第一部分：
NTSTATUS
RtlLookupAtomInAtomTable(
IN PVOID AtomTableHandle,
IN PWSTR AtomName,
OUT PRTL_ATOM Atom OPTIONAL
)
{
NTSTATUS Status;
PRTL_ATOM_TABLE p = (PRTL_ATOM_TABLE)AtomTableHandle;
PRTL_ATOM_TABLE_ENTRY a;
RTL_ATOM Temp;
RTL_PAGED_CODE();
if (!RtlpLockAtomTable( p )) {
return STATUS_INVALID_PARAMETER;
}
try {
if (RtlpGetIntegerAtom( AtomName, &Temp )) {
if (Temp >= RTL_ATOM_MAXIMUM_INTEGER_ATOM) {
Temp = RTL_ATOM_INVALID_ATOM;
Status = STATUS_INVALID_PARAMETER;
}
else {
Status = STATUS_SUCCESS;
}
if (ARGUMENT_PRESENT( Atom )) {
*Atom = Temp;
}
}
else
if (*AtomName == UNICODE_NULL) {
Status = STATUS_OBJECT_NAME_INVALID;
}
else {
a = RtlpHashStringToAtom( p, AtomName, NULL, NULL ); //关键地方
if (a == NULL) {
Status = STATUS_OBJECT_NAME_NOT_FOUND;
}
else {
if (RtlpAtomMapAtomToHandleEntry( p, (ULONG)a->HandleIndex ) != NULL) { //关键地方
Status = STATUS_SUCCESS;
if (ARGUMENT_PRESENT( Atom )) {
*Atom = a->Atom;
}
}
else {
Status = STATUS_INVALID_HANDLE;
}
}
}
}
except (EXCEPTION_EXECUTE_HANDLER) {
Status = GetExceptionCode();
}
RtlpUnlockAtomTable( p );
return Status;
}
第二部分：AtomTable->ExHandleTable说明原子表也是个句柄表
PRTL_ATOM_TABLE_ENTRY
RtlpAtomMapAtomToHandleEntry(
IN PRTL_ATOM_TABLE AtomTable,
IN ULONG HandleIndex
)
{
#if defined(NTOS_KERNEL_RUNTIME)
PHANDLE_TABLE_ENTRY ExHandleEntry;
PRTL_ATOM_TABLE_ENTRY a;
EXHANDLE ExHandle;
ExHandle.GenericHandleOverlay = 0;
ExHandle.Index = HandleIndex;
ExHandleEntry = ExMapHandleToPointer( AtomTable->ExHandleTable,
ExHandle.GenericHandleOverlay
);
typedef struct _EXHANDLE {
union {
struct {
//
// Application available tag bits
//
ULONG TagBits : 2;
//
// The handle table entry index
//
ULONG Index : 30;
};
HANDLE GenericHandleOverlay;
#define HANDLE_VALUE_INC 4 // Amount to increment the Value to get to the next handle
ULONG_PTR Value;
};
} EXHANDLE, *PEXHANDLE;
1: kd> t
nt!RtlLookupAtomInAtomTable+0xc9:
80d51ca1 e862f6ffff call nt!RtlpAtomMapAtomToHandleEntry (80d51308)
1: kd> t
nt!RtlpAtomMapAtomToHandleEntry:
80d51308 55 push ebp
1: kd> dv
AtomTable = 0xe13d6010
HandleIndex = 0x1f
第三部分：
NTKERNELAPI
PHANDLE_TABLE_ENTRY
ExMapHandleToPointer (
IN PHANDLE_TABLE HandleTable,
IN HANDLE Handle
)
{
EXHANDLE LocalHandle;
PHANDLE_TABLE_ENTRY HandleTableEntry;
PAGED_CODE();
LocalHandle.GenericHandleOverlay = Handle;
if ((LocalHandle.Index & (LOWLEVEL_COUNT - 1)) == 0) {
return NULL;
}
//
// Translate the input handle to a handle table entry and make
// sure it is a valid handle.
//
HandleTableEntry = ExpLookupHandleTableEntry( HandleTable,
LocalHandle );
1: kd> t
nt!RtlpAtomMapAtomToHandleEntry+0x11:
80d51319 e89e030600 call nt!ExMapHandleToPointer (80db16bc)
1: kd> t
nt!ExMapHandleToPointer:
80db16bc 55 push ebp
1: kd> dv
HandleTable = 0xe140afb8
Handle = 0x0000007c
第四部分：
PHANDLE_TABLE_ENTRY
ExpLookupHandleTableEntry (
IN PHANDLE_TABLE HandleTable,
IN EXHANDLE tHandle
)
1: kd> dv
HandleTable = 0xe140afb8
tHandle = struct _EXHANDLE
1: kd> dx -r1 ((ntkrnlmp!_HANDLE_TABLE *)0xe140afb8)
((ntkrnlmp!_HANDLE_TABLE *)0xe140afb8) : 0xe140afb8 [Type: _HANDLE_TABLE *]
[+0x000] TableCode : 0xe140d000 [Type: unsigned long]
[+0x004] QuotaProcess : 0x0 [Type: _EPROCESS *]
[+0x008] UniqueProcessId : 0x1cc [Type: void *]
[+0x00c] HandleTableLock [Type: _EX_PUSH_LOCK [4]]
[+0x01c] HandleTableList [Type: _LIST_ENTRY]
[+0x024] HandleContentionEvent [Type: _EX_PUSH_LOCK]
[+0x028] DebugInfo : 0x0 [Type: _HANDLE_TRACE_DEBUG_INFO *]
[+0x02c] ExtraInfoPages : 0 [Type: long]
[+0x030] FirstFree : 0x90 [Type: unsigned long]
[+0x034] LastFree : 0x0 [Type: unsigned long]
[+0x038] NextHandleNeedingPool : 0x800 [Type: unsigned long]
[+0x03c] HandleCount : 35 [Type: long] //一共35个句柄0x23
[+0x040] Flags : 0x0 [Type: unsigned long]
[+0x040 ( 0: 0)] StrictFIFO : 0x0 [Type: unsigned char]
1: kd> dv
HandleTable = 0xe140afb8
tHandle = struct _EXHANDLE
1: kd> dx -r1 (*((ntkrnlmp!_EXHANDLE *)0xb9f32678))
(*((ntkrnlmp!_EXHANDLE *)0xb9f32678)) [Type: _EXHANDLE]
[+0x000 ( 1: 0)] TagBits : 0x0 [Type: unsigned long]
[+0x000 (31: 2)] Index : 0x1f [Type: unsigned long]
[+0x000] GenericHandleOverlay : 0x7c [Type: void *]
[+0x000] Value : 0x7c [Type: unsigned long]
1: kd> dt HANDLE_TABLE_ENTRY 0xe140d000
ntdll!HANDLE_TABLE_ENTRY
+0x000 Object : (null)
+0x000 ObAttributes : 0
+0x000 InfoTable : (null)
+0x000 Value : 0
+0x004 GrantedAccess : 0xfffffffe
+0x004 GrantedAccessIndex : 0xfffe
+0x006 CreatorBackTraceIndex : 0xffff
+0x004 NextFreeTableEntry : 0n-2
1: kd> dt HANDLE_TABLE_ENTRY 0xe140d000+8*1f
ntdll!HANDLE_TABLE_ENTRY
+0x000 Object : 0xe194ebd1 Void
+0x000 ObAttributes : 0xe194ebd1
+0x000 InfoTable : 0xe194ebd1 _HANDLE_TABLE_ENTRY_INFO
+0x000 Value : 0xe194ebd1
+0x004 GrantedAccess : 0
+0x004 GrantedAccessIndex : 0
+0x006 CreatorBackTraceIndex : 0
+0x004 NextFreeTableEntry : 0n0
第五部分： +0x000 Value : 0xe194ebd1 转换为ntdll!_RTL_ATOM_TABLE_ENTRY结构
1: kd> dt ntdll!_RTL_ATOM_TABLE_ENTRY 0xe194ebd0
+0x000 HashLink : (null)
+0x004 HandleIndex : 0x1f
+0x006 Atom : 0xc01f
+0x008 ReferenceCount : 1
+0x00a Flags : 0 ''
+0x00b NameLength : 0x14 ''
+0x00c Name : [1] 0x43
1: kd> dx -id 0,0,896d1020 -r1 (*((ntdll!unsigned short (*)[1])0xe194ebdc))
(*((ntdll!unsigned short (*)[1])0xe194ebdc)) [Type: unsigned short [1]]
[0] : 0x43 [Type: unsigned short]
1: kd> db 0xe194ebdc
e194ebdc 43 00 41 00 64 00 64 00-72 00 65 00 73 00 73 00 C.A.d.d.r.e.s.s.
e194ebec 43 00 6f 00 6d 00 62 00-6f 00 45 00 78 00 5f 00 C.o.m.b.o.E.x._.
e194ebfc 54 00 68 00 69 00 73 00-00 00 54 89 09 06 09 0c T.h.i.s...T.....
