扫描0x888d 的方式，win7 shadow 无内容，反汇编看看，做个备忘。
@note : shadow 只在gui 进程内有效.
kd> .process /p 8807eaf0
Implicit process is now 8807eaf0
.cache forcedecodeuser done
kd> dd KeServiceDescriptorTable
83fb19c0 83ec5d9c 00000000 00000191 83ec63e4
83fb19d0 00000000 00000000 00000000 00000000
83fb19e0 83f246af 00000000 02b88043 00000bb8
83fb19f0 00000011 00000100 5385d2ba d717548f
83fb1a00 83ec5d9c 00000000 00000191 83ec63e4
83fb1a10 93806000 00000000 00000339 9380702c
83fb1a20 00000000 00000000 83fb1a24 00000240
83fb1a30 00000240 86402c10 00000003 00000000
kd> dd 93806000
93806000 93793d37 937abc23 936071ac 937a2c5d
93806010 937ad369 93794554 937945e8 936bdad1
93806020 937acb94 93671965 93671882 937aeead
93806030 937ad085 937abc97 936b28cb 937acfd8
93806040 937afc51 937abb9e 936e4a88 937ad10f
93806050 937af645 93672069 937188bf 9373c7bc
93806060 937b063d 937a5659 936d358b 937ad075
93806070 937276c3 937af508 937af8d2 936acf2e
kd> ln 93793d37
(93793d37) win32k!NtGdiAbortDoc | (93793d4f) win32k!NtGdiStartPage
Exact matches:
win32k!NtGdiAbortDoc =
kd> uf nt!KeAddSystemServiceTable
nt!KeAddSystemServiceTable:
83fd4008 8bff mov edi,edi
83fd400a 55 push ebp
83fd400b 8bec mov ebp,esp
83fd400d 837d1801 cmp dword ptr [ebp+18h],1 ;比较server descriptor table 索引号，0开始，只使用前两项，故在此判断.
83fd4011 7760 ja nt!KeAddSystemServiceTable+0x6b (83fd4073) ;大于则返回 0 /False
nt!KeAddSystemServiceTable+0xb:
83fd4013 8b4518 mov eax,dword ptr [ebp+18h]
83fd4016 c1e004 shl eax,4
83fd4019 83b8c019fb8300 cmp dword ptr nt!KeServiceDescriptorTable (83fb19c0)[eax],0 ;判断是否是需要填充的ki服务表项.
83fd4020 7551 jne nt!KeAddSystemServiceTable+0x6b (83fd4073)
nt!KeAddSystemServiceTable+0x1a:
83fd4022 8d88001afb83 lea ecx,nt!KeServiceDescriptorTableShadow (83fb1a00)[eax]
83fd4028 833900 cmp dword ptr [ecx],0
83fd402b 7546 jne nt!KeAddSystemServiceTable+0x6b (83fd4073);判断是否是需要填充的shadow表项
nt!KeAddSystemServiceTable+0x25:
83fd402d 837d1801 cmp dword ptr [ebp+18h],1
83fd4031 8b5508 mov edx,dword ptr [ebp+8] ;当前描述表的base 基址
83fd4034 56 push esi
83fd4035 8b7510 mov esi,dword ptr [ebp+10h] ;server descriptor table limit ： number of entry
83fd4038 57 push edi
83fd4039 8b7d14 mov edi,dword ptr [ebp+14h] ;number
83fd403c 8911 mov dword ptr [ecx],edx
83fd403e 8b4d0c mov ecx,dword ptr [ebp+0Ch] ;count
83fd4041 8988041afb83 mov dword ptr nt!KeServiceDescriptorTableShadow+0x4 (83fb1a04)[eax],ecx
83fd4047 89b0081afb83 mov dword ptr nt!KeServiceDescriptorTableShadow+0x8 (83fb1a08)[eax],esi
83fd404d 89b80c1afb83 mov dword ptr nt!KeServiceDescriptorTableShadow+0xc (83fb1a0c)[eax],edi
83fd4053 7418 je nt!KeAddSystemServiceTable+0x65 (83fd406d)
nt!KeAddSystemServiceTable+0x4d:
83fd4055 8990c019fb83 mov dword ptr nt!KeServiceDescriptorTable (83fb19c0)[eax],edx
83fd405b 8988c419fb83 mov dword ptr nt!KeServiceDescriptorTable+0x4 (83fb19c4)[eax],ecx
83fd4061 89b0c819fb83 mov dword ptr nt!KeServiceDescriptorTable+0x8 (83fb19c8)[eax],esi
83fd4067 89b8cc19fb83 mov dword ptr nt!KeServiceDescriptorTable+0xc (83fb19cc)[eax],edi
nt!KeAddSystemServiceTable+0x65:
83fd406d 5f pop edi
83fd406e b001 mov al,1
83fd4070 5e pop esi
83fd4071 eb02 jmp nt!KeAddSystemServiceTable+0x6d (83fd4075)
nt!KeAddSystemServiceTable+0x6b:
83fd4073 32c0 xor al,al
nt!KeAddSystemServiceTable+0x6d:
83fd4075 5d pop ebp
83fd4076 c21400 ret 14h
