转载

学习/认识CPU的GDT

0x00 关于GDT

CPU相信大家都知道是啥玩意，哪三个单词缩写。GDT对于一些不搞底层的人知道的可能还有一些。

GDT就是 global descriptor table 的缩写。相应的还有个 local descriptor tables (LDT)，这个不再此文的讨论范围内。

这在保护模式教程中经常看到，但是这和咱们程序员有啥关系呢？ 1.留后门

就是进入R0后设置（R3）进入R0的后门（如：调用门，中断门，任务门等）。

2.了解/编写操作系统

人家微软的Windows操作系统经历了很多变化，如今到了WIN10。（对于天天研究Windows的人）这对咱有意思吗？顶多认识了解和应用/利用。好像有不少的变化（PC端）都是基于硬件的。基于软件的算法不说。

3.虚拟化

如：intel-VT就要设置许多段（如：cs,ss,ds,es,fs,gs等）的Base，Limit，access rights，Selectors等。

好了，废话不多进入正题。

0x01 开始分析

以Windows系统为例进行分析。

kd> vertarget  Windows XP Kernel Version 2600 (Service Pack 3) MP (1 procs) Free x86 compatible Built by: 2600.xpsp_sp3_qfe.130704-0421 Machine Name: Kernel base = 0x804d8000 PsLoadedModuleList = 0x8055e720 Debug session time: Thu Aug  6 14:25:16.468 2015 (UTC + 8:00) System Uptime: 0 days 0:01:19.984

这是操作系统的环境信息。

GDT是由GDTR指向的。

kd> r gdtr gdtr=8003f000

其大小为：

kd> r gdtl gdtl=000003ff

其全部的内容为：

kd> db 8003f000 L(000003ff + 1) 8003f000  00 00 00 00 00 00 00 00-ff ff 00 00 00 9b cf 00  ................ 8003f010  ff ff 00 00 00 93 cf 00-ff ff 00 00 00 fb cf 00  ................ 8003f020  ff ff 00 00 00 f3 cf 00-ab 20 00 20 04 8b 00 80  ......... . .... 8003f030  01 00 00 f0 df 93 c0 ff-ff 0f 00 00 00 f3 40 00  ..............@. 8003f040  ff ff 00 04 00 f2 00 00-00 00 00 00 00 00 00 00  ................ 8003f050  68 00 00 27 55 89 00 80-68 00 68 27 55 89 00 80  h..'U...h.h'U... 8003f060  ff ff 40 2f 02 93 00 00-ff 3f 00 80 0b 92 00 00  ..@/.....?...... 8003f070  ff 03 00 70 ff 92 00 ff-ff ff 00 00 40 9a 00 80  ...p........@... 8003f080  ff ff 00 00 40 92 00 80-00 00 00 00 00 92 00 00  ....@........... 8003f090  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................ 8003f0a0  68 00 b8 16 38 89 00 82-00 00 00 00 00 00 00 00  h...8........... 8003f0b0  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................ 8003f0c0  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................ 8003f0d0  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................ 8003f0e0  ff ff 00 f0 50 9f 00 f8-ff ff 00 00 00 92 00 00  ....P........... 8003f0f0  b7 03 40 d0 4f 98 00 80-ff ff 00 00 00 92 00 00  ..@.O........... 8003f100  ff ff 00 24 4d 93 40 ba-ff ff 00 24 4d 93 40 ba  ...$M.@....$M.@. 8003f110  ff ff 00 24 4d 93 40 ba-20 f1 03 80 00 00 00 00  ...$M.@. ....... 8003f120  28 f1 03 80 00 00 00 00-30 f1 03 80 00 00 00 00  (.......0....... 8003f130  38 f1 03 80 00 00 00 00-40 f1 03 80 00 00 00 00  8.......@....... 8003f140  48 f1 03 80 00 00 00 00-50 f1 03 80 00 00 00 00  H.......P....... 8003f150  58 f1 03 80 00 00 00 00-60 f1 03 80 00 00 00 00  X.......`....... 8003f160  68 f1 03 80 00 00 00 00-70 f1 03 80 00 00 00 00  h.......p....... 8003f170  78 f1 03 80 00 00 00 00-80 f1 03 80 00 00 00 00  x............... 8003f180  88 f1 03 80 00 00 00 00-90 f1 03 80 00 00 00 00  ................ 8003f190  98 f1 03 80 00 00 00 00-a0 f1 03 80 00 00 00 00  ................ 8003f1a0  a8 f1 03 80 00 00 00 00-b0 f1 03 80 00 00 00 00  ................ 8003f1b0  b8 f1 03 80 00 00 00 00-c0 f1 03 80 00 00 00 00  ................ 8003f1c0  c8 f1 03 80 00 00 00 00-d0 f1 03 80 00 00 00 00  ................ 8003f1d0  d8 f1 03 80 00 00 00 00-e0 f1 03 80 00 00 00 00  ................ 8003f1e0  e8 f1 03 80 00 00 00 00-f0 f1 03 80 00 00 00 00  ................ 8003f1f0  f8 f1 03 80 00 00 00 00-00 f2 03 80 00 00 00 00  ................ 8003f200  08 f2 03 80 00 00 00 00-10 f2 03 80 00 00 00 00  ................ 8003f210  18 f2 03 80 00 00 00 00-20 f2 03 80 00 00 00 00  ........ ....... 8003f220  28 f2 03 80 00 00 00 00-30 f2 03 80 00 00 00 00  (.......0....... 8003f230  38 f2 03 80 00 00 00 00-40 f2 03 80 00 00 00 00  8.......@....... 8003f240  48 f2 03 80 00 00 00 00-50 f2 03 80 00 00 00 00  H.......P....... 8003f250  58 f2 03 80 00 00 00 00-60 f2 03 80 00 00 00 00  X.......`....... 8003f260  68 f2 03 80 00 00 00 00-70 f2 03 80 00 00 00 00  h.......p....... 8003f270  78 f2 03 80 00 00 00 00-80 f2 03 80 00 00 00 00  x............... 8003f280  88 f2 03 80 00 00 00 00-90 f2 03 80 00 00 00 00  ................ 8003f290  98 f2 03 80 00 00 00 00-a0 f2 03 80 00 00 00 00  ................ 8003f2a0  a8 f2 03 80 00 00 00 00-b0 f2 03 80 00 00 00 00  ................ 8003f2b0  b8 f2 03 80 00 00 00 00-c0 f2 03 80 00 00 00 00  ................ 8003f2c0  c8 f2 03 80 00 00 00 00-d0 f2 03 80 00 00 00 00  ................ 8003f2d0  d8 f2 03 80 00 00 00 00-e0 f2 03 80 00 00 00 00  ................ 8003f2e0  e8 f2 03 80 00 00 00 00-f0 f2 03 80 00 00 00 00  ................ 8003f2f0  f8 f2 03 80 00 00 00 00-00 f3 03 80 00 00 00 00  ................ 8003f300  08 f3 03 80 00 00 00 00-10 f3 03 80 00 00 00 00  ................ 8003f310  18 f3 03 80 00 00 00 00-20 f3 03 80 00 00 00 00  ........ ....... 8003f320  28 f3 03 80 00 00 00 00-30 f3 03 80 00 00 00 00  (.......0....... 8003f330  38 f3 03 80 00 00 00 00-40 f3 03 80 00 00 00 00  8.......@....... 8003f340  48 f3 03 80 00 00 00 00-50 f3 03 80 00 00 00 00  H.......P....... 8003f350  58 f3 03 80 00 00 00 00-60 f3 03 80 00 00 00 00  X.......`....... 8003f360  68 f3 03 80 00 00 00 00-70 f3 03 80 00 00 00 00  h.......p....... 8003f370  78 f3 03 80 00 00 00 00-80 f3 03 80 00 00 00 00  x............... 8003f380  88 f3 03 80 00 00 00 00-90 f3 03 80 00 00 00 00  ................ 8003f390  98 f3 03 80 00 00 00 00-a0 f3 03 80 00 00 00 00  ................ 8003f3a0  a8 f3 03 80 00 00 00 00-b0 f3 03 80 00 00 00 00  ................ 8003f3b0  b8 f3 03 80 00 00 00 00-c0 f3 03 80 00 00 00 00  ................ 8003f3c0  c8 f3 03 80 00 00 00 00-d0 f3 03 80 00 00 00 00  ................ 8003f3d0  d8 f3 03 80 00 00 00 00-e0 f3 03 80 00 00 00 00  ................ 8003f3e0  e8 f3 03 80 00 00 00 00-f0 f3 03 80 00 00 00 00  ................ 8003f3f0  f8 f3 03 80 00 00 00 00-00 00 00 00 00 00 00 00  ................

注意：是8字节对齐并是8的整数倍。

不过这些数据不好看，要解析，这就是我们的任务。

其实也可以这样看：

kd> dg 0 3ff  P Si Gr Pr Lo Sel    Base     Limit     Type    l ze an es ng Flags ---- -------- -------- ---------- - -- -- -- -- -------- 0000 00000000 00000000 <Reserved> 0 Nb By Np Nl 00000000 0008 00000000 ffffffff Code RE Ac 0 Bg Pg P  Nl 00000c9b 0010 00000000 ffffffff Data RW Ac 0 Bg Pg P  Nl 00000c93 0018 00000000 ffffffff Code RE Ac 3 Bg Pg P  Nl 00000cfb 0020 00000000 ffffffff Data RW Ac 3 Bg Pg P  Nl 00000cf3 0028 80042000 000020ab TSS32 Busy 0 Nb By P  Nl 0000008b 0030 ffdff000 00001fff Data RW Ac 0 Bg Pg P  Nl 00000c93 0038 00000000 00000fff Data RW Ac 3 Bg By P  Nl 000004f3 0040 00000400 0000ffff Data RW    3 Nb By P  Nl 000000f2 0048 00000000 00000000 <Reserved> 0 Nb By Np Nl 00000000 0050 80552700 00000068 TSS32 Avl  0 Nb By P  Nl 00000089 0058 80552768 00000068 TSS32 Avl  0 Nb By P  Nl 00000089 0060 00022f40 0000ffff Data RW Ac 0 Nb By P  Nl 00000093 0068 000b8000 00003fff Data RW    0 Nb By P  Nl 00000092 0070 ffff7000 000003ff Data RW    0 Nb By P  Nl 00000092 0078 80400000 0000ffff Code RE    0 Nb By P  Nl 0000009a 0080 80400000 0000ffff Data RW    0 Nb By P  Nl 00000092 0088 00000000 00000000 Data RW    0 Nb By P  Nl 00000092 0090 00000000 00000000 <Reserved> 0 Nb By Np Nl 00000000 0098 00000000 00000000 <Reserved> 0 Nb By Np Nl 00000000 00A0 823816b8 00000068 TSS32 Avl  0 Nb By P  Nl 00000089 00A8 00000000 00000000 <Reserved> 0 Nb By Np Nl 00000000 00B0 00000000 00000000 <Reserved> 0 Nb By Np Nl 00000000 00B8 00000000 00000000 <Reserved> 0 Nb By Np Nl 00000000 00C0 00000000 00000000 <Reserved> 0 Nb By Np Nl 00000000 00C8 00000000 00000000 <Reserved> 0 Nb By Np Nl 00000000 00D0 00000000 00000000 <Reserved> 0 Nb By Np Nl 00000000 00D8 00000000 00000000 <Reserved> 0 Nb By Np Nl 00000000 00E0 f850f000 0000ffff Code RE Ac 0 Nb By P  Nl 0000009f 00E8 00000000 0000ffff Data RW    0 Nb By P  Nl 00000092 00F0 804fd040 000003b7 Code EO    0 Nb By P  Nl 00000098 00F8 00000000 0000ffff Data RW    0 Nb By P  Nl 00000092 0100 ba4d2400 0000ffff Data RW Ac 0 Bg By P  Nl 00000493 0108 ba4d2400 0000ffff Data RW Ac 0 Bg By P  Nl 00000493 0110 ba4d2400 0000ffff Data RW Ac 0 Bg By P  Nl 00000493 0118 00008003 0000f120 <Reserved> 0 Nb By Np Nl 00000000 0120 00008003 0000f128 <Reserved> 0 Nb By Np Nl 00000000 0128 00008003 0000f130 <Reserved> 0 Nb By Np Nl 00000000 0130 00008003 0000f138 <Reserved> 0 Nb By Np Nl 00000000 0138 00008003 0000f140 <Reserved> 0 Nb By Np Nl 00000000 0140 00008003 0000f148 <Reserved> 0 Nb By Np Nl 00000000 0148 00008003 0000f150 <Reserved> 0 Nb By Np Nl 00000000 0150 00008003 0000f158 <Reserved> 0 Nb By Np Nl 00000000 0158 00008003 0000f160 <Reserved> 0 Nb By Np Nl 00000000 0160 00008003 0000f168 <Reserved> 0 Nb By Np Nl 00000000 0168 00008003 0000f170 <Reserved> 0 Nb By Np Nl 00000000 0170 00008003 0000f178 <Reserved> 0 Nb By Np Nl 00000000 0178 00008003 0000f180 <Reserved> 0 Nb By Np Nl 00000000 0180 00008003 0000f188 <Reserved> 0 Nb By Np Nl 00000000 0188 00008003 0000f190 <Reserved> 0 Nb By Np Nl 00000000 0190 00008003 0000f198 <Reserved> 0 Nb By Np Nl 00000000 0198 00008003 0000f1a0 <Reserved> 0 Nb By Np Nl 00000000 01A0 00008003 0000f1a8 <Reserved> 0 Nb By Np Nl 00000000 01A8 00008003 0000f1b0 <Reserved> 0 Nb By Np Nl 00000000 01B0 00008003 0000f1b8 <Reserved> 0 Nb By Np Nl 00000000 01B8 00008003 0000f1c0 <Reserved> 0 Nb By Np Nl 00000000 01C0 00008003 0000f1c8 <Reserved> 0 Nb By Np Nl 00000000 01C8 00008003 0000f1d0 <Reserved> 0 Nb By Np Nl 00000000 01D0 00008003 0000f1d8 <Reserved> 0 Nb By Np Nl 00000000 01D8 00008003 0000f1e0 <Reserved> 0 Nb By Np Nl 00000000 01E0 00008003 0000f1e8 <Reserved> 0 Nb By Np Nl 00000000 01E8 00008003 0000f1f0 <Reserved> 0 Nb By Np Nl 00000000 01F0 00008003 0000f1f8 <Reserved> 0 Nb By Np Nl 00000000 01F8 00008003 0000f200 <Reserved> 0 Nb By Np Nl 00000000 0200 00008003 0000f208 <Reserved> 0 Nb By Np Nl 00000000 0208 00008003 0000f210 <Reserved> 0 Nb By Np Nl 00000000 0210 00008003 0000f218 <Reserved> 0 Nb By Np Nl 00000000 0218 00008003 0000f220 <Reserved> 0 Nb By Np Nl 00000000 0220 00008003 0000f228 <Reserved> 0 Nb By Np Nl 00000000 0228 00008003 0000f230 <Reserved> 0 Nb By Np Nl 00000000 0230 00008003 0000f238 <Reserved> 0 Nb By Np Nl 00000000 0238 00008003 0000f240 <Reserved> 0 Nb By Np Nl 00000000 0240 00008003 0000f248 <Reserved> 0 Nb By Np Nl 00000000 0248 00008003 0000f250 <Reserved> 0 Nb By Np Nl 00000000 0250 00008003 0000f258 <Reserved> 0 Nb By Np Nl 00000000 0258 00008003 0000f260 <Reserved> 0 Nb By Np Nl 00000000 0260 00008003 0000f268 <Reserved> 0 Nb By Np Nl 00000000 0268 00008003 0000f270 <Reserved> 0 Nb By Np Nl 00000000 0270 00008003 0000f278 <Reserved> 0 Nb By Np Nl 00000000 0278 00008003 0000f280 <Reserved> 0 Nb By Np Nl 00000000 0280 00008003 0000f288 <Reserved> 0 Nb By Np Nl 00000000 0288 00008003 0000f290 <Reserved> 0 Nb By Np Nl 00000000 0290 00008003 0000f298 <Reserved> 0 Nb By Np Nl 00000000 0298 00008003 0000f2a0 <Reserved> 0 Nb By Np Nl 00000000 02A0 00008003 0000f2a8 <Reserved> 0 Nb By Np Nl 00000000 02A8 00008003 0000f2b0 <Reserved> 0 Nb By Np Nl 00000000 02B0 00008003 0000f2b8 <Reserved> 0 Nb By Np Nl 00000000 02B8 00008003 0000f2c0 <Reserved> 0 Nb By Np Nl 00000000 02C0 00008003 0000f2c8 <Reserved> 0 Nb By Np Nl 00000000 02C8 00008003 0000f2d0 <Reserved> 0 Nb By Np Nl 00000000 02D0 00008003 0000f2d8 <Reserved> 0 Nb By Np Nl 00000000 02D8 00008003 0000f2e0 <Reserved> 0 Nb By Np Nl 00000000 02E0 00008003 0000f2e8 <Reserved> 0 Nb By Np Nl 00000000 02E8 00008003 0000f2f0 <Reserved> 0 Nb By Np Nl 00000000 02F0 00008003 0000f2f8 <Reserved> 0 Nb By Np Nl 00000000 02F8 00008003 0000f300 <Reserved> 0 Nb By Np Nl 00000000 0300 00008003 0000f308 <Reserved> 0 Nb By Np Nl 00000000 0308 00008003 0000f310 <Reserved> 0 Nb By Np Nl 00000000 0310 00008003 0000f318 <Reserved> 0 Nb By Np Nl 00000000 0318 00008003 0000f320 <Reserved> 0 Nb By Np Nl 00000000 0320 00008003 0000f328 <Reserved> 0 Nb By Np Nl 00000000 0328 00008003 0000f330 <Reserved> 0 Nb By Np Nl 00000000 0330 00008003 0000f338 <Reserved> 0 Nb By Np Nl 00000000 0338 00008003 0000f340 <Reserved> 0 Nb By Np Nl 00000000 0340 00008003 0000f348 <Reserved> 0 Nb By Np Nl 00000000 0348 00008003 0000f350 <Reserved> 0 Nb By Np Nl 00000000 0350 00008003 0000f358 <Reserved> 0 Nb By Np Nl 00000000 0358 00008003 0000f360 <Reserved> 0 Nb By Np Nl 00000000 0360 00008003 0000f368 <Reserved> 0 Nb By Np Nl 00000000 0368 00008003 0000f370 <Reserved> 0 Nb By Np Nl 00000000 0370 00008003 0000f378 <Reserved> 0 Nb By Np Nl 00000000 0378 00008003 0000f380 <Reserved> 0 Nb By Np Nl 00000000 0380 00008003 0000f388 <Reserved> 0 Nb By Np Nl 00000000 0388 00008003 0000f390 <Reserved> 0 Nb By Np Nl 00000000 0390 00008003 0000f398 <Reserved> 0 Nb By Np Nl 00000000 0398 00008003 0000f3a0 <Reserved> 0 Nb By Np Nl 00000000 03A0 00008003 0000f3a8 <Reserved> 0 Nb By Np Nl 00000000 03A8 00008003 0000f3b0 <Reserved> 0 Nb By Np Nl 00000000 03B0 00008003 0000f3b8 <Reserved> 0 Nb By Np Nl 00000000 03B8 00008003 0000f3c0 <Reserved> 0 Nb By Np Nl 00000000 03C0 00008003 0000f3c8 <Reserved> 0 Nb By Np Nl 00000000 03C8 00008003 0000f3d0 <Reserved> 0 Nb By Np Nl 00000000 03D0 00008003 0000f3d8 <Reserved> 0 Nb By Np Nl 00000000 03D8 00008003 0000f3e0 <Reserved> 0 Nb By Np Nl 00000000 03E0 00008003 0000f3e8 <Reserved> 0 Nb By Np Nl 00000000 03E8 00008003 0000f3f0 <Reserved> 0 Nb By Np Nl 00000000 03F0 00008003 0000f3f8 <Reserved> 0 Nb By Np Nl 00000000 03F8 00000000 00000000 <Reserved> 0 Nb By Np Nl 00000000

我们的功能就是要解析出这样的格式。

注意，另外一个话题是：也可以手动分析出这个格式，如：

kd> r cs  cs=00000008

然后根据一定的算法得出的结论要如下（一种思路是根据_KGDTENTRY的定义）：

kd> dg cs                                    P Si Gr Pr Lo Sel    Base     Limit     Type    l ze an es ng Flags ---- -------- -------- ---------- - -- -- -- -- -------- 0008 00000000 ffffffff Code RE Ac 0 Bg Pg P  Nl 00000c9b

这个算法就不说了，相信你会的。

0x02 总结

简单说下吧！

GDT就是一个（数组格式的）表，里面的每一项是一个 Segment Descriptors 。

关于这个的格式，可见： Intel? 64 and IA-32 Architectures Software Developer’s Manual（Order Number: 325462-055US June 2015） 的 Volume 3: System Programming Guide 的 3.4.5 Segment Descriptors 小节及附图。

这个Segment Descriptors具体的分两大类：

一类是： application (code or data) descriptor 。 这就是常见的代码/数据段，如：大多数的CS，DS都指向这里 。一类是： system descriptor

这里又分为： system-segment descriptors（LDT and TSS segments） 。 gate descriptors（call, interrupt, and trap gates） 。

但是，这些结构在Windows下的定义是啥样呢？

经查WRK和WINDBG，结果如下：

// Special Registers for i386 typedef struct _X86_DESCRIPTOR {  USHORT  Pad;  USHORT  Limit;  ULONG   Base; } X86_DESCRIPTOR, *PX86_DESCRIPTOR; // GDT Entry typedef struct _KGDTENTRY {  USHORT  LimitLow;  USHORT  BaseLow;  union {   struct {    UCHAR   BaseMid;    UCHAR   Flags1;  // Declare as bytes to avoid alignment    UCHAR   Flags2;  // Problems.    UCHAR   BaseHi;   } Bytes;   struct {    ULONG   BaseMid : 8;    ULONG   Type : 5;//把S位包含进去了，也就是是否为系统段描述符的位。    ULONG   Dpl : 2;    ULONG   Pres : 1;    ULONG   LimitHi : 4;    ULONG   Sys : 1;//即AVL，系统软件自定义的。    ULONG   Reserved_0 : 1;//LongMode    ULONG   Default_Big : 1;//即INTEL的D/B (default operation size/default stack pointer size and/or upper bound) flag。    ULONG   Granularity : 1;    ULONG   BaseHi : 8;   } Bits;  } HighWord; } KGDTENTRY, *PKGDTENTRY;

为啥定义的名字是KGDTENTRY呢？其实你想想结构的位置。这个其实就是 Segment Descriptors ，但是定义的和INTEL的不完全一样。

kd> dt nt!_KGDTENTRY   +0x000 LimitLow   : Uint2B  +0x002 BaseLow    : Uint2B  +0x004 HighWord   : __unnamed kd> dt nt!_KGDTENTRY -b  +0x000 LimitLow   : Uint2B  +0x002 BaseLow    : Uint2B  +0x004 HighWord   : __unnamed   +0x000 Bytes    : __unnamed    +0x000 BaseMid    : UChar    +0x001 Flags1     : UChar    +0x002 Flags2     : UChar    +0x003 BaseHi     : UChar   +0x000 Bits     : __unnamed    +0x000 BaseMid    : Pos 0, 8 Bits    +0x000 Type     : Pos 8, 5 Bits    +0x000 Dpl      : Pos 13, 2 Bits    +0x000 Pres     : Pos 15, 1 Bit    +0x000 LimitHi    : Pos 16, 4 Bits    +0x000 Sys      : Pos 20, 1 Bit    +0x000 Reserved_0   : Pos 21, 1 Bit    +0x000 Default_Big  : Pos 22, 1 Bit    +0x000 Granularity  : Pos 23, 1 Bit    +0x000 BaseHi     : Pos 24, 8 Bits

具体的算法请参见： 1.INTEL的资料。 2.WRK的算法。 3.本文的代码。

上面分析的是32位下的Windows系统，再看看64位下Windows的GDT。

0: kd> vertarget  Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64 Built by: 7601.18869.amd64fre.win7sp1_gdr.150525-0603 Machine Name: Kernel base = 0xfffff800`01e64000 PsLoadedModuleList = 0xfffff800`020ab730 Debug session time: Thu Aug  6 14:37:33.359 2015 (UTC + 8:00) System Uptime: 0 days 0:13:15.757 0: kd> r gdtr gdtr=fffff80001d51000 0: kd> r gdtl gdtl=007f 0: kd> db fffff80001d51000 L(007f + 1) fffff800`01d51000  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................ fffff800`01d51010  00 00 00 00 00 9b 20 00-ff ff 00 00 00 93 cf 00  ...... ......... fffff800`01d51020  ff ff 00 00 00 fb cf 00-ff ff 00 00 00 f3 cf 00  ................ fffff800`01d51030  00 00 00 00 00 fb 20 00-00 00 00 00 00 00 00 00  ...... ......... fffff800`01d51040  67 00 80 20 d5 8b 00 01-00 f8 ff ff 00 00 00 00  g.. ............ fffff800`01d51050  00 3c 00 a0 f9 f3 40 ff-00 00 00 00 00 00 00 00  .<....@......... fffff800`01d51060  ff ff 00 00 00 9a cf 00-00 00 00 00 00 00 00 00  ................ fffff800`01d51070  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................ 0: kd> dg 0 80  P Si Gr Pr Lo Sel        Base              Limit          Type    l ze an es ng Flags ---- ----------------- ----------------- ---------- - -- -- -- -- -------- 0000 00000000`00000000 00000000`00000000 <Reserved> 0 Nb By Np Nl 00000000 0008 00000000`00000000 00000000`00000000 <Reserved> 0 Nb By Np Nl 00000000 0010 00000000`00000000 00000000`00000000 Code RE Ac 0 Nb By P  Lo 0000029b 0018 00000000`00000000 00000000`ffffffff Data RW Ac 0 Bg Pg P  Nl 00000c93 0020 00000000`00000000 00000000`ffffffff Code RE Ac 3 Bg Pg P  Nl 00000cfb 0028 00000000`00000000 00000000`ffffffff Data RW Ac 3 Bg Pg P  Nl 00000cf3 0030 00000000`00000000 00000000`00000000 Code RE Ac 3 Nb By P  Lo 000002fb 0038 00000000`00000000 00000000`00000000 <Reserved> 0 Nb By Np Nl 00000000 0040 00000000`01d52080 00000000`00000067 TSS32 Busy 0 Nb By P  Nl 0000008b 0048 00000000`0000ffff 00000000`0000f800 <Reserved> 0 Nb By Np Nl 00000000 0050 ffffffff`fff9a000 00000000`00003c00 Data RW Ac 3 Bg By P  Nl 000004f3 0058 00000000`00000000 00000000`00000000 <Reserved> 0 Nb By Np Nl 00000000 0060 00000000`00000000 00000000`ffffffff Code RE    0 Bg Pg P  Nl 00000c9a 0068 00000000`00000000 00000000`00000000 <Reserved> 0 Nb By Np Nl 00000000 0070 00000000`00000000 00000000`00000000 <Reserved> 0 Nb By Np Nl 00000000 0078 00000000`00000000 00000000`00000000 <Reserved> 0 Nb By Np Nl 00000000 0080 Unable to get descriptor

WRK及WINDBG的相关（验证）信息如下：

// Special Registers for AMD64. typedef struct _AMD64_DESCRIPTOR {  USHORT  Pad[3];  USHORT  Limit;  ULONG64 Base; } AMD64_DESCRIPTOR, *PAMD64_DESCRIPTOR; typedef union _KGDTENTRY64 {  struct {   USHORT  LimitLow;   USHORT  BaseLow;   union {    struct {     UCHAR   BaseMiddle;     UCHAR   Flags1;     UCHAR   Flags2;     UCHAR   BaseHigh;    } Bytes;    struct {     ULONG   BaseMiddle : 8;     ULONG   Type : 5;//把S位包含进去了，也就是是否为系统段描述符的位。     ULONG   Dpl : 2;     ULONG   Present : 1;     ULONG   LimitHigh : 4;     ULONG   System : 1;//即AVL，系统软件自定义的。     ULONG   LongMode : 1;     ULONG   DefaultBig : 1;//即INTEL的D/B (default operation size/default stack pointer size and/or upper bound) flag。     ULONG   Granularity : 1;     ULONG   BaseHigh : 8;    } Bits;   };   //ULONG BaseUpper;   //ULONG MustBeZero;  };  //ULONG64 Alignment; } KGDTENTRY64, *PKGDTENTRY64; 0: kd> dt _KGDTENTRY64 hal!_KGDTENTRY64    +0x000 LimitLow   : Uint2B    +0x002 BaseLow    : Uint2B    +0x004 Bytes   : <unnamed-tag>    +0x004 Bits    : <unnamed-tag>    +0x008 BaseUpper  : Uint4B    +0x00c MustBeZero    : Uint4B    +0x000 Alignment  : Uint8B 0: kd> dt _KGDTENTRY64 -b hal!_KGDTENTRY64    +0x000 LimitLow   : Uint2B    +0x002 BaseLow    : Uint2B    +0x004 Bytes   : <unnamed-tag>    +0x000 BaseMiddle    : UChar    +0x001 Flags1     : UChar    +0x002 Flags2     : UChar    +0x003 BaseHigh   : UChar    +0x004 Bits    : <unnamed-tag>    +0x000 BaseMiddle    : Pos 0, 8 Bits    +0x000 Type    : Pos 8, 5 Bits    +0x000 Dpl     : Pos 13, 2 Bits    +0x000 Present    : Pos 15, 1 Bit    +0x000 LimitHigh  : Pos 16, 4 Bits    +0x000 System     : Pos 20, 1 Bit    +0x000 LongMode   : Pos 21, 1 Bit    +0x000 DefaultBig    : Pos 22, 1 Bit    +0x000 Granularity   : Pos 23, 1 Bit    +0x000 BaseHigh   : Pos 24, 8 Bits    +0x008 BaseUpper  : Uint4B    +0x00c MustBeZero    : Uint4B    +0x000 Alignment  : Uint8B

注意：1.以上只分析一个CPU的情况，如果一个计算机有多个CPU要分别处理。

2.为了和WINDBG的DG命令处理/显示的相似，特意根据INTEL的Table 3-1. Code- and Data-Segment Types，制作一个字符串数组。还有待改善。

3.GetGdtLimit的这个功能没有相应的C代码，只有汇编代码（.asm文件），包括（X86和X64）。这个代码就不附带了，相信你能做到的。

最后只有代码了，请看代码：

/* 功能：显示每个CPU的GDT信息。 注释：一下结构摘自WRK。 made by correy. QQ:112426112. homepage:http://correy.webs.com 注释：需翻墙，有的翻墙软件也打不开。 2008年夏天开始学习CPU的保护模式。 2015.01.11起稿。 2015年夏修改存档，尽管还有一些不完美的地方。 */ #include <ntifs.h> #include <windef.h> #if defined(_AMD64_) || defined(_IA64_) //defined(_WIN64) // Special Registers for AMD64. typedef struct _AMD64_DESCRIPTOR {  USHORT  Pad[3];  USHORT  Limit;  ULONG64 Base; } AMD64_DESCRIPTOR, *PAMD64_DESCRIPTOR; typedef union _KGDTENTRY64 {  struct {   USHORT  LimitLow;   USHORT  BaseLow;   union {    struct {     UCHAR   BaseMiddle;     UCHAR   Flags1;     UCHAR   Flags2;     UCHAR   BaseHigh;    } Bytes;    struct {     ULONG   BaseMiddle : 8;     ULONG   Type : 5;//把S位包含进去了，也就是是否为系统段描述符的位。     ULONG   Dpl : 2;     ULONG   Present : 1;     ULONG   LimitHigh : 4;     ULONG   System : 1;//即AVL，系统软件自定义的。     ULONG   LongMode : 1;     ULONG   DefaultBig : 1;//即INTEL的D/B (default operation size/default stack pointer size and/or upper bound) flag。     ULONG   Granularity : 1;     ULONG   BaseHigh : 8;    } Bits;   };   //ULONG BaseUpper;/*经观察，64下的结构的长度是6字节，不是上面定义的16字节。*/   //ULONG MustBeZero;  };  //ULONG64 Alignment; } KGDTENTRY64, *PKGDTENTRY64; #else  // Special Registers for i386 typedef struct _X86_DESCRIPTOR {  USHORT  Pad;  USHORT  Limit;  ULONG   Base; } X86_DESCRIPTOR, *PX86_DESCRIPTOR; // GDT Entry typedef struct _KGDTENTRY {  USHORT  LimitLow;  USHORT  BaseLow;  union {   struct {    UCHAR   BaseMid;    UCHAR   Flags1;  // Declare as bytes to avoid alignment    UCHAR   Flags2;  // Problems.    UCHAR   BaseHi;   } Bytes;   struct {    ULONG   BaseMid : 8;    ULONG   Type : 5;//把S位包含进去了，也就是是否为系统段描述符的位。    ULONG   Dpl : 2;    ULONG   Pres : 1;    ULONG   LimitHi : 4;    ULONG   Sys : 1;//即AVL，系统软件自定义的。    ULONG   Reserved_0 : 1;//LongMode    ULONG   Default_Big : 1;//即INTEL的D/B (default operation size/default stack pointer size and/or upper bound) flag。    ULONG   Granularity : 1;    ULONG   BaseHi : 8;   } Bits;  } HighWord; } KGDTENTRY, *PKGDTENTRY; #endif /* 根据：Table 3-1. Code- and Data-Segment Types，仿照WINDBG的dg命令定义。 */ char SegmentTypes[][256] = {  "<Reserved>",//Data Read-Only缩写是：Data RO，也可认为是： <Reserved>。如果结构（UINT64）全部为零，也可认为是Reserved。  "Data RO AC",//Data Read-Only, accessed  "Data RW",//Data Read/Write  "Data RW AC",//Data Read/Write, accessed  "Data RO ED",//Data Read-Only, expand-down  "Data RO ED AC",//Data Read-Only, expand-down, accessed  "Data RW ED",//Data Read/Write, expand-down  "Data RW ED AC",//Data Read/Write, expand-down, accessed  "Code EO",//Code Execute-Only  "Code EO AC",//Code Execute-Only, accessed  "Code RE",//Code Execute/Read 加空格以便显示的对齐。  "Code RE AC",//Code Execute/Read, accessed  "Code EO CO",//Code Execute-Only, conforming  "Code EO CO AC",//Code Execute-Only, conforming, accessed  "Code RE CO",//Code Execute/Read, conforming  "Code RE CO AC",//Code Execute/Read, conforming, accessed  "TSS32 Busy ",//这个也可显示只要识别了TSS及内容。  "TSS32 Avl" //这个在X86上出现了。 };   DRIVER_UNLOAD DriverUnload; VOID DriverUnload(__in PDRIVER_OBJECT DriverObject) {    } #ifdef _X86_ __forceinline PKPCR KeGetPcr (VOID) {  return (PKPCR)__readfsdword(FIELD_OFFSET(KPCR, SelfPcr)); } #endif USHORT NTAPI GetGdtLimit ();//汇编函数。 #if defined(_WIN64) void show_gdt(int i)  /*  i的取值可以是0.  */ {  //SIZE_T IDTR;  //X86_DESCRIPTOR gdtr = {0};//A pointer to the memory location where the IDTR is stored.  //KGDTENTRY * GDT = 0;  USHORT GdtLimit = 0;  SIZE_T r = 0;  PVOID p = 0;  int index = 0;  int maximun = 0;  PKGDTENTRY64 pkgdte;  SIZE_T ISR = 0;  KeSetSystemAffinityThread(i + 1);  pkgdte = KeGetPcr()->GdtBase;//没有__sgdt,也不用sgdt汇编指令的办法。但是这个获取的没有长度。  GdtLimit = GetGdtLimit ();//一般等于0x7f.  KeRevertToUserAffinityThread();  //p = &gdtr.Limit;  //r = * (SIZE_T *)p;  //pkgdte = (PKGDTENTRY)r;   /*  其实直接：  maximun = (idtr.Base + 1) / sizeof(KIDTENTRY);  也可以。  maximun一般等于256.  */  //if (gdtr.Pad % sizeof(KIDTENTRY) == 0) {  // maximun = gdtr.Pad / sizeof(KIDTENTRY);  //} else {  // maximun = gdtr.Pad / sizeof(KIDTENTRY);  // maximun++;  //}  //if (GdtLimit % sizeof(KGDTENTRY64) == 0) {  // maximun = GdtLimit / sizeof(KGDTENTRY64);  //} else {  // maximun = GdtLimit / sizeof(KGDTENTRY64);  // maximun++;//一般是128.  //}  maximun = (GdtLimit + 1) / sizeof(KGDTENTRY64);  /*  显示格式：   CPU SN Sel  Base     Limit    Type Pl Size Gran Pres Long Flags  --- -- ---- ----------------- ----------------- ---------- -- ---- ---- ---- ---- --------  注释：CPU和SN是自己添加的。SN即Segment Name,如：CS，DS，FS等.  */  KdPrint(("Sel  Base    Limit    Type   DPl Size Gran Pres Long Flags/n"));//CPU SN   KdPrint(("---- ---------------- ---------------- ------------- --- ---- ---- ---- ---- --------/n"));//--- --   KdPrint(("/n"));  for ( ;index < maximun ;index++ )   {   PKGDTENTRY64 pkgdte_t = &pkgdte[index];   SIZE_T Base = 0;   SIZE_T Limit = 0;   ULONG  Type = 0;   char * size = NULL;   char * Granularity = NULL;   char * Present = NULL;   char * LongMode = NULL;   int Flags = 0;     Base = pkgdte_t->Bits.BaseHigh;   Base = (Base << 24);   Base += (pkgdte_t->BaseLow + (pkgdte_t->Bits.BaseMiddle << 16));   Limit = pkgdte_t->LimitLow + (pkgdte_t->Bits.LimitHigh << 16);   if (pkgdte_t->Bits.DefaultBig && Base)   {    //扩充高位为1.即F.    Base += 0xffffffff00000000;   }      if (pkgdte_t->Bits.DefaultBig && pkgdte_t->Bits.Granularity)   {    //扩充高位为1.即F.    SIZE_T t = Limit;    Limit = (Limit << 12);    Limit += PAGE_SIZE - 1;   }    Type = pkgdte_t->Bits.Type;   _bittestandreset(&Type, 4);//因为这个包含了S位，所以要清除这个位标志。   if (pkgdte_t->Bits.DefaultBig)   {    size = "Bg  ";//Big 加空格是为了对齐显示。   }   else   {    size = "Nb  ";//Not Big 加空格是为了对齐显示。   }   if (pkgdte_t->Bits.Granularity)   {    Granularity = "Pg  ";//Page 加空格是为了对齐显示。   }   else   {    Granularity = "By  ";//Byte 加空格是为了对齐显示。   }   if (pkgdte_t->Bits.Present)   {    Present = "P   ";//Present 加空格是为了对齐显示。   }   else   {    Present = "NP  ";//NO Present 加空格是为了对齐显示。   }   if (pkgdte_t->Bits.LongMode)   {    LongMode = "Lo  ";//Long 加空格是为了对齐显示。   }   else   {    LongMode = "Nl  ";//NO long 加空格是为了对齐显示。   }   Flags = (pkgdte_t->Bytes.Flags2 >> 4);//去掉Segment limit的那几位。   Flags = Flags << 8;   Flags = Flags + pkgdte_t->Bytes.Flags1;   KdPrint(("%04x %p %p %13s %03x %s %s %s %s 0x%04x/n",     index * 8, //sizeof (KGDTENTRY)    Base,     Limit,    SegmentTypes[Type],    pkgdte_t->Bits.Dpl,    size,    Granularity,    Present,       LongMode,    Flags    ));  } } #else  void show_gdt(int i)  /*  i的取值可以是0.  */ {  //SIZE_T IDTR;  //X86_DESCRIPTOR gdtr = {0};//A pointer to the memory location where the IDTR is stored.  //KGDTENTRY * GDT = 0;  USHORT GdtLimit = 0;  SIZE_T r = 0;  PVOID p = 0;  int index = 0;  int maximun = 0;  PKGDTENTRY pkgdte;  SIZE_T ISR = 0;  KeSetSystemAffinityThread(i + 1);  pkgdte = KeGetPcr()->GDT;//没有__sgdt,也不用sgdt汇编指令的办法。但是这个获取的没有长度。  GdtLimit = GetGdtLimit ();//一般等于0x3ff.  KeRevertToUserAffinityThread();  //p = &gdtr.Limit;  //r = * (SIZE_T *)p;  //pkgdte = (PKGDTENTRY)r;   /*  其实直接：  maximun = (idtr.Base + 1) / sizeof(KIDTENTRY);  也可以。  maximun一般等于256.  */  //if (gdtr.Pad % sizeof(KIDTENTRY) == 0) {  // maximun = gdtr.Pad / sizeof(KIDTENTRY);  //} else {  // maximun = gdtr.Pad / sizeof(KIDTENTRY);  // maximun++;  //}  if (GdtLimit % sizeof(KGDTENTRY) == 0) {   maximun = GdtLimit / sizeof(KGDTENTRY);  } else {   maximun = GdtLimit / sizeof(KGDTENTRY);   maximun++;//一般是128.  }  /*  显示格式：   CPU SN Sel  Base     Limit    Type Pl Size Gran Pres Long Flags  --- -- ---- ----------------- ----------------- ---------- -- ---- ---- ---- ---- --------  注释：CPU和SN是自己添加的。SN即Segment Name,如：CS，DS，FS等.  */  KdPrint(("Sel  Base    Limit    Type DPl Size Gran Pres Long Flags/n"));//CPU SN   KdPrint(("---- -------- ------------- ------------- --- ---- ---- ---- ---- --------/n"));//--- --   KdPrint(("/n"));  for ( ;index < maximun ;index++ )   {   PKGDTENTRY pkgdte_t = &pkgdte[index];   SIZE_T Base = 0;   SIZE_T Limit = 0;   ULONG  Type = 0;   char * size = NULL;   char * Granularity = NULL;   char * Present = NULL;   char * LongMode = NULL;   int Flags = 0;      //注意：0x38处的值不停的变化。   USHORT  BaseLow = pkgdte_t->BaseLow;   ULONG   BaseMid = pkgdte_t->HighWord.Bits.BaseMid;   ULONG   BaseHi = pkgdte_t->HighWord.Bits.BaseHi;   Base = (BaseHi << 24) + (BaseMid << 16) + BaseLow;//其实用位与更快 | 。   if (pkgdte_t->HighWord.Bits.Granularity && BooleanFlagOn(pkgdte_t->HighWord.Bits.Type, 2 ) ) {//关于标志位及算法，见权威资料。    Limit = pkgdte_t->LimitLow + (pkgdte_t->HighWord.Bits.LimitHi << 16);    Limit *= PAGE_SIZE;    Limit += PAGE_SIZE - 1;   } else {    Limit = pkgdte_t->LimitLow + (pkgdte_t->HighWord.Bits.LimitHi << 16);   }   Type = pkgdte_t->HighWord.Bits.Type;   _bittestandreset(&Type, 4);//因为这个包含了S位，所以要清除这个位标志。   if (pkgdte_t->HighWord.Bits.Default_Big)   {    size = "Bg  ";//Big 加空格是为了对齐显示。   }   else   {    size = "Nb  ";//Not Big 加空格是为了对齐显示。   }   if (pkgdte_t->HighWord.Bits.Granularity)   {    Granularity = "Pg  ";//Page 加空格是为了对齐显示。   }   else   {    Granularity = "By  ";//Byte 加空格是为了对齐显示。   }   if (pkgdte_t->HighWord.Bits.Pres)   {    Present = "P   ";//Present 加空格是为了对齐显示。   }   else   {    Present = "NP  ";//NO Present 加空格是为了对齐显示。   }   if (pkgdte_t->HighWord.Bits.Reserved_0)   {    LongMode = "Lo  ";//Long 加空格是为了对齐显示。   }   else   {    LongMode = "Nl  ";//NO long 加空格是为了对齐显示。   }   Flags = (pkgdte_t->HighWord.Bytes.Flags2 >> 4);//去掉Segment limit的那几位。   Flags = Flags << 8;   Flags = Flags + pkgdte_t->HighWord.Bytes.Flags1;   KdPrint(("%04x %p %p %13s %03x %s %s %s %s 0x%04x/n",     index * 8, //sizeof (KGDTENTRY)    Base,     Limit,    SegmentTypes[Type],    pkgdte_t->HighWord.Bits.Dpl,    size,    Granularity,    Present,       LongMode,    Flags    ));  } } #endif #pragma INITCODE DRIVER_INITIALIZE DriverEntry; NTSTATUS DriverEntry(__in struct _DRIVER_OBJECT * DriverObject, __in PUNICODE_STRING RegistryPath) {  int i = 0;  KdBreakPoint();  DriverObject->DriverUnload = DriverUnload;  for ( ;i < KeNumberProcessors ;i++ )//KeQueryMaximumProcessorCount()  KeGetCurrentProcessorNumber  {     show_gdt(i);    }  return STATUS_SUCCESS; }

结果及验证：

32位Windows的结果：

kd> g Sel  Base             Limit          Type DPl Size Gran Pres Long Flags ---- -------- ------------- ------------- --- ---- ---- ---- ---- --------  0000 00000000 00000000    <Reserved> 000 Nb   By   NP   Nl   0x0000 0008 00000000 FFFFFFFF    Code RE AC 000 Bg   Pg   P    Nl   0x0c9b 0010 00000000 FFFFFFFF    Data RW AC 000 Bg   Pg   P    Nl   0x0c93 0018 00000000 FFFFFFFF    Code RE AC 003 Bg   Pg   P    Nl   0x0cfb 0020 00000000 FFFFFFFF    Data RW AC 003 Bg   Pg   P    Nl   0x0cf3 0028 80042000 000020AB    Code RE AC 000 Nb   By   P    Nl   0x008b 0030 FFDFF000 00001FFF    Data RW AC 000 Bg   Pg   P    Nl   0x0c93 0038 00000000 00000FFF    Data RW AC 003 Bg   By   P    Nl   0x04f3 0040 00000400 0000FFFF       Data RW 003 Nb   By   P    Nl   0x00f2 0048 00000000 00000000    <Reserved> 000 Nb   By   NP   Nl   0x0000 0050 80552700 00000068    Code EO AC 000 Nb   By   P    Nl   0x0089 0058 80552768 00000068    Code EO AC 000 Nb   By   P    Nl   0x0089 0060 00022F40 0000FFFF    Data RW AC 000 Nb   By   P    Nl   0x0093 0068 000B8000 00003FFF       Data RW 000 Nb   By   P    Nl   0x0092 0070 FFFF7000 000003FF       Data RW 000 Nb   By   P    Nl   0x0092 0078 80400000 0000FFFF       Code RE 000 Nb   By   P    Nl   0x009a 0080 80400000 0000FFFF       Data RW 000 Nb   By   P    Nl   0x0092 0088 00000000 00000000       Data RW 000 Nb   By   P    Nl   0x0092 0090 00000000 00000000    <Reserved> 000 Nb   By   NP   Nl   0x0000 0098 00000000 00000000    <Reserved> 000 Nb   By   NP   Nl   0x0000 00a0 823816B8 00000068    Code EO AC 000 Nb   By   P    Nl   0x0089 00a8 00000000 00000000    <Reserved> 000 Nb   By   NP   Nl   0x0000 00b0 00000000 00000000    <Reserved> 000 Nb   By   NP   Nl   0x0000 00b8 00000000 00000000    <Reserved> 000 Nb   By   NP   Nl   0x0000 00c0 00000000 00000000    <Reserved> 000 Nb   By   NP   Nl   0x0000 00c8 00000000 00000000    <Reserved> 000 Nb   By   NP   Nl   0x0000 00d0 00000000 00000000    <Reserved> 000 Nb   By   NP   Nl   0x0000 00d8 00000000 00000000    <Reserved> 000 Nb   By   NP   Nl   0x0000 00e0 F850F000 0000FFFF Code RE CO AC 000 Nb   By   P    Nl   0x009f 00e8 00000000 0000FFFF       Data RW 000 Nb   By   P    Nl   0x0092 00f0 804FD040 000003B7       Code EO 000 Nb   By   P    Nl   0x0098 00f8 00000000 0000FFFF       Data RW 000 Nb   By   P    Nl   0x0092 0100 BA4D2400 0000FFFF    Data RW AC 000 Bg   By   P    Nl   0x0493 0108 BA4D2400 0000FFFF    Data RW AC 000 Bg   By   P    Nl   0x0493 0110 BA4D2400 0000FFFF    Data RW AC 000 Bg   By   P    Nl   0x0493 0118 00008003 0000F120    <Reserved> 000 Nb   By   NP   Nl   0x0000 0120 00008003 0000F128    <Reserved> 000 Nb   By   NP   Nl   0x0000 0128 00008003 0000F130    <Reserved> 000 Nb   By   NP   Nl   0x0000 0130 00008003 0000F138    <Reserved> 000 Nb   By   NP   Nl   0x0000 0138 00008003 0000F140    <Reserved> 000 Nb   By   NP   Nl   0x0000 0140 00008003 0000F148    <Reserved> 000 Nb   By   NP   Nl   0x0000 0148 00008003 0000F150    <Reserved> 000 Nb   By   NP   Nl   0x0000 0150 00008003 0000F158    <Reserved> 000 Nb   By   NP   Nl   0x0000 0158 00008003 0000F160    <Reserved> 000 Nb   By   NP   Nl   0x0000 0160 00008003 0000F168    <Reserved> 000 Nb   By   NP   Nl   0x0000 0168 00008003 0000F170    <Reserved> 000 Nb   By   NP   Nl   0x0000 0170 00008003 0000F178    <Reserved> 000 Nb   By   NP   Nl   0x0000 0178 00008003 0000F180    <Reserved> 000 Nb   By   NP   Nl   0x0000 0180 00008003 0000F188    <Reserved> 000 Nb   By   NP   Nl   0x0000 0188 00008003 0000F190    <Reserved> 000 Nb   By   NP   Nl   0x0000 0190 00008003 0000F198    <Reserved> 000 Nb   By   NP   Nl   0x0000 0198 00008003 0000F1A0    <Reserved> 000 Nb   By   NP   Nl   0x0000 01a0 00008003 0000F1A8    <Reserved> 000 Nb   By   NP   Nl   0x0000 01a8 00008003 0000F1B0    <Reserved> 000 Nb   By   NP   Nl   0x0000 01b0 00008003 0000F1B8    <Reserved> 000 Nb   By   NP   Nl   0x0000 01b8 00008003 0000F1C0    <Reserved> 000 Nb   By   NP   Nl   0x0000 01c0 00008003 0000F1C8    <Reserved> 000 Nb   By   NP   Nl   0x0000 01c8 00008003 0000F1D0    <Reserved> 000 Nb   By   NP   Nl   0x0000 01d0 00008003 0000F1D8    <Reserved> 000 Nb   By   NP   Nl   0x0000 01d8 00008003 0000F1E0    <Reserved> 000 Nb   By   NP   Nl   0x0000 01e0 00008003 0000F1E8    <Reserved> 000 Nb   By   NP   Nl   0x0000 01e8 00008003 0000F1F0    <Reserved> 000 Nb   By   NP   Nl   0x0000 01f0 00008003 0000F1F8    <Reserved> 000 Nb   By   NP   Nl   0x0000 01f8 00008003 0000F200    <Reserved> 000 Nb   By   NP   Nl   0x0000 0200 00008003 0000F208    <Reserved> 000 Nb   By   NP   Nl   0x0000 0208 00008003 0000F210    <Reserved> 000 Nb   By   NP   Nl   0x0000 0210 00008003 0000F218    <Reserved> 000 Nb   By   NP   Nl   0x0000 0218 00008003 0000F220    <Reserved> 000 Nb   By   NP   Nl   0x0000 0220 00008003 0000F228    <Reserved> 000 Nb   By   NP   Nl   0x0000 0228 00008003 0000F230    <Reserved> 000 Nb   By   NP   Nl   0x0000 0230 00008003 0000F238    <Reserved> 000 Nb   By   NP   Nl   0x0000 0238 00008003 0000F240    <Reserved> 000 Nb   By   NP   Nl   0x0000 0240 00008003 0000F248    <Reserved> 000 Nb   By   NP   Nl   0x0000 0248 00008003 0000F250    <Reserved> 000 Nb   By   NP   Nl   0x0000 0250 00008003 0000F258    <Reserved> 000 Nb   By   NP   Nl   0x0000 0258 00008003 0000F260    <Reserved> 000 Nb   By   NP   Nl   0x0000 0260 00008003 0000F268    <Reserved> 000 Nb   By   NP   Nl   0x0000 0268 00008003 0000F270    <Reserved> 000 Nb   By   NP   Nl   0x0000 0270 00008003 0000F278    <Reserved> 000 Nb   By   NP   Nl   0x0000 0278 00008003 0000F280    <Reserved> 000 Nb   By   NP   Nl   0x0000 0280 00008003 0000F288    <Reserved> 000 Nb   By   NP   Nl   0x0000 0288 00008003 0000F290    <Reserved> 000 Nb   By   NP   Nl   0x0000 0290 00008003 0000F298    <Reserved> 000 Nb   By   NP   Nl   0x0000 0298 00008003 0000F2A0    <Reserved> 000 Nb   By   NP   Nl   0x0000 02a0 00008003 0000F2A8    <Reserved> 000 Nb   By   NP   Nl   0x0000 02a8 00008003 0000F2B0    <Reserved> 000 Nb   By   NP   Nl   0x0000 02b0 00008003 0000F2B8    <Reserved> 000 Nb   By   NP   Nl   0x0000 02b8 00008003 0000F2C0    <Reserved> 000 Nb   By   NP   Nl   0x0000 02c0 00008003 0000F2C8    <Reserved> 000 Nb   By   NP   Nl   0x0000 02c8 00008003 0000F2D0    <Reserved> 000 Nb   By   NP   Nl   0x0000 02d0 00008003 0000F2D8    <Reserved> 000 Nb   By   NP   Nl   0x0000 02d8 00008003 0000F2E0    <Reserved> 000 Nb   By   NP   Nl   0x0000 02e0 00008003 0000F2E8    <Reserved> 000 Nb   By   NP   Nl   0x0000 02e8 00008003 0000F2F0    <Reserved> 000 Nb   By   NP   Nl   0x0000 02f0 00008003 0000F2F8    <Reserved> 000 Nb   By   NP   Nl   0x0000 02f8 00008003 0000F300    <Reserved> 000 Nb   By   NP   Nl   0x0000 0300 00008003 0000F308    <Reserved> 000 Nb   By   NP   Nl   0x0000 0308 00008003 0000F310    <Reserved> 000 Nb   By   NP   Nl   0x0000 0310 00008003 0000F318    <Reserved> 000 Nb   By   NP   Nl   0x0000 0318 00008003 0000F320    <Reserved> 000 Nb   By   NP   Nl   0x0000 0320 00008003 0000F328    <Reserved> 000 Nb   By   NP   Nl   0x0000 0328 00008003 0000F330    <Reserved> 000 Nb   By   NP   Nl   0x0000 0330 00008003 0000F338    <Reserved> 000 Nb   By   NP   Nl   0x0000 0338 00008003 0000F340    <Reserved> 000 Nb   By   NP   Nl   0x0000 0340 00008003 0000F348    <Reserved> 000 Nb   By   NP   Nl   0x0000 0348 00008003 0000F350    <Reserved> 000 Nb   By   NP   Nl   0x0000 0350 00008003 0000F358    <Reserved> 000 Nb   By   NP   Nl   0x0000 0358 00008003 0000F360    <Reserved> 000 Nb   By   NP   Nl   0x0000 0360 00008003 0000F368    <Reserved> 000 Nb   By   NP   Nl   0x0000 0368 00008003 0000F370    <Reserved> 000 Nb   By   NP   Nl   0x0000 0370 00008003 0000F378    <Reserved> 000 Nb   By   NP   Nl   0x0000 0378 00008003 0000F380    <Reserved> 000 Nb   By   NP   Nl   0x0000 0380 00008003 0000F388    <Reserved> 000 Nb   By   NP   Nl   0x0000 0388 00008003 0000F390    <Reserved> 000 Nb   By   NP   Nl   0x0000 0390 00008003 0000F398    <Reserved> 000 Nb   By   NP   Nl   0x0000 0398 00008003 0000F3A0    <Reserved> 000 Nb   By   NP   Nl   0x0000 03a0 00008003 0000F3A8    <Reserved> 000 Nb   By   NP   Nl   0x0000 03a8 00008003 0000F3B0    <Reserved> 000 Nb   By   NP   Nl   0x0000 03b0 00008003 0000F3B8    <Reserved> 000 Nb   By   NP   Nl   0x0000 03b8 00008003 0000F3C0    <Reserved> 000 Nb   By   NP   Nl   0x0000 03c0 00008003 0000F3C8    <Reserved> 000 Nb   By   NP   Nl   0x0000 03c8 00008003 0000F3D0    <Reserved> 000 Nb   By   NP   Nl   0x0000 03d0 00008003 0000F3D8    <Reserved> 000 Nb   By   NP   Nl   0x0000 03d8 00008003 0000F3E0    <Reserved> 000 Nb   By   NP   Nl   0x0000 03e0 00008003 0000F3E8    <Reserved> 000 Nb   By   NP   Nl   0x0000 03e8 00008003 0000F3F0    <Reserved> 000 Nb   By   NP   Nl   0x0000 03f0 00008003 0000F3F8    <Reserved> 000 Nb   By   NP   Nl   0x0000 03f8 00000000 00000000    <Reserved> 000 Nb   By   NP   Nl   0x0000

验证，可以和前面的显示做对比。

64位Windows的结果：

0: kd> g Sel        Base             Limit             Type   DPl Size Gran Pres Long Flags ---- ---------------- ---------------- ------------- --- ---- ---- ---- ---- --------  0000 0000000000000000 0000000000000000    <Reserved> 000 Nb   By   NP   Nl   0x0000 0008 0000000000000000 0000000000000000    <Reserved> 000 Nb   By   NP   Nl   0x0000 0010 0000000000000000 0000000000000000    Code RE AC 000 Nb   By   P    Lo   0x029b 0018 0000000000000000 00000000FFFFFFFF    Data RW AC 000 Bg   Pg   P    Nl   0x0c93 0020 0000000000000000 00000000FFFFFFFF    Code RE AC 003 Bg   Pg   P    Nl   0x0cfb 0028 0000000000000000 00000000FFFFFFFF    Data RW AC 003 Bg   Pg   P    Nl   0x0cf3 0030 0000000000000000 0000000000000000    Code RE AC 003 Nb   By   P    Lo   0x02fb 0038 0000000000000000 0000000000000000    <Reserved> 000 Nb   By   NP   Nl   0x0000 0040 0000000001D52080 0000000000000067    Code RE AC 000 Nb   By   P    Nl   0x008b 0048 000000000000FFFF 000000000000F800    <Reserved> 000 Nb   By   NP   Nl   0x0000 0050 FFFFFFFFFFFA0000 0000000000003C00    Data RW AC 003 Bg   By   P    Nl   0x04f3 0058 0000000000000000 0000000000000000    <Reserved> 000 Nb   By   NP   Nl   0x0000 0060 0000000000000000 00000000FFFFFFFF       Code RE 000 Bg   Pg   P    Nl   0x0c9a 0068 0000000000000000 0000000000000000    <Reserved> 000 Nb   By   NP   Nl   0x0000 0070 0000000000000000 0000000000000000    <Reserved> 000 Nb   By   NP   Nl   0x0000 0078 0000000000000000 0000000000000000    <Reserved> 000 Nb   By   NP   Nl   0x0000 Sel        Base             Limit             Type   DPl Size Gran Pres Long Flags ---- ---------------- ---------------- ------------- --- ---- ---- ---- ---- --------  0000 0000000000000000 0000000000000000    <Reserved> 000 Nb   By   NP   Nl   0x0000 0008 0000000000000000 0000000000000000    <Reserved> 000 Nb   By   NP   Nl   0x0000 0010 0000000000000000 0000000000000000    Code RE AC 000 Nb   By   P    Lo   0x029b 0018 0000000000000000 00000000FFFFFFFF    Data RW AC 000 Bg   Pg   P    Nl   0x0c93 0020 0000000000000000 00000000FFFFFFFF    Code RE AC 003 Bg   Pg   P    Nl   0x0cfb 0028 0000000000000000 00000000FFFFFFFF    Data RW AC 003 Bg   Pg   P    Nl   0x0cf3 0030 0000000000000000 0000000000000000    Code RE AC 003 Nb   By   P    Lo   0x02fb 0038 0000000000000000 0000000000000000    <Reserved> 000 Nb   By   NP   Nl   0x0000 0040 00000000009F7E40 0000000000000067    Code RE AC 000 Nb   By   P    Nl   0x008b 0048 000000000000FFFF 000000000000F880    <Reserved> 000 Nb   By   NP   Nl   0x0000 0050 FFFFFFFFFFFE0000 0000000000007C00    Data RW AC 003 Bg   By   P    Nl   0x04f3 0058 0000000000000000 0000000000000000    <Reserved> 000 Nb   By   NP   Nl   0x0000 0060 0000000000000000 00000000FFFFFFFF       Code RE 000 Bg   Pg   P    Nl   0x0c9a 0068 0000000000000000 0000000000000000    <Reserved> 000 Nb   By   NP   Nl   0x0000 0070 0000000000000000 0000000000000000    <Reserved> 000 Nb   By   NP   Nl   0x0000 0078 0000000000000000 0000000000000000    <Reserved> 000 Nb   By   NP   Nl   0x0000

验证，可以和前面（某个）的显示做对比。

这里显示2个，是因为有两个CPU。

细心的你应该（从对比中）还会发现一些不足和不一样的地方，期待你的改正，剩下的任务也就是你要改正的地方。

如：添加显示CPU的个数，及段的名字（特别是系统段，各种门）等。

不当之处，敬请指出。

正文到此结束