regsample.map

本程序是一个关于内存操作的驱动程序。希望对大家有所帮助。

 RegSample

 Timestamp is 41a0b1f6 (Sun Nov 21 23:19:18 2004)

 Preferred load address is 00010000

 Start         Length     Name                   Class
 0001:00000000 000000fcH .idata$5                CODE
 0001:00000100 00000584H .rdata                  CODE
 0001:00000684 00000052H .rdata$debug            CODE
 0001:000006e0 0000a27eH .text                   CODE
 0001:0000a960 00000035H .text$yc                CODE
 0001:0000a9a0 0000000fH .text$yd                CODE
 0002:00000000 00000090H .data                   DATA
 0002:00000090 0000047dH .bss                    DATA
 0003:00000000 00000004H .CRT$XCA                DATA
 0003:00000004 00000004H .CRT$XCU                DATA
 0003:00000008 00000004H .CRT$XCZ                DATA
 0004:00000000 00000004H .STL$A                  DATA
 0004:00000004 00000004H .STL$L                  DATA
 0004:00000008 00000004H .STL$M                  DATA
 0004:0000000c 00000004H .STL$Z                  DATA
 0005:00000000 00001fb1H PAGE                    CODE
 0006:00000000 0000089cH INIT                    CODE
 0006:0000089c 00000028H .idata$2                CODE
 0006:000008c4 00000014H .idata$3                CODE
 0006:000008d8 000000fcH .idata$4                CODE
 0006:000009d4 000004faH .idata$6                CODE
 0007:00000000 00000058H .rsrc$01                DATA
 0007:00000060 00000330H .rsrc$02                DATA

  Address         Publics by Value              Rva+Base     Lib:Object

 0001:00000000       __imp_@KfAcquireSpinLock@4 00010320     wdm:HAL.DLL
 0001:00000004       __imp_@KfReleaseSpinLock@8 00010324     wdm:HAL.DLL
 0001:00000008       __imp__KeGetCurrentIrql@0  00010328     wdm:HAL.DLL
 0001:0000000c       \177HAL_NULL_THUNK_DATA    0001032c     wdm:HAL.DLL
 0001:00000010       __imp__RtlAssert@16        00010330     wdm:NTOSKRNL.EXE
 0001:00000014       __imp__wcscpy              00010334     wdm:NTOSKRNL.EXE
 0001:00000018       __imp__PoStartNextPowerIrp@4 00010338     wdm:NTOSKRNL.EXE
 0001:0000001c       __imp__IoFreeMdl@4         0001033c     wdm:NTOSKRNL.EXE
 0001:00000020       __imp__MmMapLockedPages@8  00010340     wdm:NTOSKRNL.EXE
 0001:00000024       __imp_@IofCompleteRequest@8 00010344     wdm:NTOSKRNL.EXE
 0001:00000028       __imp_@ObfDereferenceObject@4 00010348     wdm:NTOSKRNL.EXE
 0001:0000002c       __imp__PoCallDriver@8      0001034c     wdm:NTOSKRNL.EXE
 0001:00000030       __imp_@IofCallDriver@8     00010350     wdm:NTOSKRNL.EXE
 0001:00000034       __imp__RtlInitAnsiString@8 00010354     wdm:NTOSKRNL.EXE
 0001:00000038       __imp__DbgBreakPoint@0     00010358     wdm:NTOSKRNL.EXE
 0001:0000003c       __imp__memmove             0001035c     wdm:NTOSKRNL.EXE
 0001:00000040       __imp__strchr              00010360     wdm:NTOSKRNL.EXE
 0001:00000044       __imp___vsnprintf          00010364     wdm:NTOSKRNL.EXE
 0001:00000048       __imp__DbgPrint            00010368     wdm:NTOSKRNL.EXE
 0001:0000004c       __imp_@InterlockedIncrement@4 0001036c     wdm:NTOSKRNL.EXE
 0001:00000050       __imp_@InterlockedDecrement@4 00010370     wdm:NTOSKRNL.EXE
 0001:00000054       __imp__ZwClose@4           00010374     wdm:NTOSKRNL.EXE
 0001:00000058       __imp__RtlAppendUnicodeToString@8 00010378     wdm:NTOSKRNL.EXE
 0001:0000005c       __imp__RtlAppendUnicodeStringToString@8 0001037c     wdm:NTOSKRNL.EXE
 0001:00000060       __imp__IoGetDeviceProperty@20 00010380     wdm:NTOSKRNL.EXE
 0001:00000064       __imp__ZwOpenKey@12        00010384     wdm:NTOSKRNL.EXE
 0001:00000068       __imp__ZwCreateKey@28      00010388     wdm:NTOSKRNL.EXE
 0001:0000006c       __imp__ExFreePool@4        0001038c     wdm:NTOSKRNL.EXE
 0001:00000070       __imp__ZwQueryValueKey@24  00010390     wdm:NTOSKRNL.EXE
 0001:00000074       __imp__IoDeleteDevice@4    00010394     wdm:NTOSKRNL.EXE
 0001:00000078       __imp__IoDeleteSymbolicLink@4 00010398     wdm:NTOSKRNL.EXE
 0001:0000007c       __imp__IoCreateSymbolicLink@8 0001039c     wdm:NTOSKRNL.EXE
 0001:00000080       __imp__IoCreateDevice@28   000103a0     wdm:NTOSKRNL.EXE
 0001:00000084       __imp__IoAttachDeviceToDeviceStack@8 000103a4     wdm:NTOSKRNL.EXE
 0001:00000088       __imp__RtlIntegerToUnicodeString@12 000103a8     wdm:NTOSKRNL.EXE
 0001:0000008c       __imp__IoAllocateIrp@8     000103ac     wdm:NTOSKRNL.EXE
 0001:00000090       __imp__IoFreeIrp@4         000103b0     wdm:NTOSKRNL.EXE
 0001:00000094       __imp_@InterlockedExchange@8 000103b4     wdm:NTOSKRNL.EXE
 0001:00000098       __imp__RtlFreeUnicodeString@4 000103b8     wdm:NTOSKRNL.EXE
 0001:0000009c       __imp__KeWaitForSingleObject@20 000103bc     wdm:NTOSKRNL.EXE
 0001:000000a0       __imp__KeReleaseMutex@8    000103c0     wdm:NTOSKRNL.EXE
 0001:000000a4       __imp__IoDetachDevice@4    000103c4     wdm:NTOSKRNL.EXE
 0001:000000a8       __imp__IoAcquireCancelSpinLock@4 000103c8     wdm:NTOSKRNL.EXE
 0001:000000ac       __imp__IoReleaseCancelSpinLock@4 000103cc     wdm:NTOSKRNL.EXE
 0001:000000b0       __imp__KeClearEvent@4      000103d0     wdm:NTOSKRNL.EXE
 0001:000000b4       __imp__KeSetEvent@12       000103d4     wdm:NTOSKRNL.EXE
 0001:000000b8       __imp__PoRequestPowerIrp@24 000103d8     wdm:NTOSKRNL.EXE
 0001:000000bc       __imp__PoSetPowerState@12  000103dc     wdm:NTOSKRNL.EXE
 0001:000000c0       __imp__IoCancelIrp@4       000103e0     wdm:NTOSKRNL.EXE
 0001:000000c4       __imp__IoRegisterDeviceInterface@16 000103e4     wdm:NTOSKRNL.EXE
 0001:000000c8       __imp__IoSetDeviceInterfaceState@8 000103e8     wdm:NTOSKRNL.EXE
 0001:000000cc       __imp__KeInitializeSpinLock@4 000103ec     wdm:NTOSKRNL.EXE
 0001:000000d0       __imp__ExAllocatePoolWithTag@12 000103f0     wdm:NTOSKRNL.EXE
 0001:000000d4       __imp__RtlCopyUnicodeString@8 000103f4     wdm:NTOSKRNL.EXE
 0001:000000d8       __imp__IoGetDeviceObjectPointer@16 000103f8     wdm:NTOSKRNL.EXE
 0001:000000dc       __imp__IoBuildDeviceIoControlRequest@36 000103fc     wdm:NTOSKRNL.EXE
 0001:000000e0       __imp__KeInitializeEvent@12 00010400     wdm:NTOSKRNL.EXE
 0001:000000e4       __imp__KeInitializeMutex@8 00010404     wdm:NTOSKRNL.EXE
 0001:000000e8       __imp__KeRemoveEntryDeviceQueue@8 00010408     wdm:NTOSKRNL.EXE
 0001:000000ec       __imp_@KefAcquireSpinLockAtDpcLevel@4 0001040c     wdm:NTOSKRNL.EXE
 0001:000000f0       __imp_@KefReleaseSpinLockFromDpcLevel@4 00010410     wdm:NTOSKRNL.EXE
 0001:000000f4       __imp__RtlInitUnicodeString@8 00010414     wdm:NTOSKRNL.EXE
 0001:000000f8       \177NTOSKRNL_NULL_THUNK_DATA 00010418     wdm:NTOSKRNL.EXE
 0001:0000011c       ??_C@_0DF@OJJCGMGD@DriverWorks?5?$CIc?$CJ?5Copyright?52003?5C@ 0001043c     RegSample.obj
 0001:00000154       ??_7RegSample@@6B@         00010474     RegSample.obj
 0001:00000168       ??_7KDriver@@6B@           00010488     RegSample.obj
 0001:0000017c       ??_C@_0BL@NNGFNHOB@m_Irp?9?$DOCurrentLocation?5?$DO?51?$AA@ 0001049c     RegSample.obj
 0001:00000198       ??_C@_0CM@FADDDCMO@m_Irp?9?$DOCurrentLocation?5?$DM?$DN?5m_Irp?9@ 000104b8     RegSample.obj
 0001:000001c4       ??_C@_0DO@EFKCJHCD@C?3?2PROGRA?$HO1?2Compuware?2DriverStud@ 000104e4     RegSample.obj
 0001:00000204       ??_C@_02DKCKIIND@?$CFs?$AA@ 00010524     RegSample.obj
 0001:00000208       ??_C@_02GMHACPFF@?$CFu?$AA@ 00010528     RegSample.obj
 0001:0000020c       ??_C@_07KFGDNAFA@0x?$CF08lx?$AA@ 0001052c     RegSample.obj
 0001:00000214       ??_C@_02KPKOKMHB@?$CFS?$AA@ 00010534     RegSample.obj
 0001:00000218       ??_C@_04MGOIBCNE@?$CF?9?$CKS?$AA@ 00010538     RegSample.obj
 0001:00000220       ??_7RegSampleDevice@@6B@   00010540     RegSampleDevice.obj
 0001:0000034c       ??_C@_05MAJJAKPI@FALSE?$AA@ 0001066c     RegSampleDevice.obj
 0001:00000358       ??_C@_0EB@COLAEKAL@C?3?2PROGRA?$HO1?2Compuware?2DriverStud@ 00010678     RegSampleDevice.obj
 0001:0000039c       ??_C@_0CG@IJCOJOJN@I?4MajorFunction?$CINEXT?$CJ?5?$DN?$DN?5IRP_MJ_@ 000106bc     RegSampleDevice.obj
 0001:000003c8       ??_C@_0EB@JAFEGOBF@C?3?2PROGRA?$HO1?2Compuware?2DriverStud@ 000106e8     RegSampleDevice.obj
 0001:0000040c       ??_C@_0BE@HGMFHLDM@?4?2?4?4?2include?2kirp?4h?$AA@ 0001072c     vdw_wdm:ktrace.obj
 0001:00000420       ??_7KDevice@@6B@           00010740     vdw_wdm:kdevice.obj
 0001:000004a8       ??_7KDeviceBase@@6B@       000107c8     vdw_wdm:kdevice.obj
 0001:000004b0       ??_C@_0BH@BINHOGGO@?4?2?4?4?2include?2kdevice?4h?$AA@ 000107d0     vdw_wdm:kdevice.obj
 0001:000004c8       ??_7KPnpDevice@@6B@        000107e8     vdw_wdm:kpnpdev.obj
 0001:000005f4       ??_C@_0O@KBDMFNDM@m_pdq?5?$CB?$DN?5NULL?$AA@ 00010914     vdw_wdm:kpnpdev.obj
 0001:00000604       ??_C@_0BH@BIPCAELK@?4?2?4?4?2include?2kdevque?4h?$AA@ 00010924     vdw_wdm:kpnpdev.obj
 0001:0000061c       ??_C@_0DN@BBDLMDMH@?$CIOnSuccess?$CJ?5?$HM?5?$CIOnError?$CJ?5?$HM?5?$CIOnCan@ 0001093c     vdw_wdm:kpnpdev.obj
 0001:0000065c       ??_C@_0BH@LIGMDPNJ@?4?2?4?4?2include?2kpnplow?4h?$AA@ 0001097c     vdw_wdm:kpnpdev.obj
 0001:00000674       ??_7?$KList@UINTERFACE_LIST_ENTRY@@@@6B@ 00010994     vdw_wdm:kpnpdev.obj
 0001:00000700       ?AddDevice@RegSample@@UAEJPAU_DEVICE_OBJECT@@@Z 00010a20 f   RegSample.obj
 0001:000007e0       ??2@YAPAXI@Z               00010b00 f i RegSample.obj
 0001:00000810       ??2@YAPAXIW4_POOL_TYPE@@@Z 00010b30 f i RegSample.obj
 0001:00000850       ??3@YAXPAX@Z               00010b70 f i RegSample.obj
 0001:00000850       ??_V@YAXPAX@Z              00010b70 f i RegSample.obj
 0001:00000870       ??1KUnitizedName@@QAE@XZ   00010b90 f i RegSample.obj
 0001:000008a0       ?ConstructorStatus@KLowerDevice@@QAEJXZ 00010bc0 f i vdw_wdm:ktrace.obj
 0001:000008a0       ??CKIrp@@QAEPAU_IRP@@XZ    00010bc0 f i vdw_wdm:ktrace.obj
 0001:000008a0       ??BKIrp@@QAEPAU_IRP@@XZ    00010bc0 f i RegSample.obj
 0001:000008a0       ?Test@KInterlockedCounter@@QAEJXZ 00010bc0 f i vdw_wdm:kpnpdev.obj
 0001:000008a0       ??BKUnitizedName@@QAEPBGXZ 00010bc0 f i RegSample.obj
 0001:000008b0       ??1KRegistryKey@@QAE@XZ    00010bd0 f i RegSample.obj
 0001:00000940       ?IsValid@KUstring@@QAEEXZ  00010c60 f i vdw_wdm:kregkey.obj
 0001:00000940       ?IsValid@KRegistryKey@@QAEEXZ 00010c60 f i RegSample.obj
 0001:00000940       ?IsValid@KDispatcherObject@@QAEEXZ 00010c60 f i vdw_wdm:kpnpdev.obj
 0001:00000960       ?Invalidate@KRegistryKey@@QAEXXZ 00010c80 f i RegSample.obj
 0001:00000990       ?LastError@KRegistryKey@@QAEJXZ 00010cb0 f i RegSample.obj
 0001:000009b0       ?ConstructorStatus@KDevice@@QAEJXZ 00010cd0 f i RegSample.obj
 0001:000009d0       ?_self_delete@KDriver@@EAEXXZ 00010cf0 f i RegSample.obj