readwrite.map

DriverStudio包含一个DriverMonitor显示工具。ReadWrite实例便是它的一个仿真

 ReadWrite

 Timestamp is 416bf7c0 (Tue Oct 12 23:26:56 2004)

 Preferred load address is 00010000

 Start         Length     Name                   Class
 0001:00000000 000000e8H .idata$5                CODE
 0001:000000f0 00000574H .rdata                  CODE
 0001:00000664 0000004eH .rdata$debug            CODE
 0001:000006c0 0000a236H .text                   CODE
 0001:0000a900 00000035H .text$yc                CODE
 0001:0000a940 0000000fH .text$yd                CODE
 0002:00000000 0000008cH .data                   DATA
 0002:00000090 00000480H .bss                    DATA
 0003:00000000 00000004H .CRT$XCA                DATA
 0003:00000004 00000004H .CRT$XCU                DATA
 0003:00000008 00000004H .CRT$XCZ                DATA
 0004:00000000 00000004H .STL$A                  DATA
 0004:00000004 00000004H .STL$L                  DATA
 0004:00000008 00000004H .STL$M                  DATA
 0004:0000000c 00000004H .STL$Z                  DATA
 0005:00000000 00001681H PAGE                    CODE
 0006:00000000 00000689H INIT                    CODE
 0006:0000068c 00000028H .idata$2                CODE
 0006:000006b4 00000014H .idata$3                CODE
 0006:000006c8 000000e8H .idata$4                CODE
 0006:000007b0 000004aaH .idata$6                CODE
 0007:00000000 00000058H .rsrc$01                DATA
 0007:00000060 00000330H .rsrc$02                DATA

  Address         Publics by Value              Rva+Base     Lib:Object

 0001:00000000       __imp__KeGetCurrentIrql@0  00010300     wdm:HAL.DLL
 0001:00000004       __imp_@KfReleaseSpinLock@8 00010304     wdm:HAL.DLL
 0001:00000008       __imp_@KfAcquireSpinLock@4 00010308     wdm:HAL.DLL
 0001:0000000c       \177HAL_NULL_THUNK_DATA    0001030c     wdm:HAL.DLL
 0001:00000010       __imp__ZwClose@4           00010310     wdm:NTOSKRNL.EXE
 0001:00000014       __imp_@InterlockedCompareExchange@12 00010314     wdm:NTOSKRNL.EXE
 0001:00000018       __imp__KeInitializeSpinLock@4 00010318     wdm:NTOSKRNL.EXE
 0001:0000001c       __imp__RtlAssert@16        0001031c     wdm:NTOSKRNL.EXE
 0001:00000020       __imp__ExFreePool@4        00010320     wdm:NTOSKRNL.EXE
 0001:00000024       __imp__ExAllocatePoolWithTag@12 00010324     wdm:NTOSKRNL.EXE
 0001:00000028       __imp__IoReleaseCancelSpinLock@4 00010328     wdm:NTOSKRNL.EXE
 0001:0000002c       __imp_@InterlockedExchange@8 0001032c     wdm:NTOSKRNL.EXE
 0001:00000030       __imp__PoStartNextPowerIrp@4 00010330     wdm:NTOSKRNL.EXE
 0001:00000034       __imp_@IofCompleteRequest@8 00010334     wdm:NTOSKRNL.EXE
 0001:00000038       __imp_@ObfDereferenceObject@4 00010338     wdm:NTOSKRNL.EXE
 0001:0000003c       __imp__PoCallDriver@8      0001033c     wdm:NTOSKRNL.EXE
 0001:00000040       __imp_@IofCallDriver@8     00010340     wdm:NTOSKRNL.EXE
 0001:00000044       __imp__IoAcquireCancelSpinLock@4 00010344     wdm:NTOSKRNL.EXE
 0001:00000048       __imp__IoDeleteDevice@4    00010348     wdm:NTOSKRNL.EXE
 0001:0000004c       __imp__RtlAppendUnicodeStringToString@8 0001034c     wdm:NTOSKRNL.EXE
 0001:00000050       __imp__IoDeleteSymbolicLink@4 00010350     wdm:NTOSKRNL.EXE
 0001:00000054       __imp__IoCreateSymbolicLink@8 00010354     wdm:NTOSKRNL.EXE
 0001:00000058       __imp__IoCreateDevice@28   00010358     wdm:NTOSKRNL.EXE
 0001:0000005c       __imp__IoAttachDeviceToDeviceStack@8 0001035c     wdm:NTOSKRNL.EXE
 0001:00000060       __imp__memmove             00010360     wdm:NTOSKRNL.EXE
 0001:00000064       __imp__RtlIntegerToUnicodeString@12 00010364     wdm:NTOSKRNL.EXE
 0001:00000068       __imp__IoAllocateIrp@8     00010368     wdm:NTOSKRNL.EXE
 0001:0000006c       __imp__IoFreeIrp@4         0001036c     wdm:NTOSKRNL.EXE
 0001:00000070       __imp__RtlInitUnicodeString@8 00010370     wdm:NTOSKRNL.EXE
 0001:00000074       __imp__ZwOpenKey@12        00010374     wdm:NTOSKRNL.EXE
 0001:00000078       __imp__ZwCreateKey@28      00010378     wdm:NTOSKRNL.EXE
 0001:0000007c       __imp__RtlCopyUnicodeString@8 0001037c     wdm:NTOSKRNL.EXE
 0001:00000080       __imp__RtlInitAnsiString@8 00010380     wdm:NTOSKRNL.EXE
 0001:00000084       __imp__DbgBreakPoint@0     00010384     wdm:NTOSKRNL.EXE
 0001:00000088       __imp__strchr              00010388     wdm:NTOSKRNL.EXE
 0001:0000008c       __imp___vsnprintf          0001038c     wdm:NTOSKRNL.EXE
 0001:00000090       __imp__DbgPrint            00010390     wdm:NTOSKRNL.EXE
 0001:00000094       __imp_@InterlockedIncrement@4 00010394     wdm:NTOSKRNL.EXE
 0001:00000098       __imp_@InterlockedDecrement@4 00010398     wdm:NTOSKRNL.EXE
 0001:0000009c       __imp__RtlFreeUnicodeString@4 0001039c     wdm:NTOSKRNL.EXE
 0001:000000a0       __imp__KeWaitForSingleObject@20 000103a0     wdm:NTOSKRNL.EXE
 0001:000000a4       __imp__KeReleaseMutex@8    000103a4     wdm:NTOSKRNL.EXE
 0001:000000a8       __imp__IoDetachDevice@4    000103a8     wdm:NTOSKRNL.EXE
 0001:000000ac       __imp__KeClearEvent@4      000103ac     wdm:NTOSKRNL.EXE
 0001:000000b0       __imp__KeSetEvent@12       000103b0     wdm:NTOSKRNL.EXE
 0001:000000b4       __imp__PoRequestPowerIrp@24 000103b4     wdm:NTOSKRNL.EXE
 0001:000000b8       __imp__PoSetPowerState@12  000103b8     wdm:NTOSKRNL.EXE
 0001:000000bc       __imp__IoCancelIrp@4       000103bc     wdm:NTOSKRNL.EXE
 0001:000000c0       __imp__IoRegisterDeviceInterface@16 000103c0     wdm:NTOSKRNL.EXE
 0001:000000c4       __imp__IoSetDeviceInterfaceState@8 000103c4     wdm:NTOSKRNL.EXE
 0001:000000c8       __imp__IoGetDeviceObjectPointer@16 000103c8     wdm:NTOSKRNL.EXE
 0001:000000cc       __imp__IoBuildDeviceIoControlRequest@36 000103cc     wdm:NTOSKRNL.EXE
 0001:000000d0       __imp__KeInitializeEvent@12 000103d0     wdm:NTOSKRNL.EXE
 0001:000000d4       __imp__KeInitializeMutex@8 000103d4     wdm:NTOSKRNL.EXE
 0001:000000d8       __imp__KeRemoveEntryDeviceQueue@8 000103d8     wdm:NTOSKRNL.EXE
 0001:000000dc       __imp_@KefAcquireSpinLockAtDpcLevel@4 000103dc     wdm:NTOSKRNL.EXE
 0001:000000e0       __imp_@KefReleaseSpinLockFromDpcLevel@4 000103e0     wdm:NTOSKRNL.EXE
 0001:000000e4       \177NTOSKRNL_NULL_THUNK_DATA 000103e4     wdm:NTOSKRNL.EXE
 0001:0000010c       ??_C@_0DF@OJJCGMGD@DriverWorks?5?$CIc?$CJ?5Copyright?52003?5C@ 0001040c     ReadWrite.obj
 0001:00000144       ??_7ReadWrite@@6B@         00010444     ReadWrite.obj
 0001:00000158       ??_7KDriver@@6B@           00010458     ReadWrite.obj
 0001:0000016c       ??_C@_0BL@NNGFNHOB@m_Irp?9?$DOCurrentLocation?5?$DO?51?$AA@ 0001046c     ReadWrite.obj
 0001:00000188       ??_C@_0CM@FADDDCMO@m_Irp?9?$DOCurrentLocation?5?$DM?$DN?5m_Irp?9@ 00010488     ReadWrite.obj
 0001:000001b4       ??_C@_0DO@EFKCJHCD@C?3?2PROGRA?$HO1?2Compuware?2DriverStud@ 000104b4     ReadWrite.obj
 0001:000001f8       ??_7ReadWriteDevice@@6B@   000104f8     ReadWriteDevice.obj
 0001:00000324       ??_C@_05MAJJAKPI@FALSE?$AA@ 00010624     ReadWriteDevice.obj
 0001:00000330       ??_C@_0EB@COLAEKAL@C?3?2PROGRA?$HO1?2Compuware?2DriverStud@ 00010630     ReadWriteDevice.obj
 0001:00000374       ??_C@_02DKCKIIND@?$CFs?$AA@ 00010674     ReadWriteDevice.obj
 0001:00000378       ??_C@_0CG@IJCOJOJN@I?4MajorFunction?$CINEXT?$CJ?5?$DN?$DN?5IRP_MJ_@ 00010678     ReadWriteDevice.obj
 0001:000003a0       ??_C@_0EB@JAFEGOBF@C?3?2PROGRA?$HO1?2Compuware?2DriverStud@ 000106a0     ReadWriteDevice.obj
 0001:000003e8       ??_7KDevice@@6B@           000106e8     vdw_wdm:kdevice.obj
 0001:00000470       ??_7KDeviceBase@@6B@       00010770     vdw_wdm:kdevice.obj
 0001:00000478       ??_C@_0BH@BINHOGGO@?4?2?4?4?2include?2kdevice?4h?$AA@ 00010778     vdw_wdm:kdevice.obj
 0001:00000490       ??_C@_0BE@HGMFHLDM@?4?2?4?4?2include?2kirp?4h?$AA@ 00010790     vdw_wdm:kchecker.obj
 0001:000004a8       ??_7KPnpDevice@@6B@        000107a8     vdw_wdm:kpnpdev.obj
 0001:000005d4       ??_C@_0O@KBDMFNDM@m_pdq?5?$CB?$DN?5NULL?$AA@ 000108d4     vdw_wdm:kpnpdev.obj
 0001:000005e4       ??_C@_0BH@BIPCAELK@?4?2?4?4?2include?2kdevque?4h?$AA@ 000108e4     vdw_wdm:kpnpdev.obj
 0001:000005fc       ??_C@_0DN@BBDLMDMH@?$CIOnSuccess?$CJ?5?$HM?5?$CIOnError?$CJ?5?$HM?5?$CIOnCan@ 000108fc     vdw_wdm:kpnpdev.obj
 0001:0000063c       ??_C@_0BH@LIGMDPNJ@?4?2?4?4?2include?2kpnplow?4h?$AA@ 0001093c     vdw_wdm:kpnpdev.obj
 0001:00000654       ??_7?$KList@UINTERFACE_LIST_ENTRY@@@@6B@ 00010954     vdw_wdm:kpnpdev.obj
 0001:000006e0       ?AddDevice@ReadWrite@@UAEJPAU_DEVICE_OBJECT@@@Z 000109e0 f   ReadWrite.obj
 0001:000007c0       ??2@YAPAXI@Z               00010ac0 f i ReadWrite.obj
 0001:000007f0       ??2@YAPAXIW4_POOL_TYPE@@@Z 00010af0 f i ReadWrite.obj
 0001:00000830       ??3@YAXPAX@Z               00010b30 f i ReadWrite.obj
 0001:00000830       ??_V@YAXPAX@Z              00010b30 f i ReadWrite.obj
 0001:00000850       ??1KUnitizedName@@QAE@XZ   00010b50 f i ReadWrite.obj
 0001:00000880       ?ConstructorStatus@KDevice@@QAEJXZ 00010b80 f i ReadWrite.obj
 0001:000008a0       ??1KRegistryKey@@QAE@XZ    00010ba0 f i ReadWrite.obj
 0001:00000930       ?IsValid@KUstring@@QAEEXZ  00010c30 f i vdw_wdm:kdevice.obj
 0001:00000930       ?IsValid@KDispatcherObject@@QAEEXZ 00010c30 f i vdw_wdm:kpnpdev.obj
 0001:00000930       ?IsValid@KRegistryKey@@QAEEXZ 00010c30 f i ReadWrite.obj
 0001:00000950       ?Invalidate@KRegistryKey@@QAEXXZ 00010c50 f i ReadWrite.obj
 0001:00000980       ?LastError@KRegistryKey@@QAEJXZ 00010c80 f i ReadWrite.obj
 0001:000009a0       ?_self_delete@KDriver@@EAEXXZ 00010ca0 f i ReadWrite.obj
 0001:000009e0       ??_GKDriver@@QAEPAXI@Z     00010ce0 f i ReadWrite.obj
 0001:00000a10       ??1KDriver@@QAE@XZ         00010d10 f i ReadWrite.obj
 0001:00000a60       ?DriverInstance@KDriver@@SGPAV1@XZ 00010d60 f i ReadWrite.obj
 0001:00000a70       ?AddDeviceDispatch@KDriver@@KGJPAU_DRIVER_OBJECT@@PAU_DEVICE_OBJECT@@@Z 00010d70 f   ReadWrite.obj
 0001:00000ad0       ?DriverIrpDispatch@KDriver@@SGJPAU_DEVICE_OBJECT@@PAU_IRP@@@Z 00010dd0 f   ReadWrite.obj
 0001:00000b70       ??0KIrp@@QAE@PAU_IRP@@@Z   00010e70 f i ReadWrite.obj
 0001:00000b90       ?MajorFunction@KIrp@@QAEAAEW4EStackLocation@@@Z 00010e90 f i ReadWrite.obj
 0001:00000bd0       ?ValidateStackLocation@KIrp@@QAEXW4EStackLocation@@@Z 00010ed0 f i ReadWrite.obj
 0001:00000c60       ?DispatchFilter@KDriver@@UAEJPAVKDevice@@VKIrp@@P82@AEJ1@Z@Z 00010f60 f   ReadWrite.obj
 0001:00000cda       __purecall                 00010fda f   ReadWrite.obj