00000050 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ <BR>0030:00000060 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ <BR>0030:00000070 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ <BR> <BR>-DL 0 <BR>#0004 Base=0009CEF0 Limit=000000FF Flags=92 USE32 Byte granularity <BR>#000C Base=00CA0000 Limit=00000031 Flags=9B USE32 Page granularity <BR>#0014 Base=00CA0000 Limit=00000031 Flags=93 USE32 Page granularity <BR>#001C Base=000B8000 Limit=0000FFFF Flags=92 USE32 Byte granularity <BR>#0024 Base=0009CEF0 Limit=000000FF Flags=92 USE32 Byte granularity <BR>#002C Base=0009CE90 Limit=0000004D Flags=92 USE32 Byte granularity <BR>#0034 Base=00000000 Limit=00000144 Flags=93 USE32 Page granularity <BR>#003C Base=00000000 Limit=00000000 Flags=92 USE32 Byte granularity <BR>#0044 Base=000B8000 Limit=0000FFFF Flags=92 USE32 Byte granularity <BR>#004C Base=00000000 Limit=00000000 Flags=92 USE32 Byte granularity <BR>#0054 Segment not present. <BR>#005C Segment not present. <BR>#0064 Segment not present. <BR>#006C Segment not present. <BR>#0074 Segment not present. <BR>#007C Segment not present. <BR> <BR>-------------------------------------------------------------------------- <BR>【 IDT 介绍 】 <BR> 在以往中断向量表都是用 4 byte 来表示 ,但是在保护模式下则由 8 byte 表 <BR>示 ,至於那几个 byte 表示什麽 ,笔者还未搞懂 ,底下只弄懂几个。 <BR> <BR> <BR>C:\>386debug 386debug.exp (改过的.exp档) <BR>000C:00027434 660F010F SIDT [EDI] <BR>-D EDI <BR>0014:00000000 FF 07 6C F5 01 00 .. ..-.. .. .. .. .. .. .. .. <BR> ^^^^^^^^^^^线性记忆体位址 <BR> ^^^^^长+1 <BR>因为该线性记忆体已对映到 50:0 <BR>#0050 Base=0001F56C Limit=000007FF Flags=92 USE32 Byte granularity <BR>所以: <BR>0050:00000000 00 34 08 00 00 EE 00 00-0A 34 08 00 00 EE 00 00 .4...n...4...n.. <BR>0050:00000010 14 34 08 00 00 EE 00 00-1E 34 08 00 00 EE 00 00 .4...n...4...n.. <BR>0050:00000020 28 34 08 00 00 EE 00 00-32 34 08 00 00 EE 00 00 (4...n..24...n.. <BR>0050:00000030 3C 34 08 00 00 EE 00 00-6C 16 C8 0F 00 8E 00 00 <4...n..F4...n.. <BR>0050:00000040 50 34 08 00 00 EE 00 00-5A 34 08 00 00 EE 00 00 P4...n..Z4...n.. <BR>0050:00000050 64 34 08 00 00 EE 00 00-6E 34 08 00 00 EE 00 00 d4...n..n4...n.. <BR>0050:00000060 78 34 08 00 00 EE 00 00-82 34 08 00 00 EE 00 00 x4...n...4...n.. <BR>0050:00000070 8C 34 08 00 00 EE 00 00-96 34 08 00 00 EE 00 00 .4...n...4...n.. <BR> <BR>-DI 0 <BR>#0000 Selector=0008 Offset=00003400 Flags=EE ;int_0 <BR>#0001 Selector=0008 Offset=0000340A Flags=EE ;int_1 <BR>#0002 Selector=0008 Offset=00003414 Flags=EE ;int_2 <BR>#0003 Selector=0008 Offset=0000341E Flags=EE ;int_3 <BR>#0004 Selector=0008 Offset=00003428 Flags=EE <BR>#0005 Selector=0008 Offset=00003432 Flags=EE <BR>#0006 Selector=0008 Offset=0000343C Flags=EE <BR>#0007 Selector=0FC8 Offset=0000166C Flags=8E ;此处为Q387使用 <BR>#0008 Selector=0008 Offset=00003450 Flags=EE <BR>#0009 Selector=0008 Offset=0000345A Flags=EE <BR>#000A Selector=0008 Offset=00003464 Flags=EE <BR>#000B Selector=0008 Offset=0000346E Flags=EE <BR>#000C Selector=0008 Offset=00003478 Flags=EE <BR>#000D Selector=0008 Offset=00003482 Flags=EE <BR>#000E Selector=0008 Offset=0000348C Flags=EE <BR>#000F Selector=0008 Offset=00003496 Flags=EE <BR> <BR>请仔细看一看这个表的对应情形 ,笔者故意载入Q387 以便让 INT_7 的 Selector 与 <BR>众不同 ,让您更易判断中断表对应关系。 <BR>-------------------------------------------------------------------------- <BR>实例解说: <BR>底下是读取 SoftICE INT_0 的程式码□例: <BR> <BR>Load IDT <BR>LDT = FF 07 12 C0 80 00 所以观看 0080C012 的记忆体 <BR> 0080C012 47 2C 18 00 00 EE 00 00-4C 2C 18 00 00 EE 00 00 G,...□.L,...□. <BR> 0080C022 51 2C 18 00 00 EE 00 00-56 2C 18 00 00 EE 00 00 Q,...□.V,...□. <BR> 0080C032 5B 2C 18 00 00 EE 00 00-60 2C 18 00 00 EE 00 00 [,...□.`,...□. <BR> 0080C042 65 2C 18 00 00 EE 00 00-6A 2C 18 00 00 EE 00 00 e,...□.j,...□. <BR> 0080C052 6F 2C 18 00 00 EE 00 00-74 2C 18 00 00 EE 00 00 o,...□.t,...□. <BR> 0080C062 79 2C 18 00 00 EE 00 00-7E 2C 18 00 00 EE 00 00 y,...□.~,...□. <BR>由此得知 INT_0 是放在 0018:00002C47 的位址 ,於是查GDT表.. <BR> <BR> <BR>Load GDT <BR>GDT = C8 00 18 C8 80 00 所以观看 0080C818 的记忆体 <BR> 0080C818 00 00 00 00 00 00 00 00-FF FF 10 11 83 93 00 00 ............儞.. <BR> 0080C828 FF FF 00 6E 81 93 00 00-FF FF 00 6E 81 9B 00 00 ...n亾.....n仜.. <BR> 0080C838 FF FF 00 00 00 93 CF 00-FF 7F 00 00 0B 92 00 00 .....摗
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -