第一部分：
插入全局对象变量LoadedLoadableTransports
RPC_STATUS
LoadableTransportInfo (
IN RPC_CHAR * DllName,
IN RPC_CHAR PAPI * RpcProtocolSequence,
OUT TRANS_INFO * PAPI *pTransInfo
)
{
if ( Status != RPC_S_OK
|| LoadedLoadableTransports->Insert(LoadableTransport) == -1 )
{
1: kd> x rpcrt4!LoadedLoadableTransports
77c837bc RPCRT4!LoadedLoadableTransports = 0x00942588
1: kd> dx -id 0,0,897f4020 -r1 ((RPCRT4!LOADABLE_TRANSPORT_DICT *)0x942588)
((RPCRT4!LOADABLE_TRANSPORT_DICT *)0x942588) : 0x942588 [Type: LOADABLE_TRANSPORT_DICT *]
[+0x000] DictSlots : 0x942594 [Type: void * *]
[+0x004] cDictSlots : 0x4 [Type: unsigned int]
[+0x008] cDictSize : 0x0 [Type: unsigned int]
[+0x00c] InitialDictSlots [Type: void * [4]]
之后：
1: kd> x rpcrt4!LoadedLoadableTransports
77c837bc RPCRT4!LoadedLoadableTransports = 0x00942588
1: kd> dx -id 0,0,897f4020 -r1 ((RPCRT4!LOADABLE_TRANSPORT_DICT *)0x942588)
((RPCRT4!LOADABLE_TRANSPORT_DICT *)0x942588) : 0x942588 [Type: LOADABLE_TRANSPORT_DICT *]
[+0x000] DictSlots : 0x942594 [Type: void * *]
[+0x004] cDictSlots : 0x4 [Type: unsigned int]
[+0x008] cDictSize : 0x1 [Type: unsigned int]
[+0x00c] InitialDictSlots [Type: void * [4]]
1: kd> dx -id 0,0,897f4020 -r1 (*((RPCRT4!void * (*)[4])0x942594))
(*((RPCRT4!void * (*)[4])0x942594)) [Type: void * [4]]
[0] : 0x943a80 [Type: void *]
[1] : 0x0 [Type: void *]
[2] : 0x0 [Type: void *]
[3] : 0x0 [Type: void *]
第二部分：
RPC_STATUS
LoadableTransportInfo (
IN RPC_CHAR * DllName,
IN RPC_CHAR PAPI * RpcProtocolSequence,
OUT TRANS_INFO * PAPI *pTransInfo
)
{
while ((LoadableTransport
= LoadedLoadableTransports->Next(cursor)) != 0)
{
*pTransInfo = LoadableTransport->MapProtocol (
DllName,
RpcProtocolSequence) ;
if (*pTransInfo != 0)
{
ClearGlobalMutex();
return RPC_S_OK;
}
}
第三部分：
TRANS_INFO *
LOADABLE_TRANSPORT::MapProtocol (
IN RPC_CHAR * DllName,
IN RPC_CHAR PAPI * ProtocolSequence
)
/*++
Routine Description:
This method is used to search the dictionary. It compares a
LOADABLE_TRANSPORT with a transport interface to see if
they match.
Arguments:
DllName - Supplies the name of the dll from which this loadable
transport interface was loaded.
Return Value:
--*/
{
TRANS_INFO *Protseq ;
TRANSPORT_LOAD TransportLoad;
RPC_TRANSPORT_INTERFACE pTransport;
DictionaryCursor cursor;
if (RpcpStringCompare(DllName, this->DllName) != 0)
{
return 0;
}
ProtseqDict.Reset(cursor) ;
while ((Protseq = ProtseqDict.Next(cursor)) != 0)
{
if (Protseq->MatchProtseq(ProtocolSequence))
{
return Protseq ;
}
}
inline BOOL
TRANS_INFO::MatchProtseq(
IN RPC_CHAR *ProtocolSeq
)
{
if (RpcpStringCompare(ProtocolSeq, RpcProtocolSequence) == 0)
{
return 1 ;
}
return 0;
}
第四部分：
1: kd> dt RPCRT4!LOADABLE_TRANSPORT 0x943a80
+0x000 ThreadsStarted : 0n0
+0x004 DllName : [257] 0x72
+0x208 NumThreads : 0n0
+0x20c LoadedDll : 0x00943700 DLL
+0x210 ProtseqDict : TRANS_INFO_DICT
+0x22c ThreadsDoingLongWait : INTERLOCKED_INTEGER
+0x230 Reserved0 : [7] 0n-1163005939
+0x24c ProcessCallsFunc : 0x77c66ea4 long RPCRT4!COMMON_ProcessCalls+0
+0x250 nOptimalNumberOfThreads : 0n3
+0x254 PnpListen : 0x77c66d26 void RPCRT4!COMMON_ListenForPNPNotifications+0
+0x258 GetHandleForThread : 0x77c661e1 void* RPCRT4!GetCompletionPortHandleForThread+0
+0x25c ReleaseHandleForThread : 0x77c66278 void RPCRT4!ReleaseCompletionPortHandleForThread+0
+0x260 Reserved1 : [3] 0n-1163005939
+0x26c Reserved2 : [7] 0n-1163005939
+0x288 nThreadsAtCompletionPort : INTERLOCKED_INTEGER
+0x28c Reserved3 : [7] 0n-1163005939
+0x2a8 nActivityValue : 0n0
1: kd> dx -id 0,0,897f4020 -r1 (*((RPCRT4!TRANS_INFO_DICT *)0x943c90)) //+0x210 ProtseqDict : TRANS_INFO_DICT
(*((RPCRT4!TRANS_INFO_DICT *)0x943c90)) [Type: TRANS_INFO_DICT]
[+0x000] DictSlots : 0x943c9c [Type: void * *]
[+0x004] cDictSlots : 0x4 [Type: unsigned int]
[+0x008] cDictSize : 0x1 [Type: unsigned int]
[+0x00c] InitialDictSlots [Type: void * [4]]
1: kd> dx -id 0,0,897f4020 -r1 (*((RPCRT4!void * (*)[4])0x943c9c))
(*((RPCRT4!void * (*)[4])0x943c9c)) [Type: void * [4]]
[0] : 0x943d70 [Type: void *]
[1] : 0x0 [Type: void *]
[2] : 0x0 [Type: void *]
[3] : 0x0 [Type: void *]
1: kd> dt RPCRT4!TRANS_INFO 0x943d70
+0x000 pTransportInterface : 0x77bece00 RPC_TRANSPORT_INTERFACE_HEADER
+0x004 LoadableTrans : 0x00943a80 LOADABLE_TRANSPORT
+0x008 RpcProtocolSequence : [257] 0x6e
1: kd> dx -id 0,0,897f4020 -r1 (*((RPCRT4!unsigned short (*)[257])0x943d78))
(*((RPCRT4!unsigned short (*)[257])0x943d78)) [Type: unsigned short [257]]
[0] : 0x6e [Type: unsigned short]
[1] : 0x63 [Type: unsigned short]
[2] : 0x61 [Type: unsigned short]
[3] : 0x63 [Type: unsigned short]
[4] : 0x6e [Type: unsigned short]
[5] : 0x5f [Type: unsigned short]
[6] : 0x6e [Type: unsigned short]
[7] : 0x70 [Type: unsigned short]
[8] : 0x0 [Type: unsigned short]
[9] : 0xbaad [Type: unsigned short]
1: kd> db 0x943d78
00943d78 6e 00 63 00 61 00 63 00-6e 00 5f 00 6e 00 70 00 n.c.a.c.n._.n.p.
00943d88 00 00 ad ba 0d f0 ad ba-0d f0 ad ba 0d f0 ad ba ................