PatchGuard 监视内容清单

ntoskrnl.exe 10.0.26100.9168（Win11 24H2）· 转储 mem09.elf · 3 个上下文 （全局、ExpTimeZoneDpcRoutine、ExpTimerDpcRoutine）· 1126 个描述符 · 861/861 已验证 · 调度器识别的 49 种类型中已实例化 34 种。

---

1. 模块

已加载的 168 个模块中有 27 个。

模块	0x00 EXPORT	0x00 .xdata	0x01 .pdata	0x1E 填充	0x0D IAT	0x23 LOAD_CONFIG	0x2C PE 头	0x30 retpoline	0x21 页哈希
ntoskrnl.exe	✓	✓	✓	✓	✓	✓	✓	·	✓
hal.dll	✓	·	·	·	·	·	✓	·	✓
win32k.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
CI.dll	✓	✓	✓	✓	✓	✓	✓	✓	✓
ndis.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
tcpip.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
Ntfs.sys	·	✓	✓	✓	✓	✓	✓	✓	✓
FLTMGR.SYS	✓	✓	✓	✓	✓	✓	✓	✓	✓
msrpc.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
ksecdd.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
cng.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
clipsp.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
dxgkrnl.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
watchdog.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
PSHED.dll	✓	✓	✓	✓	✓	✓	✓	✓	✓
BOOTVID.dll	✓	✓	✓	✓	✓	✓	✓	✓	✓
kdcom.dll	✓	✓	✓	✓	✓	✓	✓	✓	✓
CLFS.SYS	✓	✓	✓	✓	✓	✓	✓	✓	✓
tm.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
WMILIB.SYS	✓	✓	✓	✓	✓	✓	✓	✓	✓
werkernel.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
ntosext.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
cmimcext.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
symcryptk.dll	✓	✓	✓	✓	✓	✓	✓	✓	✓
winaccel.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
globmerger.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓
msseccore.sys	✓	✓	✓	✓	✓	✓	✓	✓	✓

页哈希范围（类型 0x21，每 4 KB 页 20 字节，在超过 16 页的范围内随机采样）：

模块	长度	页数
ntoskrnl.exe	0x1604000	5636
dxgkrnl.sys	0x4fc000	1276
Ntfs.sys	0x36e000	878
tcpip.sys	0x35c000	860
ndis.sys	0x1c2000	450
CI.dll	0x11e000	286
clipsp.sys	0x11b000	283
cng.sys	0xed000	237
win32k.sys	0xcb000	203
FLTMGR.SYS	0x99000	153
CLFS.SYS	0x90000	144
msrpc.sys	0x69000	105
ksecdd.sys	0x3a000	58
tm.sys	0x2e000	46
watchdog.sys	0x24000	36
globmerger.sys	0x24000	36
PSHED.dll	0x21000	33
werkernel.sys	0x1b000	27
winaccel.sys	0x19000	25
cmimcext.sys	0x16000	22
msseccore.sys	0x13000	19
symcryptk.dll	0x11000	17
BOOTVID.dll	0x11000	17
ntosext.sys	0x11000	17
WMILIB.SYS	0x11000	17
kdcom.dll	0xf000	15
hal.dll	0xa000	10

---

2. 命名全局变量

全局上下文中为类型 0x20，常规上下文中为 0x00。

符号	大小
nt!KiServiceTable	0x7a4
nt!KeServiceDescriptorTable	0x20
nt!KeServiceDescriptorTable+0x20	0x20
nt!KeServiceDescriptorTableShadow	0x20
nt!KeServiceDescriptorTableShadow+0x20	0x20
nt!KeServiceDescriptorTableFilter	0x20
nt!KeServiceDescriptorTableFilter+0x20	0x20
nt!PsAltSystemCallHandlers	0x10
win32k.sys!TABLERO+0x0	0x1764
win32k.sys!TABLERO+0x2330	0x1764
nt!HalDispatchTable+0x8	0x8
nt!HalPrivateDispatchTable+0x450	0x8
nt!HalPerformEndOfInterruptAtController	0x8
nt!HalpProfileInterface	0x8
nt!HalpProfileFeatures	0x4
nt!SeCiCallbacks	0x110
nt!SeCiDebugOptions	0x4
nt!SeILSigningPolicy	0x1
nt!SeProtectedMapping	0x12
nt!SeMsMinTCBList	0x198
nt!g_SecureBootPolicyBlobHeader	0x18
CI.dll!CiPolicy+0x0	0x4
CI.dll!CiPolicy+0x4	0x4
CI.dll!CiPolicy+0x8	0x1
CI.dll!CiPolicy+0xc	0x4
CI.dll!CiPolicy+0x10	0x4
CI.dll!.data+0x1588	0x8
CI.dll!.data+0x15a0	0x70
CI.dll!.data+0x1640	0x40
nt!HvcallCodeVa	0x8
nt!HvlpHypercallCodeVa	0x8
nt!HvlpVsmVtlCallVa	0x8
nt!HvlpInterruptCallback	0x28
nt!MiState+0xca0	0x8
nt!MiState+0xca8	0x8
nt!MmBadPointer	0x8
nt!MmHighestUserAddress	0x8
nt!MmUserProbeAddress	0x8
nt!MmSystemRangeStart	0x8
nt!KiKvaShadow	0x1
nt!KiIsrThunkShadow	0x800
nt!KiDebugTraps	0x40
nt!KiDynamicTraceEnabled	0x4
nt!KiDynamicTraceCallouts	0x58
nt!ObpObjectTypes	0x1d0
nt!ExpInitializeCallback	0x80
nt!PsWin32NullCallBack	0x8
nt!PspPicoProviderRoutines	0x58
nt!PspSystemMitigationOptions	0x18
nt!PsInvertedFunctionTable+0x10	0x18
nt!RtlpUnwindHistoryTable	0xd8
nt!RtlProtectedAccess	0x6c
nt!InitSafeBootMode	0x4
nt!KdpBootedNodebug	0x1
nt!__ti_a	0x158
KUSER_SHARED_DATA+0x274	0x40
KUSER_SHARED_DATA+0x308	0x4
KUSER_SHARED_DATA+0xa80	0x580
msseccore.sys!.rdata+0x0	0x10
msseccore.sys!SecKdpSe+0x8	0x8

---

3. 对象类型

类型 0x08（重复为 0x20）：系统中全部 58 种对象类型的 _OBJECT_TYPE_INITIALIZER 的 0x40 字节，无一例外。

ALPC Port            ActivationObject     ActivityReference    Adapter
Callback             Composition          Controller           CoreMessaging
CoverageSampler      CpuPartition         DebugObject          Desktop
Device               Directory            DmaAdapter           Driver
EnergyTracker        EtwConsumer          EtwRegistration      EtwSessionDemuxEntry
Event                File                 IRTimer              IoCompletion
IoCompletionReserve  IoRing               Job                  Key
KeyedEvent           Mutant               Partition            PowerRequest
Process              ProcessStateChange   Profile              PsSiloContextNonPaged
PsSiloContextPaged   RawInputManager      RegistryTransaction  SchedulerSharedData
Section              Semaphore            Session              SymbolicLink
Thread               ThreadStateChange    Timer                TmEn
TmRm                 TmTm                 TmTx                 Token
TpWorkerFactory      Type                 UserApcReserve       WaitCompletionPacket
WindowStation        WmiGuid

---

4. 每处理器

本次启动有 2 个 CPU，每个 CPU 有 13 个区域，外加 IDT 和 GDT。

类型	区域	大小
0x02	IDT — 前 53 个向量	0x350
0x03	GDT	0x50
0x03	段寄存器 LDTR、SS、TR（KiGetLdtr/KiGetSs/KiGetTr）	—
0x20/0x00	KPCR+0x00 — GdtBase	0x8
0x20/0x00	KPCR+0x08 — TssBase	0x8
0x20/0x00	KPCR+0x38 — IdtBase	0x8
0x20/0x00	KPCR+0x108	0x8
0x20/0x00	整个 _KTSS64，直到 IoMapBase	0x68
0x20/0x00	TSS.Ist[1] … TSS.Ist[4]（步长 0x200）	0x10 ×4
0x20/0x00	4 个 32 KB 块末尾的回指字（步长 0x8000）	0x8 ×4

所有处理器共享：

类型	区域	大小
0x20/0x00	32 条 {ntoskrnl RVA, address} 记录表，两个连续块	0x200 ×2

---

5. MSR

类型 0x07，每个处理器一个描述符，每个描述符包含 11 个 MSR。

MSR	名称	掩码	预期值
0xC0000082	IA32_LSTAR	~0	nt!KiSystemCall64Shadow
0xC0000083	IA32_CSTAR	~0	nt!KiSystemCall32Shadow
0xC0000081	IA32_STAR	~0	0x0023001000000000
0xC0000084	IA32_FMASK	~0	0x4700
0xC0000080	IA32_EFER	~0x1000	0xd01
0xC0000103	IA32_TSC_AUX	~0	处理器索引
0x1B	IA32_APIC_BASE	~0	0xfee00900（CPU 0）/ 0xfee00800（CPU 1）
0x174	IA32_SYSENTER_CS	~0	0
0x175	IA32_SYSENTER_ESP	~0	0
0x176	IA32_SYSENTER_EIP	~0	0
0x1A0	IA32_MISC_ENABLE	0x400440000	0（第 18、22、34 位）

---

6. 控制寄存器

每个处理器和寄存器一个描述符。