WinDBG查看内核数据结构

    查看详细的模块信息：!lmi nt

枚举所有内核数据结构：dt nt!_*

查看数据结构详细信息：dt nt!_xxx

// !lmi nt  [查看详细的模块信息]
kd>  !lmi nt
Loaded Module Info: [nt] 
         Module: ntkrnlpa
   Base Address: 804d8000
     Image Name: ntkrnlpa.exe
   Machine Type: 332 (I386)
     Time Stamp: 4802516a Mon Apr 14 02:31:06 2008
           Size: 1f8480
       CheckSum: 2050d3
Characteristics: 12e  
Debug Data Dirs: Type  Size     VA  Pointer
             CODEVIEW    25,  9578,    9578 RSDS - GUID: {30B5FB31-AE7E-4ACA-ABA7-50AA241FF331}
               Age: 1, Pdb: ntkrnlpa.pdb
     Image Type: MEMORY   - Image read successfully from loaded memory.
    Symbol Type: PDB      - Symbols loaded successfully from symbol search path.
                 d:\symbol\exe\ntkrnlpa.pdb
    Load Report: public symbols , not source indexed 
                 d:\symbol\exe\ntkrnlpa.pdb
// dt nt!_*  [查看所有内核数据结构]
kd> dt nt!_*
          ntkrnlpa!_LIST_ENTRY
          ntkrnlpa!_IMAGE_NT_HEADERS
          ntkrnlpa!_IMAGE_FILE_HEADER
          ntkrnlpa!_IMAGE_OPTIONAL_HEADER
          ntkrnlpa!_LARGE_INTEGER
          ntkrnlpa!_ULARGE_INTEGER
          ntkrnlpa!_LUID
          ntkrnlpa!_KAPC
          ntkrnlpa!_KTHREAD
          ntkrnlpa!_SINGLE_LIST_ENTRY
          ntkrnlpa!_HARDWARE_PTE
          ntkrnlpa!_SLIST_HEADER
          ntkrnlpa!_NPAGED_LOOKASIDE_LIST
          ntkrnlpa!_GENERAL_LOOKASIDE
          ntkrnlpa!_PAGED_LOOKASIDE_LIST
          ntkrnlpa!_FAST_MUTEX
          ntkrnlpa!_PP_NPAGED_LOOKASIDE_NUMBER
          ntkrnlpa!_POOL_TYPE
          ntkrnlpa!_KPRCB
          ntkrnlpa!_KPROCESSOR_STATE
          ntkrnlpa!_KSPIN_LOCK_QUEUE
          ntkrnlpa!_KNODE
          ntkrnlpa!_PP_LOOKASIDE_LIST
          ntkrnlpa!_KPRCB
          ntkrnlpa!_KDPC
          ntkrnlpa!_FX_SAVE_AREA
          ntkrnlpa!_PROCESSOR_POWER_STATE
          ntkrnlpa!_EX_RUNDOWN_REF
          ntkrnlpa!_EX_FAST_REF
          ntkrnlpa!_EX_PUSH_LOCK
          ntkrnlpa!_EX_PUSH_LOCK_WAIT_BLOCK
          ntkrnlpa!_KEVENT
          ntkrnlpa!_EX_PUSH_LOCK_CACHE_AWARE
          ntkrnlpa!_ETHREAD
          ntkrnlpa!_TERMINATION_PORT
          ntkrnlpa!_CLIENT_ID
          ntkrnlpa!_KSEMAPHORE
          ntkrnlpa!_PS_IMPERSONATION_INFORMATION
          ntkrnlpa!_DEVICE_OBJECT
          ntkrnlpa!_EPROCESS
          ntkrnlpa!_KPROCESS
          ntkrnlpa!_HANDLE_TABLE
          ntkrnlpa!_EJOB
          ntkrnlpa!_EPROCESS_QUOTA_BLOCK
          ntkrnlpa!_PAGEFAULT_HISTORY
          ntkrnlpa!_PEB
          ......

// DRIVER_OBJECT
kd> dt nt!_DRIVER_OBJECT
   +0x000 Type             : Int2B
   +0x002 Size             : Int2B
   +0x004 DeviceObject     : Ptr32 _DEVICE_OBJECT
   +0x008 Flags            : Uint4B
   +0x00c DriverStart      : Ptr32 Void
   +0x010 DriverSize       : Uint4B
   +0x014 DriverSection    : Ptr32 Void
   +0x018 DriverExtension  : Ptr32 _DRIVER_EXTENSION
   +0x01c DriverName       : _UNICODE_STRING
   +0x024 HardwareDatabase : Ptr32 _UNICODE_STRING
   +0x028 FastIoDispatch   : Ptr32 _FAST_IO_DISPATCH
   +0x02c DriverInit       : Ptr32     long 
   +0x030 DriverStartIo    : Ptr32     void 
   +0x034 DriverUnload     : Ptr32     void 
   +0x038 MajorFunction    : [28] Ptr32     long 

// DEVICE_OBJECT
kd> dt nt!_DEVICE_OBJECT
   +0x000 Type             : Int2B
   +0x002 Size             : Uint2B
   +0x004 ReferenceCount   : Int4B
   +0x008 DriverObject     : Ptr32 _DRIVER_OBJECT
   +0x00c NextDevice       : Ptr32 _DEVICE_OBJECT
   +0x010 AttachedDevice   : Ptr32 _DEVICE_OBJECT
   +0x014 CurrentIrp       : Ptr32 _IRP
   +0x018 Timer            : Ptr32 _IO_TIMER
   +0x01c Flags            : Uint4B
   +0x020 Characteristics  : Uint4B
   +0x024 Vpb              : Ptr32 _VPB
   +0x028 DeviceExtension  : Ptr32 Void
   +0x02c DeviceType       : Uint4B
   +0x030 StackSize        : Char
   +0x034 Queue            : __unnamed
   +0x05c AlignmentRequirement : Uint4B
   +0x060 DeviceQueue      : _KDEVICE_QUEUE
   +0x074 Dpc              : _KDPC
   +0x094 ActiveThreadCount : Uint4B
   +0x098 SecurityDescriptor : Ptr32 Void
   +0x09c DeviceLock       : _KEVENT
   +0x0ac SectorSize       : Uint2B
   +0x0ae Spare1           : Uint2B
   +0x0b0 DeviceObjectExtension : Ptr32 _DEVOBJ_EXTENSION
   +0x0b4 Reserved         : Ptr32 Void

// IRP
kd> dt nt!_IRP
   +0x000 Type             : Int2B
   +0x002 Size             : Uint2B
   +0x004 MdlAddress       : Ptr32 _MDL
   +0x008 Flags            : Uint4B
   +0x00c AssociatedIrp    : __unnamed
   +0x010 ThreadListEntry  : _LIST_ENTRY
   +0x018 IoStatus         : _IO_STATUS_BLOCK
   +0x020 RequestorMode    : Char
   +0x021 PendingReturned  : UChar
   +0x022 StackCount       : Char
   +0x023 CurrentLocation  : Char
   +0x024 Cancel           : UChar
   +0x025 CancelIrql       : UChar
   +0x026 ApcEnvironment   : Char
   +0x027 AllocationFlags  : UChar
   +0x028 UserIosb         : Ptr32 _IO_STATUS_BLOCK
   +0x02c UserEvent        : Ptr32 _KEVENT
   +0x030 Overlay          : __unnamed
   +0x038 CancelRoutine    : Ptr32     void 
   +0x03c UserBuffer       : Ptr32 Void
   +0x040 Tail             : __unnamed

// IO_STACK_LOCATION
kd> dt nt!_IO_STACK_LOCATION
   +0x000 MajorFunction    : UChar
   +0x001 MinorFunction    : UChar
   +0x002 Flags            : UChar
   +0x003 Control          : UChar
   +0x004 Parameters       : __unnamed
   +0x014 DeviceObject     : Ptr32 _DEVICE_OBJECT
   +0x018 FileObject       : Ptr32 _FILE_OBJECT
   +0x01c CompletionRoutine : Ptr32     long 
   +0x020 Context          : Ptr32 Void