参考：http://x86.renejeschke.de/html/file_module_x86_id_313.html
http://msdn.microsoft.com/en-us/library/windows/hardware/ff553516(v=vs.85).aspx
http://en.wikipedia.org/wiki/Model-specific_register
rdmsr ( 0x00000174 ) = 0x00000000 ~ 0x00000008
rdmsr ( 0x00000175 ) = 0x00000000 ~ 0xf7a1a000
rdmsr ( 0x00000176 ) = 0x00000000 ~ 0x8053dad0
kd> dg 0
P Si Gr Pr Lo
Sel Base Limit Type l ze an es ng Flags
---- -------- -------- ---------- - -- -- -- -- --------
0000 00000000 00000000 0 Nb By Np Nl 00000000
kd> dg 0x08
P Si Gr Pr Lo
Sel Base Limit Type l ze an es ng Flags
---- -------- -------- ---------- - -- -- -- -- --------
0008 00000000 ffffffff Code RE Ac 0 Bg Pg P Nl 00000c9b
kd> dg 0x13
P Si Gr Pr Lo
Sel Base Limit Type l ze an es ng Flags
---- -------- -------- ---------- - -- -- -- -- --------
0013 00000000 ffffffff Data RW Ac 0 Bg Pg P Nl 00000c93
kd> dg 0x18
P Si Gr Pr Lo
Sel Base Limit Type l ze an es ng Flags
---- -------- -------- ---------- - -- -- -- -- --------
0018 00000000 ffffffff Code RE Ac 3 Bg Pg P Nl 00000cfb
kd> dg 0x23
P Si Gr Pr Lo
Sel Base Limit Type l ze an es ng Flags
---- -------- -------- ---------- - -- -- -- -- --------
0023 00000000 ffffffff Data RW Ac 3 Bg Pg P Nl 00000cf3
因此，sysenter_cs就是内核的代码段。
列举内核中全部的driver
kd> !drivers
The !drivers command is no longer supported.
Please use the 'lm t n' command.
Consult the debugger documentation for the supported 'lm' command options.
The WinDbg "Modules" window can also be used to display timestamps.
The "Modules" window supports sorting on name or timestamp values
kd> lm t n
nt!KiFastCallEntry:
8053dad0 b923000000 mov ecx,23h
8053dad5 6a30 push 30h
8053dad7 0fa1 pop fs
8053dad9 8ed9 mov ds,cx
8053dadb 8ec1 mov es,cx
8053dadd 8b0d40f0dfff mov ecx,dword ptr ds:[0FFDFF040h]
8053dae3 8b6104 mov esp,dword ptr [ecx+4]
8053dae6 6a23 push 23h
8053dae8 52 push edx
8053dae9 9c pushfd
8053daea 6a02 push 2
8053daec 83c208 add edx,8
8053daef 9d popfd
8053daf0 804c240102 or byte ptr [esp+1],2
8053daf5 6a1b push 1Bh
8053daf7 ff350403dfff push dword ptr ds:[0FFDF0304h]
8053dafd 6a00 push 0
8053daff 55 push ebp
8053db00 53 push ebx
8053db01 56 push esi
8053db02 57 push edi
8053db03 8b1d1cf0dfff mov ebx,dword ptr ds:[0FFDFF01Ch]
8053db09 6a3b push 3Bh
8053db0b 8bb324010000 mov esi,dword ptr [ebx+124h]
8053db11 ff33 push dword ptr [ebx]
8053db13 c703ffffffff mov dword ptr [ebx],0FFFFFFFFh
8053db19 8b6e18 mov ebp,dword ptr [esi+18h]
8053db1c 6a01 push 1
8053db1e 83ec48 sub esp,48h
8053db21 81ed9c020000 sub ebp,29Ch
8053db27 c6864001000001 mov byte ptr [esi+140h],1
8053db2e 3bec cmp ebp,esp
8053db30 759a jne nt!KiFastCallEntry2+0x47 (8053dacc)
kd> u nt!KiSystemService L20
nt!KiSystemService:
8053da11 6a00 push 0
8053da13 55 push ebp
8053da14 53 push ebx
8053da15 56 push esi
8053da16 57 push edi
8053da17 0fa0 push fs
8053da19 bb30000000 mov ebx,30h
8053da1e 668ee3 mov fs,bx
8053da21 ff3500f0dfff push dword ptr ds:[0FFDFF000h]
8053da27 c70500f0dfffffffffff mov dword ptr ds:[0FFDFF000h],0FFFFFFFFh
8053da31 8b3524f1dfff mov esi,dword ptr ds:[0FFDFF124h]
8053da37 ffb640010000 push dword ptr [esi+140h]
8053da3d 83ec48 sub esp,48h
8053da40 8b5c246c mov ebx,dword ptr [esp+6Ch]
8053da44 83e301 and ebx,1
8053da47 889e40010000 mov byte ptr [esi+140h],bl
8053da4d 8bec mov ebp,esp
8053da4f 8b9e34010000 mov ebx,dword ptr [esi+134h]
8053da55 895d3c mov dword ptr [ebp+3Ch],ebx
8053da58 89ae34010000 mov dword ptr [esi+134h],ebp
8053da5e fc cld
8053da5f 8b5d60 mov ebx,dword ptr [ebp+60h]
8053da62 8b7d68 mov edi,dword ptr [ebp+68h]
8053da65 89550c mov dword ptr [ebp+0Ch],edx
8053da68 c74508000ddbba mov dword ptr [ebp+8],0BADB0D00h
8053da6f 895d00 mov dword ptr [ebp],ebx
8053da72 897d04 mov dword ptr [ebp+4],edi
8053da75 f6462cff test byte ptr [esi+2Ch],0FFh
8053da79 0f858dfeffff jne nt!Dr_kss_a (8053d90c)
8053da7f fb sti
8053da80 e9d8000000 jmp nt!KiFastCallEntry+0x8d (8053db5d)
nt!KiFastCallEntry2:
kd> !idt 2e
Dumping IDT:
2e: 8053da11 nt!KiSystemService
daniel@daniel-mint ~/windbg $ awk '{printf("[% 8x]: \t\t[%s --> %s] \t\t%s\n", NR, $1, $2, $3)}' kiservicetable
[ 1]: [80502354 --> 80599a66] nt!NtAcceptConnectPort
[ 2]: [80502358 --> 805e6cce] nt!NtAccessCheck
[ 3]: [8050235c --> 805ea514] nt!NtAccessCheckAndAuditAlarm
[ 4]: [80502360 --> 805e6d00] nt!NtAccessCheckByType
[ 5]: [80502364 --> 805ea54e] nt!NtAccessCheckByTypeAndAuditAlarm
[ 6]: [80502368 --> 805e6d36] nt!NtAccessCheckByTypeResultList
[ 7]: [8050236c --> 805ea592] nt!NtAccessCheckByTypeResultListAndAuditAlarm
[ 8]: [80502370 --> 805ea5d6] nt!NtAccessCheckByTypeResultListAndAuditAlarmByHandle
[ 9]: [80502374 --> 8060bc40] nt!NtAddAtom
[ a]: [80502378 --> 8060c984] nt!NtAddBootEntry
[ b]: [8050237c --> 805e2066] nt!NtAdjustGroupsToken
[ c]: [80502380 --> 805e1cbe] nt!NtAdjustPrivilegesToken
[ d]: [80502384 --> 805caccc] nt!NtAlertResumeThread
[ e]: [80502388 --> 805cac7c] nt!NtAlertThread
[ f]: [8050238c --> 8060c266] nt!NtAllocateLocallyUniqueId
[ 10]: [80502390 --> 805ab654] nt!NtAllocateUserPhysicalPages
[ 11]: [80502394 --> 8060b87e] nt!NtAllocateUuids
[ 12]: [80502398 --> 8059dedc] nt!NtAllocateVirtualMemory
[ 13]: [8050239c --> 805a5aa6] nt!NtAreMappedFilesTheSame
[ 14]: [805023a0 --> 805cc7aa] nt!NtAssignProcessToJobObject
[ 15]: [805023a4 --> 80500020] nt!NtCallbackReturn
[ 16]: [805023a8 --> 805be3e2] nt!NtModifyBootEntry
[ 17]: [805023ac --> 8056c0c6] nt!NtCancelIoFile
[ 18]: [805023b0 --> 80535596] nt!NtCancelTimer
[ 19]: [805023b4 --> 80604f36] nt!NtClearEvent
[ 1a]: [805023b8 --> 805b1ce0] nt!NtClose
[ 1b]: [805023bc --> 805eaa4e] nt!NtCloseObjectAuditAlarm
[ 1c]: [805023c0 --> 80619dfe] nt!NtCompactKeys
[ 1d]: [805023c4 --> 805eef40] nt!NtCompareTokens
[ 1e]: [805023c8 --> 8059a154] nt!NtCompleteConnectPort
[ 1f]: [805023cc --> 8061a052] nt!NtCompressKey
[ 20]: [805023d0 --> 80599a06] nt!NtConnectPort
[ 21]: [805023d4 --> 80541390] nt!NtContinue
[ 22]: [805023d8 --> 806381da] nt!NtCreateDebugObject
[ 23]: [805023dc --> 805b3bdc] nt!NtCreateDirectoryObject
[ 24]: [805023e0 --> 80604f86] nt!NtCreateEvent
[ 25]: [805023e4 --> 8060d1fa] nt!NtCreateEventPair
[ 26]: [805023e8 --> 8056e62e] nt!NtCreateFile
[ 27]: [805023ec --> 8056e00c] nt!NtCreateIoCompletion
[ 28]: [805023f0 --> 805cb76e] nt!NtCreateJobObject
[ 29]: [805023f4 --> 805cb4a6] nt!NtCreateJobSet
[ 2a]: [805023f8 --> 8061a22e] nt!NtCreateKey
[ 2b]: [805023fc --> 8056e73c] nt!NtCreateMailslotFile
[ 2c]: [80502400 --> 8060d5f2] nt!NtCreateMutant
[ 2d]: [80502404 --> 8056e668] nt!NtCreateNamedPipeFile
[ 2e]: [80502408 --> 805a0ec6] nt!NtCreatePagingFile
[ 2f]: [8050240c --> 8059a522] nt!NtCreatePort
[ 30]: [80502410 --> 805c7332] nt!NtCreateProcess
[ 31]: [80502414 --> 805c727c] nt!NtCreateProcessEx
[ 32]: [80502418 --> 8060da12] nt!NtCreateProfile
[ 33]: [8050241c --> 805a080a] nt!NtCreateSection
[ 34]: [80502420 --> 8060af9c] nt!NtCreateSemaphore
[ 35]: [80502424 --> 805ba9e4] nt!NtCreateSymbolicLinkObject
[ 36]: [80502428 --> 805c711a] nt!NtCreateThread
[ 37]: [8050242c --> 8060cec2] nt!NtCreateTimer
[ 38]: [80502430 --> 805ef2e8] nt!NtCreateToken
[ 39]: [80502434 --> 8059a546] nt!NtCreateWaitablePort
[ 3a]: [80502438 --> 806392b6] nt!NtDebugActiveProcess
[ 3b]: [8050243c --> 80639406] nt!NtDebugContinue
[ 3c]: [80502440 --> 8060c8d4] nt!NtDelayExecution
[ 3d]: [80502444 --> 8060c0f6] nt!NtDeleteAtom
[ 3e]: [80502448 --> 805be3e2] nt!NtModifyBootEntry
[ 3f]: [8050244c --> 8056c20c] nt!NtDeleteFile
[ 40]: [80502450 --> 8061a6be] nt!NtDeleteKey
[ 41]: [80502454 --> 805eab5a] nt!NtDeleteObjectAuditAlarm
[ 42]: [80502458 --> 8061a88e] nt!NtDeleteValueKey
[ 43]: [8050245c --> 8056e7f4] nt!NtDeviceIoControlFile
[ 44]: [80502460 --> 80608f10] nt!NtDisplayString
[ 45]: [80502464 --> 805b37bc] nt!NtDuplicateObject
[ 46]: [80502468 --> 805e2f04] nt!NtDuplicateToken
[ 47]: [8050246c --> 8060c984] nt!NtAddBootEntry
[ 48]: [80502470 --> 8061aa6e] nt!NtEnumerateKey
[ 49]: [80502474 --> 8060c976] nt!NtEnumerateSystemEnvironmentValuesEx
[ 4a]: [80502478 --> 8061acd8] nt!NtEnumerateValueKey
[ 4b]: [8050247c --> 805a91cc] nt!NtExtendSection
[ 4c]: [80502480 --> 805e30b0] nt!NtFilterToken
[ 4d]: [80502484 --> 8060beaa] nt!NtFindAtom
[ 4e]: [80502488 --> 8056c2d8] nt!NtFlushBuffersFile
[ 4f]: [8050248c --> 805abede] nt!NtFlushInstructionCache
[ 50]: [80502490 --> 8061af42] nt!NtFlushKey
[ 51]: [80502494 --> 805a1bd6] nt!NtFlushVirtualMemory
[ 52]: [80502498 --> 805abe80] nt!NtFlushWriteBuffer
[ 53]: [8050249c --> 805ab9f0] nt!NtFreeUserPhysicalPages
[ 54]: [805024a0 --> 805a84a6] nt!NtFreeVirtualMemory
[ 55]: [805024a4 --> 8056e828] nt!NtFsControlFile
[ 56]: [805024a8 --> 805c7644] nt!NtGetContextThread
[ 57]: [805024ac --> 805be404] nt!NtGetDevicePowerState
[ 58]: [805024b0 --> 8058e83c] nt!NtGetPlugPlayEvent
[ 59]: [805024b4 --> 8051df7e] nt!NtGetWriteWatch
[ 5a]: [805024b8 --> 805eec34] nt!NtImpersonateAnonymousToken
[ 5b]: [805024bc --> 8059a5b0] nt!NtImpersonateClientOfPort
[ 5c]: [805024c0 --> 805cd942] nt!NtImpersonateThread
[ 5d]: [805024c4 --> 80618206] nt!NtInitializeRegistry
[ 5e]: [805024c8 --> 805be1dc] nt!NtInitiatePowerAction
[ 5f]: [805024cc --> 805cb36a] nt!NtIsProcessInJob
[ 60]: [805024d0 --> 805be3f0] nt!NtIsSystemResumeAutomatic
[ 61]: [805024d4 --> 8059a7bc] nt!NtListenPort
[ 62]: [805024d8 --> 80579848] nt!NtLoadDriver
[ 63]: [805024dc --> 8061bf5e] nt!NtLoadKey
[ 64]: [805024e0 --> 8061bba8] nt!NtLoadKey2
[ 65]: [805024e4 --> 8056e85c] nt!NtLockFile
[ 66]: [805024e8 --> 80609472] nt!NtLockProductActivationKeys
[ 67]: [805024ec --> 8061a0fe] nt!NtLockRegistryKey
[ 68]: [805024f0 --> 805abfe6] nt!NtLockVirtualMemory
[ 69]: [805024f4 --> 805b505c] nt!NtMakePermanentObject
[ 6a]: [805024f8 --> 805b1d84] nt!NtMakeTemporaryObject
[ 6b]: [805024fc --> 805aa948] nt!NtMapUserPhysicalPages
[ 6c]: [80502500 --> 805aaf20] nt!NtMapUserPhysicalPagesScatter
[ 6d]: [80502504 --> 805a7526] nt!NtMapViewOfSection
[ 6e]: [80502508 --> 805be3e2] nt!NtModifyBootEntry
[ 6f]: [8050250c --> 8056f48c] nt!NtNotifyChangeDirectoryFile
[ 70]: [80502510 --> 8061bf28] nt!NtNotifyChangeKey
[ 71]: [80502514 --> 8061b044] nt!NtNotifyChangeMultipleKeys
[ 72]: [80502518 --> 805b3cae] nt!NtOpenDirectoryObject
[ 73]: [8050251c --> 80605086] nt!NtOpenEvent
[ 74]: [80502520 --> 8060d2d2] nt!NtOpenEventPair
[ 75]: [80502524 --> 8056f74c] nt!NtOpenFile
[ 76]: [80502528 --> 8056e0e4] nt!NtOpenIoCompletion
[ 77]: [8050252c --> 805cb8f4] nt!NtOpenJobObject
[ 78]: [80502530 --> 8061b5c4] nt!NtOpenKey
[ 79]: [80502534 --> 8060d6ca] nt!NtOpenMutant
[ 7a]: [80502538 --> 805ea61c] nt!NtOpenObjectAuditAlarm
[ 7b]: [8050253c --> 805c11c2] nt!NtOpenProcess
[ 7c]: [80502540 --> 805e38fc] nt!NtOpenProcessToken
[ 7d]: [80502544 --> 805e3502] nt!NtOpenProcessTokenEx
[ 7e]: [80502548 --> 8059f840] nt!NtOpenSection
[ 7f]: [8050254c --> 8060b096] nt!NtOpenSemaphore
[ 80]: [80502550 --> 805babca] nt!NtOpenSymbolicLinkObject
[ 81]: [80502554 --> 805c144e] nt!NtOpenThread
[ 82]: [80502558 --> 805e391a] nt!NtOpenThreadToken
[ 83]: [8050255c --> 805e3672] nt!NtOpenThreadTokenEx
[ 84]: [80502560 --> 8060cfe4] nt!NtOpenTimer
[ 85]: [80502564 --> 8063b4a8] nt!NtPlugPlayControl
[ 86]: [80502568 --> 805bf272] nt!NtPowerInformation
[ 87]: [8050256c --> 805edce6] nt!NtPrivilegeCheck
[ 88]: [80502570 --> 805e992e] nt!NtPrivilegeObjectAuditAlarm
[ 89]: [80502574 --> 805e9b1a] nt!NtPrivilegedServiceAuditAlarm
[ 8a]: [80502578 --> 805adaae] nt!NtProtectVirtualMemory
[ 8b]: [8050257c --> 8060513e] nt!NtPulseEvent
[ 8c]: [80502580 --> 8056c4be] nt!NtQueryAttributesFile
[ 8d]: [80502584 --> 8060c984] nt!NtAddBootEntry
[ 8e]: [80502588 --> 8060c984] nt!NtAddBootEntry
[ 8f]: [8050258c --> 8053c5be] nt!NtQueryDebugFilterState
[ 90]: [80502590 --> 80606caa] nt!NtQueryDefaultLocale
[ 91]: [80502594 --> 8060790a] nt!NtQueryDefaultUILanguage
[ 92]: [80502598 --> 8056f426] nt!NtQueryDirectoryFile
[ 93]: [8050259c --> 805b3d4e] nt!NtQueryDirectoryObject
[ 94]: [805025a0 --> 8056f77c] nt!NtQueryEaFile
[ 95]: [805025a4 --> 80605206] nt!NtQueryEvent
[ 96]: [805025a8 --> 8056c5f6] nt!NtQueryFullAttributesFile
[ 97]: [805025ac --> 8060c11e] nt!NtQueryInformationAtom
[ 98]: [805025b0 --> 8056fff8] nt!NtQueryInformationFile
[ 99]: [805025b4 --> 805cbdc6] nt!NtQueryInformationJobObject
[ 9a]: [805025b8 --> 8059a81a] nt!NtQueryInformationPort
[ 9b]: [805025bc --> 805c2b28] nt!NtQueryInformationProcess
[ 9c]: [805025c0 --> 805c16f4] nt!NtQueryInformationThread
[ 9d]: [805025c4 --> 805e39fa] nt!NtQueryInformationToken
[ 9e]: [805025c8 --> 806070a8] nt!NtQueryInstallUILanguage
[ 9f]: [805025cc --> 8060de94] nt!NtQueryIntervalProfile
[ a0]: [805025d0 --> 8056e18c] nt!NtQueryIoCompletion
[ a1]: [805025d4 --> 8061b8e8] nt!NtQueryKey
[ a2]: [805025d8 --> 806193fc] nt!NtQueryMultipleValueKey
[ a3]: [805025dc --> 8060d772] nt!NtQueryMutant
[ a4]: [805025e0 --> 805ba0a4] nt!NtQueryObject
[ a5]: [805025e4 --> 80619a62] nt!NtQueryOpenSubKeys
[ a6]: [805025e8 --> 8060df22] nt!NtQueryPerformanceCounter
[ a7]: [805025ec --> 80570e42] nt!NtQueryQuotaInformationFile
[ a8]: [805025f0 --> 805adc70] nt!NtQuerySection
[ a9]: [805025f4 --> 805b5a28] nt!NtQuerySecurityObject
[ aa]: [805025f8 --> 8060b14e] nt!NtQuerySemaphore
[ ab]: [805025fc --> 805bac6a] nt!NtQuerySymbolicLinkObject
[ ac]: [80502600 --> 8060c9a0] nt!NtQuerySystemEnvironmentValue
[ ad]: [80502604 --> 8060c968] nt!NtSetSystemEnvironmentValueEx
[ ae]: [80502608 --> 8060798a] nt!NtQuerySystemInformation
[ af]: [8050260c --> 80609826] nt!NtQuerySystemTime
[ b0]: [80502610 --> 8060d09c] nt!NtQueryTimer
[ b1]: [80502614 --> 806090de] nt!NtQueryTimerResolution
[ b2]: [80502618 --> 806182e8] nt!NtQueryValueKey
[ b3]: [8050261c --> 805ae2f6] nt!NtQueryVirtualMemory
[ b4]: [80502620 --> 80571332] nt!NtQueryVolumeInformationFile
[ b5]: [80502624 --> 805c7390] nt!NtQueueApcThread
[ b6]: [80502628 --> 805413d8] nt!NtRaiseException
[ b7]: [8050262c --> 8060adc0] nt!NtRaiseHardError
[ b8]: [80502630 --> 80571afa] nt!NtReadFile
[ b9]: [80502634 --> 80572088] nt!NtReadFileScatter
[ ba]: [80502638 --> 8059b2a2] nt!NtReadRequestData
[ bb]: [8050263c --> 805a97b8] nt!NtReadVirtualMemory
[ bc]: [80502640 --> 805c88c6] nt!NtRegisterThreadTerminatePort
[ bd]: [80502644 --> 8060d8aa] nt!NtReleaseMutant
[ be]: [80502648 --> 8060b27e] nt!NtReleaseSemaphore
[ bf]: [8050264c --> 8056e484] nt!NtRemoveIoCompletion
[ c0]: [80502650 --> 80639386] nt!NtRemoveProcessDebug
[ c1]: [80502654 --> 80619c54] nt!NtRenameKey
[ c2]: [80502658 --> 8061be0e] nt!NtReplaceKey
[ c3]: [8050265c --> 8059a922] nt!NtReplyPort
[ c4]: [80502660 --> 8059b8ea] nt!NtReplyWaitReceivePort
[ c5]: [80502664 --> 8059b2f2] nt!NtReplyWaitReceivePortEx
[ c6]: [80502668 --> 8059ac0c] nt!NtReplyWaitReplyPort
[ c7]: [8050266c --> 805be374] nt!NtRequestDeviceWakeup
[ c8]: [80502670 --> 80597e80] nt!NtRequestPort
[ c9]: [80502674 --> 805981ac] nt!NtRequestWaitReplyPort
[ ca]: [80502678 --> 805be182] nt!NtRequestWakeupLatency
[ cb]: [8050267c --> 80605318] nt!NtResetEvent
[ cc]: [80502680 --> 8051e45e] nt!NtResetWriteWatch
[ cd]: [80502684 --> 80618636] nt!NtRestoreKey
[ ce]: [80502688 --> 805cac26] nt!NtResumeProcess
[ cf]: [8050268c --> 805cab08] nt!NtResumeThread
[ d0]: [80502690 --> 806186d8] nt!NtSaveKey
[ d1]: [80502694 --> 80618768] nt!NtSaveKeyEx
[ d2]: [80502698 --> 80618834] nt!NtSaveMergedKeys
[ d3]: [8050269c --> 8059919a] nt!NtSecureConnectPort
[ d4]: [805026a0 --> 8060c984] nt!NtAddBootEntry
[ d5]: [805026a4 --> 8060c984] nt!NtAddBootEntry
[ d6]: [805026a8 --> 805c7854] nt!NtSetContextThread
[ d7]: [805026ac --> 8063c03e] nt!NtSetDebugFilterState
[ d8]: [805026b0 --> 8060ac6a] nt!NtSetDefaultHardErrorPort
[ d9]: [805026b4 --> 80606dfa] nt!NtSetDefaultLocale
[ da]: [805026b8 --> 8060766c] nt!NtSetDefaultUILanguage
[ db]: [805026bc --> 8056fc98] nt!NtSetEaFile
[ dc]: [805026c0 --> 806053d8] nt!NtSetEvent
[ dd]: [805026c4 --> 806054a2] nt!NtSetEventBoostPriority
[ de]: [805026c8 --> 8060d58e] nt!NtSetHighEventPair
[ df]: [805026cc --> 8060d4be] nt!NtSetHighWaitLowEventPair
[ e0]: [805026d0 --> 80638d50] nt!NtSetInformationDebugObject
[ e1]: [805026d4 --> 805705fc] nt!NtSetInformationFile
[ e2]: [805026d8 --> 805ccad6] nt!NtSetInformationJobObject
[ e3]: [805026dc --> 80618fc8] nt!NtSetInformationKey
[ e4]: [805026e0 --> 805b94e8] nt!NtSetInformationObject
[ e5]: [805026e4 --> 805c3c80] nt!NtSetInformationProcess
[ e6]: [805026e8 --> 805c1c40] nt!NtSetInformationThread
[ e7]: [805026ec --> 805f0062] nt!NtSetInformationToken
[ e8]: [805026f0 --> 8060d9f6] nt!NtSetIntervalProfile
[ e9]: [805026f4 --> 8056e422] nt!NtSetIoCompletion
[ ea]: [805026f8 --> 805c9a52] nt!NtSetLdtEntries
[ eb]: [805026fc --> 8060d52a] nt!NtSetLowEventPair
[ ec]: [80502700 --> 8060d452] nt!NtSetLowWaitHighEventPair
[ ed]: [80502704 --> 80570e20] nt!NtSetQuotaInformationFile
[ ee]: [80502708 --> 805b595c] nt!NtSetSecurityObject
[ ef]: [8050270c --> 8060cc24] nt!NtSetSystemEnvironmentValue
[ f0]: [80502710 --> 8060c968] nt!NtSetSystemEnvironmentValueEx
[ f1]: [80502714 --> 80605cd8] nt!NtSetSystemInformation
[ f2]: [80502718 --> 806485f6] nt!NtSetSystemPowerState
[ f3]: [8050271c --> 8060a3e6] nt!NtSetSystemTime
[ f4]: [80502720 --> 805be096] nt!NtSetThreadExecutionState
[ f5]: [80502724 --> 805356d2] nt!NtSetTimer
[ f6]: [80502728 --> 806098b8] nt!NtSetTimerResolution
[ f7]: [8050272c --> 8060b734] nt!NtSetUuidSeed
[ f8]: [80502730 --> 806188ee] nt!NtSetValueKey
[ f9]: [80502734 --> 80571756] nt!NtSetVolumeInformationFile
[ fa]: [80502738 --> 80608ed4] nt!NtShutdownSystem
[ fb]: [8050273c --> 80523210] nt!NtSignalAndWaitForSingleObject
[ fc]: [80502740 --> 8060dc40] nt!NtStartProfile
[ fd]: [80502744 --> 8060ddea] nt!NtStopProfile
[ fe]: [80502748 --> 805cabd0] nt!NtSuspendProcess
[ ff]: [8050274c --> 805caa42] nt!NtSuspendThread
[ 100]: [80502750 --> 8060e00e] nt!NtSystemDebugControl
[ 101]: [80502754 --> 805cd640] nt!NtTerminateJobObject
[ 102]: [80502758 --> 805c8b10] nt!NtTerminateProcess
[ 103]: [8050275c --> 805c8d0a] nt!NtTerminateThread
[ 104]: [80502760 --> 805cad90] nt!NtTestAlert
[ 105]: [80502764 --> 80531db0] nt!NtTraceEvent
[ 106]: [80502768 --> 8060c992] nt!NtTranslateFilePath
[ 107]: [8050276c --> 805799dc] nt!NtUnloadDriver
[ 108]: [80502770 --> 80618bb6] nt!NtUnloadKey
[ 109]: [80502774 --> 80618da4] nt!NtUnloadKeyEx
[ 10a]: [80502778 --> 8056ec08] nt!NtUnlockFile
[ 10b]: [8050277c --> 805ac574] nt!NtUnlockVirtualMemory
[ 10c]: [80502780 --> 805a833c] nt!NtUnmapViewOfSection
[ 10d]: [80502784 --> 805f141a] nt!NtVdmControl
[ 10e]: [80502788 --> 80638ab8] nt!NtWaitForDebugEvent
[ 10f]: [8050278c --> 805b6094] nt!NtWaitForMultipleObjects
[ 110]: [80502790 --> 805b5faa] nt!NtWaitForSingleObject
[ 111]: [80502794 --> 8060d3ee] nt!NtWaitHighEventPair
[ 112]: [80502798 --> 8060d38a] nt!NtWaitLowEventPair
[ 113]: [8050279c --> 80572598] nt!NtWriteFile
[ 114]: [805027a0 --> 80572ba8] nt!NtWriteFileGather
[ 115]: [805027a4 --> 8059b2ca] nt!NtWriteRequestData
[ 116]: [805027a8 --> 805a98c2] nt!NtWriteVirtualMemory
[ 117]: [805027ac --> 805029f4] nt!NtYieldExecution
[ 118]: [805027b0 --> 8060e466] nt!NtCreateKeyedEvent
[ 119]: [805027b4 --> 8060e550] nt!NtOpenKeyedEvent
[ 11a]: [805027b8 --> 8060e602] nt!NtReleaseKeyedEvent
[ 11b]: [805027bc --> 8060e88e] nt!NtWaitForKeyedEvent
[ 11c]: [805027c0 --> 805c16c4] nt!NtQueryPortInformationProcess
可见， KeServiceDescriptorTable的前四项是对KiServiceTable的描述【start_addr, start_index, end_addr, end_index】
//
// System Service Table Descriptor
//
typedef struct _KSERVICE_TABLE_DESCRIPTOR
{
PULONG_PTR Base;
PULONG Count;
ULONG Limit;
#if defined(_IA64_)
LONG TableBaseGpOffset;
#endif
PUCHAR Number;
} KSERVICE_TABLE_DESCRIPTOR, *PKSERVICE_TABLE_DESCRIPTOR;
//
// Exported System Service Descriptor Tables
//
extern KSERVICE_TABLE_DESCRIPTOR NTSYSAPI KeServiceDescriptorTable[SSDT_MAX_ENTRIES];
extern KSERVICE_TABLE_DESCRIPTOR NTSYSAPI KeServiceDescriptorTableShadow[SSDT_MAX_ENTRIES];
//
// Maximum System Descriptor Table Entries
//
#define SSDT_MAX_ENTRIES 2
因此KeServiceDescriptorTable与KeServiceDescriptorTableShadow其实是上述结构体KSERVICE_TABLE_DESCRIPTOR的数组，每个数组里面都只有两项。
kd> dds nt!KeServiceDescriptorTable L8
80553580 80502354 nt!KiServiceTable
80553584 00000000
80553588 0000011c
8055358c 805027c8 nt!KiArgumentTable
80553590 00000000
80553594 00000000
80553598 00000000
8055359c 00000000
kd> dds nt!KeServiceDescriptorTableShadow L8
80553540 80502354 nt!KiServiceTable
80553544 00000000
80553548 0000011c
8055354c 805027c8 nt!KiArgumentTable
80553550 bf999400 win32k!W32pServiceTable
80553554 00000000
80553558 0000029b
8055355c bf99a110 win32k!W32pArgumentTable
而真正的System Service Routine的列表在KiServiceTable和W32pServiceTable中。
[ 1]: [bf999400 --> bf9357a3] win32k!NtGdiAbortDoc
[ 2]: [bf999404 --> bf947361] win32k!NtGdiAbortPath
[ 3]: [bf999408 --> bf896625] win32k!NtGdiAddFontResourceW
[ 4]: [bf99940c --> bf93ef25] win32k!NtGdiAddRemoteFontToDC
[ 5]: [bf999410 --> bf948978] win32k!NtGdiAddFontMemResourceEx
[ 6]: [bf999414 --> bf935a37] win32k!NtGdiRemoveMergeFont
[ 7]: [bf999418 --> bf935adc] win32k!NtGdiAddRemoteMMInstanceToDC
[ 8]: [bf99941c --> bf83b65f] win32k!NtGdiAlphaBlend
[ 9]: [bf999420 --> bf94829f] win32k!NtGdiAngleArc
[ a]: [bf999424 --> bf934242] win32k!NtGdiAnyLinkedFonts
[ b]: [bf999428 --> bf948897] win32k!NtGdiFontIsLinked
[ c]: [bf99942c --> bf90eea2] win32k!NtGdiArcInternal
[ d]: [bf999430 --> bf900833] win32k!NtGdiBeginPath
[ e]: [bf999434 --> bf80a178] win32k!NtGdiBitBlt
[ f]: [bf999438 --> bf948769] win32k!NtGdiCancelDC
[ 10]: [bf99943c --> bf949f65] win32k!NtGdiCheckBitmapBits
[ 11]: [bf999440 --> bf8ff130] win32k!NtGdiCloseFigure
[ 12]: [bf999444 --> bf89d4eb] win32k!NtGdiClearBitmapAttributes
[ 13]: [bf999448 --> bf948847] win32k!NtGdiClearBrushAttributes
[ 14]: [bf99944c --> bf94a098] win32k!NtGdiColorCorrectPalette
[ 15]: [bf999450 --> bf8210bb] win32k!NtGdiCombineRgn
[ 16]: [bf999454 --> bf8dcd15] win32k!NtGdiCombineTransform
[ 17]: [bf999458 --> bf88374b] win32k!NtGdiComputeXformCoefficients
[ 18]: [bf99945c --> bf87d210] win32k!NtGdiConsoleTextOut
[ 19]: [bf999460 --> bf9100dd] win32k!NtGdiConvertMetafileRect
[ 1a]: [bf999464 --> bf80e427] win32k!NtGdiCreateBitmap
[ 1b]: [bf999468 --> bf8dc9bd] win32k!NtGdiCreateClientObj
[ 1c]: [bf99946c --> bf949d5d] win32k!NtGdiCreateColorSpace
[ 1d]: [bf999470 --> bf94ac5c] win32k!NtGdiCreateColorTransform
[ 1e]: [bf999474 --> bf80fc96] win32k!NtGdiCreateCompatibleBitmap
[ 1f]: [bf999478 --> bf80d0f2] win32k!NtGdiCreateCompatibleDC
[ 20]: [bf99947c --> bf8d1699] win32k!NtGdiCreateDIBBrush
[ 21]: [bf999480 --> bf838921] win32k!NtGdiCreateDIBitmapInternal
[ 22]: [bf999484 --> bf82dac0] win32k!NtGdiCreateDIBSection
[ 23]: [bf999488 --> bf9386bb] win32k!NtGdiCreateEllipticRgn
[ 24]: [bf99948c --> bf84b5aa] win32k!NtGdiCreateHalftonePalette
[ 25]: [bf999490 --> bf94bce8] win32k!NtGdiCreateHatchBrushInternal
[ 26]: [bf999494 --> bf8e6517] win32k!NtGdiCreateMetafileDC
[ 27]: [bf999498 --> bf88235e] win32k!NtGdiCreatePaletteInternal
[ 28]: [bf99949c --> bf8687e1] win32k!NtGdiCreatePatternBrushInternal
[ 29]: [bf9994a0 --> bf84f1ec] win32k!NtGdiCreatePen
[ 2a]: [bf9994a4 --> bf8408ce] win32k!NtGdiCreateRectRgn
[ 2b]: [bf9994a8 --> bf88cb87] win32k!NtGdiCreateRoundRectRgn
[ 2c]: [bf9994ac --> bf90ffe2] win32k!NtGdiCreateServerMetaFile
[ 2d]: [bf9994b0 --> bf81a08f] win32k!NtGdiCreateSolidBrush
[ 2e]: [bf9994b4 --> bf9338ae] win32k!NtGdiD3dContextCreate
[ 2f]: [bf9994b8 --> bf9338c1] win32k!NtGdiD3dContextDestroy
[ 30]: [bf9994bc --> bf9338d4] win32k!NtGdiD3dContextDestroyAll
[ 31]: [bf9994c0 --> bf9338e7] win32k!NtGdiD3dValidateTextureStageState
[ 32]: [bf9994c4 --> bf9338fa] win32k!NtGdiD3dDrawPrimitives2
[ 33]: [bf9994c8 --> bf93390d] win32k!NtGdiDdGetDriverState
[ 34]: [bf9994cc --> bf933783] win32k!NtGdiDdAddAttachedSurface
[ 35]: [bf9994d0 --> bf9339cd] win32k!NtGdiDdAlphaBlt
[ 36]: [bf9994d4 --> bf907cf2] win32k!NtGdiDdAttachSurface
[ 37]: [bf9994d8 --> bf933978] win32k!NtGdiDdBeginMoCompFrame
[ 38]: [bf9994dc --> bf907d05] win32k!NtGdiDdBlt
[ 39]: [bf9994e0 --> bf907adf] win32k!NtGdiDdCanCreateSurface
[ 3a]: [bf9994e4 --> bf933885] win32k!NtGdiDdCanCreateD3DBuffer
[ 3b]: [bf9994e8 --> bf933796] win32k!NtGdiDdColorControl
[ 3c]: [bf9994ec --> bf8edd93] win32k!NtGdiDdCreateDirectDrawObject
[ 3d]: [bf9994f0 --> bf8edda6] win32k!NtGdiDdCreateSurface
[ 3e]: [bf9994f4 --> bf93386f] win32k!NtGdiDdCreateD3DBuffer
[ 3f]: [bf9994f8 --> bf907b1e] win32k!NtGdiDdCreateMoComp
[ 40]: [bf9994fc --> bf90815d] win32k!NtGdiDdCreateSurfaceObject
[ 41]: [bf999500 --> bf8edfef] win32k!NtGdiDdDeleteDirectDrawObject
[ 42]: [bf999504 --> bf907cc6] win32k!NtGdiDdDeleteSurfaceObject
[ 43]: [bf999508 --> bf907af2] win32k!NtGdiDdDestroyMoComp
[ 44]: [bf99950c --> bf8edfd9] win32k!NtGdiDdDestroySurface
[ 45]: [bf999510 --> bf933898] win32k!NtGdiDdDestroyD3DBuffer
[ 46]: [bf999514 --> bf93398b] win32k!NtGdiDdEndMoCompFrame
[ 47]: [bf999518 --> bf908203] win32k!NtGdiDdFlip
[ 48]: [bf99951c --> bf90890e] win32k!NtGdiDdFlipToGDISurface
[ 49]: [bf999520 --> bf907cdc] win32k!NtGdiDdGetAvailDriverMemory
[ 4a]: [bf999524 --> bf9337a9] win32k!NtGdiDdGetBltStatus
[ 4b]: [bf999528 --> bf907a4a] win32k!NtGdiDdGetDC
[ 4c]: [bf99952c --> bf907a89] win32k!NtGdiDdGetDriverInfo
[ 4d]: [bf999530 --> bf933817] win32k!NtGdiDdGetDxHandle
[ 4e]: [bf999534 --> bf9337bf] win32k!NtGdiDdGetFlipStatus
[ 4f]: [bf999538 --> bf933962] win32k!NtGdiDdGetInternalMoCompInfo
[ 50]: [bf99953c --> bf93394c] win32k!NtGdiDdGetMoCompBuffInfo
[ 51]: [bf999540 --> bf907b08] win32k!NtGdiDdGetMoCompGuids
[ 52]: [bf999544 --> bf933936] win32k!NtGdiDdGetMoCompFormats
[ 53]: [bf999548 --> bf908a14] win32k!NtGdiDdGetScanLine
[ 54]: [bf99954c --> bf8e42af] win32k!NtGdiDdLock
[ 55]: [bf999550 --> bf933843] win32k!NtGdiDdLockD3D
[ 56]: [bf999554 --> bf8edd32] win32k!NtGdiDdQueryDirectDrawObject
[ 57]: [bf999558 --> bf9339b7] win32k!NtGdiDdQueryMoCompStatus
[ 58]: [bf99955c --> bf8edd6d] win32k!NtGdiDdReenableDirectDrawObject
[ 59]: [bf999560 --> bf907bbe] win32k!NtGdiDdReleaseDC
[ 5a]: [bf999564 --> bf9339a1] win32k!NtGdiDdRenderMoComp
[ 5b]: [bf999568 --> bf8e40f5] win32k!NtGdiDdResetVisrgn
[ 5c]: [bf99956c --> bf908219] win32k!NtGdiDdSetColorKey
[ 5d]: [bf999570 --> bf9337d5] win32k!NtGdiDdSetExclusiveMode
[ 5e]: [bf999574 --> bf93382d] win32k!NtGdiDdSetGammaRamp
[ 5f]: [bf999578 --> bf933920] win32k!NtGdiDdCreateSurfaceEx
[ 60]: [bf99957c --> bf9337eb] win32k!NtGdiDdSetOverlayPosition
[ 61]: [bf999580 --> bf907d92] win32k!NtGdiDdUnattachSurface
[ 62]: [bf999584 --> bf8e40a5] win32k!NtGdiDdUnlock
[ 63]: [bf999588 --> bf933859] win32k!NtGdiDdUnlockD3D
[ 64]: [bf99958c --> bf9081ed] win32k!NtGdiDdUpdateOverlay
[ 65]: [bf999590 --> bf933801] win32k!NtGdiDdWaitForVerticalBlank
[ 66]: [bf999594 --> bf9339e0] win32k!NtGdiDvpCanCreateVideoPort
[ 67]: [bf999598 --> bf9339f6] win32k!NtGdiDvpColorControl
[ 68]: [bf99959c --> bf933a0c] win32k!NtGdiDvpCreateVideoPort
[ 69]: [bf9995a0 --> bf933a22] win32k!NtGdiDvpDestroyVideoPort
[ 6a]: [bf9995a4 --> bf933a38] win32k!NtGdiDvpFlipVideoPort
[ 6b]: [bf9995a8 --> bf933a4e] win32k!NtGdiDvpGetVideoPortBandwidth
[ 6c]: [bf9995ac --> bf933a64] win32k!NtGdiDvpGetVideoPortField
[ 6d]: [bf9995b0 --> bf933a7a] win32k!NtGdiDvpGetVideoPortFlipStatus
[ 6e]: [bf9995b4 --> bf933a90] win32k!NtGdiDvpGetVideoPortInputFormats
[ 6f]: [bf9995b8 --> bf933aa6] win32k!NtGdiDvpGetVideoPortLine
[ 70]: [bf9995bc --> bf933abc] win32k!NtGdiDvpGetVideoPortOutputFormats
[ 71]: [bf9995c0 --> bf933ad2] win32k!NtGdiDvpGetVideoPortConnectInfo
[ 72]: [bf9995c4 --> bf933ae8] win32k!NtGdiDvpGetVideoSignalStatus
[ 73]: [bf9995c8 --> bf933afe] win32k!NtGdiDvpUpdateVideoPort
[ 74]: [bf9995cc --> bf933b14] win32k!NtGdiDvpWaitForVideoPortSync
[ 75]: [bf9995d0 --> bf933b2a] win32k!NtGdiDvpAcquireNotification
[ 76]: [bf9995d4 --> bf933b40] win32k!NtGdiDvpReleaseNotification
[ 77]: [bf9995d8 --> bf933770] win32k!NtGdiDxgGenericThunk
[ 78]: [bf9995dc --> bf8dcadf] win32k!NtGdiDeleteClientObj
[ 79]: [bf9995e0 --> bf949d50] win32k!NtGdiDeleteColorSpace
[ 7a]: [bf9995e4 --> bf94af18] win32k!NtGdiDeleteColorTransform
[ 7b]: [bf9995e8 --> bf80fb23] win32k!NtGdiDeleteObjectApp
[ 7c]: [bf9995ec --> bf94944e] win32k!NtGdiDescribePixelFormat
[ 7d]: [bf9995f0 --> bf8faebb] win32k!NtGdiGetPerBandInfo
[ 7e]: [bf9995f4 --> bf8fc502] win32k!NtGdiDoBanding
[ 7f]: [bf9995f8 --> bf843898] win32k!NtGdiDoPalette
[ 80]: [bf9995fc --> bf9482e9] win32k!NtGdiDrawEscape
[ 81]: [bf999600 --> bf8d41b0] win32k!NtGdiEllipse
[ 82]: [bf999604 --> bf89bbe3] win32k!NtGdiEnableEudc
[ 83]: [bf999608 --> bf8fbe4b] win32k!NtGdiEndDoc
[ 84]: [bf99960c --> bf9052ee] win32k!NtGdiEndPage
[ 85]: [bf999610 --> bf9008d3] win32k!NtGdiEndPath
[ 86]: [bf999614 --> bf88768a] win32k!NtGdiEnumFontChunk
[ 87]: [bf999618 --> bf887609] win32k!NtGdiEnumFontClose
[ 88]: [bf99961c --> bf886c98] win32k!NtGdiEnumFontOpen
[ 89]: [bf999620 --> bf8d19a1] win32k!NtGdiEnumObjects
[ 8a]: [bf999624 --> bf9387b6] win32k!NtGdiEqualRgn
[ 8b]: [bf999628 --> bf94f4f3] win32k!NtGdiEudcLoadUnloadLink
[ 8c]: [bf99962c --> bf82d2c1] win32k!NtGdiExcludeClipRect
[ 8d]: [bf999630 --> bf8c9d87] win32k!NtGdiExtCreatePen
[ 8e]: [bf999634 --> bf840c15] win32k!NtGdiExtCreateRegion
[ 8f]: [bf999638 --> bf8bfb6c] win32k!NtGdiExtEscape
[ 90]: [bf99963c --> bf950311] win32k!NtGdiExtFloodFill
[ 91]: [bf999640 --> bf82c1c7] win32k!NtGdiExtGetObjectW
[ 92]: [bf999644 --> bf80f2e7] win32k!NtGdiExtSelectClipRgn
[ 93]: [bf999648 --> bf82928c] win32k!NtGdiExtTextOutW
[ 94]: [bf99964c --> bf947486] win32k!NtGdiFillPath
[ 95]: [bf999650 --> bf875583] win32k!NtGdiFillRgn
[ 96]: [bf999654 --> bf9473eb] win32k!NtGdiFlattenPath
[ 97]: [bf999658 --> bf80c24f] win32k!NtGdiFlushUserBatch
[ 98]: [bf99965c --> bf807a02] win32k!NtGdiFlush
[ 99]: [bf999660 --> bf94932e] win32k!NtGdiForceUFIMapping
[ 9a]: [bf999664 --> bf88cdf9] win32k!NtGdiFrameRgn
[ 9b]: [bf999668 --> bf93b48f] win32k!NtGdiFullscreenControl
[ 9c]: [bf99966c --> bf8c9058] win32k!NtGdiGetAndSetDCDword
[ 9d]: [bf999670 --> bf816afe] win32k!NtGdiGetAppClipBox
[ 9e]: [bf999674 --> bf875a76] win32k!NtGdiGetBitmapBits
[ 9f]: [bf999678 --> bf949250] win32k!NtGdiGetBitmapDimension
[ a0]: [bf99967c --> bf8bd5dd] win32k!NtGdiGetBoundsRect
[ a1]: [bf999680 --> bf8f91ba] win32k!NtGdiGetCharABCWidthsW
[ a2]: [bf999684 --> bf9479f4] win32k!NtGdiGetCharacterPlacementW
[ a3]: [bf999688 --> bf80f8b3] win32k!NtGdiGetCharSet
[ a4]: [bf99968c --> bf8eb49e] win32k!NtGdiGetCharWidthW
[ a5]: [bf999690 --> bf882e1c] win32k!NtGdiGetCharWidthInfo
[ a6]: [bf999694 --> bf94860b] win32k!NtGdiGetColorAdjustment
[ a7]: [bf999698 --> bf950bc6] win32k!NtGdiGetColorSpaceforBitmap
[ a8]: [bf99969c --> bf82c494] win32k!NtGdiGetDCDword
[ a9]: [bf9996a0 --> bf836294] win32k!NtGdiGetDCforBitmap
[ aa]: [bf9996a4 --> bf82c321] win32k!NtGdiGetDCObject
[ ab]: [bf9996a8 --> bf8c5409] win32k!NtGdiGetDCPoint
[ ac]: [bf9996ac --> bf948807] win32k!NtGdiGetDeviceCaps
[ ad]: [bf9996b0 --> bf94a2ef] win32k!NtGdiGetDeviceGammaRamp
[ ae]: [bf9996b4 --> bf8fa227] win32k!NtGdiGetDeviceCapsAll
[ af]: [bf9996b8 --> bf84567d] win32k!NtGdiGetDIBitsInternal
[ b0]: [bf9996bc --> bf951b29] win32k!NtGdiGetETM
[ b1]: [bf9996c0 --> bf94cf95] win32k!NtGdiGetEudcTimeStampEx
[ b2]: [bf9996c4 --> bf8ecc8c] win32k!NtGdiGetFontData
[ b3]: [bf9996c8 --> bf948aa6] win32k!NtGdiGetFontResourceInfoInternalW
[ b4]: [bf9996cc --> bf949731] win32k!NtGdiGetGlyphIndicesW
[ b5]: [bf9996d0 --> bf9495d4] win32k!NtGdiGetGlyphIndicesWInternal
[ b6]: [bf9996d4 --> bf9483fc] win32k!NtGdiGetGlyphOutline
[ b7]: [bf9996d8 --> bf948501] win32k!NtGdiGetKerningPairs
[ b8]: [bf9996dc --> bf9357bb] win32k!NtGdiGetLinkedUFIs
[ b9]: [bf9996e0 --> bf8e657f] win32k!NtGdiGetMiterLimit
[ ba]: [bf9996e4 --> bf93e3b6] win32k!NtGdiGetMonitorID
[ bb]: [bf9996e8 --> bf82d417] win32k!NtGdiGetNearestColor
[ bc]: [bf9996ec --> bf94bd6e] win32k!NtGdiGetNearestPaletteIndex
[ bd]: [bf9996f0 --> bf948592] win32k!NtGdiGetObjectBitmapHandle
[ be]: [bf9996f4 --> bf8eab87] win32k!NtGdiGetOutlineTextMetricsInternalW
[ bf]: [bf9996f8 --> bf947853] win32k!NtGdiGetPath
[ c0]: [bf9996fc --> bf84666d] win32k!NtGdiGetPixel
[ c1]: [bf999700 --> bf80f2f7] win32k!NtGdiGetRandomRgn
[ c2]: [bf999704 --> bf8ed7ca] win32k!NtGdiGetRasterizerCaps
[ c3]: [bf999708 --> bf9497dc] win32k!NtGdiGetRealizationInfo
[ c4]: [bf99970c --> bf87f1b4] win32k!NtGdiGetRegionData
[ c5]: [bf999710 --> bf8c5353] win32k!NtGdiGetRgnBox
[ c6]: [bf999714 --> bf91023c] win32k!NtGdiGetServerMetaFileBits
[ c7]: [bf999718 --> bf890c97] win32k!NtGdiGetSpoolMessage
[ c8]: [bf99971c --> bf951ca6] win32k!NtGdiGetStats
[ c9]: [bf999720 --> bf81fa30] win32k!NtGdiGetStockObject
[ ca]: [bf999724 --> bf94eb87] win32k!NtGdiGetStringBitmapW
[ cb]: [bf999728 --> bf8f4c41] win32k!NtGdiGetSystemPaletteUse
[ cc]: [bf99972c --> bf837d45] win32k!NtGdiGetTextCharsetInfo
[ cd]: [bf999730 --> bf84ab72] win32k!NtGdiGetTextExtent
[ ce]: [bf999734 --> bf8d1207] win32k!NtGdiGetTextExtentExW
[ cf]: [bf999738 --> bf839de4] win32k!NtGdiGetTextFaceW
[ d0]: [bf99973c --> bf837ba3] win32k!NtGdiGetTextMetricsW
[ d1]: [bf999740 --> bf8bc64f] win32k!NtGdiGetTransform
[ d2]: [bf999744 --> bf948ced] win32k!NtGdiGetUFI
[ d3]: [bf999748 --> bf948db6] win32k!NtGdiGetEmbUFI
[ d4]: [bf99974c --> bf948e96] win32k!NtGdiGetUFIPathname
[ d5]: [bf999750 --> bf948c6e] win32k!NtGdiGetEmbedFonts
[ d6]: [bf999754 --> bf948c78] win32k!NtGdiChangeGhostFont
[ d7]: [bf999758 --> bf934aed] win32k!NtGdiAddEmbFontToDC
[ d8]: [bf99975c --> bf949755] win32k!NtGdiGetFontUnicodeRanges
[ d9]: [bf999760 --> bf838ff4] win32k!NtGdiGetWidthTable
[ da]: [bf999764 --> bf88e033] win32k!NtGdiGradientFill
[ db]: [bf999768 --> bf837891] win32k!NtGdiHfontCreate
[ dc]: [bf99976c --> bf94a8d3] win32k!NtGdiIcmBrushInfo
[ dd]: [bf999770 --> bf87c3bc] win32k!NtGdiInit
[ de]: [bf999774 --> bf89dc09] win32k!NtGdiInitSpool
[ df]: [bf999778 --> bf816627] win32k!NtGdiIntersectClipRect
[ e0]: [bf99977c --> bf8f8704] win32k!NtGdiInvertRgn
[ e1]: [bf999780 --> bf8c6c65] win32k!NtGdiLineTo
[ e2]: [bf999784 --> bf9494c8] win32k!NtGdiMakeFontDir
[ e3]: [bf999788 --> bf950bff] win32k!NtGdiMakeInfoDC
[ e4]: [bf99978c --> bf8386f2] win32k!NtGdiMaskBlt
[ e5]: [bf999790 --> bf8bc42c] win32k!NtGdiModifyWorldTransform
[ e6]: [bf999794 --> bf8e6752] win32k!NtGdiMonoBitmap
[ e7]: [bf999798 --> bf948799] win32k!NtGdiMoveTo
[ e8]: [bf99979c --> bf8fc39d] win32k!NtGdiOffsetClipRgn
[ e9]: [bf9997a0 --> bf8367a8] win32k!NtGdiOffsetRgn
[ ea]: [bf9997a4 --> bf838c10] win32k!NtGdiOpenDCW
[ eb]: [bf9997a8 --> bf8c49c1] win32k!NtGdiPatBlt
[ ec]: [bf9997ac --> bf82f42b] win32k!NtGdiPolyPatBlt
[ ed]: [bf9997b0 --> bf947560] win32k!NtGdiPathToRegion
[ ee]: [bf9997b4 --> bf94312d] win32k!NtGdiPlgBlt
[ ef]: [bf9997b8 --> bf947e87] win32k!NtGdiPolyDraw
[ f0]: [bf9997bc --> bf84ea6e] win32k!NtGdiPolyPolyDraw
[ f1]: [bf9997c0 --> bf947f84] win32k!NtGdiPolyTextOutW
[ f2]: [bf9997c4 --> bf948887] win32k!NtGdiPtInRegion
[ f3]: [bf9997c8 --> bf938958] win32k!NtGdiPtVisible
[ f4]: [bf9997cc --> bf9488a7] win32k!NtGdiQueryFonts
[ f5]: [bf9997d0 --> bf87c8cd] win32k!NtGdiQueryFontAssocInfo
[ f6]: [bf9997d4 --> bf8e3601] win32k!NtGdiRectangle
[ f7]: [bf9997d8 --> bf8ee042] win32k!NtGdiRectInRegion
[ f8]: [bf9997dc --> bf8351f2] win32k!NtGdiRectVisible
[ f9]: [bf9997e0 --> bf8d0ae2] win32k!NtGdiRemoveFontResourceW
[ fa]: [bf9997e4 --> bf948a8a] win32k!NtGdiRemoveFontMemResourceEx
[ fb]: [bf9997e8 --> bf8e3060] win32k!NtGdiResetDC
[ fc]: [bf9997ec --> bf94bfe2] win32k!NtGdiResizePalette
[ fd]: [bf9997f0 --> bf82e80f] win32k!NtGdiRestoreDC
[ fe]: [bf9997f4 --> bf90e07e] win32k!NtGdiRoundRect
[ ff]: [bf9997f8 --> bf82e81f] win32k!NtGdiSaveDC
[ 100]: [bf9997fc --> bf94131f] win32k!NtGdiScaleViewportExtEx
[ 101]: [bf999800 --> bf9491dc] win32k!NtGdiScaleWindowExtEx
[ 102]: [bf999804 --> bf808d86] win32k!GreSelectBitmap
[ 103]: [bf999808 --> bf948779] win32k!NtGdiSelectBrush
[ 104]: [bf99980c --> bf9009ce] win32k!NtGdiSelectClipPath
[ 105]: [bf999810 --> bf8210cb] win32k!NtGdiSelectFont
[ 106]: [bf999814 --> bf948789] win32k!NtGdiSelectPen
[ 107]: [bf999818 --> bf89d5f2] win32k!NtGdiSetBitmapAttributes
[ 108]: [bf99981c --> bf8c4309] win32k!NtGdiSetBitmapBits
[ 109]: [bf999820 --> bf9492ba] win32k!NtGdiSetBitmapDimension
[ 10a]: [bf999824 --> bf8bd9e4] win32k!NtGdiSetBoundsRect
[ 10b]: [bf999828 --> bf948827] win32k!NtGdiSetBrushAttributes
[ 10c]: [bf99982c --> bf8c43a7] win32k!NtGdiSetBrushOrg
[ 10d]: [bf999830 --> bf94866c] win32k!NtGdiSetColorAdjustment
[ 10e]: [bf999834 --> bf949e12] win32k!NtGdiSetColorSpace
[ 10f]: [bf999838 --> bf94a62b] win32k!NtGdiSetDeviceGammaRamp
[ 110]: [bf99983c --> bf82bbeb] win32k!NtGdiSetDIBitsToDeviceInternal
[ 111]: [bf999840 --> bf8b82ba] win32k!NtGdiSetFontEnumeration
[ 112]: [bf999844 --> bf8dce95] win32k!NtGdiSetFontXform
[ 113]: [bf999848 --> bf8c65a8] win32k!NtGdiSetIcmMode
[ 114]: [bf99984c --> bf8fabb9] win32k!NtGdiSetLinkedUFIs
[ 115]: [bf999850 --> bf94c26c] win32k!NtGdiSetMagicColors
[ 116]: [bf999854 --> bf8dcc14] win32k!NtGdiSetMetaRgn
[ 117]: [bf999858 --> bf8dcc36] win32k!NtGdiSetMiterLimit
[ 118]: [bf99985c --> bf9491cc] win32k!NtGdiGetDeviceWidth
[ 119]: [bf999860 --> bf9491bc] win32k!NtGdiMirrorWindowOrg
[ 11a]: [bf999864 --> bf82d1c9] win32k!NtGdiSetLayout
[ 11b]: [bf999868 --> bf8468af] win32k!NtGdiSetPixel
[ 11c]: [bf99986c --> bf952970] win32k!NtGdiSetPixelFormat
[ 11d]: [bf999870 --> bf948877] win32k!NtGdiSetRectRgn
[ 11e]: [bf999874 --> bf948817] win32k!NtGdiSetSystemPaletteUse
[ 11f]: [bf999878 --> bf951f36] win32k!NtGdiSetTextJustification
[ 120]: [bf99987c --> bf8992a6] win32k!NtGdiSetupPublicCFONT
[ 121]: [bf999880 --> bf8dca38] win32k!NtGdiSetVirtualResolution
[ 122]: [bf999884 --> bf8dcf06] win32k!NtGdiSetSizeDevice
[ 123]: [bf999888 --> bf9041c6] win32k!NtGdiStartDoc
[ 124]: [bf99988c --> bf90513f] win32k!NtGdiStartPage
[ 125]: [bf999890 --> bf881872] win32k!NtGdiStretchBlt
[ 126]: [bf999894 --> bf848dfd] win32k!NtGdiStretchDIBitsInternal
[ 127]: [bf999898 --> bf8ff549] win32k!NtGdiStrokeAndFillPath
[ 128]: [bf99989c --> bf947767] win32k!NtGdiStrokePath
[ 129]: [bf9998a0 --> bf952b18] win32k!NtGdiSwapBuffers
[ 12a]: [bf9998a4 --> bf8c4b54] win32k!NtGdiTransformPoints
[ 12b]: [bf9998a8 --> bf8bbdaf] win32k!NtGdiTransparentBlt
[ 12c]: [bf9998ac --> bf94939f] win32k!NtGdiUnloadPrinterDriver
[ 12d]: [bf9998b0 --> bf952dd6] win32k!NtGdiUnmapMemFont
[ 12e]: [bf9998b4 --> bf948867] win32k!NtGdiUnrealizeObject
[ 12f]: [bf9998b8 --> bf94c27c] win32k!NtGdiUpdateColors
[ 130]: [bf9998bc --> bf947648] win32k!NtGdiWidenPath
[ 131]: [bf9998c0 --> bf8855d0] win32k!NtUserActivateKeyboardLayout
[ 132]: [bf9998c4 --> bf88b0ee] win32k!NtUserAlterWindowStyle
[ 133]: [bf9998c8 --> bf9143f8] win32k!NtUserAssociateInputContext
[ 134]: [bf9998cc --> bf8f519c] win32k!NtUserAttachThreadInput
[ 135]: [bf9998d0 --> bf815a6d] win32k!NtUserBeginPaint
[ 136]: [bf9998d4 --> bf8f4c67] win32k!NtUserBitBltSysBmp
[ 137]: [bf9998d8 --> bf912d94] win32k!NtUserBlockInput
[ 138]: [bf9998dc --> bf91452f] win32k!NtUserBuildHimcList
[ 139]: [bf9998e0 --> bf8360b3] win32k!NtUserBuildHwndList
[ 13a]: [bf9998e4 --> bf86b9f4] win32k!NtUserBuildNameList
[ 13b]: [bf9998e8 --> bf912b57] win32k!NtUserBuildPropList
[ 13c]: [bf9998ec --> bf8c208c] win32k!NtUserCallHwnd
[ 13d]: [bf9998f0 --> bf8366ef] win32k!NtUserCallHwndLock
[ 13e]: [bf9998f4 --> bf89ac2c] win32k!NtUserCallHwndOpt
[ 13f]: [bf9998f8 --> bf8368e2] win32k!NtUserCallHwndParam
[ 140]: [bf9998fc --> bf828813] win32k!NtUserCallHwndParamLock
[ 141]: [bf999900 --> bf8f4b76] win32k!NtUserCallMsgFilter
[ 142]: [bf999904 --> bf8f655f] win32k!NtUserCallNextHookEx
[ 143]: [bf999908 --> bf8010df] win32k!NtUserCallNoParam
[ 144]: [bf99990c --> bf801097] win32k!NtUserCallOneParam
[ 145]: [bf999910 --> bf8368a2] win32k!NtUserCallTwoParam
[ 146]: [bf999914 --> bf8f974d] win32k!NtUserChangeClipboardChain
[ 147]: [bf999918 --> bf8b689c] win32k!NtUserChangeDisplaySettings
[ 148]: [bf99991c --> bf86c501] win32k!NtUserCheckImeHotKey
[ 149]: [bf999920 --> bf8cca4b] win32k!NtUserCheckMenuItem
[ 14a]: [bf999924 --> bf8940b7] win32k!NtUserChildWindowFromPointEx
[ 14b]: [bf999928 --> bf8fa9d9] win32k!NtUserClipCursor
[ 14c]: [bf99992c --> bf8f8609] win32k!NtUserCloseClipboard
[ 14d]: [bf999930 --> bf86b6cf] win32k!NtUserCloseDesktop
[ 14e]: [bf999934 --> bf86b791] win32k!NtUserCloseWindowStation
[ 14f]: [bf999938 --> bf87bdf0] win32k!NtUserConsoleControl
[ 150]: [bf99993c --> bf8ea9b4] win32k!NtUserConvertMemHandle
[ 151]: [bf999940 --> bf90d6b7] win32k!NtUserCopyAcceleratorTable
[ 152]: [bf999944 --> bf8f4c1b] win32k!NtUserCountClipboardFormats
[ 153]: [bf999948 --> bf84b4cf] win32k!NtUserCreateAcceleratorTable
[ 154]: [bf99994c --> bf8733b4] win32k!NtUserCreateCaret
[ 155]: [bf999950 --> bf89d1d8] win32k!NtUserCreateDesktop
[ 156]: [bf999954 --> bf91435e] win32k!NtUserCreateInputContext
[ 157]: [bf999958 --> bf8f9aa8] win32k!NtUserCreateLocalMemHandle
[ 158]: [bf99995c --> bf834af6] win32k!NtUserCreateWindowEx
[ 159]: [bf999960 --> bf89d949] win32k!NtUserCreateWindowStation
[ 15a]: [bf999964 --> bf911be1] win32k!NtUserDdeGetQualityOfService
[ 15b]: [bf999968 --> bf89b8dd] win32k!NtUserDdeInitialize
[ 15c]: [bf99996c --> bf911b11] win32k!NtUserDdeSetQualityOfService
[ 15d]: [bf999970 --> bf86c82e] win32k!NtUserDeferWindowPos
[ 15e]: [bf999974 --> bf86cbf4] win32k!NtUserDefSetText
[ 15f]: [bf999978 --> bf8737e0] win32k!NtUserDeleteMenu
[ 160]: [bf99997c --> bf8fa978] win32k!NtUserDestroyAcceleratorTable
[ 161]: [bf999980 --> bf835e37] win32k!NtUserDestroyCursor
[ 162]: [bf999984 --> bf9143ae] win32k!NtUserDestroyInputContext
[ 163]: [bf999988 --> bf845a1f] win32k!NtUserDestroyMenu
[ 164]: [bf99998c --> bf866c76] win32k!NtUserDestroyWindow
[ 165]: [bf999990 --> bf914b66] win32k!NtUserDisableThreadIme
[ 166]: [bf999994 --> bf80ed89] win32k!NtUserDispatchMessage
[ 167]: [bf999998 --> bf912c52] win32k!NtUserDragDetect
[ 168]: [bf99999c --> bf9110d5] win32k!NtUserDragObject
[ 169]: [bf9999a0 --> bf911db1] win32k!NtUserDrawAnimatedRects
[ 16a]: [bf9999a4 --> bf911e74] win32k!NtUserDrawCaption
[ 16b]: [bf9999a8 --> bf90b537] win32k!NtUserDrawCaptionTemp
[ 16c]: [bf9999ac --> bf83c221] win32k!NtUserDrawIconEx
[ 16d]: [bf9999b0 --> bf912e1f] win32k!NtUserDrawMenuBarTemp
[ 16e]: [bf9999b4 --> bf8ea639] win32k!NtUserEmptyClipboard
[ 16f]: [bf9999b8 --> bf8c550e] win32k!NtUserEnableMenuItem
[ 170]: [bf9999bc --> bf911a8c] win32k!NtUserEnableScrollBar
[ 171]: [bf9999c0 --> bf82cdb7] win32k!NtUserEndDeferWindowPosEx
[ 172]: [bf9999c4 --> bf911f1d] win32k!NtUserEndMenu
[ 173]: [bf9999c8 --> bf815724] win32k!NtUserEndPaint
[ 174]: [bf9999cc --> bf880b0c] win32k!NtUserEnumDisplayDevices
[ 175]: [bf9999d0 --> bf835801] win32k!NtUserEnumDisplayMonitors
[ 176]: [bf9999d4 --> bf8c0e17] win32k!NtUserEnumDisplaySettings
[ 177]: [bf9999d8 --> bf911362] win32k!NtUserEvent
[ 178]: [bf9999dc --> bf8f890a] win32k!NtUserExcludeUpdateRgn
[ 179]: [bf9999e0 --> bf8f4aad] win32k!NtUserFillWindow
[ 17a]: [bf9999e4 --> bf81b77e] win32k!NtUserFindExistingCursorIcon
[ 17b]: [bf9999e8 --> bf869562] win32k!NtUserFindWindowEx
[ 17c]: [bf9999ec --> bf914f55] win32k!NtUserFlashWindowEx
[ 17d]: [bf9999f0 --> bf8e885b] win32k!NtUserGetAltTabInfo
[ 17e]: [bf9999f4 --> bf82c9c9] win32k!NtUserGetAncestor
[ 17f]: [bf9999f8 --> bf914903] win32k!NtUserGetAppImeLevel
[ 180]: [bf9999fc --> bf87146d] win32k!NtUserGetAsyncKeyState
[ 181]: [bf999a00 --> bf834cd2] win32k!NtUserGetAtomName
[ 182]: [bf999a04 --> bf842297] win32k!NtUserGetCaretBlinkTime
[ 183]: [bf999a08 --> bf8c50b2] win32k!NtUserGetCaretPos
[ 184]: [bf999a0c --> bf843559] win32k!NtUserGetClassInfo
[ 185]: [bf999a10 --> bf82c6fa] win32k!NtUserGetClassName
[ 186]: [bf999a14 --> bf8f98e3] win32k!NtUserGetClipboardData
[ 187]: [bf999a18 --> bf8ee107] win32k!NtUserGetClipboardFormatName
[ 188]: [bf999a1c --> bf8ea72f] win32k!NtUserGetClipboardOwner
[ 189]: [bf999a20 --> bf8c4e6b] win32k!NtUserGetClipboardSequenceNumber
[ 18a]: [bf999a24 --> bf911f63] win32k!NtUserGetClipboardViewer
[ 18b]: [bf999a28 --> bf9119f4] win32k!NtUserGetClipCursor
[ 18c]: [bf999a2c --> bf91162a] win32k!NtUserGetComboBoxInfo
[ 18d]: [bf999a30 --> bf882d33] win32k!NtUserGetControlBrush
[ 18e]: [bf999a34 --> bf9075cb] win32k!NtUserGetControlColor
[ 18f]: [bf999a38 --> bf821662] win32k!NtUserGetCPD
[ 190]: [bf999a3c --> bf882fd2] win32k!NtUserGetCursorFrameInfo
[ 191]: [bf999a40 --> bf911747] win32k!NtUserGetCursorInfo
[ 192]: [bf999a44 --> bf804547] win32k!NtUserGetDC
[ 193]: [bf999a48 --> bf83a237] win32k!NtUserGetDCEx
[ 194]: [bf999a4c --> bf83b202] win32k!NtUserGetDoubleClickTime
[ 195]: [bf999a50 --> bf820d48] win32k!NtUserGetForegroundWindow
[ 196]: [bf999a54 --> bf91119e] win32k!NtUserGetGuiResources
[ 197]: [bf999a58 --> bf869f06] win32k!NtUserGetGUIThreadInfo
[ 198]: [bf999a5c --> bf842cc5] win32k!NtUserGetIconInfo
[ 199]: [bf999a60 --> bf842e15] win32k!NtUserGetIconSize
[ 19a]: [bf999a64 --> bf9147c1] win32k!NtUserGetImeHotKey
[ 19b]: [bf999a68 --> bf914631] win32k!NtUserGetImeInfoEx
[ 19c]: [bf999a6c --> bf9113f3] win32k!NtUserGetInternalWindowPos
[ 19d]: [bf999a70 --> bf835528] win32k!NtUserGetKeyboardLayoutList
[ 19e]: [bf999a74 --> bf8f5ff8] win32k!NtUserGetKeyboardLayoutName
[ 19f]: [bf999a78 --> bf87606e] win32k!NtUserGetKeyboardState
[ 1a0]: [bf999a7c --> bf90b884] win32k!NtUserGetKeyNameText
[ 1a1]: [bf999a80 --> bf820ff3] win32k!NtUserGetKeyState
[ 1a2]: [bf999a84 --> bf9116f3] win32k!NtUserGetListBoxInfo
[ 1a3]: [bf999a88 --> bf911844] win32k!NtUserGetMenuBarInfo
[ 1a4]: [bf999a8c --> bf911c9a] win32k!NtUserGetMenuIndex
[ 1a5]: [bf999a90 --> bf9127ce] win32k!NtUserGetMenuItemRect
[ 1a6]: [bf999a94 --> bf819fc9] win32k!NtUserGetMessage
[ 1a7]: [bf999a98 --> bf9124a9] win32k!NtUserGetMouseMovePointsEx
[ 1a8]: [bf999a9c --> bf81a241] win32k!NtUserGetObjectInformation
[ 1a9]: [bf999aa0 --> bf8f4bef] win32k!NtUserGetOpenClipboardWindow
[ 1aa]: [bf999aa4 --> bf911f8f] win32k!NtUserGetPriorityClipboardFormat
[ 1ab]: [bf999aa8 --> bf81a0ac] win32k!NtUserGetProcessWindowStation
[ 1ac]: [bf999aac --> bf9157d5] win32k!NtUserGetRawInputBuffer
[ 1ad]: [bf999ab0 --> bf9150d5] win32k!NtUserGetRawInputData
[ 1ae]: [bf999ab4 --> bf9152af] win32k!NtUserGetRawInputDeviceInfo
[ 1af]: [bf999ab8 --> bf9155a4] win32k!NtUserGetRawInputDeviceList
[ 1b0]: [bf999abc --> bf91579a] win32k!NtUserGetRegisteredRawInputDevices
[ 1b1]: [bf999ac0 --> bf84624e] win32k!NtUserGetScrollBarInfo
[ 1b2]: [bf999ac4 --> bf840ace] win32k!NtUserGetSystemMenu
[ 1b3]: [bf999ac8 --> bf81a4f7] win32k!NtUserGetThreadDesktop
[ 1b4]: [bf999acc --> bf823b41] win32k!NtUserGetThreadState
[ 1b5]: [bf999ad0 --> bf83a4c1] win32k!NtUserGetTitleBarInfo
[ 1b6]: [bf999ad4 --> bf83b02f] win32k!NtUserGetUpdateRect
[ 1b7]: [bf999ad8 --> bf8c51fa] win32k!NtUserGetUpdateRgn
[ 1b8]: [bf999adc --> bf803811] win32k!NtUserGetWindowDC
[ 1b9]: [bf999ae0 --> bf8f9b76] win32k!NtUserGetWindowPlacement
[ 1ba]: [bf999ae4 --> bf90da63] win32k!NtUserGetWOWClass
[ 1bb]: [bf999ae8 --> bf910fdf] win32k!NtUserHardErrorControl
[ 1bc]: [bf999aec --> bf82ce91] win32k!NtUserHideCaret
[ 1bd]: [bf999af0 --> bf912018] win32k!NtUserHiliteMenuItem
[ 1be]: [bf999af4 --> bf912dba] win32k!NtUserImpersonateDdeClientWindow
[ 1bf]: [bf999af8 --> bf8b1d7e] win32k!NtUserInitialize
[ 1c0]: [bf999afc --> bf8ac31e] win32k!NtUserInitializeClientPfnArrays
[ 1c1]: [bf999b00 --> bf9114d2] win32k!NtUserInitTask
[ 1c2]: [bf999b04 --> bf83a5bd] win32k!NtUserInternalGetWindowText
[ 1c3]: [bf999b08 --> bf814dbb] win32k!NtUserInvalidateRect
[ 1c4]: [bf999b0c --> bf8459c5] win32k!NtUserInvalidateRgn
[ 1c5]: [bf999b10 --> bf8c4e31] win32k!NtUserIsClipboardFormatAvailable
[ 1c6]: [bf999b14 --> bf80ea37] win32k!NtUserKillTimer
[ 1c7]: [bf999b18 --> bf891798] win32k!NtUserLoadKeyboardLayoutEx
[ 1c8]: [bf999b1c --> bf89d43a] win32k!NtUserLockWindowStation
[ 1c9]: [bf999b20 --> bf8cc992] win32k!NtUserLockWindowUpdate
[ 1ca]: [bf999b24 --> bf9110b8] win32k!NtUserLockWorkStation
[ 1cb]: [bf999b28 --> bf8c7e35] win32k!NtUserMapVirtualKeyEx
[ 1cc]: [bf999b2c --> bf9128a5] win32k!NtUserMenuItemFromPoint
[ 1cd]: [bf999b30 --> bf80efcd] win32k!NtUserMessageCall
[ 1ce]: [bf999b34 --> bf90f645] win32k!NtUserMinMaximize
[ 1cf]: [bf999b38 --> bf912168] win32k!NtUserMNDragLeave
[ 1d0]: [bf999b3c --> bf9120b8] win32k!NtUserMNDragOver
[ 1d1]: [bf999b40 --> bf8e3267] win32k!NtUserModifyUserStartupInfoFlags
[ 1d2]: [bf999b44 --> bf838ae5] win32k!NtUserMoveWindow
[ 1d3]: [bf999b48 --> bf914b01] win32k!NtUserNotifyIMEStatus
[ 1d4]: [bf999b4c --> bf87c3f2] win32k!NtUserNotifyProcessCreate
[ 1d5]: [bf999b50 --> bf8c54b9] win32k!NtUserNotifyWinEvent
[ 1d6]: [bf999b54 --> bf8f8586] win32k!NtUserOpenClipboard
[ 1d7]: [bf999b58 --> bf86b969] win32k!NtUserOpenDesktop
[ 1d8]: [bf999b5c --> bf899b89] win32k!NtUserOpenInputDesktop
[ 1d9]: [bf999b60 --> bf8f9dbe] win32k!NtUserOpenWindowStation
[ 1da]: [bf999b64 --> bf885886] win32k!NtUserPaintDesktop
[ 1db]: [bf999b68 --> bf803700] win32k!NtUserPeekMessage
[ 1dc]: [bf999b6c --> bf808b4d] win32k!NtUserPostMessage
[ 1dd]: [bf999b70 --> bf86bf40] win32k!NtUserPostThreadMessage
[ 1de]: [bf999b74 --> bf8b83bd] win32k!NtUserPrintWindow
[ 1df]: [bf999b78 --> bf87a14a] win32k!NtUserProcessConnect
[ 1e0]: [bf999b7c --> bf912937] win32k!NtUserQueryInformationThread
[ 1e1]: [bf999b80 --> bf9144ab] win32k!NtUserQueryInputContext
[ 1e2]: [bf999b84 --> bf912ce5] win32k!NtUserQuerySendMessage
[ 1e3]: [bf999b88 --> bf914c0a] win32k!NtUserQueryUserCounters
[ 1e4]: [bf999b8c --> bf803b9c] win32k!NtUserQueryWindow
[ 1e5]: [bf999b90 --> bf911806] win32k!NtUserRealChildWindowFromPoint
[ 1e6]: [bf999b94 --> bf899641] win32k!NtUserRealInternalGetMessage
[ 1e7]: [bf999b98 --> bf91270e] win32k!NtUserRealWaitMessageEx
[ 1e8]: [bf999b9c --> bf823d16] win32k!NtUserRedrawWindow
[ 1e9]: [bf999ba0 --> bf81f433] win32k!NtUserRegisterClassExWOW
[ 1ea]: [bf999ba4 --> bf89dd35] win32k!NtUserRegisterUserApiHook
[ 1eb]: [bf999ba8 --> bf8b7901] win32k!NtUserRegisterHotKey
[ 1ec]: [bf999bac --> bf9156ee] win32k!NtUserRegisterRawInputDevices
[ 1ed]: [bf999bb0 --> bf9115f6] win32k!NtUserRegisterTasklist
[ 1ee]: [bf999bb4 --> bf807b93] win32k!NtUserRegisterWindowMessage
[ 1ef]: [bf999bb8 --> bf8b82e5] win32k!NtUserRemoveMenu
[ 1f0]: [bf999bbc --> bf832c6e] win32k!NtUserRemoveProp
[ 1f1]: [bf999bc0 --> bf892189] win32k!NtUserResolveDesktop
[ 1f2]: [bf999bc4 --> bf9159e5] win32k!NtUserResolveDesktopForWOW
[ 1f3]: [bf999bc8 --> bf8460f5] win32k!NtUserSBGetParms
[ 1f4]: [bf999bcc --> bf879a5a] win32k!NtUserScrollDC
[ 1f5]: [bf999bd0 --> bf8e593a] win32k!NtUserScrollWindowEx
[ 1f6]: [bf999bd4 --> bf83856c] win32k!NtUserSelectPalette
[ 1f7]: [bf999bd8 --> bf8c33ab] win32k!NtUserSendInput
[ 1f8]: [bf999bdc --> bf8bacca] win32k!NtUserSetActiveWindow
[ 1f9]: [bf999be0 --> bf914898] win32k!NtUserSetAppImeLevel
[ 1fa]: [bf999be4 --> bf8724da] win32k!NtUserSetCapture
[ 1fb]: [bf999be8 --> bf845c62] win32k!NtUserSetClassLong
[ 1fc]: [bf999bec --> bf912185] win32k!NtUserSetClassWord
[ 1fd]: [bf999bf0 --> bf8ea8d8] win32k!NtUserSetClipboardData
[ 1fe]: [bf999bf4 --> bf8f9663] win32k!NtUserSetClipboardViewer
[ 1ff]: [bf999bf8 --> bf88636b] win32k!NtUserSetConsoleReserveKeys
[ 200]: [bf999bfc --> bf82126e] win32k!NtUserSetCursor
[ 201]: [bf999c00 --> bf912787] win32k!NtUserSetCursorContents
[ 202]: [bf999c04 --> bf842fa4] win32k!NtUserSetCursorIconData
[ 203]: [bf999c08 --> bf911d1d] win32k!NtUserSetDbgTag
[ 204]: [bf999c0c --> bf83a9b3] win32k!NtUserSetFocus
[ 205]: [bf999c10 --> bf8916c2] win32k!NtUserSetImeHotKey
[ 206]: [bf999c14 --> bf914716] win32k!NtUserSetImeInfoEx
[ 207]: [bf999c18 --> bf91496d] win32k!NtUserSetImeOwnerWindow
[ 208]: [bf999c1c --> bf87c056] win32k!NtUserSetInformationProcess
[ 209]: [bf999c20 --> bf886135] win32k!NtUserSetInformationThread
[ 20a]: [bf999c24 --> bf911913] win32k!NtUserSetInternalWindowPos
[ 20b]: [bf999c28 --> bf8f89ea] win32k!NtUserSetKeyboardState
[ 20c]: [bf999c2c --> bf8a5d53] win32k!NtUserSetLogonNotifyWindow
[ 20d]: [bf999c30 --> bf90b74a] win32k!NtUserSetMenu
[ 20e]: [bf999c34 --> bf911d40] win32k!NtUserSetMenuContextHelpId
[ 20f]: [bf999c38 --> bf8b827a] win32k!NtUserSetMenuDefaultItem
[ 210]: [bf999c3c --> bf911d7d] win32k!NtUserSetMenuFlagRtoL
[ 211]: [bf999c40 --> bf91102a] win32k!NtUserSetObjectInformation
[ 212]: [bf999c44 --> bf882afc] win32k!NtUserSetParent
[ 213]: [bf999c48 --> bf86bd5b] win32k!NtUserSetProcessWindowStation
[ 214]: [bf999c4c --> bf82847c] win32k!NtUserSetProp
[ 215]: [bf999c50 --> bf911cfa] win32k!NtUserSetRipFlags
[ 216]: [bf999c54 --> bf80e774] win32k!NtUserSetScrollInfo
[ 217]: [bf999c58 --> bf89a417] win32k!NtUserSetShellWindowEx
[ 218]: [bf999c5c --> bf9121c0] win32k!NtUserSetSysColors
[ 219]: [bf999c60 --> bf91274e] win32k!NtUserSetSystemCursor
[ 21a]: [bf999c64 --> bf8f61bb] win32k!NtUserSetSystemMenu
[ 21b]: [bf999c68 --> bf912cac] win32k!NtUserSetSystemTimer
[ 21c]: [bf999c6c --> bf86bdb3] win32k!NtUserSetThreadDesktop
[ 21d]: [bf999c70 --> bf914a80] win32k!NtUserSetThreadLayoutHandles
[ 21e]: [bf999c74 --> bf882cf7] win32k!NtUserSetThreadState
[ 21f]: [bf999c78 --> bf803aab] win32k!NtUserSetTimer
[ 220]: [bf999c7c --> bf882ba7] win32k!NtUserSetWindowFNID
[ 221]: [bf999c80 --> bf832d7e] win32k!NtUserSetWindowLong
[ 222]: [bf999c84 --> bf88d87b] win32k!NtUserSetWindowPlacement
[ 223]: [bf999c88 --> bf828223] win32k!NtUserSetWindowPos
[ 224]: [bf999c8c --> bf840823] win32k!NtUserSetWindowRgn
[ 225]: [bf999c90 --> bf88e300] win32k!NtUserSetWindowsHookAW
[ 226]: [bf999c94 --> bf8ba057] win32k!NtUserSetWindowsHookEx
[ 227]: [bf999c98 --> bf89d2d7] win32k!NtUserSetWindowStationUser
[ 228]: [bf999c9c --> bf8f8f9b] win32k!NtUserSetWindowWord
[ 229]: [bf999ca0 --> bf8edb64] win32k!NtUserSetWinEventHook
[ 22a]: [bf999ca4 --> bf82cef3] win32k!NtUserShowCaret
[ 22b]: [bf999ca8 --> bf8c5730] win32k!NtUserShowScrollBar
[ 22c]: [bf999cac --> bf83513b] win32k!NtUserShowWindow
[ 22d]: [bf999cb0 --> bf89207c] win32k!NtUserShowWindowAsync
[ 22e]: [bf999cb4 --> bf8e32d5] win32k!NtUserSoundSentry
[ 22f]: [bf999cb8 --> bf89a6ac] win32k!NtUserSwitchDesktop
[ 230]: [bf999cbc --> bf81e8e3] win32k!NtUserSystemParametersInfo
[ 231]: [bf999cc0 --> bf90dbee] win32k!NtUserTestForInteractiveUser
[ 232]: [bf999cc4 --> bf8f611c] win32k!NtUserThunkedMenuInfo
[ 233]: [bf999cc8 --> bf83fc0d] win32k!NtUserThunkedMenuItemInfo
[ 234]: [bf999ccc --> bf912559] win32k!NtUserToUnicodeEx
[ 235]: [bf999cd0 --> bf86c580] win32k!NtUserTrackMouseEvent
[ 236]: [bf999cd4 --> bf912376] win32k!NtUserTrackPopupMenuEx
[ 237]: [bf999cd8 --> bf83a728] win32k!NtUserCalcMenuBar
[ 238]: [bf999cdc --> bf8eef29] win32k!NtUserPaintMenuBar
[ 239]: [bf999ce0 --> bf8f81f3] win32k!NtUserTranslateAccelerator
[ 23a]: [bf999ce4 --> bf870be0] win32k!NtUserTranslateMessage
[ 23b]: [bf999ce8 --> bf8ba646] win32k!NtUserUnhookWindowsHookEx
[ 23c]: [bf999cec --> bf8edc3f] win32k!NtUserUnhookWinEvent
[ 23d]: [bf999cf0 --> bf912c24] win32k!NtUserUnloadKeyboardLayout
[ 23e]: [bf999cf4 --> bf8911ed] win32k!NtUserUnlockWindowStation
[ 23f]: [bf999cf8 --> bf81fd00] win32k!NtUserUnregisterClass
[ 240]: [bf999cfc --> bf89d748] win32k!NtUserUnregisterUserApiHook
[ 241]: [bf999d00 --> bf91246c] win32k!NtUserUnregisterHotKey
[ 242]: [bf999d04 --> bf91445b] win32k!NtUserUpdateInputContext
[ 243]: [bf999d08 --> bf9112cd] win32k!NtUserUpdateInstance
[ 244]: [bf999d0c --> bf874e3f] win32k!NtUserUpdateLayeredWindow
[ 245]: [bf999d10 --> bf915017] win32k!NtUserGetLayeredWindowAttributes
[ 246]: [bf999d14 --> bf845afb] win32k!NtUserSetLayeredWindowAttributes
[ 247]: [bf999d18 --> bf8a2f52] win32k!NtUserUpdatePerUserSystemParameters
[ 248]: [bf999d1c --> bf91297e] win32k!NtUserUserHandleGrantAccess
[ 249]: [bf999d20 --> bf8018ac] win32k!NtUserValidateHandleSecure
[ 24a]: [bf999d24 --> bf8f8bd9] win32k!NtUserValidateRect
[ 24b]: [bf999d28 --> bf807eba] win32k!NtUserValidateTimerCallback
[ 24c]: [bf999d2c --> bf8c3d69] win32k!NtUserVkKeyScanEx
[ 24d]: [bf999d30 --> bf90d432] win32k!NtUserWaitForInputIdle
[ 24e]: [bf999d34 --> bf90c444] win32k!NtUserWaitForMsgAndEvent
[ 24f]: [bf999d38 --> bf8037a7] win32k!NtUserWaitMessage
[ 250]: [bf999d3c --> bf911020] win32k!NtUserWin32PoolAllocationStats
[ 251]: [bf999d40 --> bf821530] win32k!NtUserWindowFromPoint
[ 252]: [bf999d44 --> bf90db86] win32k!NtUserYieldTask
[ 253]: [bf999d48 --> bf899f9e] win32k!NtUserRemoteConnect
[ 254]: [bf999d4c --> bf910ea7] win32k!NtUserRemoteRedrawRectangle
[ 255]: [bf999d50 --> bf910ef4] win32k!NtUserRemoteRedrawScreen
[ 256]: [bf999d54 --> bf910f48] win32k!NtUserRemoteStopScreenUpdates
[ 257]: [bf999d58 --> bf910f95] win32k!NtUserCtxDisplayIOCtl
[ 258]: [bf999d5c --> bf8fbcf2] win32k!NtGdiEngAssociateSurface
[ 259]: [bf999d60 --> bf8fc6a2] win32k!NtGdiEngCreateBitmap
[ 25a]: [bf999d64 --> bf8fbcbf] win32k!NtGdiEngCreateDeviceSurface
[ 25b]: [bf999d68 --> bf952de1] win32k!NtGdiEngCreateDeviceBitmap
[ 25c]: [bf999d6c --> bf8defe9] win32k!NtGdiEngCreatePalette
[ 25d]: [bf999d70 --> bf90635f] win32k!NtGdiEngComputeGlyphSet
[ 25e]: [bf999d74 --> bf952f37] win32k!NtGdiEngCopyBits
[ 25f]: [bf999d78 --> bf8dfb75] win32k!NtGdiEngDeletePalette
[ 260]: [bf999d7c --> bf8fbc45] win32k!NtGdiEngDeleteSurface
[ 261]: [bf999d80 --> bf953d9a] win32k!NtGdiEngEraseSurface
[ 262]: [bf999d84 --> bf8ffefb] win32k!NtGdiEngUnlockSurface
[ 263]: [bf999d88 --> bf8fc0f7] win32k!NtGdiEngLockSurface
[ 264]: [bf999d8c --> bf904ee3] win32k!NtGdiEngBitBlt
[ 265]: [bf999d90 --> bf9002d4] win32k!NtGdiEngStretchBlt
[ 266]: [bf999d94 --> bf95332f] win32k!NtGdiEngPlgBlt
[ 267]: [bf999d98 --> bf8fc798] win32k!NtGdiEngMarkBandingSurface
[ 268]: [bf999d9c --> bf8fd592] win32k!NtGdiEngStrokePath
[ 269]: [bf999da0 --> bf953526] win32k!NtGdiEngFillPath
[ 26a]: [bf999da4 --> bf8fe227] win32k!NtGdiEngStrokeAndFillPath
[ 26b]: [bf999da8 --> bf953691] win32k!NtGdiEngPaint
[ 26c]: [bf999dac --> bf9537ad] win32k!NtGdiEngLineTo
[ 26d]: [bf999db0 --> bf9538d6] win32k!NtGdiEngAlphaBlend
[ 26e]: [bf999db4 --> bf953a55] win32k!NtGdiEngGradientFill
[ 26f]: [bf999db8 --> bf953c2e] win32k!NtGdiEngTransparentBlt
[ 270]: [bf999dbc --> bf8fed98] win32k!NtGdiEngTextOut
[ 271]: [bf999dc0 --> bf9530d3] win32k!NtGdiEngStretchBltROP
[ 272]: [bf999dc4 --> bf95454c] win32k!NtGdiXLATEOBJ_cGetPalette
[ 273]: [bf999dc8 --> bf954608] win32k!NtGdiXLATEOBJ_iXlate
[ 274]: [bf999dcc --> bf9544fe] win32k!NtGdiXLATEOBJ_hGetColorTransform
[ 275]: [bf999dd0 --> bf8fda8f] win32k!NtGdiCLIPOBJ_bEnum
[ 276]: [bf999dd4 --> bf8fdb3c] win32k!NtGdiCLIPOBJ_cEnumStart
[ 277]: [bf999dd8 --> bf953e64] win32k!NtGdiCLIPOBJ_ppoGetPath
[ 278]: [bf999ddc --> bf953ea2] win32k!NtGdiEngDeletePath
[ 279]: [bf999de0 --> bf953edc] win32k!NtGdiEngCreateClip
[ 27a]: [bf999de4 --> bf953f0e] win32k!NtGdiEngDeleteClip
[ 27b]: [bf999de8 --> bf8fd0fa] win32k!NtGdiBRUSHOBJ_ulGetBrushColor
[ 27c]: [bf999dec --> bf953f48] win32k!NtGdiBRUSHOBJ_pvAllocRbrush
[ 27d]: [bf999df0 --> bf953f99] win32k!NtGdiBRUSHOBJ_pvGetRbrush
[ 27e]: [bf999df4 --> bf9063e5] win32k!NtGdiBRUSHOBJ_hGetColorTransform
[ 27f]: [bf999df8 --> bf905d2e] win32k!NtGdiXFORMOBJ_bApplyXform
[ 280]: [bf999dfc --> bf8fafef] win32k!NtGdiXFORMOBJ_iGetXform
[ 281]: [bf999e00 --> bf905eef] win32k!NtGdiFONTOBJ_vGetInfo
[ 282]: [bf999e04 --> bf8faf55] win32k!NtGdiFONTOBJ_pxoGetXform
[ 283]: [bf999e08 --> bf905993] win32k!NtGdiFONTOBJ_cGetGlyphs
[ 284]: [bf999e0c --> bf8fb160] win32k!NtGdiFONTOBJ_pifi
[ 285]: [bf999e10 --> bf9546c3] win32k!NtGdiFONTOBJ_pfdg
[ 286]: [bf999e14 --> bf9547ca] win32k!NtGdiFONTOBJ_pQueryGlyphAttrs
[ 287]: [bf999e18 --> bf95442e] win32k!NtGdiFONTOBJ_pvTrueTypeFontFile
[ 288]: [bf999e1c --> bf953fe7] win32k!NtGdiFONTOBJ_cGetAllGlyphHandles
[ 289]: [bf999e20 --> bf9548a2] win32k!NtGdiSTROBJ_bEnum
[ 28a]: [bf999e24 --> bf90611d] win32k!NtGdiSTROBJ_bEnumPositionsOnly
[ 28b]: [bf999e28 --> bf8fb273] win32k!NtGdiSTROBJ_bGetAdvanceWidths
[ 28c]: [bf999e2c --> bf90613b] win32k!NtGdiSTROBJ_vEnumStart
[ 28d]: [bf999e30 --> bf9540b2] win32k!NtGdiSTROBJ_dwGetCodePage
[ 28e]: [bf999e34 --> bf9541a3] win32k!NtGdiPATHOBJ_vGetBounds
[ 28f]: [bf999e38 --> bf9548c0] win32k!NtGdiPATHOBJ_bEnum
[ 290]: [bf999e3c --> bf954234] win32k!NtGdiPATHOBJ_vEnumStart
[ 291]: [bf999e40 --> bf954278] win32k!NtGdiPATHOBJ_vEnumStartClipLines
[ 292]: [bf999e44 --> bf954325] win32k!NtGdiPATHOBJ_bEnumClipLines
[ 293]: [bf999e48 --> bf952daf] win32k!NtGdiGetDhpdev
[ 294]: [bf999e4c --> bf95465a] win32k!NtGdiEngCheckAbort
[ 295]: [bf999e50 --> bf9057d8] win32k!NtGdiHT_Get8BPPFormatPalette
[ 296]: [bf999e54 --> bf952e23] win32k!NtGdiHT_Get8BPPMaskPalette
[ 297]: [bf999e58 --> bf9414e4] win32k!NtGdiUpdateTransform
[ 298]: [bf999e5c --> bf8dd701] win32k!NtGdiSetPUMPDOBJ
[ 299]: [bf999e60 --> bf954100] win32k!NtGdiBRUSHOBJ_DeleteRbrush
[ 29a]: [bf999e64 --> bf952dd6] win32k!NtGdiUnmapMemFont
[ 29b]: [bf999e68 --> bf8177ad] win32k!NtGdiDrawStream