SSDT and Shadow SSDT table

阅读原文时间：2023年07月14日阅读：1

参考：http://x86.renejeschke.de/html/file_module_x86_id_313.html

http://msdn.microsoft.com/en-us/library/windows/hardware/ff553516(v=vs.85).aspx

http://en.wikipedia.org/wiki/Model-specific_register

rdmsr ( 0x00000174 ) = 0x00000000 ~ 0x00000008
rdmsr ( 0x00000175 ) = 0x00000000 ~ 0xf7a1a000
rdmsr ( 0x00000176 ) = 0x00000000 ~ 0x8053dad0

kd> dg 0
P Si Gr Pr Lo
Sel Base Limit Type l ze an es ng Flags

0000 00000000 00000000 0 Nb By Np Nl 00000000
kd> dg 0x08
P Si Gr Pr Lo
Sel Base Limit Type l ze an es ng Flags

0008 00000000 ffffffff Code RE Ac 0 Bg Pg P Nl 00000c9b
kd> dg 0x13
P Si Gr Pr Lo
Sel Base Limit Type l ze an es ng Flags

0013 00000000 ffffffff Data RW Ac 0 Bg Pg P Nl 00000c93
kd> dg 0x18
P Si Gr Pr Lo
Sel Base Limit Type l ze an es ng Flags

0018 00000000 ffffffff Code RE Ac 3 Bg Pg P Nl 00000cfb
kd> dg 0x23
P Si Gr Pr Lo
Sel Base Limit Type l ze an es ng Flags

0023 00000000 ffffffff Data RW Ac 3 Bg Pg P Nl 00000cf3

因此，sysenter_cs就是内核的代码段。

列举内核中全部的driver

kd> !drivers

The !drivers command is no longer supported.

Please use the 'lm t n' command.
Consult the debugger documentation for the supported 'lm' command options.

The WinDbg "Modules" window can also be used to display timestamps.
The "Modules" window supports sorting on name or timestamp values

kd> lm t n

nt!KiFastCallEntry:
8053dad0 b923000000 mov ecx,23h
8053dad5 6a30 push 30h
8053dad7 0fa1 pop fs
8053dad9 8ed9 mov ds,cx
8053dadb 8ec1 mov es,cx
8053dadd 8b0d40f0dfff mov ecx,dword ptr ds:[0FFDFF040h]
8053dae3 8b6104 mov esp,dword ptr [ecx+4]
8053dae6 6a23 push 23h
8053dae8 52 push edx
8053dae9 9c pushfd
8053daea 6a02 push 2
8053daec 83c208 add edx,8
8053daef 9d popfd
8053daf0 804c240102 or byte ptr [esp+1],2
8053daf5 6a1b push 1Bh
8053daf7 ff350403dfff push dword ptr ds:[0FFDF0304h]
8053dafd 6a00 push 0
8053daff 55 push ebp
8053db00 53 push ebx
8053db01 56 push esi
8053db02 57 push edi
8053db03 8b1d1cf0dfff mov ebx,dword ptr ds:[0FFDFF01Ch]
8053db09 6a3b push 3Bh
8053db0b 8bb324010000 mov esi,dword ptr [ebx+124h]
8053db11 ff33 push dword ptr [ebx]
8053db13 c703ffffffff mov dword ptr [ebx],0FFFFFFFFh
8053db19 8b6e18 mov ebp,dword ptr [esi+18h]
8053db1c 6a01 push 1
8053db1e 83ec48 sub esp,48h
8053db21 81ed9c020000 sub ebp,29Ch
8053db27 c6864001000001 mov byte ptr [esi+140h],1
8053db2e 3bec cmp ebp,esp
8053db30 759a jne nt!KiFastCallEntry2+0x47 (8053dacc)

kd> u nt!KiSystemService L20
nt!KiSystemService:
8053da11 6a00 push 0
8053da13 55 push ebp
8053da14 53 push ebx
8053da15 56 push esi
8053da16 57 push edi
8053da17 0fa0 push fs
8053da19 bb30000000 mov ebx,30h
8053da1e 668ee3 mov fs,bx
8053da21 ff3500f0dfff push dword ptr ds:[0FFDFF000h]
8053da27 c70500f0dfffffffffff mov dword ptr ds:[0FFDFF000h],0FFFFFFFFh
8053da31 8b3524f1dfff mov esi,dword ptr ds:[0FFDFF124h]
8053da37 ffb640010000 push dword ptr [esi+140h]
8053da3d 83ec48 sub esp,48h
8053da40 8b5c246c mov ebx,dword ptr [esp+6Ch]
8053da44 83e301 and ebx,1
8053da47 889e40010000 mov byte ptr [esi+140h],bl
8053da4d 8bec mov ebp,esp
8053da4f 8b9e34010000 mov ebx,dword ptr [esi+134h]
8053da55 895d3c mov dword ptr [ebp+3Ch],ebx
8053da58 89ae34010000 mov dword ptr [esi+134h],ebp
8053da5e fc cld
8053da5f 8b5d60 mov ebx,dword ptr [ebp+60h]
8053da62 8b7d68 mov edi,dword ptr [ebp+68h]
8053da65 89550c mov dword ptr [ebp+0Ch],edx
8053da68 c74508000ddbba mov dword ptr [ebp+8],0BADB0D00h
8053da6f 895d00 mov dword ptr [ebp],ebx
8053da72 897d04 mov dword ptr [ebp+4],edi
8053da75 f6462cff test byte ptr [esi+2Ch],0FFh
8053da79 0f858dfeffff jne nt!Dr_kss_a (8053d90c)
8053da7f fb sti
8053da80 e9d8000000 jmp nt!KiFastCallEntry+0x8d (8053db5d)
nt!KiFastCallEntry2:

kd> !idt 2e

Dumping IDT:

2e: 8053da11 nt!KiSystemService

daniel@daniel-mint ~/windbg $ awk '{printf("[% [ 1]: [80502354 --> 80599a66] [ 2]: [80502358 --> 805e6cce] [ 3]: [8050235c --> 805ea514] [ 4]: [80502360 --> 805e6d00] [ 5]: [80502364 --> 805ea54e] [ 6]: [80502368 --> 805e6d36] [ 7]: [8050236c --> 805ea592] [ 8]: [80502370 --> 805ea5d6] [ 9]: [80502374 --> 8060bc40] [ a]: [80502378 --> 8060c984] [ b]: [8050237c --> 805e2066] [ c]: [80502380 --> 805e1cbe] [ d]: [80502384 --> 805caccc] [ e]: [80502388 --> 805cac7c] [ f]: [8050238c --> 8060c266] [ 10]: [80502390 --> 805ab654] [ 11]: [80502394 --> 8060b87e] [ 12]: [80502398 --> 8059dedc] [ 13]: [8050239c --> 805a5aa6] [ 14]: [805023a0 --> 805cc7aa] [ 15]: [805023a4 --> 80500020] [ 16]: [805023a8 --> 805be3e2] [ 17]: [805023ac --> 8056c0c6] [ 18]: [805023b0 --> 80535596] [ 19]: [805023b4 --> 80604f36] [ 1a]: [805023b8 --> 805b1ce0] [ 1b]: [805023bc --> 805eaa4e] [ 1c]: [805023c0 --> 80619dfe] [ 1d]: [805023c4 --> 805eef40] [ 1e]: [805023c8 --> 8059a154] [ 1f]: [805023cc --> 8061a052] [ 20]: [805023d0 --> 80599a06] [ 21]: [805023d4 --> 80541390] [ 22]: [805023d8 --> 806381da] [ 23]: [805023dc --> 805b3bdc] [ 24]: [805023e0 --> 80604f86] [ 25]: [805023e4 --> 8060d1fa] [ 26]: [805023e8 --> 8056e62e] [ 27]: [805023ec --> 8056e00c] [ 28]: [805023f0 --> 805cb76e] [ 29]: [805023f4 --> 805cb4a6] [ 2a]: [805023f8 --> 8061a22e] [ 2b]: [805023fc --> 8056e73c] [ 2c]: [80502400 --> 8060d5f2] [ 2d]: [80502404 --> 8056e668] [ 2e]: [80502408 --> 805a0ec6] [ 2f]: [8050240c --> 8059a522] [ 30]: [80502410 --> 805c7332] [ 31]: [80502414 --> 805c727c] [ 32]: [80502418 --> 8060da12] [ 33]: [8050241c --> 805a080a] [ 34]: [80502420 --> 8060af9c] [ 35]: [80502424 --> 805ba9e4] [ 36]: [80502428 --> 805c711a] [ 37]: [8050242c --> 8060cec2] [ 38]: [80502430 --> 805ef2e8] [ 39]: [80502434 --> 8059a546] [ 3a]: [80502438 --> 806392b6] [ 3b]: [8050243c --> 80639406] [ 3c]: [80502440 --> 8060c8d4] [ 3d]: [80502444 --> 8060c0f6] [ 3e]: [80502448 --> 805be3e2] [ 3f]: [8050244c --> 8056c20c] [ 40]: [80502450 --> 8061a6be] [ 41]: [80502454 --> 805eab5a] [ 42]: [80502458 --> 8061a88e] [ 43]: [8050245c --> 8056e7f4] [ 44]: [80502460 --> 80608f10] [ 45]: [80502464 --> 805b37bc] [ 46]: [80502468 --> 805e2f04] [ 47]: [8050246c --> 8060c984] [ 48]: [80502470 --> 8061aa6e] [ 49]: [80502474 --> 8060c976] [ 4a]: [80502478 --> 8061acd8] [ 4b]: [8050247c --> 805a91cc] [ 4c]: [80502480 --> 805e30b0] [ 4d]: [80502484 --> 8060beaa] [ 4e]: [80502488 --> 8056c2d8] [ 4f]: [8050248c --> 805abede] [ 50]: [80502490 --> 8061af42] [ 51]: [80502494 --> 805a1bd6] [ 52]: [80502498 --> 805abe80] [ 53]: [8050249c --> 805ab9f0] [ 54]: [805024a0 --> 805a84a6] [ 55]: [805024a4 --> 8056e828] [ 56]: [805024a8 --> 805c7644] [ 57]: [805024ac --> 805be404] [ 58]: [805024b0 --> 8058e83c] [ 59]: [805024b4 --> 8051df7e] [ 5a]: [805024b8 --> 805eec34] [ 5b]: [805024bc --> 8059a5b0] [ 5c]: [805024c0 --> 805cd942] [ 5d]: [805024c4 --> 80618206] [ 5e]: [805024c8 --> 805be1dc] [ 5f]: [805024cc --> 805cb36a] [ 60]: [805024d0 --> 805be3f0] [ 61]: [805024d4 --> 8059a7bc] [ 62]: [805024d8 --> 80579848] [ 63]: [805024dc --> 8061bf5e] [ 64]: [805024e0 --> 8061bba8] [ 65]: [805024e4 --> 8056e85c] [ 66]: [805024e8 --> 80609472] [ 67]: [805024ec --> 8061a0fe] [ 68]: [805024f0 --> 805abfe6] [ 69]: [805024f4 --> 805b505c] [ 6a]: [805024f8 --> 805b1d84] [ 6b]: [805024fc --> 805aa948] [ 6c]: [80502500 --> 805aaf20] [ 6d]: [80502504 --> 805a7526] [ 6e]: [80502508 --> 805be3e2] [ 6f]: [8050250c --> 8056f48c] [ 70]: [80502510 --> 8061bf28] [ 71]: [80502514 --> 8061b044] [ 72]: [80502518 --> 805b3cae] [ 73]: [8050251c --> 80605086] [ 74]: [80502520 --> 8060d2d2] [ 75]: [80502524 --> 8056f74c] [ 76]: [80502528 --> 8056e0e4] [ 77]: [8050252c --> 805cb8f4] [ 78]: [80502530 --> 8061b5c4] [ 79]: [80502534 --> 8060d6ca] [ 7a]: [80502538 --> 805ea61c] [ 7b]: [8050253c --> 805c11c2] [ 7c]: [80502540 --> 805e38fc] [ 7d]: [80502544 --> 805e3502] [ 7e]: [80502548 --> 8059f840] [ 7f]: [8050254c --> 8060b096] [ 80]: [80502550 --> 805babca] [ 81]: [80502554 --> 805c144e] [ 82]: [80502558 --> 805e391a] [ 83]: [8050255c --> 805e3672] [ 84]: [80502560 --> 8060cfe4] [ 85]: [80502564 --> 8063b4a8] [ 86]: [80502568 --> 805bf272] [ 87]: [8050256c --> 805edce6] [ 88]: [80502570 --> 805e992e] [ 89]: [80502574 --> 805e9b1a] [ 8a]: [80502578 --> 805adaae] [ 8b]: [8050257c --> 8060513e] [ 8c]: [80502580 --> 8056c4be] [ 8d]: [80502584 --> 8060c984] [ 8e]: [80502588 --> 8060c984] [ 8f]: [8050258c --> 8053c5be] [ 90]: [80502590 --> 80606caa] [ 91]: [80502594 --> 8060790a] [ 92]: [80502598 --> 8056f426] [ 93]: [8050259c --> 805b3d4e] [ 94]: [805025a0 --> 8056f77c] [ 95]: [805025a4 --> 80605206] [ 96]: [805025a8 --> 8056c5f6] [ 97]: [805025ac --> 8060c11e] [ 98]: [805025b0 --> 8056fff8] [ 99]: [805025b4 --> 805cbdc6] [ 9a]: [805025b8 --> 8059a81a] [ 9b]: [805025bc --> 805c2b28] [ 9c]: [805025c0 --> 805c16f4] [ 9d]: [805025c4 --> 805e39fa] [ 9e]: [805025c8 --> 806070a8] [ 9f]: [805025cc --> 8060de94] [ a0]: [805025d0 --> 8056e18c] [ a1]: [805025d4 --> 8061b8e8] [ a2]: [805025d8 --> 806193fc] [ a3]: [805025dc --> 8060d772] [ a4]: [805025e0 --> 805ba0a4] [ a5]: [805025e4 --> 80619a62] [ a6]: [805025e8 --> 8060df22] [ a7]: [805025ec --> 80570e42] [ a8]: [805025f0 --> 805adc70] [ a9]: [805025f4 --> 805b5a28] [ aa]: [805025f8 --> 8060b14e] [ ab]: [805025fc --> 805bac6a] [ ac]: [80502600 --> 8060c9a0] [ ad]: [80502604 --> 8060c968] [ ae]: [80502608 --> 8060798a] [ af]: [8050260c --> 80609826] [ b0]: [80502610 --> 8060d09c] [ b1]: [80502614 --> 806090de] [ b2]: [80502618 --> 806182e8] [ b3]: [8050261c --> 805ae2f6] [ b4]: [80502620 --> 80571332] [ b5]: [80502624 --> 805c7390] [ b6]: [80502628 --> 805413d8] [ b7]: [8050262c --> 8060adc0] [ b8]: [80502630 --> 80571afa] [ b9]: [80502634 --> 80572088] [ ba]: [80502638 --> 8059b2a2] [ bb]: [8050263c --> 805a97b8] [ bc]: [80502640 --> 805c88c6] [ bd]: [80502644 --> 8060d8aa] [ be]: [80502648 --> 8060b27e] [ bf]: [8050264c --> 8056e484] [ c0]: [80502650 --> 80639386] [ c1]: [80502654 --> 80619c54] [ c2]: [80502658 --> 8061be0e] [ c3]: [8050265c --> 8059a922] [ c4]: [80502660 --> 8059b8ea] [ c5]: [80502664 --> 8059b2f2] [ c6]: [80502668 --> 8059ac0c] [ c7]: [8050266c --> 805be374] [ c8]: [80502670 --> 80597e80] [ c9]: [80502674 --> 805981ac] [ ca]: [80502678 --> 805be182] [ cb]: [8050267c --> 80605318] [ cc]: [80502680 --> 8051e45e] [ cd]: [80502684 --> 80618636] [ ce]: [80502688 --> 805cac26] [ cf]: [8050268c --> 805cab08] [ d0]: [80502690 --> 806186d8] [ d1]: [80502694 --> 80618768] [ d2]: [80502698 --> 80618834] [ d3]: [8050269c --> 8059919a] [ d4]: [805026a0 --> 8060c984] [ d5]: [805026a4 --> 8060c984] [ d6]: [805026a8 --> 805c7854] [ d7]: [805026ac --> 8063c03e] [ d8]: [805026b0 --> 8060ac6a] [ d9]: [805026b4 --> 80606dfa] [ da]: [805026b8 --> 8060766c] [ db]: [805026bc --> 8056fc98] [ dc]: [805026c0 --> 806053d8] [ dd]: [805026c4 --> 806054a2] [ de]: [805026c8 --> 8060d58e] [ df]: [805026cc --> 8060d4be] [ e0]: [805026d0 --> 80638d50] [ e1]: [805026d4 --> 805705fc] [ e2]: [805026d8 --> 805ccad6] [ e3]: [805026dc --> 80618fc8] [ e4]: [805026e0 --> 805b94e8] [ e5]: [805026e4 --> 805c3c80] [ e6]: [805026e8 --> 805c1c40] [ e7]: [805026ec --> 805f0062] [ e8]: [805026f0 --> 8060d9f6] [ e9]: [805026f4 --> 8056e422] [ ea]: [805026f8 --> 805c9a52] [ eb]: [805026fc --> 8060d52a] [ ec]: [80502700 --> 8060d452] [ ed]: [80502704 --> 80570e20] [ ee]: [80502708 --> 805b595c] [ ef]: [8050270c --> 8060cc24] [ f0]: [80502710 --> 8060c968] [ f1]: [80502714 --> 80605cd8] [ f2]: [80502718 --> 806485f6] [ f3]: [8050271c --> 8060a3e6] [ f4]: [80502720 --> 805be096] [ f5]: [80502724 --> 805356d2] [ f6]: [80502728 --> 806098b8] [ f7]: [8050272c --> 8060b734] [ f8]: [80502730 --> 806188ee] [ f9]: [80502734 --> 80571756] [ fa]: [80502738 --> 80608ed4] [ fb]: [8050273c --> 80523210] [ fc]: [80502740 --> 8060dc40] [ fd]: [80502744 --> 8060ddea] [ fe]: [80502748 --> 805cabd0] [ ff]: [8050274c --> 805caa42] [ 100]: [80502750 --> 8060e00e] [ 101]: [80502754 --> 805cd640] [ 102]: [80502758 --> 805c8b10] [ 103]: [8050275c --> 805c8d0a] [ 104]: [80502760 --> 805cad90] [ 105]: [80502764 --> 80531db0] [ 106]: [80502768 --> 8060c992] [ 107]: [8050276c --> 805799dc] [ 108]: [80502770 --> 80618bb6] [ 109]: [80502774 --> 80618da4] [ 10a]: [80502778 --> 8056ec08] [ 10b]: [8050277c --> 805ac574] [ 10c]: [80502780 --> 805a833c] [ 10d]: [80502784 --> 805f141a] [ 10e]: [80502788 --> 80638ab8] [ 10f]: [8050278c --> 805b6094] [ 110]: [80502790 --> 805b5faa] [ 111]: [80502794 --> 8060d3ee] [ 112]: [80502798 --> 8060d38a] [ 113]: [8050279c --> 80572598] [ 114]: [805027a0 --> 80572ba8] [ 115]: [805027a4 --> 8059b2ca] [ 116]: [805027a8 --> 805a98c2] [ 117]: [805027ac --> 805029f4] [ 118]: [805027b0 --> 8060e466] [ 119]: [805027b4 --> 8060e550] [ 11a]: [805027b8 --> 8060e602] [ 11b]: [805027bc --> 8060e88e] [ 11c]: [805027c0 --> 805c16c4] 8x]: \t\t[%s --> %s] \t\t%s\n", NR, $1, $2, $3)}' kiservicetable
nt!NtAcceptConnectPort
nt!NtAccessCheck
nt!NtAccessCheckAndAuditAlarm
nt!NtAccessCheckByType
nt!NtAccessCheckByTypeAndAuditAlarm
nt!NtAccessCheckByTypeResultList
nt!NtAccessCheckByTypeResultListAndAuditAlarm
nt!NtAccessCheckByTypeResultListAndAuditAlarmByHandle
nt!NtAddAtom
nt!NtAddBootEntry
nt!NtAdjustGroupsToken
nt!NtAdjustPrivilegesToken
nt!NtAlertResumeThread
nt!NtAlertThread
nt!NtAllocateLocallyUniqueId
nt!NtAllocateUserPhysicalPages
nt!NtAllocateUuids
nt!NtAllocateVirtualMemory
nt!NtAreMappedFilesTheSame
nt!NtAssignProcessToJobObject
nt!NtCallbackReturn
nt!NtModifyBootEntry
nt!NtCancelIoFile
nt!NtCancelTimer
nt!NtClearEvent
nt!NtClose
nt!NtCloseObjectAuditAlarm
nt!NtCompactKeys
nt!NtCompareTokens
nt!NtCompleteConnectPort
nt!NtCompressKey
nt!NtConnectPort
nt!NtContinue
nt!NtCreateDebugObject
nt!NtCreateDirectoryObject
nt!NtCreateEvent
nt!NtCreateEventPair
nt!NtCreateFile
nt!NtCreateIoCompletion
nt!NtCreateJobObject
nt!NtCreateJobSet
nt!NtCreateKey
nt!NtCreateMailslotFile
nt!NtCreateMutant
nt!NtCreateNamedPipeFile
nt!NtCreatePagingFile
nt!NtCreatePort
nt!NtCreateProcess
nt!NtCreateProcessEx
nt!NtCreateProfile
nt!NtCreateSection
nt!NtCreateSemaphore
nt!NtCreateSymbolicLinkObject
nt!NtCreateThread
nt!NtCreateTimer
nt!NtCreateToken
nt!NtCreateWaitablePort
nt!NtDebugActiveProcess
nt!NtDebugContinue
nt!NtDelayExecution
nt!NtDeleteAtom
nt!NtModifyBootEntry
nt!NtDeleteFile
nt!NtDeleteKey
nt!NtDeleteObjectAuditAlarm
nt!NtDeleteValueKey
nt!NtDeviceIoControlFile
nt!NtDisplayString
nt!NtDuplicateObject
nt!NtDuplicateToken
nt!NtAddBootEntry
nt!NtEnumerateKey
nt!NtEnumerateSystemEnvironmentValuesEx
nt!NtEnumerateValueKey
nt!NtExtendSection
nt!NtFilterToken
nt!NtFindAtom
nt!NtFlushBuffersFile
nt!NtFlushInstructionCache
nt!NtFlushKey
nt!NtFlushVirtualMemory
nt!NtFlushWriteBuffer
nt!NtFreeUserPhysicalPages
nt!NtFreeVirtualMemory
nt!NtFsControlFile
nt!NtGetContextThread
nt!NtGetDevicePowerState
nt!NtGetPlugPlayEvent
nt!NtGetWriteWatch
nt!NtImpersonateAnonymousToken
nt!NtImpersonateClientOfPort
nt!NtImpersonateThread
nt!NtInitializeRegistry
nt!NtInitiatePowerAction
nt!NtIsProcessInJob
nt!NtIsSystemResumeAutomatic
nt!NtListenPort
nt!NtLoadDriver
nt!NtLoadKey
nt!NtLoadKey2
nt!NtLockFile
nt!NtLockProductActivationKeys
nt!NtLockRegistryKey
nt!NtLockVirtualMemory
nt!NtMakePermanentObject
nt!NtMakeTemporaryObject
nt!NtMapUserPhysicalPages
nt!NtMapUserPhysicalPagesScatter
nt!NtMapViewOfSection
nt!NtModifyBootEntry
nt!NtNotifyChangeDirectoryFile
nt!NtNotifyChangeKey
nt!NtNotifyChangeMultipleKeys
nt!NtOpenDirectoryObject
nt!NtOpenEvent
nt!NtOpenEventPair
nt!NtOpenFile
nt!NtOpenIoCompletion
nt!NtOpenJobObject
nt!NtOpenKey
nt!NtOpenMutant
nt!NtOpenObjectAuditAlarm
nt!NtOpenProcess
nt!NtOpenProcessToken
nt!NtOpenProcessTokenEx
nt!NtOpenSection
nt!NtOpenSemaphore
nt!NtOpenSymbolicLinkObject
nt!NtOpenThread
nt!NtOpenThreadToken
nt!NtOpenThreadTokenEx
nt!NtOpenTimer
nt!NtPlugPlayControl
nt!NtPowerInformation
nt!NtPrivilegeCheck
nt!NtPrivilegeObjectAuditAlarm
nt!NtPrivilegedServiceAuditAlarm
nt!NtProtectVirtualMemory
nt!NtPulseEvent
nt!NtQueryAttributesFile
nt!NtAddBootEntry
nt!NtAddBootEntry
nt!NtQueryDebugFilterState
nt!NtQueryDefaultLocale
nt!NtQueryDefaultUILanguage
nt!NtQueryDirectoryFile
nt!NtQueryDirectoryObject
nt!NtQueryEaFile
nt!NtQueryEvent
nt!NtQueryFullAttributesFile
nt!NtQueryInformationAtom
nt!NtQueryInformationFile
nt!NtQueryInformationJobObject
nt!NtQueryInformationPort
nt!NtQueryInformationProcess
nt!NtQueryInformationThread
nt!NtQueryInformationToken
nt!NtQueryInstallUILanguage
nt!NtQueryIntervalProfile
nt!NtQueryIoCompletion
nt!NtQueryKey
nt!NtQueryMultipleValueKey
nt!NtQueryMutant
nt!NtQueryObject
nt!NtQueryOpenSubKeys
nt!NtQueryPerformanceCounter
nt!NtQueryQuotaInformationFile
nt!NtQuerySection
nt!NtQuerySecurityObject
nt!NtQuerySemaphore
nt!NtQuerySymbolicLinkObject
nt!NtQuerySystemEnvironmentValue
nt!NtSetSystemEnvironmentValueEx
nt!NtQuerySystemInformation
nt!NtQuerySystemTime
nt!NtQueryTimer
nt!NtQueryTimerResolution
nt!NtQueryValueKey
nt!NtQueryVirtualMemory
nt!NtQueryVolumeInformationFile
nt!NtQueueApcThread
nt!NtRaiseException
nt!NtRaiseHardError
nt!NtReadFile
nt!NtReadFileScatter
nt!NtReadRequestData
nt!NtReadVirtualMemory
nt!NtRegisterThreadTerminatePort
nt!NtReleaseMutant
nt!NtReleaseSemaphore
nt!NtRemoveIoCompletion
nt!NtRemoveProcessDebug
nt!NtRenameKey
nt!NtReplaceKey
nt!NtReplyPort
nt!NtReplyWaitReceivePort
nt!NtReplyWaitReceivePortEx
nt!NtReplyWaitReplyPort
nt!NtRequestDeviceWakeup
nt!NtRequestPort
nt!NtRequestWaitReplyPort
nt!NtRequestWakeupLatency
nt!NtResetEvent
nt!NtResetWriteWatch
nt!NtRestoreKey
nt!NtResumeProcess
nt!NtResumeThread
nt!NtSaveKey
nt!NtSaveKeyEx
nt!NtSaveMergedKeys
nt!NtSecureConnectPort
nt!NtAddBootEntry
nt!NtAddBootEntry
nt!NtSetContextThread
nt!NtSetDebugFilterState
nt!NtSetDefaultHardErrorPort
nt!NtSetDefaultLocale
nt!NtSetDefaultUILanguage
nt!NtSetEaFile
nt!NtSetEvent
nt!NtSetEventBoostPriority
nt!NtSetHighEventPair
nt!NtSetHighWaitLowEventPair
nt!NtSetInformationDebugObject
nt!NtSetInformationFile
nt!NtSetInformationJobObject
nt!NtSetInformationKey
nt!NtSetInformationObject
nt!NtSetInformationProcess
nt!NtSetInformationThread
nt!NtSetInformationToken
nt!NtSetIntervalProfile
nt!NtSetIoCompletion
nt!NtSetLdtEntries
nt!NtSetLowEventPair
nt!NtSetLowWaitHighEventPair
nt!NtSetQuotaInformationFile
nt!NtSetSecurityObject
nt!NtSetSystemEnvironmentValue
nt!NtSetSystemEnvironmentValueEx
nt!NtSetSystemInformation
nt!NtSetSystemPowerState
nt!NtSetSystemTime
nt!NtSetThreadExecutionState
nt!NtSetTimer
nt!NtSetTimerResolution
nt!NtSetUuidSeed
nt!NtSetValueKey
nt!NtSetVolumeInformationFile
nt!NtShutdownSystem
nt!NtSignalAndWaitForSingleObject
nt!NtStartProfile
nt!NtStopProfile
nt!NtSuspendProcess
nt!NtSuspendThread
nt!NtSystemDebugControl
nt!NtTerminateJobObject
nt!NtTerminateProcess
nt!NtTerminateThread
nt!NtTestAlert
nt!NtTraceEvent
nt!NtTranslateFilePath
nt!NtUnloadDriver
nt!NtUnloadKey
nt!NtUnloadKeyEx
nt!NtUnlockFile
nt!NtUnlockVirtualMemory
nt!NtUnmapViewOfSection
nt!NtVdmControl
nt!NtWaitForDebugEvent
nt!NtWaitForMultipleObjects
nt!NtWaitForSingleObject
nt!NtWaitHighEventPair
nt!NtWaitLowEventPair
nt!NtWriteFile
nt!NtWriteFileGather
nt!NtWriteRequestData
nt!NtWriteVirtualMemory
nt!NtYieldExecution
nt!NtCreateKeyedEvent
nt!NtOpenKeyedEvent
nt!NtReleaseKeyedEvent
nt!NtWaitForKeyedEvent
nt!NtQueryPortInformationProcess

可见， KeServiceDescriptorTable的前四项是对KiServiceTable的描述【start_addr, start_index, end_addr, end_index】

//
// System Service Table Descriptor
//
typedef struct _KSERVICE_TABLE_DESCRIPTOR
{
PULONG_PTR Base;
PULONG Count;
ULONG Limit;
#if defined(_IA64_)
LONG TableBaseGpOffset;
#endif
PUCHAR Number;
} KSERVICE_TABLE_DESCRIPTOR, *PKSERVICE_TABLE_DESCRIPTOR;

//
// Exported System Service Descriptor Tables
//
extern KSERVICE_TABLE_DESCRIPTOR NTSYSAPI KeServiceDescriptorTable[SSDT_MAX_ENTRIES];
extern KSERVICE_TABLE_DESCRIPTOR NTSYSAPI KeServiceDescriptorTableShadow[SSDT_MAX_ENTRIES];

//
// Maximum System Descriptor Table Entries
//
#define SSDT_MAX_ENTRIES 2

因此KeServiceDescriptorTable与KeServiceDescriptorTableShadow其实是上述结构体KSERVICE_TABLE_DESCRIPTOR的数组，每个数组里面都只有两项。

kd> dds nt!KeServiceDescriptorTable L8
80553580 80502354 nt!KiServiceTable
80553584 00000000
80553588 0000011c
8055358c 805027c8 nt!KiArgumentTable
80553590 00000000
80553594 00000000
80553598 00000000
8055359c 00000000
kd> dds nt!KeServiceDescriptorTableShadow L8
80553540 80502354 nt!KiServiceTable
80553544 00000000
80553548 0000011c
8055354c 805027c8 nt!KiArgumentTable
80553550 bf999400 win32k!W32pServiceTable
80553554 00000000
80553558 0000029b
8055355c bf99a110 win32k!W32pArgumentTable

而真正的System Service Routine的列表在KiServiceTable和W32pServiceTable中。　　

[ 1]: [bf999400 --> bf9357a3] win32k!NtGdiAbortDoc
[ 2]: [bf999404 --> bf947361] win32k!NtGdiAbortPath
[ 3]: [bf999408 --> bf896625] win32k!NtGdiAddFontResourceW
[ 4]: [bf99940c --> bf93ef25] win32k!NtGdiAddRemoteFontToDC
[ 5]: [bf999410 --> bf948978] win32k!NtGdiAddFontMemResourceEx
[ 6]: [bf999414 --> bf935a37] win32k!NtGdiRemoveMergeFont
[ 7]: [bf999418 --> bf935adc] win32k!NtGdiAddRemoteMMInstanceToDC
[ 8]: [bf99941c --> bf83b65f] win32k!NtGdiAlphaBlend
[ 9]: [bf999420 --> bf94829f] win32k!NtGdiAngleArc
[ a]: [bf999424 --> bf934242] win32k!NtGdiAnyLinkedFonts
[ b]: [bf999428 --> bf948897] win32k!NtGdiFontIsLinked
[ c]: [bf99942c --> bf90eea2] win32k!NtGdiArcInternal
[ d]: [bf999430 --> bf900833] win32k!NtGdiBeginPath
[ e]: [bf999434 --> bf80a178] win32k!NtGdiBitBlt
[ f]: [bf999438 --> bf948769] win32k!NtGdiCancelDC
[ 10]: [bf99943c --> bf949f65] win32k!NtGdiCheckBitmapBits
[ 11]: [bf999440 --> bf8ff130] win32k!NtGdiCloseFigure
[ 12]: [bf999444 --> bf89d4eb] win32k!NtGdiClearBitmapAttributes
[ 13]: [bf999448 --> bf948847] win32k!NtGdiClearBrushAttributes
[ 14]: [bf99944c --> bf94a098] win32k!NtGdiColorCorrectPalette
[ 15]: [bf999450 --> bf8210bb] win32k!NtGdiCombineRgn
[ 16]: [bf999454 --> bf8dcd15] win32k!NtGdiCombineTransform
[ 17]: [bf999458 --> bf88374b] win32k!NtGdiComputeXformCoefficients
[ 18]: [bf99945c --> bf87d210] win32k!NtGdiConsoleTextOut
[ 19]: [bf999460 --> bf9100dd] win32k!NtGdiConvertMetafileRect
[ 1a]: [bf999464 --> bf80e427] win32k!NtGdiCreateBitmap
[ 1b]: [bf999468 --> bf8dc9bd] win32k!NtGdiCreateClientObj
[ 1c]: [bf99946c --> bf949d5d] win32k!NtGdiCreateColorSpace
[ 1d]: [bf999470 --> bf94ac5c] win32k!NtGdiCreateColorTransform
[ 1e]: [bf999474 --> bf80fc96] win32k!NtGdiCreateCompatibleBitmap
[ 1f]: [bf999478 --> bf80d0f2] win32k!NtGdiCreateCompatibleDC
[ 20]: [bf99947c --> bf8d1699] win32k!NtGdiCreateDIBBrush
[ 21]: [bf999480 --> bf838921] win32k!NtGdiCreateDIBitmapInternal
[ 22]: [bf999484 --> bf82dac0] win32k!NtGdiCreateDIBSection
[ 23]: [bf999488 --> bf9386bb] win32k!NtGdiCreateEllipticRgn
[ 24]: [bf99948c --> bf84b5aa] win32k!NtGdiCreateHalftonePalette
[ 25]: [bf999490 --> bf94bce8] win32k!NtGdiCreateHatchBrushInternal
[ 26]: [bf999494 --> bf8e6517] win32k!NtGdiCreateMetafileDC
[ 27]: [bf999498 --> bf88235e] win32k!NtGdiCreatePaletteInternal
[ 28]: [bf99949c --> bf8687e1] win32k!NtGdiCreatePatternBrushInternal
[ 29]: [bf9994a0 --> bf84f1ec] win32k!NtGdiCreatePen
[ 2a]: [bf9994a4 --> bf8408ce] win32k!NtGdiCreateRectRgn
[ 2b]: [bf9994a8 --> bf88cb87] win32k!NtGdiCreateRoundRectRgn
[ 2c]: [bf9994ac --> bf90ffe2] win32k!NtGdiCreateServerMetaFile
[ 2d]: [bf9994b0 --> bf81a08f] win32k!NtGdiCreateSolidBrush
[ 2e]: [bf9994b4 --> bf9338ae] win32k!NtGdiD3dContextCreate
[ 2f]: [bf9994b8 --> bf9338c1] win32k!NtGdiD3dContextDestroy
[ 30]: [bf9994bc --> bf9338d4] win32k!NtGdiD3dContextDestroyAll
[ 31]: [bf9994c0 --> bf9338e7] win32k!NtGdiD3dValidateTextureStageState
[ 32]: [bf9994c4 --> bf9338fa] win32k!NtGdiD3dDrawPrimitives2
[ 33]: [bf9994c8 --> bf93390d] win32k!NtGdiDdGetDriverState
[ 34]: [bf9994cc --> bf933783] win32k!NtGdiDdAddAttachedSurface
[ 35]: [bf9994d0 --> bf9339cd] win32k!NtGdiDdAlphaBlt
[ 36]: [bf9994d4 --> bf907cf2] win32k!NtGdiDdAttachSurface
[ 37]: [bf9994d8 --> bf933978] win32k!NtGdiDdBeginMoCompFrame
[ 38]: [bf9994dc --> bf907d05] win32k!NtGdiDdBlt
[ 39]: [bf9994e0 --> bf907adf] win32k!NtGdiDdCanCreateSurface
[ 3a]: [bf9994e4 --> bf933885] win32k!NtGdiDdCanCreateD3DBuffer
[ 3b]: [bf9994e8 --> bf933796] win32k!NtGdiDdColorControl
[ 3c]: [bf9994ec --> bf8edd93] win32k!NtGdiDdCreateDirectDrawObject
[ 3d]: [bf9994f0 --> bf8edda6] win32k!NtGdiDdCreateSurface
[ 3e]: [bf9994f4 --> bf93386f] win32k!NtGdiDdCreateD3DBuffer
[ 3f]: [bf9994f8 --> bf907b1e] win32k!NtGdiDdCreateMoComp
[ 40]: [bf9994fc --> bf90815d] win32k!NtGdiDdCreateSurfaceObject
[ 41]: [bf999500 --> bf8edfef] win32k!NtGdiDdDeleteDirectDrawObject
[ 42]: [bf999504 --> bf907cc6] win32k!NtGdiDdDeleteSurfaceObject
[ 43]: [bf999508 --> bf907af2] win32k!NtGdiDdDestroyMoComp
[ 44]: [bf99950c --> bf8edfd9] win32k!NtGdiDdDestroySurface
[ 45]: [bf999510 --> bf933898] win32k!NtGdiDdDestroyD3DBuffer
[ 46]: [bf999514 --> bf93398b] win32k!NtGdiDdEndMoCompFrame
[ 47]: [bf999518 --> bf908203] win32k!NtGdiDdFlip
[ 48]: [bf99951c --> bf90890e] win32k!NtGdiDdFlipToGDISurface
[ 49]: [bf999520 --> bf907cdc] win32k!NtGdiDdGetAvailDriverMemory
[ 4a]: [bf999524 --> bf9337a9] win32k!NtGdiDdGetBltStatus
[ 4b]: [bf999528 --> bf907a4a] win32k!NtGdiDdGetDC
[ 4c]: [bf99952c --> bf907a89] win32k!NtGdiDdGetDriverInfo
[ 4d]: [bf999530 --> bf933817] win32k!NtGdiDdGetDxHandle
[ 4e]: [bf999534 --> bf9337bf] win32k!NtGdiDdGetFlipStatus
[ 4f]: [bf999538 --> bf933962] win32k!NtGdiDdGetInternalMoCompInfo
[ 50]: [bf99953c --> bf93394c] win32k!NtGdiDdGetMoCompBuffInfo
[ 51]: [bf999540 --> bf907b08] win32k!NtGdiDdGetMoCompGuids
[ 52]: [bf999544 --> bf933936] win32k!NtGdiDdGetMoCompFormats
[ 53]: [bf999548 --> bf908a14] win32k!NtGdiDdGetScanLine
[ 54]: [bf99954c --> bf8e42af] win32k!NtGdiDdLock
[ 55]: [bf999550 --> bf933843] win32k!NtGdiDdLockD3D
[ 56]: [bf999554 --> bf8edd32] win32k!NtGdiDdQueryDirectDrawObject
[ 57]: [bf999558 --> bf9339b7] win32k!NtGdiDdQueryMoCompStatus
[ 58]: [bf99955c --> bf8edd6d] win32k!NtGdiDdReenableDirectDrawObject
[ 59]: [bf999560 --> bf907bbe] win32k!NtGdiDdReleaseDC
[ 5a]: [bf999564 --> bf9339a1] win32k!NtGdiDdRenderMoComp
[ 5b]: [bf999568 --> bf8e40f5] win32k!NtGdiDdResetVisrgn
[ 5c]: [bf99956c --> bf908219] win32k!NtGdiDdSetColorKey
[ 5d]: [bf999570 --> bf9337d5] win32k!NtGdiDdSetExclusiveMode
[ 5e]: [bf999574 --> bf93382d] win32k!NtGdiDdSetGammaRamp
[ 5f]: [bf999578 --> bf933920] win32k!NtGdiDdCreateSurfaceEx
[ 60]: [bf99957c --> bf9337eb] win32k!NtGdiDdSetOverlayPosition
[ 61]: [bf999580 --> bf907d92] win32k!NtGdiDdUnattachSurface
[ 62]: [bf999584 --> bf8e40a5] win32k!NtGdiDdUnlock
[ 63]: [bf999588 --> bf933859] win32k!NtGdiDdUnlockD3D
[ 64]: [bf99958c --> bf9081ed] win32k!NtGdiDdUpdateOverlay
[ 65]: [bf999590 --> bf933801] win32k!NtGdiDdWaitForVerticalBlank
[ 66]: [bf999594 --> bf9339e0] win32k!NtGdiDvpCanCreateVideoPort
[ 67]: [bf999598 --> bf9339f6] win32k!NtGdiDvpColorControl
[ 68]: [bf99959c --> bf933a0c] win32k!NtGdiDvpCreateVideoPort
[ 69]: [bf9995a0 --> bf933a22] win32k!NtGdiDvpDestroyVideoPort
[ 6a]: [bf9995a4 --> bf933a38] win32k!NtGdiDvpFlipVideoPort
[ 6b]: [bf9995a8 --> bf933a4e] win32k!NtGdiDvpGetVideoPortBandwidth
[ 6c]: [bf9995ac --> bf933a64] win32k!NtGdiDvpGetVideoPortField
[ 6d]: [bf9995b0 --> bf933a7a] win32k!NtGdiDvpGetVideoPortFlipStatus
[ 6e]: [bf9995b4 --> bf933a90] win32k!NtGdiDvpGetVideoPortInputFormats
[ 6f]: [bf9995b8 --> bf933aa6] win32k!NtGdiDvpGetVideoPortLine
[ 70]: [bf9995bc --> bf933abc] win32k!NtGdiDvpGetVideoPortOutputFormats
[ 71]: [bf9995c0 --> bf933ad2] win32k!NtGdiDvpGetVideoPortConnectInfo
[ 72]: [bf9995c4 --> bf933ae8] win32k!NtGdiDvpGetVideoSignalStatus
[ 73]: [bf9995c8 --> bf933afe] win32k!NtGdiDvpUpdateVideoPort
[ 74]: [bf9995cc --> bf933b14] win32k!NtGdiDvpWaitForVideoPortSync
[ 75]: [bf9995d0 --> bf933b2a] win32k!NtGdiDvpAcquireNotification
[ 76]: [bf9995d4 --> bf933b40] win32k!NtGdiDvpReleaseNotification
[ 77]: [bf9995d8 --> bf933770] win32k!NtGdiDxgGenericThunk
[ 78]: [bf9995dc --> bf8dcadf] win32k!NtGdiDeleteClientObj
[ 79]: [bf9995e0 --> bf949d50] win32k!NtGdiDeleteColorSpace
[ 7a]: [bf9995e4 --> bf94af18] win32k!NtGdiDeleteColorTransform
[ 7b]: [bf9995e8 --> bf80fb23] win32k!NtGdiDeleteObjectApp
[ 7c]: [bf9995ec --> bf94944e] win32k!NtGdiDescribePixelFormat
[ 7d]: [bf9995f0 --> bf8faebb] win32k!NtGdiGetPerBandInfo
[ 7e]: [bf9995f4 --> bf8fc502] win32k!NtGdiDoBanding
[ 7f]: [bf9995f8 --> bf843898] win32k!NtGdiDoPalette
[ 80]: [bf9995fc --> bf9482e9] win32k!NtGdiDrawEscape
[ 81]: [bf999600 --> bf8d41b0] win32k!NtGdiEllipse
[ 82]: [bf999604 --> bf89bbe3] win32k!NtGdiEnableEudc
[ 83]: [bf999608 --> bf8fbe4b] win32k!NtGdiEndDoc
[ 84]: [bf99960c --> bf9052ee] win32k!NtGdiEndPage
[ 85]: [bf999610 --> bf9008d3] win32k!NtGdiEndPath
[ 86]: [bf999614 --> bf88768a] win32k!NtGdiEnumFontChunk
[ 87]: [bf999618 --> bf887609] win32k!NtGdiEnumFontClose
[ 88]: [bf99961c --> bf886c98] win32k!NtGdiEnumFontOpen
[ 89]: [bf999620 --> bf8d19a1] win32k!NtGdiEnumObjects
[ 8a]: [bf999624 --> bf9387b6] win32k!NtGdiEqualRgn
[ 8b]: [bf999628 --> bf94f4f3] win32k!NtGdiEudcLoadUnloadLink
[ 8c]: [bf99962c --> bf82d2c1] win32k!NtGdiExcludeClipRect
[ 8d]: [bf999630 --> bf8c9d87] win32k!NtGdiExtCreatePen
[ 8e]: [bf999634 --> bf840c15] win32k!NtGdiExtCreateRegion
[ 8f]: [bf999638 --> bf8bfb6c] win32k!NtGdiExtEscape
[ 90]: [bf99963c --> bf950311] win32k!NtGdiExtFloodFill
[ 91]: [bf999640 --> bf82c1c7] win32k!NtGdiExtGetObjectW
[ 92]: [bf999644 --> bf80f2e7] win32k!NtGdiExtSelectClipRgn
[ 93]: [bf999648 --> bf82928c] win32k!NtGdiExtTextOutW
[ 94]: [bf99964c --> bf947486] win32k!NtGdiFillPath
[ 95]: [bf999650 --> bf875583] win32k!NtGdiFillRgn
[ 96]: [bf999654 --> bf9473eb] win32k!NtGdiFlattenPath
[ 97]: [bf999658 --> bf80c24f] win32k!NtGdiFlushUserBatch
[ 98]: [bf99965c --> bf807a02] win32k!NtGdiFlush
[ 99]: [bf999660 --> bf94932e] win32k!NtGdiForceUFIMapping
[ 9a]: [bf999664 --> bf88cdf9] win32k!NtGdiFrameRgn
[ 9b]: [bf999668 --> bf93b48f] win32k!NtGdiFullscreenControl
[ 9c]: [bf99966c --> bf8c9058] win32k!NtGdiGetAndSetDCDword
[ 9d]: [bf999670 --> bf816afe] win32k!NtGdiGetAppClipBox
[ 9e]: [bf999674 --> bf875a76] win32k!NtGdiGetBitmapBits
[ 9f]: [bf999678 --> bf949250] win32k!NtGdiGetBitmapDimension
[ a0]: [bf99967c --> bf8bd5dd] win32k!NtGdiGetBoundsRect
[ a1]: [bf999680 --> bf8f91ba] win32k!NtGdiGetCharABCWidthsW
[ a2]: [bf999684 --> bf9479f4] win32k!NtGdiGetCharacterPlacementW
[ a3]: [bf999688 --> bf80f8b3] win32k!NtGdiGetCharSet
[ a4]: [bf99968c --> bf8eb49e] win32k!NtGdiGetCharWidthW
[ a5]: [bf999690 --> bf882e1c] win32k!NtGdiGetCharWidthInfo
[ a6]: [bf999694 --> bf94860b] win32k!NtGdiGetColorAdjustment
[ a7]: [bf999698 --> bf950bc6] win32k!NtGdiGetColorSpaceforBitmap
[ a8]: [bf99969c --> bf82c494] win32k!NtGdiGetDCDword
[ a9]: [bf9996a0 --> bf836294] win32k!NtGdiGetDCforBitmap
[ aa]: [bf9996a4 --> bf82c321] win32k!NtGdiGetDCObject
[ ab]: [bf9996a8 --> bf8c5409] win32k!NtGdiGetDCPoint
[ ac]: [bf9996ac --> bf948807] win32k!NtGdiGetDeviceCaps
[ ad]: [bf9996b0 --> bf94a2ef] win32k!NtGdiGetDeviceGammaRamp
[ ae]: [bf9996b4 --> bf8fa227] win32k!NtGdiGetDeviceCapsAll
[ af]: [bf9996b8 --> bf84567d] win32k!NtGdiGetDIBitsInternal
[ b0]: [bf9996bc --> bf951b29] win32k!NtGdiGetETM
[ b1]: [bf9996c0 --> bf94cf95] win32k!NtGdiGetEudcTimeStampEx
[ b2]: [bf9996c4 --> bf8ecc8c] win32k!NtGdiGetFontData
[ b3]: [bf9996c8 --> bf948aa6] win32k!NtGdiGetFontResourceInfoInternalW
[ b4]: [bf9996cc --> bf949731] win32k!NtGdiGetGlyphIndicesW
[ b5]: [bf9996d0 --> bf9495d4] win32k!NtGdiGetGlyphIndicesWInternal
[ b6]: [bf9996d4 --> bf9483fc] win32k!NtGdiGetGlyphOutline
[ b7]: [bf9996d8 --> bf948501] win32k!NtGdiGetKerningPairs
[ b8]: [bf9996dc --> bf9357bb] win32k!NtGdiGetLinkedUFIs
[ b9]: [bf9996e0 --> bf8e657f] win32k!NtGdiGetMiterLimit
[ ba]: [bf9996e4 --> bf93e3b6] win32k!NtGdiGetMonitorID
[ bb]: [bf9996e8 --> bf82d417] win32k!NtGdiGetNearestColor
[ bc]: [bf9996ec --> bf94bd6e] win32k!NtGdiGetNearestPaletteIndex
[ bd]: [bf9996f0 --> bf948592] win32k!NtGdiGetObjectBitmapHandle
[ be]: [bf9996f4 --> bf8eab87] win32k!NtGdiGetOutlineTextMetricsInternalW
[ bf]: [bf9996f8 --> bf947853] win32k!NtGdiGetPath
[ c0]: [bf9996fc --> bf84666d] win32k!NtGdiGetPixel
[ c1]: [bf999700 --> bf80f2f7] win32k!NtGdiGetRandomRgn
[ c2]: [bf999704 --> bf8ed7ca] win32k!NtGdiGetRasterizerCaps
[ c3]: [bf999708 --> bf9497dc] win32k!NtGdiGetRealizationInfo
[ c4]: [bf99970c --> bf87f1b4] win32k!NtGdiGetRegionData
[ c5]: [bf999710 --> bf8c5353] win32k!NtGdiGetRgnBox
[ c6]: [bf999714 --> bf91023c] win32k!NtGdiGetServerMetaFileBits
[ c7]: [bf999718 --> bf890c97] win32k!NtGdiGetSpoolMessage
[ c8]: [bf99971c --> bf951ca6] win32k!NtGdiGetStats
[ c9]: [bf999720 --> bf81fa30] win32k!NtGdiGetStockObject
[ ca]: [bf999724 --> bf94eb87] win32k!NtGdiGetStringBitmapW
[ cb]: [bf999728 --> bf8f4c41] win32k!NtGdiGetSystemPaletteUse
[ cc]: [bf99972c --> bf837d45] win32k!NtGdiGetTextCharsetInfo
[ cd]: [bf999730 --> bf84ab72] win32k!NtGdiGetTextExtent
[ ce]: [bf999734 --> bf8d1207] win32k!NtGdiGetTextExtentExW
[ cf]: [bf999738 --> bf839de4] win32k!NtGdiGetTextFaceW
[ d0]: [bf99973c --> bf837ba3] win32k!NtGdiGetTextMetricsW
[ d1]: [bf999740 --> bf8bc64f] win32k!NtGdiGetTransform
[ d2]: [bf999744 --> bf948ced] win32k!NtGdiGetUFI
[ d3]: [bf999748 --> bf948db6] win32k!NtGdiGetEmbUFI
[ d4]: [bf99974c --> bf948e96] win32k!NtGdiGetUFIPathname
[ d5]: [bf999750 --> bf948c6e] win32k!NtGdiGetEmbedFonts
[ d6]: [bf999754 --> bf948c78] win32k!NtGdiChangeGhostFont
[ d7]: [bf999758 --> bf934aed] win32k!NtGdiAddEmbFontToDC
[ d8]: [bf99975c --> bf949755] win32k!NtGdiGetFontUnicodeRanges
[ d9]: [bf999760 --> bf838ff4] win32k!NtGdiGetWidthTable
[ da]: [bf999764 --> bf88e033] win32k!NtGdiGradientFill
[ db]: [bf999768 --> bf837891] win32k!NtGdiHfontCreate
[ dc]: [bf99976c --> bf94a8d3] win32k!NtGdiIcmBrushInfo
[ dd]: [bf999770 --> bf87c3bc] win32k!NtGdiInit
[ de]: [bf999774 --> bf89dc09] win32k!NtGdiInitSpool
[ df]: [bf999778 --> bf816627] win32k!NtGdiIntersectClipRect
[ e0]: [bf99977c --> bf8f8704] win32k!NtGdiInvertRgn
[ e1]: [bf999780 --> bf8c6c65] win32k!NtGdiLineTo
[ e2]: [bf999784 --> bf9494c8] win32k!NtGdiMakeFontDir
[ e3]: [bf999788 --> bf950bff] win32k!NtGdiMakeInfoDC
[ e4]: [bf99978c --> bf8386f2] win32k!NtGdiMaskBlt
[ e5]: [bf999790 --> bf8bc42c] win32k!NtGdiModifyWorldTransform
[ e6]: [bf999794 --> bf8e6752] win32k!NtGdiMonoBitmap
[ e7]: [bf999798 --> bf948799] win32k!NtGdiMoveTo
[ e8]: [bf99979c --> bf8fc39d] win32k!NtGdiOffsetClipRgn
[ e9]: [bf9997a0 --> bf8367a8] win32k!NtGdiOffsetRgn
[ ea]: [bf9997a4 --> bf838c10] win32k!NtGdiOpenDCW
[ eb]: [bf9997a8 --> bf8c49c1] win32k!NtGdiPatBlt
[ ec]: [bf9997ac --> bf82f42b] win32k!NtGdiPolyPatBlt
[ ed]: [bf9997b0 --> bf947560] win32k!NtGdiPathToRegion
[ ee]: [bf9997b4 --> bf94312d] win32k!NtGdiPlgBlt
[ ef]: [bf9997b8 --> bf947e87] win32k!NtGdiPolyDraw
[ f0]: [bf9997bc --> bf84ea6e] win32k!NtGdiPolyPolyDraw
[ f1]: [bf9997c0 --> bf947f84] win32k!NtGdiPolyTextOutW
[ f2]: [bf9997c4 --> bf948887] win32k!NtGdiPtInRegion
[ f3]: [bf9997c8 --> bf938958] win32k!NtGdiPtVisible
[ f4]: [bf9997cc --> bf9488a7] win32k!NtGdiQueryFonts
[ f5]: [bf9997d0 --> bf87c8cd] win32k!NtGdiQueryFontAssocInfo
[ f6]: [bf9997d4 --> bf8e3601] win32k!NtGdiRectangle
[ f7]: [bf9997d8 --> bf8ee042] win32k!NtGdiRectInRegion
[ f8]: [bf9997dc --> bf8351f2] win32k!NtGdiRectVisible
[ f9]: [bf9997e0 --> bf8d0ae2] win32k!NtGdiRemoveFontResourceW
[ fa]: [bf9997e4 --> bf948a8a] win32k!NtGdiRemoveFontMemResourceEx
[ fb]: [bf9997e8 --> bf8e3060] win32k!NtGdiResetDC
[ fc]: [bf9997ec --> bf94bfe2] win32k!NtGdiResizePalette
[ fd]: [bf9997f0 --> bf82e80f] win32k!NtGdiRestoreDC
[ fe]: [bf9997f4 --> bf90e07e] win32k!NtGdiRoundRect
[ ff]: [bf9997f8 --> bf82e81f] win32k!NtGdiSaveDC
[ 100]: [bf9997fc --> bf94131f] win32k!NtGdiScaleViewportExtEx
[ 101]: [bf999800 --> bf9491dc] win32k!NtGdiScaleWindowExtEx
[ 102]: [bf999804 --> bf808d86] win32k!GreSelectBitmap
[ 103]: [bf999808 --> bf948779] win32k!NtGdiSelectBrush
[ 104]: [bf99980c --> bf9009ce] win32k!NtGdiSelectClipPath
[ 105]: [bf999810 --> bf8210cb] win32k!NtGdiSelectFont
[ 106]: [bf999814 --> bf948789] win32k!NtGdiSelectPen
[ 107]: [bf999818 --> bf89d5f2] win32k!NtGdiSetBitmapAttributes
[ 108]: [bf99981c --> bf8c4309] win32k!NtGdiSetBitmapBits
[ 109]: [bf999820 --> bf9492ba] win32k!NtGdiSetBitmapDimension
[ 10a]: [bf999824 --> bf8bd9e4] win32k!NtGdiSetBoundsRect
[ 10b]: [bf999828 --> bf948827] win32k!NtGdiSetBrushAttributes
[ 10c]: [bf99982c --> bf8c43a7] win32k!NtGdiSetBrushOrg
[ 10d]: [bf999830 --> bf94866c] win32k!NtGdiSetColorAdjustment
[ 10e]: [bf999834 --> bf949e12] win32k!NtGdiSetColorSpace
[ 10f]: [bf999838 --> bf94a62b] win32k!NtGdiSetDeviceGammaRamp
[ 110]: [bf99983c --> bf82bbeb] win32k!NtGdiSetDIBitsToDeviceInternal
[ 111]: [bf999840 --> bf8b82ba] win32k!NtGdiSetFontEnumeration
[ 112]: [bf999844 --> bf8dce95] win32k!NtGdiSetFontXform
[ 113]: [bf999848 --> bf8c65a8] win32k!NtGdiSetIcmMode
[ 114]: [bf99984c --> bf8fabb9] win32k!NtGdiSetLinkedUFIs
[ 115]: [bf999850 --> bf94c26c] win32k!NtGdiSetMagicColors
[ 116]: [bf999854 --> bf8dcc14] win32k!NtGdiSetMetaRgn
[ 117]: [bf999858 --> bf8dcc36] win32k!NtGdiSetMiterLimit
[ 118]: [bf99985c --> bf9491cc] win32k!NtGdiGetDeviceWidth
[ 119]: [bf999860 --> bf9491bc] win32k!NtGdiMirrorWindowOrg
[ 11a]: [bf999864 --> bf82d1c9] win32k!NtGdiSetLayout
[ 11b]: [bf999868 --> bf8468af] win32k!NtGdiSetPixel
[ 11c]: [bf99986c --> bf952970] win32k!NtGdiSetPixelFormat
[ 11d]: [bf999870 --> bf948877] win32k!NtGdiSetRectRgn
[ 11e]: [bf999874 --> bf948817] win32k!NtGdiSetSystemPaletteUse
[ 11f]: [bf999878 --> bf951f36] win32k!NtGdiSetTextJustification
[ 120]: [bf99987c --> bf8992a6] win32k!NtGdiSetupPublicCFONT
[ 121]: [bf999880 --> bf8dca38] win32k!NtGdiSetVirtualResolution
[ 122]: [bf999884 --> bf8dcf06] win32k!NtGdiSetSizeDevice
[ 123]: [bf999888 --> bf9041c6] win32k!NtGdiStartDoc
[ 124]: [bf99988c --> bf90513f] win32k!NtGdiStartPage
[ 125]: [bf999890 --> bf881872] win32k!NtGdiStretchBlt
[ 126]: [bf999894 --> bf848dfd] win32k!NtGdiStretchDIBitsInternal
[ 127]: [bf999898 --> bf8ff549] win32k!NtGdiStrokeAndFillPath
[ 128]: [bf99989c --> bf947767] win32k!NtGdiStrokePath
[ 129]: [bf9998a0 --> bf952b18] win32k!NtGdiSwapBuffers
[ 12a]: [bf9998a4 --> bf8c4b54] win32k!NtGdiTransformPoints
[ 12b]: [bf9998a8 --> bf8bbdaf] win32k!NtGdiTransparentBlt
[ 12c]: [bf9998ac --> bf94939f] win32k!NtGdiUnloadPrinterDriver
[ 12d]: [bf9998b0 --> bf952dd6] win32k!NtGdiUnmapMemFont
[ 12e]: [bf9998b4 --> bf948867] win32k!NtGdiUnrealizeObject
[ 12f]: [bf9998b8 --> bf94c27c] win32k!NtGdiUpdateColors
[ 130]: [bf9998bc --> bf947648] win32k!NtGdiWidenPath
[ 131]: [bf9998c0 --> bf8855d0] win32k!NtUserActivateKeyboardLayout
[ 132]: [bf9998c4 --> bf88b0ee] win32k!NtUserAlterWindowStyle
[ 133]: [bf9998c8 --> bf9143f8] win32k!NtUserAssociateInputContext
[ 134]: [bf9998cc --> bf8f519c] win32k!NtUserAttachThreadInput
[ 135]: [bf9998d0 --> bf815a6d] win32k!NtUserBeginPaint
[ 136]: [bf9998d4 --> bf8f4c67] win32k!NtUserBitBltSysBmp
[ 137]: [bf9998d8 --> bf912d94] win32k!NtUserBlockInput
[ 138]: [bf9998dc --> bf91452f] win32k!NtUserBuildHimcList
[ 139]: [bf9998e0 --> bf8360b3] win32k!NtUserBuildHwndList
[ 13a]: [bf9998e4 --> bf86b9f4] win32k!NtUserBuildNameList
[ 13b]: [bf9998e8 --> bf912b57] win32k!NtUserBuildPropList
[ 13c]: [bf9998ec --> bf8c208c] win32k!NtUserCallHwnd
[ 13d]: [bf9998f0 --> bf8366ef] win32k!NtUserCallHwndLock
[ 13e]: [bf9998f4 --> bf89ac2c] win32k!NtUserCallHwndOpt
[ 13f]: [bf9998f8 --> bf8368e2] win32k!NtUserCallHwndParam
[ 140]: [bf9998fc --> bf828813] win32k!NtUserCallHwndParamLock
[ 141]: [bf999900 --> bf8f4b76] win32k!NtUserCallMsgFilter
[ 142]: [bf999904 --> bf8f655f] win32k!NtUserCallNextHookEx
[ 143]: [bf999908 --> bf8010df] win32k!NtUserCallNoParam
[ 144]: [bf99990c --> bf801097] win32k!NtUserCallOneParam
[ 145]: [bf999910 --> bf8368a2] win32k!NtUserCallTwoParam
[ 146]: [bf999914 --> bf8f974d] win32k!NtUserChangeClipboardChain
[ 147]: [bf999918 --> bf8b689c] win32k!NtUserChangeDisplaySettings
[ 148]: [bf99991c --> bf86c501] win32k!NtUserCheckImeHotKey
[ 149]: [bf999920 --> bf8cca4b] win32k!NtUserCheckMenuItem
[ 14a]: [bf999924 --> bf8940b7] win32k!NtUserChildWindowFromPointEx
[ 14b]: [bf999928 --> bf8fa9d9] win32k!NtUserClipCursor
[ 14c]: [bf99992c --> bf8f8609] win32k!NtUserCloseClipboard
[ 14d]: [bf999930 --> bf86b6cf] win32k!NtUserCloseDesktop
[ 14e]: [bf999934 --> bf86b791] win32k!NtUserCloseWindowStation
[ 14f]: [bf999938 --> bf87bdf0] win32k!NtUserConsoleControl
[ 150]: [bf99993c --> bf8ea9b4] win32k!NtUserConvertMemHandle
[ 151]: [bf999940 --> bf90d6b7] win32k!NtUserCopyAcceleratorTable
[ 152]: [bf999944 --> bf8f4c1b] win32k!NtUserCountClipboardFormats
[ 153]: [bf999948 --> bf84b4cf] win32k!NtUserCreateAcceleratorTable
[ 154]: [bf99994c --> bf8733b4] win32k!NtUserCreateCaret
[ 155]: [bf999950 --> bf89d1d8] win32k!NtUserCreateDesktop
[ 156]: [bf999954 --> bf91435e] win32k!NtUserCreateInputContext
[ 157]: [bf999958 --> bf8f9aa8] win32k!NtUserCreateLocalMemHandle
[ 158]: [bf99995c --> bf834af6] win32k!NtUserCreateWindowEx
[ 159]: [bf999960 --> bf89d949] win32k!NtUserCreateWindowStation
[ 15a]: [bf999964 --> bf911be1] win32k!NtUserDdeGetQualityOfService
[ 15b]: [bf999968 --> bf89b8dd] win32k!NtUserDdeInitialize
[ 15c]: [bf99996c --> bf911b11] win32k!NtUserDdeSetQualityOfService
[ 15d]: [bf999970 --> bf86c82e] win32k!NtUserDeferWindowPos
[ 15e]: [bf999974 --> bf86cbf4] win32k!NtUserDefSetText
[ 15f]: [bf999978 --> bf8737e0] win32k!NtUserDeleteMenu
[ 160]: [bf99997c --> bf8fa978] win32k!NtUserDestroyAcceleratorTable
[ 161]: [bf999980 --> bf835e37] win32k!NtUserDestroyCursor
[ 162]: [bf999984 --> bf9143ae] win32k!NtUserDestroyInputContext
[ 163]: [bf999988 --> bf845a1f] win32k!NtUserDestroyMenu
[ 164]: [bf99998c --> bf866c76] win32k!NtUserDestroyWindow
[ 165]: [bf999990 --> bf914b66] win32k!NtUserDisableThreadIme
[ 166]: [bf999994 --> bf80ed89] win32k!NtUserDispatchMessage
[ 167]: [bf999998 --> bf912c52] win32k!NtUserDragDetect
[ 168]: [bf99999c --> bf9110d5] win32k!NtUserDragObject
[ 169]: [bf9999a0 --> bf911db1] win32k!NtUserDrawAnimatedRects
[ 16a]: [bf9999a4 --> bf911e74] win32k!NtUserDrawCaption
[ 16b]: [bf9999a8 --> bf90b537] win32k!NtUserDrawCaptionTemp
[ 16c]: [bf9999ac --> bf83c221] win32k!NtUserDrawIconEx
[ 16d]: [bf9999b0 --> bf912e1f] win32k!NtUserDrawMenuBarTemp
[ 16e]: [bf9999b4 --> bf8ea639] win32k!NtUserEmptyClipboard
[ 16f]: [bf9999b8 --> bf8c550e] win32k!NtUserEnableMenuItem
[ 170]: [bf9999bc --> bf911a8c] win32k!NtUserEnableScrollBar
[ 171]: [bf9999c0 --> bf82cdb7] win32k!NtUserEndDeferWindowPosEx
[ 172]: [bf9999c4 --> bf911f1d] win32k!NtUserEndMenu
[ 173]: [bf9999c8 --> bf815724] win32k!NtUserEndPaint
[ 174]: [bf9999cc --> bf880b0c] win32k!NtUserEnumDisplayDevices
[ 175]: [bf9999d0 --> bf835801] win32k!NtUserEnumDisplayMonitors
[ 176]: [bf9999d4 --> bf8c0e17] win32k!NtUserEnumDisplaySettings
[ 177]: [bf9999d8 --> bf911362] win32k!NtUserEvent
[ 178]: [bf9999dc --> bf8f890a] win32k!NtUserExcludeUpdateRgn
[ 179]: [bf9999e0 --> bf8f4aad] win32k!NtUserFillWindow
[ 17a]: [bf9999e4 --> bf81b77e] win32k!NtUserFindExistingCursorIcon
[ 17b]: [bf9999e8 --> bf869562] win32k!NtUserFindWindowEx
[ 17c]: [bf9999ec --> bf914f55] win32k!NtUserFlashWindowEx
[ 17d]: [bf9999f0 --> bf8e885b] win32k!NtUserGetAltTabInfo
[ 17e]: [bf9999f4 --> bf82c9c9] win32k!NtUserGetAncestor
[ 17f]: [bf9999f8 --> bf914903] win32k!NtUserGetAppImeLevel
[ 180]: [bf9999fc --> bf87146d] win32k!NtUserGetAsyncKeyState
[ 181]: [bf999a00 --> bf834cd2] win32k!NtUserGetAtomName
[ 182]: [bf999a04 --> bf842297] win32k!NtUserGetCaretBlinkTime
[ 183]: [bf999a08 --> bf8c50b2] win32k!NtUserGetCaretPos
[ 184]: [bf999a0c --> bf843559] win32k!NtUserGetClassInfo
[ 185]: [bf999a10 --> bf82c6fa] win32k!NtUserGetClassName
[ 186]: [bf999a14 --> bf8f98e3] win32k!NtUserGetClipboardData
[ 187]: [bf999a18 --> bf8ee107] win32k!NtUserGetClipboardFormatName
[ 188]: [bf999a1c --> bf8ea72f] win32k!NtUserGetClipboardOwner
[ 189]: [bf999a20 --> bf8c4e6b] win32k!NtUserGetClipboardSequenceNumber
[ 18a]: [bf999a24 --> bf911f63] win32k!NtUserGetClipboardViewer
[ 18b]: [bf999a28 --> bf9119f4] win32k!NtUserGetClipCursor
[ 18c]: [bf999a2c --> bf91162a] win32k!NtUserGetComboBoxInfo
[ 18d]: [bf999a30 --> bf882d33] win32k!NtUserGetControlBrush
[ 18e]: [bf999a34 --> bf9075cb] win32k!NtUserGetControlColor
[ 18f]: [bf999a38 --> bf821662] win32k!NtUserGetCPD
[ 190]: [bf999a3c --> bf882fd2] win32k!NtUserGetCursorFrameInfo
[ 191]: [bf999a40 --> bf911747] win32k!NtUserGetCursorInfo
[ 192]: [bf999a44 --> bf804547] win32k!NtUserGetDC
[ 193]: [bf999a48 --> bf83a237] win32k!NtUserGetDCEx
[ 194]: [bf999a4c --> bf83b202] win32k!NtUserGetDoubleClickTime
[ 195]: [bf999a50 --> bf820d48] win32k!NtUserGetForegroundWindow
[ 196]: [bf999a54 --> bf91119e] win32k!NtUserGetGuiResources
[ 197]: [bf999a58 --> bf869f06] win32k!NtUserGetGUIThreadInfo
[ 198]: [bf999a5c --> bf842cc5] win32k!NtUserGetIconInfo
[ 199]: [bf999a60 --> bf842e15] win32k!NtUserGetIconSize
[ 19a]: [bf999a64 --> bf9147c1] win32k!NtUserGetImeHotKey
[ 19b]: [bf999a68 --> bf914631] win32k!NtUserGetImeInfoEx
[ 19c]: [bf999a6c --> bf9113f3] win32k!NtUserGetInternalWindowPos
[ 19d]: [bf999a70 --> bf835528] win32k!NtUserGetKeyboardLayoutList
[ 19e]: [bf999a74 --> bf8f5ff8] win32k!NtUserGetKeyboardLayoutName
[ 19f]: [bf999a78 --> bf87606e] win32k!NtUserGetKeyboardState
[ 1a0]: [bf999a7c --> bf90b884] win32k!NtUserGetKeyNameText
[ 1a1]: [bf999a80 --> bf820ff3] win32k!NtUserGetKeyState
[ 1a2]: [bf999a84 --> bf9116f3] win32k!NtUserGetListBoxInfo
[ 1a3]: [bf999a88 --> bf911844] win32k!NtUserGetMenuBarInfo
[ 1a4]: [bf999a8c --> bf911c9a] win32k!NtUserGetMenuIndex
[ 1a5]: [bf999a90 --> bf9127ce] win32k!NtUserGetMenuItemRect
[ 1a6]: [bf999a94 --> bf819fc9] win32k!NtUserGetMessage
[ 1a7]: [bf999a98 --> bf9124a9] win32k!NtUserGetMouseMovePointsEx
[ 1a8]: [bf999a9c --> bf81a241] win32k!NtUserGetObjectInformation
[ 1a9]: [bf999aa0 --> bf8f4bef] win32k!NtUserGetOpenClipboardWindow
[ 1aa]: [bf999aa4 --> bf911f8f] win32k!NtUserGetPriorityClipboardFormat
[ 1ab]: [bf999aa8 --> bf81a0ac] win32k!NtUserGetProcessWindowStation
[ 1ac]: [bf999aac --> bf9157d5] win32k!NtUserGetRawInputBuffer
[ 1ad]: [bf999ab0 --> bf9150d5] win32k!NtUserGetRawInputData
[ 1ae]: [bf999ab4 --> bf9152af] win32k!NtUserGetRawInputDeviceInfo
[ 1af]: [bf999ab8 --> bf9155a4] win32k!NtUserGetRawInputDeviceList
[ 1b0]: [bf999abc --> bf91579a] win32k!NtUserGetRegisteredRawInputDevices
[ 1b1]: [bf999ac0 --> bf84624e] win32k!NtUserGetScrollBarInfo
[ 1b2]: [bf999ac4 --> bf840ace] win32k!NtUserGetSystemMenu
[ 1b3]: [bf999ac8 --> bf81a4f7] win32k!NtUserGetThreadDesktop
[ 1b4]: [bf999acc --> bf823b41] win32k!NtUserGetThreadState
[ 1b5]: [bf999ad0 --> bf83a4c1] win32k!NtUserGetTitleBarInfo
[ 1b6]: [bf999ad4 --> bf83b02f] win32k!NtUserGetUpdateRect
[ 1b7]: [bf999ad8 --> bf8c51fa] win32k!NtUserGetUpdateRgn
[ 1b8]: [bf999adc --> bf803811] win32k!NtUserGetWindowDC
[ 1b9]: [bf999ae0 --> bf8f9b76] win32k!NtUserGetWindowPlacement
[ 1ba]: [bf999ae4 --> bf90da63] win32k!NtUserGetWOWClass
[ 1bb]: [bf999ae8 --> bf910fdf] win32k!NtUserHardErrorControl
[ 1bc]: [bf999aec --> bf82ce91] win32k!NtUserHideCaret
[ 1bd]: [bf999af0 --> bf912018] win32k!NtUserHiliteMenuItem
[ 1be]: [bf999af4 --> bf912dba] win32k!NtUserImpersonateDdeClientWindow
[ 1bf]: [bf999af8 --> bf8b1d7e] win32k!NtUserInitialize
[ 1c0]: [bf999afc --> bf8ac31e] win32k!NtUserInitializeClientPfnArrays
[ 1c1]: [bf999b00 --> bf9114d2] win32k!NtUserInitTask
[ 1c2]: [bf999b04 --> bf83a5bd] win32k!NtUserInternalGetWindowText
[ 1c3]: [bf999b08 --> bf814dbb] win32k!NtUserInvalidateRect
[ 1c4]: [bf999b0c --> bf8459c5] win32k!NtUserInvalidateRgn
[ 1c5]: [bf999b10 --> bf8c4e31] win32k!NtUserIsClipboardFormatAvailable
[ 1c6]: [bf999b14 --> bf80ea37] win32k!NtUserKillTimer
[ 1c7]: [bf999b18 --> bf891798] win32k!NtUserLoadKeyboardLayoutEx
[ 1c8]: [bf999b1c --> bf89d43a] win32k!NtUserLockWindowStation
[ 1c9]: [bf999b20 --> bf8cc992] win32k!NtUserLockWindowUpdate
[ 1ca]: [bf999b24 --> bf9110b8] win32k!NtUserLockWorkStation
[ 1cb]: [bf999b28 --> bf8c7e35] win32k!NtUserMapVirtualKeyEx
[ 1cc]: [bf999b2c --> bf9128a5] win32k!NtUserMenuItemFromPoint
[ 1cd]: [bf999b30 --> bf80efcd] win32k!NtUserMessageCall
[ 1ce]: [bf999b34 --> bf90f645] win32k!NtUserMinMaximize
[ 1cf]: [bf999b38 --> bf912168] win32k!NtUserMNDragLeave
[ 1d0]: [bf999b3c --> bf9120b8] win32k!NtUserMNDragOver
[ 1d1]: [bf999b40 --> bf8e3267] win32k!NtUserModifyUserStartupInfoFlags
[ 1d2]: [bf999b44 --> bf838ae5] win32k!NtUserMoveWindow
[ 1d3]: [bf999b48 --> bf914b01] win32k!NtUserNotifyIMEStatus
[ 1d4]: [bf999b4c --> bf87c3f2] win32k!NtUserNotifyProcessCreate
[ 1d5]: [bf999b50 --> bf8c54b9] win32k!NtUserNotifyWinEvent
[ 1d6]: [bf999b54 --> bf8f8586] win32k!NtUserOpenClipboard
[ 1d7]: [bf999b58 --> bf86b969] win32k!NtUserOpenDesktop
[ 1d8]: [bf999b5c --> bf899b89] win32k!NtUserOpenInputDesktop
[ 1d9]: [bf999b60 --> bf8f9dbe] win32k!NtUserOpenWindowStation
[ 1da]: [bf999b64 --> bf885886] win32k!NtUserPaintDesktop
[ 1db]: [bf999b68 --> bf803700] win32k!NtUserPeekMessage
[ 1dc]: [bf999b6c --> bf808b4d] win32k!NtUserPostMessage
[ 1dd]: [bf999b70 --> bf86bf40] win32k!NtUserPostThreadMessage
[ 1de]: [bf999b74 --> bf8b83bd] win32k!NtUserPrintWindow
[ 1df]: [bf999b78 --> bf87a14a] win32k!NtUserProcessConnect
[ 1e0]: [bf999b7c --> bf912937] win32k!NtUserQueryInformationThread
[ 1e1]: [bf999b80 --> bf9144ab] win32k!NtUserQueryInputContext
[ 1e2]: [bf999b84 --> bf912ce5] win32k!NtUserQuerySendMessage
[ 1e3]: [bf999b88 --> bf914c0a] win32k!NtUserQueryUserCounters
[ 1e4]: [bf999b8c --> bf803b9c] win32k!NtUserQueryWindow
[ 1e5]: [bf999b90 --> bf911806] win32k!NtUserRealChildWindowFromPoint
[ 1e6]: [bf999b94 --> bf899641] win32k!NtUserRealInternalGetMessage
[ 1e7]: [bf999b98 --> bf91270e] win32k!NtUserRealWaitMessageEx
[ 1e8]: [bf999b9c --> bf823d16] win32k!NtUserRedrawWindow
[ 1e9]: [bf999ba0 --> bf81f433] win32k!NtUserRegisterClassExWOW
[ 1ea]: [bf999ba4 --> bf89dd35] win32k!NtUserRegisterUserApiHook
[ 1eb]: [bf999ba8 --> bf8b7901] win32k!NtUserRegisterHotKey
[ 1ec]: [bf999bac --> bf9156ee] win32k!NtUserRegisterRawInputDevices
[ 1ed]: [bf999bb0 --> bf9115f6] win32k!NtUserRegisterTasklist
[ 1ee]: [bf999bb4 --> bf807b93] win32k!NtUserRegisterWindowMessage
[ 1ef]: [bf999bb8 --> bf8b82e5] win32k!NtUserRemoveMenu
[ 1f0]: [bf999bbc --> bf832c6e] win32k!NtUserRemoveProp
[ 1f1]: [bf999bc0 --> bf892189] win32k!NtUserResolveDesktop
[ 1f2]: [bf999bc4 --> bf9159e5] win32k!NtUserResolveDesktopForWOW
[ 1f3]: [bf999bc8 --> bf8460f5] win32k!NtUserSBGetParms
[ 1f4]: [bf999bcc --> bf879a5a] win32k!NtUserScrollDC
[ 1f5]: [bf999bd0 --> bf8e593a] win32k!NtUserScrollWindowEx
[ 1f6]: [bf999bd4 --> bf83856c] win32k!NtUserSelectPalette
[ 1f7]: [bf999bd8 --> bf8c33ab] win32k!NtUserSendInput
[ 1f8]: [bf999bdc --> bf8bacca] win32k!NtUserSetActiveWindow
[ 1f9]: [bf999be0 --> bf914898] win32k!NtUserSetAppImeLevel
[ 1fa]: [bf999be4 --> bf8724da] win32k!NtUserSetCapture
[ 1fb]: [bf999be8 --> bf845c62] win32k!NtUserSetClassLong
[ 1fc]: [bf999bec --> bf912185] win32k!NtUserSetClassWord
[ 1fd]: [bf999bf0 --> bf8ea8d8] win32k!NtUserSetClipboardData
[ 1fe]: [bf999bf4 --> bf8f9663] win32k!NtUserSetClipboardViewer
[ 1ff]: [bf999bf8 --> bf88636b] win32k!NtUserSetConsoleReserveKeys
[ 200]: [bf999bfc --> bf82126e] win32k!NtUserSetCursor
[ 201]: [bf999c00 --> bf912787] win32k!NtUserSetCursorContents
[ 202]: [bf999c04 --> bf842fa4] win32k!NtUserSetCursorIconData
[ 203]: [bf999c08 --> bf911d1d] win32k!NtUserSetDbgTag
[ 204]: [bf999c0c --> bf83a9b3] win32k!NtUserSetFocus
[ 205]: [bf999c10 --> bf8916c2] win32k!NtUserSetImeHotKey
[ 206]: [bf999c14 --> bf914716] win32k!NtUserSetImeInfoEx
[ 207]: [bf999c18 --> bf91496d] win32k!NtUserSetImeOwnerWindow
[ 208]: [bf999c1c --> bf87c056] win32k!NtUserSetInformationProcess
[ 209]: [bf999c20 --> bf886135] win32k!NtUserSetInformationThread
[ 20a]: [bf999c24 --> bf911913] win32k!NtUserSetInternalWindowPos
[ 20b]: [bf999c28 --> bf8f89ea] win32k!NtUserSetKeyboardState
[ 20c]: [bf999c2c --> bf8a5d53] win32k!NtUserSetLogonNotifyWindow
[ 20d]: [bf999c30 --> bf90b74a] win32k!NtUserSetMenu
[ 20e]: [bf999c34 --> bf911d40] win32k!NtUserSetMenuContextHelpId
[ 20f]: [bf999c38 --> bf8b827a] win32k!NtUserSetMenuDefaultItem
[ 210]: [bf999c3c --> bf911d7d] win32k!NtUserSetMenuFlagRtoL
[ 211]: [bf999c40 --> bf91102a] win32k!NtUserSetObjectInformation
[ 212]: [bf999c44 --> bf882afc] win32k!NtUserSetParent
[ 213]: [bf999c48 --> bf86bd5b] win32k!NtUserSetProcessWindowStation
[ 214]: [bf999c4c --> bf82847c] win32k!NtUserSetProp
[ 215]: [bf999c50 --> bf911cfa] win32k!NtUserSetRipFlags
[ 216]: [bf999c54 --> bf80e774] win32k!NtUserSetScrollInfo
[ 217]: [bf999c58 --> bf89a417] win32k!NtUserSetShellWindowEx
[ 218]: [bf999c5c --> bf9121c0] win32k!NtUserSetSysColors
[ 219]: [bf999c60 --> bf91274e] win32k!NtUserSetSystemCursor
[ 21a]: [bf999c64 --> bf8f61bb] win32k!NtUserSetSystemMenu
[ 21b]: [bf999c68 --> bf912cac] win32k!NtUserSetSystemTimer
[ 21c]: [bf999c6c --> bf86bdb3] win32k!NtUserSetThreadDesktop
[ 21d]: [bf999c70 --> bf914a80] win32k!NtUserSetThreadLayoutHandles
[ 21e]: [bf999c74 --> bf882cf7] win32k!NtUserSetThreadState
[ 21f]: [bf999c78 --> bf803aab] win32k!NtUserSetTimer
[ 220]: [bf999c7c --> bf882ba7] win32k!NtUserSetWindowFNID
[ 221]: [bf999c80 --> bf832d7e] win32k!NtUserSetWindowLong
[ 222]: [bf999c84 --> bf88d87b] win32k!NtUserSetWindowPlacement
[ 223]: [bf999c88 --> bf828223] win32k!NtUserSetWindowPos
[ 224]: [bf999c8c --> bf840823] win32k!NtUserSetWindowRgn
[ 225]: [bf999c90 --> bf88e300] win32k!NtUserSetWindowsHookAW
[ 226]: [bf999c94 --> bf8ba057] win32k!NtUserSetWindowsHookEx
[ 227]: [bf999c98 --> bf89d2d7] win32k!NtUserSetWindowStationUser
[ 228]: [bf999c9c --> bf8f8f9b] win32k!NtUserSetWindowWord
[ 229]: [bf999ca0 --> bf8edb64] win32k!NtUserSetWinEventHook
[ 22a]: [bf999ca4 --> bf82cef3] win32k!NtUserShowCaret
[ 22b]: [bf999ca8 --> bf8c5730] win32k!NtUserShowScrollBar
[ 22c]: [bf999cac --> bf83513b] win32k!NtUserShowWindow
[ 22d]: [bf999cb0 --> bf89207c] win32k!NtUserShowWindowAsync
[ 22e]: [bf999cb4 --> bf8e32d5] win32k!NtUserSoundSentry
[ 22f]: [bf999cb8 --> bf89a6ac] win32k!NtUserSwitchDesktop
[ 230]: [bf999cbc --> bf81e8e3] win32k!NtUserSystemParametersInfo
[ 231]: [bf999cc0 --> bf90dbee] win32k!NtUserTestForInteractiveUser
[ 232]: [bf999cc4 --> bf8f611c] win32k!NtUserThunkedMenuInfo
[ 233]: [bf999cc8 --> bf83fc0d] win32k!NtUserThunkedMenuItemInfo
[ 234]: [bf999ccc --> bf912559] win32k!NtUserToUnicodeEx
[ 235]: [bf999cd0 --> bf86c580] win32k!NtUserTrackMouseEvent
[ 236]: [bf999cd4 --> bf912376] win32k!NtUserTrackPopupMenuEx
[ 237]: [bf999cd8 --> bf83a728] win32k!NtUserCalcMenuBar
[ 238]: [bf999cdc --> bf8eef29] win32k!NtUserPaintMenuBar
[ 239]: [bf999ce0 --> bf8f81f3] win32k!NtUserTranslateAccelerator
[ 23a]: [bf999ce4 --> bf870be0] win32k!NtUserTranslateMessage
[ 23b]: [bf999ce8 --> bf8ba646] win32k!NtUserUnhookWindowsHookEx
[ 23c]: [bf999cec --> bf8edc3f] win32k!NtUserUnhookWinEvent
[ 23d]: [bf999cf0 --> bf912c24] win32k!NtUserUnloadKeyboardLayout
[ 23e]: [bf999cf4 --> bf8911ed] win32k!NtUserUnlockWindowStation
[ 23f]: [bf999cf8 --> bf81fd00] win32k!NtUserUnregisterClass
[ 240]: [bf999cfc --> bf89d748] win32k!NtUserUnregisterUserApiHook
[ 241]: [bf999d00 --> bf91246c] win32k!NtUserUnregisterHotKey
[ 242]: [bf999d04 --> bf91445b] win32k!NtUserUpdateInputContext
[ 243]: [bf999d08 --> bf9112cd] win32k!NtUserUpdateInstance
[ 244]: [bf999d0c --> bf874e3f] win32k!NtUserUpdateLayeredWindow
[ 245]: [bf999d10 --> bf915017] win32k!NtUserGetLayeredWindowAttributes
[ 246]: [bf999d14 --> bf845afb] win32k!NtUserSetLayeredWindowAttributes
[ 247]: [bf999d18 --> bf8a2f52] win32k!NtUserUpdatePerUserSystemParameters
[ 248]: [bf999d1c --> bf91297e] win32k!NtUserUserHandleGrantAccess
[ 249]: [bf999d20 --> bf8018ac] win32k!NtUserValidateHandleSecure
[ 24a]: [bf999d24 --> bf8f8bd9] win32k!NtUserValidateRect
[ 24b]: [bf999d28 --> bf807eba] win32k!NtUserValidateTimerCallback
[ 24c]: [bf999d2c --> bf8c3d69] win32k!NtUserVkKeyScanEx
[ 24d]: [bf999d30 --> bf90d432] win32k!NtUserWaitForInputIdle
[ 24e]: [bf999d34 --> bf90c444] win32k!NtUserWaitForMsgAndEvent
[ 24f]: [bf999d38 --> bf8037a7] win32k!NtUserWaitMessage
[ 250]: [bf999d3c --> bf911020] win32k!NtUserWin32PoolAllocationStats
[ 251]: [bf999d40 --> bf821530] win32k!NtUserWindowFromPoint
[ 252]: [bf999d44 --> bf90db86] win32k!NtUserYieldTask
[ 253]: [bf999d48 --> bf899f9e] win32k!NtUserRemoteConnect
[ 254]: [bf999d4c --> bf910ea7] win32k!NtUserRemoteRedrawRectangle
[ 255]: [bf999d50 --> bf910ef4] win32k!NtUserRemoteRedrawScreen
[ 256]: [bf999d54 --> bf910f48] win32k!NtUserRemoteStopScreenUpdates
[ 257]: [bf999d58 --> bf910f95] win32k!NtUserCtxDisplayIOCtl
[ 258]: [bf999d5c --> bf8fbcf2] win32k!NtGdiEngAssociateSurface
[ 259]: [bf999d60 --> bf8fc6a2] win32k!NtGdiEngCreateBitmap
[ 25a]: [bf999d64 --> bf8fbcbf] win32k!NtGdiEngCreateDeviceSurface
[ 25b]: [bf999d68 --> bf952de1] win32k!NtGdiEngCreateDeviceBitmap
[ 25c]: [bf999d6c --> bf8defe9] win32k!NtGdiEngCreatePalette
[ 25d]: [bf999d70 --> bf90635f] win32k!NtGdiEngComputeGlyphSet
[ 25e]: [bf999d74 --> bf952f37] win32k!NtGdiEngCopyBits
[ 25f]: [bf999d78 --> bf8dfb75] win32k!NtGdiEngDeletePalette
[ 260]: [bf999d7c --> bf8fbc45] win32k!NtGdiEngDeleteSurface
[ 261]: [bf999d80 --> bf953d9a] win32k!NtGdiEngEraseSurface
[ 262]: [bf999d84 --> bf8ffefb] win32k!NtGdiEngUnlockSurface
[ 263]: [bf999d88 --> bf8fc0f7] win32k!NtGdiEngLockSurface
[ 264]: [bf999d8c --> bf904ee3] win32k!NtGdiEngBitBlt
[ 265]: [bf999d90 --> bf9002d4] win32k!NtGdiEngStretchBlt
[ 266]: [bf999d94 --> bf95332f] win32k!NtGdiEngPlgBlt
[ 267]: [bf999d98 --> bf8fc798] win32k!NtGdiEngMarkBandingSurface
[ 268]: [bf999d9c --> bf8fd592] win32k!NtGdiEngStrokePath
[ 269]: [bf999da0 --> bf953526] win32k!NtGdiEngFillPath
[ 26a]: [bf999da4 --> bf8fe227] win32k!NtGdiEngStrokeAndFillPath
[ 26b]: [bf999da8 --> bf953691] win32k!NtGdiEngPaint
[ 26c]: [bf999dac --> bf9537ad] win32k!NtGdiEngLineTo
[ 26d]: [bf999db0 --> bf9538d6] win32k!NtGdiEngAlphaBlend
[ 26e]: [bf999db4 --> bf953a55] win32k!NtGdiEngGradientFill
[ 26f]: [bf999db8 --> bf953c2e] win32k!NtGdiEngTransparentBlt
[ 270]: [bf999dbc --> bf8fed98] win32k!NtGdiEngTextOut
[ 271]: [bf999dc0 --> bf9530d3] win32k!NtGdiEngStretchBltROP
[ 272]: [bf999dc4 --> bf95454c] win32k!NtGdiXLATEOBJ_cGetPalette
[ 273]: [bf999dc8 --> bf954608] win32k!NtGdiXLATEOBJ_iXlate
[ 274]: [bf999dcc --> bf9544fe] win32k!NtGdiXLATEOBJ_hGetColorTransform
[ 275]: [bf999dd0 --> bf8fda8f] win32k!NtGdiCLIPOBJ_bEnum
[ 276]: [bf999dd4 --> bf8fdb3c] win32k!NtGdiCLIPOBJ_cEnumStart
[ 277]: [bf999dd8 --> bf953e64] win32k!NtGdiCLIPOBJ_ppoGetPath
[ 278]: [bf999ddc --> bf953ea2] win32k!NtGdiEngDeletePath
[ 279]: [bf999de0 --> bf953edc] win32k!NtGdiEngCreateClip
[ 27a]: [bf999de4 --> bf953f0e] win32k!NtGdiEngDeleteClip
[ 27b]: [bf999de8 --> bf8fd0fa] win32k!NtGdiBRUSHOBJ_ulGetBrushColor
[ 27c]: [bf999dec --> bf953f48] win32k!NtGdiBRUSHOBJ_pvAllocRbrush
[ 27d]: [bf999df0 --> bf953f99] win32k!NtGdiBRUSHOBJ_pvGetRbrush
[ 27e]: [bf999df4 --> bf9063e5] win32k!NtGdiBRUSHOBJ_hGetColorTransform
[ 27f]: [bf999df8 --> bf905d2e] win32k!NtGdiXFORMOBJ_bApplyXform
[ 280]: [bf999dfc --> bf8fafef] win32k!NtGdiXFORMOBJ_iGetXform
[ 281]: [bf999e00 --> bf905eef] win32k!NtGdiFONTOBJ_vGetInfo
[ 282]: [bf999e04 --> bf8faf55] win32k!NtGdiFONTOBJ_pxoGetXform
[ 283]: [bf999e08 --> bf905993] win32k!NtGdiFONTOBJ_cGetGlyphs
[ 284]: [bf999e0c --> bf8fb160] win32k!NtGdiFONTOBJ_pifi
[ 285]: [bf999e10 --> bf9546c3] win32k!NtGdiFONTOBJ_pfdg
[ 286]: [bf999e14 --> bf9547ca] win32k!NtGdiFONTOBJ_pQueryGlyphAttrs
[ 287]: [bf999e18 --> bf95442e] win32k!NtGdiFONTOBJ_pvTrueTypeFontFile
[ 288]: [bf999e1c --> bf953fe7] win32k!NtGdiFONTOBJ_cGetAllGlyphHandles
[ 289]: [bf999e20 --> bf9548a2] win32k!NtGdiSTROBJ_bEnum
[ 28a]: [bf999e24 --> bf90611d] win32k!NtGdiSTROBJ_bEnumPositionsOnly
[ 28b]: [bf999e28 --> bf8fb273] win32k!NtGdiSTROBJ_bGetAdvanceWidths
[ 28c]: [bf999e2c --> bf90613b] win32k!NtGdiSTROBJ_vEnumStart
[ 28d]: [bf999e30 --> bf9540b2] win32k!NtGdiSTROBJ_dwGetCodePage
[ 28e]: [bf999e34 --> bf9541a3] win32k!NtGdiPATHOBJ_vGetBounds
[ 28f]: [bf999e38 --> bf9548c0] win32k!NtGdiPATHOBJ_bEnum
[ 290]: [bf999e3c --> bf954234] win32k!NtGdiPATHOBJ_vEnumStart
[ 291]: [bf999e40 --> bf954278] win32k!NtGdiPATHOBJ_vEnumStartClipLines
[ 292]: [bf999e44 --> bf954325] win32k!NtGdiPATHOBJ_bEnumClipLines
[ 293]: [bf999e48 --> bf952daf] win32k!NtGdiGetDhpdev
[ 294]: [bf999e4c --> bf95465a] win32k!NtGdiEngCheckAbort
[ 295]: [bf999e50 --> bf9057d8] win32k!NtGdiHT_Get8BPPFormatPalette
[ 296]: [bf999e54 --> bf952e23] win32k!NtGdiHT_Get8BPPMaskPalette
[ 297]: [bf999e58 --> bf9414e4] win32k!NtGdiUpdateTransform
[ 298]: [bf999e5c --> bf8dd701] win32k!NtGdiSetPUMPDOBJ
[ 299]: [bf999e60 --> bf954100] win32k!NtGdiBRUSHOBJ_DeleteRbrush
[ 29a]: [bf999e64 --> bf952dd6] win32k!NtGdiUnmapMemFont
[ 29b]: [bf999e68 --> bf8177ad] win32k!NtGdiDrawStream

手机扫一扫

移动阅读更方便

你可能感兴趣的文章