PatchGuard가 감시하는 항목의 인벤토리

ntoskrnl.exe 10.0.26100.9168 (Win11 24H2) · 덤프 mem09.elf · 3개 컨텍스트 (전역, ExpTimeZoneDpcRoutine, ExpTimerDpcRoutine) · 1126개 디스크립터 · 861/861 검증됨 · 디스패처가 인식하는 49개 유형 중 34개 유형 인스턴스화됨.

---

1. 모듈

로드된 168개 중 27개.

Module	0x00 EXPORT	0x00 .xdata	0x01 .pdata	0x1E padding	0x0D IAT	0x23 LOAD_CONFIG	0x2C PE header	0x30 retpoline	0x21 page hash
ntoskrnl.exe	✓	✓	✓	✓	✓	✓	✓	·	✓
hal.dll	✓	·	·	·	·	·	✓	·	✓
win32k.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
CI.dll	✓	✓	✓	✓	✓	✓	✓	✓	✓
ndis.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
tcpip.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
Ntfs.sys	·	✓	✓	✓	✓	✓	✓	✓	✓
FLTMGR.SYS	✓	✓	✓	✓	✓	✓	✓	✓	✓
msrpc.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
ksecdd.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
cng.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
clipsp.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
dxgkrnl.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
watchdog.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
PSHED.dll	✓	✓	✓	✓	✓	✓	✓	✓	✓
BOOTVID.dll	✓	✓	✓	✓	✓	✓	✓	✓	✓
kdcom.dll	✓	✓	✓	✓	✓	✓	✓	✓	✓
CLFS.SYS	✓	✓	✓	✓	✓	✓	✓	✓	✓
tm.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
WMILIB.SYS	✓	✓	✓	✓	✓	✓	✓	✓	✓
werkernel.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
ntosext.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
cmimcext.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
symcryptk.dll	✓	✓	✓	✓	✓	✓	✓	✓	✓
winaccel.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
globmerger.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
msseccore.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓

페이지 해시 범위 (유형 0x21, 4 KB 페이지당 20바이트, 16페이지 초과 구간에서 무작위 샘플링):

모듈	길이	페이지
ntoskrnl.exe	0x1604000	5636
dxgkrnl.sys	0x4fc000	1276
Ntfs.sys	0x36e000	878
tcpip.sys	0x35c000	860
ndis.sys	0x1c2000	450
CI.dll	0x11e000	286
clipsp.sys	0x11b000	283
cng.sys	0xed000	237
win32k.sys	0xcb000	203
FLTMGR.SYS	0x99000	153
CLFS.SYS	0x90000	144
msrpc.sys	0x69000	105
ksecdd.sys	0x3a000	58
tm.sys	0x2e000	46
watchdog.sys	0x24000	36
globmerger.sys	0x24000	36
PSHED.dll	0x21000	33
werkernel.sys	0x1b000	27
winaccel.sys	0x19000	25
cmimcext.sys	0x16000	22
msseccore.sys	0x13000	19
symcryptk.dll	0x11000	17
BOOTVID.dll	0x11000	17
ntosext.sys	0x11000	17
WMILIB.SYS	0x11000	17
kdcom.dll	0xf000	15
hal.dll	0xa000	10

---

2. 명명된 전역 변수

전역 컨텍스트에서는 유형 0x20, 일반 컨텍스트에서는 0x00.

기호	크기
nt!KiServiceTable	0x7a4
nt!KeServiceDescriptorTable	0x20
nt!KeServiceDescriptorTable+0x20	0x20
nt!KeServiceDescriptorTableShadow	0x20
nt!KeServiceDescriptorTableShadow+0x20	0x20
nt!KeServiceDescriptorTableFilter	0x20
nt!KeServiceDescriptorTableFilter+0x20	0x20
nt!PsAltSystemCallHandlers	0x10
win32k.sys!TABLERO+0x0	0x1764
win32k.sys!TABLERO+0x2330	0x1764
nt!HalDispatchTable+0x8	0x8
nt!HalPrivateDispatchTable+0x450	0x8
nt!HalPerformEndOfInterruptAtController	0x8
nt!HalpProfileInterface	0x8
nt!HalpProfileFeatures	0x4
nt!SeCiCallbacks	0x110
nt!SeCiDebugOptions	0x4
nt!SeILSigningPolicy	0x1
nt!SeProtectedMapping	0x12
nt!SeMsMinTCBList	0x198
nt!g_SecureBootPolicyBlobHeader	0x18
CI.dll!CiPolicy+0x0	0x4
CI.dll!CiPolicy+0x4	0x4
CI.dll!CiPolicy+0x8	0x1
CI.dll!CiPolicy+0xc	0x4
CI.dll!CiPolicy+0x10	0x4
CI.dll!.data+0x1588	0x8
CI.dll!.data+0x15a0	0x70
CI.dll!.data+0x1640	0x40
nt!HvcallCodeVa	0x8
nt!HvlpHypercallCodeVa	0x8
nt!HvlpVsmVtlCallVa	0x8
nt!HvlpInterruptCallback	0x28
nt!MiState+0xca0	0x8
nt!MiState+0xca8	0x8
nt!MmBadPointer	0x8
nt!MmHighestUserAddress	0x8
nt!MmUserProbeAddress	0x8
nt!MmSystemRangeStart	0x8
nt!KiKvaShadow	0x1
nt!KiIsrThunkShadow	0x800
nt!KiDebugTraps	0x40
nt!KiDynamicTraceEnabled	0x4
nt!KiDynamicTraceCallouts	0x58
nt!ObpObjectTypes	0x1d0
nt!ExpInitializeCallback	0x80
nt!PsWin32NullCallBack	0x8
nt!PspPicoProviderRoutines	0x58
nt!PspSystemMitigationOptions	0x18
nt!PsInvertedFunctionTable+0x10	0x18
nt!RtlpUnwindHistoryTable	0xd8
nt!RtlProtectedAccess	0x6c
nt!InitSafeBootMode	0x4
nt!KdpBootedNodebug	0x1
nt!__ti_a	0x158
KUSER_SHARED_DATA+0x274	0x40
KUSER_SHARED_DATA+0x308	0x4
KUSER_SHARED_DATA+0xa80	0x580
msseccore.sys!.rdata+0x0	0x10
msseccore.sys!SecKdpSe+0x8	0x8

---

3. 객체 유형

유형 0x08(0x20으로 중복됨): 예외 없이 시스템의 모든 58개 객체 유형의 _OBJECT_TYPE_INITIALIZER 중 0x40 바이트.

ALPC Port            ActivationObject     ActivityReference    Adapter
Callback             Composition          Controller           CoreMessaging
CoverageSampler      CpuPartition         DebugObject          Desktop
Device               Directory            DmaAdapter           Driver
EnergyTracker        EtwConsumer          EtwRegistration      EtwSessionDemuxEntry
Event                File                 IRTimer              IoCompletion
IoCompletionReserve  IoRing               Job                  Key
KeyedEvent           Mutant               Partition            PowerRequest
Process              ProcessStateChange   Profile              PsSiloContextNonPaged
PsSiloContextPaged   RawInputManager      RegistryTransaction  SchedulerSharedData
Section              Semaphore            Session              SymbolicLink
Thread               ThreadStateChange    Timer                TmEn
TmRm                 TmTm                 TmTx                 Token
TpWorkerFactory      Type                 UserApcReserve       WaitCompletionPacket
WindowStation        WmiGuid

---

4. 프로세서별

이 부팅 환경에는 2개의 CPU가 있으며, CPU당 13개 영역과 IDT 및 GDT가 있습니다.

유형	영역	크기
0x02	IDT — 처음 53개 벡터	0x350
0x03	GDT	0x50
0x03	세그먼트 레지스터 LDTR, SS, TR (KiGetLdtr/KiGetSs/KiGetTr)	—
0x20/0x00	KPCR+0x00 — GdtBase	0x8
0x20/0x00	KPCR+0x08 — TssBase	0x8
0x20/0x00	KPCR+0x38 — IdtBase	0x8
0x20/0x00	KPCR+0x108	0x8
0x20/0x00	IoMapBase까지의 전체 _KTSS64	0x68
0x20/0x00	TSS.Ist[1] … TSS.Ist[4] (스트라이드 0x200)	0x10 ×4
0x20/0x00	32 KB 블록 4개의 끝에 있는 역방향 포인터 워드 (스트라이드 0x8000)	0x8 ×4

모든 프로세서가 공유:

유형	영역	크기
0x20/0x00	32개의 {ntoskrnl RVA, address} 레코드 테이블, 두 개의 연속 블록	0x200 ×2

---

5. MSR

유형 0x07, 프로세서당 하나의 디스크립터, 각각 11개의 MSR.