分类：
2008-10-13 16:13:15
可等待的东西的头部是一样的，这个头部我会在后面贴出来。具体类型有：
typedef enum _KOBJECTS {
EventNotificationObject = 0,
EventSynchronizationObject = 1,
MutantObject = 2,
ProcessObject = 3,
QueueObject = 4,
SemaphoreObject = 5,
ThreadObject = 6,
Spare1Object = 7,
TimerNotificationObject = 8,
TimerSynchronizationObject = 9,
Spare2Object = 10,
Spare3Object = 11,
Spare4Object = 12,
Spare5Object = 13,
Spare6Object = 14,
Spare7Object = 15,
Spare8Object = 16,
Spare9Object = 17,
ApcObject,
DpcObject,
DeviceQueueObject,
EventPairObject,
InterruptObject,
ProfileObject
} KOBJECTS;
typedef struct _DISPATCHER_HEADER {
UCHAR Type;
UCHAR Absolute;
UCHAR Size;
UCHAR Inserted;
LONG SignalState;
LIST_ENTRY WaitListHead;
} DISPATCHER_HEADER;
第一个TYPE就是上面的枚举类型
1、EVENT的内核部分如下：
typedef struct _KEVENT {
DISPATCHER_HEADER Header;
} KEVENT, *PKEVENT, *RESTRICTED_POINTER PRKEVENT;
就是一个光光的Header
2、MUTEX的结构
typedef struct _KMUTANT {
DISPATCHER_HEADER Header;
LIST_ENTRY MutantListEntry;
struct _KTHREAD *RESTRICTED_POINTER OwnerThread;
BOOLEAN Abandoned;
UCHAR ApcDisable;
} KMUTANT, *PKMUTANT, *RESTRICTED_POINTER PRKMUTANT, KMUTEX, *PKMUTEX, *RESTRICTED_POINTER PRKMUTEX;
3、typedef struct _KQUEUE {
DISPATCHER_HEADER Header;
LIST_ENTRY EntryListHead;
ULONG CurrentCount;
ULONG MaximumCount;
LIST_ENTRY ThreadListHead;
} KQUEUE, *PKQUEUE, *RESTRICTED_POINTER PRKQUEUE;
这个东东我也不知道是用在啥地方的，惭愧
4、SEMAPHORE
typedef struct _KSEMAPHORE {
DISPATCHER_HEADER Header;
LONG Limit;
} KSEMAPHORE, *PKSEMAPHORE, *RESTRICTED_POINTER PRKSEMAPHORE;
5、TIMER
typedef struct _KTIMER {
DISPATCHER_HEADER Header;
ULARGE_INTEGER DueTime;
LIST_ENTRY TimerListEntry;
struct _KDPC *Dpc;
LONG Period;
} KTIMER, *PKTIMER, *RESTRICTED_POINTER PRKTIMER;
6、KTHREAD
typedef struct _KTHREAD {
//
// The dispatcher header and mutant listhead are fairly infrequently
// referenced, but pad the thread to a 32-byte boundary (assumption
// that pool allocation is in units of 32-bytes).
//
DISPATCHER_HEADER Header;
LIST_ENTRY MutantListHead;
//
// The following fields are referenced during trap, interrupts, or
// context switches.
//
// N.B. The Teb address and TlsArray are loaded as a quadword quantity
// on MIPS and therefore must be on a quadword boundary.
//
PVOID InitialStack;
PVOID StackLimit;
#if defined(_IA64_)
PVOID InitialBStore;
PVOID BStoreLimit;
#endif
PVOID Teb;
PVOID TlsArray;
PVOID KernelStack;
#if defined(_IA64_)
PVOID KernelBStore;
#endif
BOOLEAN DebugActive;
UCHAR State;
BOOLEAN Alerted[MaximumMode];
UCHAR Iopl;
UCHAR NpxState;
CHAR Saturation;
SCHAR Priority;
KAPC_STATE ApcState;
ULONG ContextSwitches;
//
// The following fields are referenced during wait operations.
//
LONG_PTR WaitStatus;
KIRQL WaitIrql;
KPROCESSOR_MODE WaitMode;
BOOLEAN WaitNext;
UCHAR WaitReason;
PRKWAIT_BLOCK WaitBlockList;
LIST_ENTRY WaitListEntry;
ULONG WaitTime;
SCHAR BasePriority;
UCHAR DecrementCount;
SCHAR PriorityDecrement;
SCHAR Quantum;
KWAIT_BLOCK WaitBlock[THREAD_WAIT_OBJECTS + 1];
PVOID LegoData;
ULONG KernelApcDisable;
KAFFINITY UserAffinity;
BOOLEAN SystemAffinityActive;
UCHAR PowerState;
UCHAR NpxIrql;
UCHAR Pad[1];
PVOID ServiceTable;
// struct _ECHANNEL *Channel;
// PVOID Section;
// PCHANNEL_MESSAGE SystemView;
// PCHANNEL_MESSAGE ThreadView;
//
// The following fields are referenced during queue operations.
//
PRKQUEUE Queue;
KSPIN_LOCK ApcQueueLock;
KTIMER Timer;
LIST_ENTRY QueueListEntry;
//
// The following fields are referenced during read and find ready
// thread.
//
KAFFINITY Affinity;
BOOLEAN Preempted;
BOOLEAN ProcessReadyQueue;
BOOLEAN KernelStackResident;
UCHAR NextProcessor;
//
// The following fields are referenced during system calls.
//
PVOID CallbackStack;
#if defined(_IA64_)
PVOID CallbackBStore;
#endif
PVOID Win32Thread;
PKTRAP_FRAME TrapFrame;
PKAPC_STATE ApcStatePointer[2];
CCHAR PreviousMode;
UCHAR EnableStackSwap;
UCHAR LargeStack;
UCHAR ResourceIndex;
//
// The following entries are referenced during clock interrupts.
//
ULONG KernelTime;
ULONG UserTime;
//
// The following fields are referenced during APC queuing and process
// attach/detach.
//
KAPC_STATE SavedApcState;
BOOLEAN Alertable;
UCHAR ApcStateIndex;
BOOLEAN ApcQueueable;
BOOLEAN AutoAlignment;
//
// The following fields are referenced when the thread is initialized
// and very infrequently thereafter.
//
PVOID StackBase;
KAPC SuspendApc;
KSEMAPHORE SuspendSemaphore;
LIST_ENTRY ThreadListEntry;
//
// N.B. The below four UCHARs share the same DWORD and are modified
// by other threads. Therefore, they must ALWAYS be modified
// under the dispatcher lock to prevent granularity problems
// on Alpha machines.
//
CCHAR FreezeCount;
CCHAR SuspendCount;
UCHAR IdealProcessor;
UCHAR DisableBoost;
} KTHREAD, *PKTHREAD, *RESTRICTED_POINTER PRKTHREAD;
7、KPROCESS
typedef struct _KPROCESS {
//
// The dispatch header and profile listhead are fairly infrequently
// referenced, but pad the process to a 32-byte boundary (assumption
// that pool block allocation is in units of 32-bytes).
//
DISPATCHER_HEADER Header;
LIST_ENTRY ProfileListHead;
//
// The following fields are referenced during context switches.
//
ULONG_PTR DirectoryTableBase[2];
#if defined(_X86_)
KGDTENTRY LdtDescriptor;
KIDTENTRY Int21Descriptor;
USHORT IopmOffset;
UCHAR Iopl;
BOOLEAN VdmFlag;
#endif
#if defined(_IA64_)
KGDTENTRY LdtDescriptor;
ULONGLONG UnscrambledLdtDescriptor;
KIDTENTRY Int21Descriptor;
BOOLEAN VdmFlag;
REGION_MAP_INFO ProcessRegion;
REGION_MAP_INFO SessionRegion;
PREGION_MAP_INFO SessionMapInfo;
ULONG_PTR SessionParentBase;
#endif // _IA64_
#if defined(_ALPHA_)
union {
struct {
KAFFINITY ActiveProcessors;
KAFFINITY RunOnProcessors;
};
ULONGLONG Alignment;
};
ULONGLONG ProcessSequence;
ULONG ProcessAsn;
#else
KAFFINITY ActiveProcessors;
#endif
//
// The following fields are referenced during clock interrupts.
//
ULONG KernelTime;
ULONG UserTime;
//
// The following fields are referenced infrequently.
//
LIST_ENTRY ReadyListHead;
LIST_ENTRY SwapListEntry;
LIST_ENTRY ThreadListHead;
KSPIN_LOCK ProcessLock;
KAFFINITY Affinity;
USHORT StackCount;
SCHAR BasePriority;
SCHAR ThreadQuantum;
BOOLEAN AutoAlignment;
UCHAR State;
UCHAR ThreadSeed;
BOOLEAN DisableBoost;
UCHAR PowerState;
BOOLEAN DisableQuantum;
UCHAR Spare[2];
} KPROCESS, *PKPROCESS, *RESTRICTED_POINTER PRKPROCESS;
