0

i want to see all graphics functions from the win32k!W32pServiceTable function pointer Array but it only returns "????"

kd> dps nt!KeServiceDescriptorTableShadow L8
8298f980  8288b73c nt!KiServiceTable
8298f984  00000000
8298f988  00000191
8298f98c  8288bd84 nt!KiArgumentTable
8298f990  82376000 win32k!W32pServiceTable
8298f994  00000000
8298f998  00000339
8298f99c  8237702c win32k!W32pArgumentTable

kd> dps win32k!W32pServiceTable
82376000  ????????
82376004  ????????
82376008  ????????
8237600c  ????????
82376010  ????????
82376014  ????????
82376018  ????????
8237601c  ????????
82376020  ????????
82376024  ????????
82376028  ????????
8237602c  ????????
82376030  ????????
82376034  ????????
82376038  ????????
8237603c  ????????
82376040  ????????
82376044  ????????
82376048  ????????
8237604c  ????????
82376050  ????????
82376054  ????????
82376058  ????????
8237605c  ????????
82376060  ????????
82376064  ????????
82376068  ????????
8237606c  ????????
82376070  ????????
82376074  ????????
82376078  ????????
8237607c  ????????

Target OS is Windows 7 32 bit

1 Answer 1

2

From http://www.osronline.com/showthread.cfm?link=165166#T2:

When looking at session space you need to switch to a process from the appropriate session. If you just want to disassemble win32k code, any interactive process will do (e.g. explorer.exe):

!process 0 0 explorer.exe

.process /P <EPROCESS>

1
  • aight, works , thx very much
    – test123423
    Sep 28, 2015 at 18:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.