User32 의 UnicodeString MultibyteString 간 변환 API
USER32!WCSToMBEx:
77d0d446 8bff mov edi,edi
77d0d448 55 push ebp
77d0d449 8bec mov ebp,esp
77d0d44b 53 push ebx
77d0d44c 8b5d18 mov ebx,dword ptr [ebp+18h]
77d0d44f 85db test ebx,ebx
77d0d451 56 push esi
77d0d452 57 push edi
0: kd> u USER32!MBToWCSEx
USER32!MBToWCSEx:
77cfadad 8bff mov edi,edi
77cfadaf 55 push ebp
77cfadb0 8bec mov ebp,esp
77cfadb2 53 push ebx
77cfadb3 56 push esi
77cfadb4 57 push edi
77cfadb5 8b7d10 mov edi,dword ptr [ebp+10h]
77cfadb8 85ff test edi,edi
에서 확인
Proto Type :
WORD CodePage,
LPWSTR UnicodeString,
DWORD UnicodeSize,
LPSTR *MBString,
DWORD MBSize,
BOOL Allocate);
WORD CodePage,
LPSTR MBString,
DWORD MBSize,
LPWSTR UnicodeString,
DWORD UnicodeSize,
BOOL Allocate);
주목할 Parameters
Size : -1 일 경우 사이즈 자동 체크.
Allocate : TRUE 일 경우, 받는 버퍼의 메모리를 할당. ( MultiByteToWideChar 계열 함수와 차이 )
WinDbg // ServiceDescriptorTable 내용 확인하기
우선, 커널 변수를 이용하여, 테이블 위치 확인
8055c700 80504450 00000000 0000011c 805048c4
8055c710 00000000 00000000 00000000 00000000
8055c720 00000000 00000000 00000000 00000000
8055c730 00000000 00000000 00000000 00000000
8055c740 00000002 00002710 bf80c0b6 00000000
8055c750 f719ba80 f6b89b60 86d74950 806f60c0
8055c760 00000000 00000000 ffea8ad6 ffffffff
8055c770 ee4ae396 01c90284 00000000 00000000
8055c6c0 80504450 00000000 0000011c 805048c4
8055c6d0 bf999b80 00000000 0000029b bf99a890
8055c6e0 00000000 00000000 00000000 00000000
8055c6f0 00000000 00000000 00000000 00000000
8055c700 80504450 00000000 0000011c 805048c4
8055c710 00000000 00000000 00000000 00000000
8055c720 00000000 00000000 00000000 00000000
8055c730 00000000 00000000 00000000 00000000
KeServiceDescriptorTable 에서, NtOsKrnl 에 연결된 서비스.
KeServiceDescriptorTableShadow 에서, Win32K 에 연결된 서비스 를 확인 할 수 있다.
{
PULONG ServiceTable; // array of entry-points
PULONG puCounterTable; // array of counters
ULONG uTableSize; // number of table entries
PUCHAR pbArgumentTable; // array of byte counts
} SERVICE_DESCRIPTOR_TABLE, *PSERVICE_DESCRIPTOR_TABLE;
ServiceDescriptorTable의 구조가 위와 같으므로,
앞의 SDT에서는
ServiceTable Array of Entry 가 80504450
Entry의 개수는 0000011c 개 임을 알 수 있다.
출력하여 보면
80504450 805a4614 nt!NtAcceptConnectPort
80504454 805f0adc nt!NtAccessCheck
80504458 805f4312 nt!NtAccessCheckAndAuditAlarm
8050445c 805f0b0e nt!NtAccessCheckByType
80504460 805f434c nt!NtAccessCheckByTypeAndAuditAlarm
80504464 805f0b44 nt!NtAccessCheckByTypeResultList
80504468 805f4390 nt!NtAccessCheckByTypeResultListAndAuditAlarm
8050446c 805f43d4 nt!NtAccessCheckByTypeResultListAndAuditAlarmByHandle
80504470 806153a2 nt!NtAddAtom
...
위와 같이 List를 확인할 수 있다.
덧붙혀, 위의 순서가 바로 서비스 Index가 된다.
Linux / Unix Command: signal
NAME
signal - list of available signalsDESCRIPTION
Linux supports both POSIX reliable signals (hereinafter "standard signals") and POSIX real-time signals.Standard Signals
Linux supports the standard signals listed below. Several signal numbers are architecture dependent, as indicated in the "Value" column. (Where three values are given, the first one is usually valid for alpha and sparc, the middle one for i386, ppc and sh, and the last one for mips. A - denotes that a signal is absent on the corresponding architecture.)The entries in the "Action" column of the table specify the default action for the signal, as follows:
- Term
- Default action is to terminate the process.
- Ign
- Default action is to ignore the signal.
- Core
- Default action is to terminate the process and dump core.
- Stop
- Default action is to stop the process.
First the signals described in the original POSIX.1 standard.
Signal | Value | Action | Comment |
|
|
|
|
or death of controlling process | |||
SIGINT | 2 | Term | Interrupt from keyboard |
SIGQUIT | 3 | Core | Quit from keyboard |
SIGILL | 4 | Core | Illegal Instruction |
SIGABRT | 6 | Core | Abort signal from abort(3) |
SIGFPE | 8 | Core | Floating point exception |
SIGKILL | 9 | Term | Kill signal |
SIGSEGV | 11 | Core | Invalid memory reference |
SIGPIPE | 13 | Term | Broken pipe: write to pipe with no readers |
SIGALRM | 14 | Term | Timer signal from alarm(2) |
SIGTERM | 15 | Term | Termination signal |
SIGUSR1 | 30,10,16 | Term | User-defined signal 1 |
SIGUSR2 | 31,12,17 | Term | User-defined signal 2 |
SIGCHLD | 20,17,18 | Ign | Child stopped or terminated |
SIGCONT | 19,18,25 | Continue if stopped | |
SIGSTOP | 17,19,23 | Stop | Stop process |
SIGTSTP | 18,20,24 | Stop | Stop typed at tty |
SIGTTIN | 21,21,26 | Stop | tty input for background process |
SIGTTOU | 22,22,27 | Stop | tty output for background process |
The signals SIGKILL and SIGSTOP cannot be caught, blocked, or ignored.
Next the signals not in the POSIX.1 standard but described in SUSv2 and SUSv3 / POSIX 1003.1-2001.
Signal | Value | Action | Comment |
|
|
|
|
SIGPOLL | Term | Pollable event (Sys V). Synonym of SIGIO | |
SIGPROF | 27,27,29 | Term | Profiling timer expired |
SIGSYS | 12,-,12 | Core | Bad argument to routine (SVID) |
SIGTRAP | 5 | Core | Trace/breakpoint trap |
SIGURG | 16,23,21 | Ign | Urgent condition on socket (4.2 BSD) |
SIGVTALRM | 26,26,28 | Term | Virtual alarm clock (4.2 BSD) |
SIGXCPU | 24,24,30 | Core | CPU time limit exceeded (4.2 BSD) |
SIGXFSZ | 25,25,31 | Core | File size limit exceeded (4.2 BSD) |
Up to and including Linux 2.2, the default behaviour for SIGSYS, SIGXCPU, SIGXFSZ, and (on architectures other than SPARC and MIPS) SIGBUS was to terminate the process (without a core dump). (On some other Unices the default action for SIGXCPU and SIGXFSZ is to terminate the process without a core dump.) Linux 2.4 conforms to the POSIX 1003.1-2001 requirements for these signals, terminating the process with a core dump.
Next various other signals.
Signal | Value | Action | Comment |
|
|
|
|
SIGEMT | 7,-,7 | Term | |
SIGSTKFLT | -,16,- | Term | Stack fault on coprocessor (unused) |
SIGIO | 23,29,22 | Term | I/O now possible (4.2 BSD) |
SIGCLD | -,-,18 | Ign | A synonym for SIGCHLD |
SIGPWR | 29,30,19 | Term | Power failure (System V) |
SIGINFO | 29,-,- | A synonym for SIGPWR | |
SIGLOST | -,-,- | Term | File lock lost |
SIGWINCH | 28,28,20 | Ign | Window resize signal (4.3 BSD, Sun) |
SIGUNUSED | -,31,- | Term | Unused signal (will be SIGSYS) |
(Signal 29 is SIGINFO / SIGPWR on an alpha but SIGLOST on a sparc.)
SIGEMT is not specified in POSIX 1003.1-2001, but neverthless appears on most other Unices, where its default action is typically to terminate the process with a core dump.
SIGPWR (which is not specified in POSIX 1003.1-2001) is typically ignored by default on those other Unices where it appears.
SIGIO (which is not specified in POSIX 1003.1-2001) is ignored by default on several other Unices.
Real-time Signals
Linux supports real-time signals as originally defined in the POSIX.4 real-time extensions (and now included in POSIX 1003.1-2001). Linux supports 32 real-time signals, numbered from 32 (SIGRTMIN) to 63 (SIGRTMAX). (Programs should always refer to real-time signals using notation SIGRTMIN+n, since the range of real-time signal numbers varies across Unices.)Unlike standard signals, real-time signals have no predefined meanings: the entire set of real-time signals can be used for application-defined purposes. (Note, however, that the LinuxThreads implementation uses the first three real-time signals.)
The default action for an unhandled real-time signal is to terminate the receiving process.
Real-time signals are distinguished by the following:
- 1.
- Multiple instances of real-time signals can be queued. By contrast, if multiple instances of a standard signal are delivered while that signal is currently blocked, then only one instance is queued.
- 2.
- If the signal is sent using sigqueue(2), an accompanying value (either an integer or a pointer) can be sent with the signal. If the receiving process establishes a handler for this signal using the SA_SIGACTION flag to sigaction(2) then it can obtain this data via the si_value field of the siginfo_t structure passed as the second argument to the handler. Furthermore, the si_pid and si_uid fields of this structure can be used to obtain the PID and real user ID of the process sending the signal.
- 3.
- Real-time signals are delivered in a guaranteed order. Multiple real-time signals of the same type are delivered in the order they were sent. If different real-time signals are sent to a process, they are delivered starting with the lowest-numbered signal. (I.e., low-numbered signals have highest priority.)
If both standard and real-time signals are pending for a process, POSIX leaves it unspecified which is delivered first. Linux, like many other implementations, gives priority to standard signals in this case.
According to POSIX, an implementation should permit at least _POSIX_SIGQUEUE_MAX (32) real-time signals to be queued to a process. However, rather than placing a per-process limit, Linux imposes a system-wide limit on the number of queued real-time signals for all processes. This limit can be viewed (and with privilege) changed via the /proc/sys/kernel/rtsig-max file. A related file, /proc/sys/kernel/rtsig-max, can be used to find out how many real-time signals are currently queued.
CONFORMING TO
POSIX.1SEE ALSO
kill(1), kill(2), setitimer(2), sigaction(2), signal(2), sigprocmask(2), sigqueue(2)실행파일의 Dependency 확인하기
linux-gate.so.1 => (0xb7f5a000)
libm.so.6 => /lib/tls/i686/cmov/libm.so.6 (0xb7e33000)
libgcc_s.so.1 => /lib/libgcc_s.so.1 (0xb7e28000)
libc.so.6 => /lib/tls/i686/cmov/libc.so.6 (0xb7cd8000)
/lib/ld-linux.so.2 (0xb7f5b000)
de·pend·en·cy, -an·cy〔










1

2 종속물;부속 건물, 별관
3 속국, 보호령
4 식솔이 딸림
5 의존증, 중독(증)
디펜던시, 의존성