Xp sp3 创建进程的堆栈

 以前以为下面是调用的 NtCreateProcesss 今天代码里这样写 没断下来 Windbg 调试下 才发现是这个样子的。。

kd> kb
ChildEBP RetAddr  Args to Child              
f7d3fd38 804de7ec 0089b01c 001f0fff 00000000 nt!NtCreateProcessEx
f7d3fd38 7c90e4f4 0089b01c 001f0fff 00000000 nt!KiFastCallEntry+0xf8
0089ac34 7c90d14c 7c8192ce 0089b01c 001f0fff ntdll!KiFastSystemCallRet
0089ac38 7c8192ce 0089b01c 001f0fff 00000000 ntdll!ZwCreateProcessEx+0xc
0089b688 7c802362 00000000 00000000 0089b6f8 kernel32!CreateProcessInternalW+0x1327
0089b6c0 0043089e 00000000 0089b6f8 00000000 kernel32!CreateProcessW+0x2c
WARNING: Stack unwind information not available. Following frames may be wrong.
0089f79c 0044d413 00000000 00000000 00000000 sujnlomrjc+0x3089e
00000000 00000000 00000000 00000000 00000000 sujnlomrjc+0x4d413



你可能感兴趣的:(Xp sp3 创建进程的堆栈)