겸손한 개발을 위한 자양분

User32 Dll 에서 제공하는 변환 API

0: kd> u USER32!WCSToMBEx
USER32!WCSToMBEx:
77d0d446 8bff            mov     edi,edi
77d0d448 55              push    ebp
77d0d449 8bec            mov     ebp,esp
77d0d44b 53              push    ebx
77d0d44c 8b5d18          mov     ebx,dword ptr [ebp+18h]
77d0d44f 85db            test    ebx,ebx
77d0d451 56              push    esi
77d0d452 57              push    edi
0: kd> u USER32!MBToWCSEx
USER32!MBToWCSEx:
77cfadad 8bff            mov     edi,edi
77cfadaf 55              push    ebp
77cfadb0 8bec            mov     ebp,esp
77cfadb2 53              push    ebx
77cfadb3 56              push    esi
77cfadb4 57              push    edi
77cfadb5 8b7d10          mov     edi,dword ptr [ebp+10h]
77cfadb8 85ff            test    edi,edi

에서 확인

Proto Type :
DWORD STDCALL WCSToMBEx(
                                 WORD CodePage,
                                 LPWSTR UnicodeString,
                                 DWORD UnicodeSize,
                                 LPSTR *MBString,
                                 DWORD MBSize,
                                 BOOL Allocate);


DWORD STDCALL MBToWCSEx(
                                 WORD CodePage,
                                 LPSTR MBString,
                                 DWORD MBSize,
                                 LPWSTR UnicodeString,
                                 DWORD UnicodeSize,
                                 BOOL Allocate);


주목할 Parameters

Size : -1 일 경우 사이즈 자동 체크.
Allocate : TRUE 일 경우, 받는 버퍼의 메모리를 할당. ( MultiByteToWideChar 계열 함수와 차이 )

우선, 커널 변수를 이용하여, 테이블 위치 확인

0: kd> dd KeServiceDescriptorTable
8055c700 80504450 00000000 0000011c 805048c4
8055c710  00000000 00000000 00000000 00000000
8055c720  00000000 00000000 00000000 00000000
8055c730  00000000 00000000 00000000 00000000
8055c740  00000002 00002710 bf80c0b6 00000000
8055c750  f719ba80 f6b89b60 86d74950 806f60c0
8055c760  00000000 00000000 ffea8ad6 ffffffff
8055c770  ee4ae396 01c90284 00000000 00000000

0: kd> dd KeServiceDescriptorTableShadow
8055c6c0  80504450 00000000 0000011c 805048c4
8055c6d0  bf999b80 00000000 0000029b bf99a890
8055c6e0  00000000 00000000 00000000 00000000
8055c6f0  00000000 00000000 00000000 00000000
8055c700  80504450 00000000 0000011c 805048c4
8055c710  00000000 00000000 00000000 00000000
8055c720  00000000 00000000 00000000 00000000
8055c730  00000000 00000000 00000000 00000000

KeServiceDescriptorTable 에서, NtOsKrnl 에 연결된 서비스.
KeServiceDescriptorTableShadow 에서, Win32K 에 연결된 서비스 를 확인 할 수 있다.

typedef struct _SERVICE_DESCRIPTOR_TABLE
{
PULONG  ServiceTable;  // array of entry-points
PULONG  puCounterTable;  // array of counters
ULONG  uTableSize;   // number of table entries
PUCHAR  pbArgumentTable; // array of byte counts
} SERVICE_DESCRIPTOR_TABLE, *PSERVICE_DESCRIPTOR_TABLE;

ServiceDescriptorTable의 구조가 위와 같으므로,
앞의 SDT에서는
ServiceTable Array of Entry 가 80504450
Entry의 개수는 0000011c 개 임을 알 수 있다.

출력하여 보면
0: kd> dds 0x80504450 L11c
80504450  805a4614 nt!NtAcceptConnectPort
80504454  805f0adc nt!NtAccessCheck
80504458  805f4312 nt!NtAccessCheckAndAuditAlarm
8050445c  805f0b0e nt!NtAccessCheckByType
80504460  805f434c nt!NtAccessCheckByTypeAndAuditAlarm
80504464  805f0b44 nt!NtAccessCheckByTypeResultList
80504468  805f4390 nt!NtAccessCheckByTypeResultListAndAuditAlarm
8050446c  805f43d4 nt!NtAccessCheckByTypeResultListAndAuditAlarmByHandle
80504470  806153a2 nt!NtAddAtom
...

위와 같이 List를 확인할 수 있다.
덧붙혀, 위의 순서가 바로 서비스 Index가 된다.

NAME

signal - list of available signals

DESCRIPTION

Linux supports both POSIX reliable signals (hereinafter "standard signals") and POSIX real-time signals.

Standard Signals

Linux supports the standard signals listed below. Several signal numbers are architecture dependent, as indicated in the "Value" column. (Where three values are given, the first one is usually valid for alpha and sparc, the middle one for i386, ppc and sh, and the last one for mips. A - denotes that a signal is absent on the corresponding architecture.)

The entries in the "Action" column of the table specify the default action for the signal, as follows:

Term
Default action is to terminate the process.
Ign
Default action is to ignore the signal.
Core
Default action is to terminate the process and dump core.
Stop
Default action is to stop the process.

First the signals described in the original POSIX.1 standard.

Signal Value Action Comment







or death of controlling process
SIGINT 2 Term Interrupt from keyboard
SIGQUIT 3 Core Quit from keyboard
SIGILL 4 Core Illegal Instruction
SIGABRT 6 Core Abort signal from abort(3)
SIGFPE 8 Core Floating point exception
SIGKILL 9 Term Kill signal
SIGSEGV 11 Core Invalid memory reference
SIGPIPE 13 Term Broken pipe: write to pipe with no readers
SIGALRM 14 Term Timer signal from alarm(2)
SIGTERM 15 Term Termination signal
SIGUSR1 30,10,16 Term User-defined signal 1
SIGUSR2 31,12,17 Term User-defined signal 2
SIGCHLD 20,17,18 Ign Child stopped or terminated
SIGCONT 19,18,25
Continue if stopped
SIGSTOP 17,19,23 Stop Stop process
SIGTSTP 18,20,24 Stop Stop typed at tty
SIGTTIN 21,21,26 Stop tty input for background process
SIGTTOU 22,22,27 Stop tty output for background process

The signals SIGKILL and SIGSTOP cannot be caught, blocked, or ignored.

Next the signals not in the POSIX.1 standard but described in SUSv2 and SUSv3 / POSIX 1003.1-2001.

Signal Value Action Comment




SIGPOLL
Term Pollable event (Sys V). Synonym of SIGIO
SIGPROF 27,27,29 Term Profiling timer expired
SIGSYS 12,-,12 Core Bad argument to routine (SVID)
SIGTRAP 5 Core Trace/breakpoint trap
SIGURG 16,23,21 Ign Urgent condition on socket (4.2 BSD)
SIGVTALRM 26,26,28 Term Virtual alarm clock (4.2 BSD)
SIGXCPU 24,24,30 Core CPU time limit exceeded (4.2 BSD)
SIGXFSZ 25,25,31 Core File size limit exceeded (4.2 BSD)

Up to and including Linux 2.2, the default behaviour for SIGSYS, SIGXCPU, SIGXFSZ, and (on architectures other than SPARC and MIPS) SIGBUS was to terminate the process (without a core dump). (On some other Unices the default action for SIGXCPU and SIGXFSZ is to terminate the process without a core dump.) Linux 2.4 conforms to the POSIX 1003.1-2001 requirements for these signals, terminating the process with a core dump.

Next various other signals.

Signal Value Action Comment




SIGEMT 7,-,7 Term
SIGSTKFLT -,16,- Term Stack fault on coprocessor (unused)
SIGIO 23,29,22 Term I/O now possible (4.2 BSD)
SIGCLD -,-,18 Ign A synonym for SIGCHLD
SIGPWR 29,30,19 Term Power failure (System V)
SIGINFO 29,-,-
A synonym for SIGPWR
SIGLOST -,-,- Term File lock lost
SIGWINCH 28,28,20 Ign Window resize signal (4.3 BSD, Sun)
SIGUNUSED -,31,- Term Unused signal (will be SIGSYS)

(Signal 29 is SIGINFO / SIGPWR on an alpha but SIGLOST on a sparc.)

SIGEMT is not specified in POSIX 1003.1-2001, but neverthless appears on most other Unices, where its default action is typically to terminate the process with a core dump.

SIGPWR (which is not specified in POSIX 1003.1-2001) is typically ignored by default on those other Unices where it appears.

SIGIO (which is not specified in POSIX 1003.1-2001) is ignored by default on several other Unices.

Real-time Signals

Linux supports real-time signals as originally defined in the POSIX.4 real-time extensions (and now included in POSIX 1003.1-2001). Linux supports 32 real-time signals, numbered from 32 (SIGRTMIN) to 63 (SIGRTMAX). (Programs should always refer to real-time signals using notation SIGRTMIN+n, since the range of real-time signal numbers varies across Unices.)

Unlike standard signals, real-time signals have no predefined meanings: the entire set of real-time signals can be used for application-defined purposes. (Note, however, that the LinuxThreads implementation uses the first three real-time signals.)

The default action for an unhandled real-time signal is to terminate the receiving process.

Real-time signals are distinguished by the following:

1.
Multiple instances of real-time signals can be queued. By contrast, if multiple instances of a standard signal are delivered while that signal is currently blocked, then only one instance is queued.
2.
If the signal is sent using sigqueue(2), an accompanying value (either an integer or a pointer) can be sent with the signal. If the receiving process establishes a handler for this signal using the SA_SIGACTION flag to sigaction(2) then it can obtain this data via the si_value field of the siginfo_t structure passed as the second argument to the handler. Furthermore, the si_pid and si_uid fields of this structure can be used to obtain the PID and real user ID of the process sending the signal.
3.
Real-time signals are delivered in a guaranteed order. Multiple real-time signals of the same type are delivered in the order they were sent. If different real-time signals are sent to a process, they are delivered starting with the lowest-numbered signal. (I.e., low-numbered signals have highest priority.)

If both standard and real-time signals are pending for a process, POSIX leaves it unspecified which is delivered first. Linux, like many other implementations, gives priority to standard signals in this case.

According to POSIX, an implementation should permit at least _POSIX_SIGQUEUE_MAX (32) real-time signals to be queued to a process. However, rather than placing a per-process limit, Linux imposes a system-wide limit on the number of queued real-time signals for all processes. This limit can be viewed (and with privilege) changed via the /proc/sys/kernel/rtsig-max file. A related file, /proc/sys/kernel/rtsig-max, can be used to find out how many real-time signals are currently queued.

CONFORMING TO

POSIX.1

SEE ALSO

kill(1), kill(2), setitimer(2), sigaction(2), signal(2), sigprocmask(2), sigqueue(2)

> ldd 실행파일이름

lloyd@lloyd-desktop:~/MyProjects/MyFirstTest/bin/Release$ ldd /usr/lib/libstdc++.so.6
    linux-gate.so.1 =>  (0xb7f5a000)
    libm.so.6 => /lib/tls/i686/cmov/libm.so.6 (0xb7e33000)
    libgcc_s.so.1 => /lib/libgcc_s.so.1 (0xb7e28000)
    libc.so.6 => /lib/tls/i686/cmov/libc.so.6 (0xb7cd8000)
    /lib/ld-linux.so.2 (0xb7f5b000)


de·pend·en·cy, -an·cyn. (pl. -cies)
1 의존 (상태)
2 종속;부속 건물, 별관
3 속국, 보호령
4 식솔
5 의존증, 중독()

디펜던시, 의존성